@pulse-compute/runtime 1.0.0-beta.5 → 1.0.0-beta.6

package/README.md

@@ -7,9 +7,9 @@
 > **Supported entry points:** `@pulse-compute/runtime`<br>
 > **Stability:** Supported application authoring and execution contract.<br>
 > **npm:** [`@pulse-compute/runtime`](https://www.npmjs.com/package/@pulse-compute/runtime)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.5/packages/runtime/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/runtime/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.5` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
 `@pulse-compute/runtime` is the low-level, provider-neutral Pulse application contract.

package/docs/API.md

@@ -1,17 +1,17 @@
 # Pulse runtime contract
 
 For source eligibility, use [Managed handler TypeScript and
-JavaScript](https://pulsecompute.io/v1.0.0-beta.5/reference/handler-authoring/). For provider and target
+JavaScript](https://pulsecompute.io/v1.0.0-beta.6/reference/handler-authoring/). For provider and target
 differences, use the [compatibility
-matrix](https://pulsecompute.io/v1.0.0-beta.5/reference/compatibility-matrix/). For CLI and runtime failures,
+matrix](https://pulsecompute.io/v1.0.0-beta.6/reference/compatibility-matrix/). For CLI and runtime failures,
 use the stable codes in the [diagnostics
-reference](https://pulsecompute.io/v1.0.0-beta.5/reference/diagnostics/).
+reference](https://pulsecompute.io/v1.0.0-beta.6/reference/diagnostics/).
 
 This document describes the provider-neutral TypeScript application contract compiled by Pulse. Low-level authoring types and the static `Router` come from `@pulse-compute/runtime`. The public `@pulse-compute/pulse` package owns the conventional `Pulse` application root, deferred project configuration, and schema declarations, while `@pulse-compute/cli` owns workspace orchestration.
 
 `@pulse-compute/runtime` is the low-level portable application surface and
 `@pulse-compute/pulse` is the conventional project surface. Both belong to the
-14-package public release catalog. Native and JavaScript execution remain
+19-package public release catalog. Native and JavaScript execution remain
 explicitly selected targets over the same canonical runtime contract.
 
 ## Context at a glance
@@ -52,7 +52,7 @@ Every managed handler is async-shaped:
 type Handler = (ctx: PulseContext) => Promise<PulseResult | PulseFetchResponse>
 ```
 
-For native targets the compiler erases the async wrapper. Awaited Pulse effects lower into the existing explicit effect and continuation state machine; no Promise runtime or Asyncify transform is linked. Awaiting a proven synchronous `ctx` expression is redundant and may warn, while arbitrary non-Pulse awaits mark the native eligibility boundary. The canonical [handler authoring reference](https://pulsecompute.io/v1.0.0-beta.5/reference/handler-authoring/) defines the static language subset; the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.5/reference/compatibility-matrix/) owns the tested four-mode claims.
+For native targets the compiler erases the async wrapper. Awaited Pulse effects lower into the existing explicit effect and continuation state machine; no Promise runtime or Asyncify transform is linked. Awaiting a proven synchronous `ctx` expression is redundant and may warn, while arbitrary non-Pulse awaits mark the native eligibility boundary. The canonical [handler authoring reference](https://pulsecompute.io/v1.0.0-beta.6/reference/handler-authoring/) defines the static language subset; the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.6/reference/compatibility-matrix/) owns the tested four-mode claims.
 
 ## Static `Router`
 
@@ -140,9 +140,9 @@ eligibility. Fastly targets fail closed because no event ingress/emit adapter is
 claimed. There is no public event injection command, no event-aware development
 listener, no HTTP/GRIP translation, and no automatic target fallback.
 
-The [static events guide](https://pulsecompute.io/v1.0.0-beta.5/guides/events/) owns the complete frame,
+The [static events guide](https://pulsecompute.io/v1.0.0-beta.6/guides/events/) owns the complete frame,
 queue, target-eligibility, diagnostic, and Native-extension contract. The
-source-bound [event example](https://pulsecompute.io/v1.0.0-beta.5/examples/11-events/) runs the same mixed project
+source-bound [event example](https://pulsecompute.io/v1.0.0-beta.6/examples/11-events/) runs the same mixed project
 on Node JavaScript and Node Native.
 
 ## `ctx.req`
@@ -154,6 +154,8 @@ interface PulseRequest {
   readonly path: string
   readonly headers: readonly [string, string][]
   header(name: string): string | undefined
+  body(): PulseIncomingBody
+  readTextChunk(): PulseEffect<{ readonly done: boolean; readonly text: string }>
   text(): PulseEffect<string>
   json<T = unknown>(schemaId?: string): PulseEffect<T>
 }
@@ -161,6 +163,15 @@ interface PulseRequest {
 
 Structured request bodies are bounded runtime-owned snapshots. Repeated `text()` and `json()` reads are memoized immutable transforms.
 
+`body()` is an opaque incoming handle under the Node `bodyForwarding` opt-in;
+it grants no reader or binary inspection. `readTextChunk()` belongs only to the
+experimental Node `bodyTransform` opt-in, with generated output and a finite
+deadline. It excludes forwarding and structured body reads. Both Fastly targets
+reject these capabilities. The [bodies guide](https://pulsecompute.io/v1.0.0-beta.6/concepts/bodies/) owns the
+byte/read/write limits and separates installed output qualification from pending
+installed transform qualification. The production `/server` launcher remains
+qualified for finite HTTP, as described in [Node deployment](https://pulsecompute.io/v1.0.0-beta.6/guides/deploying-node/).
+
 ### Request metadata and headers
 
 ```ts
@@ -392,7 +403,7 @@ its matching UTC string. A failed sample has `status: 'failed'` and reason
 `'unavailable'` or `'invalid-clock'`. Direct awaited calls and keyed parallel
 members are supported on Node/Fastly Native and JavaScript. Wall time can regress
 and is separate from monotonic deadlines and exact commit timestamps. See the
-[complete result contract](https://pulsecompute.io/v1.0.0-beta.5/packages/runtime/#wall-time).
+[complete result contract](https://pulsecompute.io/v1.0.0-beta.6/packages/runtime/#wall-time).
 
 ## Config and secrets
 
@@ -465,7 +476,7 @@ projects the value, then returns detached JSON text bounded by `schemas.maxBytes
 in UTF-8 bytes. It does not create a response or dispatch an effect. Invalid
 values and oversized text fail before subsequent writes. Declaration order and
 array order are preserved; cross-target parity is semantic, not a universal
-canonical-byte format. See [application-owned encoding](https://pulsecompute.io/v1.0.0-beta.5/guides/json-schemas/#encode-application-owned-text).
+canonical-byte format. See [application-owned encoding](https://pulsecompute.io/v1.0.0-beta.6/guides/json-schemas/#encode-application-owned-text).
 
