@nifrajs/core 2.14.1 → 3.2.0

package/dist/server/server.js

@@ -1,113 +1,28 @@
 import { admitDeadline, createRequestBudget, createUnboundedRequestBudget, NIFRA_DEADLINE_HEADER, } from "../budget.js";
 import { FrameworkError, RouteConfigError } from "../errors.js";
-import { CAPABILITY_GUARD, createCapabilityGuard, DEFAULT_CAPABILITY_INTERCEPTOR_TIMEOUT_MS, normalizeRouteCapabilities, } from "../internal/capability-runtime.js";
-import { assuranceDeclarationsOf, assuranceEvidenceFor, NIFRA_ASSURANCE_IDS, validEvidenceId, } from "../internal/route-assurance.js";
+import { DEFAULT_CAPABILITY_INTERCEPTOR_TIMEOUT_MS, } from "../internal/capability-runtime.js";
+import { assuranceDeclarationsOf, assuranceEvidenceFor, } from "../internal/route-assurance.js";
 import { RouteCatalog } from "../internal/route-catalog.js";
+import { compileRouteOptions } from "../internal/route-compiler.js";
 import { compileRouteExecutionPlan, } from "../internal/route-execution.js";
+import { compileRouteProgram, executeRouteProgram } from "../internal/route-program.js";
 import { isSameOriginRequest } from "../internal/same-origin.js";
-import { compileRoutePattern, decodeRouteParams } from "../router/pattern.js";
+import { decodeRouteParams } from "../router/pattern.js";
 import { EMPTY_PARAMS, Router } from "../router/router.js";
-import { assertByteLimit, markTransportCap, markTrustedBodyFraming, } from "./body.js";
+import { emitRequestErrorLog, renderBareError } from "./bare-error-lane.js";
+import { assertByteLimit, markTransportCap, markTrustedBodyFraming, UNLIMITED_BODY_BYTES, } from "./body.js";
 import { resolveClientIp } from "./client-ip.js";
 import { hasLowercaseHeaderKeysMark, headerKeysAllLowercase, markLowercaseHeaderKeys, } from "./header-case.js";
 import { headerObjectOf } from "./headers.js";
-import { jsonError, pathnameOf, urlPartsOf } from "./http.js";
+import { jsonError, pathnameOf, plainError, urlPartsOf } from "./http.js";
 import { withStaticNodeHeaders } from "./node-outcome.js";
-import { recordHeadersView, } from "./node-outcome-hook.js";
-import { isUrlEncodedForm, queryObjectOf, readBoundedForm, searchOf, } from "./query.js";
-import { RequestContext, readBoundedJsonSource } from "./request-context.js";
-import { applyStaticResponseHeaders, buildStaticResponseHeaders, fusedRespond, fusedRespondNoSet, knownMutableHeaders, rememberMutableHeaders, taggedResponseBody, toResponse, } from "./respond.js";
-import { applyBodyReplacement, withReplacedBody } from "./response-hooks.js";
-import { CONTEXT_SEARCH, CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, getNeverAbortSignal, getUnboundedRequestBudget, headerOf, requestOf, } from "./runtime-core.js";
+import { queryObjectOf, searchOf } from "./query.js";
+import { RequestContext, readBodyFramed } from "./request-context.js";
+import { applyStaticResponseHeaders, buildStaticResponseHeaders, fusedRespond, fusedRespondNoSet, toResponse, } from "./respond.js";
+import { CONTEXT_SEARCH, CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, getNeverAbortSignal, getUnboundedRequestBudget, headerOf, isResponseResult, requestOf, } from "./runtime-core.js";
 import { normalizeStaticResponseHeaders } from "./static-headers.js";
-const HEADER_MUTABILITY_PROBE = "x-nifra-header-probe";
-const GUARDED_RESPONSE_HEADERS = new WeakSet();
-/**
- * Detect a guarded Web Headers object before invoking user code. Retrying after catching any
- * TypeError is observably wrong: user hooks are allowed to throw TypeError themselves, and a retry
- * runs those hooks twice. The hot path never reaches the probe: every framework-constructed
- * Response stamps its headers as known-mutable at construction (see respond.ts), so only a
- * handler-returned foreign `Response` - the case that can actually be guarded - pays it, once per
- * headers object. The probe uses a valid private header name and restores a pre-existing value, so
- * the fallback is limited to the actual immutable/guarded-header case.
- */
-function hasMutableResponseHeaders(headers) {
-    if (knownMutableHeaders(headers))
-        return true;
-    if (GUARDED_RESPONSE_HEADERS.has(headers))
-        return false;
-    let previous = null;
-    try {
-        previous = headers.get(HEADER_MUTABILITY_PROBE);
-        headers.set(HEADER_MUTABILITY_PROBE, "1");
-        if (previous === null)
-            headers.delete(HEADER_MUTABILITY_PROBE);
-        else
-            headers.set(HEADER_MUTABILITY_PROBE, previous);
-        rememberMutableHeaders(headers);
-        return true;
-    }
-    catch {
-        try {
-            if (previous === null)
-                headers.delete(HEADER_MUTABILITY_PROBE);
-            else
-                headers.set(HEADER_MUTABILITY_PROBE, previous);
-        }
-        catch {
-            // The guarded object rejected the cleanup too; the clone below is authoritative.
-        }
-        GUARDED_RESPONSE_HEADERS.add(headers);
-        return false;
-    }
-}
-/** Adapt a portable {@link ResponseBodyHook} into the Web `onResponse` walk. Only a Response
- * carrying the framework-buffered body tag participates - a raw or streamed Response is skipped by
- * contract, never drained. */
-function webResponseBodyHook(fn, owners) {
-    return (response, req) => {
-        const body = taggedResponseBody(response, owners);
-        if (body === undefined)
-            return response;
-        const out = fn(body, response.headers, webRequestView(req), response.status);
-        if (out instanceof Promise)
-            return out.then((replaced) => withReplacedBody(response, replaced));
-        return withReplacedBody(response, out);
-    };
-}
-/** Minimal request view over a Web `Request` for portable header hooks on the Web serving paths. */
-function webRequestView(req) {
-    return { method: req.method, url: req.url, header: (name) => req.headers.get(name) };
-}
-/**
- * Adapt a portable {@link ResponseHeadersHook} into the Web `onResponse` walk: run it against the
- * response's own `Headers` in place (no clone). A response whose headers are GUARDED (a raw
- * `fetch()`ed Response returned by a handler) throws on the FIRST mutation, so nothing was applied
- * yet - rerun once against a mutable copy. Async hooks should perform their mutations before their
- * first await for the guard fallback to cover them.
- */
-function webResponseHeadersHook(fn) {
-    return (response, req) => {
-        const view = webRequestView(req);
-        if (!hasMutableResponseHeaders(response.headers)) {
-            const clone = new Response(response.body, response);
-            const out = fn(clone.headers, view, clone.status);
-            return out instanceof Promise ? out.then(() => clone) : clone;
-        }
-        const out = fn(response.headers, view, response.status);
-        return out instanceof Promise ? out.then(() => response) : response;
-    };
-}
-/** Adapt a raw-response fallback hook. Tagged framework payloads already ran through the body tier,
- * while untagged Responses include streams, proxied fetches, and framework-generated error responses. */
-function webResponseRawHook(fn, owners) {
-    return (response, req) => {
-        if (taggedResponseBody(response, owners) !== undefined)
-            return response;
-        return fn(response, req);
-    };
-}
-import { INSTALL_EFFECT_LEDGER, INSTALL_IDEMPOTENCY, INSTALL_MCP, INSTALL_NODE_DIRECT, INSTALL_RESPONSE_CONTRACT, INSTALL_SSE, INSTALL_WS, } from "./install.js";
+import { plainValidationError } from "./validation.js";
+import { INSTALL_EFFECT_LEDGER, INSTALL_IDEMPOTENCY, INSTALL_MCP, INSTALL_NODE_DIRECT, INSTALL_RESPONSE_CONTRACT, INSTALL_RESPONSE_OBSERVER, INSTALL_SSE, INSTALL_WS, NODE_NATIVE_MOUNT, RESOLVE_NODE_MOUNT, } from "./install.js";
 import { jsonLogger } from "./logger.js";
 const functionToString = Function.prototype.toString;
 const CONTEXTLESS_ARROW = /^(?:async\s*)?\(\s*\)\s*(?::[\s\S]*?)?=>/;
@@ -162,16 +77,13 @@ const STOP_HOOK_TIMEOUT_MS = 5_000;
  * owner, shared with the server-function mount in `@nifrajs/web` - the two used to answer differently
  * for the same request, so a browser that could open a socket was told its POST was cross-origin. */
 const wsSameOrigin = isSameOriginRequest;
-function validationError(issues) {
-    const serialized = issues.map((issue) => {
-        const path = issue.path?.map((seg) => String(typeof seg === "object" ? seg.key : seg));
-        return path !== undefined ? { message: issue.message, path } : { message: issue.message };
-    });
-    return Response.json({ ok: false, error: "validation", issues: serialized }, { status: 422 });
-}
 // `jsonError`, `urlPartsOf`, `pathnameOf` moved to `./http.ts` (a dependency-free leaf shared with the
 // opt-in request lanes); re-exported so existing importers keep resolving from here.
 export { pathnameOf, urlPartsOf } from "./http.js";
+/** The 422 as plain data - the shape every lane's response wrapper takes, so a rejected body costs
+ * what an accepted one costs: on Node it is written straight to the socket with a `content-length`
+ * instead of being built as a `Response` and drained back out. */
+export { plainValidationError } from "./validation.js";
 // Query-string + urlencoded-form parsing now lives in `./query.ts`; re-exported so existing
 // importers keep resolving `searchOf`/`queryObjectOf`/`QueryValue` from here.
 export { queryObjectOf, searchOf };
@@ -220,8 +132,15 @@ function isContextlessNoArgArrow(handler) {
         return false;
     }
 }
+/**
+ * The Web lanes' `wrapResponse` input, as a `Response`. A plain-data carrier ({@link plainError},
+ * `status(...)`) is rendered on the ordinary JSON lane rather than through its own `toResponse`, so
+ * it picks up the same prebuilt init a handler's plain return uses. `EMPTY_RESPONSE_CONTROLS` because
+ * these renders happen where no request context exists - before routing, or after it was abandoned.
+ */
+const webResponseOf = (result) => result instanceof Response ? result : toResponse(result, EMPTY_RESPONSE_CONTROLS);
 // Stable module-level finalizers so `fetch`/`resolveNode` allocate no per-request closures.
-const IDENTITY_RESPONSE = (response) => response;
+const IDENTITY_RESPONSE = (response) => webResponseOf(response);
 const RESPONSE_TIMEOUT = () => jsonError(503, "request_timeout");
 // The unused-order-scoped-hook audit (recorder, seal check, stack capture, message) is a dev-time
 // diagnostic. Every guard below keeps the INLINE literal `process.env.NODE_ENV !== "production"` at the
@@ -316,6 +235,13 @@ export class Server {
      * Created by the first `app.ws()` via the `@nifrajs/core/ws` runtime - `undefined` until then, so a
      * no-WebSocket app never constructs (or bundles) it. */
     topics;
+    /** True once any `app.ws()` route sets `validateSend: true` - the one case where a broadcast frame
+     * is validated (and possibly dropped) per socket, so `app.publish` must stay on the JS registry loop
+     * rather than delegate to Bun's native `server.publish`. */
+    wsHasValidatedSend = false;
+    /** Bun's native topic broadcast, bound by `listen()` in native-pubsub mode; `app.publish` uses it
+     * instead of the JS registry. `undefined` off Bun, before `listen()`, or with a validated-send route. */
+    nativePublish;
     maxBodyBytes;
     protoPoisoning;
     /** `trustBodyFraming`: mark every `app.fetch` request as runtime-framed (see ServerOptions). */
@@ -525,6 +451,11 @@ export class Server {
      * declared *after* this call, and reaches none declared before. One added after the last route
      * (e.g. on the app returned by a route-registering factory) covers nothing - see
      * {@link ServerOptions.unusedScopedHooks}.
+     *
+     * Returning a `status(...)` (or a `Response`) instead of an extension ends the request there - the
+     * guard shape, and the cheap one: it renders as plain data on the same lane a handler's return
+     * takes, where `throw new Response(...)` pays ~40% of the rejection lane to build the object. That
+     * branch is control flow, so it does not widen the derived context type.
