@timber-js/app 0.2.0-alpha.145 → 0.2.0-alpha.146

package/src/server/action-handler.ts

@@ -35,6 +35,7 @@ import {
 } from './sensitive-fields.js';
 import type { FormFlashData } from './form-flash.js';
 import { checkVersionSkew, applyReloadHeaders } from './version-skew.js';
+import { encodeHeadHeader, HEAD_HEADER } from '../shared/head-header.js';
 import { logActionError } from './logger.js';
 
 // ─── Types ────────────────────────────────────────────────────────────────
@@ -299,9 +300,16 @@ async function handleRscAction(
       _tree: result.revalidation.element,
     };
     headers['X-Timber-Revalidation'] = '1';
-    // Forward head elements as JSON so the client can update <head>.
+    // Forward head elements (percent-encoded JSON) so the client can update
+    // <head>. Raw JSON.stringify is NOT safe here: header values must be
+    // ByteStrings, so a title with an em dash or emoji would make
+    // `new Response(...)` throw — a 500 after the action's mutation already
+    // committed, dropping Set-Cookie too. See TIM-1058.
     if (result.revalidation.headElements.length > 0) {
-      headers['X-Timber-Head'] = JSON.stringify(result.revalidation.headElements);
+      const encodedHead = encodeHeadHeader(result.revalidation.headElements);
+      if (encodedHead !== null) {
+        headers[HEAD_HEADER] = encodedHead;
+      }
     }
   } else {
     payload = result.actionResult;

package/src/server/actions.ts

@@ -18,6 +18,7 @@ import { getCacheHandler } from '../cache/handler-store';
 import { DenySignal, RedirectSignal } from './primitives';
 import { withSpan } from './tracing';
 import { revalidationAls, type RevalidationState } from './als-registry.js';
+import type { HeadElementPayload } from '../shared/head-header.js';
 
 // ─── Types ───────────────────────────────────────────────────────────────
 
@@ -25,8 +26,8 @@ import { revalidationAls, type RevalidationState } from './als-registry.js';
 export interface RevalidationResult {
   /** React element tree (pre-serialization — passed to renderToReadableStream). */
   element: unknown;
-  /** Resolved head elements for metadata. */
-  headElements: unknown[];
+  /** Resolved head elements for metadata (forwarded via X-Timber-Head). */
+  headElements: HeadElementPayload[];
 }
 
 /** Renderer function that builds a React element tree for a given path. */

package/src/server/compress.ts

@@ -174,7 +174,7 @@ export function compressResponse(request: Request, response: Response): Response
 // progressively.
 
 import { createGzip, constants } from 'node:zlib';
-import { Readable } from 'node:stream';
+import { Readable, pipeline } from 'node:stream';
 
 /**
  * Compress a ReadableStream with gzip, flushing each chunk immediately.
@@ -186,7 +186,16 @@ import { Readable } from 'node:stream';
 function compressWithGzip(body: ReadableStream<Uint8Array>): ReadableStream<Uint8Array> {
   const gzip = createGzip({ flush: constants.Z_SYNC_FLUSH });
   const nodeInput = Readable.fromWeb(body as import('stream/web').ReadableStream);
-  nodeInput.pipe(gzip);
+
+  // pipeline() instead of bare pipe(): pipe() does not forward source errors,
+  // so an erroring body (streaming route handler, dropped upstream fetch)
+  // would emit an unhandled 'error' event and crash the process. pipeline()
+  // destroys gzip on source error — the returned web stream rejects — and
+  // tears down nodeInput when the consumer cancels the web stream, which
+  // cancels the source body via fromWeb. The error reaches the consumer
+  // through the web stream; the callback only marks it handled at the Node
+  // layer.
+  pipeline(nodeInput, gzip, () => {});
 