 ## `ctx.decodeJson`
 
@@ -478,7 +489,7 @@ be a string within `schemas.maxBytes` UTF-8 bytes. Decoding returns a detached,
 deeply immutable value with declared fields only. It performs no effect and
 does not apply HTTP content-type policy. Keep the original text for hashing,
 verification and retries; decoding does not establish byte canonicalization or
-storage acceptance. See [application text decoding](https://pulsecompute.io/v1.0.0-beta.5/guides/json-schemas/#decode-application-owned-text).
+storage acceptance. See [application text decoding](https://pulsecompute.io/v1.0.0-beta.6/guides/json-schemas/#decode-application-owned-text).
 
 ## Explicit JSON schemas
 
@@ -521,12 +532,12 @@ forms lower into canonical package operations; JavaScript targets execute the
 real package implementation.
 
 Older `/pulsewasm` imports are compatibility-only and are isolated in the
-[migration guide](https://pulsecompute.io/v1.0.0-beta.5/guides/compatibility-imports/). See the
-[GRIP package guide](https://pulsecompute.io/v1.0.0-beta.5/packages/grip/) for the complete current surface.
+[migration guide](https://pulsecompute.io/v1.0.0-beta.6/guides/compatibility-imports/). See the
+[GRIP package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/grip/) for the complete current surface.
 
