@nifrajs/core 4.0.2 → 5.1.0

package/dist/server/server.js

@@ -1,9 +1,10 @@
 import { admitDeadline, createRequestBudget, createUnboundedRequestBudget, NIFRA_DEADLINE_HEADER, } from "../budget.js";
 import { FrameworkError, RouteConfigError } from "../errors.js";
 import { DEFAULT_CAPABILITY_INTERCEPTOR_TIMEOUT_MS, } from "../internal/capability-runtime.js";
+import { adoptStaticTags, enterPlugin, leavePlugin, tagAdoption, tagHook, tagScoped, tagStatic, } from "../internal/hook-origins.js";
 import { assuranceDeclarationsOf, assuranceEvidenceFor, } from "../internal/route-assurance.js";
 import { RouteCatalog } from "../internal/route-catalog.js";
-import { compileRouteOptions } from "../internal/route-compiler.js";
+import { adoptRouteRuntimes, compileRouteOptions } from "../internal/route-compiler.js";
 import { compileRouteExecutionPlan, } from "../internal/route-execution.js";
 import { compileRouteProgram, executeRouteProgram } from "../internal/route-program.js";
 import { isSameOriginRequest } from "../internal/same-origin.js";
@@ -21,12 +22,12 @@ import { queryObjectOf, searchOf } from "./query.js";
 import { PLATFORM_PEER, RequestContext, readBodyFramed, } from "./request-context.js";
 import { recordRequestReplacement } from "./request-lineage.js";
 import { hasDotSegment, resolveDotSegments } from "./request-target.js";
-import { applyStaticResponseHeaders, buildStaticResponseHeaders, fusedRespond, fusedRespondNoSet, toResponse, } from "./respond.js";
-import { CONTEXT_SEARCH, CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, getNeverAbortSignal, getUnboundedRequestBudget, headerOf, isResponseResult, requestOf, } from "./runtime-core.js";
+import { applyStaticResponseHeaders, buildStaticResponseHeaders, fusedRespond, fusedRespondNoSet, toResponse, writableResponse, } from "./respond.js";
+import { CONTEXT_REQUEST, CONTEXT_SEARCH, CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, getNeverAbortSignal, getUnboundedRequestBudget, headerOf, isResponseResult, requestOf, } from "./runtime-core.js";
 import { normalizeStaticResponseHeaders } from "./static-headers.js";
 import { plainValidationError } from "./validation.js";
 import { NIFRA_BACKEND_WS_RUNTIME } from "../mount.js";
-import { GET_WS_RUNTIME, INSTALL_EFFECT_LEDGER, INSTALL_IDEMPOTENCY, INSTALL_MCP, INSTALL_NODE_DIRECT, INSTALL_NOT_FOUND, INSTALL_RESPONSE_CONTRACT, INSTALL_RESPONSE_OBSERVER, INSTALL_SSE, INSTALL_WS, NODE_NATIVE_MOUNT, RESOLVE_NODE_MOUNT, } from "./install.js";
+import { GET_WS_RUNTIME, INSTALL_EFFECT_LEDGER, INSTALL_IDEMPOTENCY, INSTALL_MCP, INSTALL_NODE_DIRECT, INSTALL_NOT_FOUND, INSTALL_RESPONSE_CONTRACT, INSTALL_RESPONSE_OBSERVER, INSTALL_SSE, INSTALL_WS, NODE_NATIVE_MOUNT, REPORT_ERROR, RESOLVE_NODE_MOUNT, } from "./install.js";
 import { jsonLogger } from "./logger.js";
 // CORS uses this marker to say its request hook only handles OPTIONS preflight. Bun can keep
 // ordinary registered routes on its native table and send unmatched OPTIONS requests through the
@@ -214,11 +215,16 @@ const underPrefix = (prefix) => {
     };
 };
 /** A merged server's hook scope: exactly the routes MERGED, snapshotted into a dedicated matcher so
- * the guard never reflects whatever the source's own catalog grows into afterwards. */
+ * the guard never reflects whatever the source's own catalog grows into afterwards. An `OPTIONS`
+ * request to a path they serve is in scope too: a CORS preflight names the path, not a route, and
+ * the group's `cors()` is the only hook that can answer it. */
 const servedBy = (routes) => {
     const scope = new RouteCatalog();
     scope.addBatch(routes);
-    return (req) => scope.find(req.method, pathnameOf(req.url)).found;
+    return (req) => {
+        const match = scope.find(req.method, pathnameOf(req.url));
+        return match.found || (req.method === "OPTIONS" && match.reason === "method-not-allowed");
+    };
 };
 /** Gate adopted hooks to `inScope` (`undefined`: adopt them unchanged). The request is a request
  * hook's first argument (`reqAt` 0) and every response-side hook's second; out of scope a hook
@@ -305,30 +311,67 @@ const captureCallerSite = () => {
     return undefined;
 };
 const hookAudit = /* @__PURE__ */ new WeakMap();
+/** Whether `from` reaches `target` through mounts that keep the path and take a request under `path`.
+ * Module-level, not a `Server` method, so a production bundle drops it with its dev-only caller. */
+function mountLeadsBack(from, target, path, mountsOf, seen) {
+    if (from === target)
+        return true;
+    if (!(from instanceof Server) || seen.has(from))
+        return false;
+    seen.add(from);
+    const under = (prefix) => (prefix === "/" ? "/" : `${prefix}/`);
+    return mountsOf(from).some((mount) => !mount.stripPrefix &&
+        (under(path).startsWith(under(mount.path)) || under(mount.path).startsWith(under(path))) &&
+        mountLeadsBack(mount.app, target, path, mountsOf, seen));
+}
+/** Set by `@nifrajs/web`'s `createWebApp` on its app once the page routes are declared. */
+const PAGES_DECLARED = /* @__PURE__ */ Symbol.for("nifra.web.pagesDeclared");
 /** Start tracking one server's order-scoped hook pushes (once, from the constructor). */
 const beginHookAudit = (key, policy, hasCustomLogger) => {
     hookAudit.set(key, { policy, hasCustomLogger, sites: [], checked: false });
 };
 /** Record one order-scoped hook push: the route count at that moment (so `routesAtPush === total` at
- * seal means no route was declared after it) and the caller's frame. */
+ * seal means no route was declared after it) and the caller's frame. Hooks a WebSocket handshake runs
+ * count sockets as routes; `around` and `afterHandle` wrap a response, so they count HTTP routes only. */
 const recordScopedHook = (key, routesAtPush, kind) => {
+    // Not a dead hook when routes follow it, but every page already copied its chain without it.
+    if (PAGES_DECLARED in key) {
+        const site = captureCallerSite();
+        throw new FrameworkError("HOOK_AFTER_PAGES", `${kind}()${site === undefined ? "" : ` at ${site}`} was added after createWebApp declared the page routes, so no page runs it: each route keeps the order-scoped hooks that existed when it was declared. Apply it in createWebApp({ use: (app) => ... }) to cover the pages, or inside app.group(prefix, ...) to scope it to the routes declared there.`);
+    }
     const state = hookAudit.get(key);
     if (state === undefined || state.policy === "off")
         return;
     state.sites.push({ kind, routesAtPush, site: captureCallerSite() });
 };
+/** Hook provenance for an adoption (dev only, see `internal/hook-origins.ts`): which scope each
+ * wrapper just appended to a hook list gates its hook by. `pairs` holds each source list with the target list it
+ * was appended to, read right after the append so the wrappers are the target list's tail. */
+const tagAdopted = (target, source, prefix, routes, pairs) => {
+    tagAdoption(target, source, prefix);
+    const scope = prefix !== undefined
+        ? { prefix }
+        : { routes: routes.map((route) => ({ method: route.method, path: route.path })) };
+    for (const [originals, appended] of pairs) {
+        if (originals.length > 0)
+            tagScoped(originals, appended.slice(-originals.length), scope);
+    }
+};
 /** Run the deadness check exactly once. A hook whose recorded route count equals the final route count
  * had no route declared after it - unambiguously dead, since the scoping feature (a hook that covers
  * only later routes) always leaves at least one such route. Zero-route apps are exempt (different
  * mistake, and the warning would be noise). */
-const sealHookAudit = (key, total, logger) => {
+const sealHookAudit = (key, total, sockets, logger) => {
     const state = hookAudit.get(key);
     if (state === undefined || state.checked)
         return;
     state.checked = true;
-    if (state.policy === "off" || total === 0)
+    if (state.policy === "off" || total + sockets === 0)
         return;
-    const dead = state.sites.filter((hook) => hook.routesAtPush === total);
+    const dead = state.sites.filter((hook) => hook.routesAtPush ===
+        (hook.kind === "around" || hook.kind === "aroundCapability" || hook.kind === "afterHandle"
+            ? total
+            : total + sockets));
     if (dead.length === 0)
         return;
     const detail = dead.map((hook) => `  ${hook.kind}()  at ${hook.site ?? "<unknown>"}`).join("\n");
@@ -355,7 +398,9 @@ export class Server {
     catalog;
     /** WebSocket routes, matched separately at upgrade time (a GET + `Upgrade: websocket`). */
     wsRouter;
-    wsRouteCount;
+    /** Each socket path, its declared capabilities, the evidence declarations its handshake captured
+     * and the chain it runs; reflection reads it. */
+    wsRoutes;
     /** `wsChanges` when `wsMountsLive` was last worked out; -1 until then. */
     wsMountsCheckedAt = -1;
     /** Whether an app mounted here takes WebSocket upgrades, as of `wsMountsCheckedAt`. */
@@ -374,6 +419,7 @@ export class Server {
     nativePublish;
     maxBodyBytes;
     protoPoisoning;
+    formOrigins;
     /** `trustBodyFraming`: mark every `app.fetch` request as runtime-framed (see ServerOptions). */
     trustBodyFraming;
     wsMaxPayloadBytes;
@@ -463,8 +509,13 @@ export class Server {
     /** Body/raw response hooks need a framework-payload marker; keep that decision per app. */
     responseBodyTag;
     responseBodyOwners;
-    finalizeResponse = (result, set) => toResponse(result, set, this.responseBodyTag, this.staticResponseHeaders);
+    finalizeResponse = (result, set, ctx) => toResponse(result, set, this.responseBodyTag, this.staticResponseHeaders, 
+    // Response hooks write next, and they run for this same request object.
