@timber-js/app 0.2.0-alpha.197 → 0.2.0-alpha.199

package/src/server/route-element-helpers.ts

@@ -0,0 +1,37 @@
+/**
+ * Pure helpers for `route-element-builder.ts` — tree inspection and rewriting
+ * that need no request state. Split out so the builder stays within the
+ * 500-line limit as its wrapping steps grew (TIM-1450).
+ */
+
+import { createElement } from 'react';
+
+import { AccessGate } from './access-gate.tsx';
+import { MetadataCollector } from './metadata-collector.ts';
+import { SegmentOutlet } from '../client/segment-outlet.tsx';
+
+/**
+ * Replace the outermost SegmentOutlet in a partial payload with its
+ * SegmentProvider child. Walks through AccessGate wrappers (which sit
+ * outside SegmentOutlet) to find the outlet.
+ */
+export function replaceOutermostSegmentOutlet(
+  element: React.ReactElement,
+  replacement: React.ReactElement
+): React.ReactElement {
+  if (element.type === SegmentOutlet) {
+    return replacement;
+  }
+  // AccessGate and MetadataCollector wrap outside SegmentOutlet — recurse through them.
+  const props = element.props as Record<string, unknown>;
+  if ((element.type === AccessGate || element.type === MetadataCollector) && props.children) {
+    const inner = replaceOutermostSegmentOutlet(props.children as React.ReactElement, replacement);
+    /* eslint-disable react/no-children-prop -- createElement API */
+    return createElement(element.type as React.FunctionComponent<Record<string, unknown>>, {
+      ...props,
+      children: inner,
+    });
+    /* eslint-enable react/no-children-prop */
+  }
+  return element;
+}

package/src/server/route-handler.ts

@@ -10,7 +10,7 @@
 
 import type { RouteContext } from './types.ts';
 import { logRouteError } from './logger.ts';
-import { DenySignal, RedirectSignal } from './primitives.ts';
+import { isDenySignal, isRedirectSignal } from './primitives.ts';
 import { stripHeadBody } from './head-response.ts';
 
 // ─── Types ───────────────────────────────────────────────────────────────
@@ -127,7 +127,7 @@ async function runHandler(handler: RouteHandler, ctx: RouteContext): Promise<Res
     // Control-flow signals — propagate to the API route dispatcher so deny()
     // gets the JSON status-file chain and redirect() gets a proper 3xx with
     // Location. Not errors; don't log them.
-    if (error instanceof DenySignal || error instanceof RedirectSignal) {
+    if (isDenySignal(error) || isRedirectSignal(error)) {
       throw error;
     }
     logRouteError({ method: ctx.req.method, path: new URL(ctx.req.url).pathname, error });