      */
     derive(fn) {
         this.assertConfigurable("derive()");
@@ -671,19 +602,33 @@ export class Server {
      * hook owns part of the header state - into a hook that runs in the right order. */
     addStaticResponseHeaders(record) {
         if (this.onResponseHooks.length > 0) {
-            return this.onResponseHeaders((headers) => {
-                for (const name of Object.keys(record)) {
-                    if (!headers.has(name))
-                        headers.set(name, record[name]);
-                }
-            });
+            const observerHeaders = this.onResponseHeaders;
+            if (observerHeaders !== undefined) {
+                observerHeaders.call(this, (headers) => {
+                    for (const name of Object.keys(record)) {
+                        if (!headers.has(name))
+                            headers.set(name, record[name]);
+                    }
+                });
+                return this;
+            }
+            // Route the hook through the same seam the static tier uses. On a framework response (headers
+            // stamped mutable) it applies the defaults in place and returns the SAME object, so the
+            // serialized-body marker survives for later `onResponseBody`/`onResponseRaw` observers and the
+            // Node writer; reconstructing a `Response` here would strip that marker and reclassify the Node
+            // outcome from `json` to a generic `response`. A guarded foreign response takes its clone path.
+            const statics = buildStaticResponseHeaders(record);
+            this.onResponseHooks.push((response) => applyStaticResponseHeaders(response, statics));
+            this.onNodeResponseHooks.push(undefined);
+            this.nodeResponseHooksComplete = false;
+            return this;
         }
         const merged = this.staticResponseHeaders === undefined
             ? record
             : { ...this.staticResponseHeaders.record, ...record };
         this.staticResponseHeaders = buildStaticResponseHeaders(merged);
         const statics = this.staticResponseHeaders;
-        this.wrapWebResponse = (response) => applyStaticResponseHeaders(response, statics);
+        this.wrapWebResponse = (response) => applyStaticResponseHeaders(webResponseOf(response), statics);
         this.webResponseTimeout = () => applyStaticResponseHeaders(RESPONSE_TIMEOUT(), statics);
         return this;
     }
@@ -694,58 +639,14 @@ export class Server {
         }
         return this.responseBodyTag;
     }
-    /**
-     * Register a response transform for raw/streamed Responses. Framework-serialized payloads stay on
-     * the body tier; this hook is only entered for untagged Responses (streams, proxied fetches, and
-     * framework-generated error responses). A no-op native twin keeps buffered JSON on the direct lane.
-     */
-    onResponseRaw(fn) {
-        this.assertConfigurable("onResponseRaw()");
-        this.enableResponseBodyTagging();
-        this.onResponseHooks.push(webResponseRawHook(fn, this.responseBodyOwners));
-        this.onNodeResponseHooks.push(() => undefined);
-        return this;
-    }
-    /**
-     * Register a PORTABLE header-only response hook - one implementation, fast on every runtime.
-     *
-     * The hook receives a mutable case-insensitive header view, a minimal request view, and the
-     * status. On the Web serving paths it runs inside the normal `onResponse` walk against the
-     * response's own `Headers` (mutating in place - no clone). On Node it self-pairs as a native
-     * response hook against the outcome's plain header record, so registering one NEVER forces the
-     * Node adapter off its direct socket writer the way a full `onResponse(res: Response)` hook does.
-     * Prefer this over `onResponse` whenever the middleware only reads/writes headers.
-     */
-    onResponseHeaders(fn) {
-        this.assertConfigurable("onResponseHeaders()");
-        this.onResponseHooks.push(webResponseHeadersHook(fn));
-        this.onNodeResponseHooks.push((response, req) => fn(recordHeadersView(response), req, response.status));
-        return this;
-    }
-    /**
-     * Register a PORTABLE post-serialization body hook - the payload tier. The hook receives the
-     * FINAL framework-serialized bytes (plus the mutable header view and status) and may return
-     * replacement bytes; `undefined` keeps the body. On the Node direct writer the bytes come
-     * straight off the outcome record; on the Web serving paths they ride the framework-built
-     * Response as a tag, so no body stream is ever drained on any runtime. A handler-returned raw
-     * `Response` (proxied fetch, SSE, streamed SSR) is skipped by contract - transforming those is
-     * what the full `onResponse` hook is for.
-     */
-    onResponseBody(fn) {
-        this.assertConfigurable("onResponseBody()");
-        this.enableResponseBodyTagging();
-        this.onResponseHooks.push(webResponseBodyHook(fn, this.responseBodyOwners));
-        this.onNodeResponseHooks.push((response, req) => {
-            const body = response.body;
-            if (body === null)
-                return undefined;
-            const out = fn(body, recordHeadersView(response), req, response.status);
-            if (out instanceof Promise)
-                return out.then((replaced) => applyBodyReplacement(response, replaced));
-            applyBodyReplacement(response, out);
-            return undefined;
-        });
-        return this;
+    responseObserverMethods() {
+        const methods = this;
+        if (typeof methods.onResponseHeaders !== "function" ||
+            typeof methods.onResponseBody !== "function" ||
+            typeof methods.onResponseRaw !== "function") {
+            throw new TypeError("response observation requires `.use(responseObserver())` or an observer-enabled middleware");
+        }
+        return methods;
     }
     /** Observe the terminal response after all transformations. Observers are ordered and fail-open. */
     onResponseFinalized(fn) {
@@ -791,6 +692,15 @@ export class Server {
         }
         this.globalAssurance.push(...evidence.filter((item) => item.scope === "global"));
         this.activeAssurance.push(...evidence.filter((item) => item.scope === "subsequent"));
+        const responseObserver = arg[INSTALL_RESPONSE_OBSERVER];
+        if (responseObserver !== undefined) {
+            if (typeof responseObserver !== "object" ||
+                responseObserver === null ||
+                typeof responseObserver.install !== "function") {
+                throw new TypeError("response observer middleware has an invalid runtime");
+            }
+            this[INSTALL_RESPONSE_OBSERVER](responseObserver);
+        }
         if (arg.onRequest !== undefined) {
             this.assertConfigurable("onRequest()");
             this.onRequestHooks.push(arg.onRequest);
@@ -824,11 +734,11 @@ export class Server {
         if (arg.responseHeaders !== undefined)
             this.responseHeaders(arg.responseHeaders);
         if (arg.onResponseHeaders !== undefined)
-            this.onResponseHeaders(arg.onResponseHeaders);
+            this.responseObserverMethods().onResponseHeaders(arg.onResponseHeaders);
         if (arg.onResponseBody !== undefined)
-            this.onResponseBody(arg.onResponseBody);
+            this.responseObserverMethods().onResponseBody(arg.onResponseBody);
         if (arg.onResponseRaw !== undefined)
-            this.onResponseRaw(arg.onResponseRaw);
+            this.responseObserverMethods().onResponseRaw(arg.onResponseRaw);
         if (arg.onResponseFinalized !== undefined)
             this.onResponseFinalized(arg.onResponseFinalized);
         if (arg.onError !== undefined)
@@ -935,6 +845,13 @@ export class Server {
         // Boot-time guard: the WS runtime is a subpath (`@nifrajs/core/ws`) so no-WebSocket apps don't
         // bundle it. Registration is the loud, early failure point - never the first connection.
         const runtime = requireWsRuntime(this.wsRuntime);
+        if (handler.validateSend === true && handler.sendSchema === undefined) {
+            throw new RouteConfigError("INVALID_WS_SEND_VALIDATION", `route WS ${path}: validateSend requires sendSchema`);
+        }
+        // A validated-send route makes broadcast bytes route-dependent (drop-on-invalid per socket), so the
+        // whole app forgoes native pub/sub and keeps the JS registry loop that runs each send through the sender.
+        if (handler.validateSend === true)
+            this.wsHasValidatedSend = true;
         this.topics ??= runtime.createTopics();
         // A `messageSchema` wraps `message` with validation once, here - every adapter then dispatches
         // already-validated, typed messages (Bun/Deno/Node/Workers) with no per-adapter code.
@@ -950,6 +867,12 @@ export class Server {
      * an external fan-out (Redis, a Durable Object) to this. A no-op when nobody is subscribed.
      */
     publish(topic, data) {
+        // Native-pubsub mode (Bun, no validated-send route): one native broadcast to every subscriber, no
+        // per-connection JS loop. Bound only after `listen()`; before that (or off Bun) the registry runs.
+        if (this.nativePublish !== undefined) {
+            this.nativePublish(topic, data);
+            return;
+        }
         // No `app.ws()` yet ⇒ no registry and necessarily no subscribers - a publish is a no-op anyway.
         this.topics?.publish(topic, data);
     }
@@ -986,197 +909,88 @@ export class Server {
         this.catalog.addBatch(staged);
     }
     prepareRoute(method, path, schema, handler) {
-        const pattern = compileRoutePattern(path);
-        let bodyLimit = this.maxBodyBytes;
-        const invalidBodyLimit = (message) => {
-            throw new RouteConfigError("INVALID_BODY_LIMIT", `route ${method} ${path}: ${message}`);
-        };
-        if (schema?.bodyLimitReason !== undefined && schema.bodyLimit !== "unlimited") {
-            invalidBodyLimit('bodyLimitReason is only valid with bodyLimit: "unlimited"');
-        }
-        if (schema?.bodyLimit === "unlimited") {
-            if (typeof schema.bodyLimitReason !== "string" ||
-                schema.bodyLimitReason.trim().length === 0) {
-                invalidBodyLimit('bodyLimit: "unlimited" requires a non-empty bodyLimitReason');
-            }
-            bodyLimit = undefined;
-        }
-        else if (schema?.bodyLimit !== undefined) {
-            try {
-                assertByteLimit(schema.bodyLimit, "route bodyLimit");
-            }
-            catch {
-                invalidBodyLimit('bodyLimit must be a non-negative safe integer or "unlimited"');
-            }
-            bodyLimit = schema.bodyLimit;
-        }
-        const capabilities = normalizeRouteCapabilities(schema?.capabilities);
-        const handlerAssurance = assuranceDeclarationsOf(handler);
-        const invalidHandlerScope = handlerAssurance.find((declaration) => declaration.scope !== "plugin");
-        if (invalidHandlerScope !== undefined) {
-            throw new RouteConfigError("INVALID_ASSURANCE", `route handler assurance must use plugin scope (received ${invalidHandlerScope.scope})`);
-        }
-        const authenticated = assuranceEvidenceFor([...this.activeAssurance, ...handlerAssurance, ...this.globalAssurance], method, path).some((evidence) => evidence.id === NIFRA_ASSURANCE_IDS.AUTHENTICATED);
-        const routeDecorations = { ...this.decorations };
-        if (capabilities.length > 0) {
-            routeDecorations[CAPABILITY_GUARD] = createCapabilityGuard(capabilities, method, path, this.onCapabilityUse, this.idempotencyRuntime?.trackEffect, Object.freeze([...this.capabilityInterceptors]), Object.freeze([...this.capabilityObservers]));
-        }
-        const hasDecorations = Reflect.ownKeys(routeDecorations).length > 0;
-        // An idempotency route runs a dedupe lane that must buffer the body and capture the response, so it
-        // never takes the fused/native fast path - force it onto the portable matched lane (which routes
-        // through `fetchMatched`, where the dedupe wrapper lives). Fail closed: a route may not declare
-        // idempotency unless the idempotency runtime is installed, so the safety gate can never be silently
-        // dropped by a missing plugin.
-        if (schema?.idempotency !== undefined && this.idempotencyRuntime === undefined) {
-            throw new RouteConfigError("INVALID_IDEMPOTENCY", "route declares idempotency but the idempotency plugin is not installed; add .use(idempotency())");
-        }
-        const idempotent = this.idempotencyRuntime?.resolve(schema, authenticated, this.maxBodyBytes);
-        // A ledgered route (capabilities declared + `.use(effectLedger())`) needs a per-request
-        // context to carry the ledger and a settle step to seal + sink it, so it too leaves the
-        // fused/contextless fast path. Resolved per route, at registration - like the capability guard.
