@nifrajs/core 3.1.0 → 3.3.0

package/src/server/server.ts

@@ -12,22 +12,18 @@ import { FrameworkError, RouteConfigError } from "../errors.ts"
 import type { Version } from "../index.ts"
 import {
   type AroundCapabilityOptions,
-  CAPABILITY_GUARD,
   type CapabilityInterceptor,
   type CapabilityUseEvent,
-  createCapabilityGuard,
   DEFAULT_CAPABILITY_INTERCEPTOR_TIMEOUT_MS,
-  normalizeRouteCapabilities,
   type RegisteredCapabilityInterceptor,
 } from "../internal/capability-runtime.ts"
 import {
   type AssuranceDeclaration,
   assuranceDeclarationsOf,
   assuranceEvidenceFor,
-  NIFRA_ASSURANCE_IDS,
-  validEvidenceId,
 } from "../internal/route-assurance.ts"
 import { type CatalogRoute, RouteCatalog } from "../internal/route-catalog.ts"
+import { compileRouteOptions } from "../internal/route-compiler.ts"
 import {
   compileRouteExecutionPlan,
   type FusedBodyRunner,
@@ -40,9 +36,11 @@ import {
   type RawErrorHandler,
   type RouteEntry,
 } from "../internal/route-execution.ts"
+import type { RouteProgramStage } from "../internal/route-program.ts"
+import { compileRouteProgram, executeRouteProgram } from "../internal/route-program.ts"
 import { isSameOriginRequest } from "../internal/same-origin.ts"
 import type { ResponseObserverPlugin } from "../response-observer.ts"
-import { compileRoutePattern, decodeRouteParams } from "../router/pattern.ts"
+import { decodeRouteParams } from "../router/pattern.ts"
 import { EMPTY_PARAMS, type Method, Router } from "../router/router.ts"
 import type {
   InferOutput,
@@ -79,14 +77,8 @@ import type {
   ResponseHeadersHook,
   ResponseHeadersView,
 } from "./node-outcome-hook.ts"
-import {
-  isUrlEncodedForm,
-  type QueryValue,
-  queryObjectOf,
-  readBoundedForm,
-  searchOf,
-} from "./query.ts"
-import { RequestContext, readBodyFramed, readBoundedJsonSource } from "./request-context.ts"
+import { type QueryValue, queryObjectOf, searchOf } from "./query.ts"
+import { RequestContext, readBodyFramed } from "./request-context.ts"
 import {
   applyStaticResponseHeaders,
   buildStaticResponseHeaders,
@@ -112,9 +104,10 @@ import {
   isResponseResult,
   type ResponseResult,
   requestOf,
-  status,
+  type StatusResponse,
 } from "./runtime-core.ts"
 import { normalizeStaticResponseHeaders, type StaticResponseHeaders } from "./static-headers.ts"
+import { plainValidationError } from "./validation.ts"
 
 // NodeServeOutcome (the nifra<->node bridge render form) now lives in `./node-outcome.ts`; re-exported
 // so existing importers keep resolving it from the server module.
@@ -143,7 +136,7 @@ import {
   NODE_NATIVE_MOUNT,
   RESOLVE_NODE_MOUNT,
 } from "./install.ts"
-import type { EffectLedgerRuntime, ResolvedEffectLedger } from "./ledger-lane.ts"
+import type { EffectLedgerRuntime } from "./ledger-lane.ts"
 import { jsonLogger, type Logger } from "./logger.ts"
 import type { McpRuntime } from "./mcp-hook.ts"
 import type {
@@ -373,6 +366,31 @@ type ResponseOf<S extends RouteSchema> = S extends { response: infer R extends S
   ? InferOutput<R> | Response | ResponseResult
   : HandlerResult
 
+/** A typed status result is control flow, not a context extension. */
+type StatusResponseOf<T> = T extends StatusResponse<number, unknown> ? T : never
+
+type ContextExtensionPart<T> = T extends object ? T : EmptyContext
+type ContextExtensionOf<T> = [Exclude<Awaited<T>, Response | ResponseResult>] extends [never]
+  ? EmptyContext
+  : ContextExtensionPart<Exclude<Awaited<T>, Response | ResponseResult>>
+
+/** Keep concrete lifecycle return values for route inference, but don't let an untyped hook widen every route to unknown. */
+type HookOutputOf<T> = unknown extends Awaited<T> ? never : Exclude<Awaited<T>, void>
+
+type ReturnOfHookField<M, K extends PropertyKey> = M extends {
+  readonly [P in K]?: infer F
+}
+  ? F extends (...args: never[]) => infer R
+    ? HookOutputOf<R>
+    : never
+  : never
+
+type MiddlewareOutputOf<M> =
+  | ReturnOfHookField<M, "beforeHandle">
+  | ReturnOfHookField<M, "afterHandle">
+  | ReturnOfHookField<M, "onError">
+  | ReturnOfHookField<M, "around">
+
 /**
  * Public handler shape: context typed from the path, the (optional) schema, and
  * any accumulated middleware context `Ctx` (from `derive`/`decorate`).
@@ -406,7 +424,7 @@ export type {
 // A plugin operates over arbitrary Server shapes; `any` here is the standard framework escape hatch
 // (the precise threading happens at the `use` call site, which is generic over the *concrete* `this`).
 // biome-ignore lint/suspicious/noExplicitAny: plugins are generic over any Server's Registry/Context
-export type AnyServer = Server<any, any>
+export type AnyServer = Server<any, any, any>
 
 // Plugin definers + their types now live in `./plugin.ts`; re-exported here so `.use()` callers and
 // existing importers keep resolving them from the server module.
@@ -432,28 +450,13 @@ const STOP_HOOK_TIMEOUT_MS = 5_000
  * for the same request, so a browser that could open a socket was told its POST was cross-origin. */
 const wsSameOrigin = isSameOriginRequest
 
-function validationIssues(issues: ReadonlyArray<StandardIssue>): {
-  ok: false
-  error: string
-  issues: unknown[]
-} {
-  const serialized = issues.map((issue) => {
-    const path = issue.path?.map((seg) => String(typeof seg === "object" ? seg.key : seg))
-    return path !== undefined ? { message: issue.message, path } : { message: issue.message }
-  })
-  return { ok: false, error: "validation", issues: serialized }
-}
-
-/** The 422 as plain data - the shape every lane's response wrapper takes, so a rejected body costs
- * what an accepted one costs: on Node it is written straight to the socket with a `content-length`
- * instead of being built as a `Response` and drained back out. */
-export function plainValidationError(issues: ReadonlyArray<StandardIssue>): ResponseResult {
-  return status(422, validationIssues(issues))
-}
-
 // `jsonError`, `urlPartsOf`, `pathnameOf` moved to `./http.ts` (a dependency-free leaf shared with the
 // opt-in request lanes); re-exported so existing importers keep resolving from here.
 export { pathnameOf, urlPartsOf } from "./http.ts"
+/** The 422 as plain data - the shape every lane's response wrapper takes, so a rejected body costs
+ * what an accepted one costs: on Node it is written straight to the socket with a `content-length`
+ * instead of being built as a `Response` and drained back out. */
+export { plainValidationError } from "./validation.ts"
 // Query-string + urlencoded-form parsing now lives in `./query.ts`; re-exported so existing
 // importers keep resolving `searchOf`/`queryObjectOf`/`QueryValue` from here.
 export { type QueryValue, queryObjectOf, searchOf }
@@ -503,21 +506,6 @@ function responseSet(ctx: RawContext): CtxSet {
   return ctx[CONTEXT_SET]() ?? EMPTY_RESPONSE_CONTROLS
 }
 
-/**
- * A `derive` that answered with a response rather than a context extension - `status(...)`, or a bare
- * `Response`. The request ends there, on the same lane a `beforeHandle`'s early return takes.
- *
- * `derive` is the one stage that could not exit early: `beforeHandle` says "done" by returning a
- * value, but a derive's return value IS the extension, so the only way out was `throw`ing a
- * `Response` - which measured as the single most expensive way to answer (the `Response` object
- * costs ~40% of the rejection lane; see `PlainRender`). Neither shape had a meaning here before:
- * `Object.assign(ctx, response)` copies nothing (a `Response`'s properties live on its prototype),
- * so a derive that returned one silently fell through to the handler it meant to prevent.
- */
-function isDeriveEarlyExit(extension: unknown): boolean {
-  return isResponseResult(extension) || extension instanceof Response
-}
-
 function isContextlessNoArgArrow(handler: (context: never) => unknown): boolean {
   if (handler.length !== 0) return false
   try {
@@ -657,7 +645,7 @@ const sealHookAudit = (
  *   app.decorate("db", db).derive((c) => ({ user: auth(c) }))
  *      .get("/me", (c) => c.user)            // c.user + c.db are typed
  */
-export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
+export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, HookOutput = never> {
   /**
    * Which copy of `@nifrajs/core` declared this type. Two copies in one build (a linked sibling repo,
    * a hoisting split) produce two unrelated `Server` types whose assignment error is a wall of
@@ -676,6 +664,15 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * Created by the first `app.ws()` via the `@nifrajs/core/ws` runtime - `undefined` until then, so a
    * no-WebSocket app never constructs (or bundles) it. */
   private topics: TopicRegistry | undefined
+  /** True once any `app.ws()` route sets `validateSend: true` - the one case where a broadcast frame
+   * is validated (and possibly dropped) per socket, so `app.publish` must stay on the JS registry loop
+   * rather than delegate to Bun's native `server.publish`. */
+  private wsHasValidatedSend = false
+  /** Bun's native topic broadcast, bound by `listen()` in native-pubsub mode; `app.publish` uses it
+   * instead of the JS registry. `undefined` off Bun, before `listen()`, or with a validated-send route. */
+  private nativePublish:
+    | ((topic: string, data: string | ArrayBufferView | ArrayBuffer) => void)
+    | undefined
   private readonly maxBodyBytes: number
   private readonly protoPoisoning: "reject" | "strip" | "ignore"
   /** `trustBodyFraming`: mark every `app.fetch` request as runtime-framed (see ServerOptions). */
@@ -901,14 +898,22 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * takes, where `throw new Response(...)` pays ~40% of the rejection lane to build the object. That
    * branch is control flow, so it does not widen the derived context type.
    */
-  derive<D extends object>(
-    fn: (context: Context & Ctx) => MaybePromise<D | ResponseResult | Response>,
-  ): Server<R, Ctx & D> {
+  derive<H extends (context: Context & Ctx) => MaybePromise<unknown>>(
+    fn: H,
+  ): Server<
+    R,
+    Ctx & ContextExtensionOf<ReturnType<H>>,
+    HookOutput | StatusResponseOf<Awaited<ReturnType<H>>>
+  > {
     this.assertConfigurable("derive()")
     this.derives.push(fn as unknown as RawDerive)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "derive")
-    return this as unknown as Server<R, Ctx & D>
+    return this as unknown as Server<
+      R,
+      Ctx & ContextExtensionOf<ReturnType<H>>,
+      HookOutput | StatusResponseOf<Awaited<ReturnType<H>>>
+    >
   }
 
   /**
@@ -916,12 +921,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * by none before; one added after the last route reaches nothing
    * (see {@link ServerOptions.unusedScopedHooks}).
    */
-  decorate<const K extends string, V>(key: K, value: V): Server<R, Ctx & Record<K, V>> {
+  decorate<const K extends string, V>(key: K, value: V): Server<R, Ctx & Record<K, V>, HookOutput> {
     this.assertConfigurable("decorate()")
     this.decorations[key] = value
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "decorate")
-    return this as unknown as Server<R, Ctx & Record<K, V>>
+    return this as unknown as Server<R, Ctx & Record<K, V>, HookOutput>
   }
 
   /**
@@ -943,12 +948,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * it is snapshotted into every route declared *after* this call and covers none declared before, so
    * one added after the last route reaches nothing (see {@link ServerOptions.unusedScopedHooks}).
    */
-  beforeHandle(fn: (context: Context & Ctx) => MaybePromise<unknown>): this {
+  beforeHandle<H extends (context: Context & Ctx) => MaybePromise<unknown>>(
+    fn: H,
+  ): Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>> {
     this.assertConfigurable("beforeHandle()")
     this.beforeHandleHooks.push(fn as unknown as RawBeforeHandle)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "beforeHandle")
-    return this
+    return this as unknown as Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>>
   }
 
   /**
@@ -959,12 +966,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * Order-scoped: captured by every route declared *after* this call, none before; one added after the
    * last route reaches nothing (see {@link ServerOptions.unusedScopedHooks}).
    */
-  around(fn: <T>(context: Context & Ctx, next: () => MaybePromise<T>) => MaybePromise<T>): this {
+  around<
+    H extends (context: Context & Ctx, next: () => MaybePromise<unknown>) => MaybePromise<unknown>,
+  >(fn: H): Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>> {
     this.assertConfigurable("around()")
     this.aroundHooks.push(fn as unknown as RawAround)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "around")
-    return this
+    return this as unknown as Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>>
   }
 
   /**
@@ -1006,23 +1015,27 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   /** Transform the handler's result before it is serialized. Order-scoped: captured by routes declared
    * *after* this call, none before; one added after the last route reaches nothing (see
    * {@link ServerOptions.unusedScopedHooks}). */
-  afterHandle(fn: (result: unknown, context: Context & Ctx) => MaybePromise<unknown>): this {
+  afterHandle<H extends (result: unknown, context: Context & Ctx) => MaybePromise<unknown>>(
+    fn: H,
+  ): Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>> {
     this.assertConfigurable("afterHandle()")
     this.afterHandleHooks.push(fn as unknown as RawAfterHandle)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "afterHandle")
-    return this
+    return this as unknown as Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>>
   }
 