   return Readable.toWeb(gzip) as ReadableStream<Uint8Array>;
 }

package/src/server/cookie-context.ts

@@ -195,6 +195,11 @@ export function getCookieJar(): RequestCookies {
         maxAge: 0,
         expires: new Date(0),
       };
+      // delete() is a jar entry point like set() — caller-supplied
+      // path/domain are serialized verbatim into the Set-Cookie header,
+      // so they must pass the same attribute-injection guard. See
+      // design/29-cookies.md §"Cookie Attribute Validation" (TIM-1026).
+      assertValidCookieOptions(opts);
       store.cookieJar.set(name, { name, value: '', options: opts });
       // Remove from read view
       map.delete(name);
@@ -460,6 +465,12 @@ function setRaw(
   // the cookie jar / RYW map.
   assertValidCookieName(name);
   assertValidCookieValue(name, value);
+  // Options get the same entry-point guard as set()/delete(). For the
+  // setFromHeaders path this can only fire on attributes parseSetCookie
+  // cannot produce (it splits on `;` and normalizes Max-Age/SameSite),
+  // but setRaw is the jar entry point — the invariant lives here, not in
+  // the caller. See design/29-cookies.md §"Cookie Attribute Validation".
+  assertValidCookieOptions(options);
   store.cookieJar.set(name, { name, value, options });
   // Deletion cookies (Max-Age=0) should not appear in the read map.
   if (options.maxAge === 0) {

package/src/server/cookie-parsing.ts

@@ -110,15 +110,27 @@ export function parseSetCookie(
       case 'domain':
         options.domain = val;
         break;
-      case 'max-age':
-        options.maxAge = Number(val);
+      case 'max-age': {
+        // RFC 6265 §5.2.2: a non-numeric Max-Age is ignored, not fatal.
+        // Dropping NaN/Infinity here keeps this parser total and keeps
+        // `Max-Age=NaN` out of the serialized Set-Cookie header.
+        const maxAge = Number(val);
+        if (Number.isFinite(maxAge)) options.maxAge = maxAge;
         break;
+      }
       case 'expires':
         options.expires = new Date(val);
         break;
-      case 'samesite':
-        options.sameSite = val.toLowerCase() as 'strict' | 'lax' | 'none';
+      case 'samesite': {
+        // Unknown SameSite values are ignored (browsers treat them as
+        // unspecified) so forwarding a quirky upstream header via
+        // setFromHeaders never trips the entry-point validator.
+        const sameSite = val.toLowerCase();
+        if (sameSite === 'strict' || sameSite === 'lax' || sameSite === 'none') {
+          options.sameSite = sameSite;
+        }
         break;
+      }
       case 'secure':
         options.secure = true;
         break;

package/src/server/fallback-error.ts

@@ -34,14 +34,15 @@ export async function renderFallbackError(
   rootSegment: ManifestSegmentNode,
   clientBootstrap: ClientBootstrapConfig,
   globalError?: GlobalErrorFile,
-  projectRoot?: string
+  projectRoot?: string,
+  hmrOptions?: import('../dev-tools/dev-page-shell.js').DevErrorHmrOptions
 ): Promise<Response> {
   // Source-map the error's stack trace in dev mode so the error page
   // shows original source positions. See TIM-811.
   sourceMapError(error);
 
   if (isDev) {
-    return renderDevErrorPage(error, projectRoot);
+    return renderDevErrorPage(error, projectRoot, hmrOptions);
   }
   // Lazy import to avoid loading error-renderer in the pipeline module
   const { renderErrorPage } = await import('./rsc-entry/error-renderer.js');
@@ -91,7 +92,11 @@ export async function renderFallbackError(
  *
  * Dev-only — the dynamic import has zero production cost.
  */
-export async function renderDevErrorPage(error: unknown, projectRoot?: string): Promise<Response> {
+export async function renderDevErrorPage(
+  error: unknown,
+  projectRoot?: string,
+  hmrOptions?: import('../dev-tools/dev-page-shell.js').DevErrorHmrOptions
+): Promise<Response> {
   const err = error instanceof Error ? error : new Error(String(error));
   const root = projectRoot ?? process.cwd();
 
@@ -100,7 +105,7 @@ export async function renderDevErrorPage(error: unknown, projectRoot?: string):
     // Dynamic import — keeps dev-error-page.ts and its transitive deps
     // (dev-error-overlay.ts, @jridgewell/trace-mapping) out of production bundles.
     const { generateDevErrorPage } = await import('../dev-tools/error-page.js');
-    html = generateDevErrorPage(err, 'render', root);
+    html = generateDevErrorPage(err, 'render', root, hmrOptions);
     // Inject Vite client script so the error overlay fires when HMR connects.
     html = html.replace(
       '</head>',

package/src/server/node-stream-transforms.ts

@@ -18,7 +18,8 @@
  * Readable.toWeb() conversion for the Response body.
  */
 
-import { Transform } from 'node:stream';
+import { PassThrough, Transform, type Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
 import { createGzip, constants } from 'node:zlib';
 
 import {
@@ -265,37 +266,73 @@ export function createNodeFlightInjector(
 const NOINDEX_SCRIPT =
   '<script>document.head.appendChild(Object.assign(document.createElement("meta"),{name:"robots",content:"noindex"}))</script>';
 
