@timber-js/app 0.2.0-alpha.185 → 0.2.0-alpha.187

package/src/server/rsc-entry/helpers.ts

@@ -6,14 +6,12 @@
 
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import { swallow } from '../logger.js';
-import { computeSegmentKeys } from '../state-tree-diff.js';
+import { computeSegmentKeys, computeSegmentTreePaths } from '../../routing/segment-keys.js';
+import type { SegmentInfo } from '../../shared/segment-info.js';
 import type { SlotSkipEntry } from '../slot-resolver.js';
 import { isClientReference } from '../route-element-builder.js';
 import { isStaticRequestDependent } from '../request-dep.js';
 
-/** RSC content type for client navigation payload requests. */
-export const RSC_CONTENT_TYPE = 'text/x-component';
-
 /**
  * Create a debug channel sink that discards all debug data.
  *
@@ -180,16 +178,6 @@ export function parseDebugRows(text: string): DebugComponentEntry[] {
  *
  * See design/07-routing.md §"Server Diffing Rules".
  */
-interface SegmentInfoEntry {
-  path: string;
-  segmentId?: string;
-  isRequestDependent: boolean;
-  slot?: boolean;
-  parentSegment?: string;
-  denied?: boolean;
-  skipped?: boolean;
-}
-
 export function buildSegmentInfo(
   segments: ManifestSegmentNode[],
   layoutComponents: Array<{
@@ -197,17 +185,34 @@ export function buildSegmentInfo(
     segment: ManifestSegmentNode;
   }>,
   slotSkipInfo?: SlotSkipEntry[],
-  skippedSegmentKeys?: string[]
-): SegmentInfoEntry[] {
+  skippedSegmentKeys?: string[],
+  firstDeniedIndex = Infinity
+): SegmentInfo[] {
   const layoutBySegment = new Map(
     layoutComponents.map(({ component, segment }) => [segment, component])
   );
 
   const segmentKeys = computeSegmentKeys(segments);
+  // The scope identity interception compares against. Emitted for every
+  // layout-bearing segment, which is exactly the set that can own a scope:
+  // slots are only resolved for segments whose layout renders
+  // (`route-element-builder.ts`), so a segment with no layout can never hold
+  // an intercepting slot. See TIM-1282.
+  const treePaths = computeSegmentTreePaths(segments);
   const skippedSet = skippedSegmentKeys ? new Set(skippedSegmentKeys) : null;
-  const result: SegmentInfoEntry[] = [];
+  const result: SegmentInfo[] = [];
 
+  // Deepest segment that actually mounted, exclusive.
+  //
   for (let i = 0; i < segments.length; i++) {
+    // A denied segment's AccessGate renders the deny page in place of the
+    // layout, so this segment and everything below it never mounted. Their
+    // layouts were still loaded — `layoutComponents` holds every module the
+    // chain pulled in, not every component that rendered — so without this
+    // the client is told it has a tree it does not, and `treePaths` reports a
+    // slot owner whose slot was never resolved (TIM-1282).
+    if (i >= firstDeniedIndex) break;
+
     const segment = segments[i];
     const component = layoutBySegment.get(segment);
 
@@ -225,8 +230,9 @@ export function buildSegmentInfo(
       isRequestDependent = true;
     }
 
-    const entry: SegmentInfoEntry = {
+    const entry: SegmentInfo = {
       path: segment.urlPath,
+      treePath: treePaths[i],
       isRequestDependent,
     };
     if (segmentId !== segment.urlPath) {
@@ -237,7 +243,7 @@ export function buildSegmentInfo(
 
   if (slotSkipInfo) {
     for (const slot of slotSkipInfo) {
-      const entry: SegmentInfoEntry = {
+      const entry: SegmentInfo = {
         path: slot.slotKey,
         isRequestDependent: slot.isRequestDependent,
         slot: true,
@@ -252,15 +258,6 @@ export function buildSegmentInfo(
   return result;
 }
 
-/**
- * Check if a request is asking for an RSC payload (client navigation)
- * rather than full HTML. Client-side navigation sends Accept: text/x-component.
- */
-export function isRscPayloadRequest(req: Request): boolean {
-  const accept = req.headers.get('Accept') ?? '';
-  return accept.includes(RSC_CONTENT_TYPE);
-}
-
 // Re-export consolidated helpers from their single source of truth.
 // Callers within rsc-entry/ import from this file; the implementations
 // live in pipeline-helpers.ts (buildRedirectResponse) and render-utils.ts
@@ -270,3 +267,11 @@ export { isAbortError } from '../render-utils.js';
 