   /** Handle a thrown error; a non-`undefined` return becomes the response (else the default 500).
    * Order-scoped: captured by routes declared *after* this call, none before; one added after the last
    * route reaches nothing (see {@link ServerOptions.unusedScopedHooks}). */
-  onError(fn: (error: unknown, context: Context & Ctx) => MaybePromise<unknown>): this {
+  onError<H extends (error: unknown, context: Context & Ctx) => MaybePromise<unknown>>(
+    fn: H,
+  ): Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>> {
     this.assertConfigurable("onError()")
     this.onErrorHooks.push(fn as unknown as RawErrorHandler)
     if (hookAuditRuntime && process.env.NODE_ENV !== "production")
       recordScopedHook(this, this.catalog.size, "onError")
-    return this
+    return this as unknown as Server<R, Ctx, HookOutput | HookOutputOf<ReturnType<H>>>
   }
 
   /** Transform every outgoing response - success, error, 404, 405, short-circuit. Global. */
@@ -1133,14 +1146,6 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
 
   /** Enable the opt-in portable response observer methods. */
   use(plugin: ResponseObserverPlugin): this & ResponseObserverMethods
-  /**
-   * Apply a type-**identity** plugin ({@link IdentityPlugin}, from {@link defineIdentityPlugin}) - it
-   * registers routes/hooks but doesn't change the types, so this returns `this` with the route registry
-   * and context fully intact. This overload exists specifically so a named identity plugin (e.g.
-   * `@nifrajs/better-auth`) threads the registry: its `& { pluginName }` intersection would otherwise
-   * defeat the generic inference of the transforming overload below and collapse the result to `any`.
-   */
-  use(plugin: IdentityPlugin): this
   /**
    * Apply a **context** plugin ({@link ContextPlugin}, from {@link defineContextPlugin}) - it adds `D`
    * to the handler context and changes nothing else, so the route registry `R` and the existing context
@@ -1148,7 +1153,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * `(app: this) => Out` overload below cannot infer through a *generic* plugin signature: it erases the
    * plugin's own type parameters to their constraints, which silently widens `R` to `Registry`.
    */
-  use<D extends object>(plugin: ContextPlugin<D>): Server<R, Ctx & D>
+  use<D extends object>(plugin: ContextPlugin<D>): Server<R, Ctx & D, HookOutput>
+  /**
+   * Apply a type-**identity** plugin ({@link IdentityPlugin}, from {@link defineIdentityPlugin}) - it
+   * registers routes/hooks but doesn't change the types, so this returns `this` with the route registry
+   * and context fully intact. This overload exists specifically so a named identity plugin (e.g.
+   * `@nifrajs/better-auth`) threads the registry: its `& { pluginName }` intersection would otherwise
+   * defeat the generic inference of the transforming overload below and collapse the result to `any`.
+   */
+  use<AddedHookOutput = never>(
+    plugin: IdentityPlugin<AddedHookOutput>,
+  ): Server<R, Ctx, HookOutput | AddedHookOutput>
   /**
    * Apply a **plugin function** - `(app) => app`, typically built with {@link definePlugin}. It's
    * called with `this` and its result is returned, so an inline plugin's `derive`/`decorate` thread
@@ -1172,6 +1187,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * the last route reaches nothing - {@link ServerOptions.unusedScopedHooks} logs that at seal. A named
    * bundle already applied is skipped (idempotent).
    */
+  use<M extends Middleware>(mw: M): Server<R, Ctx, HookOutput | MiddlewareOutputOf<M>>
   use(mw: Middleware): this
   use(arg: Middleware | ((app: this) => AnyServer)): AnyServer {
     this.assertConfigurable("use()")
@@ -1256,16 +1272,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "GET", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "GET", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   get<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "GET", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "GET", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   get(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("GET", path, schemaOrHandler, handler)
   }
 
@@ -1298,12 +1322,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       stream: TypedSSEStream<InferOutput<S["sse"]>>,
     ) => void | Promise<void>,
     init?: SSEInit,
-  ): Server<AddRoute<R, "GET", Path, RouteInfoFor<Path, S, Response>>, Ctx> {
+  ): Server<
+    AddRoute<R, "GET", Path, RouteInfoFor<Path, S, Response, HookOutput>>,
+    Ctx,
+    HookOutput
+  > {
     const handler = (context: Context<Path, S> & Ctx): Response =>
       requireSseRuntime(this.sseRuntime).response(context, (stream) => run(context, stream), init)
     return this.route("GET", path, schema, handler as unknown as ErasedHandler) as Server<
-      AddRoute<R, "GET", Path, RouteInfoFor<Path, S, Response>>,
-      Ctx
+      AddRoute<R, "GET", Path, RouteInfoFor<Path, S, Response, HookOutput>>,
+      Ctx,
+      HookOutput
     >
   }
 
@@ -1311,16 +1340,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "POST", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "POST", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   post<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "POST", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "POST", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   post(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("POST", path, schemaOrHandler, handler)
   }
 
@@ -1328,16 +1365,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "PUT", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "PUT", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   put<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "PUT", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "PUT", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   put(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("PUT", path, schemaOrHandler, handler)
   }
 
@@ -1345,16 +1390,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "PATCH", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "PATCH", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   patch<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "PATCH", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "PATCH", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   patch(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("PATCH", path, schemaOrHandler, handler)
   }
 
@@ -1362,16 +1415,24 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     schema: S,
     handler: H,
-  ): Server<AddRoute<R, "DELETE", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "DELETE", Path, RouteInfoFor<Path, S, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   delete<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(
     path: Path,
     handler: H,
-  ): Server<AddRoute<R, "DELETE", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>
+  ): Server<
+    AddRoute<R, "DELETE", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>, HookOutput>>,
+    Ctx,
+    HookOutput
+  >
   delete(
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     return this.route("DELETE", path, schemaOrHandler, handler)
   }
 
@@ -1414,10 +1475,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         S["output"] extends StandardSchemaV1
           ? { body: S["input"]; response: S["output"] }
           : { body: S["input"] },
-        OutputOf<H>
+        OutputOf<H>,
+        HookOutput
       >
     >,
-    Ctx
+    Ctx,
+    HookOutput
   >
   tool(
     name: string,
@@ -1428,7 +1491,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       annotations?: ToolAnnotations
     },
     handler: (input: unknown, ctx: Context & Ctx) => unknown,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     const plan = requireMcpRuntime(this.mcpRuntime).tool(
       name,
       config,
@@ -1441,7 +1504,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     if (lastRoute) {
       ;(lastRoute as { tool?: RouteDescriptor["tool"] }).tool = plan.descriptor
     }
-    return this as unknown as Server<Registry, Ctx>
+    return this as unknown as Server<Registry, Ctx, HookOutput>
   }
 
   /**
@@ -1454,7 +1517,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     uri: string,
     config: { readonly name: string; readonly description?: string; readonly mimeType?: string },
     read: McpResourceDescriptor["read"],
-  ): Server<R, Ctx> {
+  ): Server<R, Ctx, HookOutput> {
     this.assertConfigurable("resource()")
     this.mcpResourceList.push(requireMcpRuntime(this.mcpRuntime).resource(uri, config, read))
     return this
@@ -1468,7 +1531,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     name: string,
     config: { readonly description: string; readonly arguments?: readonly PromptArgument[] },
     handler: McpPromptDescriptor["handler"],
-  ): Server<R, Ctx> {
+  ): Server<R, Ctx, HookOutput> {
     this.assertConfigurable("prompt()")
     this.mcpPromptList.push(requireMcpRuntime(this.mcpRuntime).prompt(name, config, handler))
     return this
@@ -1508,8 +1571,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: Path,
     handler: WebSocketHandler<Data, EnvOf<Ctx>, Schema, Send>,
   ): string extends Path
-    ? Server<R, Ctx>
-    : Server<AddRoute<R, "WS", Path, WsRouteInfoFor<Path, Schema, Send>>, Ctx> {
+    ? Server<R, Ctx, HookOutput>
+    : Server<AddRoute<R, "WS", Path, WsRouteInfoFor<Path, Schema, Send>>, Ctx, HookOutput> {
     this.assertConfigurable("ws()")
     // Boot-time guard: the WS runtime is a subpath (`@nifrajs/core/ws`) so no-WebSocket apps don't
     // bundle it. Registration is the loud, early failure point - never the first connection.
@@ -1520,6 +1583,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         `route WS ${path}: validateSend requires sendSchema`,
       )
     }
+    // A validated-send route makes broadcast bytes route-dependent (drop-on-invalid per socket), so the
+    // whole app forgoes native pub/sub and keeps the JS registry loop that runs each send through the sender.
+    if (handler.validateSend === true) this.wsHasValidatedSend = true
     this.topics ??= runtime.createTopics()
     // A `messageSchema` wraps `message` with validation once, here - every adapter then dispatches
     // already-validated, typed messages (Bun/Deno/Node/Workers) with no per-adapter code.
@@ -1536,6 +1602,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * an external fan-out (Redis, a Durable Object) to this. A no-op when nobody is subscribed.
    */
   publish(topic: string, data: string | ArrayBufferView | ArrayBuffer): void {
+    // Native-pubsub mode (Bun, no validated-send route): one native broadcast to every subscriber, no
+    // per-connection JS loop. Bound only after `listen()`; before that (or off Bun) the registry runs.
+    if (this.nativePublish !== undefined) {
+      this.nativePublish(topic, data)
+      return
+    }
     // No `app.ws()` yet ⇒ no registry and necessarily no subscribers - a publish is a no-op anyway.
     this.topics?.publish(topic, data)
   }
@@ -1545,7 +1617,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     path: string,
     schemaOrHandler: RouteSchema | ErasedHandler,
     handler?: ErasedHandler,
-  ): Server<Registry, Ctx> {
+  ): Server<Registry, Ctx, HookOutput> {
     let rawHandler: ErasedHandler
     let schema: RouteSchema | undefined
     if (handler !== undefined) {
@@ -1558,7 +1630,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     this.register(method, path, schema, rawHandler)
     // The accumulated registry type is compile-time only; the same instance
     // carries every route, so the public methods re-type `this` per call.
-    return this as unknown as Server<Registry, Ctx>
+    return this as unknown as Server<Registry, Ctx, HookOutput>
   }
 
