@nifrajs/web 3.5.0 → 4.0.0

package/src/internal/page-execution.ts

@@ -1,4 +1,9 @@
-import type { ResponseResult } from "@nifrajs/core/server"
+import {
+  type BackendPlatformBinder,
+  NIFRA_BACKEND_BIND_PLATFORM,
+  NIFRA_PLATFORM_CLIENT_IP_DERIVED,
+} from "@nifrajs/core/mount"
+import { type Platform, type ResponseResult, status as statusResult } from "@nifrajs/core/server"
 import {
   type BoundaryRequestCtx,
   type BoundaryStates,
@@ -7,23 +12,29 @@ import {
   type StaticBoundaryCache,
   startDynamicBoundaries,
 } from "../boundary.ts"
+import type { CspPolicy } from "../csp.ts"
 import { type CssLoadingMode, DEFAULT_CSS_LOADING, normalizeCssLoading } from "../css-contract.ts"
 import { defer, ndjsonStream, prepareDeferred } from "../deferred.ts"
 import { isDraftEnabled } from "../draft.ts"
+import { routeTags } from "../isr.ts"
 import type {
   LayoutEntry,
   LoaderContext,
   Manifest,
   Meta,
   MetaArgs,
+  NotFoundEntry,
   RouteEntry,
   RouteModule,
+  ShouldRevalidate,
 } from "../manifest.ts"
-import type { RenderAdapter } from "../render-seam.ts"
+import type { NonceResolver } from "../nonce.ts"
+import type { MatchChain, RenderAdapter } from "../render-seam.ts"
 import {
   createMatcher,
   DATA_HEADER,
   NAV_FROM_HEADER,
+  REDIRECT_HEADER,
   RETAIN_HEADER,
   REVALIDATE_HEADER,
   STATUS_HEADER,
@@ -31,10 +42,10 @@ import {
 import { searchOf, searchOfChain } from "../search.ts"
 import { mergeHeads, resolveMeta } from "./head-merge.ts"
 import {
-  actionResponse,
   EMPTY_RETAIN,
   type HeadersLike,
   isControlFlow,
+  isResponseResult,
   isStatusSignal,
   type LoadedLayoutModules,
   layoutErrorId,
@@ -50,18 +61,114 @@ import {
   withDuplicateInstanceHint,
 } from "./render-document.ts"
 import { urlPartsFor } from "./request-url.ts"
+import {
+  ACTION_SCOPE,
+  type CoreResponseControls,
+  DATA_RESPONSE_HEADERS,
+  MIDDLEWARE_SCOPE,
+  PAGE_SCOPE,
+  PageResponseControls,
+  PRIVATE_NO_STORE,
+  PRIVATE_PAGE_HEADERS,
+  privateOutcome,
+  varyOnDataHeader,
+} from "./response-controls.ts"
 
-/** Resolve the CSP nonce for one document request. Return `undefined` to omit nonce attributes. */
-export type NonceResolver<Env = unknown> = (ctx: {
-  readonly request: Request
-  readonly env: Env
-}) => string | undefined | Promise<string | undefined>
+export type { NonceResolver } from "../nonce.ts"
 
 /** Structural context supplied by the core server to one page route handler. */
 export interface PageRouteContext<Env = unknown> {
   readonly params: Record<string, string>
   readonly req: Request
   readonly env: Env
+  /** The serving app's response controls; a loader's `ctx.set` queues its cookies through them. */
+  readonly set: CoreResponseControls
+  /** The visitor's IP as the serving app derived it; forwarded to a request-bound `ctx.api`. */
+  readonly clientIp?: string | undefined
+  readonly waitUntil?: (promise: Promise<unknown>) => void
+}
+
+/** The page slot of an `ssr = false` route with no `HydrateFallback`: a component that renders nothing. */
+const EMPTY_LEAF = (): null => null
+
+/** The request-scoping seam of an in-process `api` (see `inProcessClient`), if it carries one. */
+function platformBinderOf(api: unknown): BackendPlatformBinder | undefined {
+  if ((typeof api !== "object" && typeof api !== "function") || api === null) return undefined
+  const bind = (api as { [NIFRA_BACKEND_BIND_PLATFORM]?: unknown })[NIFRA_BACKEND_BIND_PLATFORM]
+  return typeof bind === "function" ? (bind as BackendPlatformBinder) : undefined
+}
+
+/**
+ * The page request's platform identity for loader calls: `clientIp` (read lazily, so a backend that
+ * never reads `c.clientIp` never pays the socket lookup), `env` and `waitUntil` - and nothing else. The
+ * page request's headers (cookie, authorization) never travel; a loader passes them explicitly if it
+ * wants an authenticated call. The prototype marker tells the backend its `clientIp` is already derived,
+ * so its own trust declaration does not re-read forwarding headers the synthesized request does not
+ * carry; a spread copy drops both the getter and the marker, so it falls back to re-deriving.
+ */
+class LoaderPlatform {
+  readonly env: unknown
+  readonly waitUntil: ((promise: Promise<unknown>) => void) | undefined
+  readonly #c: PageRouteContext<unknown>
+  constructor(c: PageRouteContext<unknown>) {
+    this.#c = c
+    this.env = c.env
+    this.waitUntil = c.waitUntil
+  }
+  get clientIp(): string | undefined {
+    return this.#c.clientIp
+  }
+}
+;(LoaderPlatform.prototype as { [NIFRA_PLATFORM_CLIENT_IP_DERIVED]?: true })[
+  NIFRA_PLATFORM_CLIENT_IP_DERIVED
+] = true
+
+/**
+ * A redirect answering a data request (a client navigation or form submit), as the client router reads
+ * one: fetch would follow a 3xx and hand the router another page's data, so the target rides
+ * `x-nifra-redirect` on a 204 that keeps the redirect's own headers. `undefined` for any other outcome
+ * or request.
+ */
+function dataRedirect(req: Request, outcome: unknown): Response | ResponseResult | undefined {
+  if (req.headers.get(DATA_HEADER) === null) return undefined
+  if (isResponseResult(outcome)) {
+    const plain = outcome.plain
+    if (plain === undefined) return dataRedirect(req, outcome.toResponse())
+    if (plain.status < 300 || plain.status >= 400) return undefined
+    const { location, ...own } = plain.headers ?? {}
+    if (location === undefined) return undefined
+    return statusResult(204, undefined, {
+      headers: {
+        ...own,
+        [REDIRECT_HEADER]: appTarget(location, req.url),
+        ...DATA_RESPONSE_HEADERS,
+      },
+    })
+  }
+  if (!(outcome instanceof Response) || outcome.status < 300 || outcome.status >= 400) {
+    return undefined
+  }
+  const location = outcome.headers.get("location")
+  if (location === null) return undefined
+  const headers = new Headers(outcome.headers)
+  headers.delete("location")
+  headers.delete("content-length")
+  headers.set(REDIRECT_HEADER, appTarget(location, req.url))
+  for (const [name, value] of Object.entries(DATA_RESPONSE_HEADERS)) headers.set(name, value)
+  return new Response(null, { status: 204, headers })
+}
+
+/** A same-origin target as a path, which the client router can follow without loading a document. */
+function appTarget(location: string, requestUrl: string): string {
+  let target: URL
+  try {
+    target = new URL(location, requestUrl)
+  } catch {
+    return location // the browser fails on it the same way when it loads it
+  }
+  return target.origin === new URL(requestUrl).origin
+    ? target.pathname + target.search + target.hash
+    : location
 }
 