 ## Entities API
 
-`@pulse-compute/entities` is part of the synchronized `1.0.0-beta.5` package
+`@pulse-compute/entities` is part of the synchronized `1.0.0-beta.6` package
 set. The application surface has two runtime values:
 
 ```ts
@@ -588,9 +599,9 @@ Registrations and the terminal binding must use the supported static form. The
 first-party JSON-RPC adapter accepts bounded JSON-RPC 2.0 request objects and
 named params, validates declared schemas, uses stable error framing, and
 acknowledges notifications with HTTP `204`. See the [package
-guide](https://pulsecompute.io/v1.0.0-beta.5/packages/entities/), [entity/adapter
-model](https://pulsecompute.io/v1.0.0-beta.5/concepts/entities-and-adapters/), and [executable
-example](https://pulsecompute.io/v1.0.0-beta.5/examples/10-entities-tools/).
+guide](https://pulsecompute.io/v1.0.0-beta.6/packages/entities/), [entity/adapter
+model](https://pulsecompute.io/v1.0.0-beta.6/concepts/entities-and-adapters/), and [executable
+example](https://pulsecompute.io/v1.0.0-beta.6/examples/10-entities-tools/).
 
 ## Project workflow
 
@@ -607,5 +618,5 @@ selected profile, handler entry, schema declarations, provider bindings, and
 output directory through `.pulse/config.ts`. `pulse inspect` is optional
 observability, and `pulse compile` is the advanced provider-neutral Native
 artifact command; neither is required before `pulse build`. See the [project
-lifecycle guide](https://pulsecompute.io/v1.0.0-beta.5/guides/project-lifecycle/) and [CLI
-reference](https://pulsecompute.io/v1.0.0-beta.5/reference/cli/).
+lifecycle guide](https://pulsecompute.io/v1.0.0-beta.6/guides/project-lifecycle/) and [CLI
+reference](https://pulsecompute.io/v1.0.0-beta.6/reference/cli/).

package/docs/guides/routing.md

@@ -1,6 +1,6 @@
 # Static Router authoring
 
-Use `Router` when an application has several method/path entry points or needs compile-time middleware. It is a static authoring marker from `@pulse-compute/runtime`, not a JavaScript runtime dispatcher. The shared async/static restrictions are defined in [Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.5/reference/handler-authoring/); target claims live in the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.5/reference/compatibility-matrix/).
+Use `Router` when an application has several method/path entry points or needs compile-time middleware. It is a static authoring marker from `@pulse-compute/runtime`, not a JavaScript runtime dispatcher. The shared async/static restrictions are defined in [Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.6/reference/handler-authoring/); target claims live in the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.6/reference/compatibility-matrix/).
 
 <!-- pulse-doc-source: examples/09-router-lowering/src/index.ts -->
 ```ts
@@ -105,6 +105,43 @@ acceptance only; they do not implement Catalog persistence or authorization.
 node wasm/scripts/run-wasm-tests.cjs --task catalog-router-parity --no-report
 ```
 
+## Selected groups
+
+Mount a group once after earlier selectors have set request-local state:
+
+```ts
+app.mount('/api', collection, { state: 'read-family', equals: 'collection' })
+```
+
+The optional third argument is an inline object containing exactly `state` and
+`equals`, both string literals. At this mount's ordered position, the request
+path must match and `ctx.state.get('read-family') === 'collection'` must hold.
+An absent or unequal value skips every child owner and effect directly to the
+parent continuation. Selection is not authorization; keep authorization in its
+existing owner.
+
+A match enters the child once. Child `next()` still advances to the next sibling,
+and exhaustion joins the parent continuation once. Terminal responses and ordered
+local/parent error handling keep their existing semantics. A suspended effect
+resumes inside the child; changing selection state there does not reevaluate the
+mount. Method, path and parameter scoping are unchanged. An empty selected child
+continues immediately.
+
+This form is supported by live JavaScript and canonical Native compilation.
+Eligibility does not accept callbacks, calls, getters, spreads, computed keys,
+descriptor references or dynamic values. Unsupported source receives
+`PULSEWASM_UNSUPPORTED_MOUNT_ELIGIBILITY`; historical table/harness emitters also
+reject selected mounts rather than ignoring them. Two-argument mounts are
+unchanged. The group remains one placement with one existing parent continuation.
+
+The `router-selected-groups` task checks exclusion, suspension after a state
+change, terminal/error paths, nested parameters and one common tail on live
+JavaScript and compiled Node/Fastly Native (Fastly uses its local ABI mock host).
+
+```sh
+node wasm/scripts/run-wasm-tests.cjs --task router-selected-groups --no-report
+```
+
 ## `next()` is a terminal transfer
 
 `next()` is not an onion-style callback. It is a compiler-visible control transfer:
@@ -157,6 +194,11 @@ identical messages, stacks, causes or detail fields across providers.
 | JWT input and verification | `PULSE_JWT_TOKEN_REQUIRED`, `PULSE_JWT_BEARER_INVALID`, `PULSE_JWT_MALFORMED`, `PULSE_JWT_LIMIT_EXCEEDED`, `PULSE_JWT_ALGORITHM_NOT_ALLOWED`, `PULSE_JWT_KEY_INVALID`, `PULSE_JWT_SIGNATURE_INVALID` |
 | JWT claims | `PULSE_JWT_CLOCK_INVALID`, `PULSE_JWT_CLAIMS_INVALID`, `PULSE_JWT_CLAIMS_SCHEMA_INVALID` |
 
+These admitted `error.code` values remain stable through redaction, including
+when a secret, KV key or array index overlaps their spelling. Messages, stacks,
+causes, details and arbitrary provider error codes remain subject to redaction.
+This preserves the existing recovery catalog; it does not admit new failures.
+
 Recovery moves forward in registration order, including through mounted
 routers. A failed handler never resumes. An error handler can return a response,
 forward with `return next(error)`, or clear the error lane with `return next()`.

package/docs/preview-scope.md

@@ -1,6 +1,6 @@
 # Beta scope
 
-Pulse `1.0.0-beta.5` is a Beta of one provider-neutral application contract
+Pulse `1.0.0-beta.6` is a Beta of one provider-neutral application contract
 with explicit Native and JavaScript execution targets. The intended 1.0
 surface is present, but deliberate corrections may still occur before the
 stable `1.0.0` release.
@@ -19,7 +19,7 @@ targets.
   wildcards, and acyclic mounts.
 - Basic branching and structured object, array, and scalar manipulation.
 - Literal-capped pure `for` loops and zero-argument string `.trim()` across
-  Native and JavaScript; see [bounded application values](https://pulsecompute.io/v1.0.0-beta.5/concepts/compilation-and-lowering/#bounded-application-values).
+  Native and JavaScript; see [bounded application values](https://pulsecompute.io/v1.0.0-beta.6/concepts/compilation-and-lowering/#bounded-application-values).
 - Request method, URL, path, headers, text, and JSON access.
 - Bounded, memoized structured body decoding.
 - Explicit TypeScript JSON schema declarations and literal schema IDs.
@@ -77,8 +77,10 @@ JavaScript-selected project into a Native one.
 
 ## Deliberately unsupported
 
-- Effectful or unbounded loops, arbitrary callback transformations, and Native
-  pure-helper calls. Pure loop bodies cannot transfer from the handler.
+- Unbounded loops, arbitrary callback transformations and Native helper shapes
+  outside the supported bounded subset. Effectful loops are limited to the
+  experimental finite Node output/transform forms in the [bodies guide](https://pulsecompute.io/v1.0.0-beta.6/concepts/bodies/);
+  other loop bodies must stay within the admitted pure forms.
 
 - Automatic fallback from Native lowering to JavaScript execution.
 - Declaring general target availability without satisfying every declared
@@ -93,7 +95,9 @@ JavaScript-selected project into a Native one.
 - Automatic discovery of arbitrary TypeScript types.
 - Dynamic schema IDs.
 - Arbitrary binary body inspection or mutation.