-        const ledgered = this.effectLedgerRuntime?.resolve(capabilities, method, path);
-        // A checked response schema needs the handler's VALUE before it becomes bytes, and the fused and
-        // native lanes exist precisely to skip that step. So a contracted route leaves them - the same
-        // structural trade an idempotent route makes above. The check itself is not the cost: a compiled
-        // validator measures ~100ns/response, within benchmark noise on any route these lanes already
-        // exclude (middleware, derives, lifecycle hooks).
-        const runtime = this.responseContractRuntime;
-        const contracted = runtime !== undefined && schema?.response !== undefined
-            ? { runtime, schema: schema.response }
-            : undefined;
-        const bare = schema?.params === undefined &&
-            schema?.headers === undefined &&
-            schema?.body === undefined &&
-            schema?.query === undefined &&
-            idempotent === undefined &&
-            ledgered === undefined &&
-            contracted === undefined &&
-            this.derives.length === 0 &&
-            this.beforeHandleHooks.length === 0 &&
-            this.afterHandleHooks.length === 0 &&
-            this.onErrorHooks.length === 0;
-        // A route whose ONLY lifecycle step is a query schema can fuse too: the parse + validate +
-        // handler + respond collapse into one closure with no lifecycle promise on the sync path. The
-        // guards mirror the `query` lane below PLUS everything the fused dispatch skips: around hooks,
-        // the idempotency/ledger wrappers, and validation-error recovery (schema or server default) -
-        // the fused invalid path is exactly `validationError(issues)`, so any recovery semantics keep
-        // the generic lane.
-        const fusedQuery = !bare &&
-            contracted === undefined &&
-            schema?.query !== undefined &&
-            schema.body === undefined &&
-            schema.params === undefined &&
-            schema.headers === undefined &&
-            schema.onValidationError === undefined &&
-            this.defaultOnValidationError === undefined &&
-            idempotent === undefined &&
-            ledgered === undefined &&
-            this.derives.length === 0 &&
-            this.beforeHandleHooks.length === 0 &&
-            this.afterHandleHooks.length === 0 &&
-            this.onErrorHooks.length === 0 &&
-            this.aroundHooks.length === 0;
-        const bodyOnly = contracted === undefined &&
-            schema?.body !== undefined &&
-            schema.query === undefined &&
-            schema.params === undefined &&
-            schema.headers === undefined &&
-            this.derives.length === 0 &&
-            this.beforeHandleHooks.length === 0 &&
-            this.afterHandleHooks.length === 0 &&
-            this.onErrorHooks.length === 0;
-        const fusedBody = !bare &&
-            bodyOnly &&
-            schema.onValidationError === undefined &&
-            this.defaultOnValidationError === undefined &&
-            idempotent === undefined &&
-            ledgered === undefined &&
-            this.aroundHooks.length === 0;
-        // Body-only routes still need an async body read, but eligible routes can compile the validation +
-        // handler continuation once. The runner keeps the bounded parser and all error semantics while
-        // avoiding the generic entry/schema/lifecycle dispatch on Bun, Deno, and Node-direct.
+        const compiled = compileRouteOptions({
+            maxBodyBytes: this.maxBodyBytes,
+            activeAssurance: this.activeAssurance,
+            globalAssurance: this.globalAssurance,
+            decorations: this.decorations,
+            onCapabilityUse: this.onCapabilityUse,
+            capabilityInterceptors: this.capabilityInterceptors,
+            capabilityObservers: this.capabilityObservers,
+            effectLedgerRuntime: this.effectLedgerRuntime,
+            idempotencyRuntime: this.idempotencyRuntime,
+            responseContractRuntime: this.responseContractRuntime,
+            derives: this.derives,
+            beforeHandleHooks: this.beforeHandleHooks,
+            afterHandleHooks: this.afterHandleHooks,
+            onErrorHooks: this.onErrorHooks,
+            aroundHooks: this.aroundHooks,
+            defaultOnValidationError: this.defaultOnValidationError,
+        }, method, path, schema, handler);
+        const { pattern, bodyLimit, capabilities, routeDecorations, hasDecorations, idempotent, ledgered, responseContract, lanes, routeAssurance, } = compiled;
+        const { bare, fusedQuery, fusedBody } = lanes;
         const fusedBodyRunner = fusedBody
-            ? this.buildFusedBodyRunner(handler, schema.body, hasDecorations ? routeDecorations : undefined, bodyLimit ?? this.maxBodyBytes)
+            ? this.buildFusedBodyRunner(handler, schema?.body, hasDecorations ? routeDecorations : undefined, bodyLimit ?? UNLIMITED_BODY_BYTES)
             : undefined;
+        // Fused lifecycle lanes: derive + before (with or without an after), and body + the same shape.
+        // The lane selectors in `selectRouteLanes` are exhaustive about the lifecycleHookLane /
+        // body-derive-before-after eligibility, so we only need to check the lane and the hook counts.
+        const lifecycleHookLane = lanes.lifecycleHookLane;
+        const isFusedLifecycle = lifecycleHookLane !== undefined && this.derives.length === 1;
+        const isFusedBodyLifecycle = lanes.fusedLane === "body-derive-before" || lanes.fusedLane === "body-derive-before-after";
         const fusedWeb = bare && this.aroundHooks.length === 0
-            ? this.buildFusedWeb(handler, hasDecorations ? routeDecorations : undefined, isContextlessNoArgArrow(handler), bodyLimit ?? this.maxBodyBytes)
+            ? this.buildFusedWeb(handler, hasDecorations ? routeDecorations : undefined, isContextlessNoArgArrow(handler), bodyLimit ?? UNLIMITED_BODY_BYTES)
             : fusedQuery
-                ? this.buildFusedQueryWeb(handler, hasDecorations ? routeDecorations : undefined, schema.query, bodyLimit ?? this.maxBodyBytes)
+                ? this.buildFusedQueryWeb(handler, hasDecorations ? routeDecorations : undefined, schema?.query, bodyLimit ?? UNLIMITED_BODY_BYTES)
                 : fusedBody
                     ? this.buildFusedBodyWeb(fusedBodyRunner)
-                    : undefined;
-        const contextless = bare && this.aroundHooks.length === 0 && isContextlessNoArgArrow(handler);
-        // The body and query lanes finalize the handler's result themselves, so a contracted route takes
-        // the general lifecycle lane instead - one place owns the check rather than three.
-        const lane = bare
-            ? "bare"
-            : bodyOnly
-                ? "body"
-                : contracted === undefined &&
-                    schema?.body === undefined &&
-                    schema?.query !== undefined &&
-                    schema.params === undefined &&
-                    schema.headers === undefined &&
-                    this.derives.length === 0 &&
-                    this.beforeHandleHooks.length === 0 &&
-                    this.afterHandleHooks.length === 0 &&
-                    this.onErrorHooks.length === 0
-                    ? "query"
-                    : "lifecycle";
-        // Lifecycle routes with no params schema are the common middleware shape: a derive/before hook
-        // plus an optional query or body schema. Select their complete validation stage at registration
-        // so the request path never re-checks params/body presence. Parameter-schema routes retain the
-        // generic lifecycle runner until their more involved recovery matrix is selected explicitly.
-        const lifecycleLane = lane !== "lifecycle" || schema?.params !== undefined || schema?.headers !== undefined
-            ? undefined
-            : schema?.body !== undefined
-                ? schema.query !== undefined
-                    ? "body-query"
-                    : "body"
-                : schema?.query !== undefined
-                    ? "query"
-                    : "hooks";
-        // The realistic middleware shape is commonly exactly one synchronous-or-async derive followed
-        // by one before hook. Keep the generic runner for every route that can observe decorations,
-        // after hooks, error hooks, or response contracts; this lane only removes the two per-request
-        // hook-loop dispatches and preserves the same async continuations and error handling.
-        const lifecycleHookLane = lane === "lifecycle" &&
-            contracted === undefined &&
-            !hasDecorations &&
-            this.derives.length === 1 &&
-            this.beforeHandleHooks.length === 1 &&
-            this.afterHandleHooks.length === 0 &&
-            this.onErrorHooks.length === 0
-            ? "derive-before"
-            : undefined;
+                    : isFusedBodyLifecycle
+                        ? this.buildFusedBodyDeriveBeforeAfter(handler, this.derives[0], this.beforeHandleHooks[0], this.afterHandleHooks[0], schema?.body, bodyLimit ?? UNLIMITED_BODY_BYTES)
+                        : isFusedLifecycle && lifecycleHookLane === "derive-before"
+                            ? this.buildFusedDeriveBefore(handler, this.derives[0], this.beforeHandleHooks[0], schema?.query, bodyLimit ?? UNLIMITED_BODY_BYTES)
+                            : isFusedLifecycle && lifecycleHookLane === "derive-before-after"
+                                ? this.buildFusedDeriveBeforeAfter(handler, this.derives[0], this.beforeHandleHooks[0], this.afterHandleHooks[0], schema?.query, bodyLimit ?? UNLIMITED_BODY_BYTES)
+                                : undefined;
+        const program = compileRouteProgram({
+            schema,
+            handler: handler,
+            derives: this.derives,
+            beforeHandle: this.beforeHandleHooks,
+            afterHandle: this.afterHandleHooks,
+            onError: this.onErrorHooks,
+            decorations: routeDecorations,
+            hasDecorations,
+            bodySchema: schema?.body,
+            bodyLimit,
+            responseContract,
+        });
+        const contextless = lanes.bare && this.aroundHooks.length === 0 && isContextlessNoArgArrow(handler);
         const execution = compileRouteExecutionPlan({
-            lane,
+            lane: lanes.lane,
             contextless,
             hasAround: this.aroundHooks.length > 0,
             hasLedger: ledgered !== undefined,
-            lifecycleLane,
             fusedWeb,
             fusedBody: fusedBodyRunner,
-            fusedLane: fusedWeb === undefined ? undefined : fusedQuery ? "query" : fusedBody ? "body" : "bare",
+            fusedLane: lanes.fusedLane,
         });
         const registeredEntry = {
-            // (context: never) => unknown -> InternalHandler: the framework invokes it
-            // with the concrete RawContext the typed handler expects, so this is sound.
             handler: handler,
             schema,
             bodyLimit,
             idempotent,
             ledgered,
-            responseContract: contracted,
+            responseContract,
             derives: [...this.derives],
             decorations: routeDecorations,
             hasDecorations,
             beforeHandle: [...this.beforeHandleHooks],
             afterHandle: [...this.afterHandleHooks],
             onError: [...this.onErrorHooks],
-            lifecycleHookLane,
+            lifecycleHookLane: lanes.lifecycleHookLane,
             around: [...this.aroundHooks],
             execution,
+            program,
         };
         const descriptor = {
             method,
@@ -1185,53 +999,13 @@ export class Server {
             ...(capabilities.length > 0 ? { capabilities } : {}),
             ...(schema?.family === true ? { family: true } : {}),
         };
-        const routeAssurance = [...this.activeAssurance, ...handlerAssurance];
-        if (contracted?.runtime.mode === "enforce" && schema?.response !== undefined) {
-            routeAssurance.push(Object.freeze({
-                id: NIFRA_ASSURANCE_IDS.RESPONSE_CONTRACT,
-                source: "response-contract",
-                scope: "plugin",
-            }));
-        }
-        // Inline `schema.assurance`: the route DECLARES its enforcement evidence adjacent to the handler, so an
-        // in-handler-guarded route satisfies a policy `require:` clause without a `withRouteAssurance` middleware
-        // rewrite. Each id becomes route-scoped `declared` evidence (invalid ids fail closed at registration).
-        for (const id of schema?.assurance ?? []) {
-            if (!validEvidenceId(id)) {
-                throw new Error(`route assurance: invalid evidence id ${JSON.stringify(id)} on ${method} ${path} (use lowercase dot/dash segments)`);
-            }
-            const declared = { id, source: "declared", scope: "plugin" };
-            Object.defineProperty(declared, "provenance", {
-                value: "declared",
-                enumerable: false,
-                configurable: false,
-                writable: false,
-            });
-            routeAssurance.push(Object.freeze(declared));
-        }
-        if (schema?.body !== undefined) {
-            routeAssurance.push(Object.freeze({
-                id: NIFRA_ASSURANCE_IDS.BODY_BOUNDED,
-                source: "route-schema",
-                scope: "plugin",
-            }));
-        }
-        // Declaring `schema.idempotency` is evidence for request replay only. It deliberately never proves
-        // durable command execution; that stronger evidence belongs to a command/outbox adapter.