   /**
@@ -1599,162 +1671,58 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     schema: RouteSchema | undefined,
     handler: (context: never) => unknown,
   ): CatalogRoute {
-    const pattern = compileRoutePattern(path)
-    // Resolved here, once: `undefined` past this point means the route declared `"unlimited"`, NOT
-    // "nothing declared". Readers fall back to UNLIMITED_BODY_BYTES accordingly.
-    let bodyLimit: number | undefined = this.maxBodyBytes
-    const invalidBodyLimit = (message: string): never => {
-      throw new RouteConfigError("INVALID_BODY_LIMIT", `route ${method} ${path}: ${message}`)
-    }
-    if (schema?.bodyLimitReason !== undefined && schema.bodyLimit !== "unlimited") {
-      invalidBodyLimit('bodyLimitReason is only valid with bodyLimit: "unlimited"')
-    }
-    if (schema?.bodyLimit === "unlimited") {
-      if (
-        typeof schema.bodyLimitReason !== "string" ||
-        schema.bodyLimitReason.trim().length === 0
-      ) {
-        invalidBodyLimit('bodyLimit: "unlimited" requires a non-empty bodyLimitReason')
-      }
-      if (schema.body !== undefined) {
-        invalidBodyLimit(
-          'bodyLimit: "unlimited" cannot be used with a body schema; use a finite cap',
-        )
-      }
-      if (schema.idempotency !== undefined) {
-        invalidBodyLimit('bodyLimit: "unlimited" cannot be used with idempotency')
-      }
-      bodyLimit = undefined
-    } else if (schema?.bodyLimit !== undefined) {
-      try {
-        assertByteLimit(schema.bodyLimit, "route bodyLimit")
-      } catch {
-        invalidBodyLimit('bodyLimit must be a non-negative safe integer or "unlimited"')
-      }
-      bodyLimit = schema.bodyLimit
-    }
-    const capabilities = normalizeRouteCapabilities(schema?.capabilities)
-    const handlerAssurance = assuranceDeclarationsOf(handler as unknown as object)
-    const invalidHandlerScope = handlerAssurance.find(
-      (declaration) => declaration.scope !== "plugin",
-    )
-    if (invalidHandlerScope !== undefined) {
-      throw new RouteConfigError(
-        "INVALID_ASSURANCE",
-        `route handler assurance must use plugin scope (received ${invalidHandlerScope.scope})`,
-      )
-    }
-    const authenticated = assuranceEvidenceFor(
-      [...this.activeAssurance, ...handlerAssurance, ...this.globalAssurance],
-      method,
-      path,
-    ).some((evidence) => evidence.id === NIFRA_ASSURANCE_IDS.AUTHENTICATED)
-    const routeDecorations: Record<PropertyKey, unknown> = { ...this.decorations }
-    if (capabilities.length > 0) {
-      routeDecorations[CAPABILITY_GUARD] = createCapabilityGuard(
-        capabilities,
-        method,
-        path,
-        this.onCapabilityUse,
-        this.idempotencyRuntime?.trackEffect,
-        Object.freeze([...this.capabilityInterceptors]),
-        Object.freeze([...this.capabilityObservers]),
-      )
-    }
-    const hasDecorations = Reflect.ownKeys(routeDecorations).length > 0
-    // An idempotency route runs a dedupe lane that must buffer the body and capture the response, so it
-    // never takes the fused/native fast path - force it onto the portable matched lane (which routes
-    // through `fetchMatched`, where the dedupe wrapper lives). Fail closed: a route may not declare
-    // idempotency unless the idempotency runtime is installed, so the safety gate can never be silently
-    // dropped by a missing plugin.
-    if (schema?.idempotency !== undefined && this.idempotencyRuntime === undefined) {
-      throw new RouteConfigError(
-        "INVALID_IDEMPOTENCY",
-        "route declares idempotency but the idempotency plugin is not installed; add .use(idempotency())",
-      )
-    }
-    const idempotent = this.idempotencyRuntime?.resolve(schema, authenticated, this.maxBodyBytes)
-    // A ledgered route (capabilities declared + `.use(effectLedger())`) needs a per-request
-    // context to carry the ledger and a settle step to seal + sink it, so it too leaves the
-    // fused/contextless fast path. Resolved per route, at registration - like the capability guard.
-    const ledgered: ResolvedEffectLedger | undefined = this.effectLedgerRuntime?.resolve(
-      capabilities,
+    const compiled = compileRouteOptions(
+      {
+        maxBodyBytes: this.maxBodyBytes,
+        activeAssurance: this.activeAssurance,
+        globalAssurance: this.globalAssurance,
+        decorations: this.decorations,
+        onCapabilityUse: this.onCapabilityUse,
+        capabilityInterceptors: this.capabilityInterceptors,
+        capabilityObservers: this.capabilityObservers,
+        effectLedgerRuntime: this.effectLedgerRuntime,
+        idempotencyRuntime: this.idempotencyRuntime,
+        responseContractRuntime: this.responseContractRuntime,
+        derives: this.derives,
+        beforeHandleHooks: this.beforeHandleHooks,
+        afterHandleHooks: this.afterHandleHooks,
+        onErrorHooks: this.onErrorHooks,
+        aroundHooks: this.aroundHooks,
+        defaultOnValidationError: this.defaultOnValidationError,
+      },
       method,
       path,
+      schema,
+      handler,
     )
-    // A checked response schema needs the handler's VALUE before it becomes bytes, and the fused and
-    // native lanes exist precisely to skip that step. So a contracted route leaves them - the same
-    // structural trade an idempotent route makes above. The check itself is not the cost: a compiled
-    // validator measures ~100ns/response, within benchmark noise on any route these lanes already
-    // exclude (middleware, derives, lifecycle hooks).
-    const runtime = this.responseContractRuntime
-    const contracted =
-      runtime !== undefined && schema?.response !== undefined
-        ? { runtime, schema: schema.response }
-        : undefined
-    const bare =
-      schema?.params === undefined &&
-      schema?.headers === undefined &&
-      schema?.body === undefined &&
-      schema?.query === undefined &&
-      idempotent === undefined &&
-      ledgered === undefined &&
-      contracted === undefined &&
-      this.derives.length === 0 &&
-      this.beforeHandleHooks.length === 0 &&
-      this.afterHandleHooks.length === 0 &&
-      this.onErrorHooks.length === 0
-    // A route whose ONLY lifecycle step is a query schema can fuse too: the parse + validate +
-    // handler + respond collapse into one closure with no lifecycle promise on the sync path. The
-    // guards mirror the `query` lane below PLUS everything the fused dispatch skips: around hooks,
-    // the idempotency/ledger wrappers, and validation-error recovery (schema or server default) -
-    // the fused invalid path is exactly `validationError(issues)`, so any recovery semantics keep
-    // the generic lane.
-    const fusedQuery =
-      !bare &&
-      contracted === undefined &&
-      schema?.query !== undefined &&
-      schema.body === undefined &&
-      schema.params === undefined &&
-      schema.headers === undefined &&
-      schema.onValidationError === undefined &&
-      this.defaultOnValidationError === undefined &&
-      idempotent === undefined &&
-      ledgered === undefined &&
-      this.derives.length === 0 &&
-      this.beforeHandleHooks.length === 0 &&
-      this.afterHandleHooks.length === 0 &&
-      this.onErrorHooks.length === 0 &&
-      this.aroundHooks.length === 0
-    const bodyOnly =
-      contracted === undefined &&
-      schema?.body !== undefined &&
-      schema.query === undefined &&
-      schema.params === undefined &&
-      schema.headers === undefined &&
-      this.derives.length === 0 &&
-      this.beforeHandleHooks.length === 0 &&
-      this.afterHandleHooks.length === 0 &&
-      this.onErrorHooks.length === 0
-    const fusedBody =
-      !bare &&
-      bodyOnly &&
-      schema.onValidationError === undefined &&
-      this.defaultOnValidationError === undefined &&
-      idempotent === undefined &&
-      ledgered === undefined &&
-      this.aroundHooks.length === 0
-    // Body-only routes still need an async body read, but eligible routes can compile the validation +
-    // handler continuation once. The runner keeps the bounded parser and all error semantics while
-    // avoiding the generic entry/schema/lifecycle dispatch on Bun, Deno, and Node-direct.
+    const {
+      pattern,
+      bodyLimit,
+      capabilities,
+      routeDecorations,
+      hasDecorations,
+      idempotent,
+      ledgered,
+      responseContract,
+      lanes,
+      routeAssurance,
+    } = compiled
+    const { bare, fusedQuery, fusedBody } = lanes
     const fusedBodyRunner = fusedBody
       ? this.buildFusedBodyRunner(
           handler as unknown as InternalHandler,
-          schema.body as StandardSchemaV1,
+          schema?.body as StandardSchemaV1,
           hasDecorations ? routeDecorations : undefined,
           bodyLimit ?? UNLIMITED_BODY_BYTES,
         )
       : undefined
+    // Fused lifecycle lanes: derive + before (with or without an after), and body + the same shape.
+    // The lane selectors in `selectRouteLanes` are exhaustive about the lifecycleHookLane /
+    // body-derive-before-after eligibility, so we only need to check the lane and the hook counts.
+    const lifecycleHookLane = lanes.lifecycleHookLane
+    const isFusedLifecycle = lifecycleHookLane !== undefined && this.derives.length === 1
+    const isFusedBodyLifecycle =
+      lanes.fusedLane === "body-derive-before" || lanes.fusedLane === "body-derive-before-after"
     const fusedWeb =
       bare && this.aroundHooks.length === 0
         ? this.buildFusedWeb(
@@ -1767,87 +1735,79 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
           ? this.buildFusedQueryWeb(
               handler as unknown as InternalHandler,
               hasDecorations ? routeDecorations : undefined,
-              schema.query as StandardSchemaV1,
+              schema?.query as StandardSchemaV1,
               bodyLimit ?? UNLIMITED_BODY_BYTES,
             )
           : fusedBody
             ? this.buildFusedBodyWeb(fusedBodyRunner as FusedBodyRunner)
-            : undefined
-    const contextless = bare && this.aroundHooks.length === 0 && isContextlessNoArgArrow(handler)
-    // The body and query lanes finalize the handler's result themselves, so a contracted route takes
-    // the general lifecycle lane instead - one place owns the check rather than three.
-    const lane = bare
-      ? "bare"
-      : bodyOnly
-        ? "body"
-        : contracted === undefined &&
-            schema?.body === undefined &&
-            schema?.query !== undefined &&
-            schema.params === undefined &&
-            schema.headers === undefined &&
-            this.derives.length === 0 &&
-            this.beforeHandleHooks.length === 0 &&
-            this.afterHandleHooks.length === 0 &&
-            this.onErrorHooks.length === 0
-          ? "query"
-          : "lifecycle"
-    // Lifecycle routes with no params schema are the common middleware shape: a derive/before hook
-    // plus an optional query or body schema. Select their complete validation stage at registration
-    // so the request path never re-checks params/body presence. Parameter-schema routes retain the
-    // generic lifecycle runner until their more involved recovery matrix is selected explicitly.
-    const lifecycleLane =
-      lane !== "lifecycle" || schema?.params !== undefined || schema?.headers !== undefined
-        ? undefined
-        : schema?.body !== undefined
-          ? schema.query !== undefined
-            ? "body-query"
-            : "body"
-          : schema?.query !== undefined
-            ? "query"
-            : "hooks"
-    // The realistic middleware shape is commonly exactly one synchronous-or-async derive followed
-    // by one before hook. Keep the generic runner for every route that can observe decorations,
-    // after hooks, error hooks, or response contracts; this lane only removes the two per-request
-    // hook-loop dispatches and preserves the same async continuations and error handling.
-    const lifecycleHookLane =
-      lane === "lifecycle" &&
-      contracted === undefined &&
-      !hasDecorations &&
-      this.derives.length === 1 &&
-      this.beforeHandleHooks.length === 1 &&
-      this.afterHandleHooks.length === 0 &&
-      this.onErrorHooks.length === 0
-        ? "derive-before"
-        : undefined
+            : isFusedBodyLifecycle
+              ? this.buildFusedBodyDeriveBeforeAfter(
+                  handler as unknown as InternalHandler,
+                  this.derives[0]!,
+                  this.beforeHandleHooks[0]!,
+                  this.afterHandleHooks[0],
+                  schema?.body as StandardSchemaV1,
+                  bodyLimit ?? UNLIMITED_BODY_BYTES,
+                )
+              : isFusedLifecycle && lifecycleHookLane === "derive-before"
+                ? this.buildFusedDeriveBefore(
+                    handler as unknown as InternalHandler,
+                    this.derives[0]!,
+                    this.beforeHandleHooks[0]!,
+                    schema?.query,
+                    bodyLimit ?? UNLIMITED_BODY_BYTES,
+                  )
+                : isFusedLifecycle && lifecycleHookLane === "derive-before-after"
+                  ? this.buildFusedDeriveBeforeAfter(
+                      handler as unknown as InternalHandler,
+                      this.derives[0]!,
+                      this.beforeHandleHooks[0]!,
+                      this.afterHandleHooks[0]!,
+                      schema?.query,
+                      bodyLimit ?? UNLIMITED_BODY_BYTES,
+                    )
+                  : undefined
+    const program = compileRouteProgram({
+      schema,
+      handler: handler as unknown as InternalHandler,
+      derives: this.derives,
+      beforeHandle: this.beforeHandleHooks,
+      afterHandle: this.afterHandleHooks,
+      onError: this.onErrorHooks,
+      decorations: routeDecorations,
+      hasDecorations,
+      bodySchema: schema?.body,
+      bodyLimit,
+      responseContract,
+    })
+    const contextless =
+      lanes.bare && this.aroundHooks.length === 0 && isContextlessNoArgArrow(handler)
     const execution = compileRouteExecutionPlan({
-      lane,
+      lane: lanes.lane,
       contextless,
       hasAround: this.aroundHooks.length > 0,
       hasLedger: ledgered !== undefined,
-      lifecycleLane,
       fusedWeb,
       fusedBody: fusedBodyRunner,
-      fusedLane:
-        fusedWeb === undefined ? undefined : fusedQuery ? "query" : fusedBody ? "body" : "bare",
+      fusedLane: lanes.fusedLane,
     })
     const registeredEntry: RouteEntry = {
-      // (context: never) => unknown -> InternalHandler: the framework invokes it
-      // with the concrete RawContext the typed handler expects, so this is sound.
       handler: handler as unknown as InternalHandler,
       schema,
       bodyLimit,
       idempotent,
       ledgered,
-      responseContract: contracted,
+      responseContract,
       derives: [...this.derives],
       decorations: routeDecorations,
       hasDecorations,
       beforeHandle: [...this.beforeHandleHooks],
       afterHandle: [...this.afterHandleHooks],
       onError: [...this.onErrorHooks],
-      lifecycleHookLane,
+      lifecycleHookLane: lanes.lifecycleHookLane,
       around: [...this.aroundHooks],
       execution,
+      program,
     }
     const descriptor: RouteDescriptor = {
       method,
@@ -1856,72 +1816,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       ...(capabilities.length > 0 ? { capabilities } : {}),
       ...(schema?.family === true ? { family: true } : {}),
     }
-    const routeAssurance: AssuranceDeclaration[] = [...this.activeAssurance, ...handlerAssurance]
-    if (contracted?.runtime.mode === "enforce" && schema?.response !== undefined) {
-      routeAssurance.push(
-        Object.freeze({
-          id: NIFRA_ASSURANCE_IDS.RESPONSE_CONTRACT,
-          source: "response-contract",
-          scope: "plugin",
-        }),
-      )
-    }
-    // Inline `schema.assurance`: the route DECLARES its enforcement evidence adjacent to the handler, so an
-    // in-handler-guarded route satisfies a policy `require:` clause without a `withRouteAssurance` middleware
-    // rewrite. Each id becomes route-scoped `declared` evidence (invalid ids fail closed at registration).
-    for (const id of schema?.assurance ?? []) {
-      if (!validEvidenceId(id)) {
-        throw new Error(
-          `route assurance: invalid evidence id ${JSON.stringify(id)} on ${method} ${path} (use lowercase dot/dash segments)`,
-        )
-      }
-      const declared = { id, source: "declared", scope: "plugin" } as AssuranceDeclaration
-      Object.defineProperty(declared, "provenance", {
-        value: "declared",
-        enumerable: false,
-        configurable: false,
-        writable: false,
-      })
-      routeAssurance.push(Object.freeze(declared))
-    }
-    // Two ways a route proves its body is bounded, both enforced by the core at read time:
-    // `schema.body` (the validated read is bounded) and an explicit finite `schema.bodyLimit` (the
-    // transport cap shadows every reader, including a raw `c.req.body` stream that a Content-Length
-    // middleware cannot bound).
-    // `bodyLimit: "unlimited"` is rejected above for schema and idempotency routes. The remaining
-    // exemption is schema-less streaming/upload work, so it publishes NOTHING: there is no finite
-    // framework byte ceiling for assurance to attest and the application protocol owns that bound.
-    // The server-wide `maxBodyBytes` default is not evidence either. It applies to every route
-    // whether or not anyone thought about it, so publishing it would make the id pass everywhere and
-    // prove nothing; this evidence marks a bound the route chose.
-    const unlimitedBody = schema?.bodyLimit === "unlimited"
-    if (!unlimitedBody && (schema?.body !== undefined || typeof schema?.bodyLimit === "number")) {
-      routeAssurance.push(
-        Object.freeze({
-          id: NIFRA_ASSURANCE_IDS.BODY_BOUNDED,
-          source: "route-schema",
-          scope: "plugin",
-        }),
-      )
-    }
-    // Declaring `schema.idempotency` is evidence for request replay only. It deliberately never proves
-    // durable command execution; that stronger evidence belongs to a command/outbox adapter.
-    if (schema?.idempotency !== undefined) {
-      routeAssurance.push(
-        Object.freeze({
-          id: NIFRA_ASSURANCE_IDS.IDEMPOTENCY_KEY,
-          source: "route-schema",
-          scope: "plugin",
-        }),
-      )
-    }
     return {
       method,
       path,
       pattern,
       entry: registeredEntry,
       descriptor,
-      assurance: Object.freeze(routeAssurance),
+      assurance: routeAssurance,
     }
   }
 