+function isAbortError(error: unknown): boolean {
+  if (error instanceof DOMException && error.name === 'AbortError') return true;
+  if (error instanceof Error && error.name === 'AbortError') return true;
+  return false;
+}
+
 /**
- * Node.js Transform that catches post-shell streaming errors.
+ * Run the Node SSR post-processing pipeline with post-shell error handling.
+ *
+ * Equivalent to wrapStreamWithErrorHandling() in ssr-render.ts: when the
+ * stream errors after the shell has flushed (deny/throw inside Suspense,
+ * an RSC read timeout in the flight injector, or an upstream Fizz error),
+ * the response closes cleanly with a trailing noindex script instead of
+ * aborting the connection mid-body. Abort errors (client disconnect,
+ * render-timeout abort) close the output silently — no noindex, no log.
  *
- * Equivalent to wrapStreamWithErrorHandling() in ssr-render.ts.
- * Catches errors from React's streaming phase (deny/throw inside Suspense
- * after the shell has flushed) and closes the stream cleanly.
+ * Why this is a pump function and not a Transform stage (TIM-1019):
+ * stream.promises.pipeline() destroys every stage in the chain when any
+ * stage errors, so a Transform *inside* the pipeline can never append
+ * bytes after a failure — by the time its 'error' listener fires, the
+ * transform and everything downstream are already destroyed and push()/
+ * end() are no-ops. The output PassThrough therefore lives OUTSIDE the
+ * pipeline() call: the last stage pipes into it (pipe() ends the output
+ * on upstream success but leaves it open on upstream error), and the
+ * pipeline's rejection handler appends the noindex script.
+ *
+ * Consumer cancellation (e.g. Readable.toWeb() cancel on client
+ * disconnect) is wired back into the pipeline via an AbortSignal so the
+ * source and all stages are torn down — the teardown that membership in
+ * pipeline() used to provide.
  */
-export function createNodeErrorHandler(signal?: AbortSignal): Transform {
-  const transform = new Transform({
-    transform(chunk, _encoding, callback) {
-      callback(null, chunk);
-    },
-  });
-
-  transform.on('error', (error) => {
-    const isAbort =
-      (error instanceof DOMException && error.name === 'AbortError') ||
-      (error instanceof Error && error.name === 'AbortError') ||
-      signal?.aborted;
-
-    if (isAbort) {
-      transform.end();
+export function runNodePipelineWithErrorHandling(
+  source: Readable,
+  transforms: readonly [Transform, ...Transform[]],
+  signal?: AbortSignal
+): PassThrough {
+  const output = new PassThrough();
+  const last = transforms[transforms.length - 1]!;
+  last.pipe(output);
+
+  // If the consumer destroys the output (client disconnect), abort the
+  // pipeline so the Fizz source and flight injector release their
+  // resources. On normal completion the pipeline has already settled and
+  // the abort is a no-op.
+  const consumerGone = new AbortController();
+  output.once('close', () => consumerGone.abort());
+
+  // The cast satisfies pipeline()'s [source, ...transforms, destination]
+  // tuple overload — TS can't prove the shape across a spread, but the
+  // signature above guarantees a non-empty transform list at compile time.
+  const stages = [source, ...transforms] as unknown as readonly [
+    Readable,
+    ...Transform[],
+    Transform,
+  ];
+
+  pipeline(stages, { signal: consumerGone.signal }).catch((error: unknown) => {
+    if (output.writableEnded || output.destroyed) return;
+    if (isAbortError(error) || signal?.aborted || consumerGone.signal.aborted) {
+      output.end();
       return;
     }
-
     logStreamingError({ error });
-    transform.push(Buffer.from(NOINDEX_SCRIPT, 'utf-8'));
-    transform.end();
+    output.end(Buffer.from(NOINDEX_SCRIPT, 'utf-8'));
   });
 
