@nifrajs/core 2.14.1 → 3.2.0

package/src/server/server.ts

@@ -12,22 +12,18 @@ import { FrameworkError, RouteConfigError } from "../errors.ts"
 import type { Version } from "../index.ts"
 import {
   type AroundCapabilityOptions,
-  CAPABILITY_GUARD,
   type CapabilityInterceptor,
   type CapabilityUseEvent,
-  createCapabilityGuard,
   DEFAULT_CAPABILITY_INTERCEPTOR_TIMEOUT_MS,
-  normalizeRouteCapabilities,
   type RegisteredCapabilityInterceptor,
 } from "../internal/capability-runtime.ts"
 import {
   type AssuranceDeclaration,
   assuranceDeclarationsOf,
   assuranceEvidenceFor,
-  NIFRA_ASSURANCE_IDS,
-  validEvidenceId,
 } from "../internal/route-assurance.ts"
 import { type CatalogRoute, RouteCatalog } from "../internal/route-catalog.ts"
+import { compileRouteOptions } from "../internal/route-compiler.ts"
 import {
   compileRouteExecutionPlan,
   type FusedBodyRunner,
@@ -40,8 +36,11 @@ import {
   type RawErrorHandler,
   type RouteEntry,
 } from "../internal/route-execution.ts"
+import type { RouteProgramStage } from "../internal/route-program.ts"
+import { compileRouteProgram, executeRouteProgram } from "../internal/route-program.ts"
 import { isSameOriginRequest } from "../internal/same-origin.ts"
-import { compileRoutePattern, decodeRouteParams } from "../router/pattern.ts"
+import type { ResponseObserverPlugin } from "../response-observer.ts"
+import { decodeRouteParams } from "../router/pattern.ts"
 import { EMPTY_PARAMS, type Method, Router } from "../router/router.ts"
 import type {
   InferOutput,
@@ -49,11 +48,13 @@ import type {
   StandardResult,
   StandardSchemaV1,
 } from "../schema/standard.ts"
+import { emitRequestErrorLog, renderBareError } from "./bare-error-lane.ts"
 import {
   assertByteLimit,
   markTransportCap,
   markTrustedBodyFraming,
   type RawBodyReaders,
+  UNLIMITED_BODY_BYTES,
 } from "./body.ts"
 import { type ClientIpTrust, resolveClientIp } from "./client-ip.ts"
 import type { Context, Platform, ResponseControls, RouteSchema } from "./context.ts"
@@ -63,42 +64,35 @@ import {
   markLowercaseHeaderKeys,
 } from "./header-case.ts"
 import { headerObjectOf } from "./headers.ts"
-import { jsonError, pathnameOf, type UrlParts, urlPartsOf } from "./http.ts"
+import { jsonError, pathnameOf, plainError, type UrlParts, urlPartsOf } from "./http.ts"
 import { type NodeServeOutcome, withStaticNodeHeaders } from "./node-outcome.ts"
-import {
-  type NodeOutcomeRuntime,
-  type NodeRequestContext,
-  type NodeRequestHook,
-  type NodeResponseContext,
-  type NodeResponseHook,
-  type ResponseBodyHook,
-  type ResponseBodyReplacement,
-  type ResponseHeadersHook,
-  type ResponseHeadersView,
-  recordHeadersView,
+import type {
+  NodeOutcomeRuntime,
+  NodeRequestContext,
+  NodeRequestHook,
+  NodeResponseContext,
+  NodeResponseHook,
+  ResponseBodyHook,
+  ResponseBodyReplacement,
+  ResponseHeadersHook,
+  ResponseHeadersView,
 } from "./node-outcome-hook.ts"
-import {
-  isUrlEncodedForm,
-  type QueryValue,
-  queryObjectOf,
-  readBoundedForm,
-  searchOf,
-} from "./query.ts"
-import { RequestContext, readBoundedJsonSource } from "./request-context.ts"
+import { type QueryValue, queryObjectOf, searchOf } from "./query.ts"
+import { RequestContext, readBodyFramed } from "./request-context.ts"
 import {
   applyStaticResponseHeaders,
   buildStaticResponseHeaders,
   fusedRespond,
   fusedRespondNoSet,
-  knownMutableHeaders,
-  rememberMutableHeaders,
-  taggedResponseBody,
   toResponse,
 } from "./respond.ts"
 // Type-only: erased, so the kernel never pulls the lane's implementation into a bundle that does not
 // install the plugin. The value side arrives through the symbol-keyed install seam.
 import type { ResponseContractRuntime } from "./response-contract-lane.ts"
-import { applyBodyReplacement, withReplacedBody } from "./response-hooks.ts"
+import type {
+  ResponseObserverMethods,
+  ResponseObserverRuntime,
+} from "./response-observer-runtime.ts"
 import {
   CONTEXT_SEARCH,
   CONTEXT_SET,
@@ -107,9 +101,13 @@ import {
   getUnboundedRequestBudget,
   type HandlerResult,
   headerOf,
+  isResponseResult,
+  type ResponseResult,
   requestOf,
+  type StatusResponse,
 } from "./runtime-core.ts"
 import { normalizeStaticResponseHeaders, type StaticResponseHeaders } from "./static-headers.ts"
+import { plainValidationError } from "./validation.ts"
 
 // NodeServeOutcome (the nifra<->node bridge render form) now lives in `./node-outcome.ts`; re-exported
 // so existing importers keep resolving it from the server module.
@@ -125,96 +123,6 @@ export type {
   ResponseHeadersView,
 }
 
-const HEADER_MUTABILITY_PROBE = "x-nifra-header-probe"
-const GUARDED_RESPONSE_HEADERS = new WeakSet<Headers>()
-
-/**
- * Detect a guarded Web Headers object before invoking user code. Retrying after catching any
- * TypeError is observably wrong: user hooks are allowed to throw TypeError themselves, and a retry
- * runs those hooks twice. The hot path never reaches the probe: every framework-constructed
- * Response stamps its headers as known-mutable at construction (see respond.ts), so only a
- * handler-returned foreign `Response` - the case that can actually be guarded - pays it, once per
- * headers object. The probe uses a valid private header name and restores a pre-existing value, so
- * the fallback is limited to the actual immutable/guarded-header case.
- */
-function hasMutableResponseHeaders(headers: Headers): boolean {
-  if (knownMutableHeaders(headers)) return true
-  if (GUARDED_RESPONSE_HEADERS.has(headers)) return false
-  let previous: string | null = null
-  try {
-    previous = headers.get(HEADER_MUTABILITY_PROBE)
-    headers.set(HEADER_MUTABILITY_PROBE, "1")
-    if (previous === null) headers.delete(HEADER_MUTABILITY_PROBE)
-    else headers.set(HEADER_MUTABILITY_PROBE, previous)
-    rememberMutableHeaders(headers)
-    return true
-  } catch {
-    try {
-      if (previous === null) headers.delete(HEADER_MUTABILITY_PROBE)
-      else headers.set(HEADER_MUTABILITY_PROBE, previous)
-    } catch {
-      // The guarded object rejected the cleanup too; the clone below is authoritative.
-    }
-    GUARDED_RESPONSE_HEADERS.add(headers)
-    return false
-  }
-}
-
-/** Adapt a portable {@link ResponseBodyHook} into the Web `onResponse` walk. Only a Response
- * carrying the framework-buffered body tag participates - a raw or streamed Response is skipped by
- * contract, never drained. */
-function webResponseBodyHook(
-  fn: ResponseBodyHook,
-  owners: ReadonlySet<object>,
-): (response: Response, req: Request) => MaybePromise<Response> {
-  return (response, req) => {
-    const body = taggedResponseBody(response, owners)
-    if (body === undefined) return response
-    const out = fn(body, response.headers, webRequestView(req), response.status)
-    if (out instanceof Promise) return out.then((replaced) => withReplacedBody(response, replaced))
-    return withReplacedBody(response, out)
-  }
-}
-
-/** Minimal request view over a Web `Request` for portable header hooks on the Web serving paths. */
-function webRequestView(req: Request): NodeRequestContext {
-  return { method: req.method, url: req.url, header: (name) => req.headers.get(name) }
-}
-
-/**
- * Adapt a portable {@link ResponseHeadersHook} into the Web `onResponse` walk: run it against the
- * response's own `Headers` in place (no clone). A response whose headers are GUARDED (a raw
- * `fetch()`ed Response returned by a handler) throws on the FIRST mutation, so nothing was applied
- * yet - rerun once against a mutable copy. Async hooks should perform their mutations before their
- * first await for the guard fallback to cover them.
- */
-function webResponseHeadersHook(
-  fn: ResponseHeadersHook,
-): (response: Response, req: Request) => MaybePromise<Response> {
-  return (response, req) => {
-    const view = webRequestView(req)
-    if (!hasMutableResponseHeaders(response.headers)) {
-      const clone = new Response(response.body, response)
-      const out = fn(clone.headers, view, clone.status)
-      return out instanceof Promise ? out.then(() => clone) : clone
-    }
-    const out = fn(response.headers, view, response.status)
-    return out instanceof Promise ? out.then(() => response) : response
-  }
-}
-
-/** Adapt a raw-response fallback hook. Tagged framework payloads already ran through the body tier,
- * while untagged Responses include streams, proxied fetches, and framework-generated error responses. */
-function webResponseRawHook(
-  fn: (response: Response, req: Request) => MaybePromise<Response>,
-  owners: ReadonlySet<object>,
-): (response: Response, req: Request) => MaybePromise<Response> {
-  return (response, req) => {
-    if (taggedResponseBody(response, owners) !== undefined) return response
-    return fn(response, req)
-  }
-}
-
 import type { IdempotencyRuntime } from "./idempotency-lane.ts"
 import {
   INSTALL_EFFECT_LEDGER,
@@ -222,10 +130,13 @@ import {
   INSTALL_MCP,
   INSTALL_NODE_DIRECT,
   INSTALL_RESPONSE_CONTRACT,
+  INSTALL_RESPONSE_OBSERVER,
   INSTALL_SSE,
   INSTALL_WS,
+  NODE_NATIVE_MOUNT,
+  RESOLVE_NODE_MOUNT,
 } from "./install.ts"
-import type { EffectLedgerRuntime, ResolvedEffectLedger } from "./ledger-lane.ts"
+import type { EffectLedgerRuntime } from "./ledger-lane.ts"
 import { jsonLogger, type Logger } from "./logger.ts"
 import type { McpRuntime } from "./mcp-hook.ts"
 import type {
@@ -363,6 +274,22 @@ interface BunUpgradeServer {
 
 type MountedFetchHandler = (request: Request, platform?: Platform) => MaybePromise<Response>
 
+/** Structural native mount contract. The serving adapter owns the concrete Node request/response
+ * types; the kernel only selects a handler after proving that taking this lane cannot skip its
+ * global lifecycle. `false` means the capability was unavailable at runtime, so the adapter must
+ * retry the ordinary Web mount with the same untouched source. */
+type NativeMountHandler = (
+  request: unknown,
+  response: unknown,
+  platform?: Platform,
+) => MaybePromise<undefined | false>
+
+interface NativeMountSelection {
+  readonly handler: NativeMountHandler
+  readonly path: string
+  readonly stripPrefix: boolean
+}
+
 interface FetchMount {
   readonly path: string
   readonly handler: MountedFetchHandler
@@ -432,12 +359,38 @@ function requireMcpRuntime(runtime: McpRuntime | undefined): McpRuntime {
 }
 
 /** The handler's permitted return type. When the route declares a `response` schema, the return is
- * constrained to the contract's type (or a raw `Response`) - so the implementation can't drift from the
- * declared contract. Without a `response` schema it's unconstrained (`HandlerResult`), exactly as before. */
+ * constrained to the contract's type (a raw `Response`, or a `status(...)` early exit - both are
+ * control flow, not the declared payload) - so the implementation can't drift from the declared
+ * contract. Without a `response` schema it's unconstrained (`HandlerResult`), exactly as before. */
 type ResponseOf<S extends RouteSchema> = S extends { response: infer R extends StandardSchemaV1 }
-  ? InferOutput<R> | Response
+  ? InferOutput<R> | Response | ResponseResult
   : HandlerResult
 
+/** A typed status result is control flow, not a context extension. */
+type StatusResponseOf<T> = T extends StatusResponse<number, unknown> ? T : never
+
+type ContextExtensionPart<T> = T extends object ? T : EmptyContext
+type ContextExtensionOf<T> = [Exclude<Awaited<T>, Response | ResponseResult>] extends [never]
+  ? EmptyContext
+  : ContextExtensionPart<Exclude<Awaited<T>, Response | ResponseResult>>
+
+/** Keep concrete lifecycle return values for route inference, but don't let an untyped hook widen every route to unknown. */
+type HookOutputOf<T> = unknown extends Awaited<T> ? never : Exclude<Awaited<T>, void>
+
+type ReturnOfHookField<M, K extends PropertyKey> = M extends {
+  readonly [P in K]?: infer F
+}
+  ? F extends (...args: never[]) => infer R
+    ? HookOutputOf<R>
+    : never
+  : never
+
+type MiddlewareOutputOf<M> =
+  | ReturnOfHookField<M, "beforeHandle">
+  | ReturnOfHookField<M, "afterHandle">
+  | ReturnOfHookField<M, "onError">
+  | ReturnOfHookField<M, "around">
+
 /**
  * Public handler shape: context typed from the path, the (optional) schema, and
  * any accumulated middleware context `Ctx` (from `derive`/`decorate`).
@@ -471,7 +424,7 @@ export type {
 // A plugin operates over arbitrary Server shapes; `any` here is the standard framework escape hatch
 // (the precise threading happens at the `use` call site, which is generic over the *concrete* `this`).
 // biome-ignore lint/suspicious/noExplicitAny: plugins are generic over any Server's Registry/Context
-export type AnyServer = Server<any, any>
+export type AnyServer = Server<any, any, any>
 
 // Plugin definers + their types now live in `./plugin.ts`; re-exported here so `.use()` callers and
 // existing importers keep resolving them from the server module.
@@ -497,17 +450,13 @@ const STOP_HOOK_TIMEOUT_MS = 5_000
  * for the same request, so a browser that could open a socket was told its POST was cross-origin. */
 const wsSameOrigin = isSameOriginRequest
 
-function validationError(issues: ReadonlyArray<StandardIssue>): Response {
-  const serialized = issues.map((issue) => {
-    const path = issue.path?.map((seg) => String(typeof seg === "object" ? seg.key : seg))
-    return path !== undefined ? { message: issue.message, path } : { message: issue.message }
-  })
-  return Response.json({ ok: false, error: "validation", issues: serialized }, { status: 422 })
-}
-
 // `jsonError`, `urlPartsOf`, `pathnameOf` moved to `./http.ts` (a dependency-free leaf shared with the
 // opt-in request lanes); re-exported so existing importers keep resolving from here.
 export { pathnameOf, urlPartsOf } from "./http.ts"
+/** The 422 as plain data - the shape every lane's response wrapper takes, so a rejected body costs
+ * what an accepted one costs: on Node it is written straight to the socket with a `content-length`
+ * instead of being built as a `Response` and drained back out. */
+export { plainValidationError } from "./validation.ts"
 // Query-string + urlencoded-form parsing now lives in `./query.ts`; re-exported so existing
 // importers keep resolving `searchOf`/`queryObjectOf`/`QueryValue` from here.
 export { type QueryValue, queryObjectOf, searchOf }
@@ -577,8 +526,17 @@ type FeatureVersionOf<V extends string> = V extends `${infer Major}.${infer Mino
  */
 export type NifraFeatureVersion = FeatureVersionOf<Version>
 
+/**
+ * The Web lanes' `wrapResponse` input, as a `Response`. A plain-data carrier ({@link plainError},
+ * `status(...)`) is rendered on the ordinary JSON lane rather than through its own `toResponse`, so
+ * it picks up the same prebuilt init a handler's plain return uses. `EMPTY_RESPONSE_CONTROLS` because
+ * these renders happen where no request context exists - before routing, or after it was abandoned.
+ */
+const webResponseOf = (result: Response | ResponseResult): Response =>
+  result instanceof Response ? result : toResponse(result, EMPTY_RESPONSE_CONTROLS)
+
 // Stable module-level finalizers so `fetch`/`resolveNode` allocate no per-request closures.
-const IDENTITY_RESPONSE = (response: Response): Response => response
+const IDENTITY_RESPONSE = (response: Response | ResponseResult): Response => webResponseOf(response)
 const RESPONSE_TIMEOUT = (): Response => jsonError(503, "request_timeout")
 