@@ -2032,7 +1933,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * `RouteConfigError` at merge time, and a group with WebSocket routes is refused (register
    * those on the parent).
    */
-  merge<R2 extends Registry, Ctx2>(other: Server<R2, Ctx2>): Server<R & R2, Ctx> {
+  merge<R2 extends Registry, Ctx2, HookOutput2>(
+    other: Server<R2, Ctx2, HookOutput2>,
+  ): Server<R & R2, Ctx, HookOutput> {
     this.assertConfigurable("merge()")
     const source = other as unknown as Server<Registry, EmptyContext>
     if (source.wsRouteCount > 0) {
@@ -2117,7 +2020,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     if (!scoped) this.globalAssurance.push(...source.globalAssurance)
     this.mcpResourceList.push(...source.mcpResourceList)
     this.mcpPromptList.push(...source.mcpPromptList)
-    return this as unknown as Server<R & R2, Ctx>
+    return this as unknown as Server<R & R2, Ctx, HookOutput>
   }
 
   /** A fused renderer closes over runtime services to keep its seven-argument JSC fast path. Merging
@@ -2127,8 +2030,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     if (entry.execution.fusedWeb === undefined) return route
     // Rebuild with the SAME builder that produced the closure - rebinding a query-fused route as
     // bare would silently drop its validation.
+    const lane = entry.execution.fusedLane
+    // Type-erase the lane so each `===` branch sees the full union, not the narrowed remainder.
+    const laneName: string | undefined = lane
+    // Body+lifecycle routes have a fused Web renderer, but no body-only Node renderer: the latter
+    // would bypass derive/before/after because the Node-direct dispatcher prefers `fusedBody` over
+    // the generic execution plan. Only the original body-only lane may populate this slot.
     const fusedBody =
-      entry.execution.fusedLane === "body"
+      laneName === "body"
         ? this.buildFusedBodyRunner(
             entry.handler,
             entry.schema?.body as StandardSchemaV1,
@@ -2136,22 +2045,66 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
             entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
           )
         : undefined
+    const derive = entry.derives[0]
+    const before = entry.beforeHandle[0]
+    const after = entry.afterHandle[0]
     const fusedWeb =
-      entry.execution.fusedLane === "body"
+      laneName === "body"
         ? this.buildFusedBodyWeb(fusedBody as FusedBodyRunner)
-        : entry.execution.fusedLane === "query"
+        : laneName === "query"
           ? this.buildFusedQueryWeb(
               entry.handler,
               entry.hasDecorations ? entry.decorations : undefined,
               entry.schema?.query as StandardSchemaV1,
               entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
             )
-          : this.buildFusedWeb(
-              entry.handler,
-              entry.hasDecorations ? entry.decorations : undefined,
-              isContextlessNoArgArrow(entry.handler),
-              entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
-            )
+          : laneName === "body-derive-before" && derive !== undefined && before !== undefined
+            ? this.buildFusedBodyDeriveBeforeAfter(
+                entry.handler,
+                derive,
+                before,
+                undefined,
+                entry.schema?.body as StandardSchemaV1,
+                entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+              )
+            : laneName === "body-derive-before-after" &&
+                derive !== undefined &&
+                before !== undefined &&
+                after !== undefined
+              ? this.buildFusedBodyDeriveBeforeAfter(
+                  entry.handler,
+                  derive,
+                  before,
+                  after,
+                  entry.schema?.body as StandardSchemaV1,
+                  entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                )
+              : laneName === "derive-before" && derive !== undefined && before !== undefined
+                ? this.buildFusedDeriveBefore(
+                    entry.handler,
+                    derive,
+                    before,
+                    entry.schema?.query,
+                    entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                  )
+                : laneName === "derive-before-after" &&
+                    derive !== undefined &&
+                    before !== undefined &&
+                    after !== undefined
+                  ? this.buildFusedDeriveBeforeAfter(
+                      entry.handler,
+                      derive,
+                      before,
+                      after,
+                      entry.schema?.query,
+                      entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                    )
+                  : this.buildFusedWeb(
+                      entry.handler,
+                      entry.hasDecorations ? entry.decorations : undefined,
+                      isContextlessNoArgArrow(entry.handler),
+                      entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                    )
     return {
       ...route,
       entry: {
@@ -2949,7 +2902,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   /**
    * Route → build context → run. Synchronous through to the handler for a **bare** route
    * (selected by its compiled plan), so a sync handler produces its result with zero promise allocations;
-   * routes with validation/hooks keep the full async {@link runLifecycle}, unchanged.
+   * routes with validation/hooks keep the full compiled route program, unchanged.
    */
   private routeAndRun<T>(
     source: RequestSource,
@@ -3219,7 +3172,6 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   /** The narrowest bare route: a syntactic `() => ...` handler cannot observe the context argument, so
    * successful requests can skip allocating `RequestContext`. Errors still allocate one for logging. */
   // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
   private runContextlessBare<T>(
     entry: RouteEntry,
     source: RequestSource,
@@ -3290,19 +3242,18 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       this.protoPoisoning,
     )
     this.logRequestError(err, ctx)
-    return wrapResponse(plainError(500, "internal_error"))
+    return this.internalErrorResponse(wrapResponse)
   }
 
   /**
    * The synchronous fast path selected by a route's execution plan: apply static decorations, call the
    * handler, render the result - **no `await`** unless the handler itself returns a promise. It mirrors
-   * the bare slice of {@link runLifecycle} (which a bare route would otherwise no-op through) and shares
+   * the same error boundary as the compiled route program (which a bare route would otherwise no-op through) and shares
    * {@link logRequestError}; a bare route has no `onError` hooks, so error handling is fully synchronous
    * (a thrown `Response` is control flow; anything else is a logged flat 500). This is where nifra skips
    * the per-request async-frame tax - the same win codegen routers get, but without `eval`.
    */
   // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
   private runBare<T>(
     entry: RouteEntry,
     ctx: RawContext,
@@ -3326,7 +3277,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return finalize(result, responseSet(ctx))
   }
 
-  /** Bare-route error rendering - identical to {@link runLifecycle}'s catch minus the (absent) onError
+  /** Bare-route error rendering - identical to the compiled route program's catch minus the (absent) onError
    * loop: a thrown `Response` is returned as deliberate control flow; anything else is logged + 500. */
   /**
    * Build a route's fused Web renderer. Composition happens once at
@@ -3704,1010 +3655,968 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     }
   }
 
-  private bareError<T>(
-    err: unknown,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): T {
-    // The thrown-value contract lives in `bare-error-lane.ts`, one source of truth for both this
-    // lane and the fused body runner. `responseSet` and the logger are injected because they reach
-    // into class state; the closure is allocated only on the throw path, never on the hot lane.
-    return renderBareError(err, ctx, finalize, wrapResponse, responseSet, (e, c) =>
-      this.logRequestError(e, c),
-    )
-  }
-
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runWithAround<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    run: () => MaybePromise<T>,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    let outcome: MaybePromise<T>
-    try {
-      outcome = this.runAround(entry.around, ctx, run)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
-    return outcome instanceof Promise
-      ? outcome.catch((err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse))
-      : outcome
-  }
-
-  private runAround<T>(
-    hooks: ReadonlyArray<RawAround>,
-    ctx: RawContext,
-    run: () => MaybePromise<T>,
-  ): MaybePromise<T> {
-    const dispatch = (index: number): MaybePromise<T> => {
-      if (index >= hooks.length) return run()
-      const hook = hooks[index]!
-      let called = false
-      return hook(ctx, () => {
-        if (called) throw new Error("around next() called multiple times")
-        called = true
-        return dispatch(index + 1)
-      })
+  /**
+   * Compile a route's `derive + before` lifecycle to a single closure: the per-request walk through
+   * `runSync` → `runHooksSync` is a stack of 3 frames and 2 `Object.assign`s for what is by far the
+   * most common middleware shape (auth/trace/id derivation, an auth/policy `beforeHandle`). Folding
+   * the same steps into one closure hits the same monomorphic inline-cache site as `buildFusedWeb`,
+   * and `Object.assign(ctx, deriveResult)` becomes one extra property write on the context's already
+   * hot hidden class. Behavior is byte-identical to the compiled route program: the same thrown-value
+   * contract (`Response` is control flow, anything else logs + 500), the same `c.set` semantics, the
+   * same `fusedRespond` for the rendered body. The `LifecycleExecutionLane` guarantee
+   * (`schema.params === undefined && schema.headers === undefined && derives === 1 &&
+   * beforeHandle === 1 && afterHandle === 0 && onError === 0 && !hasResponseContract &&
+   * !hasDecorations`) is enforced by `selectRouteLanes`; this lane is selected ONLY when all of those
+   * hold. A `query` schema (the route declares `{ query }` alongside the hooks) is validated FIRST,
+   * mirroring the compiled route program's stage order; the fused builder runs validate → derive →
+   * before → handler in one frame.
+   */
+  private buildFusedDeriveBefore(
+    handler: InternalHandler,
+    derive: RawDerive,
+    before: RawBeforeHandle,
+    querySchema: StandardSchemaV1 | undefined,
+    maxBodyBytes: number,
+  ): FusedWebRunner {
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
+      )
+    return (source, params, search, signal, budget, platform, nativeContext) => {
+      const ctx = nativeContext
+        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+        : new RequestContext(
+            source,
+            params,
+            search,
+            signal,
+            budget,
+            platform,
+            maxBodyBytes,
+            this.protoPoisoning,
+          )
+      const runHandler = (): MaybePromise<Response> => {
+        let result: unknown
+        try {
+          result = handler(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (result instanceof Promise) {
+          return result.then(
+            (value) =>
+              fusedRespond(
+                value,
+                ctx,
+                this.responseBodyTag,
+                this.staticResponseHeaders,
+                this.onResponseHooks.length === 0,
+              ),
+            (err) => logError(err, ctx),
+          )
+        }
+        return fusedRespond(
+          result,
+          ctx,
+          this.responseBodyTag,
+          this.staticResponseHeaders,
+          this.onResponseHooks.length === 0,
+        )
+      }
+      const runBefore = (): MaybePromise<Response> => {
+        let early: unknown
+        try {
+          early = before(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (early instanceof Promise) {
+          return early.then(
+            (settled) => {
+              if (settled === undefined) return runHandler()
+              return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+            },
+            (err) => logError(err, ctx),
+          )
+        }
+        if (early === undefined) return runHandler()
+        return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders)
+      }
+      const runDerive = (): MaybePromise<Response> => {
+        let derived: unknown
+        try {
+          derived = derive(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (derived instanceof Promise) {
+          return derived.then(
+            (settled) => {
+              if (isResponseResult(settled) || settled instanceof Response) {
+                return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+              }
+              Object.assign(ctx, settled as object)
+              return runBefore()
+            },
+            (err) => logError(err, ctx),
+          )
+        }
+        if (isResponseResult(derived) || derived instanceof Response) {
+          return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders)
+        }
+        Object.assign(ctx, derived as object)
+        return runBefore()
+      }
+      if (querySchema === undefined) return runDerive()
+      let validation: MaybePromise<StandardResult<unknown>>
+      try {
+        validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]))
+      } catch (err) {
+        return logError(err, ctx)
+      }
+      if (validation instanceof Promise) {
+        return validation.then(
+          (settled) => {
+            if (settled.issues !== undefined)
+              return this.wrapWebResponse(plainValidationError(settled.issues))
+            ctx.query = settled.value
+            return runDerive()
+          },
+          (err) => logError(err, ctx),
+        )
+      }
+      if (validation.issues !== undefined)
+        return this.wrapWebResponse(plainValidationError(validation.issues))
+      ctx.query = validation.value
+      return runDerive()
     }
-    return dispatch(0)
   }
 