 export interface PageExecutionOptions<Env = unknown> {
@@ -76,10 +183,16 @@ export interface PageExecutionOptions<Env = unknown> {
   readonly routeStyles?: Readonly<Record<string, readonly string[]>>
   readonly cssLoading?: CssLoadingMode
   readonly prerenderedPaths?: readonly string[]
+  /** Where pages fetch {@link prerenderedPaths} from when the list is too large to inline. */
+  readonly prerenderedListUrl?: string
   readonly staticFallbacks?: Readonly<Record<string, "ssr" | "404">>
   readonly staticBoundaryCache?: StaticBoundaryCache
   /** Per-request CSP nonce for framework-owned executable document scripts. */
   readonly nonce?: NonceResolver<Env>
+  /** A hash-based CSP policy: every document is rendered under it, carrying `nonce` only when needed. */
+  readonly csp?: CspPolicy
+  /** Set once a cache wrapper attaches; until then a route's freshness and tags stay off the response. */
+  readonly cacheChannel?: { readonly enabled: boolean }
   readonly onLoaderError?: (
     error: unknown,
     ctx: {
@@ -95,7 +208,34 @@ type PageResponse = Response | ResponseResult | RenderedPage
 export interface PageRequestExecutor<Env = unknown> {
   get(route: RouteEntry): (ctx: PageRouteContext<Env>) => Promise<PageResponse>
   post(route: RouteEntry): (ctx: PageRouteContext<Env>) => Promise<PageResponse>
-  notFound(request: Request, env: Env, path?: string): Promise<PageResponse>
+  /** Answer a URL no route matched: the nearest nested `_404` for it, else the root one. */
+  fallback(ctx: PageRouteContext<Env>): Promise<PageResponse>
+}
+
+/** One URL pattern a nested `_404` answers, as the executor indexes it. */
+interface NotFoundTarget {
+  readonly id: string
+  readonly page: NotFoundEntry
+  /** The pattern's param names in order; the index holds them by position. */
+  readonly names: readonly string[]
+  /** The page's layout chain as a route, so layouts, gates and boundaries run as they do for one. */
+  readonly route: RouteEntry
+}
+
+/** The browser's side of a client navigation: the page it is leaving and the layout slots it holds. */
+type RetainContext = {
+  readonly requested: ReadonlySet<number>
+  readonly from: RouteEntry
+  readonly fromParams: Readonly<Record<string, string>>
+  readonly fromUrl: URL
+  readonly toUrl: URL
+}
+
+type LayoutRun = {
+  readonly modules: LoadedLayoutModules
+  readonly layoutData: readonly unknown[] | undefined
+  readonly retained: readonly number[]
+  readonly pending: Promise<unknown> | undefined
 }
 
 /**
@@ -111,14 +251,66 @@ export function createPageRequestExecutor<Env = unknown>(
   options: PageExecutionOptions<Env>,
 ): PageRequestExecutor<Env> {
   const { adapter, manifest, clientEntry, api } = options
+  // Bound once per render, so every loader, action and boundary in that render shares one view of the
+  // in-process client carrying the visitor's platform. An `api` without the seam passes through as-is.
+  const bindApi = platformBinderOf(api)
+  // One view per render, shared by every loader, action and boundary it runs.
+  const apiFor = (c: PageRouteContext<Env>): unknown =>
+    bindApi === undefined ? api : bindApi.call(api, new LoaderPlatform(c) as Platform)
   const cssLoading = normalizeCssLoading(options.cssLoading ?? DEFAULT_CSS_LOADING)
   const titleOption = options.title === undefined ? {} : { title: options.title }
+  const cspOption = options.csp === undefined ? {} : { csp: options.csp }
   const prerenderedSet = new Set(options.prerenderedPaths ?? [])
+  const prerenderedHandover =
+    options.prerenderedListUrl === undefined
+      ? { prerenderedPaths: options.prerenderedPaths ?? [] }
+      : { prerenderedListUrl: options.prerenderedListUrl }
   const matchManifestRoute = createMatcher(
     manifest.routes.map((route) => ({ routeId: route.id, pattern: route.pattern })),
   )
   const routeById = new Map(manifest.routes.map((route) => [route.id, route]))
 
+  // A nested `_404` answers an unmatched URL from inside the catch-all, never as a route of its own:
+  // a registered `/admin/*` would take URLs from a route the router only reaches by backtracking.
+  // Param names are indexed by position, so two directories that name one segment differently share
+  // the index; each target keeps its own names to read a match back.
+  const notFoundTargets: NotFoundTarget[] = []
+  const notFoundPatterns: Array<{ routeId: string; pattern: string }> = []
+  for (const [id, page] of Object.entries(manifest.notFounds ?? {})) {
+    for (const scope of page.scopes) {
+      const names: string[] = []
+      const pattern = scope.pattern.replace(
+        /([:*])([A-Za-z_][A-Za-z0-9_]*)/g,
+        (_match, sigil: string, name: string) => `${sigil}p${names.push(name) - 1}`,
+      )
+      notFoundPatterns.push({ routeId: String(notFoundTargets.length), pattern })
+      notFoundTargets.push({
+        id,
+        page,
+        names,
+        route: {
+          id,
+          pattern: scope.pattern,
+          layoutIds: page.layoutIds,
+          layoutParams: scope.layoutParams,
+          ...(page.middlewareIds === undefined
+            ? {}
+            : {
+                middlewareIds: page.middlewareIds,
+                ...(scope.middlewareParams === undefined
+                  ? {}
+                  : { middlewareParams: scope.middlewareParams }),
+              }),
+          errorIds: page.errorIds,
+          file: page.file,
+          load: page.load,
+        },
+      })
+    }
+  }
+  const matchNotFoundScope =
+    notFoundPatterns.length === 0 ? undefined : createMatcher(notFoundPatterns)
+
   const draftFlag = (req: Request): Promise<boolean> =>
     options.draftSecret === undefined
       ? Promise.resolve(false)
@@ -161,34 +353,49 @@ export function createPageRequestExecutor<Env = unknown>(
     return modules
   }
 