-        if (schema?.idempotency !== undefined) {
-            routeAssurance.push(Object.freeze({
-                id: NIFRA_ASSURANCE_IDS.IDEMPOTENCY_KEY,
-                source: "route-schema",
-                scope: "plugin",
-            }));
-        }
         return {
             method,
             path,
             pattern,
             entry: registeredEntry,
             descriptor,
-            assurance: Object.freeze(routeAssurance),
+            assurance: routeAssurance,
         };
     }
     /** The idempotency lane's bridge back into the normal matched lanes, resolved to a concrete Response
@@ -1244,6 +1018,29 @@ export class Server {
         this.assertConfigurable("responseContract()");
         this.responseContractRuntime = runtime;
     }
+    /** @internal Symbol-keyed install seam for the response observer plugin. */
+    [INSTALL_RESPONSE_OBSERVER](runtime) {
+        this.assertConfigurable("responseObserver()");
+        const methods = runtime.install({
+            assertConfigurable: (operation) => this.assertConfigurable(operation),
+            addResponseHook: (web, node) => {
+                this.onResponseHooks.push(web);
+                this.onNodeResponseHooks.push(node);
+                if (node === undefined)
+                    this.nodeResponseHooksComplete = false;
+            },
+            enableResponseBodyTagging: () => {
+                if (this.responseBodyTag === undefined) {
+                    this.responseBodyTag = Object.freeze({});
+                    this.responseBodyOwners.add(this.responseBodyTag);
+                }
+                return this.responseBodyTag;
+            },
+            responseBodyOwners: () => this.responseBodyOwners,
+        });
+        Object.assign(this, methods);
+        return methods;
+    }
     /** @internal Symbol-keyed install seam for the `idempotency()` plugin. Off the public typed surface. */
     [INSTALL_IDEMPOTENCY](runtime) {
         this.assertConfigurable("idempotency()");
@@ -1373,14 +1170,37 @@ export class Server {
             return route;
         // Rebuild with the SAME builder that produced the closure - rebinding a query-fused route as
         // bare would silently drop its validation.
-        const fusedBody = entry.execution.fusedLane === "body"
-            ? this.buildFusedBodyRunner(entry.handler, entry.schema?.body, entry.hasDecorations ? entry.decorations : undefined, entry.bodyLimit ?? this.maxBodyBytes)
+        const lane = entry.execution.fusedLane;
+        // Type-erase the lane so each `===` branch sees the full union, not the narrowed remainder.
+        const laneName = lane;
+        // Body+lifecycle routes have a fused Web renderer, but no body-only Node renderer: the latter
+        // would bypass derive/before/after because the Node-direct dispatcher prefers `fusedBody` over
+        // the generic execution plan. Only the original body-only lane may populate this slot.
+        const fusedBody = laneName === "body"
+            ? this.buildFusedBodyRunner(entry.handler, entry.schema?.body, entry.hasDecorations ? entry.decorations : undefined, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
             : undefined;
-        const fusedWeb = entry.execution.fusedLane === "body"
+        const derive = entry.derives[0];
+        const before = entry.beforeHandle[0];
+        const after = entry.afterHandle[0];
+        const fusedWeb = laneName === "body"
             ? this.buildFusedBodyWeb(fusedBody)
-            : entry.execution.fusedLane === "query"
-                ? this.buildFusedQueryWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, entry.schema?.query, entry.bodyLimit ?? this.maxBodyBytes)
-                : this.buildFusedWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, isContextlessNoArgArrow(entry.handler), entry.bodyLimit ?? this.maxBodyBytes);
+            : laneName === "query"
+                ? this.buildFusedQueryWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, entry.schema?.query, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                : laneName === "body-derive-before" && derive !== undefined && before !== undefined
+                    ? this.buildFusedBodyDeriveBeforeAfter(entry.handler, derive, before, undefined, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                    : laneName === "body-derive-before-after" &&
+                        derive !== undefined &&
+                        before !== undefined &&
+                        after !== undefined
+                        ? this.buildFusedBodyDeriveBeforeAfter(entry.handler, derive, before, after, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                        : laneName === "derive-before" && derive !== undefined && before !== undefined
+                            ? this.buildFusedDeriveBefore(entry.handler, derive, before, entry.schema?.query, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                            : laneName === "derive-before-after" &&
+                                derive !== undefined &&
+                                before !== undefined &&
+                                after !== undefined
+                                ? this.buildFusedDeriveBeforeAfter(entry.handler, derive, before, after, entry.schema?.query, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                                : this.buildFusedWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, isContextlessNoArgArrow(entry.handler), entry.bodyLimit ?? UNLIMITED_BODY_BYTES);
         return {
             ...route,
             entry: {
@@ -1498,6 +1318,42 @@ export class Server {
         release();
         return outcome;
     }
+    /**
+     * Select a mounted handler's native Node lane without materializing a Web Request. This is an
+     * adapter seam, not a second lifecycle: any app-wide behavior that the ordinary mount path would
+     * run makes the capability ineligible and the caller falls back to `resolveNodeSource`. Typed
+     * routes keep precedence exactly as `routeAndRun` does, including the existing mount behavior for
+     * a path whose registered route rejects this method.
+     */
+    [RESOLVE_NODE_MOUNT](source) {
+        if (this.onRequestHooks.length > 0 ||
+            this.onResponseHooks.length > 0 ||
+            this.onResponseFinalizedHooks.length > 0 ||
+            this.capacityGate !== undefined ||
+            this.staticResponseHeaders !== undefined ||
+            this.requestTimeoutMs !== 0 ||
+            this.acceptInboundDeadlines ||
+            this.clientIpTrust !== undefined) {
+            return undefined;
+        }
+        const parts = source.urlParts ?? urlPartsOf(source.url);
+        const match = this.catalog.find(source.method, parts.pathname);
+        if (match.found)
+            return undefined;
+        for (const mount of this.fetchMounts) {
+            if (!underMountPrefix(parts.pathname, mount.path))
+                continue;
+            const candidate = mount.handler[NODE_NATIVE_MOUNT];
+            return typeof candidate === "function"
+                ? {
+                    handler: candidate,
+                    path: mount.path,
+                    stripPrefix: mount.stripPrefix,
+                }
+                : undefined;
+        }
+        return undefined;
+    }
     /**
      * Like {@link fetch}, but renders a plain-data result **without** building a Web `Response` - the
      * `@nifrajs/node` adapter serializes the returned primitives straight to the socket, skipping the undici
@@ -1983,7 +1839,7 @@ export class Server {
     /**
      * Route → build context → run. Synchronous through to the handler for a **bare** route
      * (selected by its compiled plan), so a sync handler produces its result with zero promise allocations;
-     * routes with validation/hooks keep the full async {@link runLifecycle}, unchanged.
+     * routes with validation/hooks keep the full compiled route program, unchanged.
      */
     routeAndRun(source, platform, finalize, wrapResponse, onTimeout, webFast) {
         // Routing only needs the pathname. Scan the URL once but keep the two slices in locals instead
@@ -2037,15 +1893,18 @@ export class Server {
                     : wrapResponse(mounted);
             }
             if (match.reason === "method-not-allowed") {
-                return wrapResponse(jsonError(405, "method_not_allowed", { Allow: match.allowed.join(", ") }));
+                return wrapResponse(
+                // Lowercase on purpose: a plain render's headers go into the node outcome record verbatim,
+                // and every other name in that record is lowercase (the Web lane normalizes either way).
+                plainError(405, "method_not_allowed", { allow: match.allowed.join(", ") }));
             }
-            return wrapResponse(jsonError(404, "not_found"));
+            return wrapResponse(plainError(404, "not_found"));
         }
         // Inspect only captured values for escapes. Scanning the full pathname repeated work the router
         // already did and made every plain dynamic route pay for unrelated static path bytes.
         const params = match.params === EMPTY_PARAMS ? match.params : decodeRouteParams(match.params);
         if (params === null) {
-            return wrapResponse(jsonError(400, "malformed_path"));
+            return wrapResponse(plainError(400, "malformed_path"));
         }
         return this.runMatched(source, platform, match.payload, params, search, finalize, wrapResponse, onTimeout, webFast);
     }
@@ -2080,7 +1939,7 @@ export class Server {
         // The runtime is always present when a route resolved idempotency (enforced at registration).
         if (entry.idempotent !== undefined && this.idempotencyRuntime !== undefined) {
             return this.idempotencyRuntime.run(entry.idempotent, requestOf(source), platform, entry, params, search, wrapResponse, {
-                maxBodyBytes: entry.bodyLimit ?? this.maxBodyBytes,
+                maxBodyBytes: entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
                 runLanes: (buffered, plat, ent, prm, srch) => this.idempotencyRunLanes(buffered, plat, ent, prm, srch),
             });
         }
@@ -2106,7 +1965,7 @@ export class Server {
                 ? undefined
                 : admitDeadline(source.headers, this.deadlineAdmissionOptions);
         if (admission !== undefined && !admission.ok) {
-            return wrapResponse(jsonError(admission.status, admission.reason));
+            return wrapResponse(plainError(admission.status, admission.reason));
         }
         const effectiveTimeoutMs = admission?.timeoutMs ?? 0;
         // Only allocate a controller for a finite budget; the historical no-timeout path remains
@@ -2131,7 +1990,7 @@ export class Server {
         // already complete and can't time out, so it's returned as-is (no 503 race, no promise).
         if (controller !== undefined && outcome instanceof Promise) {
             const timedOut = admission?.inherited === true
-                ? () => wrapResponse(jsonError(504, "deadline_exceeded"))
+                ? () => wrapResponse(plainError(504, "deadline_exceeded"))
                 : onTimeout;
             return this.withTimeout(outcome, controller, timedOut, Math.max(0, Math.ceil(budget.remaining())));
         }
@@ -2145,7 +2004,6 @@ export class Server {
     /** The narrowest bare route: a syntactic `() => ...` handler cannot observe the context argument, so
      * successful requests can skip allocating `RequestContext`. Errors still allocate one for logging. */
     // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-    // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
     runContextlessBare(entry, source, params, search, signal, budget, platform, finalize, wrapResponse) {
         let result;
         try {
@@ -2162,20 +2020,23 @@ export class Server {
     contextlessBareError(err, source, params, search, signal, budget, platform, wrapResponse) {
         if (err instanceof Response)
             return wrapResponse(err);
+        // Handed over as the plain data it is: `wrapResponse` renders it on the JSON lane (no `Response`
+        // built on Node). There is no context here by construction, so there is no `c.set` to merge.
+        if (isResponseResult(err))
+            return wrapResponse(err);
         const ctx = new RequestContext(source, params, search, signal, budget, platform, this.maxBodyBytes, this.protoPoisoning);
         this.logRequestError(err, ctx);
-        return wrapResponse(jsonError(500, "internal_error"));
+        return this.internalErrorResponse(wrapResponse);
     }
     /**
      * The synchronous fast path selected by a route's execution plan: apply static decorations, call the
      * handler, render the result - **no `await`** unless the handler itself returns a promise. It mirrors
-     * the bare slice of {@link runLifecycle} (which a bare route would otherwise no-op through) and shares
+     * the same error boundary as the compiled route program (which a bare route would otherwise no-op through) and shares
      * {@link logRequestError}; a bare route has no `onError` hooks, so error handling is fully synchronous
      * (a thrown `Response` is control flow; anything else is a logged flat 500). This is where nifra skips
      * the per-request async-frame tax - the same win codegen routers get, but without `eval`.
      */
     // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-    // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
     runBare(entry, ctx, finalize, wrapResponse) {
         let result;
         try {
@@ -2184,15 +2045,15 @@ export class Server {
             result = entry.handler(ctx);
         }
         catch (err) {
-            return this.bareError(err, ctx, wrapResponse);
+            return this.bareError(err, ctx, finalize, wrapResponse);
         }
         if (result instanceof Promise) {
             // Async handler on an otherwise-bare route: finish on a microtask, with the same error handling.