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runBodyOnly<T>(
-    entry: RouteEntry,
-    source: RequestSource,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): Promise<T> {
-    return readBodyFramed(
-      source,
-      entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
-      this.protoPoisoning,
-      (parsed) => this.finishBodyOnly(entry, parsed, ctx, finalize, wrapResponse),
-      wrapResponse,
-      (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-    )
-  }
-
-  /** Validate + run the handler for the bodyOnly path - shared by the inline fast path and the
-   * streaming fallback. A method (not per-request closures) so the hot path allocates nothing
-   * beyond the one `.then` continuation. */
-  private finishBodyOnly<T>(
-    entry: RouteEntry,
-    parsed: unknown,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    try {
-      const bodySchema = entry.schema!.body!
-      const validation = bodySchema["~standard"].validate(parsed)
-      if (validation instanceof Promise) {
-        return validation.then(
-          (result) => {
-            try {
-              const outcome = this.applyBodyValidation(entry, result, ctx, finalize, wrapResponse)
-              return outcome instanceof Promise
-                ? outcome.catch((err) =>
-                    this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-                  )
-                : outcome
-            } catch (err) {
-              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-            }
-          },
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-        )
-      }
-      const outcome = this.applyBodyValidation(entry, validation, ctx, finalize, wrapResponse)
-      return outcome instanceof Promise
-        ? outcome.catch((err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse))
-        : outcome
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
-  }
-
-  private executeHandler<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse?: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    if (entry.hasDecorations) Object.assign(ctx, entry.decorations)
-    const handlerOutput = entry.handler(ctx)
-    if (handlerOutput instanceof Promise) {
-      return handlerOutput.then(
-        (value) => finalize(value, responseSet(ctx)),
-        (err) => {
-          if (wrapResponse) {
-            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-          }
-          throw err
-        },
+  /**
+   * Same shape as `buildFusedDeriveBefore`, plus one `afterHandle` step. The closure runs (validate) →
+   * derive → before → handler → after in one frame, the shape the realistic middleware route lands on
+   * when it also wants a response transform (e.g. attaching a request id to a successful payload's
+   * headers). `LifecycleExecutionLane` and `selectRouteLanes` guarantee `afterHandle === 1`, the
+   * throw contract is the same as the generic program, and the `after` step is the final transform +
+   * respond the generic program already does.
+   */
+  private buildFusedDeriveBeforeAfter(
+    handler: InternalHandler,
+    derive: RawDerive,
+    before: RawBeforeHandle,
+    after: RawAfterHandle,
+    querySchema: StandardSchemaV1 | undefined,
+    maxBodyBytes: number,
+  ): FusedWebRunner {
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
       )
-    }
-    return finalize(handlerOutput, responseSet(ctx))
-  }
-
-  private handleValidationErrorRecovery<T>(
-    entry: RouteEntry,
-    recovery: unknown,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-    originalIssues: ReadonlyArray<StandardIssue>,
-    kind: "body" | "query",
-  ): MaybePromise<T> {
-    if (recovery !== undefined) {
-      if (recovery instanceof Response) {
-        return wrapResponse(recovery)
+    return (source, params, search, signal, budget, platform, nativeContext) => {
+      const ctx = nativeContext
+        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+        : new RequestContext(
+            source,
+            params,
+            search,
+            signal,
+            budget,
+            platform,
+            maxBodyBytes,
+            this.protoPoisoning,
+          )
+      const runAfter = (result: unknown): MaybePromise<Response> => {
+        let transformed: unknown
+        try {
+          transformed = after(result, ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (transformed instanceof Promise) {
+          return transformed.then(
+            (value) =>
+              fusedRespond(
+                value,
+                ctx,
+                this.responseBodyTag,
+                this.staticResponseHeaders,
+                this.onResponseHooks.length === 0,
+              ),
+            (err) => logError(err, ctx),
+          )
+        }
+        return fusedRespond(
+          transformed,
+          ctx,
+          this.responseBodyTag,
+          this.staticResponseHeaders,
+          this.onResponseHooks.length === 0,
+        )
       }
-      if (kind === "body" && entry.schema?.body) {
-        const validation = entry.schema.body["~standard"].validate(recovery)
-        if (validation instanceof Promise) {
-          return validation.then((settled) => {
-            if (settled.issues !== undefined)
-              return wrapResponse(plainValidationError(settled.issues))
-            ctx.body = settled.value
-            return this.executeHandler(entry, ctx, finalize)
-          })
+      const runHandler = (): MaybePromise<Response> => {
+        let result: unknown
+        try {
+          result = handler(ctx)
+        } catch (err) {
+          return logError(err, ctx)
         }
-        if (validation.issues !== undefined)
-          return wrapResponse(plainValidationError(validation.issues))
-        ctx.body = validation.value
-        return this.executeHandler(entry, ctx, finalize)
+        if (result instanceof Promise) {
+          return result.then(
+            (value) => runAfter(value),
+            (err) => logError(err, ctx),
+          )
+        }
+        return runAfter(result)
       }
-      if (kind === "query" && entry.schema?.query) {
-        const validation = entry.schema.query["~standard"].validate(recovery)
-        if (validation instanceof Promise) {
-          return validation.then(
+      const runBefore = (): MaybePromise<Response> => {
+        let early: unknown
+        try {
+          early = before(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (early instanceof Promise) {
+          return early.then(
             (settled) => {
-              if (settled.issues !== undefined)
-                return wrapResponse(plainValidationError(settled.issues))
-              ctx.query = settled.value
-              return this.executeHandler(entry, ctx, finalize, wrapResponse)
+              if (settled === undefined) return runHandler()
+              return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
             },
-            (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+            (err) => logError(err, ctx),
           )
         }
-        if (validation.issues !== undefined)
-          return wrapResponse(plainValidationError(validation.issues))
-        ctx.query = validation.value
-        return this.executeHandler(entry, ctx, finalize, wrapResponse)
+        if (early === undefined) return runHandler()
+        return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders)
       }
-    }
-    return wrapResponse(plainValidationError(originalIssues))
-  }
-
-  private applyBodyValidation<T>(
-    entry: RouteEntry,
-    result: StandardResult<unknown>,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    if (result.issues !== undefined) {
-      const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
-      if (hook) {
-        const recovery = hook(result.issues, ctx as unknown as Context, "body")
-        if (recovery instanceof Promise) {
-          return recovery.then((rec) =>
-            this.handleValidationErrorRecovery(
-              entry,
-              rec,
-              ctx,
-              finalize,
-              wrapResponse,
-              result.issues!,
-              "body",
-            ),
+      const runDerive = (): MaybePromise<Response> => {
+        let derived: unknown
+        try {
+          derived = derive(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (derived instanceof Promise) {
+          return derived.then(
+            (settled) => {
+              if (isResponseResult(settled) || settled instanceof Response) {
+                return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+              }
+              Object.assign(ctx, settled as object)
+              return runBefore()
+            },
+            (err) => logError(err, ctx),
           )
         }
-        return this.handleValidationErrorRecovery(
-          entry,
-          recovery,
-          ctx,
-          finalize,
-          wrapResponse,
-          result.issues,
-          "body",
-        )
+        if (isResponseResult(derived) || derived instanceof Response) {
+          return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders)
+        }
+        Object.assign(ctx, derived as object)
+        return runBefore()
+      }
+      if (querySchema === undefined) return runDerive()
+      let validation: MaybePromise<StandardResult<unknown>>
+      try {
+        validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]))
+      } catch (err) {
+        return logError(err, ctx)
       }
-      return wrapResponse(plainValidationError(result.issues))
-    }
-    ctx.body = result.value
-    return this.executeHandler(entry, ctx, finalize)
-  }
-
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runQueryOnly<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    try {
-      // Call the validator directly for the raw StandardResult (read `.issues`/`.value`) - skip
-      // `validateStandard`'s per-request wrapper-object allocation, mirroring the bodyOnly path.
-      const validation = entry.schema!.query!["~standard"].validate(
-        queryObjectOf(ctx[CONTEXT_SEARCH]),
-      )
       if (validation instanceof Promise) {
         return validation.then(
           (settled) => {
-            try {
-              const outcome = this.applyQueryValidation(entry, settled, ctx, finalize, wrapResponse)
-              return outcome instanceof Promise
-                ? outcome.catch((err) =>
-                    this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-                  )
-                : outcome
-            } catch (err) {
-              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-            }
+            if (settled.issues !== undefined)
+              return this.wrapWebResponse(plainValidationError(settled.issues))
+            ctx.query = settled.value
+            return runDerive()
           },
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-        )
-      }
-      return this.applyQueryValidation(entry, validation, ctx, finalize, wrapResponse)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
-  }
-
-  /** Validate-result → set `ctx.query` → run handler. A method (not a per-request closure), the
-   * query analogue of {@link applyBodyValidation}. */
-  private applyQueryValidation<T>(
-    entry: RouteEntry,
-    result: StandardResult<unknown>,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    if (result.issues !== undefined) {
-      const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
-      if (hook) {
-        const recovery = hook(result.issues, ctx as unknown as Context, "query")
-        if (recovery instanceof Promise) {
-          return recovery.then((rec) =>
-            this.handleValidationErrorRecovery(
-              entry,
-              rec,
-              ctx,
-              finalize,
-              wrapResponse,
-              result.issues!,
-              "query",
-            ),
-          )
-        }
-        return this.handleValidationErrorRecovery(
-          entry,
-          recovery,
-          ctx,
-          finalize,
-          wrapResponse,
-          result.issues,
-          "query",
+          (err) => logError(err, ctx),
         )
       }
-      return wrapResponse(plainValidationError(result.issues))
+      if (validation.issues !== undefined)
+        return this.wrapWebResponse(plainValidationError(validation.issues))
+      ctx.query = validation.value
+      return runDerive()
     }
-    ctx.query = result.value
-    return this.executeHandler(entry, ctx, finalize, wrapResponse)
   }
 