+  // No modules, data, or per-request state: reuse the settled result for page-only routes.
+  const emptyLayoutRun: LayoutRun = {
+    modules: [],
+    layoutData: undefined,
+    retained: [],
+    pending: undefined,
+  }
+
   /** Run layout loaders, awaiting gates before starting the page loader and retaining only safe data. */
   const runLayoutChain = async (
     route: RouteEntry,
     ctx: LoaderContext,
-    retain: ReadonlySet<number> = new Set(),
-  ): Promise<{
-    readonly modules: LoadedLayoutModules
-    readonly layoutData: readonly unknown[] | undefined
-    readonly retained: readonly number[]
-    readonly pending: Promise<unknown>
-  }> => {
+    controls: PageResponseControls,
+    retain?: RetainContext,
+  ): Promise<LayoutRun> => {
+    if (route.layoutIds.length === 0) return emptyLayoutRun
     const modules = await loadLayoutModules(route)
     if (!modules.some((m) => m.loader !== undefined)) {
-      return { modules, layoutData: undefined, retained: [], pending: Promise.resolve() }
+      return { modules, layoutData: undefined, retained: [], pending: undefined }
     }
     const results: unknown[] = new Array(modules.length).fill(null)
     const retained: number[] = []
     const pending: Array<Promise<void>> = []
     for (let i = 0; i < modules.length; i++) {
-      const loader = modules[i]?.loader
+      const layout = modules[i] as LoadedLayoutModules[number]
+      const loader = layout.loader
       if (loader === undefined) continue
-      if (retain.has(i) && modules[i]?.gate !== true) {
-        retained.push(i)
-        continue
+      if (retain !== undefined && layout.gate !== true) {
+        let keep: boolean
+        try {
+          keep = keepsLayoutData(route, i, layout, ctx.params, retain)
+        } catch (err) {
+          throw tagLayoutError(err, route.layoutIds[i] as string)
+        }
+        if (keep) {
+          retained.push(i)
+          continue
+        }
       }
       const scoped: LoaderContext = {
         ...ctx,
         params: scopeParams(ctx.params, route.layoutParams?.[i]),
+        set: controls.scope(i),
       }
       if (modules[i]?.gate === true) {
         try {
@@ -200,23 +407,40 @@ export function createPageRequestExecutor<Env = unknown>(
       }
       const layoutId = route.layoutIds[i] as string
       const index = i
-      pending.push(
-        (async () => {
-          try {
-            results[index] = await loader(scoped)
-          } catch (err) {
-            throw tagLayoutError(err, layoutId)
-          }
-        })(),
-      )
+      try {
+        const value = loader(scoped)
+        // Scalars settle synchronously. Objects keep await's intrinsic promise/thenable
+        // assimilation: property-presence and prototype probes are unsafe for proxies.
+        if (value !== null && (typeof value === "object" || typeof value === "function")) {
+          pending.push(
+            (async () => {
+              try {
+                results[index] = await value
+              } catch (err) {
+                throw tagLayoutError(err, layoutId)
+              }
+            })(),
+          )
+        } else results[index] = value
+      } catch (err) {
+        // Preserve a synchronous throw as a pending layout failure, just like the async lane.
+        pending.push(Promise.reject(tagLayoutError(err, layoutId)))
+      }
+    }
+    return {
+      modules,
+      layoutData: results,
+      retained,
+      pending:
+        pending.length === 0 ? undefined : pending.length === 1 ? pending[0] : Promise.all(pending),
     }
-    return { modules, layoutData: results, retained, pending: Promise.all(pending) }
   }
 
   /** Run only authorization gates before an action; ordinary layout data runs after a native action. */
   const runLayoutGates = async (
     route: RouteEntry,
     ctx: LoaderContext,
+    controls: PageResponseControls,
   ): Promise<LoadedLayoutModules> => {
     const modules = await loadLayoutModules(route)
     for (let i = 0; i < modules.length; i++) {
@@ -226,6 +450,7 @@ export function createPageRequestExecutor<Env = unknown>(
         await mod.loader({
           ...ctx,
           params: scopeParams(ctx.params, route.layoutParams?.[i]),
+          set: controls.scope(i),
         })
       } catch (err) {
         throw tagLayoutError(err, route.layoutIds[i] as string)
@@ -234,6 +459,47 @@ export function createPageRequestExecutor<Env = unknown>(
     return modules
   }
 
+  /** Outermost first; a failure carries its directory so the nearest `_error` above it renders. */
+  const runMiddleware = async (
+    route: RouteEntry,
+    ctx: LoaderContext,
+    controls: PageResponseControls,
+  ): Promise<void> => {
+    const ids = route.middlewareIds ?? []
+    for (let i = 0; i < ids.length; i++) {
+      const id = ids[i] as string
+      const entry = manifest.middlewares?.[id] as LayoutEntry
+      const dirTag = `${id.slice(0, id.length - "_middleware".length)}_layout`
+      let outcome: unknown
+      try {
+        const middleware = (await entry.load()).default
+        // A `_layout.backend.ts` that exports no middleware is a layout data module, nothing more.
+        if (middleware === undefined) continue
+        if (typeof middleware !== "function") {
+          throw new Error(
+            `[nifra/web] "${entry.file}" exports a middleware that is not a function.`,
+          )
+        }
+        outcome = await middleware({
+          ...ctx,
+          params: scopeParams(ctx.params, route.middlewareParams?.[i]),
+          set: controls.scope(MIDDLEWARE_SCOPE + i),
+        })
+      } catch (err) {
+        throw tagLayoutError(err, dirTag)
+      }
+      if (outcome === undefined) continue
+      throw tagLayoutError(
+        isControlFlow(outcome)
+          ? outcome
+          : new Error(
+              `[nifra/web] the middleware in "${entry.file}" returned a value. Middleware returns nothing to let the request through, or a redirect(), a status such as notFound(), or a Response to answer it.`,
+            ),
+        dirTag,
+      )
+    }
+  }
+
   const retainedIndices = (header: string | null): ReadonlySet<number> => {
     if (header === null || header === "") return EMPTY_RETAIN
     const out = new Set<number>()
@@ -244,43 +510,61 @@ export function createPageRequestExecutor<Env = unknown>(
     return out
   }
 