 // escapeHtml is now imported from server/utils/escape-html.ts
 export { escapeHtml } from '../utils/escape-html.js';
+
+// Params no longer travel beside the payload. The payload root is the
+// outermost node of every tree the server sends (`server/publish-params.ts`),
+// so the record arrives as props React Flight serializes — which is what
+// makes a `Date`- or `bigint`-valued codec result survive the trip, where
+// `JSON.stringify` flattened it or threw. The response headers, the inline
+// bootstrap scripts, and the two build-time manifest fields that used to
+// carry it are all gone. See TIM-1294, design/41-global-params.md.

package/src/server/rsc-entry/index.ts

@@ -25,11 +25,6 @@
 
 // @ts-expect-error — virtual module provided by timber-routing plugin
 import routeManifest from 'virtual:timber-route-manifest';
-// TIM-830: Populate the search-params registry eagerly so <Link> can
-// serialize flat `Partial<T>` values synchronously in RSC renders.
-// The module has side effects only — no exports consumed here.
-// @ts-expect-error — virtual module provided by timber-routing plugin
-import 'virtual:timber-search-params-registry';
 // @ts-expect-error — virtual module provided by timber-entries plugin
 import config from 'virtual:timber-config';
 // @ts-expect-error — virtual module provided by timber-build-manifest plugin
@@ -54,6 +49,7 @@ import type { InterceptionContext, PipelineConfig, RouteMatch } from '../pipelin
 import { createPipeline } from '../pipeline.js';
 import { coerceSegmentParams, setGlobalSchemaCodecs } from '../param-coercion.js';
 import { createMetadataRouteMatcher, createRouteMatcher } from '../route-matcher.js';
+import { createInterceptedRouteMatcher } from '../children-interception.js';
 import { initDevTracing } from '../tracing.js';
 import { createRevalidateRendererFactory } from './revalidate-renderer.js';
 
@@ -307,38 +303,45 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
       );
     },
     renderNoMatch: async (req: Request, responseHeaders: Headers) => {
-      const response = await renderNoMatchPage(
-        req,
-        manifest.root,
-        responseHeaders,
-        clientBootstrap
-      );
-
-      // In dev mode, if the pipeline returned a bare 404 (no body — meaning
-      // no user-defined 404.tsx was found), replace it with a helpful dev
-      // page that lists available routes and suggests similar paths.
-      // Only for GET requests that accept HTML — HEAD/API/RSC clients
-      // should receive the bare 404 without an HTML body (TIM-793).
+      // In dev mode, when the app authored no 404 page, substitute a helpful
+      // page listing available routes and suggesting similar paths in place
+      // of the framework default. Only for GET requests that accept HTML —
+      // HEAD/API/RSC clients must not receive an HTML body (TIM-793).
+      //
+      // This is passed *into* the chain rather than applied to its result:
+      // the old version detected "no user-defined 404.tsx" by testing the
+      // response for an empty body, which stopped being true once the chain
+      // grew a real terminal (TIM-1258).
       const acceptsHtml = (req.headers.get('accept') ?? '').includes('text/html');
-      if (isDev && !response.body && req.method === 'GET' && acceptsHtml) {
-        const { generateDev404Page, collectRoutes } = await import('../../dev-tools/404-page.js');
-        const routes = collectRoutes(manifest.root);
-        const pathname = new URL(req.url).pathname;
-        // devHmrOptions is set by the dev server after this module is
-        // imported (read at request time, not closure-capture time).
-        const html = generateDev404Page(pathname, routes, pipelineConfig.devHmrOptions);
-        return new Response(html, {
-          status: 404,
-          headers: {
-            ...Object.fromEntries(responseHeaders.entries()),
-            'content-type': 'text/html; charset=utf-8',
-          },
-        });
-      }
+      const wantsDev404 = isDev && req.method === 'GET' && acceptsHtml;
+
+      // The dev page is loaded up front: the chain's terminal is synchronous,
+      // and dev-tools must stay out of the production bundle (dynamic import).
+      const devPage = wantsDev404
+        ? await import('../../dev-tools/404-page.js').catch(() => null)
+        : null;
+
+      const defaultPage = devPage
+        ? (_status: number, headers: Headers) => {
+            const routes = devPage.collectRoutes(manifest.root);
+            const pathname = new URL(req.url).pathname;
+            // devHmrOptions is set by the dev server after this module is
+            // imported (read at request time, not closure-capture time).
+            const html = devPage.generateDev404Page(pathname, routes, pipelineConfig.devHmrOptions);
+            return new Response(html, {
+              status: 404,
+              headers: {
+                ...Object.fromEntries(headers.entries()),
+                'content-type': 'text/html; charset=utf-8',
+              },
+            });
+          }
+        : undefined;
 