-            return result.then((value) => finalize(value, responseSet(ctx)), (err) => this.bareError(err, ctx, wrapResponse));
+            return result.then((value) => finalize(value, responseSet(ctx)), (err) => this.bareError(err, ctx, finalize, wrapResponse));
         }
         return finalize(result, responseSet(ctx));
     }
-    /** Bare-route error rendering - identical to {@link runLifecycle}'s catch minus the (absent) onError
+    /** Bare-route error rendering - identical to the compiled route program's catch minus the (absent) onError
      * loop: a thrown `Response` is returned as deliberate control flow; anything else is logged + 500. */
     /**
      * Build a route's fused Web renderer. Composition happens once at
@@ -2202,14 +2063,10 @@ export class Server {
      * 500s), same respond semantics (the lifecycle parity suite pins it).
      */
     buildFusedWeb(handler, decorations, contextless, maxBodyBytes) {
-        // The fused lanes return to the runtime directly, so the framework's own error renders fold in
-        // static headers here rather than through the shared `wrapResponse` seam.
-        const logError = (err, ctx) => {
-            if (err instanceof Response)
-                return this.wrapWebResponse(err);
-            this.logRequestError(err, ctx);
-            return this.wrapWebResponse(jsonError(500, "internal_error"));
-        };
+        // Same thrown-value contract as the generic lane (`bare-error-lane.ts` via `bareError`); the fused
+        // lane only injects its renderer, so a thrown `status(...)` and the flat 500 fold in static headers
+        // through `wrapWebResponse`. One source of truth for the error surface, no per-lane copy to drift.
+        const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
         if (contextless && decorations === undefined) {
             // `() => ...` can't observe the context - skip allocating one entirely (errors still build
             // one for the structured log, exactly like runContextlessBare).
@@ -2255,7 +2112,7 @@ export class Server {
      * bounded parser remains shared with the generic lane; only the route-invariant entry lookups and
      * lifecycle dispatch disappear from the common synchronous-validator/synchronous-handler case. */
     buildFusedBodyRunner(handler, bodySchema, decorations, maxBodyBytes) {
-        const logError = (err, ctx, wrapResponse) => this.bareError(err, ctx, wrapResponse);
+        const logError = (err, ctx, finalize, wrapResponse) => this.bareError(err, ctx, finalize, wrapResponse);
         const runHandler = (ctx, finalize, wrapResponse) => {
             if (decorations !== undefined)
                 Object.assign(ctx, decorations);
@@ -2264,7 +2121,7 @@ export class Server {
                 output = handler(ctx);
             }
             catch (err) {
-                return logError(err, ctx, wrapResponse);
+                return logError(err, ctx, finalize, wrapResponse);
             }
             if (output instanceof Promise) {
                 return output.then((result) => {
@@ -2272,20 +2129,20 @@ export class Server {
                         return finalize(result, responseSet(ctx), ctx);
                     }
                     catch (err) {
-                        return logError(err, ctx, wrapResponse);
+                        return logError(err, ctx, finalize, wrapResponse);
                     }
-                }, (err) => logError(err, ctx, wrapResponse));
+                }, (err) => logError(err, ctx, finalize, wrapResponse));
             }
             try {
                 return finalize(output, responseSet(ctx), ctx);
             }
             catch (err) {
-                return logError(err, ctx, wrapResponse);
+                return logError(err, ctx, finalize, wrapResponse);
             }
         };
         const runValidated = (result, ctx, finalize, wrapResponse) => {
             if (result.issues !== undefined)
-                return wrapResponse(validationError(result.issues));
+                return wrapResponse(plainValidationError(result.issues));
             ctx.body = result.value;
             return runHandler(ctx, finalize, wrapResponse);
         };
@@ -2295,7 +2152,7 @@ export class Server {
                 validation = bodySchema["~standard"].validate(parsed);
             }
             catch (err) {
-                return logError(err, ctx, wrapResponse);
+                return logError(err, ctx, finalize, wrapResponse);
             }
             if (validation instanceof Promise) {
                 return validation.then((settled) => {
@@ -2303,15 +2160,15 @@ export class Server {
                         return runValidated(settled, ctx, finalize, wrapResponse);
                     }
                     catch (err) {
-                        return logError(err, ctx, wrapResponse);
+                        return logError(err, ctx, finalize, wrapResponse);
                     }
-                }, (err) => logError(err, ctx, wrapResponse));
+                }, (err) => logError(err, ctx, finalize, wrapResponse));
             }
             try {
                 return runValidated(validation, ctx, finalize, wrapResponse);
             }
             catch (err) {
-                return logError(err, ctx, wrapResponse);
+                return logError(err, ctx, finalize, wrapResponse);
             }
         };
         return (source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse) => {
@@ -2319,7 +2176,7 @@ export class Server {
                 ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                 : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
             const finish = (value) => runParsed(value, ctx, finalize, wrapResponse);
-            return this.readBodyInput(source, maxBodyBytes, finish, wrapResponse, (err) => logError(err, ctx, wrapResponse));
+            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, finish, wrapResponse, (err) => logError(err, ctx, finalize, wrapResponse));
         };
     }
     /** Web adapter wrapper for the shared body runner. Node passes its native finalizer directly through
@@ -2335,14 +2192,10 @@ export class Server {
      * `Response` passes through, anything else logs and returns a flat 500, and an async validator
      * falls to a then-chain with the same steps. */
     buildFusedQueryWeb(handler, decorations, querySchema, maxBodyBytes) {
-        // The fused lanes return to the runtime directly, so the framework's own error renders fold in
-        // static headers here rather than through the shared `wrapResponse` seam.
-        const logError = (err, ctx) => {
-            if (err instanceof Response)
-                return this.wrapWebResponse(err);
-            this.logRequestError(err, ctx);
-            return this.wrapWebResponse(jsonError(500, "internal_error"));
-        };
+        // Same thrown-value contract as the generic lane (`bare-error-lane.ts` via `bareError`); the fused
+        // lane only injects its renderer, so a thrown `status(...)` and the flat 500 fold in static headers
+        // through `wrapWebResponse`. One source of truth for the error surface, no per-lane copy to drift.
+        const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
         const runHandler = (ctx, value) => {
             ctx.query = value;
             let result;
@@ -2372,22 +2225,346 @@ export class Server {
             }
             if (validation instanceof Promise) {
                 return validation.then((settled) => settled.issues !== undefined
-                    ? this.wrapWebResponse(validationError(settled.issues))
+                    ? this.wrapWebResponse(plainValidationError(settled.issues))
                     : runHandler(ctx, settled.value), (err) => logError(err, ctx));
             }
             if (validation.issues !== undefined)
-                return this.wrapWebResponse(validationError(validation.issues));
+                return this.wrapWebResponse(plainValidationError(validation.issues));
             return runHandler(ctx, validation.value);
         };
     }
-    bareError(err, ctx, wrapResponse) {
-        if (err instanceof Response)
-            return wrapResponse(err);
-        this.logRequestError(err, ctx);
-        return wrapResponse(jsonError(500, "internal_error"));
+    /**
+     * Compile a route's `derive + before` lifecycle to a single closure: the per-request walk through
+     * `runSync` → `runHooksSync` is a stack of 3 frames and 2 `Object.assign`s for what is by far the
+     * most common middleware shape (auth/trace/id derivation, an auth/policy `beforeHandle`). Folding
+     * the same steps into one closure hits the same monomorphic inline-cache site as `buildFusedWeb`,
+     * and `Object.assign(ctx, deriveResult)` becomes one extra property write on the context's already
+     * hot hidden class. Behavior is byte-identical to the compiled route program: the same thrown-value
+     * contract (`Response` is control flow, anything else logs + 500), the same `c.set` semantics, the
+     * same `fusedRespond` for the rendered body. The `LifecycleExecutionLane` guarantee
+     * (`schema.params === undefined && schema.headers === undefined && derives === 1 &&
+     * beforeHandle === 1 && afterHandle === 0 && onError === 0 && !hasResponseContract &&
+     * !hasDecorations`) is enforced by `selectRouteLanes`; this lane is selected ONLY when all of those
+     * hold. A `query` schema (the route declares `{ query }` alongside the hooks) is validated FIRST,
+     * mirroring the compiled route program's stage order; the fused builder runs validate → derive →
+     * before → handler in one frame.
+     */
+    buildFusedDeriveBefore(handler, derive, before, querySchema, maxBodyBytes) {
+        const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
+        return (source, params, search, signal, budget, platform, nativeContext) => {
+            const ctx = nativeContext
+                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
+            const runHandler = () => {
+                let result;
+                try {
+                    result = handler(ctx);
+                }
+                catch (err) {
+                    return logError(err, ctx);
+                }
+                if (result instanceof Promise) {
+                    return result.then((value) => fusedRespond(value, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
+                }
+                return fusedRespond(result, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
+            };
+            const runBefore = () => {
+                let early;
+                try {
+                    early = before(ctx);
+                }
+                catch (err) {
+                    return logError(err, ctx);
+                }
+                if (early instanceof Promise) {
+                    return early.then((settled) => {
+                        if (settled === undefined)
+                            return runHandler();
+                        return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                    }, (err) => logError(err, ctx));
+                }
+                if (early === undefined)
+                    return runHandler();
+                return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders);
+            };
+            const runDerive = () => {
+                let derived;
+                try {
+                    derived = derive(ctx);
+                }
+                catch (err) {
+                    return logError(err, ctx);
+                }
+                if (derived instanceof Promise) {
+                    return derived.then((settled) => {
+                        if (isResponseResult(settled) || settled instanceof Response) {
+                            return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                        }
+                        Object.assign(ctx, settled);
+                        return runBefore();
+                    }, (err) => logError(err, ctx));
+                }
+                if (isResponseResult(derived) || derived instanceof Response) {
+                    return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                }
+                Object.assign(ctx, derived);
+                return runBefore();
+            };
+            if (querySchema === undefined)
+                return runDerive();
+            let validation;
+            try {
+                validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
+            }
+            catch (err) {
+                return logError(err, ctx);
+            }
+            if (validation instanceof Promise) {
+                return validation.then((settled) => {
+                    if (settled.issues !== undefined)
+                        return this.wrapWebResponse(plainValidationError(settled.issues));
+                    ctx.query = settled.value;
+                    return runDerive();
+                }, (err) => logError(err, ctx));
+            }
+            if (validation.issues !== undefined)
+                return this.wrapWebResponse(plainValidationError(validation.issues));
+            ctx.query = validation.value;
+            return runDerive();
+        };
+    }
+    /**
+     * Same shape as `buildFusedDeriveBefore`, plus one `afterHandle` step. The closure runs (validate) →
+     * derive → before → handler → after in one frame, the shape the realistic middleware route lands on
+     * when it also wants a response transform (e.g. attaching a request id to a successful payload's
+     * headers). `LifecycleExecutionLane` and `selectRouteLanes` guarantee `afterHandle === 1`, the
+     * throw contract is the same as the generic program, and the `after` step is the final transform +
+     * respond the generic program already does.