 // The unused-order-scoped-hook audit (recorder, seal check, stack capture, message) is a dev-time
@@ -687,7 +645,7 @@ const sealHookAudit = (
  *   app.decorate("db", db).derive((c) => ({ user: auth(c) }))
  *      .get("/me", (c) => c.user)            // c.user + c.db are typed
  */
-export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
+export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, HookOutput = never> {
   /**
    * Which copy of `@nifrajs/core` declared this type. Two copies in one build (a linked sibling repo,
    * a hoisting split) produce two unrelated `Server` types whose assignment error is a wall of
@@ -706,6 +664,15 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * Created by the first `app.ws()` via the `@nifrajs/core/ws` runtime - `undefined` until then, so a
    * no-WebSocket app never constructs (or bundles) it. */
   private topics: TopicRegistry | undefined
+  /** True once any `app.ws()` route sets `validateSend: true` - the one case where a broadcast frame
+   * is validated (and possibly dropped) per socket, so `app.publish` must stay on the JS registry loop
+   * rather than delegate to Bun's native `server.publish`. */
+  private wsHasValidatedSend = false
+  /** Bun's native topic broadcast, bound by `listen()` in native-pubsub mode; `app.publish` uses it
+   * instead of the JS registry. `undefined` off Bun, before `listen()`, or with a validated-send route. */
+  private nativePublish:
+    | ((topic: string, data: string | ArrayBufferView | ArrayBuffer) => void)
+    | undefined
   private readonly maxBodyBytes: number
   private readonly protoPoisoning: "reject" | "strip" | "ignore"
   /** `trustBodyFraming`: mark every `app.fetch` request as runtime-framed (see ServerOptions). */
@@ -780,7 +747,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   private staticResponseHeaders: StaticResponseHeaders | undefined
   /** `wrapResponse` for the Web lanes: identity until static headers exist to fold into the
    * framework's own error/404/timeout renders, which are built outside the header init. */
-  private wrapWebResponse: (response: Response) => Response
+  private wrapWebResponse: (response: Response | ResponseResult) => Response
   private webResponseTimeout: () => Response
   /** Body/raw response hooks need a framework-payload marker; keep that decision per app. */
   private responseBodyTag: object | undefined
@@ -925,13 +892,28 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * declared *after* this call, and reaches none declared before. One added after the last route
    * (e.g. on the app returned by a route-registering factory) covers nothing - see
    * {@link ServerOptions.unusedScopedHooks}.
+   *
+   * Returning a `status(...)` (or a `Response`) instead of an extension ends the request there - the
+   * guard shape, and the cheap one: it renders as plain data on the same lane a handler's return
+   * takes, where `throw new Response(...)` pays ~40% of the rejection lane to build the object. That
+   * branch is control flow, so it does not widen the derived context type.
    */
-  derive<D extends object>(fn: (context: Context & Ctx) => MaybePromise<D>): Server<R, Ctx & D> {
+  derive<H extends (context: Context & Ctx) => MaybePromise<unknown>>(
+    fn: H,
+  ): Server<
+    R,
+    Ctx & ContextExtensionOf<ReturnType<H>>,
+    HookOutput | StatusResponseOf<Awaited<ReturnType<H>>>
+  > {
     this.assertConfigurable("derive()")
     this.derives.push(fn as unknown as RawDerive)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "derive")
-    return this as unknown as Server<R, Ctx & D>
+    return this as unknown as Server<
+      R,
+      Ctx & ContextExtensionOf<ReturnType<H>>,
+      HookOutput | StatusResponseOf<Awaited<ReturnType<H>>>
+    >
   }
 
   /**
@@ -939,12 +921,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * by none before; one added after the last route reaches nothing
    * (see {@link ServerOptions.unusedScopedHooks}).
    */
-  decorate<const K extends string, V>(key: K, value: V): Server<R, Ctx & Record<K, V>> {
+  decorate<const K extends string, V>(key: K, value: V): Server<R, Ctx & Record<K, V>, HookOutput> {
     this.assertConfigurable("decorate()")
     this.decorations[key] = value
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "decorate")
-    return this as unknown as Server<R, Ctx & Record<K, V>>
+    return this as unknown as Server<R, Ctx & Record<K, V>, HookOutput>
   }
 
   /**
@@ -966,12 +948,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * it is snapshotted into every route declared *after* this call and covers none declared before, so
    * one added after the last route reaches nothing (see {@link ServerOptions.unusedScopedHooks}).
    */
-  beforeHandle(fn: (context: Context & Ctx) => MaybePromise<unknown>): this {
+  beforeHandle<H extends (context: Context & Ctx) => MaybePromise<unknown>>(
+    fn: H,
+  ): Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>> {
     this.assertConfigurable("beforeHandle()")
     this.beforeHandleHooks.push(fn as unknown as RawBeforeHandle)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "beforeHandle")
-    return this
+    return this as unknown as Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>>
   }
 
   /**
@@ -982,12 +966,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * Order-scoped: captured by every route declared *after* this call, none before; one added after the
    * last route reaches nothing (see {@link ServerOptions.unusedScopedHooks}).
    */
-  around(fn: <T>(context: Context & Ctx, next: () => MaybePromise<T>) => MaybePromise<T>): this {
+  around<
+    H extends (context: Context & Ctx, next: () => MaybePromise<unknown>) => MaybePromise<unknown>,
+  >(fn: H): Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>> {
     this.assertConfigurable("around()")
     this.aroundHooks.push(fn as unknown as RawAround)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "around")
-    return this
+    return this as unknown as Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>>
   }
 
   /**
@@ -1029,23 +1015,27 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   /** Transform the handler's result before it is serialized. Order-scoped: captured by routes declared
    * *after* this call, none before; one added after the last route reaches nothing (see
    * {@link ServerOptions.unusedScopedHooks}). */
-  afterHandle(fn: (result: unknown, context: Context & Ctx) => MaybePromise<unknown>): this {
+  afterHandle<H extends (result: unknown, context: Context & Ctx) => MaybePromise<unknown>>(
+    fn: H,
+  ): Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>> {
     this.assertConfigurable("afterHandle()")
     this.afterHandleHooks.push(fn as unknown as RawAfterHandle)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "afterHandle")
-    return this
+    return this as unknown as Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>>
   }
 
   /** Handle a thrown error; a non-`undefined` return becomes the response (else the default 500).
    * Order-scoped: captured by routes declared *after* this call, none before; one added after the last
    * route reaches nothing (see {@link ServerOptions.unusedScopedHooks}). */
-  onError(fn: (error: unknown, context: Context & Ctx) => MaybePromise<unknown>): this {
+  onError<H extends (error: unknown, context: Context & Ctx) => MaybePromise<unknown>>(
+    fn: H,
+  ): Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>> {
     this.assertConfigurable("onError()")
     this.onErrorHooks.push(fn as unknown as RawErrorHandler)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "onError")
-    return this
+    return this as unknown as Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>>
   }
 
   /** Transform every outgoing response - success, error, 404, 405, short-circuit. Global. */
@@ -1089,11 +1079,27 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * hook owns part of the header state - into a hook that runs in the right order. */
   private addStaticResponseHeaders(record: Record<string, string>): this {
     if (this.onResponseHooks.length > 0) {
-      return this.onResponseHeaders((headers) => {
-        for (const name of Object.keys(record)) {
-          if (!headers.has(name)) headers.set(name, record[name] as string)
-        }
-      })
+      const observerHeaders = (
+        this as unknown as Pick<ResponseObserverMethods, "onResponseHeaders">
+      ).onResponseHeaders
+      if (observerHeaders !== undefined) {
+        observerHeaders.call(this, (headers) => {
+          for (const name of Object.keys(record)) {
+            if (!headers.has(name)) headers.set(name, record[name] as string)
+          }
+        })
+        return this
+      }
+      // Route the hook through the same seam the static tier uses. On a framework response (headers
+      // stamped mutable) it applies the defaults in place and returns the SAME object, so the
+      // serialized-body marker survives for later `onResponseBody`/`onResponseRaw` observers and the
+      // Node writer; reconstructing a `Response` here would strip that marker and reclassify the Node
+      // outcome from `json` to a generic `response`. A guarded foreign response takes its clone path.
+      const statics = buildStaticResponseHeaders(record)
+      this.onResponseHooks.push((response) => applyStaticResponseHeaders(response, statics))
+      this.onNodeResponseHooks.push(undefined)
+      this.nodeResponseHooksComplete = false
+      return this
     }
     const merged =
       this.staticResponseHeaders === undefined
@@ -1101,7 +1107,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         : { ...this.staticResponseHeaders.record, ...record }
     this.staticResponseHeaders = buildStaticResponseHeaders(merged)
     const statics = this.staticResponseHeaders
-    this.wrapWebResponse = (response) => applyStaticResponseHeaders(response, statics)
+    this.wrapWebResponse = (response) =>
+      applyStaticResponseHeaders(webResponseOf(response), statics)
     this.webResponseTimeout = () => applyStaticResponseHeaders(RESPONSE_TIMEOUT(), statics)
     return this
   }
@@ -1114,61 +1121,18 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return this.responseBodyTag
   }
 
-  /**
-   * Register a response transform for raw/streamed Responses. Framework-serialized payloads stay on
-   * the body tier; this hook is only entered for untagged Responses (streams, proxied fetches, and
-   * framework-generated error responses). A no-op native twin keeps buffered JSON on the direct lane.
-   */
-  onResponseRaw(fn: (response: Response, req: Request) => MaybePromise<Response>): this {
-    this.assertConfigurable("onResponseRaw()")
-    this.enableResponseBodyTagging()
-    this.onResponseHooks.push(webResponseRawHook(fn, this.responseBodyOwners))
-    this.onNodeResponseHooks.push(() => undefined)
-    return this
-  }
-
-  /**
-   * Register a PORTABLE header-only response hook - one implementation, fast on every runtime.
-   *
-   * The hook receives a mutable case-insensitive header view, a minimal request view, and the
-   * status. On the Web serving paths it runs inside the normal `onResponse` walk against the
-   * response's own `Headers` (mutating in place - no clone). On Node it self-pairs as a native
-   * response hook against the outcome's plain header record, so registering one NEVER forces the
-   * Node adapter off its direct socket writer the way a full `onResponse(res: Response)` hook does.
-   * Prefer this over `onResponse` whenever the middleware only reads/writes headers.
-   */
-  onResponseHeaders(fn: ResponseHeadersHook): this {
-    this.assertConfigurable("onResponseHeaders()")
-    this.onResponseHooks.push(webResponseHeadersHook(fn))
-    this.onNodeResponseHooks.push((response, req) =>
-      fn(recordHeadersView(response), req, response.status),
-    )
-    return this
-  }
-
-  /**
-   * Register a PORTABLE post-serialization body hook - the payload tier. The hook receives the
-   * FINAL framework-serialized bytes (plus the mutable header view and status) and may return
-   * replacement bytes; `undefined` keeps the body. On the Node direct writer the bytes come
-   * straight off the outcome record; on the Web serving paths they ride the framework-built
-   * Response as a tag, so no body stream is ever drained on any runtime. A handler-returned raw
-   * `Response` (proxied fetch, SSE, streamed SSR) is skipped by contract - transforming those is
-   * what the full `onResponse` hook is for.
-   */
-  onResponseBody(fn: ResponseBodyHook): this {
-    this.assertConfigurable("onResponseBody()")
-    this.enableResponseBodyTagging()
-    this.onResponseHooks.push(webResponseBodyHook(fn, this.responseBodyOwners))
-    this.onNodeResponseHooks.push((response, req) => {
-      const body = response.body
-      if (body === null) return undefined
-      const out = fn(body, recordHeadersView(response), req, response.status)
-      if (out instanceof Promise)
-        return out.then((replaced) => applyBodyReplacement(response, replaced))
-      applyBodyReplacement(response, out)
-      return undefined
-    })
-    return this
+  private responseObserverMethods(): ResponseObserverMethods {
+    const methods = this as unknown as Partial<ResponseObserverMethods>
+    if (
+      typeof methods.onResponseHeaders !== "function" ||
+      typeof methods.onResponseBody !== "function" ||
+      typeof methods.onResponseRaw !== "function"
+    ) {
+      throw new TypeError(
+        "response observation requires `.use(responseObserver())` or an observer-enabled middleware",
+      )
+    }
+    return methods as ResponseObserverMethods
   }
 
   /** Observe the terminal response after all transformations. Observers are ordered and fail-open. */
@@ -1180,14 +1144,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return this
   }
 
-  /**
-   * Apply a type-**identity** plugin ({@link IdentityPlugin}, from {@link defineIdentityPlugin}) - it
-   * registers routes/hooks but doesn't change the types, so this returns `this` with the route registry
-   * and context fully intact. This overload exists specifically so a *named* identity plugin (e.g.
-   * `@nifrajs/better-auth`) threads the registry: its `& { pluginName }` intersection would otherwise
-   * defeat the generic inference of the transforming overload below and collapse the result to `any`.
-   */
-  use(plugin: IdentityPlugin): this
+  /** Enable the opt-in portable response observer methods. */
+  use(plugin: ResponseObserverPlugin): this & ResponseObserverMethods
   /**
    * Apply a **context** plugin ({@link ContextPlugin}, from {@link defineContextPlugin}) - it adds `D`
    * to the handler context and changes nothing else, so the route registry `R` and the existing context
@@ -1195,7 +1153,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * `(app: this) => Out` overload below cannot infer through a *generic* plugin signature: it erases the
    * plugin's own type parameters to their constraints, which silently widens `R` to `Registry`.
    */
-  use<D extends object>(plugin: ContextPlugin<D>): Server<R, Ctx & D>
+  use<D extends object>(plugin: ContextPlugin<D>): Server<R, Ctx & D, HookOutput>
+  /**
+   * Apply a type-**identity** plugin ({@link IdentityPlugin}, from {@link defineIdentityPlugin}) - it
+   * registers routes/hooks but doesn't change the types, so this returns `this` with the route registry
+   * and context fully intact. This overload exists specifically so a named identity plugin (e.g.
+   * `@nifrajs/better-auth`) threads the registry: its `& { pluginName }` intersection would otherwise
+   * defeat the generic inference of the transforming overload below and collapse the result to `any`.
+   */
+  use<AddedHookOutput = never>(
+    plugin: IdentityPlugin<AddedHookOutput>,
+  ): Server<R, Ctx, HookOutput | AddedHookOutput>
   /**
    * Apply a **plugin function** - `(app) => app`, typically built with {@link definePlugin}. It's
    * called with `this` and its result is returned, so an inline plugin's `derive`/`decorate` thread
@@ -1219,6 +1187,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * the last route reaches nothing - {@link ServerOptions.unusedScopedHooks} logs that at seal. A named
    * bundle already applied is skipped (idempotent).
    */
+  use<M extends Middleware>(mw: M): Server<R, Ctx, HookOutput | MiddlewareOutputOf<M>>
   use(mw: Middleware): this
   use(arg: Middleware | ((app: this) => AnyServer)): AnyServer {
     this.assertConfigurable("use()")
@@ -1254,6 +1223,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     }
     this.globalAssurance.push(...evidence.filter((item) => item.scope === "global"))
     this.activeAssurance.push(...evidence.filter((item) => item.scope === "subsequent"))
+    const responseObserver = (arg as unknown as Record<symbol, unknown>)[INSTALL_RESPONSE_OBSERVER]
+    if (responseObserver !== undefined) {
+      if (
+        typeof responseObserver !== "object" ||
+        responseObserver === null ||
+        typeof (responseObserver as { install?: unknown }).install !== "function"
+      ) {
+        throw new TypeError("response observer middleware has an invalid runtime")
+      }
+      this[INSTALL_RESPONSE_OBSERVER](responseObserver as ResponseObserverRuntime)
+    }
     if (arg.onRequest !== undefined) {
       this.assertConfigurable("onRequest()")
       this.onRequestHooks.push(arg.onRequest as RawOnRequest)
@@ -1277,9 +1257,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     // Before the bundle's own hooks: a bundle declaring both means its static values are the
     // defaults its hook may then override, which is the order a single bundle reads in.
     if (arg.responseHeaders !== undefined) this.responseHeaders(arg.responseHeaders)
-    if (arg.onResponseHeaders !== undefined) this.onResponseHeaders(arg.onResponseHeaders)
-    if (arg.onResponseBody !== undefined) this.onResponseBody(arg.onResponseBody)
-    if (arg.onResponseRaw !== undefined) this.onResponseRaw(arg.onResponseRaw)
+    if (arg.onResponseHeaders !== undefined)
+      this.responseObserverMethods().onResponseHeaders(arg.onResponseHeaders)
+    if (arg.onResponseBody !== undefined)
+      this.responseObserverMethods().onResponseBody(arg.onResponseBody)
+    if (arg.onResponseRaw !== undefined)
+      this.responseObserverMethods().onResponseRaw(arg.onResponseRaw)
     if (arg.onResponseFinalized !== undefined) this.onResponseFinalized(arg.onResponseFinalized)
     if (arg.onError !== undefined) this.onError(arg.onError)
     return this
@@ -1289,16 +1272,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "GET", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "GET", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   get<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "GET", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "GET", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   get(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("GET", path, schemaOrHandler, handler)
   }
 
@@ -1331,12 +1322,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       stream: TypedSSEStream<InferOutput<S["sse"]>>,
     ) => void | Promise<void>,
     init?: SSEInit,
-  ): Server<AddRoute<R, "GET", Path, RouteInfoFor<Path, S, Response>>, Ctx> {
+  ): Server<
+    AddRoute<R, "GET", Path, RouteInfoFor<Path, S, Response, HookOutput>>,
+    Ctx,
+    HookOutput
+  > {
     const handler = (context: Context<Path, S> & Ctx): Response =>
       requireSseRuntime(this.sseRuntime).response(context, (stream) => run(context, stream), init)
     return this.route("GET", path, schema, handler as unknown as ErasedHandler) as Server<
-      AddRoute<R, "GET", Path, RouteInfoFor<Path, S, Response>>,
-      Ctx
+      AddRoute<R, "GET", Path, RouteInfoFor<Path, S, Response, HookOutput>>,
+      Ctx,
+      HookOutput
     >
   }
 
@@ -1344,16 +1340,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "POST", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "POST", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   post<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "POST", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "POST", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   post(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("POST", path, schemaOrHandler, handler)
   }
 
@@ -1361,16 +1365,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "PUT", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "PUT", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   put<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "PUT", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "PUT", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   put(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("PUT", path, schemaOrHandler, handler)
   }
 
@@ -1378,16 +1390,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "PATCH", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "PATCH", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   patch<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "PATCH", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "PATCH", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   patch(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("PATCH", path, schemaOrHandler, handler)
   }
 
@@ -1395,16 +1415,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "DELETE", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "DELETE", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   delete<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "DELETE", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "DELETE", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   delete(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("DELETE", path, schemaOrHandler, handler)
   }
 
@@ -1447,10 +1475,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         S["output"] extends StandardSchemaV1
           ? { body: S["input"]; response: S["output"] }
           : { body: S["input"] },
-        OutputOf<H>
+        OutputOf<H>,
+        HookOutput
       >
     >,
-    Ctx
+    Ctx,
+    HookOutput
   >
   tool(
     name: string,
@@ -1461,7 +1491,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       annotations?: ToolAnnotations
     },
     handler: (input: unknown, ctx: Context & Ctx) => unknown,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     const plan = requireMcpRuntime(this.mcpRuntime).tool(
       name,
       config,
@@ -1474,7 +1504,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     if (lastRoute) {
       ;(lastRoute as { tool?: RouteDescriptor["tool"] }).tool = plan.descriptor
     }
-    return this as unknown as Server<Registry, Ctx>
+    return this as unknown as Server<Registry, Ctx, HookOutput>
   }
 