-      return response;
+      return renderNoMatchPage(req, manifest.root, responseHeaders, clientBootstrap, defaultPage);
     },
     interceptionRewrites: manifest.interceptionRewrites,
+    matchInterceptedRoute: createInterceptedRouteMatcher(manifest.root),
     // Slow request threshold from timber.config.ts. Default 3000ms, 0 to disable.
     // See design/17-logging.md §"slowRequestMs"
     slowRequestMs: (runtimeConfig as Record<string, unknown>).slowRequestMs as number | undefined,

package/src/server/rsc-entry/render-route.ts

@@ -41,9 +41,11 @@ import { recordTiming } from '../server-timing.js';
 import { requestContextAls } from '../als-registry.js';
 import { parseClientStateTree } from '../state-tree-diff.js';
 
+import { getFirstDeniedSegmentIndex } from '../deny-boundary.js';
 import { handleApiRoute } from './api-handler.js';
 import { renderErrorPage, renderNoMatchPage } from './error-renderer.js';
-import { buildRedirectResponse, createDebugChannelSink, isRscPayloadRequest } from './helpers.js';
+import { buildRedirectResponse, createDebugChannelSink } from './helpers.js';
+import { isRscRequest } from '../../shared/rsc-media-type.js';
 import { buildRscPayloadResponse } from './rsc-payload.js';
 import { renderRscStream } from './rsc-stream.js';
 import { renderSsrResponse } from './ssr-renderer.js';
@@ -97,7 +99,7 @@ export async function renderRoute(
   // Only used for RSC requests — HTML requests always get a full render.
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
   const clientStateTree =
-    deps.clientSegmentCache && isRscPayloadRequest(req) ? parseClientStateTree(req) : null;
+    deps.clientSegmentCache && isRscRequest(req) ? parseClientStateTree(req) : null;
 
   // Build the React element tree — runs access checks eagerly to gate
   // metadata resolution (TIM-1027), then loads modules and resolves
@@ -140,7 +142,7 @@ export async function renderRoute(
   });
 
   const {
-    element,
+    payload,
     layoutComponents,
     deferSuspenseFor,
     skippedSegments,
@@ -199,7 +201,7 @@ export async function renderRoute(
 
   // Render to RSC Flight stream with signal tracking.
   const _rscStart = performance.now();
-  const { rscStream, signals, getDebugComponents } = renderRscStream(element, req);
+  const { rscStream, signals, getDebugComponents } = renderRscStream(payload, req);
   if (shellSettled) signals.shellSettled = shellSettled;
 
   // Store the debug components getter in ALS so onPipelineError can
@@ -224,14 +226,15 @@ export async function renderRoute(
   // Synchronous deny — deny() in a non-async component throws during
   // renderToReadableStream creation, caught in the try/catch above.
   if (signals.denySignal) {
-    if (isRscPayloadRequest(req)) {
+    if (isRscRequest(req)) {
       return renderDenyPageAsRsc(
         signals.denySignal,
         segments,
         layoutComponents as LayoutEntry[],
         req,
         responseHeaders,
-        createDebugChannelSink
+        createDebugChannelSink,
+        getFirstDeniedSegmentIndex()
       );
     }
     return renderDenyPage(
@@ -243,13 +246,18 @@ export async function renderRoute(
       responseHeaders,
       clientBootstrap,
       createDebugChannelSink,
-      callSsr
+      callSsr,
+      undefined,
+      getFirstDeniedSegmentIndex()
     );
   }
 