+    ctx !== undefined && this.onResponseHooks.length > 0 ? ctx[CONTEXT_REQUEST] : undefined);
     responseRequests;
+    /** A request the WebSocket handshake check ran the onRequest hooks on and then passed to HTTP →
+     * what the hooks returned, so `fetch` routes that instead of running the hooks a second time. */
+    wsHookedPasses;
     /** Original source → request observed by generic request hooks, including in-place mutations. */
     responseSources;
     /** Memoized NodeRequestContext per plain-`Request` source - see {@link nodeRequestContextOf}. */
@@ -488,11 +539,12 @@ export class Server {
         this.routePrefix = "";
         this.catalog = new RouteCatalog();
         this.wsRouter = new Router();
-        this.wsRouteCount = 0;
+        this.wsRoutes = [];
         this.topics = undefined;
         const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
         assertByteLimit(maxBodyBytes, "maxBodyBytes");
         this.protoPoisoning = options.protoPoisoning ?? "reject";
+        this.formOrigins = options.formOrigins;
         this.trustBodyFraming = options.trustBodyFraming ?? false;
         const wsMaxPayloadBytes = options.wsMaxPayloadBytes ?? maxBodyBytes;
         assertByteLimit(wsMaxPayloadBytes, "wsMaxPayloadBytes");
@@ -500,7 +552,13 @@ export class Server {
         this.wsMaxPayloadBytes = wsMaxPayloadBytes;
         this.requestTimeoutMs = options.requestTimeoutMs ?? 0;
         this.wsUpgradeTimeoutMs = options.wsUpgradeTimeoutMs ?? DEFAULT_WS_UPGRADE_TIMEOUT_MS;
-        this.clientIpTrust = options.clientIp;
+        const trust = options.clientIp;
+        if (trust !== undefined &&
+            !("header" in trust) &&
+            !(Number.isSafeInteger(trust.trustedHops) && trust.trustedHops >= 0)) {
+            throw new RangeError("clientIp trustedHops must be a non-negative integer");
+        }
+        this.clientIpTrust = trust;
         this.acceptInboundDeadlines = options.acceptInboundDeadlines ?? false;
         this.maxInboundDeadlineMs = options.maxInboundDeadlineMs ?? 30_000;
         this.deadlineAdmissionOptions = Object.freeze({
@@ -516,7 +574,8 @@ export class Server {
         if (!Number.isFinite(this.maxInboundDeadlineMs) || this.maxInboundDeadlineMs <= 0) {
             throw new RangeError("maxInboundDeadlineMs must be a finite positive number");
         }
-        this.gracefulSignals = options.gracefulSignals ?? false;
+        this.gracefulSignals =
+            options.gracefulSignals === true ? {} : options.gracefulSignals || undefined;
         this.stopHooks = [];
         this.fetchMounts = [];
         this.mountOrder = 0;
@@ -565,6 +624,7 @@ export class Server {
         this.responseBodyTag = undefined;
         this.responseBodyOwners = new Set();
         this.responseRequests = new WeakMap();
+        this.wsHookedPasses = undefined;
         this.responseSources = new WeakMap();
         this.nodeContexts = new WeakMap();
         this.appliedPlugins = new Map();
@@ -659,6 +719,15 @@ export class Server {
             opaque: options.opaque,
             app,
         };
+        // Mounts run before routes: a request under this prefix that no mount on the way strips comes back
+        // here unchanged until the stack overflows, which takes the process down. Dev-time only, like the
+        // hook audit: a production define folds this away, and the first dev request would hit it anyway.
+        if (hookAuditRuntime &&
+            process.env.NODE_ENV !== "production" &&
+            !mount.stripPrefix &&
+            mountLeadsBack(app, this, mount.path, (server) => server.fetchMounts, new Set())) {
+            throw new RouteConfigError("MOUNT_CYCLE", `mount ${mount.path}: the app leads back to this one without stripPrefix`);
+        }
         this.fetchMounts.push(mount);
         this.fetchMounts.sort(compareMounts);
         this.preRouteMountCount += 1;
@@ -679,8 +748,10 @@ export class Server {
     derive(fn) {
         this.assertConfigurable("derive()");
         this.derives.push(fn);
-        if (hookAuditRuntime && process.env.NODE_ENV !== "production")
-            recordScopedHook(this, this.catalog.size, "derive");
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production") {
+            recordScopedHook(this, this.catalog.size + this.wsRoutes.length, "derive");
+            tagHook(fn, "derive", this);
+        }
         return this;
     }
     /**
@@ -710,22 +781,27 @@ export class Server {
             throw new TypeError('authenticate() stage mode must be "sync" or "async"');
         }
         this.authStages.push(stage);
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+            tagHook(stage, "authenticate", this);
         return this;
     }
     decorate(key, value) {
         this.assertConfigurable("decorate()");
         this.decorations[key] = value;
         if (hookAuditRuntime && process.env.NODE_ENV !== "production")
-            recordScopedHook(this, this.catalog.size, "decorate");
+            recordScopedHook(this, this.catalog.size + this.wsRoutes.length, "decorate");
         return this;
     }
     /**
-     * Run before routing on the raw request. Return a `Response` to short-circuit, or a replacement
-     * `Request` to continue routing with a rewritten method/URL/headers. Global.
+     * Run before routing on the raw request. Return a `Response` or a `status()` result to
+     * short-circuit, or a replacement `Request` to continue routing with a rewritten method/URL/headers.
+     * Global.
      */
     onRequest(fn) {
         this.assertConfigurable("onRequest()");
         this.onRequestHooks.push(fn);
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+            tagHook(fn, "onRequest", this);
         this.onNodeRequestHooks.push(undefined);
         this.nodeRequestHooksComplete = false;
         this.bunNativeRequestHooksSafe = false;
@@ -739,8 +815,10 @@ export class Server {
     beforeHandle(fn) {
         this.assertConfigurable("beforeHandle()");
         this.beforeHandleHooks.push(fn);
-        if (hookAuditRuntime && process.env.NODE_ENV !== "production")
-            recordScopedHook(this, this.catalog.size, "beforeHandle");
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production") {
+            recordScopedHook(this, this.catalog.size + this.wsRoutes.length, "beforeHandle");
+            tagHook(fn, "beforeHandle", this);
+        }
         return this;
     }
     /**
@@ -754,8 +832,10 @@ export class Server {
     around(fn) {
         this.assertConfigurable("around()");
         this.aroundHooks.push(fn);
-        if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production") {
             recordScopedHook(this, this.catalog.size, "around");
+            tagHook(fn, "around", this);
+        }
         return this;
     }
     /**
@@ -793,8 +873,10 @@ export class Server {
     afterHandle(fn) {
         this.assertConfigurable("afterHandle()");
         this.afterHandleHooks.push(fn);
-        if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production") {
             recordScopedHook(this, this.catalog.size, "afterHandle");
+            tagHook(fn, "afterHandle", this);
+        }
         return this;
     }
     /** Handle a thrown error; a non-`undefined` return becomes the response (else the default 500).
@@ -803,14 +885,18 @@ export class Server {
     onError(fn) {
         this.assertConfigurable("onError()");
         this.onErrorHooks.push(fn);
-        if (hookAuditRuntime && process.env.NODE_ENV !== "production")
-            recordScopedHook(this, this.catalog.size, "onError");
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production") {
+            recordScopedHook(this, this.catalog.size + this.wsRoutes.length, "onError");
+            tagHook(fn, "onError", this);
+        }
         return this;
     }
     /** Transform every outgoing response - success, error, 404, 405, short-circuit. Global. */
     onResponse(fn) {
         this.assertConfigurable("onResponse()");
         this.onResponseHooks.push(fn);
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+            tagHook(fn, "onResponse", this);
         this.onNodeResponseHooks.push(undefined);
         this.nodeResponseHooksComplete = false;
         this.bunNativeResponseHeadersOnly = false;
@@ -842,6 +928,10 @@ export class Server {
      */
     responseHeaders(record) {
         this.assertConfigurable("responseHeaders()");
+        if (hookAuditRuntime &&
+            process.env.NODE_ENV !== "production" &&
+            this.onResponseHooks.length === 0)
+            tagStatic(this, Object.keys(record), record);
         return this.addStaticResponseHeaders(normalizeStaticResponseHeaders(record));
     }
     /** Wire an already-validated lowercase record into the static tier, or - once a dynamic response
@@ -858,13 +948,15 @@ export class Server {
                 });
                 return this;
             }
-            // Route the hook through the same seam the static tier uses. On a framework response (headers
-            // stamped mutable) it applies the defaults in place and returns the SAME object, so the
-            // serialized-body marker survives for later `onResponseBody`/`onResponseRaw` observers and the
-            // Node writer; reconstructing a `Response` here would strip that marker and reclassify the Node
-            // outcome from `json` to a generic `response`. A guarded foreign response takes its clone path.