   /**
@@ -1487,7 +1517,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     uri: string,
     config: { readonly name: string; readonly description?: string; readonly mimeType?: string },
     read: McpResourceDescriptor["read"],
-  ): Server<R, Ctx> {
+  ): Server<R, Ctx, HookOutput> {
     this.assertConfigurable("resource()")
     this.mcpResourceList.push(requireMcpRuntime(this.mcpRuntime).resource(uri, config, read))
     return this
@@ -1501,7 +1531,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     name: string,
     config: { readonly description: string; readonly arguments?: readonly PromptArgument[] },
     handler: McpPromptDescriptor["handler"],
-  ): Server<R, Ctx> {
+  ): Server<R, Ctx, HookOutput> {
     this.assertConfigurable("prompt()")
     this.mcpPromptList.push(requireMcpRuntime(this.mcpRuntime).prompt(name, config, handler))
     return this
@@ -1541,12 +1571,21 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     handler: WebSocketHandler<Data, EnvOf<Ctx>, Schema, Send>,
   ): string extends Path
-    ? Server<R, Ctx>
-    : Server<AddRoute<R, "WS", Path, WsRouteInfoFor<Path, Schema, Send>>, Ctx> {
+    ? Server<R, Ctx, HookOutput>
+    : Server<AddRoute<R, "WS", Path, WsRouteInfoFor<Path, Schema, Send>>, Ctx, HookOutput> {
     this.assertConfigurable("ws()")
     // Boot-time guard: the WS runtime is a subpath (`@nifrajs/core/ws`) so no-WebSocket apps don't
     // bundle it. Registration is the loud, early failure point - never the first connection.
     const runtime = requireWsRuntime(this.wsRuntime)
+    if (handler.validateSend === true && handler.sendSchema === undefined) {
+      throw new RouteConfigError(
+        "INVALID_WS_SEND_VALIDATION",
+        `route WS ${path}: validateSend requires sendSchema`,
+      )
+    }
+    // A validated-send route makes broadcast bytes route-dependent (drop-on-invalid per socket), so the
+    // whole app forgoes native pub/sub and keeps the JS registry loop that runs each send through the sender.
+    if (handler.validateSend === true) this.wsHasValidatedSend = true
     this.topics ??= runtime.createTopics()
     // A `messageSchema` wraps `message` with validation once, here - every adapter then dispatches
     // already-validated, typed messages (Bun/Deno/Node/Workers) with no per-adapter code.
@@ -1563,6 +1602,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * an external fan-out (Redis, a Durable Object) to this. A no-op when nobody is subscribed.
    */
   publish(topic: string, data: string | ArrayBufferView | ArrayBuffer): void {
+    // Native-pubsub mode (Bun, no validated-send route): one native broadcast to every subscriber, no
+    // per-connection JS loop. Bound only after `listen()`; before that (or off Bun) the registry runs.
+    if (this.nativePublish !== undefined) {
+      this.nativePublish(topic, data)
+      return
+    }
     // No `app.ws()` yet ⇒ no registry and necessarily no subscribers - a publish is a no-op anyway.
     this.topics?.publish(topic, data)
   }
@@ -1572,7 +1617,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     let rawHandler: ErasedHandler
     let schema: RouteSchema | undefined
     if (handler !== undefined) {
@@ -1585,7 +1630,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     this.register(method, path, schema, rawHandler)
     // The accumulated registry type is compile-time only; the same instance
     // carries every route, so the public methods re-type `this` per call.
-    return this as unknown as Server<Registry, Ctx>
+    return this as unknown as Server<Registry, Ctx, HookOutput>
   }
 
   /**
@@ -1626,245 +1671,143 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     schema: RouteSchema | undefined,
     handler: (context: never) => unknown,
   ): CatalogRoute {
-    const pattern = compileRoutePattern(path)
-    let bodyLimit: number | undefined = this.maxBodyBytes
-    const invalidBodyLimit = (message: string): never => {
-      throw new RouteConfigError("INVALID_BODY_LIMIT", `route ${method} ${path}: ${message}`)
-    }
-    if (schema?.bodyLimitReason !== undefined && schema.bodyLimit !== "unlimited") {
-      invalidBodyLimit('bodyLimitReason is only valid with bodyLimit: "unlimited"')
-    }
-    if (schema?.bodyLimit === "unlimited") {
-      if (
-        typeof schema.bodyLimitReason !== "string" ||
-        schema.bodyLimitReason.trim().length === 0
-      ) {
-        invalidBodyLimit('bodyLimit: "unlimited" requires a non-empty bodyLimitReason')
-      }
-      bodyLimit = undefined
-    } else if (schema?.bodyLimit !== undefined) {
-      try {
-        assertByteLimit(schema.bodyLimit, "route bodyLimit")
-      } catch {
-        invalidBodyLimit('bodyLimit must be a non-negative safe integer or "unlimited"')
-      }
-      bodyLimit = schema.bodyLimit
-    }
-    const capabilities = normalizeRouteCapabilities(schema?.capabilities)
-    const handlerAssurance = assuranceDeclarationsOf(handler as unknown as object)
-    const invalidHandlerScope = handlerAssurance.find(
-      (declaration) => declaration.scope !== "plugin",
-    )
-    if (invalidHandlerScope !== undefined) {
-      throw new RouteConfigError(
-        "INVALID_ASSURANCE",
-        `route handler assurance must use plugin scope (received ${invalidHandlerScope.scope})`,
-      )
-    }
-    const authenticated = assuranceEvidenceFor(
-      [...this.activeAssurance, ...handlerAssurance, ...this.globalAssurance],
-      method,
-      path,
-    ).some((evidence) => evidence.id === NIFRA_ASSURANCE_IDS.AUTHENTICATED)
-    const routeDecorations: Record<PropertyKey, unknown> = { ...this.decorations }
-    if (capabilities.length > 0) {
-      routeDecorations[CAPABILITY_GUARD] = createCapabilityGuard(
-        capabilities,
-        method,
-        path,
-        this.onCapabilityUse,
-        this.idempotencyRuntime?.trackEffect,
-        Object.freeze([...this.capabilityInterceptors]),
-        Object.freeze([...this.capabilityObservers]),
-      )
-    }
-    const hasDecorations = Reflect.ownKeys(routeDecorations).length > 0
-    // An idempotency route runs a dedupe lane that must buffer the body and capture the response, so it
-    // never takes the fused/native fast path - force it onto the portable matched lane (which routes
-    // through `fetchMatched`, where the dedupe wrapper lives). Fail closed: a route may not declare
-    // idempotency unless the idempotency runtime is installed, so the safety gate can never be silently
-    // dropped by a missing plugin.
-    if (schema?.idempotency !== undefined && this.idempotencyRuntime === undefined) {
-      throw new RouteConfigError(
-        "INVALID_IDEMPOTENCY",
-        "route declares idempotency but the idempotency plugin is not installed; add .use(idempotency())",
-      )
-    }
-    const idempotent = this.idempotencyRuntime?.resolve(schema, authenticated, this.maxBodyBytes)
-    // A ledgered route (capabilities declared + `.use(effectLedger())`) needs a per-request
-    // context to carry the ledger and a settle step to seal + sink it, so it too leaves the
-    // fused/contextless fast path. Resolved per route, at registration - like the capability guard.
-    const ledgered: ResolvedEffectLedger | undefined = this.effectLedgerRuntime?.resolve(
-      capabilities,
+    const compiled = compileRouteOptions(
+      {
+        maxBodyBytes: this.maxBodyBytes,
+        activeAssurance: this.activeAssurance,
+        globalAssurance: this.globalAssurance,
+        decorations: this.decorations,
+        onCapabilityUse: this.onCapabilityUse,
+        capabilityInterceptors: this.capabilityInterceptors,
+        capabilityObservers: this.capabilityObservers,
+        effectLedgerRuntime: this.effectLedgerRuntime,
+        idempotencyRuntime: this.idempotencyRuntime,
+        responseContractRuntime: this.responseContractRuntime,
+        derives: this.derives,
+        beforeHandleHooks: this.beforeHandleHooks,
+        afterHandleHooks: this.afterHandleHooks,
+        onErrorHooks: this.onErrorHooks,
+        aroundHooks: this.aroundHooks,
+        defaultOnValidationError: this.defaultOnValidationError,
+      },
       method,
       path,
+      schema,
+      handler,
     )
-    // A checked response schema needs the handler's VALUE before it becomes bytes, and the fused and
-    // native lanes exist precisely to skip that step. So a contracted route leaves them - the same
-    // structural trade an idempotent route makes above. The check itself is not the cost: a compiled
-    // validator measures ~100ns/response, within benchmark noise on any route these lanes already
-    // exclude (middleware, derives, lifecycle hooks).
-    const runtime = this.responseContractRuntime
-    const contracted =
-      runtime !== undefined && schema?.response !== undefined
-        ? { runtime, schema: schema.response }
-        : undefined
-    const bare =
-      schema?.params === undefined &&
-      schema?.headers === undefined &&
-      schema?.body === undefined &&
-      schema?.query === undefined &&
-      idempotent === undefined &&
-      ledgered === undefined &&
-      contracted === undefined &&
-      this.derives.length === 0 &&
-      this.beforeHandleHooks.length === 0 &&
-      this.afterHandleHooks.length === 0 &&
-      this.onErrorHooks.length === 0
-    // A route whose ONLY lifecycle step is a query schema can fuse too: the parse + validate +
-    // handler + respond collapse into one closure with no lifecycle promise on the sync path. The
-    // guards mirror the `query` lane below PLUS everything the fused dispatch skips: around hooks,
-    // the idempotency/ledger wrappers, and validation-error recovery (schema or server default) -
-    // the fused invalid path is exactly `validationError(issues)`, so any recovery semantics keep
-    // the generic lane.
-    const fusedQuery =
-      !bare &&
-      contracted === undefined &&
-      schema?.query !== undefined &&
-      schema.body === undefined &&
-      schema.params === undefined &&
-      schema.headers === undefined &&
-      schema.onValidationError === undefined &&
-      this.defaultOnValidationError === undefined &&
-      idempotent === undefined &&
-      ledgered === undefined &&
-      this.derives.length === 0 &&
-      this.beforeHandleHooks.length === 0 &&
-      this.afterHandleHooks.length === 0 &&
-      this.onErrorHooks.length === 0 &&
-      this.aroundHooks.length === 0
-    const bodyOnly =
-      contracted === undefined &&
-      schema?.body !== undefined &&
-      schema.query === undefined &&
-      schema.params === undefined &&
-      schema.headers === undefined &&
-      this.derives.length === 0 &&
-      this.beforeHandleHooks.length === 0 &&
-      this.afterHandleHooks.length === 0 &&
-      this.onErrorHooks.length === 0
-    const fusedBody =
-      !bare &&
-      bodyOnly &&
-      schema.onValidationError === undefined &&
-      this.defaultOnValidationError === undefined &&
-      idempotent === undefined &&
-      ledgered === undefined &&
-      this.aroundHooks.length === 0
-    // Body-only routes still need an async body read, but eligible routes can compile the validation +
-    // handler continuation once. The runner keeps the bounded parser and all error semantics while
-    // avoiding the generic entry/schema/lifecycle dispatch on Bun, Deno, and Node-direct.
+    const {
+      pattern,
+      bodyLimit,
+      capabilities,
+      routeDecorations,
+      hasDecorations,
+      idempotent,
+      ledgered,
+      responseContract,
+      lanes,
+      routeAssurance,
+    } = compiled
+    const { bare, fusedQuery, fusedBody } = lanes
     const fusedBodyRunner = fusedBody
       ? this.buildFusedBodyRunner(
           handler as unknown as InternalHandler,
-          schema.body as StandardSchemaV1,
+          schema?.body as StandardSchemaV1,
           hasDecorations ? routeDecorations : undefined,
-          bodyLimit ?? this.maxBodyBytes,
+          bodyLimit ?? UNLIMITED_BODY_BYTES,
         )
       : undefined
+    // Fused lifecycle lanes: derive + before (with or without an after), and body + the same shape.
+    // The lane selectors in `selectRouteLanes` are exhaustive about the lifecycleHookLane /
+    // body-derive-before-after eligibility, so we only need to check the lane and the hook counts.
+    const lifecycleHookLane = lanes.lifecycleHookLane
+    const isFusedLifecycle = lifecycleHookLane !== undefined && this.derives.length === 1
+    const isFusedBodyLifecycle =
+      lanes.fusedLane === "body-derive-before" || lanes.fusedLane === "body-derive-before-after"
     const fusedWeb =
       bare && this.aroundHooks.length === 0
         ? this.buildFusedWeb(
             handler as unknown as InternalHandler,
             hasDecorations ? routeDecorations : undefined,
             isContextlessNoArgArrow(handler),
-            bodyLimit ?? this.maxBodyBytes,
+            bodyLimit ?? UNLIMITED_BODY_BYTES,
           )
         : fusedQuery
           ? this.buildFusedQueryWeb(
               handler as unknown as InternalHandler,
               hasDecorations ? routeDecorations : undefined,
-              schema.query as StandardSchemaV1,
-              bodyLimit ?? this.maxBodyBytes,
+              schema?.query as StandardSchemaV1,
+              bodyLimit ?? UNLIMITED_BODY_BYTES,
             )
           : fusedBody
             ? this.buildFusedBodyWeb(fusedBodyRunner as FusedBodyRunner)
-            : undefined
-    const contextless = bare && this.aroundHooks.length === 0 && isContextlessNoArgArrow(handler)
-    // The body and query lanes finalize the handler's result themselves, so a contracted route takes
-    // the general lifecycle lane instead - one place owns the check rather than three.
-    const lane = bare
-      ? "bare"
-      : bodyOnly
-        ? "body"
-        : contracted === undefined &&
-            schema?.body === undefined &&
-            schema?.query !== undefined &&
-            schema.params === undefined &&
-            schema.headers === undefined &&
-            this.derives.length === 0 &&
-            this.beforeHandleHooks.length === 0 &&
-            this.afterHandleHooks.length === 0 &&
-            this.onErrorHooks.length === 0
-          ? "query"
-          : "lifecycle"
-    // Lifecycle routes with no params schema are the common middleware shape: a derive/before hook
-    // plus an optional query or body schema. Select their complete validation stage at registration
-    // so the request path never re-checks params/body presence. Parameter-schema routes retain the
-    // generic lifecycle runner until their more involved recovery matrix is selected explicitly.
-    const lifecycleLane =
-      lane !== "lifecycle" || schema?.params !== undefined || schema?.headers !== undefined
-        ? undefined
-        : schema?.body !== undefined
-          ? schema.query !== undefined
-            ? "body-query"
-            : "body"
-          : schema?.query !== undefined
-            ? "query"
-            : "hooks"
-    // The realistic middleware shape is commonly exactly one synchronous-or-async derive followed
-    // by one before hook. Keep the generic runner for every route that can observe decorations,
-    // after hooks, error hooks, or response contracts; this lane only removes the two per-request
-    // hook-loop dispatches and preserves the same async continuations and error handling.
-    const lifecycleHookLane =
-      lane === "lifecycle" &&
-      contracted === undefined &&
-      !hasDecorations &&
-      this.derives.length === 1 &&
-      this.beforeHandleHooks.length === 1 &&
-      this.afterHandleHooks.length === 0 &&
-      this.onErrorHooks.length === 0
-        ? "derive-before"
-        : undefined
+            : isFusedBodyLifecycle
+              ? this.buildFusedBodyDeriveBeforeAfter(
+                  handler as unknown as InternalHandler,
+                  this.derives[0]!,
+                  this.beforeHandleHooks[0]!,
+                  this.afterHandleHooks[0],
+                  schema?.body as StandardSchemaV1,
+                  bodyLimit ?? UNLIMITED_BODY_BYTES,
+                )
+              : isFusedLifecycle && lifecycleHookLane === "derive-before"
+                ? this.buildFusedDeriveBefore(
+                    handler as unknown as InternalHandler,
+                    this.derives[0]!,
+                    this.beforeHandleHooks[0]!,
+                    schema?.query,
+                    bodyLimit ?? UNLIMITED_BODY_BYTES,
+                  )
+                : isFusedLifecycle && lifecycleHookLane === "derive-before-after"
+                  ? this.buildFusedDeriveBeforeAfter(
+                      handler as unknown as InternalHandler,
+                      this.derives[0]!,
+                      this.beforeHandleHooks[0]!,
+                      this.afterHandleHooks[0]!,
+                      schema?.query,
+                      bodyLimit ?? UNLIMITED_BODY_BYTES,
+                    )
+                  : undefined
+    const program = compileRouteProgram({
+      schema,
+      handler: handler as unknown as InternalHandler,
+      derives: this.derives,
+      beforeHandle: this.beforeHandleHooks,
+      afterHandle: this.afterHandleHooks,
+      onError: this.onErrorHooks,
+      decorations: routeDecorations,
+      hasDecorations,
+      bodySchema: schema?.body,
+      bodyLimit,
+      responseContract,
+    })
+    const contextless =
+      lanes.bare && this.aroundHooks.length === 0 && isContextlessNoArgArrow(handler)
     const execution = compileRouteExecutionPlan({
-      lane,
+      lane: lanes.lane,
       contextless,
       hasAround: this.aroundHooks.length > 0,
       hasLedger: ledgered !== undefined,
-      lifecycleLane,
       fusedWeb,
       fusedBody: fusedBodyRunner,
-      fusedLane:
-        fusedWeb === undefined ? undefined : fusedQuery ? "query" : fusedBody ? "body" : "bare",
+      fusedLane: lanes.fusedLane,
     })
     const registeredEntry: RouteEntry = {
-      // (context: never) => unknown -> InternalHandler: the framework invokes it
-      // with the concrete RawContext the typed handler expects, so this is sound.
       handler: handler as unknown as InternalHandler,
       schema,
       bodyLimit,
       idempotent,
       ledgered,
-      responseContract: contracted,
+      responseContract,
       derives: [...this.derives],
       decorations: routeDecorations,
       hasDecorations,
       beforeHandle: [...this.beforeHandleHooks],
       afterHandle: [...this.afterHandleHooks],
       onError: [...this.onErrorHooks],
-      lifecycleHookLane,
+      lifecycleHookLane: lanes.lifecycleHookLane,
       around: [...this.aroundHooks],
       execution,
+      program,
     }
     const descriptor: RouteDescriptor = {
       method,
@@ -1873,61 +1816,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       ...(capabilities.length > 0 ? { capabilities } : {}),
       ...(schema?.family === true ? { family: true } : {}),
     }
-    const routeAssurance: AssuranceDeclaration[] = [...this.activeAssurance, ...handlerAssurance]
-    if (contracted?.runtime.mode === "enforce" && schema?.response !== undefined) {
-      routeAssurance.push(
-        Object.freeze({
-          id: NIFRA_ASSURANCE_IDS.RESPONSE_CONTRACT,
-          source: "response-contract",
-          scope: "plugin",
-        }),
-      )
-    }
-    // Inline `schema.assurance`: the route DECLARES its enforcement evidence adjacent to the handler, so an
-    // in-handler-guarded route satisfies a policy `require:` clause without a `withRouteAssurance` middleware
-    // rewrite. Each id becomes route-scoped `declared` evidence (invalid ids fail closed at registration).
-    for (const id of schema?.assurance ?? []) {
-      if (!validEvidenceId(id)) {
-        throw new Error(
-          `route assurance: invalid evidence id ${JSON.stringify(id)} on ${method} ${path} (use lowercase dot/dash segments)`,
-        )
-      }
-      const declared = { id, source: "declared", scope: "plugin" } as AssuranceDeclaration
-      Object.defineProperty(declared, "provenance", {
-        value: "declared",
-        enumerable: false,
-        configurable: false,
-        writable: false,
-      })
-      routeAssurance.push(Object.freeze(declared))
-    }
-    if (schema?.body !== undefined) {
-      routeAssurance.push(
-        Object.freeze({
-          id: NIFRA_ASSURANCE_IDS.BODY_BOUNDED,
-          source: "route-schema",
-          scope: "plugin",
-        }),
-      )
-    }
-    // Declaring `schema.idempotency` is evidence for request replay only. It deliberately never proves
-    // durable command execution; that stronger evidence belongs to a command/outbox adapter.
-    if (schema?.idempotency !== undefined) {
-      routeAssurance.push(
-        Object.freeze({
-          id: NIFRA_ASSURANCE_IDS.IDEMPOTENCY_KEY,
-          source: "route-schema",
-          scope: "plugin",
-        }),
-      )
-    }
     return {
       method,
       path,
       pattern,
       entry: registeredEntry,
       descriptor,
-      assurance: Object.freeze(routeAssurance),
+      assurance: routeAssurance,
     }
   }
 