-  return transform;
+  return output;
 }
 
 // ─── Compression ─────────────────────────────────────────────────────────────

package/src/server/pipeline.ts

@@ -187,6 +187,18 @@ export interface PipelineConfig {
     debugComponents?: Array<{ name: string; env: string | null; stack: unknown[] | null }>
   ) => void;
 
+  /**
+   * HMR connection options for dev-only HTML pages (dev 404 page, fallback
+   * error page) — set by the dev server after the RSC entry module is
+   * imported, like `devPipelineErrorHandler`. The RSC environment can't
+   * read the Vite server config (separate module graph), so the dev server
+   * plumbs the resolved HMR endpoint (protocol/host/port/path/token) here
+   * for the pages' auto-reload WebSocket. See TIM-1067.
+   *
+   * Undefined in production — zero overhead.
+   */
+  devHmrOptions?: import('../dev-tools/dev-page-shell.js').DevErrorHmrOptions;
+
   /**
    * Fallback error renderer — called when a catastrophic error escapes the
    * render phase. Produces an HTML Response instead of a bare empty 500.

package/src/server/primitives.ts

@@ -8,7 +8,10 @@ import { getWaitUntil as _getWaitUntil } from './waituntil-bridge.js';
 import { isDebug } from './debug.js';
 import { getRequestSearchString } from './request-context.js';
 import { mergePreservedSearchParams } from '../shared/merge-search-params.js';
-import { validateExternalRedirectUrl } from '../shared/href-validation.js';
+import {
+  assertRelativeRedirectPath,
+  validateExternalRedirectUrl,
+} from '../shared/href-validation.js';
 
 // ─── Dev-mode validation ────────────────────────────────────────────────────
 
@@ -207,17 +210,9 @@ export function notFound(): never {
   deny(404);
 }
 
-/**
- * Next.js redirect type discriminator.
- *
- * Provided for API compatibility with libraries that import `RedirectType`
- * from `next/navigation`. In timber, `redirect()` always uses `replace`
- * semantics (no history entry for the redirect itself).
- */
-export const RedirectType = {
-  push: 'push',
-  replace: 'replace',
-} as const;
+// Single source of truth shared with the client next/navigation shim —
+// see shared/redirect-type.ts.
+export { RedirectType } from '../shared/redirect-type.js';
 
 // ─── RedirectSignal ─────────────────────────────────────────────────────────
 
@@ -237,12 +232,6 @@ export class RedirectSignal extends Error {
   }
 }
 
-/** Pattern matching absolute URLs: http(s):// or protocol-relative // */
-const ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
-
-// eslint-disable-next-line no-control-regex -- must match all C0 controls to prevent bypass
-const REDIRECT_CONTROL_CHARS_RE = /[\x00-\x1f]/g;
-
 /**
  * Options for redirect() — alternative to passing a bare status code.
  */
@@ -303,19 +292,9 @@ export function redirect(path: string, statusOrOptions?: number | RedirectOption
   if (status < 300 || status > 399) {
     throw new Error(`redirect() requires a 3xx status code, got ${status}.`);
   }
-  // Strip C0 control characters and trim whitespace before checking — browsers
-  // do this during URL resolution, so " \thttp://evil.com" resolves as absolute.
-  // Normalize for validation only: strip C0 controls, trim, then replace backslashes
-  // with forward slashes. Browsers normalize \ → / during URL resolution, so
-  // "/\evil.com" becomes "//evil.com" (protocol-relative open redirect).
-  const cleaned = path.replace(REDIRECT_CONTROL_CHARS_RE, '').trimStart().replaceAll('\\', '/');
-
-  if (ABSOLUTE_URL_RE.test(cleaned)) {
-    throw new Error(
-      `redirect() only accepts relative URLs. Got absolute URL: "${path}". ` +
-        'Use redirectExternal(url, allowList) for external redirects.'
-    );
-  }
+  // Relative-only validation shared with the client next/navigation shim —
+  // strips C0 controls and normalizes backslashes before the scheme check.
+  assertRelativeRedirectPath(path);
 