+            // Route the hook through the same seam the static tier uses. On a framework response with a
+            // body it applies the defaults in place and returns the SAME object, so the serialized-body
+            // marker survives for later `onResponseBody`/`onResponseRaw` observers and the Node writer;
+            // reconstructing a `Response` here would strip that marker and reclassify the Node outcome from
+            // `json` to a generic `response`. A body-less or guarded response is copied, marker included.
             const statics = buildStaticResponseHeaders(record, this.inheritedStatics);
-            this.onResponseHooks.push((response) => applyStaticResponseHeaders(response, statics));
+            this.onResponseHooks.push((response, req) => applyStaticResponseHeaders(response, statics, req));
+            if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+                tagHook(this.onResponseHooks.at(-1), "responseHeaders", this);
             this.onNodeResponseHooks.push(undefined);
             this.nodeResponseHooksComplete = false;
             return this;
@@ -898,6 +990,8 @@ export class Server {
     onResponseFinalized(fn) {
         this.assertConfigurable("onResponseFinalized()");
         this.onResponseFinalizedHooks.push(fn);
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+            tagHook(fn, "onResponseFinalized", this);
         return this;
     }
     use(input) {
@@ -925,10 +1019,14 @@ export class Server {
             this.activeAssurance.push(...pluginOnly);
             const inherited = this.inheritedPlugins;
             this.inheritedPlugins = undefined;
+            if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+                enterPlugin(name);
             try {
                 return arg(this);
             }
             finally {
+                if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+                    leavePlugin();
                 this.inheritedPlugins = inherited;
                 // Remove only this plugin's temporary evidence. Nested assured plugins may deliberately leave
                 // subsequent evidence active, so truncating the whole array would lose real ordering semantics.
@@ -957,6 +1055,8 @@ export class Server {
         if (arg.onRequest !== undefined) {
             this.assertConfigurable("onRequest()");
             this.onRequestHooks.push(arg.onRequest);
+            if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+                tagHook(arg.onRequest, "onRequest", this);
             this.onNodeRequestHooks.push(arg.onNodeRequest);
             if (arg.onNodeRequest === undefined)
                 this.nodeRequestHooksComplete = false;
@@ -976,6 +1076,8 @@ export class Server {
         if (arg.onResponse !== undefined) {
             this.assertConfigurable("onResponse()");
             this.onResponseHooks.push(arg.onResponse);
+            if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+                tagHook(arg.onResponse, "onResponse", this);
             this.onNodeResponseHooks.push(arg.onNodeResponse);
             if (arg.onNodeResponse === undefined)
                 this.nodeResponseHooksComplete = false;
@@ -1014,8 +1116,10 @@ export class Server {
         return this.route("GET", path, schemaOrHandler, handler);
     }
     /**
-     * Register a **typed SSE route** - a GET endpoint streaming `text/event-stream` whose event
-     * payloads are contracted by `schema.sse`. The handler receives the validated context plus a
+     * Register a **typed SSE route** - an endpoint streaming `text/event-stream` whose event
+     * payloads are contracted by `schema.sse`. It is a GET route, or a POST route when the schema
+     * declares a `body` (a GET carries none): the body validates as on any POST, and the client sends
+     * it with `.subscribe(onEvent, { body })` - the shape of a chat stream that posts its prompt. The handler receives the validated context plus a
      * {@link TypedSSEStream}: `stream.send(event)` is compile-time-checked against the schema and
      * JSON-serialized into the SSE `data:` field. The typed client sees the marker and grows a
      * `.subscribe(onEvent)` for the route with the same payload type - end-to-end typed streaming.
@@ -1030,13 +1134,13 @@ export class Server {
      *
      *   // client: const off = api.feed.subscribe((post) => console.log(post.title))
      *
-     * `init` passes through to the underlying {@link sse} helper (`keepAlive`, extra headers). The
-     * connection closes when the handler resolves, `stream.close()` runs, or the client disconnects
-     * (`stream.signal`). Query/body schemas validate exactly as on any other route.
+     * `init` passes through to the underlying {@link sse} helper (`keepAlive`, `maxBufferedBytes`,
+     * extra headers). The connection closes when the handler resolves, `stream.close()` runs, or the
+     * client disconnects (`stream.signal`). Query/body schemas validate exactly as on any other route.
      */
     sse(path, schema, run, init) {
         const handler = (context) => requireSseRuntime(this.sseRuntime).response(context, (stream) => run(context, stream), init);
-        return this.route("GET", path, schema, handler);
+        return this.route(schema.body ? "POST" : "GET", path, schema, handler);
     }
     post(path, schemaOrHandler, handler) {
         return this.route("POST", path, schemaOrHandler, handler);
@@ -1092,8 +1196,11 @@ export class Server {
     }
     /**
      * Register a **WebSocket** route. The connection upgrades on a `GET` to `path` carrying
-     * `Upgrade: websocket`; the optional `handler.upgrade(c)` runs in the request context first and may
-     * reject (return a `Response`) or seed per-connection `ws.data`. WebSockets are served by the
+     * `Upgrade: websocket`. The handshake runs the chain an HTTP `GET` registered here would: the
+     * `authenticate()` stages, `derive`s and `beforeHandle`s added before this call, then the optional
+     * `handler.upgrade(c)`. Any of them may reject (a `Response`, a `status(...)`, a failed auth stage);
+     * `upgrade()` may seed per-connection `ws.data`. To keep a socket public, register it before the
+     * guard. WebSockets are served by the
      * adapter (`listen()`, `@nifrajs/node`, `@nifrajs/deno`, `toFetchHandler`) - not by bare `app.fetch`, which
      * has no socket (a WS path through `app.fetch` is a normal HTTP response).
      *
@@ -1120,10 +1227,20 @@ export class Server {
         this.topics ??= runtime.createTopics();
         // A `messageSchema` wraps `message` with validation once, here - every adapter then dispatches
         // already-validated, typed messages (Bun/Deno/Node/Workers) with no per-adapter code.
-        const entry = { handler: runtime.wrapHandler(handler, this.protoPoisoning) };
-        for (const form of expandOptionalParams(path))
-            this.wsRouter.add("GET", form, entry);
-        this.wsRouteCount += 1;
+        const wrapped = runtime.wrapHandler(handler, this.protoPoisoning);
+        const upgrade = runtime.upgradeStep(wrapped);
+        for (const form of expandOptionalParams(path)) {
+            // The chain an HTTP `GET` to `form` would capture now, ending in `upgrade()` instead of a
+            // handler. `afterHandle` and `around` are left out: they wrap a response, and an accepted
+            // handshake has none.
+            const { entry, assurance, descriptor } = this.prepareRoute("WS", form, wrapped.capabilities === undefined ? undefined : { capabilities: wrapped.capabilities }, upgrade);
+            const chain = { ...entry, afterHandle: [] };
+            this.wsRouter.add("GET", form, {
+                handler: wrapped,
+                chain: { ...chain, program: compileRouteProgram({ ...chain, bodySchema: undefined }) },
+            });
+            this.wsRoutes.push({ path: form, capabilities: descriptor.capabilities, assurance, chain });
+        }
         wsChanges += 1;
         return this;
     }
@@ -1315,11 +1432,6 @@ export class Server {
             assurance: routeAssurance,
         };
     }
-    /** The idempotency lane's bridge back into the normal matched lanes, resolved to a concrete Response
-     * (the lane buffers the body, then replays it through the route's real validation + handler). */
-    idempotencyRunLanes(buffered, platform, entry, params, search) {
-        return Promise.resolve(this.runMatchedLanes(buffered, platform, entry, params, search, this.finalizeResponse, this.wrapWebResponse, this.webResponseTimeout, false));
-    }
     /** @internal Symbol-keyed install seam for the `responseContract()` plugin. Off the public typed surface. */
     [INSTALL_RESPONSE_CONTRACT](runtime) {
         this.assertConfigurable("responseContract()");
@@ -1332,6 +1444,8 @@ export class Server {
             assertConfigurable: (operation) => this.assertConfigurable(operation),
             addResponseHook: (web, node, headerOnly = false) => {
                 this.onResponseHooks.push(web);
+                if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+                    tagHook(web, headerOnly ? "responseHeaders" : "onResponse", this);
                 this.onNodeResponseHooks.push(node);
                 if (node === undefined)
                     this.nodeResponseHooksComplete = false;
@@ -1370,6 +1484,11 @@ export class Server {
         this.assertConfigurable("nodeDirect()");
         this.nodeOutcomeRuntime = runtime;
     }
+    /** @internal An adapter reports a failure no response hook saw (a hook that threw past `fetch`, a
+     * response the runtime refused to write), logged as Bun's `listen()` logs one. */
+    [REPORT_ERROR](error) {
+        emitRequestErrorLog(this.logger, this.errorLogDetail, error, undefined);
+    }
     /** @internal Symbol-keyed install seam for the `streaming()` plugin. Off the public typed surface. */
     [INSTALL_SSE](runtime) {
         this.assertConfigurable("streaming()");
@@ -1388,7 +1507,7 @@ export class Server {
      * counts. `seen` ends a mount cycle (an app mounted under itself to alias a prefix).
      */
     [GET_WS_RUNTIME](seen) {
-        return this.wsRouteCount > 0 ? this.wsRuntime : this.mountedWsRuntime(seen);
+        return this.wsRoutes.length > 0 ? this.wsRuntime : this.mountedWsRuntime(seen);
     }
     /** The `[GET_WS_RUNTIME]` answer for the apps mounted here alone, whatever this app's own routes. */
     mountedWsRuntime(seen = new Set()) {
@@ -1429,15 +1548,36 @@ export class Server {
      * `derive`/`decorate`/`beforeHandle`/`afterHandle`/`onError`/`around` apply to its routes
      * exactly as they did standalone, so a group wires its own plugins. The same locality rule
      * covers the group's `onRequest` hooks: they run only for requests that route to the GROUP's
-     * routes (a `bodyLimit()` mounted on an uploads group must not start gating the whole app
+     * routes, and for an `OPTIONS` preflight to a path they serve (a `bodyLimit()` mounted on an uploads group must not start gating the whole app
      * because the app composed it in), and the group's global assurance follows its hooks onto
      * exactly those routes. A group with hooks but NO routes is a middleware bundle - its hooks
      * can only mean app-wide intent, so they are appended globally, unchanged. Response-side hooks
      * (`onResponse`/`onResponseFinalized`) are appended to this server's. This server's
      * route-scoped chains do NOT retroactively wrap merged routes (order-scoped, like routes
      * registered before a `derive`). Fail closed: a path+method collision throws
-     * `RouteConfigError` at merge time, and a group with WebSocket routes is refused (register
-     * those on the parent).