@@ -1961,6 +1856,29 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     this.responseContractRuntime = runtime
   }
 
+  /** @internal Symbol-keyed install seam for the response observer plugin. */
+  [INSTALL_RESPONSE_OBSERVER](runtime: ResponseObserverRuntime): ResponseObserverMethods {
+    this.assertConfigurable("responseObserver()")
+    const methods = runtime.install({
+      assertConfigurable: (operation) => this.assertConfigurable(operation),
+      addResponseHook: (web, node) => {
+        this.onResponseHooks.push(web)
+        this.onNodeResponseHooks.push(node)
+        if (node === undefined) this.nodeResponseHooksComplete = false
+      },
+      enableResponseBodyTagging: () => {
+        if (this.responseBodyTag === undefined) {
+          this.responseBodyTag = Object.freeze({})
+          this.responseBodyOwners.add(this.responseBodyTag)
+        }
+        return this.responseBodyTag
+      },
+      responseBodyOwners: () => this.responseBodyOwners,
+    })
+    Object.assign(this, methods)
+    return methods
+  }
+
   /** @internal Symbol-keyed install seam for the `idempotency()` plugin. Off the public typed surface. */
   [INSTALL_IDEMPOTENCY](runtime: IdempotencyRuntime): void {
     this.assertConfigurable("idempotency()")
@@ -2015,7 +1933,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * `RouteConfigError` at merge time, and a group with WebSocket routes is refused (register
    * those on the parent).
    */
-  merge<R2 extends Registry, Ctx2>(other: Server<R2, Ctx2>): Server<R & R2, Ctx> {
+  merge<R2 extends Registry, Ctx2, HookOutput2>(
+    other: Server<R2, Ctx2, HookOutput2>,
+  ): Server<R & R2, Ctx, HookOutput> {
     this.assertConfigurable("merge()")
     const source = other as unknown as Server<Registry, EmptyContext>
     if (source.wsRouteCount > 0) {
@@ -2100,7 +2020,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     if (!scoped) this.globalAssurance.push(...source.globalAssurance)
     this.mcpResourceList.push(...source.mcpResourceList)
     this.mcpPromptList.push(...source.mcpPromptList)
-    return this as unknown as Server<R & R2, Ctx>
+    return this as unknown as Server<R & R2, Ctx, HookOutput>
   }
 
   /** A fused renderer closes over runtime services to keep its seven-argument JSC fast path. Merging
@@ -2110,31 +2030,81 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     if (entry.execution.fusedWeb === undefined) return route
     // Rebuild with the SAME builder that produced the closure - rebinding a query-fused route as
     // bare would silently drop its validation.
+    const lane = entry.execution.fusedLane
+    // Type-erase the lane so each `===` branch sees the full union, not the narrowed remainder.
+    const laneName: string | undefined = lane
+    // Body+lifecycle routes have a fused Web renderer, but no body-only Node renderer: the latter
+    // would bypass derive/before/after because the Node-direct dispatcher prefers `fusedBody` over
+    // the generic execution plan. Only the original body-only lane may populate this slot.
     const fusedBody =
-      entry.execution.fusedLane === "body"
+      laneName === "body"
         ? this.buildFusedBodyRunner(
             entry.handler,
             entry.schema?.body as StandardSchemaV1,
             entry.hasDecorations ? entry.decorations : undefined,
-            entry.bodyLimit ?? this.maxBodyBytes,
+            entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
           )
         : undefined
+    const derive = entry.derives[0]
+    const before = entry.beforeHandle[0]
+    const after = entry.afterHandle[0]
     const fusedWeb =
-      entry.execution.fusedLane === "body"
+      laneName === "body"
         ? this.buildFusedBodyWeb(fusedBody as FusedBodyRunner)
-        : entry.execution.fusedLane === "query"
+        : laneName === "query"
           ? this.buildFusedQueryWeb(
               entry.handler,
               entry.hasDecorations ? entry.decorations : undefined,
               entry.schema?.query as StandardSchemaV1,
-              entry.bodyLimit ?? this.maxBodyBytes,
-            )
-          : this.buildFusedWeb(
-              entry.handler,
-              entry.hasDecorations ? entry.decorations : undefined,
-              isContextlessNoArgArrow(entry.handler),
-              entry.bodyLimit ?? this.maxBodyBytes,
+              entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
             )
+          : laneName === "body-derive-before" && derive !== undefined && before !== undefined
+            ? this.buildFusedBodyDeriveBeforeAfter(
+                entry.handler,
+                derive,
+                before,
+                undefined,
+                entry.schema?.body as StandardSchemaV1,
+                entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+              )
+            : laneName === "body-derive-before-after" &&
+                derive !== undefined &&
+                before !== undefined &&
+                after !== undefined
+              ? this.buildFusedBodyDeriveBeforeAfter(
+                  entry.handler,
+                  derive,
+                  before,
+                  after,
+                  entry.schema?.body as StandardSchemaV1,
+                  entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                )
+              : laneName === "derive-before" && derive !== undefined && before !== undefined
+                ? this.buildFusedDeriveBefore(
+                    entry.handler,
+                    derive,
+                    before,
+                    entry.schema?.query,
+                    entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                  )
+                : laneName === "derive-before-after" &&
+                    derive !== undefined &&
+                    before !== undefined &&
+                    after !== undefined
+                  ? this.buildFusedDeriveBeforeAfter(
+                      entry.handler,
+                      derive,
+                      before,
+                      after,
+                      entry.schema?.query,
+                      entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                    )
+                  : this.buildFusedWeb(
+                      entry.handler,
+                      entry.hasDecorations ? entry.decorations : undefined,
+                      isContextlessNoArgArrow(entry.handler),
+                      entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                    )
     return {
       ...route,
       entry: {
@@ -2290,6 +2260,45 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return outcome
   }
 
+  /**
+   * Select a mounted handler's native Node lane without materializing a Web Request. This is an
+   * adapter seam, not a second lifecycle: any app-wide behavior that the ordinary mount path would
+   * run makes the capability ineligible and the caller falls back to `resolveNodeSource`. Typed
+   * routes keep precedence exactly as `routeAndRun` does, including the existing mount behavior for
+   * a path whose registered route rejects this method.
+   */
+  [RESOLVE_NODE_MOUNT](source: RequestSource): NativeMountSelection | undefined {
+    if (
+      this.onRequestHooks.length > 0 ||
+      this.onResponseHooks.length > 0 ||
+      this.onResponseFinalizedHooks.length > 0 ||
+      this.capacityGate !== undefined ||
+      this.staticResponseHeaders !== undefined ||
+      this.requestTimeoutMs !== 0 ||
+      this.acceptInboundDeadlines ||
+      this.clientIpTrust !== undefined
+    ) {
+      return undefined
+    }
+
+    const parts = source.urlParts ?? urlPartsOf(source.url)
+    const match = this.catalog.find(source.method, parts.pathname)
+    if (match.found) return undefined
+
+    for (const mount of this.fetchMounts) {
+      if (!underMountPrefix(parts.pathname, mount.path)) continue
+      const candidate = (mount.handler as unknown as Record<symbol, unknown>)[NODE_NATIVE_MOUNT]
+      return typeof candidate === "function"
+        ? {
+            handler: candidate as NativeMountHandler,
+            path: mount.path,
+            stripPrefix: mount.stripPrefix,
+          }
+        : undefined
+    }
+    return undefined
+  }
+
   /**
    * Like {@link fetch}, but renders a plain-data result **without** building a Web `Response` - the
    * `@nifrajs/node` adapter serializes the returned primitives straight to the socket, skipping the undici
@@ -2668,7 +2677,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     // True only from the Web `fetch` path - unlocks each route's fused lane, whose output type IS
     // `Response` (`T = Response` there by construction; the node path always passes false).
@@ -2696,7 +2705,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
   ): MaybePromise<T> {
     const hooks = this.onNodeRequestHooks
@@ -2730,7 +2739,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
   ): Promise<T> {
     if (first !== undefined) return wrapResponse(first)
@@ -2758,7 +2767,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): MaybePromise<T> {
@@ -2805,7 +2814,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     sourceAtAwait: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): Promise<T> {
@@ -2893,13 +2902,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   /**
    * Route → build context → run. Synchronous through to the handler for a **bare** route
    * (selected by its compiled plan), so a sync handler produces its result with zero promise allocations;
-   * routes with validation/hooks keep the full async {@link runLifecycle}, unchanged.
+   * routes with validation/hooks keep the full compiled route program, unchanged.
    */
   private routeAndRun<T>(
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): MaybePromise<T> {
@@ -2951,17 +2960,19 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       }
       if (match.reason === "method-not-allowed") {
         return wrapResponse(
-          jsonError(405, "method_not_allowed", { Allow: match.allowed.join(", ") }),
+          // Lowercase on purpose: a plain render's headers go into the node outcome record verbatim,
+          // and every other name in that record is lowercase (the Web lane normalizes either way).
+          plainError(405, "method_not_allowed", { allow: match.allowed.join(", ") }),
         )
       }
-      return wrapResponse(jsonError(404, "not_found"))
+      return wrapResponse(plainError(404, "not_found"))
     }
 
     // Inspect only captured values for escapes. Scanning the full pathname repeated work the router
     // already did and made every plain dynamic route pay for unrelated static path bytes.
     const params = match.params === EMPTY_PARAMS ? match.params : decodeRouteParams(match.params)
     if (params === null) {
-      return wrapResponse(jsonError(400, "malformed_path"))
+      return wrapResponse(plainError(400, "malformed_path"))
     }
 
     return this.runMatched(
@@ -3001,7 +3012,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     params: Record<string, string>,
     search: string | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): MaybePromise<T> {
@@ -3032,7 +3043,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         search,
         wrapResponse,
         {
-          maxBodyBytes: entry.bodyLimit ?? this.maxBodyBytes,
+          maxBodyBytes: entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
           runLanes: (buffered, plat, ent, prm, srch) =>
             this.idempotencyRunLanes(buffered, plat, ent as RouteEntry, prm, srch),
         },
@@ -3059,7 +3070,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     params: Record<string, string>,
     search: string | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): MaybePromise<T> {
@@ -3081,7 +3092,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         ? undefined
         : admitDeadline(source.headers, this.deadlineAdmissionOptions)
     if (admission !== undefined && !admission.ok) {
-      return wrapResponse(jsonError(admission.status, admission.reason))
+      return wrapResponse(plainError(admission.status, admission.reason))
     }
     const effectiveTimeoutMs = admission?.timeoutMs ?? 0
 
@@ -3140,7 +3151,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     if (controller !== undefined && outcome instanceof Promise) {
       const timedOut =
         admission?.inherited === true
-          ? () => wrapResponse(jsonError(504, "deadline_exceeded"))
+          ? () => wrapResponse(plainError(504, "deadline_exceeded"))
           : onTimeout
       return this.withTimeout(
         outcome,
@@ -3161,7 +3172,6 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   /** The narrowest bare route: a syntactic `() => ...` handler cannot observe the context argument, so
    * successful requests can skip allocating `RequestContext`. Errors still allocate one for logging. */
   // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
   private runContextlessBare<T>(
     entry: RouteEntry,
     source: RequestSource,
@@ -3171,7 +3181,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     budget: RequestBudget,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     let result: unknown
     try {
@@ -3215,9 +3225,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     signal: AbortSignal,
     budget: RequestBudget,
     platform: Platform | undefined,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): T {
     if (err instanceof Response) return wrapResponse(err)
+    // Handed over as the plain data it is: `wrapResponse` renders it on the JSON lane (no `Response`
+    // built on Node). There is no context here by construction, so there is no `c.set` to merge.
+    if (isResponseResult(err)) return wrapResponse(err)
     const ctx = new RequestContext(
       source,
       params,
@@ -3229,43 +3242,42 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       this.protoPoisoning,
     )
     this.logRequestError(err, ctx)
-    return wrapResponse(jsonError(500, "internal_error"))
+    return this.internalErrorResponse(wrapResponse)
   }
 
   /**
    * The synchronous fast path selected by a route's execution plan: apply static decorations, call the
    * handler, render the result - **no `await`** unless the handler itself returns a promise. It mirrors
-   * the bare slice of {@link runLifecycle} (which a bare route would otherwise no-op through) and shares
+   * the same error boundary as the compiled route program (which a bare route would otherwise no-op through) and shares
    * {@link logRequestError}; a bare route has no `onError` hooks, so error handling is fully synchronous
    * (a thrown `Response` is control flow; anything else is a logged flat 500). This is where nifra skips
    * the per-request async-frame tax - the same win codegen routers get, but without `eval`.
    */
   // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
   private runBare<T>(
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     let result: unknown
     try {
       if (entry.hasDecorations) Object.assign(ctx, entry.decorations)
       result = entry.handler(ctx)
     } catch (err) {
-      return this.bareError(err, ctx, wrapResponse)
+      return this.bareError(err, ctx, finalize, wrapResponse)
     }
     if (result instanceof Promise) {
       // Async handler on an otherwise-bare route: finish on a microtask, with the same error handling.
       return result.then(
         (value) => finalize(value, responseSet(ctx)),
-        (err) => this.bareError(err, ctx, wrapResponse),
+        (err) => this.bareError(err, ctx, finalize, wrapResponse),
       )
     }
     return finalize(result, responseSet(ctx))
   }
 
-  /** Bare-route error rendering - identical to {@link runLifecycle}'s catch minus the (absent) onError
+  /** Bare-route error rendering - identical to the compiled route program's catch minus the (absent) onError
    * loop: a thrown `Response` is returned as deliberate control flow; anything else is logged + 500. */
   /**
    * Build a route's fused Web renderer. Composition happens once at
@@ -3280,13 +3292,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     contextless: boolean,
     maxBodyBytes: number,
   ): FusedWebRunner {
-    // The fused lanes return to the runtime directly, so the framework's own error renders fold in
-    // static headers here rather than through the shared `wrapResponse` seam.
-    const logError = (err: unknown, ctx: RawContext): Response => {
-      if (err instanceof Response) return this.wrapWebResponse(err)
-      this.logRequestError(err, ctx)
-      return this.wrapWebResponse(jsonError(500, "internal_error"))
-    }
+    // Same thrown-value contract as the generic lane (`bare-error-lane.ts` via `bareError`); the fused
+    // lane only injects its renderer, so a thrown `status(...)` and the flat 500 fold in static headers
+    // through `wrapWebResponse`. One source of truth for the error surface, no per-lane copy to drift.
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
+      )
     if (contextless && decorations === undefined) {
       // `() => ...` can't observe the context - skip allocating one entirely (errors still build
       // one for the structured log, exactly like runContextlessBare).
@@ -3416,20 +3431,21 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     const logError = <T>(
       err: unknown,
       ctx: RawContext,
-      wrapResponse: (response: Response) => T,
-    ): T => this.bareError(err, ctx, wrapResponse)
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): T => this.bareError(err, ctx, finalize, wrapResponse)
 
     const runHandler = <T>(
       ctx: RawContext,
       finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-      wrapResponse: (response: Response) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
     ): MaybePromise<T> => {
       if (decorations !== undefined) Object.assign(ctx, decorations)
       let output: MaybePromise<HandlerResult>
       try {
         output = handler(ctx)
       } catch (err) {
-        return logError(err, ctx, wrapResponse)
+        return logError(err, ctx, finalize, wrapResponse)
       }
       if (output instanceof Promise) {
         return output.then(
@@ -3437,16 +3453,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
             try {
               return finalize(result, responseSet(ctx), ctx)
             } catch (err) {
-              return logError(err, ctx, wrapResponse)
+              return logError(err, ctx, finalize, wrapResponse)
             }
           },
-          (err) => logError(err, ctx, wrapResponse),
+          (err) => logError(err, ctx, finalize, wrapResponse),
         )
       }
       try {
         return finalize(output, responseSet(ctx), ctx)
       } catch (err) {
-        return logError(err, ctx, wrapResponse)
+        return logError(err, ctx, finalize, wrapResponse)
       }
     }
 