package/src/server/route-module-loader.ts

@@ -0,0 +1,161 @@
+/**
+ * Route module loading — loads layout, page, and access.ts modules from
+ * a matched route's segment chain in a single pass.
+ *
+ * Extracted from `route-element-builder.ts` to keep that file focused on
+ * element-tree construction.
+ *
+ * See design/02-rendering-pipeline.md, design/07-routing.md.
+ */
+
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { Metadata } from './types.ts';
+import { loadModule } from './safe-load.ts';
+import { NoPageComponentError, type LayoutComponentEntry } from './route-element-builder.ts';
+
+/** Metadata export from a layout or page module, with its segment context. */
+export interface MetadataSource {
+  metadataExport: Metadata | (() => Promise<Metadata>);
+  segmentName: string;
+  isPage: boolean;
+  segmentIndex: number;
+}
+
+/** Access function loaded from a segment's access.ts. */
+export type AccessFn = (() => unknown) | undefined;
+
+/** Result of the module-loading phase. */
+export interface LoadedRouteModules {
+  metadataSources: MetadataSource[];
+  layoutComponents: LayoutComponentEntry[];
+  PageComponent: (...args: unknown[]) => unknown;
+  deferSuspenseFor: number;
+  accessFns: Array<AccessFn>;
+}
+
+/**
+ * Reject the legacy `generateMetadata` export with a helpful migration message.
+ * Throws if the module exports `generateMetadata` instead of `metadata`.
+ */
+function rejectLegacyGenerateMetadata(mod: Record<string, unknown>, filePath: string): void {
+  if ('generateMetadata' in mod) {
+    throw new Error(
+      `${filePath}: "generateMetadata" is not a valid export. ` +
+        `Export an async function named "metadata" instead.\n\n` +
+        `  // Before\n` +
+        `  export async function generateMetadata({ params }) { ... }\n\n` +
+        `  // After\n` +
+        `  export async function metadata() { ... }`
+    );
+  }
+}
+
+/**
+ * Extract `deferSuspenseFor` from a module and return the maximum
+ * of the current value and the module's value.
+ */
+function extractDeferSuspenseFor(mod: Record<string, unknown>, current: number): number {
+  if (typeof mod.deferSuspenseFor === 'number' && mod.deferSuspenseFor > current) {
+    return mod.deferSuspenseFor;
+  }
+  return current;
+}
+
+/**
+ * Collect metadata and deferSuspenseFor from a loaded module.
+ * Shared between layout and page loading paths.
+ */
+function collectModuleExports(
+  mod: Record<string, unknown>,
+  segment: ManifestSegmentNode,
+  segmentIndex: number,
+  isPage: boolean,
+  metadataSources: MetadataSource[],
+  currentDefer: number
+): number {
+  const filePath = (isPage ? segment.page?.filePath : segment.layout?.filePath) ?? segment.urlPath;
+  rejectLegacyGenerateMetadata(mod, filePath);
+  if (mod.metadata) {
+    metadataSources.push({
+      metadataExport: mod.metadata as Metadata | (() => Promise<Metadata>),
+      segmentName: segment.segmentName ?? segment.urlPath,
+      isPage,
+      segmentIndex,
+    });
+  }
+  return extractDeferSuspenseFor(mod, currentDefer);
+}
+
+/**
+ * Load all route modules (layouts, page, access functions) in a single pass.
+ *
+ * Access functions are loaded eagerly here so the wrapping loop does not need
+ * to await `loadModule(segment.access)` at each iteration.
+ */
+export async function loadRouteModules(
+  segments: ManifestSegmentNode[],
+  requestUrl: string
+): Promise<LoadedRouteModules> {
+  const metadataSources: MetadataSource[] = [];
+  const layoutComponents: LayoutComponentEntry[] = [];
+  const accessFns: Array<AccessFn> = [];
+  let PageComponent: ((...args: unknown[]) => unknown) | null = null;
+  let deferSuspenseFor = 0;
+
+  for (let i = 0; i < segments.length; i++) {
+    const segment = segments[i];
+    const isLeaf = i === segments.length - 1;
+
+    if (segment.layout) {
+      const mod = await loadModule(segment.layout);
+      if (mod.default) {
+        layoutComponents.push({
+          component: mod.default as (...args: unknown[]) => unknown,
+          segment,
+        });
+      }
+      deferSuspenseFor = collectModuleExports(
+        mod,
+        segment,
+        i,
+        false,
+        metadataSources,
+        deferSuspenseFor
+      );
+    }
+
+    if (isLeaf && segment.page) {
+      const mod = await loadModule(segment.page);
+      if (mod.default) {
+        PageComponent = mod.default as (...args: unknown[]) => unknown;
+      }
+      deferSuspenseFor = collectModuleExports(
+        mod,
+        segment,
+        i,
+        true,
+        metadataSources,
+        deferSuspenseFor
+      );
+    }
+
+    if (segment.access) {
+      const accessMod = await loadModule(segment.access);
+      accessFns[i] = accessMod.default as AccessFn;
+    }
+  }
+
+  if (!PageComponent) {
+    const segmentInfo = segments
+      .map(
+        (s, i) =>
+          `  [${i}] ${s.segmentName} (page: ${s.page ? 'yes' : 'no'}, layout: ${s.layout ? 'yes' : 'no'}, children: ${s.children?.length ?? 0})${i === segments.length - 1 ? ' ← leaf' : ''}`
+      )
+      .join('\n');
+    throw new NoPageComponentError(
+      `No page component found for route: ${new URL(requestUrl).pathname}\nMatched segments:\n${segmentInfo}`
+    );
+  }
+
+  return { metadataSources, layoutComponents, PageComponent, deferSuspenseFor, accessFns };
+}