+     */
+    buildFusedDeriveBeforeAfter(handler, derive, before, after, querySchema, maxBodyBytes) {
+        const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
+        return (source, params, search, signal, budget, platform, nativeContext) => {
+            const ctx = nativeContext
+                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
+            const runAfter = (result) => {
+                let transformed;
+                try {
+                    transformed = after(result, ctx);
+                }
+                catch (err) {
+                    return logError(err, ctx);
+                }
+                if (transformed instanceof Promise) {
+                    return transformed.then((value) => fusedRespond(value, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
+                }
+                return fusedRespond(transformed, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
+            };
+            const runHandler = () => {
+                let result;
+                try {
+                    result = handler(ctx);
+                }
+                catch (err) {
+                    return logError(err, ctx);
+                }
+                if (result instanceof Promise) {
+                    return result.then((value) => runAfter(value), (err) => logError(err, ctx));
+                }
+                return runAfter(result);
+            };
+            const runBefore = () => {
+                let early;
+                try {
+                    early = before(ctx);
+                }
+                catch (err) {
+                    return logError(err, ctx);
+                }
+                if (early instanceof Promise) {
+                    return early.then((settled) => {
+                        if (settled === undefined)
+                            return runHandler();
+                        return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                    }, (err) => logError(err, ctx));
+                }
+                if (early === undefined)
+                    return runHandler();
+                return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders);
+            };
+            const runDerive = () => {
+                let derived;
+                try {
+                    derived = derive(ctx);
+                }
+                catch (err) {
+                    return logError(err, ctx);
+                }
+                if (derived instanceof Promise) {
+                    return derived.then((settled) => {
+                        if (isResponseResult(settled) || settled instanceof Response) {
+                            return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                        }
+                        Object.assign(ctx, settled);
+                        return runBefore();
+                    }, (err) => logError(err, ctx));
+                }
+                if (isResponseResult(derived) || derived instanceof Response) {
+                    return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                }
+                Object.assign(ctx, derived);
+                return runBefore();
+            };
+            if (querySchema === undefined)
+                return runDerive();
+            let validation;
+            try {
+                validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
+            }
+            catch (err) {
+                return logError(err, ctx);
+            }
+            if (validation instanceof Promise) {
+                return validation.then((settled) => {
+                    if (settled.issues !== undefined)
+                        return this.wrapWebResponse(plainValidationError(settled.issues));
+                    ctx.query = settled.value;
+                    return runDerive();
+                }, (err) => logError(err, ctx));
+            }
+            if (validation.issues !== undefined)
+                return this.wrapWebResponse(plainValidationError(validation.issues));
+            ctx.query = validation.value;
+            return runDerive();
+        };
+    }
+    /**
+     * Body + lifecycle hooks fused: parse → validate → derive → before → handler → (after) in one
+     * closure, the same win `buildFusedBodyRunner` gives for the no-hooks body shape. The shape is
+     * `lifecycleHookLane` PLUS a body schema with no other validation conflicts; the lane is selected
+     * ONLY when `schema.body !== undefined && schema.query/params/headers === undefined &&
+     * schema.onValidationError === undefined && !defaultOnValidationError && !hasIdempotency &&
+     * !hasLedger && derives === 1 && beforeHandle === 1 && afterHandle <= 1 && onError === 0 &&
+     * !hasResponseContract && !hasDecorations && around === 0`. The same single `querySchema === undefined`
+     * trick used in the no-body lane lets the build path stay simple: a query + body route falls back
+     * to the generic program (this is rare in practice - validated query + validated body is usually a
+     * "search results" route with a middleware chain on top, and the generic lane is fine there).
+     */
+    buildFusedBodyDeriveBeforeAfter(handler, derive, before, after, bodySchema, maxBodyBytes) {
+        const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
+        return (source, params, search, signal, budget, platform, nativeContext) => {
+            const ctx = nativeContext
+                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
+            const runHandlerValidated = () => {
+                const runAfter = (result) => {
+                    if (after === undefined) {
+                        return fusedRespond(result, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
+                    }
+                    let transformed;
+                    try {
+                        transformed = after(result, ctx);
+                    }
+                    catch (err) {
+                        return logError(err, ctx);
+                    }
+                    if (transformed instanceof Promise) {
+                        return transformed.then((value) => fusedRespond(value, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
+                    }
+                    return fusedRespond(transformed, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
+                };
+                const runHandler = () => {
+                    let result;
+                    try {
+                        result = handler(ctx);
+                    }
+                    catch (err) {
+                        return logError(err, ctx);
+                    }
+                    if (result instanceof Promise) {
+                        return result.then((value) => runAfter(value), (err) => logError(err, ctx));
+                    }
+                    return runAfter(result);
+                };
+                const runBefore = () => {
+                    let early;
+                    try {
+                        early = before(ctx);
+                    }
+                    catch (err) {
+                        return logError(err, ctx);
+                    }
+                    if (early instanceof Promise) {
+                        return early.then((settled) => {
+                            if (settled === undefined)
+                                return runHandler();
+                            return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                        }, (err) => logError(err, ctx));
+                    }
+                    if (early === undefined)
+                        return runHandler();
+                    return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                };
+                let derived;
+                try {
+                    derived = derive(ctx);
+                }
+                catch (err) {
+                    return logError(err, ctx);
+                }
+                if (derived instanceof Promise) {
+                    return derived.then((settled) => {
+                        if (isResponseResult(settled) || settled instanceof Response) {
+                            return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                        }
+                        Object.assign(ctx, settled);
+                        return runBefore();
+                    }, (err) => logError(err, ctx));
+                }
+                if (isResponseResult(derived) || derived instanceof Response) {
+                    return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                }
+                Object.assign(ctx, derived);
+                return runBefore();
+            };
+            const onParsed = (parsed) => {
+                let validation;
+                try {
+                    validation = bodySchema["~standard"].validate(parsed);
+                }
+                catch (err) {
+                    return logError(err, ctx);
+                }
+                if (validation instanceof Promise) {
+                    return validation.then((settled) => {
+                        if (settled.issues !== undefined)
+                            return this.wrapWebResponse(plainValidationError(settled.issues));
+                        ctx.body = settled.value;
+                        return runHandlerValidated();
+                    }, (err) => logError(err, ctx));
+                }
+                if (validation.issues !== undefined)
+                    return this.wrapWebResponse(plainValidationError(validation.issues));
+                ctx.body = validation.value;
+                return runHandlerValidated();
+            };
+            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, onParsed, (response) => this.wrapWebResponse(response), (err) => Promise.resolve(logError(err, ctx)));
+        };
+    }
+    bareError(err, ctx, finalize, wrapResponse) {
+        // The thrown-value contract lives in `bare-error-lane.ts`, one source of truth for both this
+        // lane and the fused body runner. `responseSet` and the logger are injected because they reach
+        // into class state; the closure is allocated only on the throw path, never on the hot lane.
+        return renderBareError(err, ctx, finalize, wrapResponse, responseSet, (e, c) => this.logRequestError(e, c), () => this.internalErrorResponse(wrapResponse));
+    }
+    /**
+     * Keep the ordinary thrown-error response independent from the caught value. Deliberate Response
+     * control flow is handled by `renderBareError`; every other throw gets this fixed public envelope.
+     */
+    internalErrorResponse(wrapResponse) {
+        return wrapResponse(plainError(500, "internal_error"));
     }
     // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-    // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
     runWithAround(entry, ctx, run, finalize, wrapResponse) {
         let outcome;
         try {
@@ -2400,6 +2577,45 @@ export class Server {
             ? outcome.catch((err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse))
             : outcome;
     }
+    /** Execute the registration-compiled general stage program. */
+    // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
+    runProgram(entry, source, ctx, finalize, wrapResponse) {
+        return executeRouteProgram(this, entry, entry.program, source, ctx, finalize, wrapResponse);
+    }
+    /** Bind a compiled validation stage to its stable schema and the existing recovery contract. */
+    // @ts-expect-error TS6133 -- invoked structurally by the general route program
+    validateProgramStage(entry, stage, source, ctx) {
+        const input = stage.kind === "headers"
+            ? headerObjectOf(source.headers)
+            : stage.kind === "params"
+                ? ctx.params
+                : stage.kind === "query"
+                    ? queryObjectOf(ctx[CONTEXT_SEARCH])
+                    : undefined;
+        if (stage.kind === "body")
+            return this.readProgramBody(entry, source, ctx);
+        const validation = stage.schema["~standard"].validate(input);
+        return validation instanceof Promise
+            ? validation.then((result) => this.applyLifecycleValidation(entry, result, ctx, stage.kind))
+            : this.applyLifecycleValidation(entry, validation, ctx, stage.kind);
+    }
+    /** Preserve the existing bounded body reader and its fail-closed framing/prototype checks. */
+    readProgramBody(entry, source, ctx) {
+        const bodySchema = entry.program.bodySchema;
+        if (bodySchema === undefined)
+            return Promise.resolve(plainError(415, "unsupported_media_type"));
+        return this.readAndValidateBody(source, entry, ctx, bodySchema, entry.program.bodyLimit);
+    }
+    /** Keep thrown Response/status and redacted 500 semantics in one existing error boundary. */
+    // @ts-expect-error TS6133 -- invoked structurally by the general route program
+    handleProgramError(entry, error, ctx, finalize, wrapResponse) {
+        return this.handleLifecycleError(entry, error, ctx, finalize, wrapResponse);
+    }
+    /** Finish a successful program result through response-contract enforcement and finalization. */
+    // @ts-expect-error TS6133 -- invoked structurally by the general route program
+    finishProgramResult(entry, ctx, result, finalize, wrapResponse) {
+        return this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, result);
+    }
     runAround(hooks, ctx, run) {
         const dispatch = (index) => {
             if (index >= hooks.length)
@@ -2416,29 +2632,8 @@ export class Server {
         return dispatch(0);
     }
     // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-    // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
     runBodyOnly(entry, source, ctx, finalize, wrapResponse) {
-        return this.readBodyInput(source, entry.bodyLimit ?? this.maxBodyBytes, (parsed) => this.finishBodyOnly(entry, parsed, ctx, finalize, wrapResponse), wrapResponse, (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-    }
-    /** Shared bounded body framing/parser. Both body lanes use the same trust-boundary checks; only
-     * the validation + handler continuation differs. */
-    readBodyInput(source, maxBodyBytes, onParsed, wrapResponse, onError) {
-        const contentType = headerOf(source, "content-type") ?? "";
-        if (contentType !== "application/json" && !contentType.includes("application/json")) {
-            if (isUrlEncodedForm(contentType)) {
-                return readBoundedForm(source, maxBodyBytes).then((form) => (form instanceof Response ? wrapResponse(form) : onParsed(form)), onError);
-            }
-            return Promise.resolve(wrapResponse(jsonError(415, "unsupported_media_type")));
-        }
-        // All JSON bodies go through readBoundedJson - the single enforcement point for the framed
-        // fast path (post-read byte re-check), the streaming cap, and the prototype-poisoning guard.
-        // A separate inlined native-json() fast path here would fork the trust boundary in two.
-        try {
-            return this.readBoundedJson(source, maxBodyBytes, (parsed) => (parsed instanceof Response ? wrapResponse(parsed) : onParsed(parsed)), onError);
-        }
-        catch (err) {
-            return Promise.resolve(onError(err));
-        }
+        return readBodyFramed(source, entry.bodyLimit ?? UNLIMITED_BODY_BYTES, this.protoPoisoning, (parsed) => this.finishBodyOnly(entry, parsed, ctx, finalize, wrapResponse), wrapResponse, (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
     }
     /** Validate + run the handler for the bodyOnly path - shared by the inline fast path and the
      * streaming fallback. A method (not per-request closures) so the hot path allocates nothing
@@ -2493,13 +2688,13 @@ export class Server {
                 if (validation instanceof Promise) {
                     return validation.then((settled) => {
                         if (settled.issues !== undefined)
-                            return wrapResponse(validationError(settled.issues));
+                            return wrapResponse(plainValidationError(settled.issues));
                         ctx.body = settled.value;
                         return this.executeHandler(entry, ctx, finalize);
                     });
                 }
                 if (validation.issues !== undefined)
-                    return wrapResponse(validationError(validation.issues));
+                    return wrapResponse(plainValidationError(validation.issues));
                 ctx.body = validation.value;
                 return this.executeHandler(entry, ctx, finalize);
             }
@@ -2508,18 +2703,18 @@ export class Server {
                 if (validation instanceof Promise) {
                     return validation.then((settled) => {
                         if (settled.issues !== undefined)
-                            return wrapResponse(validationError(settled.issues));
+                            return wrapResponse(plainValidationError(settled.issues));
                         ctx.query = settled.value;
                         return this.executeHandler(entry, ctx, finalize, wrapResponse);
                     }, (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
                 }
                 if (validation.issues !== undefined)
-                    return wrapResponse(validationError(validation.issues));
+                    return wrapResponse(plainValidationError(validation.issues));
                 ctx.query = validation.value;
                 return this.executeHandler(entry, ctx, finalize, wrapResponse);
             }
         }
-        return wrapResponse(validationError(originalIssues));
+        return wrapResponse(plainValidationError(originalIssues));
     }
     applyBodyValidation(entry, result, ctx, finalize, wrapResponse) {
         if (result.issues !== undefined) {
@@ -2531,13 +2726,12 @@ export class Server {
                 }
                 return this.handleValidationErrorRecovery(entry, recovery, ctx, finalize, wrapResponse, result.issues, "body");
             }
-            return wrapResponse(validationError(result.issues));
+            return wrapResponse(plainValidationError(result.issues));
         }
         ctx.body = result.value;
         return this.executeHandler(entry, ctx, finalize);
     }
     // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-    // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
     runQueryOnly(entry, ctx, finalize, wrapResponse) {
         try {
             // Call the validator directly for the raw StandardResult (read `.issues`/`.value`) - skip
@@ -2574,7 +2768,7 @@ export class Server {
                 }
                 return this.handleValidationErrorRecovery(entry, recovery, ctx, finalize, wrapResponse, result.issues, "query");
             }
-            return wrapResponse(validationError(result.issues));
+            return wrapResponse(plainValidationError(result.issues));
         }
         ctx.query = result.value;
         return this.executeHandler(entry, ctx, finalize, wrapResponse);
@@ -2682,333 +2876,6 @@ export class Server {
                 clearTimeout(timer);
         }
     }
-    /**
-     * The post-match lifecycle: validate → derive → beforeHandle → handler → afterHandle, with onError.