@@ -3454,9 +3470,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       result: StandardResult<unknown>,
       ctx: RawContext,
       finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-      wrapResponse: (response: Response) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
     ): MaybePromise<T> => {
-      if (result.issues !== undefined) return wrapResponse(validationError(result.issues))
+      if (result.issues !== undefined) return wrapResponse(plainValidationError(result.issues))
       ctx.body = result.value
       return runHandler(ctx, finalize, wrapResponse)
     }
@@ -3465,13 +3481,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       parsed: unknown,
       ctx: RawContext,
       finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-      wrapResponse: (response: Response) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
     ): MaybePromise<T> => {
       let validation: StandardResult<unknown> | Promise<StandardResult<unknown>>
       try {
         validation = bodySchema["~standard"].validate(parsed)
       } catch (err) {
-        return logError(err, ctx, wrapResponse)
+        return logError(err, ctx, finalize, wrapResponse)
       }
       if (validation instanceof Promise) {
         return validation.then(
@@ -3479,16 +3495,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
             try {
               return runValidated(settled, ctx, finalize, wrapResponse)
             } catch (err) {
-              return logError(err, ctx, wrapResponse)
+              return logError(err, ctx, finalize, wrapResponse)
             }
           },
-          (err) => logError(err, ctx, wrapResponse),
+          (err) => logError(err, ctx, finalize, wrapResponse),
         )
       }
       try {
         return runValidated(validation, ctx, finalize, wrapResponse)
       } catch (err) {
-        return logError(err, ctx, wrapResponse)
+        return logError(err, ctx, finalize, wrapResponse)
       }
     }
 
@@ -3501,7 +3517,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       platform: Platform | undefined,
       nativeContext: boolean,
       finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-      wrapResponse: (response: Response) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
     ): MaybePromise<T> => {
       const ctx = nativeContext
         ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
@@ -3517,8 +3533,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
           )
       const finish = (value: unknown): MaybePromise<T> =>
         runParsed(value, ctx, finalize, wrapResponse)
-      return this.readBodyInput(source, maxBodyBytes, finish, wrapResponse, (err) =>
-        logError(err, ctx, wrapResponse),
+      return readBodyFramed(
+        source,
+        maxBodyBytes,
+        this.protoPoisoning,
+        finish,
+        wrapResponse,
+        (err) => logError(err, ctx, finalize, wrapResponse),
       )
     }
   }
@@ -3560,13 +3581,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     querySchema: StandardSchemaV1,
     maxBodyBytes: number,
   ): FusedWebRunner {
-    // The fused lanes return to the runtime directly, so the framework's own error renders fold in
-    // static headers here rather than through the shared `wrapResponse` seam.
-    const logError = (err: unknown, ctx: RawContext): Response => {
-      if (err instanceof Response) return this.wrapWebResponse(err)
-      this.logRequestError(err, ctx)
-      return this.wrapWebResponse(jsonError(500, "internal_error"))
-    }
+    // Same thrown-value contract as the generic lane (`bare-error-lane.ts` via `bareError`); the fused
+    // lane only injects its renderer, so a thrown `status(...)` and the flat 500 fold in static headers
+    // through `wrapWebResponse`. One source of truth for the error surface, no per-lane copy to drift.
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
+      )
     const runHandler = (ctx: RawContext, value: unknown): MaybePromise<Response> => {
       ctx.query = value
       let result: unknown
@@ -3620,1042 +3644,984 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         return validation.then(
           (settled) =>
             settled.issues !== undefined
-              ? this.wrapWebResponse(validationError(settled.issues))
+              ? this.wrapWebResponse(plainValidationError(settled.issues))
               : runHandler(ctx, settled.value),
           (err) => logError(err, ctx),
         )
       }
       if (validation.issues !== undefined)
-        return this.wrapWebResponse(validationError(validation.issues))
+        return this.wrapWebResponse(plainValidationError(validation.issues))
       return runHandler(ctx, validation.value)
     }
   }
 
-  private bareError<T>(err: unknown, ctx: RawContext, wrapResponse: (response: Response) => T): T {
-    if (err instanceof Response) return wrapResponse(err)
-    this.logRequestError(err, ctx)
-    return wrapResponse(jsonError(500, "internal_error"))
-  }
-
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runWithAround<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    run: () => MaybePromise<T>,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): MaybePromise<T> {
-    let outcome: MaybePromise<T>
-    try {
-      outcome = this.runAround(entry.around, ctx, run)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
-    return outcome instanceof Promise
-      ? outcome.catch((err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse))
-      : outcome
-  }
-
-  private runAround<T>(
-    hooks: ReadonlyArray<RawAround>,
-    ctx: RawContext,
-    run: () => MaybePromise<T>,
-  ): MaybePromise<T> {
-    const dispatch = (index: number): MaybePromise<T> => {
-      if (index >= hooks.length) return run()
-      const hook = hooks[index]!
-      let called = false
-      return hook(ctx, () => {
-        if (called) throw new Error("around next() called multiple times")
-        called = true
-        return dispatch(index + 1)
-      })
-    }
-    return dispatch(0)
-  }
-
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runBodyOnly<T>(
-    entry: RouteEntry,
-    source: RequestSource,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): Promise<T> {
-    return this.readBodyInput(
-      source,
-      entry.bodyLimit ?? this.maxBodyBytes,
-      (parsed) => this.finishBodyOnly(entry, parsed, ctx, finalize, wrapResponse),
-      wrapResponse,
-      (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-    )
-  }
-
-  /** Shared bounded body framing/parser. Both body lanes use the same trust-boundary checks; only
-   * the validation + handler continuation differs. */
-  private readBodyInput<T>(
-    source: RequestSource,
+  /**
+   * Compile a route's `derive + before` lifecycle to a single closure: the per-request walk through
+   * `runSync` → `runHooksSync` is a stack of 3 frames and 2 `Object.assign`s for what is by far the
+   * most common middleware shape (auth/trace/id derivation, an auth/policy `beforeHandle`). Folding
+   * the same steps into one closure hits the same monomorphic inline-cache site as `buildFusedWeb`,
+   * and `Object.assign(ctx, deriveResult)` becomes one extra property write on the context's already
+   * hot hidden class. Behavior is byte-identical to the compiled route program: the same thrown-value
+   * contract (`Response` is control flow, anything else logs + 500), the same `c.set` semantics, the
+   * same `fusedRespond` for the rendered body. The `LifecycleExecutionLane` guarantee
+   * (`schema.params === undefined && schema.headers === undefined && derives === 1 &&
+   * beforeHandle === 1 && afterHandle === 0 && onError === 0 && !hasResponseContract &&
+   * !hasDecorations`) is enforced by `selectRouteLanes`; this lane is selected ONLY when all of those
+   * hold. A `query` schema (the route declares `{ query }` alongside the hooks) is validated FIRST,
+   * mirroring the compiled route program's stage order; the fused builder runs validate → derive →
+   * before → handler in one frame.
+   */
+  private buildFusedDeriveBefore(
+    handler: InternalHandler,
+    derive: RawDerive,
+    before: RawBeforeHandle,
+    querySchema: StandardSchemaV1 | undefined,
     maxBodyBytes: number,
-    onParsed: (parsed: unknown) => MaybePromise<T>,
-    wrapResponse: (response: Response) => T,
-    onError: (err: unknown) => MaybePromise<T>,
-  ): Promise<T> {
-    const contentType = headerOf(source, "content-type") ?? ""
-    if (contentType !== "application/json" && !contentType.includes("application/json")) {
-      if (isUrlEncodedForm(contentType)) {
-        return readBoundedForm(source, maxBodyBytes).then(
-          (form) => (form instanceof Response ? wrapResponse(form) : onParsed(form)),
-          onError,
-        ) as Promise<T>
-      }
-      return Promise.resolve(wrapResponse(jsonError(415, "unsupported_media_type")))
-    }
-
-    // All JSON bodies go through readBoundedJson - the single enforcement point for the framed
-    // fast path (post-read byte re-check), the streaming cap, and the prototype-poisoning guard.
-    // A separate inlined native-json() fast path here would fork the trust boundary in two.
-    try {
-      return this.readBoundedJson(
-        source,
-        maxBodyBytes,
-        (parsed) => (parsed instanceof Response ? wrapResponse(parsed) : onParsed(parsed)),
-        onError,
+  ): FusedWebRunner {
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
       )
-    } catch (err) {
-      return Promise.resolve(onError(err))
-    }
-  }
-
-  /** Validate + run the handler for the bodyOnly path - shared by the inline fast path and the
-   * streaming fallback. A method (not per-request closures) so the hot path allocates nothing
-   * beyond the one `.then` continuation. */
-  private finishBodyOnly<T>(
-    entry: RouteEntry,
-    parsed: unknown,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): MaybePromise<T> {
-    try {
-      const bodySchema = entry.schema!.body!
-      const validation = bodySchema["~standard"].validate(parsed)
-      if (validation instanceof Promise) {
-        return validation.then(
-          (result) => {
-            try {
-              const outcome = this.applyBodyValidation(entry, result, ctx, finalize, wrapResponse)
-              return outcome instanceof Promise
-                ? outcome.catch((err) =>
-                    this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-                  )
-                : outcome
-            } catch (err) {
-              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-            }
-          },
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+    return (source, params, search, signal, budget, platform, nativeContext) => {
+      const ctx = nativeContext
+        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+        : new RequestContext(
+            source,
+            params,
+            search,
+            signal,
+            budget,
+            platform,
+            maxBodyBytes,
+            this.protoPoisoning,
+          )
+      const runHandler = (): MaybePromise<Response> => {
+        let result: unknown
+        try {
+          result = handler(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (result instanceof Promise) {
+          return result.then(
+            (value) =>
+              fusedRespond(
+                value,
+                ctx,
+                this.responseBodyTag,
+                this.staticResponseHeaders,
+                this.onResponseHooks.length === 0,
+              ),
+            (err) => logError(err, ctx),
+          )
+        }
+        return fusedRespond(
+          result,
+          ctx,
+          this.responseBodyTag,
+          this.staticResponseHeaders,
+          this.onResponseHooks.length === 0,
         )
       }
-      const outcome = this.applyBodyValidation(entry, validation, ctx, finalize, wrapResponse)
-      return outcome instanceof Promise
-        ? outcome.catch((err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse))
-        : outcome
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
-  }
-
-  private executeHandler<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse?: (response: Response) => T,
-  ): MaybePromise<T> {
-    if (entry.hasDecorations) Object.assign(ctx, entry.decorations)
-    const handlerOutput = entry.handler(ctx)
-    if (handlerOutput instanceof Promise) {
-      return handlerOutput.then(
-        (value) => finalize(value, responseSet(ctx)),
-        (err) => {
-          if (wrapResponse) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-          }
-          throw err
-        },
-      )
-    }
-    return finalize(handlerOutput, responseSet(ctx))
-  }
-
-  private handleValidationErrorRecovery<T>(
-    entry: RouteEntry,
-    recovery: unknown,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    originalIssues: ReadonlyArray<StandardIssue>,
-    kind: "body" | "query",
-  ): MaybePromise<T> {
-    if (recovery !== undefined) {
-      if (recovery instanceof Response) {
-        return wrapResponse(recovery)
-      }
-      if (kind === "body" && entry.schema?.body) {
-        const validation = entry.schema.body["~standard"].validate(recovery)
-        if (validation instanceof Promise) {
-          return validation.then((settled) => {
-            if (settled.issues !== undefined) return wrapResponse(validationError(settled.issues))
-            ctx.body = settled.value
-            return this.executeHandler(entry, ctx, finalize)
-          })
+      const runBefore = (): MaybePromise<Response> => {
+        let early: unknown
+        try {
+          early = before(ctx)
+        } catch (err) {
+          return logError(err, ctx)
         }
-        if (validation.issues !== undefined) return wrapResponse(validationError(validation.issues))
-        ctx.body = validation.value
-        return this.executeHandler(entry, ctx, finalize)
-      }
-      if (kind === "query" && entry.schema?.query) {
-        const validation = entry.schema.query["~standard"].validate(recovery)
-        if (validation instanceof Promise) {
-          return validation.then(
+        if (early instanceof Promise) {
+          return early.then(
             (settled) => {
-              if (settled.issues !== undefined) return wrapResponse(validationError(settled.issues))
-              ctx.query = settled.value
-              return this.executeHandler(entry, ctx, finalize, wrapResponse)
+              if (settled === undefined) return runHandler()
+              return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
             },
-            (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+            (err) => logError(err, ctx),
           )
         }
-        if (validation.issues !== undefined) return wrapResponse(validationError(validation.issues))
-        ctx.query = validation.value
-        return this.executeHandler(entry, ctx, finalize, wrapResponse)
+        if (early === undefined) return runHandler()
+        return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders)
       }
-    }
-    return wrapResponse(validationError(originalIssues))
-  }
-
-  private applyBodyValidation<T>(
-    entry: RouteEntry,
-    result: StandardResult<unknown>,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): MaybePromise<T> {
-    if (result.issues !== undefined) {
-      const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
-      if (hook) {
-        const recovery = hook(result.issues, ctx as unknown as Context, "body")
-        if (recovery instanceof Promise) {
-          return recovery.then((rec) =>
-            this.handleValidationErrorRecovery(
-              entry,
-              rec,
-              ctx,
-              finalize,
-              wrapResponse,
-              result.issues!,
-              "body",
-            ),
+      const runDerive = (): MaybePromise<Response> => {
+        let derived: unknown
+        try {
+          derived = derive(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (derived instanceof Promise) {
+          return derived.then(
+            (settled) => {
+              if (isResponseResult(settled) || settled instanceof Response) {
+                return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+              }
+              Object.assign(ctx, settled as object)
+              return runBefore()
+            },
+            (err) => logError(err, ctx),
           )
         }
-        return this.handleValidationErrorRecovery(
-          entry,
-          recovery,
-          ctx,
-          finalize,
-          wrapResponse,
-          result.issues,
-          "body",
-        )
+        if (isResponseResult(derived) || derived instanceof Response) {
+          return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders)
+        }
+        Object.assign(ctx, derived as object)
+        return runBefore()
+      }
+      if (querySchema === undefined) return runDerive()
+      let validation: MaybePromise<StandardResult<unknown>>
+      try {
+        validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]))
+      } catch (err) {
+        return logError(err, ctx)
       }
-      return wrapResponse(validationError(result.issues))
-    }
-    ctx.body = result.value
-    return this.executeHandler(entry, ctx, finalize)
-  }
-
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runQueryOnly<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): MaybePromise<T> {
-    try {
-      // Call the validator directly for the raw StandardResult (read `.issues`/`.value`) - skip
-      // `validateStandard`'s per-request wrapper-object allocation, mirroring the bodyOnly path.
-      const validation = entry.schema!.query!["~standard"].validate(
-        queryObjectOf(ctx[CONTEXT_SEARCH]),
-      )
       if (validation instanceof Promise) {
         return validation.then(
           (settled) => {
-            try {
-              const outcome = this.applyQueryValidation(entry, settled, ctx, finalize, wrapResponse)
-              return outcome instanceof Promise
-                ? outcome.catch((err) =>
-                    this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-                  )
-                : outcome
-            } catch (err) {
-              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-            }
+            if (settled.issues !== undefined)
+              return this.wrapWebResponse(plainValidationError(settled.issues))
+            ctx.query = settled.value
+            return runDerive()
           },
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+          (err) => logError(err, ctx),
         )
       }
-      return this.applyQueryValidation(entry, validation, ctx, finalize, wrapResponse)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      if (validation.issues !== undefined)
+        return this.wrapWebResponse(plainValidationError(validation.issues))
+      ctx.query = validation.value
+      return runDerive()
     }
   }
 