   let resolvedPath = path;
   if (preserveSearchParams) {

package/src/server/rsc-entry/index.ts

@@ -268,7 +268,9 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
         const { generateDev404Page, collectRoutes } = await import('../../dev-tools/404-page.js');
         const routes = collectRoutes(manifest.root);
         const pathname = new URL(req.url).pathname;
-        const html = generateDev404Page(pathname, routes);
+        // devHmrOptions is set by the dev server after this module is
+        // imported (read at request time, not closure-capture time).
+        const html = generateDev404Page(pathname, routes, pipelineConfig.devHmrOptions);
         return new Response(html, {
           status: 404,
           headers: {
@@ -316,7 +318,10 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
         // (TIM-807). Passing manifest.root (segment tree object) here would
         // stringify to "[object Object]" and misclassify app frames as
         // internal, dropping source locations from the dev error page (TIM-808).
-        isDev ? manifest.viteRoot : undefined
+        isDev ? manifest.viteRoot : undefined,
+        // HMR options for the dev error page's auto-reload WebSocket —
+        // set by the dev server after import, read at request time.
+        isDev ? pipelineConfig.devHmrOptions : undefined
       ),
     renderDenyFallback: async (deny, req, responseHeaders, matchedRoute) => {
       // Render the deny page (403.tsx, 404.tsx, etc.) for DenySignals

package/src/server/rsc-entry/rsc-payload.ts

@@ -12,6 +12,7 @@
 import type { LayoutEntry } from '../deny-renderer.js';
 import { renderDenyPageAsRsc } from '../deny-renderer.js';
 import type { RouteMatch } from '../pipeline.js';
+import { encodeHeadHeader, HEAD_HEADER } from '../../shared/head-header.js';
 import type { RedirectSignal } from '../primitives.js';
 import type { HeadElement, LayoutComponentEntry } from '../route-element-builder.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
@@ -175,9 +176,9 @@ export async function buildRscPayloadResponse(
 
   // Send resolved head elements so the client can update document.title
   // and <meta> tags after SPA navigation. See design/16-metadata.md.
-  const encoded = encodeURIComponent(JSON.stringify(headElements));
-  if (encoded.length <= 4096) {
-    responseHeaders.set('X-Timber-Head', encoded);
+  const encodedHead = encodeHeadHeader(headElements);
+  if (encodedHead !== null) {
+    responseHeaders.set(HEAD_HEADER, encodedHead);
   }
 
   // Send segment metadata so the client can populate its segment cache

package/src/server/slot-resolver.ts

@@ -68,10 +68,12 @@ async function renderDefaultFallback(
  * Finds a matching page in the slot's sub-tree for the current route.
  * Falls back to default.tsx if no match, or null if no default.
  *
- * When a match is found, the element is wrapped with:
- * 1. Error boundaries from each segment in the slot's matched chain
- * 2. Layouts from each segment in the slot's matched chain
- * 3. SlotAccessGate if the slot root has access.ts
+ * When a match is found, the element is wrapped per segment in the slot's
+ * matched chain with (innermost → outermost):
+ * 1. Error boundaries
+ * 2. Layout
+ * 3. SlotAccessGate if the segment has access.ts (gate OUTSIDE the layout,
+ *    so a denied layout never executes — see TIM-1074)
  */
 export async function resolveSlotElement(
   slotNode: ManifestSegmentNode,
@@ -155,20 +157,25 @@ export async function resolveSlotElement(
         element = h(SafeSlotPage, {});
       }
 
-      // Wrap with error boundaries and layouts from intermediate slot segments
-      // (everything between slot root and leaf). Process innermost-first, same
-      // order as route-element-builder.ts handles main segments. The slot root
-      // (index 0) is handled separately after the access gate below.
+      // Wrap with error boundaries, layouts, and access gates from
+      // intermediate slot segments (everything between slot root and leaf).
+      // Process innermost-first, same order as route-element-builder.ts
+      // handles main segments. The slot root (index 0) is handled below.
       element = await wrapWithIntermediateSegments(slotMatch.chain, element, h);
 