-     * Generic over the render: a success value goes through `finalize(result, set)` (a Web `Response`, or
-     * node-direct primitives); an early/error `Response` (validation, thrown, 500) through `wrapResponse`.
-     */
-    /** Synchronous until a validator, lifecycle hook, handler, or contract check actually returns a Promise. */
-    // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-    // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-    runLifecycle(entry, source, ctx, finalize, wrapResponse) {
-        try {
-            const headersSchema = entry.schema?.headers;
-            if (headersSchema !== undefined) {
-                const validation = headersSchema["~standard"].validate(headerObjectOf(source.headers));
-                if (validation instanceof Promise) {
-                    return validation.then((result) => this.runLifecycleAfterHeadersResult(entry, source, ctx, finalize, wrapResponse, result), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-                }
-                return this.runLifecycleAfterHeadersResult(entry, source, ctx, finalize, wrapResponse, validation);
-            }
-            const paramsSchema = entry.schema?.params;
-            if (paramsSchema !== undefined) {
-                const validation = paramsSchema["~standard"].validate(ctx.params);
-                if (validation instanceof Promise) {
-                    return validation.then((result) => this.runLifecycleAfterParamsResult(entry, source, ctx, finalize, wrapResponse, result), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-                }
-                return this.runLifecycleAfterParamsResult(entry, source, ctx, finalize, wrapResponse, validation);
-            }
-            // Registration already knows whether this route has body/params/query validation. Most real
-            // read routes have no body or params schema, so skip the generic stage ladder and go straight to
-            // query validation + lifecycle hooks. The fallback below remains the complete path for routes
-            // with body/params combinations and validation recovery.
-            if (entry.schema?.body === undefined) {
-                return this.runQueryAndLifecycle(entry, ctx, finalize, wrapResponse);
-            }
-            return this.runLifecycleAfterParams(entry, source, ctx, finalize, wrapResponse, undefined);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    runLifecycleAfterHeadersResult(entry, source, ctx, finalize, wrapResponse, result) {
-        try {
-            const headersError = this.applyLifecycleValidation(entry, result, ctx, "headers");
-            if (headersError instanceof Promise) {
-                return headersError.then((error) => error === undefined
-                    ? this.runLifecycleAfterHeaders(entry, source, ctx, finalize, wrapResponse)
-                    : wrapResponse(error), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-            }
-            return headersError === undefined
-                ? this.runLifecycleAfterHeaders(entry, source, ctx, finalize, wrapResponse)
-                : wrapResponse(headersError);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    runLifecycleAfterHeaders(entry, source, ctx, finalize, wrapResponse) {
-        const paramsSchema = entry.schema?.params;
-        if (paramsSchema === undefined) {
-            if (entry.schema?.body === undefined)
-                return this.runQueryAndLifecycle(entry, ctx, finalize, wrapResponse);
-            return this.runLifecycleAfterParams(entry, source, ctx, finalize, wrapResponse, undefined);
-        }
-        const validation = paramsSchema["~standard"].validate(ctx.params);
-        if (validation instanceof Promise) {
-            return validation.then((result) => this.runLifecycleAfterParamsResult(entry, source, ctx, finalize, wrapResponse, result), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-        }
-        return this.runLifecycleAfterParamsResult(entry, source, ctx, finalize, wrapResponse, validation);
-    }
-    /** Registration-specialized query lifecycle: query validation (including recovery) → hooks. */
-    runLifecycleQuery(entry, ctx, finalize, wrapResponse) {
-        try {
-            // The execution plan only selects this runner when the route has a query schema. Keeping the
-            // non-null access here removes the per-request schema-presence branch from realistic GETs.
-            const validation = entry.schema.query["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
-            if (validation instanceof Promise) {
-                return validation.then((result) => {
-                    try {
-                        return this.runQueryAndLifecycleResult(entry, ctx, finalize, wrapResponse, result);
-                    }
-                    catch (err) {
-                        return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-                    }
-                }, (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-            }
-            return this.runQueryAndLifecycleResult(entry, ctx, finalize, wrapResponse, validation);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    /** Registration-specialized body lifecycle: bounded body validation (including recovery) → hooks. */
-    // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-    // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-    runLifecycleBody(entry, source, ctx, finalize, wrapResponse) {
-        return this.readAndValidateBody(source, entry, ctx).then((bodyError) => bodyError === undefined
-            ? this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-            : wrapResponse(bodyError), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-    }
-    /** Registration-specialized body + query lifecycle: bounded body validation → query validation → hooks. */
-    // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-    // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-    runLifecycleBodyQuery(entry, source, ctx, finalize, wrapResponse) {
-        return this.readAndValidateBody(source, entry, ctx).then((bodyError) => bodyError === undefined
-            ? this.runLifecycleQuery(entry, ctx, finalize, wrapResponse)
-            : wrapResponse(bodyError), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-    }
-    /** Registration-specialized no-body lifecycle: query validation (if present) → derives/hooks. */
-    runQueryAndLifecycle(entry, ctx, finalize, wrapResponse) {
-        const querySchema = entry.schema?.query;
-        return querySchema === undefined
-            ? this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-            : this.runLifecycleQuery(entry, ctx, finalize, wrapResponse);
-    }
-    runQueryAndLifecycleResult(entry, ctx, finalize, wrapResponse, result) {
-        const queryError = this.applyLifecycleValidation(entry, result, ctx, "query");
-        if (queryError instanceof Promise) {
-            return queryError.then((error) => error === undefined
-                ? this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-                : wrapResponse(error), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-        }
-        if (queryError !== undefined)
-            return wrapResponse(queryError);
-        return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse);
-    }
-    runLifecycleAfterParamsResult(entry, source, ctx, finalize, wrapResponse, result) {
-        try {
-            return this.runLifecycleAfterParams(entry, source, ctx, finalize, wrapResponse, this.applyLifecycleValidation(entry, result, ctx, "params"));
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    runLifecycleAfterParams(entry, source, ctx, finalize, wrapResponse, paramsError) {
-        if (paramsError instanceof Promise) {
-            return paramsError.then((error) => this.runLifecycleAfterParamsSettled(entry, source, ctx, finalize, wrapResponse, error), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-        }
-        return this.runLifecycleAfterParamsSettled(entry, source, ctx, finalize, wrapResponse, paramsError);
-    }
-    runLifecycleAfterParamsSettled(entry, source, ctx, finalize, wrapResponse, paramsError) {
-        if (paramsError !== undefined)
-            return wrapResponse(paramsError);
-        if (entry.schema?.body !== undefined) {
-            return this.readAndValidateBody(source, entry, ctx).then((bodyError) => this.runLifecycleAfterBody(entry, ctx, finalize, wrapResponse, bodyError), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-        }
-        return this.runLifecycleAfterBody(entry, ctx, finalize, wrapResponse, undefined);
-    }
-    runLifecycleAfterBody(entry, ctx, finalize, wrapResponse, bodyError) {
-        if (bodyError !== undefined)
-            return wrapResponse(bodyError);
-        const querySchema = entry.schema?.query;
-        if (querySchema === undefined)
-            return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse);
-        const validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
-        if (validation instanceof Promise) {
-            return validation.then((result) => this.runLifecycleAfterQueryResult(entry, ctx, finalize, wrapResponse, result), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-        }
-        return this.runLifecycleAfterQueryResult(entry, ctx, finalize, wrapResponse, validation);
-    }
-    runLifecycleAfterQueryResult(entry, ctx, finalize, wrapResponse, result) {
-        try {
-            const queryError = this.applyLifecycleValidation(entry, result, ctx, "query");
-            if (queryError instanceof Promise) {
-                return queryError.then((error) => this.runLifecycleAfterQuery(entry, ctx, finalize, wrapResponse, error), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-            }
-            return this.runLifecycleAfterQuery(entry, ctx, finalize, wrapResponse, queryError);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    runLifecycleAfterQuery(entry, ctx, finalize, wrapResponse, queryError) {
-        if (queryError !== undefined)
-            return wrapResponse(queryError);
-        return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse);
-    }
-    runLifecycleHooks(entry, ctx, finalize, wrapResponse) {
-        if (entry.lifecycleHookLane === "derive-before") {
-            return this.runLifecycleDeriveBefore(entry, ctx, finalize, wrapResponse);
-        }
-        try {
-            if (entry.hasDecorations)
-                Object.assign(ctx, entry.decorations);
-            for (let i = 0; i < entry.derives.length; i++) {
-                const extension = entry.derives[i](ctx);
-                if (extension instanceof Promise) {
-                    return this.continueLifecycleAfterDerive(entry, ctx, finalize, wrapResponse, i, extension);
-                }
-                Object.assign(ctx, extension);
-            }
-            for (let i = 0; i < entry.beforeHandle.length; i++) {
-                const outcome = entry.beforeHandle[i](ctx);
-                if (outcome instanceof Promise) {
-                    return this.continueLifecycleAfterBefore(entry, ctx, finalize, wrapResponse, i, outcome);
-                }
-                if (outcome !== undefined)
-                    return finalize(outcome, responseSet(ctx));
-            }
-            const result = entry.handler(ctx);
-            if (result instanceof Promise) {
-                return result.then((value) => this.finishLifecycleResult(entry, ctx, finalize, wrapResponse, value), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-            }
-            return this.finishLifecycleResult(entry, ctx, finalize, wrapResponse, result);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    /** Registration-specialized derive → before → handler lifecycle. */
-    runLifecycleDeriveBefore(entry, ctx, finalize, wrapResponse) {
-        try {
-            const extension = entry.derives[0](ctx);
-            if (extension instanceof Promise) {
-                return this.continueLifecycleAfterDerive(entry, ctx, finalize, wrapResponse, 0, extension);
-            }
-            Object.assign(ctx, extension);
-            const outcome = entry.beforeHandle[0](ctx);
-            if (outcome instanceof Promise) {
-                return this.continueLifecycleAfterBefore(entry, ctx, finalize, wrapResponse, 0, outcome);
-            }
-            if (outcome !== undefined)
-                return this.finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, outcome);
-            const result = entry.handler(ctx);
-            if (result instanceof Promise) {
-                return result.then((value) => this.finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, value), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
-            }
-            return this.finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, result);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    /** Finalize the specialized lane without rechecking its registration-proven invariants. */
-    finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, result) {
-        try {
-            return finalize(result, responseSet(ctx));
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    async continueLifecycleAfterDerive(entry, ctx, finalize, wrapResponse, firstIndex, first) {
-        try {
-            Object.assign(ctx, await first);
-            for (let i = firstIndex + 1; i < entry.derives.length; i++) {
-                const extension = entry.derives[i](ctx);
-                Object.assign(ctx, extension instanceof Promise ? await extension : extension);
-            }
-            return await this.runLifecycleHooksAsync(entry, ctx, finalize, wrapResponse);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    async runLifecycleHooksAsync(entry, ctx, finalize, wrapResponse) {
-        try {
-            // Indexed, not `for...of`. An array iterator declared inside an async function stays live
-            // across the `await` below, so neither engine can sink it - unlike the sync lanes above,
-            // where V8 elides it. Measured cost of the iterator form: 43ns per hook on Bun, ~9ns on
-            // Node, on a chain whose hooks return synchronously (the common shape).