   // Synchronous render error — renderToReadableStream threw before
   // creating the stream. Render the error page with correct 5xx status.
   // (Async render errors are tracked in onError and handled after SSR.)
+  // An RSC payload request gets the hard-navigate envelope rather than an
+  // error page — `renderErrorPage` owns that branch, so every one of its call
+  // sites is covered rather than this one alone (TIM-1322).
   if (signals.renderError && !rscStream) {
     return renderErrorPage(
       signals.renderError.error,
@@ -260,21 +268,21 @@ export async function renderRoute(
       match,
       responseHeaders,
       clientBootstrap,
-      globalError
+      globalError,
+      getFirstDeniedSegmentIndex()
     );
   }
 
   // For RSC payload requests (client navigation), return the RSC Flight
   // stream directly — skip SSR HTML rendering entirely.
   // See design/19-client-navigation.md §"RSC Payload Handling"
-  if (isRscPayloadRequest(req)) {
+  if (isRscRequest(req)) {
     return buildRscPayloadResponse(
       req,
       rscStream!,
       signals,
       segments,
       layoutComponents,
-      match,
       responseHeaders,
       skippedSegments,
       slotSkipInfo

package/src/server/rsc-entry/revalidate-renderer.ts

@@ -40,6 +40,7 @@ import { buildRouteElement } from '../route-element-builder.js';
 import type { RevalidateRenderer, RevalidationResult } from '../actions.js';
 
 import { runMiddlewareForAction, type CoerceSegmentParamsFn } from './action-middleware-runner.js';
+import { RSC_CONTENT_TYPE } from '../../shared/rsc-media-type.js';
 
 /**
  * Sentinel thrown when revalidation cannot proceed because middleware
@@ -214,7 +215,7 @@ export function createRevalidateRendererFactory(
       revalidateUrl.pathname = validation.pathname;
       revalidateUrl.search = validation.search;
       const revalidateHeaders = new Headers(req.headers);
-      revalidateHeaders.set('Accept', 'text/x-component');
+      revalidateHeaders.set('Accept', RSC_CONTENT_TYPE);
       // Snapshot the action's post-mutation cookie map (deletions
       // included) and serialize it into a `Cookie:` header value the
       // target middleware can read off `ctx.req.headers.get('cookie')`.
@@ -342,7 +343,7 @@ export function createRevalidateRendererFactory(
         deps.buildManifest.metadataRouteHashes
       );
       return {
-        element: routeResult.element,
+        payload: routeResult.payload,
       };
     };
   };

package/src/server/rsc-entry/rsc-payload.ts

@@ -10,21 +10,27 @@
 
 import type { LayoutEntry } from '../deny-renderer.js';
 import { renderDenyPageAsRsc } from '../deny-renderer.js';
-import type { RouteMatch } from '../pipeline.js';
 import type { RedirectSignal } from '../primitives.js';
 import type { LayoutComponentEntry } from '../route-element-builder.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import type { SlotSkipEntry } from '../slot-resolver.js';
 
-import {
-  buildRedirectResponse,
-  buildSegmentInfo,
-  createDebugChannelSink,
-  RSC_CONTENT_TYPE,
-} from './helpers.js';
+import { buildRedirectResponse, buildSegmentInfo, createDebugChannelSink } from './helpers.js';
+import { RSC_CONTENT_TYPE } from '../../shared/rsc-media-type.js';
+
+import { rscErrorEnvelope } from '../../shared/rsc-error-envelope.js';
 
 import type { RenderSignals } from './rsc-stream.js';
 
+/**
+ * Ceiling on waiting for a first chunk that is already in flight, used only
+ * when an addressed deny won the race against it. Matches the 50ms ceiling
+ * documented for the race itself: long enough that the error row — which is
+ * what the render just produced — arrives, short enough that a stalled stream
+ * cannot hold the response open.
+ */
+const FIRST_CHUNK_CEILING_MS = 50;
+
 /**
  * Build an RSC payload Response for a client-side navigation request.
  *
@@ -40,7 +46,6 @@ export async function buildRscPayloadResponse(
   signals: RenderSignals,
   segments: ManifestSegmentNode[],
   layoutComponents: LayoutComponentEntry[],
-  match: RouteMatch,
   responseHeaders: Headers,
   skippedSegments?: string[],
   slotSkipInfo?: SlotSkipEntry[]
@@ -70,10 +75,18 @@ export async function buildRscPayloadResponse(
     | { type: 'data'; chunk: ReadableStreamReadResult<Uint8Array> }
     | { type: 'signal' };
 