-  /** Validate-result → set `ctx.query` → run handler. A method (not a per-request closure), the
-   * query analogue of {@link applyBodyValidation}. */
-  private applyQueryValidation<T>(
-    entry: RouteEntry,
-    result: StandardResult<unknown>,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): MaybePromise<T> {
-    if (result.issues !== undefined) {
-      const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
-      if (hook) {
-        const recovery = hook(result.issues, ctx as unknown as Context, "query")
-        if (recovery instanceof Promise) {
-          return recovery.then((rec) =>
-            this.handleValidationErrorRecovery(
-              entry,
-              rec,
-              ctx,
-              finalize,
-              wrapResponse,
-              result.issues!,
-              "query",
-            ),
+  /**
+   * Same shape as `buildFusedDeriveBefore`, plus one `afterHandle` step. The closure runs (validate) →
+   * derive → before → handler → after in one frame, the shape the realistic middleware route lands on
+   * when it also wants a response transform (e.g. attaching a request id to a successful payload's
+   * headers). `LifecycleExecutionLane` and `selectRouteLanes` guarantee `afterHandle === 1`, the
+   * throw contract is the same as the generic program, and the `after` step is the final transform +
+   * respond the generic program already does.
+   */
+  private buildFusedDeriveBeforeAfter(
+    handler: InternalHandler,
+    derive: RawDerive,
+    before: RawBeforeHandle,
+    after: RawAfterHandle,
+    querySchema: StandardSchemaV1 | undefined,
+    maxBodyBytes: number,
+  ): FusedWebRunner {
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
+      )
+    return (source, params, search, signal, budget, platform, nativeContext) => {
+      const ctx = nativeContext
+        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+        : new RequestContext(
+            source,
+            params,
+            search,
+            signal,
+            budget,
+            platform,
+            maxBodyBytes,
+            this.protoPoisoning,
+          )
+      const runAfter = (result: unknown): MaybePromise<Response> => {
+        let transformed: unknown
+        try {
+          transformed = after(result, ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (transformed instanceof Promise) {
+          return transformed.then(
+            (value) =>
+              fusedRespond(
+                value,
+                ctx,
+                this.responseBodyTag,
+                this.staticResponseHeaders,
+                this.onResponseHooks.length === 0,
+              ),
+            (err) => logError(err, ctx),
           )
         }
-        return this.handleValidationErrorRecovery(
-          entry,
-          recovery,
+        return fusedRespond(
+          transformed,
           ctx,
-          finalize,
-          wrapResponse,
-          result.issues,
-          "query",
+          this.responseBodyTag,
+          this.staticResponseHeaders,
+          this.onResponseHooks.length === 0,
         )
       }
-      return wrapResponse(validationError(result.issues))
-    }
-    ctx.query = result.value
-    return this.executeHandler(entry, ctx, finalize, wrapResponse)
-  }
-
-  /**
-   * Thread the response through each global `onResponse` hook. Stays SYNCHRONOUS until a hook
-   * actually returns a Promise - an `async` version forced a promise + microtask on EVERY response
-   * of any app with an onResponse hook (cors/securityHeaders/etag/timing all use onResponse), the
-   * same ~13%/req tax the onRequest walk was de-async'd to avoid. The first async hook hands the
-   * rest to {@link continueOnResponse}.
-   */
-  private applyOnResponse(response: Response, req: Request): MaybePromise<Response> {
-    const hooks = this.onResponseHooks
-    let current = response
-    for (let i = 0; i < hooks.length; i++) {
-      const next = (hooks[i] as RawOnResponse)(current, req)
-      if (next instanceof Promise) {
-        return next.then((settled) => this.continueOnResponse(settled, i + 1, req))
+      const runHandler = (): MaybePromise<Response> => {
+        let result: unknown
+        try {
+          result = handler(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (result instanceof Promise) {
+          return result.then(
+            (value) => runAfter(value),
+            (err) => logError(err, ctx),
+          )
+        }
+        return runAfter(result)
       }
-      current = next
-    }
-    return current
-  }
-
-  private applyOnResponseAndFinalize(response: Response, req: Request): MaybePromise<Response> {
-    try {
-      const transformed = this.applyOnResponse(response, req)
-      return transformed instanceof Promise
-        ? transformed.then(
-            (settled) => this.completeResponseFinalization({ response: settled }, req),
-            (error) => this.failResponseFinalization(response, error, req),
+      const runBefore = (): MaybePromise<Response> => {
+        let early: unknown
+        try {
+          early = before(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (early instanceof Promise) {
+          return early.then(
+            (settled) => {
+              if (settled === undefined) return runHandler()
+              return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+            },
+            (err) => logError(err, ctx),
           )
-        : this.completeResponseFinalization({ response: transformed }, req)
-    } catch (error) {
-      return this.failResponseFinalization(response, error, req)
-    }
-  }
-
-  private completeResponseFinalization(
-    outcome: ResponseFinalization,
-    req: Request,
-  ): MaybePromise<Response> {
-    const notified = this.notifyResponseFinalized(outcome, req)
-    return notified instanceof Promise ? notified.then(() => outcome.response) : outcome.response
-  }
-
-  private failResponseFinalization(
-    response: Response,
-    error: unknown,
-    req: Request,
-  ): Promise<never> {
-    const notified = this.notifyResponseFinalized({ response, error }, req)
-    if (notified instanceof Promise) {
-      return notified.then(() => {
-        throw error
-      })
-    }
-    // A hook failure must surface as a REJECTION even when every prior step ran synchronously:
-    // `fetch()` may now resolve without a promise, but its failure contract stays promise-shaped -
-    // a synchronous throw here would escape `Promise.resolve(app.fetch(...))` bridges and
-    // `.then()`-style callers entirely instead of reaching their rejection handling.
-    return Promise.reject(error)
-  }
-
-  /** Notify terminal observers in order while isolating both sync and async failures. */
-  private notifyResponseFinalized(outcome: ResponseFinalization, req: Request): MaybePromise<void> {
-    let pending: Promise<void> | undefined
-    for (const hook of this.onResponseFinalizedHooks) {
-      if (pending !== undefined) {
-        pending = pending.then(async () => {
-          try {
-            await hook(outcome, req)
-          } catch {
-            // Terminal observation must never change request behavior.
-          }
-        })
-        continue
+        }
+        if (early === undefined) return runHandler()
+        return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders)
+      }
+      const runDerive = (): MaybePromise<Response> => {
+        let derived: unknown
+        try {
+          derived = derive(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (derived instanceof Promise) {
+          return derived.then(
+            (settled) => {
+              if (isResponseResult(settled) || settled instanceof Response) {
+                return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+              }
+              Object.assign(ctx, settled as object)
+              return runBefore()
+            },
+            (err) => logError(err, ctx),
+          )
+        }
+        if (isResponseResult(derived) || derived instanceof Response) {
+          return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders)
+        }
+        Object.assign(ctx, derived as object)
+        return runBefore()
       }
+      if (querySchema === undefined) return runDerive()
+      let validation: MaybePromise<StandardResult<unknown>>
       try {
-        const result = hook(outcome, req)
-        if (result instanceof Promise) pending = result.catch(() => {})
-      } catch {
-        // Terminal observation must never change request behavior.
+        validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]))
+      } catch (err) {
+        return logError(err, ctx)
       }
-    }
-    return pending
-  }
-
-  /** Async tail of {@link applyOnResponse}: runs the remaining hooks once one has gone async. */
-  private async continueOnResponse(
-    response: Response,
-    nextIndex: number,
-    req: Request,
-  ): Promise<Response> {
-    let current = response
-    for (let i = nextIndex; i < this.onResponseHooks.length; i++) {
-      const next = (this.onResponseHooks[i] as RawOnResponse)(current, req)
-      current = next instanceof Promise ? await next : next
-    }
-    return current
-  }
-
-  /**
-   * Bound the response time. On timeout we abort `ctx.signal` (so cancellation-aware
-   * handlers can bail) and return 503; the in-flight work keeps running but its
-   * result is discarded - JS can't forcibly cancel a promise.
-   */
-  private async withTimeout<T>(
-    work: Promise<T>,
-    controller: AbortController,
-    onTimeout: () => T,
-    timeoutMs: number,
-  ): Promise<T> {
-    let timer: ReturnType<typeof setTimeout> | undefined
-    const timeout = new Promise<T>((resolve) => {
-      timer = setTimeout(() => {
-        controller.abort()
-        resolve(onTimeout())
-      }, timeoutMs)
-    })
-    try {
-      return await Promise.race([work, timeout])
-    } finally {
-      if (timer !== undefined) clearTimeout(timer)
+      if (validation instanceof Promise) {
+        return validation.then(
+          (settled) => {
+            if (settled.issues !== undefined)
+              return this.wrapWebResponse(plainValidationError(settled.issues))
+            ctx.query = settled.value
+            return runDerive()
+          },
+          (err) => logError(err, ctx),
+        )
+      }
+      if (validation.issues !== undefined)
+        return this.wrapWebResponse(plainValidationError(validation.issues))
+      ctx.query = validation.value
+      return runDerive()
     }
   }
 
   /**
-   * The post-match lifecycle: validate → derive → beforeHandle → handler → afterHandle, with onError.
-   * Generic over the render: a success value goes through `finalize(result, set)` (a Web `Response`, or
-   * node-direct primitives); an early/error `Response` (validation, thrown, 500) through `wrapResponse`.
+   * Body + lifecycle hooks fused: parse → validate → derive → before → handler → (after) in one
+   * closure, the same win `buildFusedBodyRunner` gives for the no-hooks body shape. The shape is
+   * `lifecycleHookLane` PLUS a body schema with no other validation conflicts; the lane is selected
+   * ONLY when `schema.body !== undefined && schema.query/params/headers === undefined &&
+   * schema.onValidationError === undefined && !defaultOnValidationError && !hasIdempotency &&
+   * !hasLedger && derives === 1 && beforeHandle === 1 && afterHandle <= 1 && onError === 0 &&
+   * !hasResponseContract && !hasDecorations && around === 0`. The same single `querySchema === undefined`
+   * trick used in the no-body lane lets the build path stay simple: a query + body route falls back
+   * to the generic program (this is rare in practice - validated query + validated body is usually a
+   * "search results" route with a middleware chain on top, and the generic lane is fine there).
    */
-  /** Synchronous until a validator, lifecycle hook, handler, or contract check actually returns a Promise. */
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runLifecycle<T>(
-    entry: RouteEntry,
-    source: RequestSource,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): MaybePromise<T> {
-    try {
-      const headersSchema = entry.schema?.headers
-      if (headersSchema !== undefined) {
-        const validation = headersSchema["~standard"].validate(headerObjectOf(source.headers))
-        if (validation instanceof Promise) {
-          return validation.then(
-            (result) =>
-              this.runLifecycleAfterHeadersResult(
-                entry,
-                source,
-                ctx,
-                finalize,
-                wrapResponse,
-                result,
-              ),
-            (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+  private buildFusedBodyDeriveBeforeAfter(
+    handler: InternalHandler,
+    derive: RawDerive,
+    before: RawBeforeHandle,
+    after: RawAfterHandle | undefined,
+    bodySchema: StandardSchemaV1,
+    maxBodyBytes: number,
+  ): FusedWebRunner {
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
+      )
+    return (source, params, search, signal, budget, platform, nativeContext) => {
+      const ctx = nativeContext
+        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+        : new RequestContext(
+            source,
+            params,
+            search,
+            signal,
+            budget,
+            platform,
+            maxBodyBytes,
+            this.protoPoisoning,
+          )
+      const runHandlerValidated = (): MaybePromise<Response> => {
+        const runAfter = (result: unknown): MaybePromise<Response> => {
+          if (after === undefined) {
+            return fusedRespond(
+              result,
+              ctx,
+              this.responseBodyTag,
+              this.staticResponseHeaders,
+              this.onResponseHooks.length === 0,
+            )
+          }
+          let transformed: unknown
+          try {
+            transformed = after(result, ctx)
+          } catch (err) {
+            return logError(err, ctx)
+          }
+          if (transformed instanceof Promise) {
+            return transformed.then(
+              (value) =>
+                fusedRespond(
+                  value,
+                  ctx,
+                  this.responseBodyTag,
+                  this.staticResponseHeaders,
+                  this.onResponseHooks.length === 0,
+                ),
+              (err) => logError(err, ctx),
+            )
+          }
+          return fusedRespond(
+            transformed,
+            ctx,
+            this.responseBodyTag,
+            this.staticResponseHeaders,
+            this.onResponseHooks.length === 0,
+          )
+        }
+        const runHandler = (): MaybePromise<Response> => {
+          let result: unknown
+          try {
+            result = handler(ctx)
+          } catch (err) {
+            return logError(err, ctx)
+          }
+          if (result instanceof Promise) {
+            return result.then(
+              (value) => runAfter(value),
+              (err) => logError(err, ctx),
+            )
+          }
+          return runAfter(result)
+        }
+        const runBefore = (): MaybePromise<Response> => {
+          let early: unknown
+          try {
+            early = before(ctx)
+          } catch (err) {
+            return logError(err, ctx)
+          }
+          if (early instanceof Promise) {
+            return early.then(
+              (settled) => {
+                if (settled === undefined) return runHandler()
+                return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+              },
+              (err) => logError(err, ctx),
+            )
+          }
+          if (early === undefined) return runHandler()
+          return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders)
+        }
+        let derived: unknown
+        try {
+          derived = derive(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (derived instanceof Promise) {
+          return derived.then(
+            (settled) => {
+              if (isResponseResult(settled) || settled instanceof Response) {
+                return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+              }
+              Object.assign(ctx, settled as object)
+              return runBefore()
+            },
+            (err) => logError(err, ctx),
           )
         }
-        return this.runLifecycleAfterHeadersResult(
-          entry,
-          source,
-          ctx,
-          finalize,
-          wrapResponse,
-          validation,
-        )
+        if (isResponseResult(derived) || derived instanceof Response) {
+          return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders)
+        }
+        Object.assign(ctx, derived as object)
+        return runBefore()
       }
-      const paramsSchema = entry.schema?.params
-      if (paramsSchema !== undefined) {
-        const validation = paramsSchema["~standard"].validate(ctx.params)
+      const onParsed = (parsed: unknown): MaybePromise<Response> => {
+        let validation: StandardResult<unknown> | Promise<StandardResult<unknown>>
+        try {
+          validation = bodySchema["~standard"].validate(parsed)
+        } catch (err) {
+          return logError(err, ctx)
+        }
         if (validation instanceof Promise) {
           return validation.then(
-            (result) =>
-              this.runLifecycleAfterParamsResult(
-                entry,
-                source,
-                ctx,
-                finalize,
-                wrapResponse,
-                result,
-              ),
-            (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+            (settled) => {
+              if (settled.issues !== undefined)
+                return this.wrapWebResponse(plainValidationError(settled.issues))
+              ctx.body = settled.value
+              return runHandlerValidated()
+            },
+            (err) => logError(err, ctx),
           )
         }
-        return this.runLifecycleAfterParamsResult(
-          entry,
-          source,
-          ctx,
-          finalize,
-          wrapResponse,
-          validation,
-        )
-      }
-      // Registration already knows whether this route has body/params/query validation. Most real
-      // read routes have no body or params schema, so skip the generic stage ladder and go straight to
-      // query validation + lifecycle hooks. The fallback below remains the complete path for routes
-      // with body/params combinations and validation recovery.
-      if (entry.schema?.body === undefined) {
-        return this.runQueryAndLifecycle(entry, ctx, finalize, wrapResponse)
-      }
-      return this.runLifecycleAfterParams(entry, source, ctx, finalize, wrapResponse, undefined)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
-  }
-
-  private runLifecycleAfterHeadersResult<T>(
-    entry: RouteEntry,
-    source: RequestSource,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    result: StandardResult<unknown>,
-  ): MaybePromise<T> {
-    try {
-      const headersError = this.applyLifecycleValidation(entry, result, ctx, "headers")
-      if (headersError instanceof Promise) {
-        return headersError.then(
-          (error) =>
-            error === undefined
-              ? this.runLifecycleAfterHeaders(entry, source, ctx, finalize, wrapResponse)
-              : wrapResponse(error),
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-        )
+        if (validation.issues !== undefined)
+          return this.wrapWebResponse(plainValidationError(validation.issues))
+        ctx.body = validation.value
+        return runHandlerValidated()
       }
-      return headersError === undefined
-        ? this.runLifecycleAfterHeaders(entry, source, ctx, finalize, wrapResponse)
-        : wrapResponse(headersError)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      return readBodyFramed(
+        source,
+        maxBodyBytes,
+        this.protoPoisoning,
+        onParsed,
+        (response) => this.wrapWebResponse(response),
+        (err) => Promise.resolve(logError(err, ctx)),
+      ) as MaybePromise<Response>
     }
   }
 
-  private runLifecycleAfterHeaders<T>(
-    entry: RouteEntry,
-    source: RequestSource,
+  private bareError<T>(
+    err: unknown,
     ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): MaybePromise<T> {
-    const paramsSchema = entry.schema?.params
-    if (paramsSchema === undefined) {
-      if (entry.schema?.body === undefined)
-        return this.runQueryAndLifecycle(entry, ctx, finalize, wrapResponse)
-      return this.runLifecycleAfterParams(entry, source, ctx, finalize, wrapResponse, undefined)
-    }
-    const validation = paramsSchema["~standard"].validate(ctx.params)
-    if (validation instanceof Promise) {
-      return validation.then(
-        (result) =>
-          this.runLifecycleAfterParamsResult(entry, source, ctx, finalize, wrapResponse, result),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
-    }
-    return this.runLifecycleAfterParamsResult(
-      entry,
-      source,
+    finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): T {
+    // The thrown-value contract lives in `bare-error-lane.ts`, one source of truth for both this
+    // lane and the fused body runner. `responseSet` and the logger are injected because they reach
+    // into class state; the closure is allocated only on the throw path, never on the hot lane.
+    return renderBareError(
+      err,
       ctx,
       finalize,
       wrapResponse,
-      validation,
+      responseSet,
+      (e, c) => this.logRequestError(e, c),
+      () => this.internalErrorResponse(wrapResponse),
     )
   }
 
-  /** Registration-specialized query lifecycle: query validation (including recovery) → hooks. */
-  private runLifecycleQuery<T>(
+  /**
+   * Keep the ordinary thrown-error response independent from the caught value. Deliberate Response
+   * control flow is handled by `renderBareError`; every other throw gets this fixed public envelope.
+   */
+  private internalErrorResponse<T>(wrapResponse: (response: Response | ResponseResult) => T): T {
+    return wrapResponse(plainError(500, "internal_error"))
+  }
+
+  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
+  private runWithAround<T>(
     entry: RouteEntry,
     ctx: RawContext,
+    run: () => MaybePromise<T>,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
+    let outcome: MaybePromise<T>
     try {
-      // The execution plan only selects this runner when the route has a query schema. Keeping the
-      // non-null access here removes the per-request schema-presence branch from realistic GETs.
-      const validation = entry.schema!.query!["~standard"].validate(
-        queryObjectOf(ctx[CONTEXT_SEARCH]),
-      )
-      if (validation instanceof Promise) {
-        return validation.then(
-          (result) => {
-            try {
-              return this.runQueryAndLifecycleResult(entry, ctx, finalize, wrapResponse, result)
-            } catch (err) {
-              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-            }
-          },
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-        )
-      }
-      return this.runQueryAndLifecycleResult(entry, ctx, finalize, wrapResponse, validation)
+      outcome = this.runAround(entry.around, ctx, run)
     } catch (err) {
       return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
     }
+    return outcome instanceof Promise
+      ? outcome.catch((err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse))
+      : outcome
   }
 