+     * `RouteConfigError` at merge time, and a group with WebSocket routes or mounts is refused
+     * (register those on the parent).
+     *
+     * What this server's `.use()`, made BEFORE the merge, covers on a merged route versus a
+     * `group()` route:
+     *
+     *   | installed on this server                   | group() route | merge()d route                 |
+     *   | ------------------------------------------ | ------------- | ------------------------------ |
+     *   | derive/decorate/beforeHandle/afterHandle,  | yes           | no - wire it on the merged     |
+     *   | onError/around, authenticate, route-scoped |               | server                         |
+     *   | assurance                                  |               |                                |
+     *   | onRequest/onResponse/responseHeaders hooks | yes           | yes (app-wide)                 |
+     *   | responseContract()                         | yes           | yes, when the route declares a |
+     *   |                                            |               | response and its own server    |
+     *   |                                            |               | installed no contract          |
+     *   | effectLedger()                             | yes           | yes, when the route declares   |
+     *   |                                            |               | capabilities and has no ledger |
+     *   | idempotency()                              | yes           | the merged server's own; a     |
+     *   |                                            |               | route declaring it without one |
+     *   |                                            |               | is refused at registration     |
+     *
+     * The response contract and the ledger can only add a check or a record, so a merged route is
+     * recompiled under them. A runtime installed AFTER the merge covers neither kind of route.
      */
     merge(other) {
         this.assertConfigurable("merge()");
@@ -1452,8 +1592,8 @@ export class Server {
             throw new RouteConfigError("INVALID_PATH", "merge() inside a group cannot prefix compiled routes - merge on the parent");
         }
         const source = other;
-        if (source.wsRouteCount > 0) {
-            throw new RouteConfigError("INVALID_PATH", "merge() does not carry WebSocket routes - register .ws() routes on the parent server");
+        if (source.wsRoutes.length > 0 || source.fetchMounts.length > 0) {
+            throw new RouteConfigError("INVALID_PATH", "merge() does not carry WebSocket routes or mounts - register them on the parent server");
         }
         this.adopt(source, undefined, 0);
         return this;
@@ -1473,7 +1613,7 @@ export class Server {
      * The builder receives a scope that INHERITS this server's route chain as it stands at the call
      * (`derive`/`decorate`/`authenticate`/`beforeHandle`/`afterHandle`/`onError`/`around`, assurance,
      * capability interceptors, installed runtimes, applied plugins), exactly as a route declared here
-     * would. A plugin this server already applied is in effect for the group: the group's `use()` of
+     * would. {@link merge} documents how that differs for a merged server. A plugin this server already applied is in effect for the group: the group's `use()` of
      * that same instance does nothing, and its `use()` of another instance under the same name throws a
      * `RouteConfigError` (`PLUGIN_RECONFIGURED`), because that instance could never replace the parent's.
      * A plugin the group applies still shares the parent's copy of a dependency it `use()`s itself.
@@ -1534,13 +1674,13 @@ export class Server {
         if (built !== scope) {
             throw new TypeError(`${label} builder must return its group synchronously`);
         }
-        if (scope.wsRouteCount > 0 ||
+        if (scope.wsRoutes.length > 0 ||
             scope.fetchMounts.length > 0 ||
             scope.catalog.entries().some((route) => route.descriptor.tool !== undefined)) {
             throw new RouteConfigError("INVALID_PATH", `${label} cannot hold ws(), mount, or MCP tool routes - add them to the parent`);
         }
         if (hookAuditRuntime && process.env.NODE_ENV !== "production")
-            sealHookAudit(scope, scope.catalog.size, this.logger);
+            sealHookAudit(scope, scope.catalog.size, scope.wsRoutes.length, this.logger);
         this.adopt(scope, fullPrefix, this.globalAssurance.length);
         return this;
     }
@@ -1567,7 +1707,7 @@ export class Server {
                 assurance: [...route.assurance, ...ownGlobal],
             })
             : (route) => route;
-        this.catalog.addBatch(sourceRoutes.map((route) => this.bindFusedRuntime(foldedAssurance(route))));
+        this.catalog.addBatch(sourceRoutes.map((route) => this.bindFusedRuntime(foldedAssurance(adoptRouteRuntimes(route, this.responseContractRuntime, this.effectLedgerRuntime)))));
         // Resolved idempotency/ledger route entries carry their own store/sink configuration, while the
         // runtime object supplies the generic execution machinery. If the parent already has a runtime,
         // either implementation can execute every resolved entry because route-specific options were
@@ -1594,13 +1734,17 @@ export class Server {
                 // The group's static declarations came before its own response hooks, so they are folded in
                 // first - and fold themselves into a hook here if this server already has one (same ordering
                 // rule as a direct `responseHeaders()` call).
+                if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+                    adoptStaticTags(this, source, this.onResponseHooks.length > 0);
                 this.addStaticResponseHeaders({ ...statics.record });
             }
             else {
                 // The static tier is folded into EVERY response this server builds, so a group's static
                 // headers cannot join it. A hook ahead of the group's own (the sealed scope is discarded
                 // after adoption) keeps their meaning - defaults a value already on the response wins over.
-                source.onResponseHooks.unshift((response) => applyStaticResponseHeaders(response, statics));
+                source.onResponseHooks.unshift((response, req) => applyStaticResponseHeaders(response, statics, req));
+                if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+                    tagHook(source.onResponseHooks[0], "responseHeaders", source, true);
                 source.onNodeResponseHooks.unshift(undefined);
                 source.nodeResponseHooksComplete = false;
             }
@@ -1608,6 +1752,17 @@ export class Server {
         this.onResponseHooks.push(...scopeHooks(source.onResponseHooks, responseScope, 1, true));
         this.onNodeResponseHooks.push(...scopeHooks(source.onNodeResponseHooks, responseScope, 1));
         this.onResponseFinalizedHooks.push(...scopeHooks(source.onResponseFinalizedHooks, responseScope, 1));
+        if (hookAuditRuntime && process.env.NODE_ENV !== "production") {
+            // Read before anything else is appended: the wrappers are still each list's tail.
+            const pairs = [];
+            if (inScope !== undefined)
+                pairs.push([source.onRequestHooks, this.onRequestHooks]);
+            if (responseScope !== undefined) {
+                pairs.push([source.onResponseHooks, this.onResponseHooks]);
+                pairs.push([source.onResponseFinalizedHooks, this.onResponseFinalizedHooks]);
+            }
+            tagAdopted(this, source, prefix, sourceRoutes, pairs);
+        }
         this.nodeResponseHooksComplete &&= source.nodeResponseHooksComplete;
         this.bunNativeResponseHeadersOnly &&= source.bunNativeResponseHeadersOnly;
         this.hasRawNodeResponseHook ||= source.hasRawNodeResponseHook;
@@ -1724,7 +1879,7 @@ export class Server {
         // Seal once on the first request so test servers (no `listen()`) still get the dead-hook check.
         // After that it is a single boolean read - the per-request cost the option promises to keep at zero.
         if (hookAuditRuntime && process.env.NODE_ENV !== "production")
-            sealHookAudit(this, this.catalog.size, this.logger);
+            sealHookAudit(this, this.catalog.size, this.wsRoutes.length, this.logger);
         // Off path (default): straight through - one property check, no closure, no promise.
         if (this.capacityGate === undefined)
             return this.fetchSourceInner(source, platform);
@@ -1857,7 +2012,7 @@ export class Server {
     resolveNodeSource(source, platform, suppliedRuntime) {
         // Seal once on the Node-direct lane too - it can bypass `fetchSource` entirely (hookless outcome).
         if (hookAuditRuntime && process.env.NODE_ENV !== "production")
-            sealHookAudit(this, this.catalog.size, this.logger);
+            sealHookAudit(this, this.catalog.size, this.wsRoutes.length, this.logger);
         // A paired header-only native hook can preserve the Node-direct JSON/body outcome for successful
         // responses. Arbitrary onResponse transforms need a real Web Response, but a buffered outcome can
         // be materialized with a direct-write marker and return to the socket path when the hook mutates
@@ -2075,7 +2230,7 @@ export class Server {
                 continue;
             }
             if (outcome !== undefined)
-                return outcome;
+                return webResponseOf(outcome);
         }
         return current;
     }
@@ -2086,7 +2241,7 @@ export class Server {
             if (outcome instanceof Request)
                 next = outcome;
             else if (outcome !== undefined)
-                return outcome;
+                return webResponseOf(outcome);
             if (i >= this.onRequestHooks.length)
                 return next;
             const hook = this.onRequestHooks[i];
@@ -2098,7 +2253,7 @@ export class Server {
     resolveWebSocketUpgrade(req, platform) {
         // Before any header is read: Deno only materializes a request's headers when asked, and that
         // costs a plain request measurably.
-        if (this.wsRouteCount === 0 && !this.mountsTakeUpgrades())
+        if (this.wsRoutes.length === 0 && !this.mountsTakeUpgrades())
             return WS_PASS;
         if (req.headers.get("upgrade")?.toLowerCase() !== "websocket")
             return WS_PASS;
@@ -2106,6 +2261,8 @@ export class Server {
         // is an ordinary request: its HTTP route answers it, and normal routing refuses an unknown token.
         if (req.method !== "GET")
             return WS_PASS;
+        // The adapter answers a pass by handing this same object to `fetch`.
+        const received = req;
         // The handshake routes the path `fetch` would: dot segments resolved (see `fetch`).
         if (rawRequestTargets && hasDotSegment(req.url))
             req = withResolvedTarget(req);
@@ -2119,11 +2276,12 @@ export class Server {
         const controller = timeoutMs > 0 ? new AbortController() : undefined;
         const signal = controller?.signal ?? getNeverAbortSignal();
         const deadline = timeoutMs > 0 ? Date.now() + timeoutMs : undefined;
-        const timeoutResponse = jsonError(503, "request_timeout");
-        const onTimeout = () => ({
+        // A refusal carries the static response headers an HTTP answer would; a guard's already does.