package/src/server/rsc-cache-key-guard.ts

@@ -27,38 +27,7 @@
 
 import { rscCacheKey, isRscCacheKeyShape, RSC_KEY_PARAM } from '../shared/rsc-cache-key.ts';
 import { isRscContentType } from '../shared/rsc-media-type.ts';
-
-/**
- * Legacy shared-cache control fields that predate RFC 9213 and so do not
- * follow the `<target>-Cache-Control` naming pattern — the one part of this
- * rule that cannot be matched by shape. `X-Accel-Expires` is nginx
- * `proxy_cache`, which gives it precedence over `Cache-Control`.
- *
- * A closed historical set, unlike the vendor `*-Cache-Control` names, which
- * keep being minted and are handled by pattern below.
- */
-const LEGACY_CDN_CACHE_HEADERS = ['Surrogate-Control', 'Edge-Control', 'X-Accel-Expires'];
-
-/**
- * Whether a response header overrides `Cache-Control` at a shared cache.
- *
- * Matched by *shape*, not by vendor name. RFC 9213 defines targeted fields
- * as `<target>-Cache-Control`, and every CDN spells its own: `CDN-`,
- * `Cloudflare-CDN-`, `Netlify-CDN-`, `Vercel-CDN-`, and whichever ships
- * next. A vendor list here is a denylist with an unbounded tail — it was
- * extended twice during review, each time by one name, which is the signal
- * that enumeration is the wrong shape. The suffix rule is total.
- *
- * `Cache-Control` itself does not match (no `-` prefix) and is replaced
- * separately.
- */
-function isSharedCacheOverride(name: string): boolean {
-  const lowered = name.toLowerCase();
-  return (
-    lowered.endsWith('-cache-control') ||
-    LEGACY_CDN_CACHE_HEADERS.some((legacy) => legacy.toLowerCase() === lowered)
-  );
-}
+import { preventResponseCaching } from './response-cache-policy.ts';
 
 /**
  * Whether the request's `_rsc` parameter matches the key derived from its
@@ -149,14 +118,5 @@ export function hardenRscPayloadResponse(response: Response): void {
  */
 export async function enforceRscCacheKey(req: Request, response: Response): Promise<void> {
   if (await hasValidRscCacheKey(req)) return;
-  // Collected before deleting — mutating Headers while iterating its live
-  // key iterator can skip entries.
-  const overrides: string[] = [];
-  for (const name of response.headers.keys()) {
-    if (isSharedCacheOverride(name)) overrides.push(name);
-  }
-  for (const name of overrides) {
-    response.headers.delete(name);
-  }
-  response.headers.set('Cache-Control', 'private, no-store');
+  preventResponseCaching(response.headers);
 }

package/src/server/rsc-entry/action-middleware-runner.ts

@@ -26,8 +26,8 @@ import {
   setSegmentParams,
 } from '../request-context.ts';
 import { runMiddlewareChain } from '../middleware-runner.ts';
-import { DenySignal, RedirectSignal } from '../primitives.ts';
-import { ParamCoercionError } from '../route-element-builder.ts';
+import { isDenySignal, isRedirectSignal, DenySignal, RedirectSignal } from '../primitives.ts';
+import { ParamCoercionError } from '../param-coercion.ts';
 import type { RouteMatch } from '../pipeline.ts';
 import type { MiddlewareContext } from '../types.ts';
 import { requestCspNonce } from '../csp-nonce.ts';
@@ -128,14 +128,14 @@ export async function runMiddlewareForAction(
       try {
         middlewareResponse = await runMiddlewareChain(match.middlewareChain, ctx);
       } catch (err) {
-        if (err instanceof RedirectSignal) {
+        if (isRedirectSignal(err)) {
           return {
             kind: 'redirect',
             signal: err,
             setCookieHeaders: getSetCookieHeaders(),
           };
         }
-        if (err instanceof DenySignal) {
+        if (isDenySignal(err)) {
           return {
             kind: 'deny',
             signal: err,