-  const validatedRetainedIndices = (
-    req: Request,
-    route: RouteEntry,
-    params: Readonly<Record<string, string>>,
-  ): ReadonlySet<number> => {
-    if (req.headers.get(DATA_HEADER) === null) return EMPTY_RETAIN
+  /**
+   * The browser's side of a client navigation: the page it is leaving and the layout slots it asked
+   * to keep. Undefined unless this is a data request whose `from` is same-origin and routable.
+   */
+  const retainContextOf = (req: Request): RetainContext | undefined => {
+    if (req.headers.get(DATA_HEADER) === null) return undefined
     const requested = retainedIndices(req.headers.get(RETAIN_HEADER))
     const from = req.headers.get(NAV_FROM_HEADER)
-    if (requested.size === 0 || from === null) return EMPTY_RETAIN
-    let fromPath: string
+    if (requested.size === 0 || from === null) return undefined
+    let toUrl: URL
+    let fromUrl: URL
     try {
-      const current = new URL(req.url)
-      const source = new URL(from, current)
-      if (source.origin !== current.origin) return EMPTY_RETAIN
-      fromPath = source.pathname + source.search
+      toUrl = new URL(req.url)
+      fromUrl = new URL(from, toUrl)
     } catch {
-      return EMPTY_RETAIN
+      return undefined
     }
-    const previousMatch = matchManifestRoute(fromPath)
-    if (previousMatch === null) return EMPTY_RETAIN
+    if (fromUrl.origin !== toUrl.origin) return undefined
+    const previousMatch = matchManifestRoute(fromUrl.pathname + fromUrl.search)
+    if (previousMatch === null) return undefined
     const previous = routeById.get(previousMatch.routeId)
-    if (previous === undefined) return EMPTY_RETAIN
-    const valid = new Set<number>()
-    for (const index of requested) {
-      if (route.layoutIds[index] !== previous.layoutIds[index]) continue
-      const owned = route.layoutParams?.[index] ?? []
-      const previouslyOwned = previous.layoutParams?.[index] ?? []
-      if (
-        owned.length !== previouslyOwned.length ||
-        owned.some((name, i) => name !== previouslyOwned[i]) ||
-        owned.some((name) => params[name] !== previousMatch.params[name])
-      ) {
-        continue
-      }
-      valid.add(index)
-    }
-    return valid
+    if (previous === undefined) return undefined
+    return { requested, from: previous, fromParams: previousMatch.params, fromUrl, toUrl }
+  }
+
+  /** A query change re-runs layout loaders by default: any can read it, and none declares keys. */
+  const keepsLayoutData = (
+    route: RouteEntry,
+    index: number,
+    layout: LoadedLayoutModules[number],
+    params: Readonly<Record<string, string>>,
+    retain: RetainContext,
+  ): boolean => {
+    if (!retain.requested.has(index)) return false
+    const previous = retain.from
+    if (route.layoutIds[index] !== previous.layoutIds[index]) return false
+    const owned = route.layoutParams?.[index] ?? []
+    const previouslyOwned = previous.layoutParams?.[index] ?? []
+    const defaultShouldRevalidate =
+      retain.fromUrl.search !== retain.toUrl.search ||
+      owned.length !== previouslyOwned.length ||
+      owned.some((name, i) => name !== previouslyOwned[i]) ||
+      owned.some((name) => params[name] !== retain.fromParams[name])
+    const decide = layout.shouldRevalidate
+    if (typeof decide !== "function") return !defaultShouldRevalidate
+    // Copies, so a hook that mutates its arguments cannot reach the request's params or the next
+    // layout's view of the navigation.
+    const answer = (decide as ShouldRevalidate)({
+      currentUrl: new URL(retain.fromUrl),
+      nextUrl: new URL(retain.toUrl),
+      currentParams: { ...retain.fromParams },
+      nextParams: { ...params },
+      defaultShouldRevalidate,
+    })
+    return answer === false
   }
 
   const loaderSearch = (searchSchema: RouteModule["searchSchema"], request: Request) =>
@@ -296,12 +580,25 @@ export function createPageRequestExecutor<Env = unknown>(
       urlPartsFor(request).search,
     )
 
+  // `ssr = false`: the slot holds `HydrateFallback`, which the browser hydrates before the page.
+  const serverLeafOf = (route: RouteEntry, mod: RouteModule): unknown => {
+    if (mod.ssr !== false) return mod.default
+    if (mod.hydrate === false) {
+      throw new Error(
+        `[nifra/web] route "${route.id}" sets both \`ssr = false\` and \`hydrate = false\`: the ` +
+          "server skips its component and no client would ever render it. Remove one of the two.",
+      )
+    }
+    return mod.HydrateFallback ?? EMPTY_LEAF
+  }
+
   const resolveChainAndHead = (
     layoutModules: LoadedLayoutModules,
     page: RouteModule,
     metaArgs: MetaArgs,
+    leaf: unknown = page.default,
   ): { chain: unknown[]; head: Meta } => {
-    const chain = [...layoutModules.map((m) => m.default), page.default]
+    const chain = [...layoutModules.map((m) => m.default), leaf]
     const heads = [
       ...layoutModules.map((m) => resolveMeta(m.meta, metaArgs)),
       resolveMeta(page.meta, metaArgs),
@@ -309,6 +606,17 @@ export function createPageRequestExecutor<Env = unknown>(
     return { chain, head: mergeHeads(heads) }
   }
 
+  /** What `useMatches` reports for a chain: the layouts' ids and `handle`s, then the page's. */
+  const matchChainOf = (
+    layoutIds: readonly string[],
+    layoutModules: LoadedLayoutModules,
+    pageId: string,
+    page: { readonly handle?: unknown },
+  ): MatchChain => ({
+    ids: [...layoutIds, pageId],
+    handles: [...layoutModules.map((layout) => layout.handle), page.handle],
+  })
+
   const dirOfId = (id: string, suffix: string): string =>
     id === suffix ? "" : id.slice(0, id.length - suffix.length - 1)
 