-- Userland chunk iteration, transform streams, or manual backpressure.
+- General userland chunk iteration, transform streams, or manual backpressure.
+  Experimental finite Node UTF-8 output/transforms are explicit bounded opt-ins,
+  not general stream support or production-launcher qualification.
 - Background tasks and work that outlives the request.
 - Raw TCP or UDP sockets.
 - Dynamic GRIP channel, framing-option, or message shapes under Native
@@ -111,13 +115,13 @@ JavaScript-selected project into a Native one.
 ## Compatibility authority
 
 The single source-form, provider-binding, artifact, and deployment-boundary
-table is [Provider and target compatibility](https://pulsecompute.io/v1.0.0-beta.5/reference/compatibility-matrix/).
+table is [Provider and target compatibility](https://pulsecompute.io/v1.0.0-beta.6/reference/compatibility-matrix/).
 It uses one public target order—Node JavaScript, Fastly JavaScript, Node Native,
 and Fastly Native—and links every row to a focused proof or canonical contract.
 
 The exact portable language subset and the JavaScript-only Native eligibility
 boundaries are defined in
-[Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.5/reference/handler-authoring/).
+[Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.6/reference/handler-authoring/).
 
 ## Body model
 
@@ -141,7 +145,7 @@ pass it through → opaque handle
 - Package names, release artifacts, and published versions are immutable once
   released.
 
-The intended npm dist-tag for the Beta is `beta`. It becomes
-active only through the atomic documentation-release transaction and an
-explicitly authorized publication. The workflow never assigns `latest`
-implicitly.
+The release manifest explicitly selects the npm `latest` dist-tag while package
+versions retain the Beta prerelease suffix. The npm tag and Git branch are
+separate names. Publication remains a distinct human-authorized action; this
+support cleanup does not change that policy.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/runtime",
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -41,7 +41,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "packages/runtime"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.5/packages/runtime/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.6/packages/runtime/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   }

package/src/host.d.ts

@@ -177,6 +177,8 @@ export interface PulseJavascriptEffectSummary {
 
 /** Maintainer bridge used by the managed Router lifecycle and focused adapter tests. */
 export interface PulseJavascriptEffectExecution {
+  /** Host/runtime admission fence; rejects queued provider dispatch after an ownership conflict. */
+  invalidateAdmission(error: unknown): void;
   /** Execution-owned local projection. It participates in lifecycle containment but is not parallel-eligible. */
   local<T = unknown>(
     kind: string,
@@ -222,7 +224,23 @@ export declare function createRequestBudget(options?: {
   requestSignal?: AbortSignal;
 }): PulseRequestBudget;
 
+export interface PulseGeneratedOutputExecution {
+  readonly started: boolean;
+  readonly finished: boolean;
+  assertEffect(): void;
+  dispatch(effect: Readonly<Record<string, unknown>>): Promise<unknown>;
+  bindInput(input: PulseIncomingBodyOwnership | undefined): void;
+  close(factory?: (options: import('./index').PulseResponseOptions) => unknown): any;
+  validateResult(result: unknown): void;
+  finish(): Promise<void>;
+  cancel(reason?: unknown): void;
+  dispose(): void;
+}
 export interface PulseRuntimeExecutionOptions {
+  /** Provider-owned output authority; unavailable to application code. */
+  readonly outputExecution?: PulseGeneratedOutputExecution;
+  /** Provider-owned incoming stream controller; never an application capability. */
+  readonly incomingBody?: PulseIncomingBodyOwnership;
   /** Provider-owned total managed request budget, 1..30000 ms. Omitted preserves existing behavior. */
   readonly maxDurationMs?: number;
   /** Shared host budget; nested adapters must not restart or close an inherited budget. */
@@ -454,3 +472,24 @@ export declare function isApplicationError(error: unknown): boolean;
 export declare const WALL_TIME_MAX_MS: 253402300799999;
 export declare function readWallTime(clock?: (() => number) | null): PulseTimeResult;
 export declare function normalizeTimeResult(value: unknown): PulseTimeResult;
+
+/** Host-only lifecycle authority for one incoming request body. */
+export interface PulseIncomingBodyOwnership {
+  marker(): import('./index').PulseIncomingBody;
+  bindInvalidation(callback: (error: unknown) => void): void;
+  structured(): void;
+  readTextChunk(budget: PulseRequestBudget): Promise<{ readonly done: boolean; readonly text: string }>;
+  claim(marker: unknown, init: unknown): void;
+  forward(url: string, init: unknown, execution: PulseJavascriptEffectHostExecution): Promise<Response>;
+  close(): Promise<void>;
+  readonly failure: unknown;
+  readonly responseSignal?: AbortSignal;
+}
+export declare function createIncomingBodyOwnership(transport: {
+  readonly responseSignal?: AbortSignal;
+  readTextChunk?(budget: PulseRequestBudget): Promise<{ readonly done: boolean; readonly text: string }>;
+  validate(init: unknown): void;
+  forward(url: string, init: unknown, execution: PulseJavascriptEffectHostExecution): Promise<Response>;
+  cancel(reason?: unknown): unknown;
+}): PulseIncomingBodyOwnership;
+export declare function forwardIncomingBody(marker: unknown, url: string, init: unknown, execution: PulseJavascriptEffectHostExecution): Promise<Response>;

package/src/host.js

@@ -78,6 +78,8 @@ async function executeApplication(application, request, options = {}) {
 }
 
 module.exports = Object.freeze({
+  createIncomingBodyOwnership: require('./internal/incoming-body.js').createIncomingBodyOwnership,
+  forwardIncomingBody: require('./internal/incoming-body.js').forwardIncomingBody,
   ...require('./internal/time.js'),
   ...require('./internal/request-budget.js'),
   isApplicationError: require('./internal/errors.js').isApplicationError,

package/src/index.d.ts

@@ -2,6 +2,10 @@ export type HeaderPair = readonly [name: string, value: string];
 
 declare const pulseEffectBrand: unique symbol;
 declare const pulseParallelEffectBrand: unique symbol;
+declare const incomingBodyBrand: unique symbol;
+
+/** Single-use opaque marker, admitted only inline as a configured Node fetch body. */
+export interface PulseIncomingBody { readonly [incomingBodyBrand]: true; }
 
 export interface PulseEffect<T> extends Promise<T> {
   readonly [pulseEffectBrand]: T;
@@ -23,6 +27,9 @@ export interface PulseRequest {
   readonly path: string;
   readonly headers: readonly HeaderPair[];
   header(name: string): string | undefined;
+  body(): PulseIncomingBody;
+  /** Experimental finite UTF-8 transform input; Node bodyTransform opt-in required. */
+  readTextChunk(): PulseEffect<{ readonly done: boolean; readonly text: string }>;
   text(): PulseEffect<string>;
   json<T = unknown>(schemaId?: string): PulseEffect<T>;
 }
@@ -35,7 +42,7 @@ export interface PulseFetchInitBase {
 
 export type PulseFetchInit = PulseFetchInitBase & (
   | { readonly body?: never; readonly json?: never; readonly schema?: never }
-  | { readonly body: string; readonly json?: never; readonly schema?: never }
+  | { readonly body: string | PulseIncomingBody; readonly json?: never; readonly schema?: never }
   | { readonly body?: never; readonly json: unknown; readonly schema?: string }
 );
 
@@ -166,6 +173,12 @@ export interface PulseExecutionContext {
 
 /** HTTP request execution context. */
 export interface PulseContext extends PulseExecutionContext {
+  /** Experimental Node output: opt-in, finite, request-owned UTF-8 writes. */
+  readonly output: {
+    start(options?: PulseResponseOptions): PulseEffect<void>;
+    write(text: string): PulseEffect<void>;
+    close(): PulseResult;