   /**
-   * Thread the response through each global `onResponse` hook. Stays SYNCHRONOUS until a hook
-   * actually returns a Promise - an `async` version forced a promise + microtask on EVERY response
-   * of any app with an onResponse hook (cors/securityHeaders/etag/timing all use onResponse), the
-   * same ~13%/req tax the onRequest walk was de-async'd to avoid. The first async hook hands the
-   * rest to {@link continueOnResponse}.
+   * Body + lifecycle hooks fused: parse → validate → derive → before → handler → (after) in one
+   * closure, the same win `buildFusedBodyRunner` gives for the no-hooks body shape. The shape is
+   * `lifecycleHookLane` PLUS a body schema with no other validation conflicts; the lane is selected
+   * ONLY when `schema.body !== undefined && schema.query/params/headers === undefined &&
+   * schema.onValidationError === undefined && !defaultOnValidationError && !hasIdempotency &&
+   * !hasLedger && derives === 1 && beforeHandle === 1 && afterHandle <= 1 && onError === 0 &&
+   * !hasResponseContract && !hasDecorations && around === 0`. The same single `querySchema === undefined`
+   * trick used in the no-body lane lets the build path stay simple: a query + body route falls back
+   * to the generic program (this is rare in practice - validated query + validated body is usually a
+   * "search results" route with a middleware chain on top, and the generic lane is fine there).
    */
-  private applyOnResponse(response: Response, req: Request): MaybePromise<Response> {
-    const hooks = this.onResponseHooks
-    let current = response
-    for (let i = 0; i < hooks.length; i++) {
-      const next = (hooks[i] as RawOnResponse)(current, req)
-      if (next instanceof Promise) {
-        return next.then((settled) => this.continueOnResponse(settled, i + 1, req))
-      }
-      current = next
-    }
-    return current
-  }
-
-  private applyOnResponseAndFinalize(response: Response, req: Request): MaybePromise<Response> {
-    try {
-      const transformed = this.applyOnResponse(response, req)
-      return transformed instanceof Promise
-        ? transformed.then(
-            (settled) => this.completeResponseFinalization({ response: settled }, req),
-            (error) => this.failResponseFinalization(response, error, req),
+  private buildFusedBodyDeriveBeforeAfter(
+    handler: InternalHandler,
+    derive: RawDerive,
+    before: RawBeforeHandle,
+    after: RawAfterHandle | undefined,
+    bodySchema: StandardSchemaV1,
+    maxBodyBytes: number,
+  ): FusedWebRunner {
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
+      )
+    return (source, params, search, signal, budget, platform, nativeContext) => {
+      const ctx = nativeContext
+        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+        : new RequestContext(
+            source,
+            params,
+            search,
+            signal,
+            budget,
+            platform,
+            maxBodyBytes,
+            this.protoPoisoning,
           )
-        : this.completeResponseFinalization({ response: transformed }, req)
-    } catch (error) {
-      return this.failResponseFinalization(response, error, req)
-    }
-  }
-
-  private completeResponseFinalization(
-    outcome: ResponseFinalization,
-    req: Request,
-  ): MaybePromise<Response> {
-    const notified = this.notifyResponseFinalized(outcome, req)
-    return notified instanceof Promise ? notified.then(() => outcome.response) : outcome.response
-  }
-
-  private failResponseFinalization(
-    response: Response,
-    error: unknown,
-    req: Request,
-  ): Promise<never> {
-    const notified = this.notifyResponseFinalized({ response, error }, req)
-    if (notified instanceof Promise) {
-      return notified.then(() => {
-        throw error
-      })
-    }
-    // A hook failure must surface as a REJECTION even when every prior step ran synchronously:
-    // `fetch()` may now resolve without a promise, but its failure contract stays promise-shaped -
-    // a synchronous throw here would escape `Promise.resolve(app.fetch(...))` bridges and
-    // `.then()`-style callers entirely instead of reaching their rejection handling.
-    return Promise.reject(error)
-  }
-
-  /** Notify terminal observers in order while isolating both sync and async failures. */
-  private notifyResponseFinalized(outcome: ResponseFinalization, req: Request): MaybePromise<void> {
-    let pending: Promise<void> | undefined
-    for (const hook of this.onResponseFinalizedHooks) {
-      if (pending !== undefined) {
-        pending = pending.then(async () => {
+      const runHandlerValidated = (): MaybePromise<Response> => {
+        const runAfter = (result: unknown): MaybePromise<Response> => {
+          if (after === undefined) {
+            return fusedRespond(
+              result,
+              ctx,
+              this.responseBodyTag,
+              this.staticResponseHeaders,
+              this.onResponseHooks.length === 0,
+            )
+          }
+          let transformed: unknown
           try {
-            await hook(outcome, req)
-          } catch {
-            // Terminal observation must never change request behavior.
+            transformed = after(result, ctx)
+          } catch (err) {
+            return logError(err, ctx)
           }
-        })
-        continue
-      }
-      try {
-        const result = hook(outcome, req)
-        if (result instanceof Promise) pending = result.catch(() => {})
-      } catch {
-        // Terminal observation must never change request behavior.
-      }
-    }
-    return pending
-  }
-
-  /** Async tail of {@link applyOnResponse}: runs the remaining hooks once one has gone async. */
-  private async continueOnResponse(
-    response: Response,
-    nextIndex: number,
-    req: Request,
-  ): Promise<Response> {
-    let current = response
-    for (let i = nextIndex; i < this.onResponseHooks.length; i++) {
-      const next = (this.onResponseHooks[i] as RawOnResponse)(current, req)
-      current = next instanceof Promise ? await next : next
-    }
-    return current
-  }
-
-  /**
-   * Bound the response time. On timeout we abort `ctx.signal` (so cancellation-aware
-   * handlers can bail) and return 503; the in-flight work keeps running but its
-   * result is discarded - JS can't forcibly cancel a promise.
-   */
-  private async withTimeout<T>(
-    work: Promise<T>,
-    controller: AbortController,
-    onTimeout: () => T,
-    timeoutMs: number,
-  ): Promise<T> {
-    let timer: ReturnType<typeof setTimeout> | undefined
-    const timeout = new Promise<T>((resolve) => {
-      timer = setTimeout(() => {
-        controller.abort()
-        resolve(onTimeout())
-      }, timeoutMs)
-    })
-    try {
-      return await Promise.race([work, timeout])
-    } finally {
-      if (timer !== undefined) clearTimeout(timer)
-    }
-  }
-
-  /**
-   * The post-match lifecycle: validate → derive → beforeHandle → handler → afterHandle, with onError.
-   * Generic over the render: a success value goes through `finalize(result, set)` (a Web `Response`, or
-   * node-direct primitives); an early/error `Response` (validation, thrown, 500) through `wrapResponse`.
-   */
-  /** Synchronous until a validator, lifecycle hook, handler, or contract check actually returns a Promise. */
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runLifecycle<T>(
-    entry: RouteEntry,
-    source: RequestSource,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    try {
-      const headersSchema = entry.schema?.headers
-      if (headersSchema !== undefined) {
-        const validation = headersSchema["~standard"].validate(headerObjectOf(source.headers))
-        if (validation instanceof Promise) {
-          return validation.then(
-            (result) =>
-              this.runLifecycleAfterHeadersResult(
-                entry,
-                source,
-                ctx,
-                finalize,
-                wrapResponse,
-                result,
-              ),
-            (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+          if (transformed instanceof Promise) {
+            return transformed.then(
+              (value) =>
+                fusedRespond(
+                  value,
+                  ctx,
+                  this.responseBodyTag,
+                  this.staticResponseHeaders,
+                  this.onResponseHooks.length === 0,
+                ),
+              (err) => logError(err, ctx),
+            )
+          }
+          return fusedRespond(
+            transformed,
+            ctx,
+            this.responseBodyTag,
+            this.staticResponseHeaders,
+            this.onResponseHooks.length === 0,
           )
         }
-        return this.runLifecycleAfterHeadersResult(
-          entry,
-          source,
-          ctx,
-          finalize,
-          wrapResponse,
-          validation,
-        )
-      }
-      const paramsSchema = entry.schema?.params
-      if (paramsSchema !== undefined) {
-        const validation = paramsSchema["~standard"].validate(ctx.params)
-        if (validation instanceof Promise) {
-          return validation.then(
-            (result) =>
-              this.runLifecycleAfterParamsResult(
-                entry,
-                source,
-                ctx,
-                finalize,
-                wrapResponse,
-                result,
-              ),
-            (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-          )
+        const runHandler = (): MaybePromise<Response> => {
+          let result: unknown
+          try {
+            result = handler(ctx)
+          } catch (err) {
+            return logError(err, ctx)
+          }
+          if (result instanceof Promise) {
+            return result.then(
+              (value) => runAfter(value),
+              (err) => logError(err, ctx),
+            )
+          }
+          return runAfter(result)
         }
-        return this.runLifecycleAfterParamsResult(
-          entry,
-          source,
-          ctx,
-          finalize,
-          wrapResponse,
-          validation,
-        )
-      }
-      // Registration already knows whether this route has body/params/query validation. Most real
-      // read routes have no body or params schema, so skip the generic stage ladder and go straight to
-      // query validation + lifecycle hooks. The fallback below remains the complete path for routes
-      // with body/params combinations and validation recovery.
-      if (entry.schema?.body === undefined) {
-        return this.runQueryAndLifecycle(entry, ctx, finalize, wrapResponse)
-      }
-      return this.runLifecycleAfterParams(entry, source, ctx, finalize, wrapResponse, undefined)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
-  }
-
-  private runLifecycleAfterHeadersResult<T>(
-    entry: RouteEntry,
-    source: RequestSource,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-    result: StandardResult<unknown>,
-  ): MaybePromise<T> {
-    try {
-      const headersError = this.applyLifecycleValidation(entry, result, ctx, "headers")
-      if (headersError instanceof Promise) {
-        return headersError.then(
-          (error) =>
-            error === undefined
-              ? this.runLifecycleAfterHeaders(entry, source, ctx, finalize, wrapResponse)
-              : wrapResponse(error),
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-        )
+        const runBefore = (): MaybePromise<Response> => {
+          let early: unknown
+          try {
+            early = before(ctx)
+          } catch (err) {
+            return logError(err, ctx)
+          }
+          if (early instanceof Promise) {
+            return early.then(
+              (settled) => {
+                if (settled === undefined) return runHandler()
+                return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+              },
+              (err) => logError(err, ctx),
+            )
+          }
+          if (early === undefined) return runHandler()
+          return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders)
+        }
+        let derived: unknown
+        try {
+          derived = derive(ctx)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (derived instanceof Promise) {
+          return derived.then(
+            (settled) => {
+              if (isResponseResult(settled) || settled instanceof Response) {
+                return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders)
+              }
+              Object.assign(ctx, settled as object)
+              return runBefore()
+            },
+            (err) => logError(err, ctx),
+          )
+        }
+        if (isResponseResult(derived) || derived instanceof Response) {
+          return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders)
+        }
+        Object.assign(ctx, derived as object)
+        return runBefore()
       }
-      return headersError === undefined
-        ? this.runLifecycleAfterHeaders(entry, source, ctx, finalize, wrapResponse)
-        : wrapResponse(headersError)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      const onParsed = (parsed: unknown): MaybePromise<Response> => {
+        let validation: StandardResult<unknown> | Promise<StandardResult<unknown>>
+        try {
+          validation = bodySchema["~standard"].validate(parsed)
+        } catch (err) {
+          return logError(err, ctx)
+        }
+        if (validation instanceof Promise) {
+          return validation.then(
+            (settled) => {
+              if (settled.issues !== undefined)
+                return this.wrapWebResponse(plainValidationError(settled.issues))
+              ctx.body = settled.value
+              return runHandlerValidated()
+            },
+            (err) => logError(err, ctx),
+          )
+        }
+        if (validation.issues !== undefined)
+          return this.wrapWebResponse(plainValidationError(validation.issues))
+        ctx.body = validation.value
+        return runHandlerValidated()
+      }
+      return readBodyFramed(
+        source,
+        maxBodyBytes,
+        this.protoPoisoning,
+        onParsed,
+        (response) => this.wrapWebResponse(response),
+        (err) => Promise.resolve(logError(err, ctx)),
+      ) as MaybePromise<Response>
     }
   }
 
-  private runLifecycleAfterHeaders<T>(
-    entry: RouteEntry,
-    source: RequestSource,
+  private bareError<T>(
+    err: unknown,
     ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
+    finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    const paramsSchema = entry.schema?.params
-    if (paramsSchema === undefined) {
-      if (entry.schema?.body === undefined)
-        return this.runQueryAndLifecycle(entry, ctx, finalize, wrapResponse)
-      return this.runLifecycleAfterParams(entry, source, ctx, finalize, wrapResponse, undefined)
-    }
-    const validation = paramsSchema["~standard"].validate(ctx.params)
-    if (validation instanceof Promise) {
-      return validation.then(
-        (result) =>
-          this.runLifecycleAfterParamsResult(entry, source, ctx, finalize, wrapResponse, result),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
-    }
-    return this.runLifecycleAfterParamsResult(
-      entry,
-      source,
+  ): T {
+    // The thrown-value contract lives in `bare-error-lane.ts`, one source of truth for both this
+    // lane and the fused body runner. `responseSet` and the logger are injected because they reach
+    // into class state; the closure is allocated only on the throw path, never on the hot lane.
+    return renderBareError(
+      err,
       ctx,
       finalize,
       wrapResponse,
-      validation,
+      responseSet,
+      (e, c) => this.logRequestError(e, c),
+      () => this.internalErrorResponse(wrapResponse),
     )
   }
 
-  /** Registration-specialized query lifecycle: query validation (including recovery) → hooks. */
-  private runLifecycleQuery<T>(
+  /**
+   * Keep the ordinary thrown-error response independent from the caught value. Deliberate Response
+   * control flow is handled by `renderBareError`; every other throw gets this fixed public envelope.
+   */
+  private internalErrorResponse<T>(wrapResponse: (response: Response | ResponseResult) => T): T {
+    return wrapResponse(plainError(500, "internal_error"))
+  }
+
+  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
+  private runWithAround<T>(
     entry: RouteEntry,
     ctx: RawContext,
+    run: () => MaybePromise<T>,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
+    let outcome: MaybePromise<T>
     try {
-      // The execution plan only selects this runner when the route has a query schema. Keeping the
-      // non-null access here removes the per-request schema-presence branch from realistic GETs.
-      const validation = entry.schema!.query!["~standard"].validate(
-        queryObjectOf(ctx[CONTEXT_SEARCH]),
-      )
-      if (validation instanceof Promise) {
-        return validation.then(
-          (result) => {
-            try {
-              return this.runQueryAndLifecycleResult(entry, ctx, finalize, wrapResponse, result)
-            } catch (err) {
-              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-            }
-          },
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-        )
-      }
-      return this.runQueryAndLifecycleResult(entry, ctx, finalize, wrapResponse, validation)
+      outcome = this.runAround(entry.around, ctx, run)
     } catch (err) {
       return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
     }
+    return outcome instanceof Promise
+      ? outcome.catch((err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse))
+      : outcome
   }
 
-  /** Registration-specialized body lifecycle: bounded body validation (including recovery) → hooks. */
+  /** Execute the registration-compiled general stage program. */
   // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runLifecycleBody<T>(
+  private runProgram<T>(
     entry: RouteEntry,
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
-    return this.readAndValidateBody(source, entry, ctx).then(
-      (bodyError) =>
-        bodyError === undefined
-          ? this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-          : wrapResponse(bodyError),
-      (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-    )
+    return executeRouteProgram(this, entry, entry.program, source, ctx, finalize, wrapResponse)
   }
 
-  /** Registration-specialized body + query lifecycle: bounded body validation → query validation → hooks. */
-  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: invoked structurally by compiled plans (internal/route-execution.ts)
-  private runLifecycleBodyQuery<T>(
+  /** Bind a compiled validation stage to its stable schema and the existing recovery contract. */
+  // @ts-expect-error TS6133 -- invoked structurally by the general route program
+  private validateProgramStage(
     entry: RouteEntry,
+    stage: Extract<RouteProgramStage, { kind: "headers" | "params" | "body" | "query" }>,
     source: RequestSource,
     ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    return this.readAndValidateBody(source, entry, ctx).then(
-      (bodyError) =>
-        bodyError === undefined
-          ? this.runLifecycleQuery(entry, ctx, finalize, wrapResponse)
-          : wrapResponse(bodyError),
-      (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-    )
+  ): MaybePromise<Response | ResponseResult | undefined> {
+    const input =
+      stage.kind === "headers"
+        ? headerObjectOf(source.headers)
+        : stage.kind === "params"
+          ? ctx.params
+          : stage.kind === "query"
+            ? queryObjectOf(ctx[CONTEXT_SEARCH])
+            : undefined
+    if (stage.kind === "body") return this.readProgramBody(entry, source, ctx)
+    const validation = stage.schema["~standard"].validate(input)
+    return validation instanceof Promise
+      ? validation.then((result) => this.applyLifecycleValidation(entry, result, ctx, stage.kind))
+      : this.applyLifecycleValidation(entry, validation, ctx, stage.kind)
   }
 
-  /** Registration-specialized no-body lifecycle: query validation (if present) → derives/hooks. */
-  private runQueryAndLifecycle<T>(
+  /** Preserve the existing bounded body reader and its fail-closed framing/prototype checks. */
+  private readProgramBody(
     entry: RouteEntry,
+    source: RequestSource,
     ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): MaybePromise<T> {
-    const querySchema = entry.schema?.query
-    return querySchema === undefined
-      ? this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-      : this.runLifecycleQuery(entry, ctx, finalize, wrapResponse)
+  ): Promise<Response | ResponseResult | undefined> {
+    const bodySchema = entry.program.bodySchema
+    if (bodySchema === undefined) return Promise.resolve(plainError(415, "unsupported_media_type"))
+    return this.readAndValidateBody(source, entry, ctx, bodySchema, entry.program.bodyLimit)
   }
 