@@ -345,6 +653,7 @@ export function createPageRequestExecutor<Env = unknown>(
     route: RouteEntry,
     errorId: string,
     err: unknown,
+    personalized: boolean,
     nonce?: string,
   ): Promise<PageResponse> => {
     const errDir = dirOfId(errorId, "_error")
@@ -359,15 +668,21 @@ export function createPageRequestExecutor<Env = unknown>(
     )
     const { default: errComp } = await (manifest.errors?.[errorId] as LayoutEntry).load()
     const e = err instanceof Error ? err : new Error(String(err))
+    // An error's text can carry a connection string or a query, so a production page gets neither.
+    const production = typeof process === "undefined" || process.env.NODE_ENV === "production"
     return renderPageResult({
       adapter,
       chain: [...layouts, errComp],
-      data: { name: e.name, message: e.message },
+      data: production
+        ? { name: "Error", message: "Internal Server Error" }
+        : { name: e.name, message: e.message },
       clientEntry,
       routeId: errorId,
       status: 500,
       hydrate: false,
+      ...(personalized ? { headers: PRIVATE_PAGE_HEADERS } : {}),
       ...(nonce === undefined ? {} : { nonce }),
+      ...cspOption,
       ...titleOption,
     })
   }
@@ -388,6 +703,7 @@ export function createPageRequestExecutor<Env = unknown>(
     const loaded = (await page.load()) as {
       readonly default: unknown
       readonly searchSchema?: RouteModule["searchSchema"]
+      readonly handle?: unknown
     }
     return renderPageResult({
       adapter,
@@ -395,6 +711,7 @@ export function createPageRequestExecutor<Env = unknown>(
       data: null,
       clientEntry,
       routeId,
+      matchChain: { ids: [routeId], handles: [loaded.handle] },
       ...(path !== undefined
         ? {
             search: searchOf(
@@ -407,9 +724,10 @@ export function createPageRequestExecutor<Env = unknown>(
       status,
       ...(extraHeaders !== undefined ? { headers: extraHeaders } : {}),
       ...(nonce === undefined ? {} : { nonce }),
+      ...cspOption,
       ...preloadOf(routeId),
       ...stylesOf(routeId),
-      prerenderedPaths: options.prerenderedPaths ?? [],
+      ...prerenderedHandover,
       ...titleOption,
     })
   }
@@ -418,14 +736,29 @@ export function createPageRequestExecutor<Env = unknown>(
     req: Request,
     env: Env,
     signal: StatusSignal,
+    personalized: boolean,
   ): Promise<PageResponse> => {
     const { status, headers } = signal[STATUS_SIGNAL]
     if (req.headers.get(DATA_HEADER) !== null) {
+      // Same URL as the status page, so it is never storable: a cache keyed on the URL alone would
+      // otherwise answer a document request with this empty body.
       const responseHeaders = new Headers(headers)
       responseHeaders.set(STATUS_HEADER, String(status))
+      responseHeaders.set("cache-control", PRIVATE_NO_STORE)
+      responseHeaders.set("vary", varyOnDataHeader(responseHeaders.get("vary")))
       return new Response(null, { status, headers: responseHeaders })
     }
-    return renderTerminalStatus(status, pathOf(req), headers, await resolveNonce(req, env))
+    const nonce = await resolveNonce(req, env)
+    if (headers === undefined && !personalized) {
+      return renderTerminalStatus(status, pathOf(req), undefined, nonce)
+    }
+    const documentHeaders = new Headers(headers)
+    if (headers !== undefined) {
+      documentHeaders.set("vary", varyOnDataHeader(documentHeaders.get("vary")))
+    }
+    // A cookie queued before the signal makes the status page specific to this visitor.
+    if (personalized) documentHeaders.set("cache-control", PRIVATE_NO_STORE)
+    return renderTerminalStatus(status, pathOf(req), documentHeaders, nonce)
   }
 
   const reportLoaderError = (
@@ -454,8 +787,10 @@ export function createPageRequestExecutor<Env = unknown>(
     layoutRetained: readonly number[],
     boundaryStates: BoundaryStates | undefined,
     assemblyCache: RenderAssemblyCache | undefined,
+    responseHeaders: Record<string, string> | undefined,
+    personalized: boolean,
   ): Promise<PageResponse> => {
-    if (isStatusSignal(data)) return renderStatusSignal(req, env, data)
+    if (isStatusSignal(data)) return renderStatusSignal(req, env, data, personalized)
     if (isControlFlow(data)) return data
     if (req.headers.get(DATA_HEADER) !== null) {
       const pageSplit = prepareDeferred(data)
@@ -483,18 +818,29 @@ export function createPageRequestExecutor<Env = unknown>(
               retained: layoutRetained,
               ...(boundarySplit === undefined ? {} : { boundaries: boundarySplit.forClient }),
             }
-      if (allDeferred.length === 0) return Response.json(payload ?? null)
+      if (allDeferred.length === 0) {
+        return Response.json(payload ?? null, { headers: DATA_RESPONSE_HEADERS })
+      }
       return new Response(ndjsonStream(payload, allDeferred), {
-        headers: { "content-type": "application/x-ndjson; charset=utf-8" },
+        headers: {
+          "content-type": "application/x-ndjson; charset=utf-8",
+          ...DATA_RESPONSE_HEADERS,
+        },
       })
     }
 