+  };
   readonly req: PulseRequest;
   json(value: unknown, descriptor?: PulseJsonResponseOptions | string): PulseResult;
   text(value: string, options?: PulseResponseOptions): PulseResult;
@@ -218,7 +231,8 @@ export declare class Router {
   put(path: string, handler: RouteHandler): this;
   patch(path: string, handler: RouteHandler): this;
   delete(path: string, handler: RouteHandler): this;
-  mount(path: string, router: Router): this;
+  /** Enter the child once only when request state strictly equals the literal string; a miss skips the entire child. */
+  mount(path: string, router: Router, eligibility?: { readonly state: string; readonly equals: string }): this;
   error(handler: RouterErrorHandler): this;
 }
 

package/src/internal/body.js

@@ -200,7 +200,10 @@ function createStructuredBodyReader(owner, options = {}) {
 
   function bytes() {
     assertInspectable();
-    if (!bytesPromise) bytesPromise = readBodyBytes(owner, maxBytes, label, signal);
+    if (!bytesPromise) {
+      bytesPromise = readBodyBytes(owner, maxBytes, label, signal);
+      if (options.onReadSettled) bytesPromise = bytesPromise.finally(options.onReadSettled);
+    }
     return bytesPromise;
   }
 

package/src/internal/context.js

@@ -2,6 +2,8 @@
 
 const { createStructuredBodyReader, normalizeBodyLimit } = require('./body.js');
 const { normalizeFetchRequest } = require('./fetch.js');
+const { isIncomingBody } = require('./incoming-body.js');
+const { PulseRuntimeContractError } = require('./errors.js');
 const { decodeSchemaText, encodeSchemaValue, requireExplicitSchemaId, strictSchemaPolicy } = require('./schema.js');
 const {
   cloneKvValue,
@@ -20,6 +22,10 @@ const {
   projectFetchResponse
 } = require('./response.js');
 
+// Router entries create new contexts but share one effect execution. Keep fetch
+// numbering with that execution, without retaining completed requests.
+const fetchSequences = new WeakMap();
+
 function headersToPairs(headers) {
   const pairs = [];
   for (const [name, value] of headers.entries()) pairs.push(Object.freeze([name, value]));
@@ -35,6 +41,7 @@ function normalizeRequestHeaderPairs(headers, fallback) {
 }
 
 function createRequestView(request, requestHeaders, effectExecution, options = {}) {
+  options.incomingBody?.bindInvalidation(error => effectExecution.invalidateAdmission(error));
   const url = new URL(request.url);
   const headers = normalizeRequestHeaderPairs(requestHeaders, request.headers);
   const body = createStructuredBodyReader(request, {
@@ -52,16 +59,28 @@ function createRequestView(request, requestHeaders, effectExecution, options = {
     url: request.url,
     path: url.pathname || '/',
     headers,
+    body(...args) {
+      if (args.length) throw new TypeError('ctx.req.body takes no arguments.');
+      if (!options.incomingBody) throw new PulseRuntimeContractError(
+        'PULSE_REQUEST_FORWARDING_UNAVAILABLE', 'Incoming body forwarding requires the configured Node JavaScript provider.');
+      return options.incomingBody.marker();
+    },
+    readTextChunk(...args) {
+      if (args.length) throw new TypeError('ctx.req.readTextChunk takes no arguments.');
+      return effectExecution.dispatch({ kind: 'output.readTextChunk', providerKind: 'output', operation: 'readTextChunk', capability: 'request.body.transform', parallelEligible: false });
+    },
     header(name) {
       const lower = String(name).toLowerCase();
       const match = headers.find(([header]) => header.toLowerCase() === lower);
       return match ? match[1] : undefined;
     },
     text() {
+      options.incomingBody?.structured();
       if (!textEffect) textEffect = effectExecution.local('request.body.text', () => body.text());
       return textEffect;
     },
     json(schemaId) {
+      options.incomingBody?.structured();
       if (schemaId === undefined && !strictSchemaPolicy(options)) {
         if (!jsonEffect) jsonEffect = effectExecution.local('request.body.json', () => body.json());
         return jsonEffect;
@@ -145,7 +164,6 @@ function createContext(frame) {
     ...(frame.executionOptions || {}),
     signal: frame.signal
   });
-  let fetchSequence = 0;
   const log = createPulseLogger({
     reporting: options.reporting,
     redact(message) { return effects.redactValue(message); },
@@ -169,13 +187,24 @@ function createContext(frame) {
     state,
     log,
     fetch(url, init) {
-      fetchSequence += 1;
+      const fetchSequence = (fetchSequences.get(effects) || 0) + 1;
+      fetchSequences.set(effects, fetchSequence);
       const effectId = `fetch-${fetchSequence}`;
-      const fetchRequest = normalizeFetchRequest(url, init, {
-        ...options,
-        operationId: `fetch-request:${effectId}`,
-        effectId
-      });
+      let fetchRequest;
+      try {
+        fetchRequest = normalizeFetchRequest(url, init, {
+          ...options,
+          operationId: `fetch-request:${effectId}`,
+          effectId
+        });
+        if (fetchRequest.init.bodyMode === 'incoming-request-v1') {
+          if (!options.incomingBody) throw new PulseRuntimeContractError('PULSE_REQUEST_BODY_OWNERSHIP', 'Incoming body belongs to another execution.');
+          options.incomingBody.claim(fetchRequest.init.body, fetchRequest.init);
+        }
+      } catch (error) {
+        if (isIncomingBody(init?.body)) effects.invalidateAdmission(error);
+        throw error;
+      }
       const fetchEffect = effects.dispatch({
         id: effectId,
         kind: 'fetch',
@@ -266,6 +295,26 @@ function createContext(frame) {
   if (eventContext) {
     ctx.event = frame.event;
   } else {
+    const output = () => {
+      if (!options.outputExecution) throw new PulseRuntimeContractError('PULSE_OUTPUT_UNAVAILABLE', 'Generated output requires configured Node HTTP execution.');
+      return options.outputExecution;
+    };
+    ctx.output = Object.freeze({
+      start(...args) {
+        if (args.length > 1) throw new TypeError('output.start accepts one options object.');
+        output().assertEffect();
+        return effects.dispatch({ kind: 'output.start', providerKind: 'output', operation: 'start', capability: 'response.output', parallelEligible: false, argument0: args[0] });
+      },
+      write(...args) {
+        if (args.length !== 1) throw new TypeError('output.write requires one text chunk.');
+        output().assertEffect();
+        return effects.dispatch({ kind: 'output.write', providerKind: 'output', operation: 'write', capability: 'response.output', parallelEligible: false, argument0: args[0] });
+      },
+      close(...args) {
+        if (args.length) throw new TypeError('output.close accepts no arguments.');
+        return output().close(init => createTextResult('', init));
+      }
+    });
     ctx.json = (value, descriptor) => createJsonResult(value, descriptor, options);
     ctx.text = (value, responseOptions) => createTextResult(value, responseOptions);
     ctx.response = (input) => createResponseResult(input);

package/src/internal/effect-adapter.js

@@ -15,6 +15,7 @@ const { fetchRequestInitForHost } = require('./fetch.js');
 const { createRedactionState } = require('./redaction.js');
 const { validateSchemaValue } = require('./schema.js');
 const { EVENT_EMIT_CODES } = require('./event-emission.js');
+const { cancelResponseBody, retainFetchResponseForBudget, releaseFetchResponseCancellation } = require('./response.js');
 
 const JAVASCRIPT_EFFECT_PROTOCOL_VERSION = 'pulse.javascript-effect.v1';
 const JAVASCRIPT_EFFECT_ADAPTER_VERSION = 'pulse.javascript-effect-adapter.v1';
@@ -510,6 +511,7 @@ function createJavascriptEffectExecution(options = {}) {
   const counters = new Map();
   const dispatchedIds = new Set();
   const pendingEffects = new Map();
+  const ownedResponses = new Set();
   const claimedParallelRootIds = new Set();
   const observations = [];
   const resolutionOrder = [];
@@ -571,6 +573,7 @@ function createJavascriptEffectExecution(options = {}) {