-  /** Registration-specialized body lifecycle: bounded body validation (including recovery) → hooks. */
+  /** Execute the registration-compiled general stage program. */
   // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runLifecycleBody<T>(
+  private runProgram<T>(
     entry: RouteEntry,
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
-    return this.readAndValidateBody(source, entry, ctx).then(
-      (bodyError) =>
-        bodyError === undefined
-          ? this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-          : wrapResponse(bodyError),
-      (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-    )
+    return executeRouteProgram(this, entry, entry.program, source, ctx, finalize, wrapResponse)
   }
 
-  /** Registration-specialized body + query lifecycle: bounded body validation → query validation → hooks. */
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runLifecycleBodyQuery<T>(
+  /** Bind a compiled validation stage to its stable schema and the existing recovery contract. */
+  // @ts-expect-error TS6133 -- invoked structurally by the general route program
+  private validateProgramStage(
     entry: RouteEntry,
+    stage: Extract<RouteProgramStage, { kind: "headers" | "params" | "body" | "query" }>,
     source: RequestSource,
     ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): MaybePromise<T> {
-    return this.readAndValidateBody(source, entry, ctx).then(
-      (bodyError) =>
-        bodyError === undefined
-          ? this.runLifecycleQuery(entry, ctx, finalize, wrapResponse)
-          : wrapResponse(bodyError),
-      (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-    )
+  ): MaybePromise<Response | ResponseResult | undefined> {
+    const input =
+      stage.kind === "headers"
+        ? headerObjectOf(source.headers)
+        : stage.kind === "params"
+          ? ctx.params
+          : stage.kind === "query"
+            ? queryObjectOf(ctx[CONTEXT_SEARCH])
+            : undefined
+    if (stage.kind === "body") return this.readProgramBody(entry, source, ctx)
+    const validation = stage.schema["~standard"].validate(input)
+    return validation instanceof Promise
+      ? validation.then((result) => this.applyLifecycleValidation(entry, result, ctx, stage.kind))
+      : this.applyLifecycleValidation(entry, validation, ctx, stage.kind)
   }
 
-  /** Registration-specialized no-body lifecycle: query validation (if present) → derives/hooks. */
-  private runQueryAndLifecycle<T>(
+  /** Preserve the existing bounded body reader and its fail-closed framing/prototype checks. */
+  private readProgramBody(
     entry: RouteEntry,
+    source: RequestSource,
     ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): MaybePromise<T> {
-    const querySchema = entry.schema?.query
-    return querySchema === undefined
-      ? this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-      : this.runLifecycleQuery(entry, ctx, finalize, wrapResponse)
+  ): Promise<Response | ResponseResult | undefined> {
+    const bodySchema = entry.program.bodySchema
+    if (bodySchema === undefined) return Promise.resolve(plainError(415, "unsupported_media_type"))
+    return this.readAndValidateBody(source, entry, ctx, bodySchema, entry.program.bodyLimit)
   }
 
-  private runQueryAndLifecycleResult<T>(
+  /** Keep thrown Response/status and redacted 500 semantics in one existing error boundary. */
+  // @ts-expect-error TS6133 -- invoked structurally by the general route program
+  private handleProgramError<T>(
     entry: RouteEntry,
+    error: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    result: StandardResult<unknown>,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
-    const queryError = this.applyLifecycleValidation(entry, result, ctx, "query")
-    if (queryError instanceof Promise) {
-      return queryError.then(
-        (error) =>
-          error === undefined
-            ? this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-            : wrapResponse(error),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
-    }
-    if (queryError !== undefined) return wrapResponse(queryError)
-    return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
+    return this.handleLifecycleError(entry, error, ctx, finalize, wrapResponse)
   }
 
-  private runLifecycleAfterParamsResult<T>(
+  /** Finish a successful program result through response-contract enforcement and finalization. */
+  // @ts-expect-error TS6133 -- invoked structurally by the general route program
+  private finishProgramResult<T>(
     entry: RouteEntry,
-    source: RequestSource,
     ctx: RawContext,
+    result: unknown,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    result: StandardResult<unknown>,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
-    try {
-      return this.runLifecycleAfterParams(
-        entry,
-        source,
-        ctx,
-        finalize,
-        wrapResponse,
-        this.applyLifecycleValidation(entry, result, ctx, "params"),
-      )
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
+    return this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, result)
   }
 
-  private runLifecycleAfterParams<T>(
-    entry: RouteEntry,
-    source: RequestSource,
+  private runAround<T>(
+    hooks: ReadonlyArray<RawAround>,
     ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    paramsError: MaybePromise<Response | undefined>,
+    run: () => MaybePromise<T>,
   ): MaybePromise<T> {
-    if (paramsError instanceof Promise) {
-      return paramsError.then(
-        (error) =>
-          this.runLifecycleAfterParamsSettled(entry, source, ctx, finalize, wrapResponse, error),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
+    const dispatch = (index: number): MaybePromise<T> => {
+      if (index >= hooks.length) return run()
+      const hook = hooks[index]!
+      let called = false
+      return hook(ctx, () => {
+        if (called) throw new Error("around next() called multiple times")
+        called = true
+        return dispatch(index + 1)
+      })
     }
-    return this.runLifecycleAfterParamsSettled(
-      entry,
-      source,
-      ctx,
-      finalize,
-      wrapResponse,
-      paramsError,
-    )
+    return dispatch(0)
   }
 
-  private runLifecycleAfterParamsSettled<T>(
+  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
+  private runBodyOnly<T>(
     entry: RouteEntry,
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    paramsError: Response | undefined,
-  ): MaybePromise<T> {
-    if (paramsError !== undefined) return wrapResponse(paramsError)
-    if (entry.schema?.body !== undefined) {
-      return this.readAndValidateBody(source, entry, ctx).then(
-        (bodyError) => this.runLifecycleAfterBody(entry, ctx, finalize, wrapResponse, bodyError),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
-    }
-    return this.runLifecycleAfterBody(entry, ctx, finalize, wrapResponse, undefined)
-  }
-
-  private runLifecycleAfterBody<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    bodyError: Response | undefined,
-  ): MaybePromise<T> {
-    if (bodyError !== undefined) return wrapResponse(bodyError)
-    const querySchema = entry.schema?.query
-    if (querySchema === undefined) return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-    const validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]))
-    if (validation instanceof Promise) {
-      return validation.then(
-        (result) => this.runLifecycleAfterQueryResult(entry, ctx, finalize, wrapResponse, result),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
-    }
-    return this.runLifecycleAfterQueryResult(entry, ctx, finalize, wrapResponse, validation)
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): Promise<T> {
+    return readBodyFramed(
+      source,
+      entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+      this.protoPoisoning,
+      (parsed) => this.finishBodyOnly(entry, parsed, ctx, finalize, wrapResponse),
+      wrapResponse,
+      (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+    )
   }
 
-  private runLifecycleAfterQueryResult<T>(
+  /** Validate + run the handler for the bodyOnly path - shared by the inline fast path and the
+   * streaming fallback. A method (not per-request closures) so the hot path allocates nothing
+   * beyond the one `.then` continuation. */
+  private finishBodyOnly<T>(
     entry: RouteEntry,
+    parsed: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    result: StandardResult<unknown>,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     try {
-      const queryError = this.applyLifecycleValidation(entry, result, ctx, "query")
-      if (queryError instanceof Promise) {
-        return queryError.then(
-          (error) => this.runLifecycleAfterQuery(entry, ctx, finalize, wrapResponse, error),
+      const bodySchema = entry.schema!.body!
+      const validation = bodySchema["~standard"].validate(parsed)
+      if (validation instanceof Promise) {
+        return validation.then(
+          (result) => {
+            try {
+              const outcome = this.applyBodyValidation(entry, result, ctx, finalize, wrapResponse)
+              return outcome instanceof Promise
+                ? outcome.catch((err) =>
+                    this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+                  )
+                : outcome
+            } catch (err) {
+              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+            }
+          },
           (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
         )
       }
-      return this.runLifecycleAfterQuery(entry, ctx, finalize, wrapResponse, queryError)
+      const outcome = this.applyBodyValidation(entry, validation, ctx, finalize, wrapResponse)
+      return outcome instanceof Promise
+        ? outcome.catch((err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse))
+        : outcome
     } catch (err) {
       return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
     }
   }
 
-  private runLifecycleAfterQuery<T>(
+  private executeHandler<T>(
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    queryError: Response | undefined,
+    wrapResponse?: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
-    if (queryError !== undefined) return wrapResponse(queryError)
-    return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
+    if (entry.hasDecorations) Object.assign(ctx, entry.decorations)
+    const handlerOutput = entry.handler(ctx)
+    if (handlerOutput instanceof Promise) {
+      return handlerOutput.then(
+        (value) => finalize(value, responseSet(ctx)),
+        (err) => {
+          if (wrapResponse) {
+            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+          }
+          throw err
+        },
+      )
+    }
+    return finalize(handlerOutput, responseSet(ctx))
   }
 
-  private runLifecycleHooks<T>(
+  private handleValidationErrorRecovery<T>(
     entry: RouteEntry,
+    recovery: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
+    originalIssues: ReadonlyArray<StandardIssue>,
+    kind: "body" | "query",
   ): MaybePromise<T> {
-    if (entry.lifecycleHookLane === "derive-before") {
-      return this.runLifecycleDeriveBefore(entry, ctx, finalize, wrapResponse)
-    }
-    try {
-      if (entry.hasDecorations) Object.assign(ctx, entry.decorations)
-      for (let i = 0; i < entry.derives.length; i++) {
-        const extension = entry.derives[i]!(ctx)
-        if (extension instanceof Promise) {
-          return this.continueLifecycleAfterDerive(entry, ctx, finalize, wrapResponse, i, extension)
+    if (recovery !== undefined) {
+      if (recovery instanceof Response) {
+        return wrapResponse(recovery)
+      }
+      if (kind === "body" && entry.schema?.body) {
+        const validation = entry.schema.body["~standard"].validate(recovery)
+        if (validation instanceof Promise) {
+          return validation.then((settled) => {
+            if (settled.issues !== undefined)
+              return wrapResponse(plainValidationError(settled.issues))
+            ctx.body = settled.value
+            return this.executeHandler(entry, ctx, finalize)
+          })
         }
-        Object.assign(ctx, extension)
+        if (validation.issues !== undefined)
+          return wrapResponse(plainValidationError(validation.issues))
+        ctx.body = validation.value
+        return this.executeHandler(entry, ctx, finalize)
       }
-      for (let i = 0; i < entry.beforeHandle.length; i++) {
-        const outcome = entry.beforeHandle[i]!(ctx)
-        if (outcome instanceof Promise) {
-          return this.continueLifecycleAfterBefore(entry, ctx, finalize, wrapResponse, i, outcome)
+      if (kind === "query" && entry.schema?.query) {
+        const validation = entry.schema.query["~standard"].validate(recovery)
+        if (validation instanceof Promise) {
+          return validation.then(
+            (settled) => {
+              if (settled.issues !== undefined)
+                return wrapResponse(plainValidationError(settled.issues))
+              ctx.query = settled.value
+              return this.executeHandler(entry, ctx, finalize, wrapResponse)
+            },
+            (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+          )
         }
-        if (outcome !== undefined) return finalize(outcome, responseSet(ctx))
+        if (validation.issues !== undefined)
+          return wrapResponse(plainValidationError(validation.issues))
+        ctx.query = validation.value
+        return this.executeHandler(entry, ctx, finalize, wrapResponse)
       }
-      const result = entry.handler(ctx)
-      if (result instanceof Promise) {
-        return result.then(
-          (value) => this.finishLifecycleResult(entry, ctx, finalize, wrapResponse, value),
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+    }
+    return wrapResponse(plainValidationError(originalIssues))
+  }
+
+  private applyBodyValidation<T>(
+    entry: RouteEntry,
+    result: StandardResult<unknown>,
+    ctx: RawContext,
+    finalize: (result: unknown, set: CtxSet) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): MaybePromise<T> {
+    if (result.issues !== undefined) {
+      const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
+      if (hook) {
+        const recovery = hook(result.issues, ctx as unknown as Context, "body")
+        if (recovery instanceof Promise) {
+          return recovery.then((rec) =>
+            this.handleValidationErrorRecovery(
+              entry,
+              rec,
+              ctx,
+              finalize,
+              wrapResponse,
+              result.issues!,
+              "body",
+            ),
+          )
+        }
+        return this.handleValidationErrorRecovery(
+          entry,
+          recovery,
+          ctx,
+          finalize,
+          wrapResponse,
+          result.issues,
+          "body",
         )
       }
-      return this.finishLifecycleResult(entry, ctx, finalize, wrapResponse, result)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      return wrapResponse(plainValidationError(result.issues))
     }
+    ctx.body = result.value
+    return this.executeHandler(entry, ctx, finalize)
   }
 
-  /** Registration-specialized derive → before → handler lifecycle. */
-  private runLifecycleDeriveBefore<T>(
+  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
+  private runQueryOnly<T>(
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     try {
-      const extension = entry.derives[0]!(ctx)
-      if (extension instanceof Promise) {
-        return this.continueLifecycleAfterDerive(entry, ctx, finalize, wrapResponse, 0, extension)
-      }
-      Object.assign(ctx, extension)
-
-      const outcome = entry.beforeHandle[0]!(ctx)
-      if (outcome instanceof Promise) {
-        return this.continueLifecycleAfterBefore(entry, ctx, finalize, wrapResponse, 0, outcome)
-      }
-      if (outcome !== undefined)
-        return this.finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, outcome)
-
-      const result = entry.handler(ctx)
-      if (result instanceof Promise) {
-        return result.then(
-          (value) => this.finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, value),
+      // Call the validator directly for the raw StandardResult (read `.issues`/`.value`) - skip
+      // `validateStandard`'s per-request wrapper-object allocation, mirroring the bodyOnly path.
+      const validation = entry.schema!.query!["~standard"].validate(
+        queryObjectOf(ctx[CONTEXT_SEARCH]),
+      )
+      if (validation instanceof Promise) {
+        return validation.then(
+          (settled) => {
+            try {
+              const outcome = this.applyQueryValidation(entry, settled, ctx, finalize, wrapResponse)
+              return outcome instanceof Promise
+                ? outcome.catch((err) =>
+                    this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+                  )
+                : outcome
+            } catch (err) {
+              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+            }
+          },
           (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
         )
       }
-      return this.finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, result)
+      return this.applyQueryValidation(entry, validation, ctx, finalize, wrapResponse)
     } catch (err) {
       return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
     }
   }
 
-  /** Finalize the specialized lane without rechecking its registration-proven invariants. */
-  private finishSimpleLifecycleResult<T>(
+  /** Validate-result → set `ctx.query` → run handler. A method (not a per-request closure), the
+   * query analogue of {@link applyBodyValidation}. */
+  private applyQueryValidation<T>(
     entry: RouteEntry,
+    result: StandardResult<unknown>,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    result: unknown,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
-    try {
-      return finalize(result, responseSet(ctx))
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+    if (result.issues !== undefined) {
+      const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
+      if (hook) {
+        const recovery = hook(result.issues, ctx as unknown as Context, "query")
+        if (recovery instanceof Promise) {
+          return recovery.then((rec) =>
+            this.handleValidationErrorRecovery(
+              entry,
+              rec,
+              ctx,
+              finalize,
+              wrapResponse,
+              result.issues!,
+              "query",
+            ),
+          )
+        }
+        return this.handleValidationErrorRecovery(
+          entry,
+          recovery,
+          ctx,
+          finalize,
+          wrapResponse,
+          result.issues,
+          "query",
+        )
+      }
+      return wrapResponse(plainValidationError(result.issues))
     }
+    ctx.query = result.value
+    return this.executeHandler(entry, ctx, finalize, wrapResponse)
   }
 
-  private async continueLifecycleAfterDerive<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    firstIndex: number,
-    first: Promise<unknown>,
-  ): Promise<T> {
-    try {
-      Object.assign(ctx, await first)
-      for (let i = firstIndex + 1; i < entry.derives.length; i++) {
-        const extension = entry.derives[i]!(ctx)
-        Object.assign(ctx, extension instanceof Promise ? await extension : extension)
+  /**
+   * Thread the response through each global `onResponse` hook. Stays SYNCHRONOUS until a hook
+   * actually returns a Promise - an `async` version forced a promise + microtask on EVERY response
+   * of any app with an onResponse hook (cors/securityHeaders/etag/timing all use onResponse), the
+   * same ~13%/req tax the onRequest walk was de-async'd to avoid. The first async hook hands the
+   * rest to {@link continueOnResponse}.
+   */
+  private applyOnResponse(response: Response, req: Request): MaybePromise<Response> {
+    const hooks = this.onResponseHooks
+    let current = response
+    for (let i = 0; i < hooks.length; i++) {
+      const next = (hooks[i] as RawOnResponse)(current, req)
+      if (next instanceof Promise) {
+        return next.then((settled) => this.continueOnResponse(settled, i + 1, req))
       }
-      return await this.runLifecycleHooksAsync(entry, ctx, finalize, wrapResponse)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      current = next
     }
+    return current
   }
 