-      // Wrap in SlotAccessGate if slot root has access.ts.
-      // On denial: denied.tsx → default.tsx → null (graceful degradation).
+      // Wrap with slot root's layout — INSIDE the access gate, so the layout
+      // server component never executes when access.ts denies. See TIM-1074.
+      element = await wrapWithLayout(slotNode, element, h);
+
+      // Wrap in SlotAccessGate if slot root has access.ts. The gate is
+      // OUTSIDE the layout, matching the segment model in
+      // route-element-builder.ts: a denied layout must not render, or it
+      // would fetch/serialize protected data into the RSC Flight stream.
+      // On denial: denied.tsx → default.tsx → null (graceful degradation),
+      // rendered WITHOUT the denied slot's own layout.
       // See design/04-authorization.md §"Slot-Level Auth".
       element = await wrapWithAccessGate(slotNode, element, h);
 
-      // Wrap with slot root's layout (outermost, outside access gate)
-      element = await wrapWithLayout(slotNode, element, h);
-
       // Wrap with slot root's error boundaries (outermost)
       element = await wrapSegmentWithErrorBoundaries(slotNode, element, h);
 
@@ -204,6 +211,12 @@ export async function resolveSlotElement(
  * not just the slot root. Without this, nested slot children (e.g.,
  * @admin/reports/access.ts) and intercepting route children with access.ts
  * would bypass authorization. See TIM-999.
+ *
+ * Wrap order per segment (innermost → outermost): error boundaries → layout
+ * → access gate. The gate must be OUTSIDE the layout so a denying access.ts
+ * prevents the layout server component from executing — otherwise the layout
+ * would fetch/serialize protected data into the RSC Flight stream. Matches
+ * route-element-builder.ts. See TIM-1074.
  */
 async function wrapWithIntermediateSegments(
   chain: ManifestSegmentNode[],
@@ -213,8 +226,8 @@ async function wrapWithIntermediateSegments(
   for (let i = chain.length - 1; i > 0; i--) {
     const seg = chain[i];
     element = await wrapSegmentWithErrorBoundaries(seg, element, h);
-    element = await wrapWithAccessGate(seg, element, h);
     element = await wrapWithLayout(seg, element, h);
+    element = await wrapWithAccessGate(seg, element, h);
   }
   return element;
 }

package/src/server/ssr-entry.ts

@@ -55,9 +55,7 @@ let _nodeStreamImports: {
   createNodeHeadInjector: typeof import('./node-stream-transforms.js').createNodeHeadInjector;
   createNodeMoveSuffixTransform: typeof import('./node-stream-transforms.js').createNodeMoveSuffixTransform;
   createNodeFlightInjector: typeof import('./node-stream-transforms.js').createNodeFlightInjector;
-  createNodeErrorHandler: typeof import('./node-stream-transforms.js').createNodeErrorHandler;
-  pipeline: typeof import('node:stream/promises').pipeline;
-  PassThrough: typeof import('node:stream').PassThrough;
+  runNodePipelineWithErrorHandling: typeof import('./node-stream-transforms.js').runNodePipelineWithErrorHandling;
   ReadableFromWeb: (
     webStream: import('stream/web').ReadableStream
   ) => import('node:stream').Readable;
@@ -65,9 +63,8 @@ let _nodeStreamImports: {
 
 if (useNodeStreams) {
   try {
-    const [transforms, streamPromises, stream] = await Promise.all([
+    const [transforms, stream] = await Promise.all([
       import('./node-stream-transforms.js'),
-      import('node:stream/promises'),
       import('node:stream'),
     ]);
     _nodeStreamImports = {
@@ -75,9 +72,7 @@ if (useNodeStreams) {
       createNodeHeadInjector: transforms.createNodeHeadInjector,
       createNodeMoveSuffixTransform: transforms.createNodeMoveSuffixTransform,
       createNodeFlightInjector: transforms.createNodeFlightInjector,
-      createNodeErrorHandler: transforms.createNodeErrorHandler,
-      pipeline: streamPromises.pipeline,
-      PassThrough: stream.PassThrough,
+      runNodePipelineWithErrorHandling: transforms.runNodePipelineWithErrorHandling,
       ReadableFromWeb: (webStream: import('stream/web').ReadableStream) =>
         stream.Readable.fromWeb(webStream) as import('node:stream').Readable,
     };
@@ -192,9 +187,7 @@ export async function handleSsr(
           createNodeHeadInjector,
           createNodeMoveSuffixTransform,
           createNodeFlightInjector,
-          createNodeErrorHandler,
-          pipeline,
-          PassThrough,
+          runNodePipelineWithErrorHandling,
         } = _nodeStreamImports;
 