-            for (let i = 0; i < entry.beforeHandle.length; i++) {
-                const outcome = entry.beforeHandle[i](ctx);
-                const early = outcome instanceof Promise ? await outcome : outcome;
-                if (early !== undefined)
-                    return finalize(early, responseSet(ctx));
-            }
-            return await this.runLifecycleHandlerAsync(entry, ctx, finalize, wrapResponse);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    async continueLifecycleAfterBefore(entry, ctx, finalize, wrapResponse, firstIndex, first) {
-        try {
-            const firstOutcome = await first;
-            if (firstOutcome !== undefined)
-                return finalize(firstOutcome, responseSet(ctx));
-            for (let i = firstIndex + 1; i < entry.beforeHandle.length; i++) {
-                const outcome = entry.beforeHandle[i](ctx);
-                const early = outcome instanceof Promise ? await outcome : outcome;
-                if (early !== undefined)
-                    return finalize(early, responseSet(ctx));
-            }
-            return await this.runLifecycleHandlerAsync(entry, ctx, finalize, wrapResponse);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    async runLifecycleHandlerAsync(entry, ctx, finalize, wrapResponse) {
-        try {
-            const output = entry.handler(ctx);
-            const result = output instanceof Promise ? await output : output;
-            return await this.finishLifecycleResult(entry, ctx, finalize, wrapResponse, result);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    finishLifecycleResult(entry, ctx, finalize, wrapResponse, initial) {
-        try {
-            let result = initial;
-            for (let i = 0; i < entry.afterHandle.length; i++) {
-                const transformed = entry.afterHandle[i](result, ctx);
-                if (transformed instanceof Promise) {
-                    return this.continueLifecycleAfterHandle(entry, ctx, finalize, wrapResponse, i, transformed);
-                }
-                result = transformed;
-            }
-            return this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, result);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
-    async continueLifecycleAfterHandle(entry, ctx, finalize, wrapResponse, firstIndex, first) {
-        try {
-            let result = await first;
-            for (let i = firstIndex + 1; i < entry.afterHandle.length; i++) {
-                const transformed = entry.afterHandle[i](result, ctx);
-                result = transformed instanceof Promise ? await transformed : transformed;
-            }
-            return await this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, result);
-        }
-        catch (err) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
-        }
-    }
     finishLifecycleContract(entry, ctx, finalize, wrapResponse, result) {
         try {
             const contract = entry.responseContract;
@@ -3031,7 +2898,7 @@ export class Server {
                 path: pathnameOf(ctx.req.url),
                 detail: outcome.message,
             });
-            return wrapResponse(jsonError(500, "internal_error"));
+            return wrapResponse(plainError(500, "internal_error"));
         }
         if (outcome.kind === "warn") {
             this.logger.warn("response contract", {
@@ -3042,14 +2909,33 @@ export class Server {
         }
         return finalize(outcome.value, responseSet(ctx));
     }
-    async handleLifecycleError(entry, err, ctx, finalize, wrapResponse) {
+    /** Synchronous by design, and `MaybePromise` rather than `Promise` for the same reason: control flow
+     * out of a lifecycle stage must not cost a promise. An `async` method allocates one and defers the
+     * result a microtask even when every branch it takes returns immediately, which is the common case
+     * here - a thrown `status(...)`/`Response`, or a route with no `onError` hook at all. Only the hook
+     * loop, which may await, drops into {@link runErrorHooks}. */
+    handleLifecycleError(entry, err, ctx, finalize, wrapResponse) {
         // A *thrown* Response is deliberate control flow, not an error - a guard throws a redirect/401,
         // an action throws an error page. Return it as-is (Remix/SvelteKit semantics); don't run onError
         // or log it as a 500. This is what makes `throw redirect(...)` / `requireSession(...)` work from
         // any handler or loader.
         if (err instanceof Response)
             return wrapResponse(err);
-        // onError hooks may return a custom response; otherwise the default 500 stands.
+        // Same rule for a thrown `status(...)`, but through `finalize` rather than `wrapResponse`: the
+        // value is still plain data, so the ordinary JSON lane renders it and no `Response` is built.
+        if (isResponseResult(err))
+            return finalize(err, responseSet(ctx));
+        if (entry.onError.length === 0) {
+            // Never crash the server or leak internals. The client gets a flat 500; the detail goes to the
+            // (redacting) logger. Body-read failures and around-hook failures land here too.
+            this.logRequestError(err, ctx);
+            return wrapResponse(plainError(500, "internal_error"));
+        }
+        return this.runErrorHooks(entry, err, ctx, finalize, wrapResponse);
+    }
+    /** The `onError` chain, split off {@link handleLifecycleError} so its `await` costs only the routes
+     * that registered a hook. A hook may return a custom response; otherwise the default 500 stands. */
+    async runErrorHooks(entry, err, ctx, finalize, wrapResponse) {
         // Indexed for the same reason as the `beforeHandle` chain above: the iterator would outlive
         // the `await` and stay heap-allocated on both engines.
         for (let i = 0; i < entry.onError.length; i++) {
@@ -3058,53 +2944,26 @@ export class Server {
             if (handled !== undefined)
                 return finalize(handled, responseSet(ctx));
         }
-        // Never crash the server or leak internals. The client gets a flat 500; the detail goes to the
-        // (redacting) logger. Body-read failures and around-hook failures land here too.
         this.logRequestError(err, ctx);
-        return wrapResponse(jsonError(500, "internal_error"));
+        return wrapResponse(plainError(500, "internal_error"));
     }
-    /** Log an unhandled request error to the (redacting) logger - shared by {@link runLifecycle} and the
+    /** Log an unhandled request error to the (redacting) logger - shared by the compiled route program and the
      * bare fast path ({@link bareError}) so both record the same fields. Never throws; never leaks. */
     logRequestError(err, ctx) {
-        // An error's own text can quote the input that produced it, so how much of it reaches the sink is
-        // the app's call (`errorLogDetail`). The default keeps it: a 500 with no message and no stack is
-        // an incident nobody can diagnose, and the framework already ships the narrower instrument for
-        // the leak - a redacting logger with `valuePatterns`. `"none"` is there for an untrusted sink.
-        const detail = this.errorLogDetail;
-        this.logger.error("unhandled request error", {
-            method: ctx.req.method,
-            path: pathnameOf(ctx.req.url),
-            name: err instanceof Error ? err.name : "Error",
-            // `detail`, not `message`: the logger uses `message` for its own first argument, so a field of
-            // that name is silently overwritten and the thrown error's own text never reaches the sink. It
-            // survived only incidentally inside `stack`, and was lost outright for a non-Error throw.
-            ...(detail === "none" ? {} : { detail: err instanceof Error ? err.message : String(err) }),
-            ...(detail === "full" && err instanceof Error ? { stack: err.stack } : {}),
-        });
-    }
-    async readAndValidateBody(req, entry, ctx) {
-        const contentType = headerOf(req, "content-type") ?? "";
-        let parsed;
-        if (contentType === "application/json" || contentType.includes("application/json")) {
-            const json = await this.readBoundedJson(req, entry.bodyLimit ?? this.maxBodyBytes);
-            if (json instanceof Response)
-                return json;
-            parsed = json;
-        }
-        else if (isUrlEncodedForm(contentType)) {
-            const form = await readBoundedForm(req, entry.bodyLimit ?? this.maxBodyBytes);
-            if (form instanceof Response)
-                return form;
-            parsed = form;
-        }
-        else {
-            // multipart/form-data (file uploads) stays 415 on the schema path by design - files don't
-            // fit a value schema; use a schema-less route + @nifrajs/uploads helpers for those.
-            return jsonError(415, "unsupported_media_type");
-        }
-        const validation = entry.schema.body["~standard"].validate(parsed);
-        const result = validation instanceof Promise ? await validation : validation;
-        return this.applyLifecycleValidation(entry, result, ctx, "body");
+        emitRequestErrorLog(this.logger, this.errorLogDetail, err, ctx);
+    }
+    readAndValidateBody(req, entry, ctx, bodySchema = entry.schema?.body, bodyLimit = entry.bodyLimit) {
+        // Keep the generic lifecycle body stage on the same framed parser/continuation as the body-only
+        // lane. This avoids an async wrapper that first awaits parsing and then starts validation in a
+        // second continuation, while retaining the exact bounded-read, content-type, and poisoning
+        // contracts shared by every body route.
+        const validate = (parsed) => {
+            const validation = bodySchema["~standard"].validate(parsed);
+            return validation instanceof Promise
+                ? validation.then((result) => this.applyLifecycleValidation(entry, result, ctx, "body"))
+                : this.applyLifecycleValidation(entry, validation, ctx, "body");
+        };
+        return readBodyFramed(req, bodyLimit ?? UNLIMITED_BODY_BYTES, this.protoPoisoning, validate, (response) => response, (error) => Promise.reject(error));
     }
     /** Apply validation and its recovery hook on the generic lifecycle lane. Recovery is completed
      * before derives/beforeHandle run, matching the body-only and query-only execution lanes. */
@@ -3125,7 +2984,7 @@ export class Server {
         }
         const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError;
         if (hook === undefined)
-            return validationError(result.issues);
+            return plainValidationError(result.issues);
         const attempted = hook(result.issues, ctx, kind);
         if (attempted instanceof Promise) {
             return attempted.then((recovery) => this.finishLifecycleValidationRecovery(entry, kind, result.issues, recovery, assign));
@@ -3134,7 +2993,7 @@ export class Server {
     }
     finishLifecycleValidationRecovery(entry, kind, issues, recovery, assign) {
         if (recovery === undefined)
-            return validationError(issues);
+            return plainValidationError(issues);
         if (recovery instanceof Response)
             return recovery;
         const schema = kind === "body"
@@ -3148,23 +3007,16 @@ export class Server {
         if (retried instanceof Promise) {
             return retried.then((settled) => {
                 if (settled.issues !== undefined)
-                    return validationError(settled.issues);
+                    return plainValidationError(settled.issues);
                 assign(settled.value);
                 return undefined;
             });
         }
         if (retried.issues !== undefined)
-            return validationError(retried.issues);
+            return plainValidationError(retried.issues);
         assign(retried.value);
         return undefined;
     }
-    readBoundedJson(req, maxBodyBytes = this.maxBodyBytes, onResult, onError) {
-        // Not `async`: this is a pass-through, and wrapping the lane's own promise in a coroutine
-        // frame costs an extra microtask hop on every JSON body.
-        return onResult === undefined
-            ? readBoundedJsonSource(req, maxBodyBytes, this.protoPoisoning)
-            : readBoundedJsonSource(req, maxBodyBytes, this.protoPoisoning, onResult, onError);
-    }
     /** Adapt one route's compiled execution plan to Bun's already-matched request shape. Route
      * semantics remain in the plan; this closure only supplies native params and deadline fallback. */
     compileBunNativeHandler(entry, paramNames, fused, signal, budget) {
@@ -3328,9 +3180,12 @@ export class Server {
         // matched route's handler, set by `server.upgrade`.
         // With WS routes, the dispatcher comes from the installed `.use(websocket())` runtime - non-null
         // because wsRouteCount > 0 means ws() ran, and ws() requires the runtime at registration.
+        // Native pub/sub when the app has WS routes and none validate outbound frames: `ws.subscribe` and
+        // `app.publish` go through Bun's own (uWebSockets) broadcast instead of the JS registry loop.
+        const nativePubsub = this.wsRouteCount > 0 && !this.wsHasValidatedSend;
         const wsHandlers = this.wsRouteCount === 0
             ? undefined
-            : this.wsRuntime.bunHandlers(this.topics);
+            : this.wsRuntime.bunHandlers(this.topics, nativePubsub);
         const reusePort = options?.reusePort === true;
         // Spread rather than pass `hostname: undefined` - Bun treats an explicit undefined as a value
         // on some option paths, and omitting is what selects its 0.0.0.0 default.
@@ -3366,6 +3221,14 @@ export class Server {
                 },
             }));
         this.bunServer = running;
+        // Bind `app.publish` to Bun's native broadcast now that the server handle exists. Guarded on the
+        // method's presence so a runtime whose handle lacks it simply keeps the registry path.
+        if (nativePubsub && typeof running.publish === "function") {
+            const native = running.publish.bind(running);
+            this.nativePublish = (topic, data) => {
+                native(topic, data);
+            };
+        }
         this.sealed = true;
         if (this.gracefulSignals)
             this.installSignalHandlers();