-  private runQueryAndLifecycleResult<T>(
+  /** Keep thrown Response/status and redacted 500 semantics in one existing error boundary. */
+  // @ts-expect-error TS6133 -- invoked structurally by the general route program
+  private handleProgramError<T>(
     entry: RouteEntry,
+    error: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
-    result: StandardResult<unknown>,
   ): MaybePromise<T> {
-    const queryError = this.applyLifecycleValidation(entry, result, ctx, "query")
-    if (queryError instanceof Promise) {
-      return queryError.then(
-        (error) =>
-          error === undefined
-            ? this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-            : wrapResponse(error),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
-    }
-    if (queryError !== undefined) return wrapResponse(queryError)
-    return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
+    return this.handleLifecycleError(entry, error, ctx, finalize, wrapResponse)
   }
 
-  private runLifecycleAfterParamsResult<T>(
+  /** Finish a successful program result through response-contract enforcement and finalization. */
+  // @ts-expect-error TS6133 -- invoked structurally by the general route program
+  private finishProgramResult<T>(
     entry: RouteEntry,
-    source: RequestSource,
     ctx: RawContext,
+    result: unknown,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
-    result: StandardResult<unknown>,
   ): MaybePromise<T> {
-    try {
-      return this.runLifecycleAfterParams(
-        entry,
-        source,
-        ctx,
-        finalize,
-        wrapResponse,
-        this.applyLifecycleValidation(entry, result, ctx, "params"),
-      )
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
+    return this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, result)
   }
 
-  private runLifecycleAfterParams<T>(
-    entry: RouteEntry,
-    source: RequestSource,
+  private runAround<T>(
+    hooks: ReadonlyArray<RawAround>,
     ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-    paramsError: MaybePromise<Response | ResponseResult | undefined>,
+    run: () => MaybePromise<T>,
   ): MaybePromise<T> {
-    if (paramsError instanceof Promise) {
-      return paramsError.then(
-        (error) =>
-          this.runLifecycleAfterParamsSettled(entry, source, ctx, finalize, wrapResponse, error),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
+    const dispatch = (index: number): MaybePromise<T> => {
+      if (index >= hooks.length) return run()
+      const hook = hooks[index]!
+      let called = false
+      return hook(ctx, () => {
+        if (called) throw new Error("around next() called multiple times")
+        called = true
+        return dispatch(index + 1)
+      })
     }
-    return this.runLifecycleAfterParamsSettled(
-      entry,
-      source,
-      ctx,
-      finalize,
-      wrapResponse,
-      paramsError,
-    )
+    return dispatch(0)
   }
 
-  private runLifecycleAfterParamsSettled<T>(
+  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
+  private runBodyOnly<T>(
     entry: RouteEntry,
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
-    paramsError: Response | ResponseResult | undefined,
-  ): MaybePromise<T> {
-    if (paramsError !== undefined) return wrapResponse(paramsError)
-    if (entry.schema?.body !== undefined) {
-      return this.readAndValidateBody(source, entry, ctx).then(
-        (bodyError) => this.runLifecycleAfterBody(entry, ctx, finalize, wrapResponse, bodyError),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
-    }
-    return this.runLifecycleAfterBody(entry, ctx, finalize, wrapResponse, undefined)
-  }
-
-  private runLifecycleAfterBody<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-    bodyError: Response | ResponseResult | undefined,
-  ): MaybePromise<T> {
-    if (bodyError !== undefined) return wrapResponse(bodyError)
-    const querySchema = entry.schema?.query
-    if (querySchema === undefined) return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
-    const validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]))
-    if (validation instanceof Promise) {
-      return validation.then(
-        (result) => this.runLifecycleAfterQueryResult(entry, ctx, finalize, wrapResponse, result),
-        (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
-      )
-    }
-    return this.runLifecycleAfterQueryResult(entry, ctx, finalize, wrapResponse, validation)
+  ): Promise<T> {
+    return readBodyFramed(
+      source,
+      entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+      this.protoPoisoning,
+      (parsed) => this.finishBodyOnly(entry, parsed, ctx, finalize, wrapResponse),
+      wrapResponse,
+      (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+    )
   }
 
-  private runLifecycleAfterQueryResult<T>(
+  /** Validate + run the handler for the bodyOnly path - shared by the inline fast path and the
+   * streaming fallback. A method (not per-request closures) so the hot path allocates nothing
+   * beyond the one `.then` continuation. */
+  private finishBodyOnly<T>(
     entry: RouteEntry,
+    parsed: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
-    result: StandardResult<unknown>,
   ): MaybePromise<T> {
     try {
-      const queryError = this.applyLifecycleValidation(entry, result, ctx, "query")
-      if (queryError instanceof Promise) {
-        return queryError.then(
-          (error) => this.runLifecycleAfterQuery(entry, ctx, finalize, wrapResponse, error),
+      const bodySchema = entry.schema!.body!
+      const validation = bodySchema["~standard"].validate(parsed)
+      if (validation instanceof Promise) {
+        return validation.then(
+          (result) => {
+            try {
+              const outcome = this.applyBodyValidation(entry, result, ctx, finalize, wrapResponse)
+              return outcome instanceof Promise
+                ? outcome.catch((err) =>
+                    this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+                  )
+                : outcome
+            } catch (err) {
+              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+            }
+          },
           (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
         )
       }
-      return this.runLifecycleAfterQuery(entry, ctx, finalize, wrapResponse, queryError)
+      const outcome = this.applyBodyValidation(entry, validation, ctx, finalize, wrapResponse)
+      return outcome instanceof Promise
+        ? outcome.catch((err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse))
+        : outcome
     } catch (err) {
       return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
     }
   }
 
-  private runLifecycleAfterQuery<T>(
+  private executeHandler<T>(
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-    queryError: Response | ResponseResult | undefined,
+    wrapResponse?: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
-    if (queryError !== undefined) return wrapResponse(queryError)
-    return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
+    if (entry.hasDecorations) Object.assign(ctx, entry.decorations)
+    const handlerOutput = entry.handler(ctx)
+    if (handlerOutput instanceof Promise) {
+      return handlerOutput.then(
+        (value) => finalize(value, responseSet(ctx)),
+        (err) => {
+          if (wrapResponse) {
+            return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+          }
+          throw err
+        },
+      )
+    }
+    return finalize(handlerOutput, responseSet(ctx))
   }
 
-  private runLifecycleHooks<T>(
+  private handleValidationErrorRecovery<T>(
     entry: RouteEntry,
+    recovery: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
+    originalIssues: ReadonlyArray<StandardIssue>,
+    kind: "body" | "query",
   ): MaybePromise<T> {
-    if (entry.lifecycleHookLane === "derive-before") {
-      return this.runLifecycleDeriveBefore(entry, ctx, finalize, wrapResponse)
-    }
-    try {
-      if (entry.hasDecorations) Object.assign(ctx, entry.decorations)
-      for (let i = 0; i < entry.derives.length; i++) {
-        const extension = entry.derives[i]!(ctx)
-        if (extension instanceof Promise) {
-          return this.continueLifecycleAfterDerive(entry, ctx, finalize, wrapResponse, i, extension)
+    if (recovery !== undefined) {
+      if (recovery instanceof Response) {
+        return wrapResponse(recovery)
+      }
+      if (kind === "body" && entry.schema?.body) {
+        const validation = entry.schema.body["~standard"].validate(recovery)
+        if (validation instanceof Promise) {
+          return validation.then((settled) => {
+            if (settled.issues !== undefined)
+              return wrapResponse(plainValidationError(settled.issues))
+            ctx.body = settled.value
+            return this.executeHandler(entry, ctx, finalize)
+          })
         }
-        if (isDeriveEarlyExit(extension)) return finalize(extension, responseSet(ctx))
-        Object.assign(ctx, extension)
+        if (validation.issues !== undefined)
+          return wrapResponse(plainValidationError(validation.issues))
+        ctx.body = validation.value
+        return this.executeHandler(entry, ctx, finalize)
       }
-      for (let i = 0; i < entry.beforeHandle.length; i++) {
-        const outcome = entry.beforeHandle[i]!(ctx)
-        if (outcome instanceof Promise) {
-          return this.continueLifecycleAfterBefore(entry, ctx, finalize, wrapResponse, i, outcome)
+      if (kind === "query" && entry.schema?.query) {
+        const validation = entry.schema.query["~standard"].validate(recovery)
+        if (validation instanceof Promise) {
+          return validation.then(
+            (settled) => {
+              if (settled.issues !== undefined)
+                return wrapResponse(plainValidationError(settled.issues))
+              ctx.query = settled.value
+              return this.executeHandler(entry, ctx, finalize, wrapResponse)
+            },
+            (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+          )
         }
-        if (outcome !== undefined) return finalize(outcome, responseSet(ctx))
+        if (validation.issues !== undefined)
+          return wrapResponse(plainValidationError(validation.issues))
+        ctx.query = validation.value
+        return this.executeHandler(entry, ctx, finalize, wrapResponse)
       }
-      const result = entry.handler(ctx)
-      if (result instanceof Promise) {
-        return result.then(
-          (value) => this.finishLifecycleResult(entry, ctx, finalize, wrapResponse, value),
-          (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+    }
+    return wrapResponse(plainValidationError(originalIssues))
+  }
+
+  private applyBodyValidation<T>(
+    entry: RouteEntry,
+    result: StandardResult<unknown>,
+    ctx: RawContext,
+    finalize: (result: unknown, set: CtxSet) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): MaybePromise<T> {
+    if (result.issues !== undefined) {
+      const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
+      if (hook) {
+        const recovery = hook(result.issues, ctx as unknown as Context, "body")
+        if (recovery instanceof Promise) {
+          return recovery.then((rec) =>
+            this.handleValidationErrorRecovery(
+              entry,
+              rec,
+              ctx,
+              finalize,
+              wrapResponse,
+              result.issues!,
+              "body",
+            ),
+          )
+        }
+        return this.handleValidationErrorRecovery(
+          entry,
+          recovery,
+          ctx,
+          finalize,
+          wrapResponse,
+          result.issues,
+          "body",
         )
       }
-      return this.finishLifecycleResult(entry, ctx, finalize, wrapResponse, result)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      return wrapResponse(plainValidationError(result.issues))
     }
+    ctx.body = result.value
+    return this.executeHandler(entry, ctx, finalize)
   }
 
-  /** Registration-specialized derive → before → handler lifecycle. */
-  private runLifecycleDeriveBefore<T>(
+  // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
+  private runQueryOnly<T>(
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     try {
-      const extension = entry.derives[0]!(ctx)
-      if (extension instanceof Promise) {
-        return this.continueLifecycleAfterDerive(entry, ctx, finalize, wrapResponse, 0, extension)
-      }
-      if (isDeriveEarlyExit(extension)) return finalize(extension, responseSet(ctx))
-      Object.assign(ctx, extension)
-
-      const outcome = entry.beforeHandle[0]!(ctx)
-      if (outcome instanceof Promise) {
-        return this.continueLifecycleAfterBefore(entry, ctx, finalize, wrapResponse, 0, outcome)
-      }
-      if (outcome !== undefined)
-        return this.finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, outcome)
-
-      const result = entry.handler(ctx)
-      if (result instanceof Promise) {
-        return result.then(
-          (value) => this.finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, value),
+      // Call the validator directly for the raw StandardResult (read `.issues`/`.value`) - skip
+      // `validateStandard`'s per-request wrapper-object allocation, mirroring the bodyOnly path.
+      const validation = entry.schema!.query!["~standard"].validate(
+        queryObjectOf(ctx[CONTEXT_SEARCH]),
+      )
+      if (validation instanceof Promise) {
+        return validation.then(
+          (settled) => {
+            try {
+              const outcome = this.applyQueryValidation(entry, settled, ctx, finalize, wrapResponse)
+              return outcome instanceof Promise
+                ? outcome.catch((err) =>
+                    this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+                  )
+                : outcome
+            } catch (err) {
+              return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+            }
+          },
           (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
         )
       }
-      return this.finishSimpleLifecycleResult(entry, ctx, finalize, wrapResponse, result)
+      return this.applyQueryValidation(entry, validation, ctx, finalize, wrapResponse)
     } catch (err) {
       return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
     }
   }
 
-  /** Finalize the specialized lane without rechecking its registration-proven invariants. */
-  private finishSimpleLifecycleResult<T>(
+  /** Validate-result → set `ctx.query` → run handler. A method (not a per-request closure), the
+   * query analogue of {@link applyBodyValidation}. */
+  private applyQueryValidation<T>(
     entry: RouteEntry,
+    result: StandardResult<unknown>,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
-    result: unknown,
   ): MaybePromise<T> {
-    try {
-      return finalize(result, responseSet(ctx))
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+    if (result.issues !== undefined) {
+      const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
+      if (hook) {
+        const recovery = hook(result.issues, ctx as unknown as Context, "query")
+        if (recovery instanceof Promise) {
+          return recovery.then((rec) =>
+            this.handleValidationErrorRecovery(
+              entry,
+              rec,
+              ctx,
+              finalize,
+              wrapResponse,
+              result.issues!,
+              "query",
+            ),
+          )
+        }
+        return this.handleValidationErrorRecovery(
+          entry,
+          recovery,
+          ctx,
+          finalize,
+          wrapResponse,
+          result.issues,
+          "query",
+        )
+      }
+      return wrapResponse(plainValidationError(result.issues))
     }
+    ctx.query = result.value
+    return this.executeHandler(entry, ctx, finalize, wrapResponse)
   }
 