-    const { chain, head } = resolveChainAndHead(layoutModules, mod, {
-      data,
-      params,
-      origin: originOf(req),
-    })
     const nonce = options.nonce === undefined ? undefined : await resolveNonce(req, env)
+    const { chain, head } = resolveChainAndHead(
+      layoutModules,
+      mod,
+      {
+        data,
+        params,
+        origin: originOf(req),
+        ...(nonce === undefined ? {} : { nonce }),
+      },
+      serverLeafOf(route, mod),
+    )
     try {
       return await renderPageResult({
         adapter,
@@ -506,27 +852,169 @@ export function createPageRequestExecutor<Env = unknown>(
         params,
         path: pathOf(req),
         search: searchChainOf(layoutModules, mod, req),
+        matchChain: matchChainOf(route.layoutIds, layoutModules, route.id, mod),
         hydrate: mod.hydrate !== false,
         ...(layoutData !== undefined ? { layoutData } : {}),
         ...(boundaryStates !== undefined ? { boundaries: boundaryStates } : {}),
         ...preloadOf(route.id),
         ...stylesOf(route.id),
-        prerenderedPaths: options.prerenderedPaths ?? [],
-        ...(mod.revalidate !== undefined ? { revalidate: mod.revalidate } : {}),
-        ...(mod.revalidateTags !== undefined ? { revalidateTags: mod.revalidateTags } : {}),
+        ...prerenderedHandover,
+        ...(responseHeaders === undefined ? {} : { headers: responseHeaders }),
+        // A response that sets a cookie is one visitor's: it never advertises ISR freshness.
+        ...(mod.revalidate !== undefined && !personalized && options.cacheChannel?.enabled === true
+          ? { revalidate: mod.revalidate }
+          : {}),
+        ...(mod.revalidateTags !== undefined &&
+        !personalized &&
+        options.cacheChannel?.enabled === true
+          ? {
+              revalidateTags: routeTags(
+                mod.revalidateTags,
+                { params, url: new URL(req.url) },
+                route.id,
+              ),
+            }
+          : {}),
         ...(mod.islandScripts !== undefined ? { islandScripts: mod.islandScripts } : {}),
         ...(nonce === undefined ? {} : { nonce }),
+        ...cspOption,
         ...titleOption,
         ...(assemblyCache === undefined ? {} : { assemblyCache }),
       })
     } catch (err) {
-      if (isStatusSignal(err)) return renderStatusSignal(req, env, err)
+      if (isStatusSignal(err)) return renderStatusSignal(req, env, err, personalized)
       if (isControlFlow(err)) throw err
       reportLoaderError(route, req, { ...params }, err)
       const errorId = boundaryFor(route, err)
       if (errorId === undefined) throw err
-      return renderError(route, errorId, withDuplicateInstanceHint(err), nonce)
+      return renderError(route, errorId, withDuplicateInstanceHint(err), personalized, nonce)
+    }
+  }
+
+  /** What a failed loader answers with, once a status signal has been ruled out. */
+  const renderLoaderFailure = async (
+    route: RouteEntry,
+    req: Request,
+    env: Env,
+    params: Record<string, string>,
+    err: unknown,
+    personalized: boolean,
+  ): Promise<PageResponse> => {
+    if (isControlFlow(err)) throw err
+    reportLoaderError(route, req, params, err)
+    const errorId = boundaryFor(route, err)
+    if (errorId === undefined) throw err
+    if (req.headers.get(DATA_HEADER) !== null) {
+      return new Response("Internal Server Error", {
+        status: 500,
+        headers: { "content-type": "text/plain; charset=utf-8" },
+      })
     }
+    return renderError(
+      route,
+      errorId,
+      withDuplicateInstanceHint(err),
+      personalized,
+      options.nonce === undefined ? undefined : await resolveNonce(req, env),
+    )
+  }
+
+  /**
+   * Render a nested `_404` inside its layouts. `layoutModules` and `layoutData` are exactly the
+   * layouts at or above the page, their gates already passed.
+   */
+  const renderNestedNotFound = async (
+    req: Request,
+    env: Env,
+    id: string,
+    page: NotFoundEntry,
+    params: Readonly<Record<string, string>>,
+    layoutModules: LoadedLayoutModules,
+    layoutData: readonly unknown[] | undefined,
+    personalized: boolean,
+    signalHeaders?: HeadersLike,
+  ): Promise<PageResponse> => {
+    // The page can show what a layout loaded for this visitor, and a 404 is storable by default.
+    const isPrivate = personalized || layoutData !== undefined
+    if (req.headers.get(DATA_HEADER) !== null) {
+      // No status header: the page has no client chunk, so the navigation falls back to loading the
+      // URL as a document, which renders it here.
+      const headers = new Headers(signalHeaders)
+      headers.set("cache-control", PRIVATE_NO_STORE)
+      headers.set("vary", varyOnDataHeader(headers.get("vary")))
+      return new Response(null, { status: 404, headers })
+    }
+    const mod = await page.load()
+    const nonce = options.nonce === undefined ? undefined : await resolveNonce(req, env)
+    const { chain, head } = resolveChainAndHead(layoutModules, mod, {
+      data: null,
+      params,
+      origin: originOf(req),
+      ...(nonce === undefined ? {} : { nonce }),
+    })
+    let headers: Headers | undefined
+    if (signalHeaders !== undefined || isPrivate) {
+      headers = new Headers(signalHeaders)
+      if (signalHeaders !== undefined) headers.set("vary", varyOnDataHeader(headers.get("vary")))
+      if (isPrivate) headers.set("cache-control", PRIVATE_NO_STORE)
+    }
+    return renderPageResult({
+      adapter,
+      chain,
+      data: null,
+      head,
+      clientEntry,
+      routeId: id,
+      params,
+      path: pathOf(req),
+      search: searchChainOf(layoutModules, mod, req),
+      matchChain: matchChainOf(page.layoutIds, layoutModules, id, mod),
+      status: 404,
+      hydrate: false,
+      ...(layoutData !== undefined ? { layoutData } : {}),
+      ...stylesOf(id),
+      ...(headers === undefined ? {} : { headers }),
+      ...(nonce === undefined ? {} : { nonce }),
+      ...cspOption,
+      ...titleOption,
+    })
+  }
+
+  /** The nearest nested `_404` for the route's own `notFound()`, else `undefined` (root page). */
+  const renderRouteNotFound = async (
+    req: Request,
+    env: Env,
+    route: RouteEntry,
+    params: Readonly<Record<string, string>>,
+    signal: StatusSignal,
+    run: LayoutRun | undefined,
+    personalized: boolean,
+  ): Promise<PageResponse | undefined> => {
+    const id = route.notFoundIds?.at(-1)
+    if (id === undefined || run === undefined) return undefined
+    if (signal[STATUS_SIGNAL].status !== 404 || layoutErrorId(signal) !== undefined) {
+      return undefined
+    }
+    const page = manifest.notFounds?.[id]
+    if (page === undefined) return undefined
+    try {
+      await run.pending
+    } catch {
+      return undefined
+    }
+    // The page's layouts are the leading ones of the route's: its directory contains the route.
+    const kept = page.layoutIds.length
+    return renderNestedNotFound(
+      req,
+      env,
+      id,
+      page,
+      params,
+      run.modules.slice(0, kept),
+      run.layoutData?.slice(0, kept),
+      personalized,
+      signal[STATUS_SIGNAL].headers,
+    )
   }
 
   const renderNotFound = async (
@@ -544,6 +1032,33 @@ export function createPageRequestExecutor<Env = unknown>(
     )
   }
 
+  /**
+   * Run a page handler with the request's `ctx.set`, sealed once the handler settles - whatever it
+   * answered with - so a write that arrives after the response was decided throws. A request that
+   * queued a cookie answers with a response no shared cache may store, returned or thrown. A redirect
+   * answering a data request, returned or thrown, reaches the client router intact.
+   */
+  const withResponseControls =
+    (run: (c: PageRouteContext<Env>, controls: PageResponseControls) => Promise<PageResponse>) =>
+    async (c: PageRouteContext<Env>): Promise<PageResponse> => {
+      const controls = new PageResponseControls(c)
+      try {
+        const outcome = await run(c, controls)
+        const answer = dataRedirect(c.req, outcome) ?? outcome
+        return controls.personalized ? (privateOutcome(answer) as PageResponse) : answer
+      } catch (err) {
+        if (!isControlFlow(err)) throw err
+        const answer = dataRedirect(c.req, err)
+        // Returned rather than rethrown: the serving app sends a thrown `Response` exactly as it is,
+        // without the cookies the request queued.
+        if (controls.personalized) return privateOutcome(answer ?? err) as PageResponse
+        if (answer !== undefined) return answer
+        throw err
+      } finally {
+        controls.seal()
+      }
+    }
+
   return {
     get: (route) => {
       const is404Fallback = options.staticFallbacks?.[route.pattern] === "404"
@@ -568,32 +1083,35 @@ export function createPageRequestExecutor<Env = unknown>(
         return assemblySlot
       }
 