+        const refuse = (response) => ({
             kind: "reject",
-            response: timeoutResponse,
+            response: this.wrapWebResponse(response),
         });
+        const onTimeout = () => refuse(jsonError(503, "request_timeout"));
         const bounded = (work, onDone) => controller === undefined
             ? work
             : this.withTimeout(work, controller, onDone, Math.max(0, deadline - Date.now()));
@@ -2136,11 +2294,11 @@ export class Server {
             // already did and made every plain dynamic route pay for unrelated static path bytes.
             const params = match.params === EMPTY_PARAMS ? match.params : decodeRouteParams(match.params);
             if (params === null)
-                return { kind: "reject", response: jsonError(400, "malformed_path") };
-            const handler = match.payload.handler;
-            // Non-null: wsRouteCount > 0 ⇒ ws() ran ⇒ `.use(websocket())` installed the runtime + registry.
+                return refuse(jsonError(400, "malformed_path"));
+            const { handler, chain } = match.payload;
+            // Non-null: a socket route ⇒ ws() ran ⇒ `.use(websocket())` installed the runtime + registry.
             const pubsub = this.topics;
-            const attach = this.wsRuntime.attach;
+            const runtime = this.wsRuntime;
             // CSWSH guard, before any per-connection work or the user's upgrade(): reject a disallowed
             // Origin with 403. Browsers don't CORS-protect WS handshakes but do send cookies, so this
             // blocks cross-site authenticated sockets when the route opts in via `allowedOrigins`.
@@ -2150,52 +2308,46 @@ export class Server {
                     ? handler.allowedOrigins(origin)
                     : origin !== null && handler.allowedOrigins.includes(origin);
                 if (!allowed)
-                    return { kind: "reject", response: jsonError(403, "forbidden_origin") };
+                    return refuse(jsonError(403, "forbidden_origin"));
             }
             else if (origin !== null && !wsSameOrigin(origin, request)) {
                 // Secure default (no explicit `allowedOrigins`): reject a CROSS-ORIGIN browser handshake - the
                 // CSWSH case, since browsers send cookies on WS handshakes and don't apply CORS. Non-browser
                 // clients send no `Origin` and pass; same-origin browsers pass. Set `allowedOrigins` to permit
                 // specific cross-origin clients (or `() => true` for a genuinely public socket).
-                return { kind: "reject", response: jsonError(403, "forbidden_origin") };
-            }
-            if (handler.upgrade === undefined) {
-                return {
-                    kind: "upgrade",
-                    handler,
-                    data: undefined,
-                    pubsub,
-                    attach,
-                    maxPayloadBytes: this.wsMaxPayloadBytes,
-                };
+                return refuse(jsonError(403, "forbidden_origin"));
             }
             const budget = controller === undefined
                 ? createUnboundedRequestBudget(signal)
                 : createRequestBudget({ deadline: deadline, signal });
             const ctx = new RequestContext(request, params, url.search, signal, budget, platform, this.maxBodyBytes, this.protoPoisoning);
-            const settle = (value) => value instanceof Response
-                ? { kind: "reject", response: value }
-                : {
-                    kind: "upgrade",
-                    handler,
-                    data: value,
-                    pubsub,
-                    attach,
-                    maxPayloadBytes: this.wsMaxPayloadBytes,
-                };
+            // Rendered as the same chain on an HTTP `GET` renders its early results.
+            const finalize = (result, set) => {
+                const accepted = runtime.accepted(result);
+                return accepted === undefined
+                    ? { kind: "reject", response: this.finalizeResponse(result, set) }
+                    : {
+                        kind: "upgrade",
+                        handler,
+                        data: accepted.data,
+                        pubsub,
+                        attach: runtime.attach,
+                        maxPayloadBytes: this.wsMaxPayloadBytes,
+                        sender: runtime.sender,
+                    };
+            };
+            const wrap = (response) => finalize(response, EMPTY_RESPONSE_CONTROLS);
+            let outcome;
             try {
-                const result = handler.upgrade(ctx);
-                if (!(result instanceof Promise))
-                    return settle(result);
-                const pending = result.then(settle, () => ({
-                    kind: "reject",
-                    response: jsonError(500, "internal_error"),
-                }));
-                return bounded(pending, onTimeout);
+                outcome = executeRouteProgram(this, chain, chain.program, request, ctx, finalize, wrap);
             }
             catch {
-                return { kind: "reject", response: jsonError(500, "internal_error") };
+                return refuse(jsonError(500, "internal_error"));
             }
+            if (!(outcome instanceof Promise))
+                return outcome;
+            const pending = outcome.then(undefined, () => refuse(jsonError(500, "internal_error")));
+            return bounded(pending, onTimeout);
         };
         const resolveMounted = (request) => {
             // Native pub/sub was chosen because no mounted app took upgrades when `listen()` ran. One that
@@ -2217,20 +2369,25 @@ export class Server {
                 }
                 if (selected === undefined)
                     return WS_PASS;
-                const childRequest = selected.stripPrefix
-                    ? stripMountPrefix(request, selected.path)
-                    : request;
+                let childRequest = request;
+                if (selected.stripPrefix) {
+                    childRequest = stripMountPrefix(request, selected.path);
+                    selected.wsPassed ??= new WeakMap();
+                    selected.wsPassed.set(request, childRequest);
+                }
                 let child;
                 try {
                     child = selected.resolveWebSocketUpgrade(childRequest, platform);
                 }
                 catch {
-                    return { kind: "reject", response: jsonError(500, "internal_error") };
+                    return refuse(jsonError(500, "internal_error"));
                 }
                 const settle = (outcome) => outcome.kind === "pass" ||
                     (outcome.kind === "reject" && outcome.response.status === 404 && selected.fallbackOn404)
                     ? dispatch(selectedIndex + 1)
-                    : outcome;
+                    : outcome.kind === "reject"
+                        ? refuse(outcome.response)
+                        : outcome;
                 return child instanceof Promise ? child.then(settle) : settle(child);
             };
             return dispatch(0);
@@ -2248,21 +2405,24 @@ export class Server {
         };
         if (this.onRequestHooks.length === 0)
             return resolveWithDeadline(req);
+        // On a pass the adapter hands `received` to `fetch`, which then routes these results. An upgrade
+        // or a rejection never reaches `fetch`, so the entry dies with the request.
+        const resolveHooked = (request) => {
+            this.wsHookedPasses ??= new WeakMap();
+            this.wsHookedPasses.set(received, request);
+            return resolveWithDeadline(request);
+        };
         let hooked;
         try {
             hooked = this.runWebSocketRequestHooks(req, platform);
         }
         catch {
-            return { kind: "reject", response: jsonError(500, "internal_error") };
+            return refuse(jsonError(500, "internal_error"));
         }
         if (!(hooked instanceof Promise)) {
-            return hooked instanceof Response
-                ? { kind: "reject", response: hooked }
-                : resolveWithDeadline(hooked);
+            return hooked instanceof Response ? refuse(hooked) : resolveHooked(hooked);
         }
-        const pending = hooked.then((result) => result instanceof Response
-            ? { kind: "reject", response: result }
-            : resolveWithDeadline(result), () => ({ kind: "reject", response: jsonError(500, "internal_error") }));
+        const pending = hooked.then((result) => (result instanceof Response ? refuse(result) : resolveHooked(result)), () => refuse(jsonError(500, "internal_error")));
         return bounded(Promise.resolve(pending).then((result) => result), onTimeout);
     }
     /** Bun `fetch` when WS routes exist: try a WS upgrade first, else run the normal HTTP lifecycle.
@@ -2274,9 +2434,8 @@ export class Server {
                 return this.fetch(req, bunPeerPlatform(server, req));
             if (o.kind === "reject")
                 return o.response;
-            return server.upgrade(req, {
-                data: { handler: o.handler, data: o.data, pubsub: o.pubsub },
-            })
+            // A copy: the Bun socket keeps per-connection state on it, and a hand-built outcome may be shared.
+            return server.upgrade(req, { data: { ...o } })
                 ? undefined
                 : jsonError(426, "upgrade_required");
         };
@@ -2319,6 +2478,13 @@ export class Server {
         if (this.onRequestHooks.length === 0 || !isRoutableMethod(source.method)) {
             return this.routeAndRun(source, resolved, finalize, wrapResponse, onTimeout, webFast);
         }
+        const hooked = this.wsHookedPasses?.get(source);
+        if (hooked !== undefined) {
+            const request = requestOf(source);
+            this.wsHookedPasses?.delete(request);
+            this.responseRequests.set(request, hooked);
+            return this.routeAndRun(hooked, resolved, finalize, wrapResponse, onTimeout, webFast);
+        }
         if (!webFast && this.canUseNodeRequestHooks()) {
             return this.runWithNodeRequest(source, resolved, finalize, wrapResponse, onTimeout);
         }
@@ -2595,7 +2761,9 @@ export class Server {
             }
             if (mount === undefined)
                 return fallback ?? jsonError(404, "not_found");
-            const childRequest = mount.stripPrefix ? stripMountPrefix(request, mount.path) : request;
+            const childRequest = mount.stripPrefix
+                ? (mount.wsPassed?.get(request) ?? stripMountPrefix(request, mount.path))
+                : request;
             const outcome = mount.handler(childRequest, platform);
             if (!replayable || !mount.fallbackOn404)
                 return outcome;
@@ -2631,7 +2799,7 @@ export class Server {
         if (entry.idempotent !== undefined && this.idempotencyRuntime !== undefined) {
             return this.idempotencyRuntime.run(entry.idempotent, requestOf(source), platform, entry, params, search, wrapResponse, {
                 maxBodyBytes: entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
-                runLanes: (buffered, plat, ent, prm, srch) => this.idempotencyRunLanes(buffered, plat, ent, prm, srch),
+                runLanes: (buffered, plat, ent, prm, srch) => this.runMatchedLanes(buffered, plat, ent, prm, srch, this.finalizeResponse, this.wrapWebResponse, this.webResponseTimeout, false),
             });
         }
         return this.runMatchedLanes(source, platform, entry, params, search, finalize, wrapResponse, onTimeout, webFast);
@@ -2672,11 +2840,20 @@ export class Server {
             : createRequestBudget({ deadline: admission.deadline, signal });
         const plan = entry.execution;
         const nativeContext = controller === undefined;
-        const outcome = webFast && plan.fusedWeb !== undefined
-            ? plan.fusedWeb(source, params, search, signal, budget, platform, nativeContext)
-            : !webFast && plan.fusedBody !== undefined
-                ? plan.fusedBody(source, params, search, signal, budget, platform, false, finalize, wrapResponse)
-                : plan.run(this, entry, source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse);
+        let outcome;
+        try {
+            outcome =
+                webFast && plan.fusedWeb !== undefined
+                    ? plan.fusedWeb(source, params, search, signal, budget, platform, nativeContext)
+                    : !webFast && plan.fusedBody !== undefined
+                        ? plan.fusedBody(source, params, search, signal, budget, platform, false, finalize, wrapResponse)
+                        : plan.run(this, entry, source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse);
+        }
+        catch (err) {
+            // A lane's synchronous render throw (a BigInt, a header value with a line break): the lanes
+            // guard only their async continuations, since a `try` around a fused render slows it.