+  // Retained rather than inlined into the race below. When a signal wins, the
+  // usual answer is to cancel — but an ADDRESSED deny is one whose error row
+  // the client's boundary is going to render, so that payload has to survive
+  // (TIM-1356). Taking delivery of the read already in flight is not the
+  // "bare read() after a signal won" the async rules forbid; issuing a second
+  // one would be. It still gets a ceiling below.
+  const pendingRead = reader.read();
+
   let first: RaceResult;
   try {
     first = await Promise.race([
-      reader.read().then((chunk) => ({ type: 'data' as const, chunk })),
+      pendingRead.then((chunk) => ({ type: 'data' as const, chunk })),
       signalDetected.then(() => ({ type: 'signal' as const })),
     ]);
   } catch (_readError) {
@@ -82,12 +95,7 @@ export async function buildRscPayloadResponse(
     // SSR-rendered error page. See design/10-error-handling.md.
     reader.cancel().catch(() => {});
     signals.onSignal = undefined;
-    responseHeaders.set('X-Timber-Error', '1');
-    responseHeaders.set('content-type', 'application/json; charset=utf-8');
-    return new Response(JSON.stringify({ error: true, status: 500 }), {
-      status: 500,
-      headers: responseHeaders,
-    });
+    return rscErrorEnvelope(500, responseHeaders);
   }
 
   // If data arrived first, still check signals — they may have fired
@@ -124,15 +132,42 @@ export async function buildRscPayloadResponse(
     reader.cancel().catch(() => {});
     return buildRedirectResponse(trackedRedirect, req, responseHeaders);
   }
-  if (signals.denySignal) {
+  // An addressed deny needs no fallback: the payload already carries its error
+  // row, aimed at the boundary the client has mounted at that segment, which
+  // renders it. Cancelling would throw a finished render away and re-run the
+  // whole route — the exact cost TIM-666 removed. The status still lands,
+  // because the catch site called setDenyStatus() before re-throwing (read
+  // below via getDenyStatus).
+  //
+  // The question is asked of `unplacedDeny`, not of `denySignal.ownerKey`,
+  // because one render can produce both kinds and `denySignal` holds only one
+  // of them. A deny nothing could place has no boundary that may claim it, so
+  // its row would otherwise stream to a client with nothing to render it —
+  // and it needs the fallback whether or not some other deny was addressed
+  // first. See TIM-1356.
+  if (signals.unplacedDeny) {
     reader.cancel().catch(() => {});
+
+    // A skipped segment whose access just flipped to deny marks the signal
+    // for hard-navigate: rendering a deny page here would execute the denied
+    // segment's protected layout and place it inside cached client chrome
+    // (TIM-1074). Return rscErrorEnvelope so the client hard-navigates for
+    // a clean full render with correct deny page placement. See TIM-1363.
+    if (signals.unplacedDeny._hardNavigate) {
+      return rscErrorEnvelope(signals.unplacedDeny.status, responseHeaders);
+    }
+
+    // Read the denied segment index from ALS — set by AccessGate during
+    // render. See TIM-1358, TIM-1365.
+    const { getFirstDeniedSegmentIndex: getDeniedIdx } = await import('../deny-boundary.js');
     return renderDenyPageAsRsc(
-      signals.denySignal,
+      signals.unplacedDeny,
       segments,
       layoutComponents as LayoutEntry[],
       req,
       responseHeaders,
-      createDebugChannelSink
+      createDebugChannelSink,
+      getDeniedIdx()
     );
   }
 
@@ -143,15 +178,7 @@ export async function buildRscPayloadResponse(
   // §"Error Page Rendering for Client Navigation".
   if (signals.renderError) {
     reader.cancel().catch(() => {});
-    responseHeaders.set('X-Timber-Error', '1');
-    responseHeaders.set('content-type', 'application/json; charset=utf-8');
-    return new Response(
-      JSON.stringify({
-        error: true,
-        status: signals.renderError.status,
-      }),
-      { status: signals.renderError.status, headers: responseHeaders }
-    );
+    return rscErrorEnvelope(signals.renderError.status, responseHeaders);
   }
 