-  private async runLifecycleHooksAsync<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): Promise<T> {
+  private applyOnResponseAndFinalize(response: Response, req: Request): MaybePromise<Response> {
     try {
-      // Indexed, not `for...of`. An array iterator declared inside an async function stays live
-      // across the `await` below, so neither engine can sink it - unlike the sync lanes above,
-      // where V8 elides it. Measured cost of the iterator form: 43ns per hook on Bun, ~9ns on
-      // Node, on a chain whose hooks return synchronously (the common shape).
-      for (let i = 0; i < entry.beforeHandle.length; i++) {
-        const outcome = entry.beforeHandle[i]!(ctx)
-        const early = outcome instanceof Promise ? await outcome : outcome
-        if (early !== undefined) return finalize(early, responseSet(ctx))
-      }
-      return await this.runLifecycleHandlerAsync(entry, ctx, finalize, wrapResponse)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      const transformed = this.applyOnResponse(response, req)
+      return transformed instanceof Promise
+        ? transformed.then(
+            (settled) => this.completeResponseFinalization({ response: settled }, req),
+            (error) => this.failResponseFinalization(response, error, req),
+          )
+        : this.completeResponseFinalization({ response: transformed }, req)
+    } catch (error) {
+      return this.failResponseFinalization(response, error, req)
     }
   }
 
-  private async continueLifecycleAfterBefore<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    firstIndex: number,
-    first: Promise<unknown>,
-  ): Promise<T> {
-    try {
-      const firstOutcome = await first
-      if (firstOutcome !== undefined) return finalize(firstOutcome, responseSet(ctx))
-      for (let i = firstIndex + 1; i < entry.beforeHandle.length; i++) {
-        const outcome = entry.beforeHandle[i]!(ctx)
-        const early = outcome instanceof Promise ? await outcome : outcome
-        if (early !== undefined) return finalize(early, responseSet(ctx))
-      }
-      return await this.runLifecycleHandlerAsync(entry, ctx, finalize, wrapResponse)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
+  private completeResponseFinalization(
+    outcome: ResponseFinalization,
+    req: Request,
+  ): MaybePromise<Response> {
+    const notified = this.notifyResponseFinalized(outcome, req)
+    return notified instanceof Promise ? notified.then(() => outcome.response) : outcome.response
   }
 
-  private async runLifecycleHandlerAsync<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): Promise<T> {
-    try {
-      const output = entry.handler(ctx)
-      const result = output instanceof Promise ? await output : output
-      return await this.finishLifecycleResult(entry, ctx, finalize, wrapResponse, result)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+  private failResponseFinalization(
+    response: Response,
+    error: unknown,
+    req: Request,
+  ): Promise<never> {
+    const notified = this.notifyResponseFinalized({ response, error }, req)
+    if (notified instanceof Promise) {
+      return notified.then(() => {
+        throw error
+      })
     }
+    // A hook failure must surface as a REJECTION even when every prior step ran synchronously:
+    // `fetch()` may now resolve without a promise, but its failure contract stays promise-shaped -
+    // a synchronous throw here would escape `Promise.resolve(app.fetch(...))` bridges and
+    // `.then()`-style callers entirely instead of reaching their rejection handling.
+    return Promise.reject(error)
   }
 
-  private finishLifecycleResult<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    initial: unknown,
-  ): MaybePromise<T> {
-    try {
-      let result = initial
-      for (let i = 0; i < entry.afterHandle.length; i++) {
-        const transformed = entry.afterHandle[i]!(result, ctx)
-        if (transformed instanceof Promise) {
-          return this.continueLifecycleAfterHandle(
-            entry,
-            ctx,
-            finalize,
-            wrapResponse,
-            i,
-            transformed,
-          )
-        }
-        result = transformed
+  /** Notify terminal observers in order while isolating both sync and async failures. */
+  private notifyResponseFinalized(outcome: ResponseFinalization, req: Request): MaybePromise<void> {
+    let pending: Promise<void> | undefined
+    for (const hook of this.onResponseFinalizedHooks) {
+      if (pending !== undefined) {
+        pending = pending.then(async () => {
+          try {
+            await hook(outcome, req)
+          } catch {
+            // Terminal observation must never change request behavior.
+          }
+        })
+        continue
+      }
+      try {
+        const result = hook(outcome, req)
+        if (result instanceof Promise) pending = result.catch(() => {})
+      } catch {
+        // Terminal observation must never change request behavior.
       }
-      return this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, result)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
     }
+    return pending
   }
 
-  private async continueLifecycleAfterHandle<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    firstIndex: number,
-    first: Promise<unknown>,
+  /** Async tail of {@link applyOnResponse}: runs the remaining hooks once one has gone async. */
+  private async continueOnResponse(
+    response: Response,
+    nextIndex: number,
+    req: Request,
+  ): Promise<Response> {
+    let current = response
+    for (let i = nextIndex; i < this.onResponseHooks.length; i++) {
+      const next = (this.onResponseHooks[i] as RawOnResponse)(current, req)
+      current = next instanceof Promise ? await next : next
+    }
+    return current
+  }
+
+  /**
+   * Bound the response time. On timeout we abort `ctx.signal` (so cancellation-aware
+   * handlers can bail) and return 503; the in-flight work keeps running but its
+   * result is discarded - JS can't forcibly cancel a promise.
+   */
+  private async withTimeout<T>(
+    work: Promise<T>,
+    controller: AbortController,
+    onTimeout: () => T,
+    timeoutMs: number,
   ): Promise<T> {
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const timeout = new Promise<T>((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort()
+        resolve(onTimeout())
+      }, timeoutMs)
+    })
     try {
-      let result = await first
-      for (let i = firstIndex + 1; i < entry.afterHandle.length; i++) {
-        const transformed = entry.afterHandle[i]!(result, ctx)
-        result = transformed instanceof Promise ? await transformed : transformed
-      }
-      return await this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, result)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      return await Promise.race([work, timeout])
+    } finally {
+      if (timer !== undefined) clearTimeout(timer)
     }
   }
-
   private finishLifecycleContract<T>(
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     result: unknown,
   ): MaybePromise<T> {
     try {
@@ -4677,7 +4643,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   private finishContractOutcome<T>(
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     outcome: {
       readonly kind: "ok" | "warn" | "violation"
       readonly value?: unknown
@@ -4690,7 +4656,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         path: pathnameOf(ctx.req.url),
         detail: outcome.message,
       })
-      return wrapResponse(jsonError(500, "internal_error"))
+      return wrapResponse(plainError(500, "internal_error"))
     }
     if (outcome.kind === "warn") {
       this.logger.warn("response contract", {
@@ -4702,19 +4668,44 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return finalize(outcome.value, responseSet(ctx))
   }
 
-  private async handleLifecycleError<T>(
+  /** Synchronous by design, and `MaybePromise` rather than `Promise` for the same reason: control flow
+   * out of a lifecycle stage must not cost a promise. An `async` method allocates one and defers the
+   * result a microtask even when every branch it takes returns immediately, which is the common case
+   * here - a thrown `status(...)`/`Response`, or a route with no `onError` hook at all. Only the hook
+   * loop, which may await, drops into {@link runErrorHooks}. */
+  private handleLifecycleError<T>(
     entry: RouteEntry,
     err: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): Promise<T> {
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): MaybePromise<T> {
     // A *thrown* Response is deliberate control flow, not an error - a guard throws a redirect/401,
     // an action throws an error page. Return it as-is (Remix/SvelteKit semantics); don't run onError
     // or log it as a 500. This is what makes `throw redirect(...)` / `requireSession(...)` work from
     // any handler or loader.
     if (err instanceof Response) return wrapResponse(err)
-    // onError hooks may return a custom response; otherwise the default 500 stands.
+    // Same rule for a thrown `status(...)`, but through `finalize` rather than `wrapResponse`: the
+    // value is still plain data, so the ordinary JSON lane renders it and no `Response` is built.
+    if (isResponseResult(err)) return finalize(err, responseSet(ctx))
+    if (entry.onError.length === 0) {
+      // Never crash the server or leak internals. The client gets a flat 500; the detail goes to the
+      // (redacting) logger. Body-read failures and around-hook failures land here too.
+      this.logRequestError(err, ctx)
+      return wrapResponse(plainError(500, "internal_error"))
+    }
+    return this.runErrorHooks(entry, err, ctx, finalize, wrapResponse)
+  }
+
+  /** The `onError` chain, split off {@link handleLifecycleError} so its `await` costs only the routes
+   * that registered a hook. A hook may return a custom response; otherwise the default 500 stands. */
+  private async runErrorHooks<T>(
+    entry: RouteEntry,
+    err: unknown,
+    ctx: RawContext,
+    finalize: (result: unknown, set: CtxSet) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): Promise<T> {
     // Indexed for the same reason as the `beforeHandle` chain above: the iterator would outlive
     // the `await` and stay heap-allocated on both engines.
     for (let i = 0; i < entry.onError.length; i++) {
@@ -4722,55 +4713,41 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       const handled = outcome instanceof Promise ? await outcome : outcome
       if (handled !== undefined) return finalize(handled, responseSet(ctx))
     }
-    // Never crash the server or leak internals. The client gets a flat 500; the detail goes to the
-    // (redacting) logger. Body-read failures and around-hook failures land here too.
     this.logRequestError(err, ctx)
-    return wrapResponse(jsonError(500, "internal_error"))
+    return wrapResponse(plainError(500, "internal_error"))
   }
 
-  /** Log an unhandled request error to the (redacting) logger - shared by {@link runLifecycle} and the
+  /** Log an unhandled request error to the (redacting) logger - shared by the compiled route program and the
    * bare fast path ({@link bareError}) so both record the same fields. Never throws; never leaks. */
   private logRequestError(err: unknown, ctx: RawContext): void {
-    // An error's own text can quote the input that produced it, so how much of it reaches the sink is
-    // the app's call (`errorLogDetail`). The default keeps it: a 500 with no message and no stack is
-    // an incident nobody can diagnose, and the framework already ships the narrower instrument for
-    // the leak - a redacting logger with `valuePatterns`. `"none"` is there for an untrusted sink.
-    const detail = this.errorLogDetail
-    this.logger.error("unhandled request error", {
-      method: ctx.req.method,
-      path: pathnameOf(ctx.req.url),
-      name: err instanceof Error ? err.name : "Error",
-      // `detail`, not `message`: the logger uses `message` for its own first argument, so a field of
-      // that name is silently overwritten and the thrown error's own text never reaches the sink. It
-      // survived only incidentally inside `stack`, and was lost outright for a non-Error throw.
-      ...(detail === "none" ? {} : { detail: err instanceof Error ? err.message : String(err) }),
-      ...(detail === "full" && err instanceof Error ? { stack: err.stack } : {}),
-    })
+    emitRequestErrorLog(this.logger, this.errorLogDetail, err, ctx)
   }
 
-  private async readAndValidateBody(
+  private readAndValidateBody(
     req: RequestSource,
     entry: RouteEntry,
     ctx: RawContext,
-  ): Promise<Response | undefined> {
-    const contentType = headerOf(req, "content-type") ?? ""
-    let parsed: unknown
-    if (contentType === "application/json" || contentType.includes("application/json")) {
-      const json = await this.readBoundedJson(req, entry.bodyLimit ?? this.maxBodyBytes)
-      if (json instanceof Response) return json
-      parsed = json
-    } else if (isUrlEncodedForm(contentType)) {
-      const form = await readBoundedForm(req, entry.bodyLimit ?? this.maxBodyBytes)
-      if (form instanceof Response) return form
-      parsed = form
-    } else {
-      // multipart/form-data (file uploads) stays 415 on the schema path by design - files don't
-      // fit a value schema; use a schema-less route + @nifrajs/uploads helpers for those.
-      return jsonError(415, "unsupported_media_type")
+    bodySchema: StandardSchemaV1 = entry.schema?.body as StandardSchemaV1,
+    bodyLimit: number | undefined = entry.bodyLimit,
+  ): Promise<Response | ResponseResult | undefined> {
+    // Keep the generic lifecycle body stage on the same framed parser/continuation as the body-only
+    // lane. This avoids an async wrapper that first awaits parsing and then starts validation in a
+    // second continuation, while retaining the exact bounded-read, content-type, and poisoning
+    // contracts shared by every body route.
+    const validate = (parsed: unknown): MaybePromise<Response | ResponseResult | undefined> => {
+      const validation = bodySchema["~standard"].validate(parsed)
+      return validation instanceof Promise
+        ? validation.then((result) => this.applyLifecycleValidation(entry, result, ctx, "body"))
+        : this.applyLifecycleValidation(entry, validation, ctx, "body")
     }
-    const validation = entry.schema!.body!["~standard"].validate(parsed)
-    const result = validation instanceof Promise ? await validation : validation
-    return this.applyLifecycleValidation(entry, result, ctx, "body")
+    return readBodyFramed(
+      req,
+      bodyLimit ?? UNLIMITED_BODY_BYTES,
+      this.protoPoisoning,
+      validate,
+      (response) => response,
+      (error) => Promise.reject(error),
+    )
   }
 
   /** Apply validation and its recovery hook on the generic lifecycle lane. Recovery is completed
@@ -4780,7 +4757,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     result: StandardResult<unknown>,
     ctx: RawContext,
     kind: "body" | "query" | "params" | "headers",
-  ): MaybePromise<Response | undefined> {
+  ): MaybePromise<Response | ResponseResult | undefined> {
     const assign = (value: unknown): void => {
       if (kind === "body") ctx.body = value
       else if (kind === "query") ctx.query = value
@@ -4792,7 +4769,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       return undefined
     }
     const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
-    if (hook === undefined) return validationError(result.issues)
+    if (hook === undefined) return plainValidationError(result.issues)
     const attempted = hook(result.issues, ctx as unknown as Context, kind)
     if (attempted instanceof Promise) {
       return attempted.then((recovery) =>
@@ -4808,8 +4785,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     issues: ReadonlyArray<StandardIssue>,
     recovery: unknown,
     assign: (value: unknown) => void,
-  ): MaybePromise<Response | undefined> {
-    if (recovery === undefined) return validationError(issues)
+  ): MaybePromise<Response | ResponseResult | undefined> {
+    if (recovery === undefined) return plainValidationError(issues)
     if (recovery instanceof Response) return recovery
     const schema =
       kind === "body"
@@ -4822,43 +4799,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     const retried = schema!["~standard"].validate(recovery)
     if (retried instanceof Promise) {
       return retried.then((settled) => {
-        if (settled.issues !== undefined) return validationError(settled.issues)
+        if (settled.issues !== undefined) return plainValidationError(settled.issues)
         assign(settled.value)
         return undefined
       })
     }
-    if (retried.issues !== undefined) return validationError(retried.issues)
+    if (retried.issues !== undefined) return plainValidationError(retried.issues)
     assign(retried.value)
     return undefined
   }
 
-  /**
-   * Read + parse the JSON body, capped at `maxBodyBytes` and screened by the server's
-   * `protoPoisoning` policy. Rejects a `Content-Length` over the cap *before* buffering,
-   * re-checks what was actually delivered after the read, and aborts a chunked or
-   * length-less body mid-stream once the running byte count exceeds the cap - so a lying
-   * or absent length can't force us to buffer an oversized payload.
-   */
-  private readBoundedJson(req: RequestSource, maxBodyBytes?: number): Promise<unknown | Response>
-  private readBoundedJson<T>(
-    req: RequestSource,
-    maxBodyBytes: number,
-    onResult: (parsed: unknown | Response) => T | Promise<T>,
-    onError: (error: unknown) => T | Promise<T>,
-  ): Promise<T>
-  private readBoundedJson<T>(
-    req: RequestSource,
-    maxBodyBytes = this.maxBodyBytes,
-    onResult?: (parsed: unknown | Response) => T | Promise<T>,
-    onError?: (error: unknown) => T | Promise<T>,
-  ): Promise<unknown | Response | T> {
-    // Not `async`: this is a pass-through, and wrapping the lane's own promise in a coroutine
-    // frame costs an extra microtask hop on every JSON body.
-    return onResult === undefined
-      ? readBoundedJsonSource(req, maxBodyBytes, this.protoPoisoning)
-      : readBoundedJsonSource(req, maxBodyBytes, this.protoPoisoning, onResult, onError!)
-  }
-
   /** Adapt one route's compiled execution plan to Bun's already-matched request shape. Route
    * semantics remain in the plan; this closure only supplies native params and deadline fallback. */
   private compileBunNativeHandler(
@@ -5046,10 +4996,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     // matched route's handler, set by `server.upgrade`.
     // With WS routes, the dispatcher comes from the installed `.use(websocket())` runtime - non-null
     // because wsRouteCount > 0 means ws() ran, and ws() requires the runtime at registration.
+    // Native pub/sub when the app has WS routes and none validate outbound frames: `ws.subscribe` and
+    // `app.publish` go through Bun's own (uWebSockets) broadcast instead of the JS registry loop.
+    const nativePubsub = this.wsRouteCount > 0 && !this.wsHasValidatedSend
     const wsHandlers =
       this.wsRouteCount === 0
         ? undefined
-        : (this.wsRuntime as WsRuntime).bunHandlers(this.topics as TopicRegistry)
+        : (this.wsRuntime as WsRuntime).bunHandlers(this.topics as TopicRegistry, nativePubsub)
     const reusePort = options?.reusePort === true
     // Spread rather than pass `hostname: undefined` - Bun treats an explicit undefined as a value
     // on some option paths, and omitting is what selects its 0.0.0.0 default.
@@ -5087,6 +5040,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
           },
         })) as unknown as RunningServer
     this.bunServer = running
+    // Bind `app.publish` to Bun's native broadcast now that the server handle exists. Guarded on the
+    // method's presence so a runtime whose handle lacks it simply keeps the registry path.
+    if (nativePubsub && typeof running.publish === "function") {
+      const native = running.publish.bind(running)
+      this.nativePublish = (topic, data) => {
+        native(topic, data)
+      }
+    }
     this.sealed = true
     if (this.gracefulSignals) this.installSignalHandlers()
     return running