+            return this.contextlessBareError(err, source, params, search, signal, budget, platform, wrapResponse);
+        }
         // The request timeout only bounds work that is actually pending - a synchronous (bare) result is
         // already complete and can't time out, so it's returned as-is (no 503 race, no promise).
         if (controller !== undefined && outcome instanceof Promise) {
@@ -2704,7 +2881,14 @@ export class Server {
             return this.contextlessBareError(err, source, params, search, signal, budget, platform, wrapResponse);
         }
         if (result instanceof Promise) {
-            return result.then((value) => finalize(value, EMPTY_RESPONSE_CONTROLS), (err) => this.contextlessBareError(err, source, params, search, signal, budget, platform, wrapResponse));
+            return result.then((value) => {
+                try {
+                    return finalize(value, EMPTY_RESPONSE_CONTROLS);
+                }
+                catch (err) {
+                    return this.contextlessBareError(err, source, params, search, signal, budget, platform, wrapResponse);
+                }
+            }, (err) => this.contextlessBareError(err, source, params, search, signal, budget, platform, wrapResponse));
         }
         return finalize(result, EMPTY_RESPONSE_CONTROLS);
     }
@@ -2740,9 +2924,17 @@ export class Server {
         }
         if (result instanceof Promise) {
             // Async handler on an otherwise-bare route: finish on a microtask, with the same error handling.
-            return result.then((value) => finalize(value, responseSet(ctx)), (err) => this.bareError(err, ctx, finalize, wrapResponse));
+            return result.then((value) => {
+                // A synchronous finalize throw reaches runMatchedLanes; this one would reject.
+                try {
+                    return finalize(value, responseSet(ctx), ctx);
+                }
+                catch (err) {
+                    return this.bareError(err, ctx, finalize, wrapResponse);
+                }
+            }, (err) => this.bareError(err, ctx, finalize, wrapResponse));
         }
-        return finalize(result, responseSet(ctx));
+        return finalize(result, responseSet(ctx), ctx);
     }
     /** Bare-route error rendering - identical to the compiled route program's catch minus the (absent) onError
      * loop: a thrown `Response` is returned as deliberate control flow; anything else is logged + 500. */
@@ -2762,22 +2954,29 @@ export class Server {
             // `() => ...` can't observe the context - skip allocating one entirely (errors still build
             // one for the structured log, exactly like runContextlessBare).
             const contextlessHandler = handler;
+            const fail = (err, source, params, search, signal, budget, platform, nativeContext) => logError(err, nativeContext
+                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning));
             return (source, params, search, signal, budget, platform, nativeContext) => {
                 let result;
                 try {
                     result = contextlessHandler();
                 }
                 catch (err) {
-                    return logError(err, nativeContext
-                        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
-                        : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning));
+                    return fail(err, source, params, search, signal, budget, platform, nativeContext);
                 }
                 if (result instanceof Promise) {
-                    return result.then((value) => fusedRespondNoSet(value, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), (err) => logError(err, nativeContext
-                        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
-                        : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning)));
+                    return result.then((value) => {
+                        // A synchronous render throw reaches runMatchedLanes; this one would reject.
+                        try {
+                            return fusedRespondNoSet(value, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0, this.onResponseHooks.length === 0 ? undefined : requestOf(source));
+                        }
+                        catch (err) {
+                            return fail(err, source, params, search, signal, budget, platform, nativeContext);
+                        }
+                    }, (err) => fail(err, source, params, search, signal, budget, platform, nativeContext));
                 }
-                return fusedRespondNoSet(result, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
+                return fusedRespondNoSet(result, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0, this.onResponseHooks.length === 0 ? undefined : requestOf(source));
             };
         }
         return (source, params, search, signal, budget, platform, nativeContext) => {
@@ -2794,11 +2993,21 @@ export class Server {
                 return logError(err, ctx);
             }
             if (result instanceof Promise) {
-                return result.then((value) => fusedRespond(value, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
+                return result.then((value) => this.respondFused(value, ctx, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
             }
             return fusedRespond(result, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
         };
     }
+    /** A fused Web lane's render in an async continuation, where a result that cannot be rendered
+     * must fail like a handler throw; a synchronous render throw reaches {@link runMatchedLanes}. */
+    respondFused(result, ctx, unstamped) {
+        try {
+            return fusedRespond(result, ctx, this.responseBodyTag, this.staticResponseHeaders, unstamped);
+        }
+        catch (err) {
+            return this.bareError(err, ctx, (value, set) => this.wrapWebResponse(toResponse(value, set)), this.wrapWebResponse);
+        }
+    }
     /** Compile the eligible body-only route's parser → validator → handler continuation once. The
      * bounded parser remains shared with the generic lane; only the route-invariant entry lookups and
      * lifecycle dispatch disappear from the common synchronous-validator/synchronous-handler case. */
@@ -2867,7 +3076,7 @@ export class Server {
                 ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                 : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
             const finish = (value) => runParsed(value, ctx, finalize, wrapResponse);
-            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, finish, wrapResponse, (err) => logError(err, ctx, finalize, wrapResponse), bodySchema);
+            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, finish, wrapResponse, (err) => logError(err, ctx, finalize, wrapResponse), bodySchema, this.formOrigins);
         };
     }
     /** Web adapter wrapper for the shared body runner. Node passes its native finalizer directly through
@@ -2897,9 +3106,9 @@ export class Server {
                 return logError(err, ctx);
             }
             if (result instanceof Promise) {
-                return result.then((settled) => fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
+                return result.then((settled) => this.respondFused(settled, ctx, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
             }
-            return fusedRespond(result, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
+            return this.respondFused(result, ctx, this.onResponseHooks.length === 0);
         };
         return (source, params, search, signal, budget, platform, nativeContext) => {
             const ctx = nativeContext
@@ -2941,173 +3150,88 @@ export class Server {
      * before → handler in one frame.
      */
     buildFusedDeriveBefore(handler, derive, before, querySchema, maxBodyBytes) {
+        return this.buildFusedDeriveBeforeAfter(handler, derive, before, undefined, querySchema, maxBodyBytes);
+    }
+    // Both hook variants share one registered chain; request contexts stay in arguments.
+    buildFusedDeriveBeforeAfter(handler, derive, before, after, querySchema, maxBodyBytes) {
         const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
-        return (source, params, search, signal, budget, platform, nativeContext) => {
-            const ctx = nativeContext
-                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
-                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
-            const runHandler = () => {
-                let result;
-                try {
-                    result = handler(ctx);
-                }
-                catch (err) {
-                    return logError(err, ctx);
-                }
-                if (result instanceof Promise) {
-                    return result.then((value) => fusedRespond(value, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
-                }
-                return fusedRespond(result, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
-            };
-            const runBefore = () => {
-                let early;
-                try {
-                    early = before(ctx);
-                }
-                catch (err) {
-                    return logError(err, ctx);
-                }
-                if (early instanceof Promise) {
-                    return early.then((settled) => {
-                        if (settled === undefined)
-                            return runHandler();
-                        return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
-                    }, (err) => logError(err, ctx));
-                }
-                if (early === undefined)
-                    return runHandler();
-                return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders);
-            };
-            const runDerive = () => {
-                let derived;
-                try {
-                    derived = derive(ctx);
-                }
-                catch (err) {
-                    return logError(err, ctx);
-                }
-                if (derived instanceof Promise) {
-                    return derived.then((settled) => {
-                        if (isResponseResult(settled) || settled instanceof Response) {
-                            return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
-                        }
-                        Object.assign(ctx, settled);
-                        return runBefore();
-                    }, (err) => logError(err, ctx));
-                }
-                if (isResponseResult(derived) || derived instanceof Response) {
-                    return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders);
-                }
-                Object.assign(ctx, derived);
-                return runBefore();
-            };
-            if (querySchema === undefined)
-                return runDerive();
-            let validation;
+        // Continuations capture route state once; each request supplies its own context.