   // Extract the first chunk from the race result.
@@ -162,6 +189,41 @@ export async function buildRscPayloadResponse(
   let firstRead: ReadableStreamReadResult<Uint8Array>;
   if (first.type === 'data') {
     firstRead = first.chunk;
+  } else if (signals.denySignal?.ownerKey) {
+    // An addressed deny won the race before its own error row surfaced.
+    // Cancelling here would hand the client a 4xx payload with nothing in it
+    // — no row for the owning boundary to render, so the navigation shows
+    // nothing at all. Take delivery of the read already in flight instead,
+    // under a ceiling so a stalled stream still cannot hang the response.
+    const TIMED_OUT = Symbol('first-chunk-timeout');
+    const raced = await Promise.race([
+      pendingRead,
+      new Promise<typeof TIMED_OUT>((resolve) =>
+        setTimeout(() => resolve(TIMED_OUT), FIRST_CHUNK_CEILING_MS)
+      ),
+    ]);
+
+    // Missing the ceiling must not be reported as a finished stream. Under
+    // event-loop contention or slow serialization the row is late rather than
+    // absent, and fabricating `done: true` here would produce the very empty
+    // 4xx this branch exists to prevent.
+    //
+    // Nor can it fall to `renderDenyPageAsRsc`. That renderer re-resolves from
+    // the FULL leaf chain and wraps whatever it finds, ignoring `ownerKey` —
+    // so an `/admin` denial addressed to a root `4xx.tsx` would come back as
+    // `/admin/secret/403.tsx` with the denied layouts executed, which is the
+    // TIM-1074 leak TIM-1358 still owns. A deny this path already placed
+    // correctly must not be handed to it.
+    //
+    // So: hard-navigate. The document request renders the same deny through
+    // the boundary at its owner, with the placement intact. A full page load
+    // is a real cost, on a path that needs a status page and a stalled stream
+    // to reach at all.
+    if (raced === TIMED_OUT) {
+      reader.cancel().catch(() => {});
+      return rscErrorEnvelope(signals.denySignal.status, responseHeaders);
+    }
+    firstRead = raced;
   } else {
     await reader.cancel();
     firstRead = { done: true, value: undefined };
@@ -200,7 +262,30 @@ export async function buildRscPayloadResponse(
   // for state tree diffing on subsequent navigations. Request-dependency
   // is determined by static module-graph analysis (not runtime taint).
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
-  const segmentInfo = buildSegmentInfo(segments, layoutComponents, slotSkipInfo, skippedSegments);
+  // Read the deny state before describing the tree — what mounted depends on it.
+  // Both values are recorded in ALS during render by AccessGate's catch path.
+  const { getDenyStatus, getFirstDeniedSegmentIndex } = await import('../deny-boundary.js');
+  const denyStatus = getDenyStatus();
+  const resolvedDenyIndex = getFirstDeniedSegmentIndex();
+
+  // Emitted in full even when a deny rendered, because this header answers two
+  // questions and they diverge here. The client picks its merge point out of
+  // this list (`buildSegmentUpdates`), and a partial payload with no merge
+  // point is never inserted at all — the URL commits over the stale previous
+  // UI. So it has to keep describing the chain the payload was BUILT against.
+  //
+  // What it must not also do on a deny is seed the segment cache, since the
+  // deny page replaced a subtree and part of that chain never mounted. That
+  // half is handled at the commit site from the response status, where the
+  // merge point has already been chosen. See `client/router-pipeline.ts` and
+  // TIM-1356.
+  const segmentInfo = buildSegmentInfo(
+    segments,
+    layoutComponents,
+    slotSkipInfo,
+    skippedSegments,
+    resolvedDenyIndex
+  );
   responseHeaders.set('X-Timber-Segments', JSON.stringify(segmentInfo));
 
   // Send skipped segments so the client can merge the partial RSC payload
@@ -209,18 +294,6 @@ export async function buildRscPayloadResponse(
     responseHeaders.set('X-Timber-Skipped-Segments', JSON.stringify(skippedSegments));
   }
 