-  private async continueLifecycleAfterDerive<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-    firstIndex: number,
-    first: Promise<unknown>,
-  ): Promise<T> {
-    try {
-      const settled = await first
-      if (isDeriveEarlyExit(settled)) return finalize(settled, responseSet(ctx))
-      Object.assign(ctx, settled)
-      for (let i = firstIndex + 1; i < entry.derives.length; i++) {
-        const raw = entry.derives[i]!(ctx)
-        const extension = raw instanceof Promise ? await raw : raw
-        if (isDeriveEarlyExit(extension)) return finalize(extension, responseSet(ctx))
-        Object.assign(ctx, extension)
+  /**
+   * Thread the response through each global `onResponse` hook. Stays SYNCHRONOUS until a hook
+   * actually returns a Promise - an `async` version forced a promise + microtask on EVERY response
+   * of any app with an onResponse hook (cors/securityHeaders/etag/timing all use onResponse), the
+   * same ~13%/req tax the onRequest walk was de-async'd to avoid. The first async hook hands the
+   * rest to {@link continueOnResponse}.
+   */
+  private applyOnResponse(response: Response, req: Request): MaybePromise<Response> {
+    const hooks = this.onResponseHooks
+    let current = response
+    for (let i = 0; i < hooks.length; i++) {
+      const next = (hooks[i] as RawOnResponse)(current, req)
+      if (next instanceof Promise) {
+        return next.then((settled) => this.continueOnResponse(settled, i + 1, req))
       }
-      return await this.runLifecycleHooksAsync(entry, ctx, finalize, wrapResponse)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      current = next
     }
+    return current
   }
 
-  private async runLifecycleHooksAsync<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): Promise<T> {
+  private applyOnResponseAndFinalize(response: Response, req: Request): MaybePromise<Response> {
     try {
-      // Indexed, not `for...of`. An array iterator declared inside an async function stays live
-      // across the `await` below, so neither engine can sink it - unlike the sync lanes above,
-      // where V8 elides it. Measured cost of the iterator form: 43ns per hook on Bun, ~9ns on
-      // Node, on a chain whose hooks return synchronously (the common shape).
-      for (let i = 0; i < entry.beforeHandle.length; i++) {
-        const outcome = entry.beforeHandle[i]!(ctx)
-        const early = outcome instanceof Promise ? await outcome : outcome
-        if (early !== undefined) return finalize(early, responseSet(ctx))
-      }
-      return await this.runLifecycleHandlerAsync(entry, ctx, finalize, wrapResponse)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      const transformed = this.applyOnResponse(response, req)
+      return transformed instanceof Promise
+        ? transformed.then(
+            (settled) => this.completeResponseFinalization({ response: settled }, req),
+            (error) => this.failResponseFinalization(response, error, req),
+          )
+        : this.completeResponseFinalization({ response: transformed }, req)
+    } catch (error) {
+      return this.failResponseFinalization(response, error, req)
     }
   }
 
-  private async continueLifecycleAfterBefore<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-    firstIndex: number,
-    first: Promise<unknown>,
-  ): Promise<T> {
-    try {
-      const firstOutcome = await first
-      if (firstOutcome !== undefined) return finalize(firstOutcome, responseSet(ctx))
-      for (let i = firstIndex + 1; i < entry.beforeHandle.length; i++) {
-        const outcome = entry.beforeHandle[i]!(ctx)
-        const early = outcome instanceof Promise ? await outcome : outcome
-        if (early !== undefined) return finalize(early, responseSet(ctx))
-      }
-      return await this.runLifecycleHandlerAsync(entry, ctx, finalize, wrapResponse)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
-    }
+  private completeResponseFinalization(
+    outcome: ResponseFinalization,
+    req: Request,
+  ): MaybePromise<Response> {
+    const notified = this.notifyResponseFinalized(outcome, req)
+    return notified instanceof Promise ? notified.then(() => outcome.response) : outcome.response
   }
 
-  private async runLifecycleHandlerAsync<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): Promise<T> {
-    try {
-      const output = entry.handler(ctx)
-      const result = output instanceof Promise ? await output : output
-      return await this.finishLifecycleResult(entry, ctx, finalize, wrapResponse, result)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+  private failResponseFinalization(
+    response: Response,
+    error: unknown,
+    req: Request,
+  ): Promise<never> {
+    const notified = this.notifyResponseFinalized({ response, error }, req)
+    if (notified instanceof Promise) {
+      return notified.then(() => {
+        throw error
+      })
     }
+    // A hook failure must surface as a REJECTION even when every prior step ran synchronously:
+    // `fetch()` may now resolve without a promise, but its failure contract stays promise-shaped -
+    // a synchronous throw here would escape `Promise.resolve(app.fetch(...))` bridges and
+    // `.then()`-style callers entirely instead of reaching their rejection handling.
+    return Promise.reject(error)
   }
 
-  private finishLifecycleResult<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-    initial: unknown,
-  ): MaybePromise<T> {
-    try {
-      let result = initial
-      for (let i = 0; i < entry.afterHandle.length; i++) {
-        const transformed = entry.afterHandle[i]!(result, ctx)
-        if (transformed instanceof Promise) {
-          return this.continueLifecycleAfterHandle(
-            entry,
-            ctx,
-            finalize,
-            wrapResponse,
-            i,
-            transformed,
-          )
-        }
-        result = transformed
+  /** Notify terminal observers in order while isolating both sync and async failures. */
+  private notifyResponseFinalized(outcome: ResponseFinalization, req: Request): MaybePromise<void> {
+    let pending: Promise<void> | undefined
+    for (const hook of this.onResponseFinalizedHooks) {
+      if (pending !== undefined) {
+        pending = pending.then(async () => {
+          try {
+            await hook(outcome, req)
+          } catch {
+            // Terminal observation must never change request behavior.
+          }
+        })
+        continue
+      }
+      try {
+        const result = hook(outcome, req)
+        if (result instanceof Promise) pending = result.catch(() => {})
+      } catch {
+        // Terminal observation must never change request behavior.
       }
-      return this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, result)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
     }
+    return pending
   }
 
-  private async continueLifecycleAfterHandle<T>(
-    entry: RouteEntry,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-    firstIndex: number,
-    first: Promise<unknown>,
+  /** Async tail of {@link applyOnResponse}: runs the remaining hooks once one has gone async. */
+  private async continueOnResponse(
+    response: Response,
+    nextIndex: number,
+    req: Request,
+  ): Promise<Response> {
+    let current = response
+    for (let i = nextIndex; i < this.onResponseHooks.length; i++) {
+      const next = (this.onResponseHooks[i] as RawOnResponse)(current, req)
+      current = next instanceof Promise ? await next : next
+    }
+    return current
+  }
+
+  /**
+   * Bound the response time. On timeout we abort `ctx.signal` (so cancellation-aware
+   * handlers can bail) and return 503; the in-flight work keeps running but its
+   * result is discarded - JS can't forcibly cancel a promise.
+   */
+  private async withTimeout<T>(
+    work: Promise<T>,
+    controller: AbortController,
+    onTimeout: () => T,
+    timeoutMs: number,
   ): Promise<T> {
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const timeout = new Promise<T>((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort()
+        resolve(onTimeout())
+      }, timeoutMs)
+    })
     try {
-      let result = await first
-      for (let i = firstIndex + 1; i < entry.afterHandle.length; i++) {
-        const transformed = entry.afterHandle[i]!(result, ctx)
-        result = transformed instanceof Promise ? await transformed : transformed
-      }
-      return await this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, result)
-    } catch (err) {
-      return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse)
+      return await Promise.race([work, timeout])
+    } finally {
+      if (timer !== undefined) clearTimeout(timer)
     }
   }
-
   private finishLifecycleContract<T>(
     entry: RouteEntry,
     ctx: RawContext,
@@ -4808,35 +4717,37 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return wrapResponse(plainError(500, "internal_error"))
   }
 
-  /** Log an unhandled request error to the (redacting) logger - shared by {@link runLifecycle} and the
+  /** Log an unhandled request error to the (redacting) logger - shared by the compiled route program and the
    * bare fast path ({@link bareError}) so both record the same fields. Never throws; never leaks. */
   private logRequestError(err: unknown, ctx: RawContext): void {
     emitRequestErrorLog(this.logger, this.errorLogDetail, err, ctx)
   }
 
-  private async readAndValidateBody(
+  private readAndValidateBody(
     req: RequestSource,
     entry: RouteEntry,
     ctx: RawContext,
+    bodySchema: StandardSchemaV1 = entry.schema?.body as StandardSchemaV1,
+    bodyLimit: number | undefined = entry.bodyLimit,
   ): Promise<Response | ResponseResult | undefined> {
-    const contentType = headerOf(req, "content-type") ?? ""
-    let parsed: unknown
-    if (contentType === "application/json" || contentType.includes("application/json")) {
-      const json = await this.readBoundedJson(req, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-      if (isResponseResult(json)) return json
-      parsed = json
-    } else if (isUrlEncodedForm(contentType)) {
-      const form = await readBoundedForm(req, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-      if (isResponseResult(form)) return form
-      parsed = form
-    } else {
-      // multipart/form-data (file uploads) stays 415 on the schema path by design - files don't
-      // fit a value schema; use a schema-less route + @nifrajs/uploads helpers for those.
-      return plainError(415, "unsupported_media_type")
+    // Keep the generic lifecycle body stage on the same framed parser/continuation as the body-only
+    // lane. This avoids an async wrapper that first awaits parsing and then starts validation in a
+    // second continuation, while retaining the exact bounded-read, content-type, and poisoning
+    // contracts shared by every body route.
+    const validate = (parsed: unknown): MaybePromise<Response | ResponseResult | undefined> => {
+      const validation = bodySchema["~standard"].validate(parsed)
+      return validation instanceof Promise
+        ? validation.then((result) => this.applyLifecycleValidation(entry, result, ctx, "body"))
+        : this.applyLifecycleValidation(entry, validation, ctx, "body")
     }
-    const validation = entry.schema!.body!["~standard"].validate(parsed)
-    const result = validation instanceof Promise ? await validation : validation
-    return this.applyLifecycleValidation(entry, result, ctx, "body")
+    return readBodyFramed(
+      req,
+      bodyLimit ?? UNLIMITED_BODY_BYTES,
+      this.protoPoisoning,
+      validate,
+      (response) => response,
+      (error) => Promise.reject(error),
+    )
   }
 
   /** Apply validation and its recovery hook on the generic lifecycle lane. Recovery is completed
@@ -4898,36 +4809,6 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return undefined
   }
 
-  /**
-   * Read + parse the JSON body, capped at `maxBodyBytes` and screened by the server's
-   * `protoPoisoning` policy. Rejects a `Content-Length` over the cap *before* buffering,
-   * re-checks what was actually delivered after the read, and aborts a chunked or
-   * length-less body mid-stream once the running byte count exceeds the cap - so a lying
-   * or absent length can't force us to buffer an oversized payload.
-   */
-  private readBoundedJson(
-    req: RequestSource,
-    maxBodyBytes?: number,
-  ): Promise<unknown | ResponseResult>
-  private readBoundedJson<T>(
-    req: RequestSource,
-    maxBodyBytes: number,
-    onResult: (parsed: unknown | ResponseResult) => T | Promise<T>,
-    onError: (error: unknown) => T | Promise<T>,
-  ): Promise<T>
-  private readBoundedJson<T>(
-    req: RequestSource,
-    maxBodyBytes = this.maxBodyBytes,
-    onResult?: (parsed: unknown | ResponseResult) => T | Promise<T>,
-    onError?: (error: unknown) => T | Promise<T>,
-  ): Promise<unknown | ResponseResult | T> {
-    // Not `async`: this is a pass-through, and wrapping the lane's own promise in a coroutine
-    // frame costs an extra microtask hop on every JSON body.
-    return onResult === undefined
-      ? readBoundedJsonSource(req, maxBodyBytes, this.protoPoisoning)
-      : readBoundedJsonSource(req, maxBodyBytes, this.protoPoisoning, onResult, onError!)
-  }
-
   /** Adapt one route's compiled execution plan to Bun's already-matched request shape. Route
    * semantics remain in the plan; this closure only supplies native params and deadline fallback. */
   private compileBunNativeHandler(
@@ -5115,10 +4996,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     // matched route's handler, set by `server.upgrade`.
     // With WS routes, the dispatcher comes from the installed `.use(websocket())` runtime - non-null
     // because wsRouteCount > 0 means ws() ran, and ws() requires the runtime at registration.
+    // Native pub/sub when the app has WS routes and none validate outbound frames: `ws.subscribe` and
+    // `app.publish` go through Bun's own (uWebSockets) broadcast instead of the JS registry loop.
+    const nativePubsub = this.wsRouteCount > 0 && !this.wsHasValidatedSend
     const wsHandlers =
       this.wsRouteCount === 0
         ? undefined
-        : (this.wsRuntime as WsRuntime).bunHandlers(this.topics as TopicRegistry)
+        : (this.wsRuntime as WsRuntime).bunHandlers(this.topics as TopicRegistry, nativePubsub)
     const reusePort = options?.reusePort === true
     // Spread rather than pass `hostname: undefined` - Bun treats an explicit undefined as a value
     // on some option paths, and omitting is what selects its 0.0.0.0 default.
@@ -5156,6 +5040,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
           },
         })) as unknown as RunningServer
     this.bunServer = running
+    // Bind `app.publish` to Bun's native broadcast now that the server handle exists. Guarded on the
+    // method's presence so a runtime whose handle lacks it simply keeps the registry path.
+    if (nativePubsub && typeof running.publish === "function") {
+      const native = running.publish.bind(running)
+      this.nativePublish = (topic, data) => {
+        native(topic, data)
+      }
+    }
     this.sealed = true
     if (this.gracefulSignals) this.installSignalHandlers()
     return running