+        const runAfter = (result, ctx) => {
+            if (after === undefined)
+                return this.respondFused(result, ctx, this.onResponseHooks.length === 0);
+            let transformed;
             try {
-                validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
+                transformed = after(result, ctx);
             }
             catch (err) {
                 return logError(err, ctx);
             }
-            if (validation instanceof Promise) {
-                return validation.then((settled) => {
-                    if (settled.issues !== undefined)
-                        return this.wrapWebResponse(plainValidationError(settled.issues));
-                    ctx.query = settled.value;
-                    return runDerive();
+            if (transformed instanceof Promise) {
+                return transformed.then((value) => this.respondFused(value, ctx, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
+            }
+            return this.respondFused(transformed, ctx, this.onResponseHooks.length === 0);
+        };
+        const runHandler = (ctx) => {
+            let result;
+            try {
+                result = handler(ctx);
+            }
+            catch (err) {
+                return logError(err, ctx);
+            }
+            if (result instanceof Promise) {
+                return result.then((value) => runAfter(value, ctx), (err) => logError(err, ctx));
+            }
+            return runAfter(result, ctx);
+        };
+        const runBefore = (ctx) => {
+            let early;
+            try {
+                early = before(ctx);
+            }
+            catch (err) {
+                return logError(err, ctx);
+            }
+            if (early instanceof Promise) {
+                return early.then((settled) => {
+                    if (settled === undefined)
+                        return runHandler(ctx);
+                    return this.respondFused(settled, ctx);
                 }, (err) => logError(err, ctx));
             }
-            if (validation.issues !== undefined)
-                return this.wrapWebResponse(plainValidationError(validation.issues));
-            ctx.query = validation.value;
-            return runDerive();
+            if (early === undefined)
+                return runHandler(ctx);
+            return this.respondFused(early, ctx);
+        };
+        const runDerive = (ctx) => {
+            let derived;
+            try {
+                derived = derive(ctx);
+            }
+            catch (err) {
+                return logError(err, ctx);
+            }
+            if (derived instanceof Promise) {
+                return derived.then((settled) => {
+                    if (isResponseResult(settled) || settled instanceof Response) {
+                        return this.respondFused(settled, ctx);
+                    }
+                    Object.assign(ctx, settled);
+                    return runBefore(ctx);
+                }, (err) => logError(err, ctx));
+            }
+            if (isResponseResult(derived) || derived instanceof Response) {
+                return this.respondFused(derived, ctx);
+            }
+            Object.assign(ctx, derived);
+            return runBefore(ctx);
         };
-    }
-    /**
-     * Same shape as `buildFusedDeriveBefore`, plus one `afterHandle` step. The closure runs (validate) →
-     * derive → before → handler → after in one frame, the shape the realistic middleware route lands on
-     * when it also wants a response transform (e.g. attaching a request id to a successful payload's
-     * headers). `LifecycleExecutionLane` and `selectRouteLanes` guarantee `afterHandle === 1`, the
-     * throw contract is the same as the generic program, and the `after` step is the final transform +
-     * respond the generic program already does.
-     */
-    buildFusedDeriveBeforeAfter(handler, derive, before, after, querySchema, maxBodyBytes) {
-        const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
         return (source, params, search, signal, budget, platform, nativeContext) => {
             const ctx = nativeContext
                 ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                 : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
-            const runAfter = (result) => {
-                let transformed;
-                try {
-                    transformed = after(result, ctx);
-                }
-                catch (err) {
-                    return logError(err, ctx);
-                }
-                if (transformed instanceof Promise) {
-                    return transformed.then((value) => fusedRespond(value, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
-                }
-                return fusedRespond(transformed, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
-            };
-            const runHandler = () => {
-                let result;
-                try {
-                    result = handler(ctx);
-                }
-                catch (err) {
-                    return logError(err, ctx);
-                }
-                if (result instanceof Promise) {
-                    return result.then((value) => runAfter(value), (err) => logError(err, ctx));
-                }
-                return runAfter(result);
-            };
-            const runBefore = () => {
-                let early;
-                try {
-                    early = before(ctx);
-                }
-                catch (err) {
-                    return logError(err, ctx);
-                }
-                if (early instanceof Promise) {
-                    return early.then((settled) => {
-                        if (settled === undefined)
-                            return runHandler();
-                        return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
-                    }, (err) => logError(err, ctx));
-                }
-                if (early === undefined)
-                    return runHandler();
-                return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders);
-            };
-            const runDerive = () => {
-                let derived;
-                try {
-                    derived = derive(ctx);
-                }
-                catch (err) {
-                    return logError(err, ctx);
-                }
-                if (derived instanceof Promise) {
-                    return derived.then((settled) => {
-                        if (isResponseResult(settled) || settled instanceof Response) {
-                            return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
-                        }
-                        Object.assign(ctx, settled);
-                        return runBefore();
-                    }, (err) => logError(err, ctx));
-                }
-                if (isResponseResult(derived) || derived instanceof Response) {
-                    return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders);
-                }
-                Object.assign(ctx, derived);
-                return runBefore();
-            };
             if (querySchema === undefined)
-                return runDerive();
+                return runDerive(ctx);
             let validation;
             try {
                 validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
@@ -3120,13 +3244,13 @@ export class Server {
                     if (settled.issues !== undefined)
                         return this.wrapWebResponse(plainValidationError(settled.issues));
                     ctx.query = settled.value;
-                    return runDerive();
+                    return runDerive(ctx);
                 }, (err) => logError(err, ctx));
             }
             if (validation.issues !== undefined)
                 return this.wrapWebResponse(plainValidationError(validation.issues));
             ctx.query = validation.value;
-            return runDerive();
+            return runDerive(ctx);
         };
     }
     /**
@@ -3150,7 +3274,7 @@ export class Server {
             const runHandlerValidated = () => {
                 const runAfter = (result) => {
                     if (after === undefined) {
-                        return fusedRespond(result, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
+                        return this.respondFused(result, ctx, this.onResponseHooks.length === 0);
                     }
                     let transformed;
                     try {
@@ -3160,9 +3284,9 @@ export class Server {
                         return logError(err, ctx);
                     }
                     if (transformed instanceof Promise) {
-                        return transformed.then((value) => fusedRespond(value, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
+                        return transformed.then((value) => this.respondFused(value, ctx, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
                     }
-                    return fusedRespond(transformed, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0);
+                    return this.respondFused(transformed, ctx, this.onResponseHooks.length === 0);
                 };
                 const runHandler = () => {
                     let result;
@@ -3189,12 +3313,12 @@ export class Server {
                         return early.then((settled) => {
                             if (settled === undefined)
                                 return runHandler();
-                            return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                            return this.respondFused(settled, ctx);
                         }, (err) => logError(err, ctx));
                     }
                     if (early === undefined)
                         return runHandler();
-                    return fusedRespond(early, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                    return this.respondFused(early, ctx);
                 };
                 let derived;
                 try {
@@ -3206,14 +3330,14 @@ export class Server {
                 if (derived instanceof Promise) {
                     return derived.then((settled) => {
                         if (isResponseResult(settled) || settled instanceof Response) {
-                            return fusedRespond(settled, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                            return this.respondFused(settled, ctx);
                         }
                         Object.assign(ctx, settled);
                         return runBefore();
                     }, (err) => logError(err, ctx));
                 }
                 if (isResponseResult(derived) || derived instanceof Response) {
-                    return fusedRespond(derived, ctx, this.responseBodyTag, this.staticResponseHeaders);
+                    return this.respondFused(derived, ctx);
                 }
                 Object.assign(ctx, derived);
                 return runBefore();
@@ -3239,7 +3363,7 @@ export class Server {
                 ctx.body = validation.value;
                 return runHandlerValidated();
             };
-            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, onParsed, (response) => this.wrapWebResponse(response), (err) => Promise.resolve(logError(err, ctx)), bodySchema);
+            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, onParsed, (response) => this.wrapWebResponse(response), (err) => Promise.resolve(logError(err, ctx)), bodySchema, this.formOrigins);
         };
     }
     /**
@@ -3519,7 +3643,7 @@ export class Server {
             const ctx = nativeContext
                 ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                 : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
-            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => onParsed(parsed, ctx, finalize, wrapResponse), wrapResponse, (err) => logError(err, ctx, finalize, wrapResponse), bodySchema);
+            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => onParsed(parsed, ctx, finalize, wrapResponse), wrapResponse, (err) => logError(err, ctx, finalize, wrapResponse), bodySchema, this.formOrigins);
         };
     }
     bareError(err, ctx, finalize, wrapResponse) {
@@ -3638,14 +3762,14 @@ export class Server {
             Object.assign(ctx, entry.decorations);
         const handlerOutput = entry.handler(ctx);
         if (handlerOutput instanceof Promise) {
-            return handlerOutput.then((value) => finalize(value, responseSet(ctx)), (err) => {
+            return handlerOutput.then((value) => finalize(value, responseSet(ctx), ctx), (err) => {
                 if (wrapResponse) {
                     return this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse);
                 }
                 throw err;
             });
         }
-        return finalize(handlerOutput, responseSet(ctx));
+        return finalize(handlerOutput, responseSet(ctx), ctx);
     }
     handleValidationErrorRecovery(entry, recovery, ctx, finalize, wrapResponse, originalIssues, kind) {
         if (recovery !== undefined) {
@@ -3751,13 +3875,16 @@ export class Server {
      */
     applyOnResponse(response, req) {
         const hooks = this.onResponseHooks;
-        let current = response;
+        // Hooks write onto the response they are handed (cookies, CORS, request ids), so every response
+        // entering the chain - and any other one a hook hands back - is first made this request's own.