         const renderTimeoutMs = _runtimeConfig.renderTimeoutMs ?? undefined;
@@ -224,15 +217,18 @@ export async function handleSsr(
         // React 19.3+ emits <!DOCTYPE html> automatically when the root
         // element is <html>, so no framework-level doctype prepend needed.
         //
-        // Pipeline: buffer → errorHandler → headInjector → flightInjector → moveSuffix → output
+        // Pipeline: buffer → headInjector → flightInjector → moveSuffix → output
         //
         // 1. buffer: coalesces Fizz micro-chunks into coherent fragments (TIM-528)
-        // 2. errorHandler: catches post-shell streaming errors
-        // 3. headInjector: injects metadata before </head>
-        // 4. flightInjector: interleaves RSC scripts between HTML chunks (TIM-529)
-        // 5. moveSuffix: strips </body></html>, re-emits at end (TIM-530)
+        // 2. headInjector: injects metadata before </head>
+        // 3. flightInjector: interleaves RSC scripts between HTML chunks (TIM-529)
+        // 4. moveSuffix: strips </body></html>, re-emits at end (TIM-530)
+        //
+        // Post-shell error handling lives in the pump, not in a pipeline
+        // stage: pipeline() destroys every stage on failure, so only an
+        // output kept outside the pipeline can append the noindex script
+        // and close cleanly (TIM-1019).
         const bufferedTransform = createNodeBufferedTransform();
-        const errorHandler = createNodeErrorHandler(navContext.signal);
         const headInjector = createNodeHeadInjector(navContext.headHtml);
         const flightInjector = createNodeFlightInjector(navContext.rscStream, {
           renderTimeoutMs,
@@ -240,18 +236,11 @@ export async function handleSsr(
         });
         const moveSuffix = createNodeMoveSuffixTransform();
 
-        const output = new PassThrough();
-        pipeline(
+        const output = runNodePipelineWithErrorHandling(
           nodeHtmlStream,
-          bufferedTransform,
-          errorHandler,
-          headInjector,
-          flightInjector,
-          moveSuffix,
-          output
-        ).catch(() => {
-          // Pipeline errors are handled by errorHandler transform
-        });
+          [bufferedTransform, headInjector, flightInjector, moveSuffix],
+          navContext.signal
+        );
         const _pipelineEnd = performance.now();
 
         // Record SSR sub-timings for Server-Timing header (detailed mode).

package/src/server/tracing.ts

@@ -94,6 +94,16 @@ export function getTraceStore(): TraceStore | undefined {
 
 // ─── Dev-Mode OTEL Auto-Init ─────────────────────────────────────────────
 
+/**
+ * Well-known key marking dev tracing as initialized.
+ *
+ * The RSC entry module re-evaluates on every HMR invalidation and calls
+ * initDevTracing() again — without this guard, each call would register a
+ * fresh provider/processor and duplicate every span's output. Symbol.for()
+ * survives module re-evaluation. See TIM-1067, B49.
+ */
+const DEV_TRACING_INIT_KEY = Symbol.for('timber.dev.tracing-initialized');
+
 /**
  * Initialize a minimal OTEL SDK in dev mode so spans are recorded and
  * fed to the DevSpanProcessor for dev log output.
@@ -102,11 +112,15 @@ export function getTraceStore(): TraceStore | undefined {
  * our DevSpanProcessor alongside theirs. If no SDK is configured,
  * we create a BasicTracerProvider with our processor.
  *
- * Only called in dev mode — zero overhead in production.
+ * Idempotent across module re-evaluations (HMR) — only the first call
+ * registers. Only called in dev mode — zero overhead in production.
  */
 export async function initDevTracing(
   config: import('../dev-tools/logger.js').DevLoggerConfig
 ): Promise<void> {
+  const globals = globalThis as Record<symbol, unknown>;
+  if (globals[DEV_TRACING_INIT_KEY]) return;
+
   const api = await getOtelApi();
   if (!api) return;
 
@@ -145,6 +159,8 @@ export async function initDevTracing(
 
   // Reset cached tracer so next getTracer() picks up the new provider
   _tracer = undefined;
+
+  globals[DEV_TRACING_INIT_KEY] = true;
 }
 
 // ─── OTEL Span Helpers ───────────────────────────────────────────────────