           limitMessage
         );
       }
+      options.outputExecution?.assertEffect();
       const normalizedInput = normalizeEffectDescriptor(input, limits);
       const kind = String(normalizedInput.kind || 'effect');
       const descriptor = Object.freeze({
@@ -605,14 +608,21 @@ function createJavascriptEffectExecution(options = {}) {
       const raw = raceWithSignal(Promise.resolve().then(() => {
         options.requestBudget?.check();
         if (operationSignal.signal.aborted) throw abortedEffectError(operationSignal.signal.reason);
+        options.outputExecution?.assertEffect();
+        if (kind.startsWith('output.')) {
+          if (!options.outputExecution) throw new PulseRuntimeContractError('PULSE_OUTPUT_UNAVAILABLE', 'Generated output requires a Node HTTP writer.');
+          return options.outputExecution.dispatch(descriptor);
+        }
         if (conditionalKv.isConditionalKv(kind)) return conditionalKv.executeConditionalKv(descriptor,
           adapter.prepareConditionalKv || ((_admitted, kvExecution) => () => adapter.dispatch(descriptor, kvExecution)),
           { ...operationExecution, onKvObservation: observe }, limits);
         return Promise.resolve(adapter.dispatch(descriptor, operationExecution)).then(value => {
-          if (value instanceof Response && value.body && options.requestBudget) {
-            options.requestBudget.onAbort(() => {
-              if (!value.body.locked) void value.body.cancel(options.requestBudget.signal.reason).catch(() => {});
-            });
+          if (value instanceof Response && value.body) {
+            if (closed || operationSignal.signal.aborted) cancelResponseBody(value, operationSignal.signal.reason);
+            else {
+              ownedResponses.add(value);
+              retainFetchResponseForBudget(value, options.requestBudget, () => ownedResponses.delete(value));
+            }
           }
           return value;
         });
@@ -739,7 +749,12 @@ function createJavascriptEffectExecution(options = {}) {
 
     parallel(record) {
       assertOpen();
-      const entries = validateParallelRecord(record, execution, claimedParallelRootIds);
+      let entries;
+      try { entries = validateParallelRecord(record, execution, claimedParallelRootIds); }
+      catch (error) {
+        if (record && Object.values(Object.getOwnPropertyDescriptors(record)).some(field => dataForEffect(field.value)?.kind?.startsWith('output.'))) execution.invalidateAdmission(error);
+        throw error;
+      }
       for (const entry of entries) claimedParallelRootIds.add(entry.data.rootId);
       parallelCount += 1;
       const id = `parallel-${parallelCount}`;
@@ -806,6 +821,11 @@ function createJavascriptEffectExecution(options = {}) {
       );
       return parallelEffect;
     },
+    invalidateAdmission(error) {
+      // A synchronous body-claim conflict must fence every already queued
+      // group member before its provider dispatch microtask can run.
+      if (!lifecycleController.signal.aborted) lifecycleController.abort(error);
+    },
 
     async assertIdle() {
       if (pendingEffects.size === 0) return;
@@ -856,7 +876,7 @@ function createJavascriptEffectExecution(options = {}) {
       });
     },
 
-    async close() {
+    async close(transferredResponse) {
       if (closed) return;
       closed = true;
       if (pendingEffects.size > 0 && !lifecycleController.signal.aborted) {
@@ -869,9 +889,21 @@ function createJavascriptEffectExecution(options = {}) {
       }
       if (pendingEffects.size > 0) await Promise.allSettled(Array.from(pendingEffects.keys()));
       if (removeSourceAbortListener) removeSourceAbortListener();
-      if (adapter.dispose) {
-        try { await adapter.dispose(externalExecution); }
-        catch (error) { throw redaction.redactError(error); }
+      try {
+        if (adapter.dispose) await adapter.dispose(externalExecution);
+      } catch (error) {
+        transferredResponse = undefined;
+        throw redaction.redactError(error);
+      } finally {
+        // Only the final response escapes this execution. Intermediate router
+        // responses and successful siblings of a failed group remain owned.
+        for (const response of ownedResponses) {
+          if (response.body !== transferredResponse?.body) {
+            cancelResponseBody(response, lifecycleController.signal.reason);
+            releaseFetchResponseCancellation(response);
+          }
+        }
+        ownedResponses.clear();
       }
     }
   };

package/src/internal/fetch.js

@@ -2,6 +2,7 @@
 
 const { PulseRuntimeContractError } = require('./errors.js');
 const { encodeSchemaValue, requireExplicitSchemaId } = require('./schema.js');
+const { isIncomingBody } = require('./incoming-body.js');
 
 const SUPPORTED_FETCH_METHODS = Object.freeze(new Set(['GET', 'HEAD', 'POST']));
 const SUPPORTED_FETCH_INIT_FIELDS = Object.freeze(new Set(['method', 'headers', 'body', 'json', 'schema', 'timeoutMs']));
@@ -153,11 +154,11 @@ function normalizeFetchInit(input, options = {}) {
   let body;
   let bodyMode = 'none';
   if (hasBody) {
-    if (typeof value.body !== 'string') {
+    if (typeof value.body !== 'string' && !isIncomingBody(value.body)) {
       throw fetchContractError('PULSE_FETCH_BODY_INVALID', 'Pulse fetch body must be a string.', { type: typeof value.body });
     }
     body = value.body;
-    bodyMode = 'text';
+    bodyMode = isIncomingBody(value.body) ? 'incoming-request-v1' : 'text';
   } else if (hasJson) {
     if (!hasHeader(headers, 'content-type')) {
       headers.push(Object.freeze(['content-type', 'application/json; charset=utf-8']));

package/src/internal/incoming-body.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const { PulseRuntimeContractError } = require('./errors.js');
+const owners = new WeakMap();
+function conflict() {
+  return new PulseRuntimeContractError('PULSE_REQUEST_BODY_OWNERSHIP', 'The incoming body has already been claimed by this request.');
+}
+
+// Host integration only. Markers carry no stream, bytes or serializable identity.
+function createIncomingBodyOwnership(transport) {
+  let state = 'available', invalidation, failure, disposed = false;
+  const marker = Object.freeze(Object.create(null));
+  const owner = Object.freeze({
+    marker() { return marker; },
+    bindInvalidation(callback) { invalidation = callback; },
+    fail(error) {
+      failure ||= error;
+      state = 'failed';
+      invalidation?.(error);
+      return error;
+    },
+    structured() {
+      if (transport.readTextChunk) throw owner.fail(conflict());
+      if (state !== 'available' && state !== 'structured') throw owner.fail(conflict());
+      state = 'structured';
+    },
+    claim(value, init) {
+      if (owners.get(value) !== owner || state !== 'available') throw owner.fail(conflict());
+      transport.validate(init);
+      state = 'reserved';
+    },
+    async readTextChunk(budget) {
+      if (!transport.readTextChunk || !['available', 'reading'].includes(state)) throw owner.fail(conflict());
+      state = 'reading';
+      try { return await transport.readTextChunk(budget); } catch (error) { throw owner.fail(error); }
+    },
+    async forward(url, init, execution) {
+      if (state !== 'reserved') throw failure || conflict();
+      state = 'forwarding';
+      try {
+        const response = await transport.forward(url, init, execution);
+        state = 'closed';
+        return response;
+      } catch (error) { throw owner.fail(error); }
+    },
+    async close() {
+      if (disposed) return;
+      disposed = true;
+      if (state !== 'closed' && state !== 'failed') state = 'cancelled';
+      // Provider cleanup is best effort, must observe rejection, and never
+      // delay an execution or grant application authority.
+      try { Promise.resolve(transport.cancel(failure)).catch(() => {}); } catch (_) {}
+    },
+    get failure() { return failure; },