-      return async (c: PageRouteContext<Env>) => {
+      return withResponseControls(async (c, controls) => {
         if (is404Fallback && !prerenderedSet.has(urlPartsFor(c.req).pathname)) {
           return renderNotFound(c.req, c.env, pathOf(c.req))
         }
         const mod = await route.load()
         const draft = await draftFlag(c.req)
+        // Unpublished content is the editor's alone: whatever cache-control a loader sets, no cache keeps it.
+        if (draft) controls.personalize()
         let data: unknown
         let layoutData: readonly unknown[] | undefined
         let boundaryStates: BoundaryStates | undefined
         let layoutModules: LoadedLayoutModules | undefined
         let layoutRetained: readonly number[] = []
+        let responseHeaders: Record<string, string> | undefined
+        const requestApi = apiFor(c)
+        let run: LayoutRun | undefined
         try {
           const ctx: LoaderContext = {
             params: c.params,
             request: c.req,
             req: c.req,
-            api,
+            api: requestApi,
             env: c.env,
             draft,
             search: loaderSearch(mod.searchSchema, c.req),
+            set: controls.scope(PAGE_SCOPE),
           }
-          const run = await runLayoutChain(
-            route,
-            ctx,
-            validatedRetainedIndices(c.req, route, c.params),
-          )
+          if (route.middlewareIds !== undefined) await runMiddleware(route, ctx, controls)
+          run = await runLayoutChain(route, ctx, controls, retainContextOf(c.req))
           layoutModules = run.modules
           layoutRetained = run.retained
           const boundaryDefinitions = [
@@ -608,7 +1126,7 @@ export function createPageRequestExecutor<Env = unknown>(
               : startDynamicBoundaries(boundaryDefinitions, {
                   request: c.req,
                   params: c.params,
-                  api,
+                  api: requestApi,
                   env: c.env,
                   draft,
                   search: effectiveSearch,
@@ -616,17 +1134,19 @@ export function createPageRequestExecutor<Env = unknown>(
                 } satisfies BoundaryRequestCtx)
           const staticBoundaryPromise =
             boundaryDefinitions.length === 0
-              ? Promise.resolve(undefined)
+              ? undefined
               : resolveStaticBoundaries(
                   boundaryDefinitions,
-                  { phase: "build", origin: originOf(c.req) },
+                  { phase: "build" },
                   options.staticBoundaryCache,
                 )
-          const [pageData, , staticBoundaries] = await Promise.all([
-            mod.loader ? mod.loader({ ...ctx, search: effectiveSearch }) : null,
-            run.pending,
-            staticBoundaryPromise,
-          ])
+          const pageResult = mod.loader ? mod.loader({ ...ctx, search: effectiveSearch }) : null
+          const [pageData, , staticBoundaries] =
+            run.pending === undefined && staticBoundaryPromise === undefined
+              ? ([await pageResult, undefined, undefined] as const)
+              : staticBoundaryPromise === undefined
+                ? await Promise.all([pageResult, run.pending])
+                : await Promise.all([pageResult, run.pending, staticBoundaryPromise])
           data = pageData
           layoutData = run.layoutData
           if (boundaryBatch !== undefined) {
@@ -640,24 +1160,36 @@ export function createPageRequestExecutor<Env = unknown>(
           } else if (staticBoundaries !== undefined) {
             boundaryStates = staticBoundaries
           }
+          // Inside the loader `try`: a header the response cannot carry is a loader error, rendered
+          // by the same boundary as one.
+          responseHeaders = controls.documentHeaders()
         } catch (err) {
-          if (isStatusSignal(err)) return renderStatusSignal(c.req, c.env, err)
-          if (isControlFlow(err)) throw err
-          reportLoaderError(route, c.req, c.params, err)
-          const errorId = boundaryFor(route, err)
-          if (errorId === undefined) throw err
-          if (c.req.headers.get(DATA_HEADER) !== null) {
-            return new Response("Internal Server Error", {
-              status: 500,
-              headers: { "content-type": "text/plain; charset=utf-8" },
-            })
+          if (isStatusSignal(err)) {
+            return (
+              (await renderRouteNotFound(
+                c.req,
+                c.env,
+                route,
+                c.params,
+                err,
+                run,
+                controls.personalized,
+              )) ?? renderStatusSignal(c.req, c.env, err, controls.personalized)
+            )
           }
-          return renderError(
+          return renderLoaderFailure(route, c.req, c.env, c.params, err, controls.personalized)
+        }
+        if (isStatusSignal(data)) {
+          const nested = await renderRouteNotFound(
+            c.req,
+            c.env,
             route,
-            errorId,
-            withDuplicateInstanceHint(err),
-            options.nonce === undefined ? undefined : await resolveNonce(c.req, c.env),
+            c.params,
+            data,
+            run,
+            controls.personalized,
           )
+          if (nested !== undefined) return nested
         }
         return handleDataOrDocument(
           c.req,
@@ -671,91 +1203,169 @@ export function createPageRequestExecutor<Env = unknown>(
           layoutRetained,
           boundaryStates,
           layoutModules === undefined ? undefined : assemblyCacheFor(mod, layoutModules),
+          responseHeaders,
+          controls.personalized,
         )
-      }
+      })
     },
 