-  // Send route params so the client can populate useSegmentParams() after
-  // SPA navigation. Without this, useSegmentParams() returns {}.
-  if (Object.keys(match.segmentParams).length > 0) {
-    responseHeaders.set('X-Timber-Params', JSON.stringify(match.segmentParams));
-  }
-
-  // Check if a DenySignal was caught in-tree by AccessGate or
-  // PageDenyBoundary. The deny page is in the Flight stream as a normal
-  // element — use the deny status for the HTTP response. See TIM-666.
-  const { getDenyStatus } = await import('../deny-boundary.js');
-  const denyStatus = getDenyStatus();
-
   return new Response(patchedStream, {
     status: denyStatus ?? 200,
     headers: responseHeaders,

package/src/server/rsc-entry/rsc-stream.ts

@@ -11,6 +11,7 @@
  */
 
 import { renderToReadableStream } from '../../rsc-runtime/rsc.js';
+import type { RscPayloadRoot } from '../../shared/payload-root.js';
 
 import { randomUUID } from 'node:crypto';
 
@@ -39,6 +40,18 @@ import { isDevMode } from '../debug.js';
  */
 export interface RenderSignals {
   denySignal: DenySignal | null;
+  /**
+   * The first deny that no in-tree catch site could place — no `ownerKey`, so
+   * no boundary may claim its error row and only the re-render fallback can
+   * produce a page for it.
+   *
+   * Tracked apart from `denySignal` because one render can produce both. A
+   * deep page can hoist a 404 to a boundary that will render it while an
+   * outer layout separately throws a 403 nothing matches; whichever lands in
+   * `denySignal` first, the unplaced one still needs the fallback, and
+   * deciding from `denySignal.ownerKey` alone would strand it. See TIM-1356.
+   */
+  unplacedDeny: DenySignal | null;
   redirectSignal: RedirectSignal | null;
   renderError: { error: unknown; status: number } | null;
   /**
@@ -74,7 +87,7 @@ export interface RscStreamResult {
 }
 
 /**
- * Render a React element tree to an RSC Flight stream.
+ * Render a payload root (tree plus its params) to an RSC Flight stream.
  *
  * The stream serializes server components as rendered output and client
  * components ("use client") as serialized references with module ID + export name.
@@ -84,9 +97,10 @@ export interface RscStreamResult {
  * fires onError during stream consumption. Signals are captured in the
  * returned `signals` object for the caller to handle.
  */
-export function renderRscStream(element: React.ReactElement, req: Request): RscStreamResult {
+export function renderRscStream(payload: RscPayloadRoot, req: Request): RscStreamResult {
   const signals: RenderSignals = {
     denySignal: null,
+    unplacedDeny: null,
     redirectSignal: null,
     renderError: null,
     lastUnhandledError: null,
@@ -100,7 +114,7 @@ export function renderRscStream(element: React.ReactElement, req: Request): RscS
 
   try {
     rscStream = renderToReadableStream(
-      element,
+      payload,
       {
         signal: req.signal,
         onError(error: unknown) {
@@ -109,9 +123,18 @@ export function renderRscStream(element: React.ReactElement, req: Request): RscS
           if (isAbortError(error) || req.signal?.aborted) return;
           if (error instanceof DenySignal) {
             signals.denySignal = error;
+            if (!error.ownerKey) signals.unplacedDeny ??= error;
             signals.onSignal?.();
-            // Return structured digest for client-side error boundaries
-            return JSON.stringify({ type: 'deny', status: error.status, data: error.data });
+            // Return structured digest for client-side error boundaries.
+            // `ownerKey` is set when an in-tree catch site hoisted the deny
+            // to the segment owning the matched file — it addresses the
+            // boundary that may render it. See TIM-1356.
+            return JSON.stringify({
+              type: 'deny',
+              status: error.status,
+              data: error.data,
+              ownerKey: error.ownerKey,
+            });
           }
           if (error instanceof RedirectSignal) {
             signals.redirectSignal = error;
@@ -217,6 +240,7 @@ export function renderRscStream(element: React.ReactElement, req: Request): RscS
   } catch (error) {
     if (error instanceof DenySignal) {
       signals.denySignal = error;
+      if (!error.ownerKey) signals.unplacedDeny ??= error;
     } else if (error instanceof RedirectSignal) {
       signals.redirectSignal = error;
     } else {