+    get responseSignal() { return transport.responseSignal; }
+  });
+  owners.set(marker, owner);
+  return owner;
+}
+
+function isIncomingBody(value) { return value !== null && typeof value === 'object' && owners.has(value); }
+function forwardIncomingBody(value, url, init, execution) {
+  const owner = owners.get(value);
+  if (!owner) throw conflict();
+  return owner.forward(url, init, execution);
+}
+
+module.exports = { createIncomingBodyOwnership, isIncomingBody, forwardIncomingBody };

package/src/internal/package-runtime.js

@@ -26,6 +26,7 @@ const TRUSTED_PACKAGE_EFFECT_CATALOG = Object.freeze({
   }),
   '@pulse-compute/s3': Object.freeze({
     contractId: 'pulse.s3', providerKind: 's3', operations: Object.freeze({
+      getBody: Object.freeze({ kind: 's3.getBody', capability: 's3.getBody', result: 'opaque-response' }),
       head: Object.freeze({ kind: 's3.head', capability: 's3.head', result: 's3-head-result' }),
       getText: Object.freeze({ kind: 's3.getText', capability: 's3.getText', result: 's3-get-text-result' }),
       putText: Object.freeze({ kind: 's3.putText', capability: 's3.putText', result: 's3-put-text-result' })
@@ -57,6 +58,7 @@ const TRUSTED_PACKAGE_EFFECT_CATALOG = Object.freeze({
     contractId: 'pulse.jwt',
     providerKind: 'jwt',
     operations: Object.freeze({
+      sign: Object.freeze({ kind: 'jwt.sign', capability: 'jwt.sign', result: 'string' }),
       verify: Object.freeze({
         kind: 'jwt.verify',
         capability: 'jwt.verify',
@@ -595,6 +597,8 @@ function createPackageRuntime(input) {
         capability: declared.capability,
         result: declared.result,
         payload: clonePackageEffectPayload(payload, {
+          // The sign payload adds one envelope level around its 32-level claims.
+          maxDepth: declared.kind === 'jwt.sign' ? DEFAULT_MAX_PAYLOAD_DEPTH + 1 : DEFAULT_MAX_PAYLOAD_DEPTH,
           maxBytes: declared.kind === 'crypto.digestText' || declared.kind === 's3.putText'
             ? TEXT_MAX_PAYLOAD_BYTES : DEFAULT_MAX_PAYLOAD_BYTES
         })

package/src/internal/redaction.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { PulseRuntimeContractError, PulseUnhandledError } = require('./errors.js');
+const { PulseRuntimeContractError, PulseUnhandledError, isApplicationError } = require('./errors.js');
 
 const REDACTED_VALUE = '<redacted>';
 const CIRCULAR_VALUE = '<circular>';
@@ -145,6 +145,10 @@ function createRedactionState(initialValues = []) {
     const rawMessage = ownDataValue(error, 'message');
     const rawName = ownDataValue(error, 'name');
     const rawCode = ownDataValue(error, 'code');
+    // Admitted discriminators are fixed protocol vocabulary, not private text.
+    // Short KV keys/array indexes must not change Router recovery decisions.
+    const stableCode = isApplicationError(error) ? rawCode
+      : error instanceof PulseUnhandledError ? 'PULSE_RUNTIME_UNHANDLED_ERROR' : undefined;
     const message = redactString(typeof rawMessage === 'string' ? rawMessage : 'Pulse runtime failure.');
     const causeDescriptor = Object.getOwnPropertyDescriptor(error, 'cause');
     const cause = causeDescriptor && Object.prototype.hasOwnProperty.call(causeDescriptor, 'value')
@@ -170,6 +174,10 @@ function createRedactionState(initialValues = []) {
     }
 
     const reserved = new Set(['name', 'message', 'stack', 'cause', 'detail']);
+    if (stableCode !== undefined) {
+      reserved.add('code');
+      Object.defineProperty(safe, 'code', { enumerable: true, configurable: true, writable: false, value: stableCode });
+    }
     for (const key of Reflect.ownKeys(error).slice(0, MAX_REDACTION_ENTRIES)) {
       if (typeof key !== 'string' || reserved.has(key)) continue;
       const descriptor = Object.getOwnPropertyDescriptor(error, key);

package/src/internal/request-budget.js

@@ -39,12 +39,12 @@ function createRequestBudget(options = {}) {
   const deadline = duration === undefined ? undefined : read() + duration;
   const expire = () => controller.abort(new PulseRuntimeContractError('PULSE_REQUEST_DEADLINE_EXCEEDED', 'Pulse request exceeded its total execution deadline.'));
   const signals = [...new Set([options.signal, options.requestSignal].filter(Boolean))];
-  const listeners = signals.map(signal => {
+  const listeners = new Set(signals.map(signal => {
     const abort = () => controller.abort(signal.reason);
     if (signal.aborted) abort();
     else signal.addEventListener('abort', abort, { once: true });
     return () => signal.removeEventListener('abort', abort);
-  });
+  }));
   const budget = Object.freeze({
     signal: controller.signal,
     deadlineMonotonicMs: deadline,
@@ -56,8 +56,11 @@ function createRequestBudget(options = {}) {
     },
     onAbort(callback) {
       if (controller.signal.aborted || closed) { callback(); return () => {}; }
-      const remove = () => controller.signal.removeEventListener('abort', callback);
-      listeners.push(remove);
+      const remove = () => {
+        controller.signal.removeEventListener('abort', callback);
+        listeners.delete(remove);
+      };
+      listeners.add(remove);
       controller.signal.addEventListener('abort', callback, { once: true });
       return remove;
     },
@@ -81,7 +84,7 @@ function createRequestBudget(options = {}) {
       closed = true;
       if (timer !== undefined) clock.clearTimeout(timer);
       for (const remove of listeners) remove();
-      listeners.length = 0;
+      listeners.clear();
     }
   });
   budgets.add(budget);

package/src/internal/response.js

@@ -12,6 +12,7 @@ const {
 
 const RESULT_DATA = new WeakMap();
 const FETCH_RESPONSE_DATA = new WeakMap();
+const FETCH_RESPONSE_CANCELLATIONS = new WeakMap();
 const RESPONSE_HEADER_DATA = new WeakMap();
 const RESPONSE_BODY_CLASS_DATA = new WeakMap();
 const RESULT_BRAND = Symbol('pulse.runtime.result');
@@ -180,6 +181,24 @@ function claimFetchResponse(data, mode) {
   data.ownershipMode = mode;
 }
 
+function retainFetchResponseForBudget(response, budget, onRelease) {
+  if (!(response instanceof Response) || !response.body) return;
+  const remove = budget?.onAbort(() => cancelResponseBody(response, budget.signal.reason));
+  let registrations = FETCH_RESPONSE_CANCELLATIONS.get(response);
+  if (!registrations) {
+    registrations = new Set();
+    FETCH_RESPONSE_CANCELLATIONS.set(response, registrations);
+  }
+  registrations.add(() => { remove?.(); onRelease?.(); });
+}
+
+function releaseFetchResponseCancellation(response) {
+  const registrations = FETCH_RESPONSE_CANCELLATIONS.get(response);
+  if (!registrations) return;
+  FETCH_RESPONSE_CANCELLATIONS.delete(response);
+  for (const remove of registrations) remove();
+}
+
 function readerForFetchData(data, options = {}) {
   claimFetchResponse(data, 'structured-projection');
   if (data.bodyReader) return data.bodyReader;
@@ -191,7 +210,10 @@ function readerForFetchData(data, options = {}) {
     label: 'fetched response',
     maxBytes: options.maxBodyBytes === undefined ? data.maxBodyBytes : options.maxBodyBytes,
     forceStructured: true,
-    signal: options.signal || data.signal
+    signal: options.signal || data.signal,
+    onReadSettled: () => {
+      if (data.response.bodyUsed && !data.response.body?.locked) releaseFetchResponseCancellation(data.response);
+    }
   });
   return data.bodyReader;
 }
@@ -355,9 +377,11 @@ function projectFetchResponse(value, projection, schemaId, options = {}) {
   );
 }
 
-async function cancelResponseBody(response) {
-  if (!(response instanceof Response) || !response.body || response.bodyUsed) return;
-  try { await response.body.cancel(); } catch (_) { /* ownership cleanup is best effort */ }
+function cancelResponseBody(response, reason) {
+  if (!(response instanceof Response) || !response.body || response.body.locked) return;
+  // A provider's cancellation callback may reject or never settle. Cleanup must