-    post: (route) => async (c) => {
-      const mod = await route.load()
-      const draft = await draftFlag(c.req)
-      if (mod.action === undefined) {
-        return new Response("Method Not Allowed", {
-          status: 405,
-          headers: { allow: "GET", "content-type": "text/plain; charset=utf-8" },
+    post: (route) =>
+      withResponseControls(async (c, controls) => {
+        const mod = await route.load()
+        const draft = await draftFlag(c.req)
+        if (draft) controls.personalize()
+        if (mod.action === undefined) {
+          return new Response("Method Not Allowed", {
+            status: 405,
+            headers: { allow: "GET", "content-type": "text/plain; charset=utf-8" },
+          })
+        }
+        const requestApi = apiFor(c)
+        const actionContext: LoaderContext = {
+          params: c.params,
+          request: c.req,
+          req: c.req,
+          api: requestApi,
+          env: c.env,
+          draft,
+          search: loaderSearch(mod.searchSchema, c.req),
+          set: controls.scope(ACTION_SCOPE),
+        }
+        const isDataRequest = c.req.headers.get(DATA_HEADER) !== null
+        let layoutModules: LoadedLayoutModules
+        let result: unknown
+        try {
+          if (route.middlewareIds !== undefined) await runMiddleware(route, actionContext, controls)
+          layoutModules = await runLayoutGates(route, actionContext, controls)
+          result = await mod.action(actionContext)
+        } catch (err) {
+          if (isControlFlow(err)) return err
+          throw err
+        }
+        const isRevalidate =
+          result !== null && typeof result === "object" && "__nifraRevalidate" in result
+        const actionResult = isRevalidate ? (result as RevalidateResult<unknown>).data : result
+        const revalidateHeader: Record<string, string> = isRevalidate
+          ? {
+              [REVALIDATE_HEADER]: (result as RevalidateResult<unknown>).__nifraRevalidate.join(
+                ",",
+              ),
+            }
+          : {}
+        if (isControlFlow(actionResult)) return actionResult
+        if (isDataRequest) {
+          // Headers shape the document only, but a bad one fails here too, so a navigation and a full
+          // page load agree on whether the action's response is valid.
+          controls.commit()
+          const { forClient, deferred } = prepareDeferred(actionResult)
+          if (deferred.length === 0) {
+            return Response.json(actionResult ?? null, {
+              headers: { ...DATA_RESPONSE_HEADERS, ...revalidateHeader },
+            })
+          }
+          return new Response(ndjsonStream(forClient, deferred), {
+            headers: {
+              "content-type": "application/x-ndjson; charset=utf-8",
+              ...DATA_RESPONSE_HEADERS,
+              ...revalidateHeader,
+            },
+          })
+        }
+        const search = searchChainOf(layoutModules, mod, c.req)
+        const data = mod.loader
+          ? await mod.loader({
+              params: c.params,
+              request: c.req,
+              req: c.req,
+              api: requestApi,
+              env: c.env,
+              draft,
+              search,
+              set: controls.scope(PAGE_SCOPE),
+            })
+          : null
+        const responseHeaders = controls.documentHeaders()
+        const nonce = options.nonce === undefined ? undefined : await resolveNonce(c.req, c.env)
+        const { chain, head } = resolveChainAndHead(
+          layoutModules,
+          mod,
+          {
+            data,
+            params: c.params,
+            origin: originOf(c.req),
+            ...(nonce === undefined ? {} : { nonce }),
+          },
+          serverLeafOf(route, mod),
+        )
+        return renderPageResult({
+          adapter,
+          chain,
+          data,
+          actionData: actionResult,
+          head,
+          clientEntry,
+          routeId: route.id,
+          params: c.params,
+          path: pathOf(c.req),
+          search,
+          matchChain: matchChainOf(route.layoutIds, layoutModules, route.id, mod),
+          hydrate: mod.hydrate !== false,
+          ...preloadOf(route.id),
+          ...stylesOf(route.id),
+          ...prerenderedHandover,
+          ...(responseHeaders === undefined ? {} : { headers: responseHeaders }),
+          ...(nonce === undefined ? {} : { nonce }),
+          ...cspOption,
+          ...titleOption,
         })
+      }),
+
+    fallback: withResponseControls(async (c, controls) => {
+      const match = matchNotFoundScope?.(pathOf(c.req)) ?? null
+      const target = match === null ? undefined : notFoundTargets[Number(match.routeId)]
+      if (match === null || target === undefined) {
+        return renderNotFound(c.req, c.env, pathOf(c.req))
       }
-      const actionContext: LoaderContext = {
-        params: c.params,
-        request: c.req,
-        req: c.req,
-        api,
-        env: c.env,
-        draft,
-        search: loaderSearch(mod.searchSchema, c.req),
+      const params: Record<string, string> = {}
+      for (let i = 0; i < target.names.length; i++) {
+        params[target.names[i] as string] = match.params[`p${i}`] as string
       }
-      const isDataRequest = c.req.headers.get(DATA_HEADER) !== null
-      let layoutModules: LoadedLayoutModules
-      let result: unknown
+      const mod = await target.page.load()
+      const draft = await draftFlag(c.req)
+      if (draft) controls.personalize()
+      let run: LayoutRun
       try {
-        layoutModules = await runLayoutGates(route, actionContext)
-        result = await mod.action(actionContext)
+        const ctx: LoaderContext = {
+          params,
+          request: c.req,
+          req: c.req,
+          api: apiFor(c),
+          env: c.env,
+          draft,
+          search: loaderSearch(mod.searchSchema, c.req),
+          set: controls.scope(PAGE_SCOPE),
+        }
+        if (target.route.middlewareIds !== undefined) {
+          await runMiddleware(target.route, ctx, controls)
+        }
+        run = await runLayoutChain(target.route, ctx, controls)
+        await run.pending
       } catch (err) {
-        if (isControlFlow(err)) return actionResponse(err, isDataRequest)
-        throw err
-      }
-      const isRevalidate =
-        result !== null && typeof result === "object" && "__nifraRevalidate" in result
-      const actionResult = isRevalidate ? (result as RevalidateResult<unknown>).data : result
-      const revalidateHeader: Record<string, string> = isRevalidate
-        ? { [REVALIDATE_HEADER]: (result as RevalidateResult<unknown>).__nifraRevalidate.join(",") }
-        : {}
-      if (isControlFlow(actionResult)) return actionResponse(actionResult, isDataRequest)
-      if (isDataRequest) {
-        const { forClient, deferred } = prepareDeferred(actionResult)
-        if (deferred.length === 0)
-          return Response.json(actionResult ?? null, { headers: revalidateHeader })
-        return new Response(ndjsonStream(forClient, deferred), {
-          headers: { "content-type": "application/x-ndjson; charset=utf-8", ...revalidateHeader },
-        })
+        if (isStatusSignal(err)) {
+          return renderStatusSignal(c.req, c.env, err, controls.personalized)
+        }
+        return renderLoaderFailure(target.route, c.req, c.env, params, err, controls.personalized)
       }
-      const search = searchChainOf(layoutModules, mod, c.req)
-      const data = mod.loader
-        ? await mod.loader({
-            params: c.params,
-            request: c.req,
-            req: c.req,
-            api,
-            env: c.env,
-            draft,
-            search,
-          })
-        : null
-      const { chain, head } = resolveChainAndHead(layoutModules, mod, {
-        data,
-        params: c.params,
-        origin: originOf(c.req),
-      })
-      const nonce = options.nonce === undefined ? undefined : await resolveNonce(c.req, c.env)
-      return renderPageResult({
-        adapter,
-        chain,
-        data,
-        actionData: actionResult,
-        head,
-        clientEntry,
-        routeId: route.id,
-        params: c.params,
-        path: pathOf(c.req),
-        search,
-        hydrate: mod.hydrate !== false,
-        ...preloadOf(route.id),
-        ...stylesOf(route.id),
-        prerenderedPaths: options.prerenderedPaths ?? [],
-        ...(nonce === undefined ? {} : { nonce }),
-        ...titleOption,
-      })
-    },
-
-    notFound: renderNotFound,
+      return renderNestedNotFound(
+        c.req,
+        c.env,
+        target.id,
+        target.page,
+        params,
+        run.modules,
+        run.layoutData,
+        controls.personalized,
+      )
+    }),
   }
 }