+        let current = writableResponse(response, req);
         for (let i = 0; i < hooks.length; i++) {
             const next = hooks[i](current, req);
             if (next instanceof Promise) {
-                return next.then((settled) => this.continueOnResponse(settled, i + 1, req));
+                const handed = current;
+                return next.then((settled) => this.continueOnResponse(settled, i + 1, req, handed));
             }
-            current = next;
+            current = next === current ? next : writableResponse(next, req);
         }
         return current;
     }
@@ -3816,11 +3943,12 @@ export class Server {
         return pending;
     }
     /** Async tail of {@link applyOnResponse}: runs the remaining hooks once one has gone async. */
-    async continueOnResponse(response, nextIndex, req) {
-        let current = response;
+    async continueOnResponse(response, nextIndex, req, handed) {
+        let current = response === handed ? response : writableResponse(response, req);
         for (let i = nextIndex; i < this.onResponseHooks.length; i++) {
             const next = this.onResponseHooks[i](current, req);
-            current = next instanceof Promise ? await next : next;
+            const settled = next instanceof Promise ? await next : next;
+            current = settled === current ? settled : writableResponse(settled, req);
         }
         return current;
     }
@@ -3849,7 +3977,7 @@ export class Server {
         try {
             const contract = entry.responseContract;
             if (contract === undefined)
-                return finalize(result, responseSet(ctx));
+                return finalize(result, responseSet(ctx), ctx);
             const checked = contract.runtime.check(contract.definition, result, ctx);
             if (checked instanceof Promise) {
                 return checked.then((outcome) => this.finishContractOutcome(ctx, finalize, wrapResponse, outcome), (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse));
@@ -3876,7 +4004,7 @@ export class Server {
                 detail: outcome.message,
             });
         }
-        return finalize(outcome.value, responseSet(ctx));
+        return finalize(outcome.value, responseSet(ctx), ctx);
     }
     /** Synchronous by design, and `MaybePromise` rather than `Promise` for the same reason: control flow
      * out of a lifecycle stage must not cost a promise. An `async` method allocates one and defers the
@@ -3889,11 +4017,10 @@ export class Server {
         // SvelteKit semantics): as built, plus the cookies the request queued, so a session set or
         // cleared before `throw redirect(...)` / `requireSession(...)` ships. Don't run onError or log
         // it as a 500.
-        if (err instanceof Response)
-            return finalize(err, responseSet(ctx));
-        // Same rule for a thrown `status(...)`, but through `finalize` rather than `wrapResponse`: the
-        // value is still plain data, so the ordinary JSON lane renders it and no `Response` is built.
-        if (isResponseResult(err))
+        if (err instanceof Response && err !== ctx.jsonReply)
+            return finalize(err, responseSet(ctx), ctx);
+        // Same rule for a thrown `status(...)` or `c.json(...)`, which stay held to the route's contract.
+        if (err instanceof Response || isResponseResult(err))
             return this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, err);
         if (entry.onError.length === 0) {
             // Never crash the server or leak internals. The client gets a flat 500; the detail goes to the
@@ -3911,8 +4038,20 @@ export class Server {
         for (let i = 0; i < entry.onError.length; i++) {
             const outcome = entry.onError[i](err, ctx);
             const handled = outcome instanceof Promise ? await outcome : outcome;
-            if (handled !== undefined)
-                return finalize(handled, responseSet(ctx));
+            if (handled === undefined)
+                continue;
+            const contract = entry.responseContract;
+            if (contract === undefined || (handled !== ctx.jsonReply && !isResponseResult(handled)))
+                return finalize(handled, responseSet(ctx), ctx);
+            // Checked here, not through finishLifecycleContract: a throwing schema must not re-enter onError.
+            try {
+                const checked = await contract.runtime.check(contract.definition, handled, ctx);
+                return this.finishContractOutcome(ctx, finalize, wrapResponse, checked);
+            }
+            catch (checkError) {
+                this.logRequestError(checkError, ctx);
+                return wrapResponse(plainError(500, "internal_error"));
+            }
         }
         this.logRequestError(err, ctx);
         return wrapResponse(plainError(500, "internal_error"));
@@ -3933,7 +4072,7 @@ export class Server {
                 ? validation.then((result) => this.applyLifecycleValidation(entry, result, ctx, "body"))
                 : this.applyLifecycleValidation(entry, validation, ctx, "body");
         };
-        return readBodyFramed(req, bodyLimit ?? UNLIMITED_BODY_BYTES, this.protoPoisoning, validate, (response) => response, (error) => Promise.reject(error), bodySchema);
+        return readBodyFramed(req, bodyLimit ?? UNLIMITED_BODY_BYTES, this.protoPoisoning, validate, (response) => response, (error) => Promise.reject(error), bodySchema, this.formOrigins);
     }
     /** Apply validation and its recovery hook on the generic lifecycle lane. Recovery is completed
      * before derives/beforeHandle run, matching the body-only and query-only execution lanes. */
@@ -4003,7 +4142,14 @@ export class Server {
             return this.applyOnResponseAndFinalize(response, request);
         };
         const runNative = (request, params) => {
-            const outcome = capped(request, params, undefined, signal, budget, peer, true);
+            let outcome;
+            try {
+                outcome = capped(request, params, undefined, signal, budget, peer, true);
+            }
+            catch (err) {
+                // A synchronous render throw, as in runMatchedLanes.
+                outcome = this.contextlessBareError(err, request, params, undefined, signal, budget, peer, this.wrapWebResponse);
+            }
             return outcome instanceof Promise
                 ? outcome.then((response) => finishNative(request, response))
                 : finishNative(request, outcome);
@@ -4020,7 +4166,7 @@ export class Server {
                     markFramed(request);
                     return request.headers.get(NIFRA_DEADLINE_HEADER) !== null
                         ? this.fetchMatched(request, entry, EMPTY_PARAMS, peer)
-                        : capped(request, EMPTY_PARAMS, undefined, signal, budget, peer, true);
+                        : runNative(request, EMPTY_PARAMS);
                 };
             }
             return (request) => {
@@ -4048,7 +4194,7 @@ export class Server {
                     return fallback(request, server);
                 return request.headers.get(NIFRA_DEADLINE_HEADER) !== null
                     ? this.fetchMatched(request, entry, params, peer)
-                    : capped(request, params, undefined, signal, budget, peer, true);
+                    : runNative(request, params);
             };
         }
         return (request, server) => {
@@ -4072,7 +4218,7 @@ export class Server {
         // bypasses - so an app that declares trust routes through the fetch lane (where `c.clientIp`
         // resolves) instead of Bun's native table. The allocation-free default keeps native fusion.
         if ((this.onRequestHooks.length > 0 && !this.bunNativeRequestHooksSafe) ||
-            this.wsRouteCount > 0 ||
+            this.wsRoutes.length > 0 ||
             this.preRouteMountCount > 0 ||
             this.clientIpTrust !== undefined) {
             return undefined;
@@ -4208,7 +4354,7 @@ export class Server {
         }
         // Seal before Bun.serve: in `"error"` mode this throws instead of leaving a bound port behind.
         if (hookAuditRuntime && process.env.NODE_ENV !== "production")
-            sealHookAudit(this, this.catalog.size, this.logger);
+            sealHookAudit(this, this.catalog.size, this.wsRoutes.length, this.logger);
         // Bun's `Server` is the concrete handle; we expose the stable `RunningServer`
         // subset so the public types don't depend on the ambient `Bun` global. The cast
         // bridges them - Bun's `.port` is `number | undefined` (undefined only for unix
@@ -4219,7 +4365,7 @@ export class Server {
         // `websocket` handlers are one shared dispatcher - each connection's `ws.data.handler` is the
         // matched route's handler, set by `server.upgrade`.
         // With WS routes, the dispatcher comes from the installed `.use(websocket())` runtime - non-null
-        // because wsRouteCount > 0 means ws() ran, and ws() requires the runtime at registration.
+        // because a socket route means ws() ran, and ws() requires the runtime at registration.
         // Native pub/sub when the app has WS routes and none validate outbound frames: `ws.subscribe` and
         // `app.publish` go through Bun's own (uWebSockets) broadcast instead of the JS registry loop.
         // A mounted app counts only while it has a WebSocket route (see `[GET_WS_RUNTIME]`), so composing
@@ -4232,8 +4378,8 @@ export class Server {
         // upgrades owns a different TopicRegistry, so force the per-connection JS dispatcher and carry
         // that registry in the upgrade outcome instead of accidentally broadcasting child sockets through
         // the parent.
-        const nativePubsub = this.wsRouteCount > 0 && !this.mountsTakeUpgrades() && !this.wsHasValidatedSend;
-        const wsHandlers = wsRuntime?.bunHandlers(this.topics ?? wsRuntime.createTopics(), nativePubsub);
+        const nativePubsub = this.wsRoutes.length > 0 && !this.mountsTakeUpgrades() && !this.wsHasValidatedSend;
+        const wsHandlers = wsRuntime?.bunHandlers(this.topics ?? wsRuntime.createTopics(), nativePubsub, this);
         // Spread rather than pass `hostname: undefined` (or an undefined idle timeout or TLS) - Bun treats
         // an explicit undefined as a value on some option paths, and omitting is what selects its own
         // defaults, 0.0.0.0 among them.
@@ -4279,8 +4425,9 @@ export class Server {
                 // `unknown` params bridge a TS structural-variance quirk. Round-trip covered by websocket.test.ts.
                 websocket: {
                     // Cap inbound frames so a huge message can't be buffered/JSON-parsed into memory; the runtime
-                    // closes an over-cap connection before the handler runs. Default 1 MB (maxBodyBytes).
-                    maxPayloadLength: this.wsMaxPayloadBytes,
+                    // closes an over-cap connection before the handler runs. Default 1 MB (maxBodyBytes). One
+                    // limit per listener: the largest cap among this app and the apps mounted on it.
+                    maxPayloadLength: wsHandlers.maxPayloadLength,
                     open: (ws) => wsHandlers.open(ws),
                     message: (ws, message) => wsHandlers.message(ws, message),
                     close: (ws, code, reason) => wsHandlers.close(ws, code, reason),
@@ -4299,7 +4446,7 @@ export class Server {
         }
         this.sealed = true;
         if (this.gracefulSignals)
-            this.installSignalHandlers();
+            this.installSignalHandlers(this.gracefulSignals);
         return running;
     }
     /**
@@ -4332,12 +4479,12 @@ export class Server {
             new Promise((resolve) => setTimeout(resolve, STOP_HOOK_TIMEOUT_MS)),
         ]);
     }
-    installSignalHandlers() {
+    installSignalHandlers(drain) {
         // Drain, then let the process exit naturally - the stopped server no longer
         // holds the event loop open. Opt-in (`gracefulSignals`), so taking over the
         // signals is consented; we don't force `process.exit`.
         const onSignal = () => {
-            void this.stop();
+            void this.stop(drain);
         };
         process.once("SIGTERM", onSignal);
         process.once("SIGINT", onSignal);