+  // observe rejection without delaying request completion or decoding the body.
+  try { void response.body.cancel(reason).catch(() => {}); } catch (_) { /* best effort */ }
 }
 
 async function fetchResponseToResponse(value, requestMethod = 'GET') {
@@ -371,7 +395,7 @@ async function fetchResponseToResponse(value, requestMethod = 'GET') {
     if (bodyAllowed && !statusChanged) {
       return rememberResponseMetadata(data.response, headers, value.bodyClass);
     }
-    if (!bodyAllowed) await cancelResponseBody(data.response);
+    if (!bodyAllowed) cancelResponseBody(data.response);
     return rememberResponseMetadata(
       new Response(bodyAllowed ? data.response.body : null, {
         status: value.status,
@@ -394,6 +418,7 @@ async function fetchResponseToResponse(value, requestMethod = 'GET') {
 module.exports = Object.freeze({
   PulseRuntimeContractError,
   PulseUnhandledError,
+  cancelResponseBody,
   createJsonResult,
   createOpaqueFetchResponse,
   createResponseResult,
@@ -403,6 +428,8 @@ module.exports = Object.freeze({
   isPulseResult,
   markOpaqueResponse,
   normalizeFetchResponse,
+  retainFetchResponseForBudget,
+  releaseFetchResponseCancellation,
   normalizeHeaders,
   projectFetchResponse,
   responseAllowsBody,

package/src/internal/router.js

@@ -9,6 +9,7 @@ const { isApplicationError } = require('./errors.js');
 const {
   PulseRuntimeContractError,
   PulseUnhandledError,
+  cancelResponseBody,
   fetchResponseToResponse,
   isPulseFetchResponse,
   isPulseResult,
@@ -33,6 +34,17 @@ function requireRouter(value) {
   return value;
 }
 
+function mountEligibility(value) {
+  if (value === undefined) return undefined;
+  const invalid = () => { throw new TypeError('Pulse Router mount eligibility requires { state: "key", equals: "value" } with string data properties.'); };
+  if (!value || typeof value !== 'object') return invalid();
+  const properties = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(properties).length !== 2 ||
+      !properties.state || !properties.equals ||
+      typeof properties.state.value !== 'string' || typeof properties.equals.value !== 'string') return invalid();
+  return Object.freeze({ state: properties.state.value, equals: properties.equals.value });
+}
+
 function mergeParams(left, right) {
   return Object.freeze({ ...(left || {}), ...(right || {}) });
 }
@@ -113,10 +125,11 @@ class Router {
     return this;
   }
 
-  mount(path, router) {
+  mount(path, router, eligibility) {
     ROUTER_STATE.get(this).entries.push(entry('mount', {
       path: compileRoutePath(path, { scoped: true, allowWildcard: true }),
-      router: requireRouter(router)
+      router: requireRouter(router),
+      eligibility: mountEligibility(eligibility)
     }));
     return this;
   }
@@ -173,9 +186,7 @@ async function normalizeHandlerResponse(value, requestMethod) {
   if (isPulseFetchResponse(value)) return fetchResponseToResponse(value, requestMethod);
   if (value instanceof Response) {
     if (String(requestMethod).toUpperCase() !== 'HEAD' && statusAllowsBody(value.status)) return value;
-    if (value.body && !value.bodyUsed) {
-      try { await value.body.cancel(); } catch (_) { /* ownership cleanup is best effort */ }
-    }
+    cancelResponseBody(value);
     const response = new Response(null, { status: value.status, statusText: value.statusText, headers: value.headers });
     return responseBodyClass(value) === 'opaque'
       ? markOpaqueResponse(response, responseHeaderPairs(value))
@@ -218,7 +229,7 @@ async function dispatchRouter(router, frame, startIndex, activeError) {
 
     if (current.kind === 'mount') {
       const match = matchRoutePath(current.path, frame.relativePath);
-      if (!match) {
+      if (!match || (current.eligibility && frame.state.get(current.eligibility.state) !== current.eligibility.equals)) {
         index += 1;
         continue;
       }
@@ -304,10 +315,12 @@ async function runNormalHandler(_router, frame, index, handler, routeContext) {
     if (handlerError === undefined) handlerError = error;
   }
   frame.signal?.throwIfAborted();
+  if (handlerError !== undefined && frame.executionOptions.outputExecution?.started) throw handlerError;
   if (handlerError !== undefined) {
     return Object.freeze({ kind: 'continue', index: index + 1, error: containUnexpected(handlerError, frame), frame });
   }
 
+  frame.executionOptions.outputExecution?.validateResult(output);
   const transfer = transferData(output, transferFactory.token);
   if (transferFactory.wasCalled()) {
     if (!transfer || output !== transferFactory.transfer()) {
@@ -358,10 +371,12 @@ async function runErrorHandler(_router, frame, index, activeError, handler) {
     if (handlerError === undefined) handlerError = error;
   }
   frame.signal?.throwIfAborted();
+  if (handlerError !== undefined && frame.executionOptions.outputExecution?.started) throw handlerError;
   if (handlerError !== undefined) {
     return Object.freeze({ kind: 'continue', index: index + 1, error: containUnexpected(handlerError, frame), frame });
   }
 
+  frame.executionOptions.outputExecution?.validateResult(output);
   const transfer = transferData(output, transferFactory.token);
   if (transferFactory.wasCalled()) {
     if (!transfer || output !== transferFactory.transfer()) {
@@ -419,9 +434,11 @@ async function executeRouter(router, request, options = {}) {
   options = { ...options, requestBudget: budget, signal: budget.signal, deadlineMonotonicMs: budget.deadlineMonotonicMs ?? options.deadlineMonotonicMs, kvClock: budget.deadlineMonotonicMs === undefined ? options.kvClock : budget.clock };
   const executionSignal = budget.signal;
   let effectExecution;
+  let transferredResponse;
   try {
     budget.check();
     effectExecution = createJavascriptEffectExecution({
+      outputExecution: options.outputExecution,
       effectAdapter: options.effectAdapter,
       capabilities: options.capabilities,
       application: options.application,
@@ -468,7 +485,7 @@ async function executeRouter(router, request, options = {}) {
     budget.check();
     const result = await budget.race(dispatchRouter(router, frame, 0, NO_ERROR));
     executionSignal?.throwIfAborted();
-    if (result.kind === 'response') return result.response;
+    if (result.kind === 'response') return (transferredResponse = result.response);
     if (result.error !== NO_ERROR) {
       return new Response('Internal Server Error', {
         status: 500,
@@ -481,7 +498,7 @@ async function executeRouter(router, request, options = {}) {
     });
   } finally {
     try {
-      await effectExecution?.close();
+      await effectExecution?.close(transferredResponse);
     } finally {
       if (ownsBudget) budget.close();
       if (effectExecution && typeof options.onEffectSummary === 'function') options.onEffectSummary(effectExecution.summary());

package/src/internal/schema.js

@@ -144,7 +144,17 @@ function utf8Bytes(value) {
 
 function assertSchemaBodySize(options, text, schemaId, source) {
   const configured = Number(schemaRegistry(options)?.maxBytes);
-  const maxBytes = Number.isSafeInteger(configured) && configured > 0 ? configured : 65_536;
+  let maxBytes = Number.isSafeInteger(configured) && configured > 0 ? configured : 65_536;
+  const jsonLimits = schemaCodecs(options)?.schema?.(schemaId)?.jsonLimits;
+  if (jsonLimits) {
+    maxBytes = Math.min(maxBytes, jsonLimits.maxTextBytes);
+    // UTF-16 length is a lower bound on UTF-8 bytes. Reject large application
+    // strings before TextEncoder allocates their complete encoded form.
+    if (typeof text === 'string' && text.length > maxBytes) {
+      throw schemaRuntimeError('PULSE_BODY_TOO_LARGE', `Pulse ${source} schema body exceeds the ${maxBytes} byte limit.`,
+        { schemaId: String(schemaId), source, bytesAtLeast: text.length, maxBytes });
+    }
+  }
   const bytes = utf8Bytes(text);
   if (bytes <= maxBytes) return bytes;
   throw schemaRuntimeError(