package/src/server/rsc-entry/api-handler.ts

@@ -9,7 +9,7 @@
 import { withSpan, setSpanAttribute } from '../tracing.ts';
 import type { ManifestSegmentNode } from '../route-matcher.ts';
 import { loadModule } from '../safe-load.ts';
-import { DenySignal, RedirectSignal } from '../primitives.ts';
+import { isDenySignal, isRedirectSignal, DenySignal, RedirectSignal } from '../primitives.ts';
 import { handleRouteRequest } from '../route-handler.ts';
 import { stripHeadBody } from '../head-response.ts';
 import { isDebug } from '../debug.ts';
@@ -49,13 +49,13 @@ export async function handleApiRoute(
                 await accessFn();
                 await setSpanAttribute('timber.result', 'pass');
               } catch (error) {
-                if (error instanceof DenySignal) {
+                if (isDenySignal(error)) {
                   await setSpanAttribute('timber.result', 'deny');
                   await setSpanAttribute('timber.deny_status', error.status);
                   if (error.sourceFile) {
                     await setSpanAttribute('timber.deny_file', error.sourceFile);
                   }
-                } else if (error instanceof RedirectSignal) {
+                } else if (isRedirectSignal(error)) {
                   await setSpanAttribute('timber.result', 'redirect');
                 }
                 throw error;
@@ -104,10 +104,10 @@ async function translateApiSignal(
   segments: ManifestSegmentNode[],
   responseHeaders: Headers
 ): Promise<Response | null> {
-  if (error instanceof DenySignal) {
+  if (isDenySignal(error)) {
     return stripHeadBody(await renderApiDeny(error, segments, responseHeaders), req.method);
   }
-  if (error instanceof RedirectSignal) {
+  if (isRedirectSignal(error)) {
     responseHeaders.set('Location', error.location);
     return new Response(null, { status: error.status, headers: responseHeaders });
   }

package/src/server/rsc-entry/error-renderer.ts

@@ -20,7 +20,7 @@ import { logRenderError } from '../logger.ts';
 import { appVisibleSearch } from '../../shared/rsc-cache-key.ts';
 import { getSlotParamsForClient } from '../request-context.ts';
 import type { ManifestSegmentNode } from '../route-matcher.ts';
-import { DenySignal, RenderError } from '../primitives.ts';
+import { isRenderError, DenySignal, RenderError } from '../primitives.ts';
 import type { ClientBootstrapConfig } from '../html-injectors.ts';
 import { flightInitScript, htmlEscapeJsonString } from '../flight-scripts.ts';
 import { getCspNonce } from '../csp-nonce.ts';
@@ -40,7 +40,7 @@ import { loadModule } from '../safe-load.ts';
 import { sourceMapError } from '../dev-source-map.ts';
 import { isMdxFilePath as isMdxFile } from '../utils/mdx-file.ts';
 import { defaultStatusPageResponse } from '../default-status-page.ts';
-import { rscErrorEnvelope } from '../../shared/rsc-error-envelope.ts';
+import { rscErrorEnvelope } from '../rsc-error-envelope.ts';
 
 /**
  * A manifest file reference with lazy import and path.
@@ -289,8 +289,7 @@ async function renderErrorPageViaRsc(
     // SerializableError (plain object) and reconstitutes a real Error
     // before passing to the user's error component.
     const serializedError = toSerializableError(error);
-    const digest =
-      error instanceof RenderError ? { code: error.code, data: error.digest.data } : null;
+    const digest = isRenderError(error) ? { code: error.code, data: error.digest.data } : null;
 
     element = h(ErrorReconstituter, {
       error: serializedError,

package/src/server/rsc-entry/helpers.ts

@@ -9,7 +9,7 @@ import { swallow } from '../logger.ts';
 import { computeSegmentKeys, computeSegmentTreePaths } from '../../routing/segment-keys.ts';
 import type { SegmentInfo } from '../../shared/segment-info.ts';
 import type { SlotSkipEntry } from '../slot-resolver.ts';
-import { isClientReference } from '../route-element-builder.ts';
+import { isClientReference } from '../utils/element-type.ts';
 import { isStaticRequestDependent } from '../request-dep.ts';
 
 /**

package/src/server/rsc-entry/index.ts

@@ -72,15 +72,15 @@ import { generateStaticSite } from '../static-generator.ts';
  * Resolve the Server-Timing mode from timber.config.ts.
  *
  * If the user set `serverTiming` explicitly, use that value.
- * Otherwise: `'detailed'` in dev, `'total'` in production.
+ * Otherwise default to `'total'`.
  */
 function resolveServerTimingMode(
   config: Record<string, unknown>,
-  isDev: boolean
+  _isDev: boolean
 ): 'detailed' | 'total' | false {
   const userValue = config.serverTiming as 'detailed' | 'total' | false | undefined;
   if (userValue !== undefined) return userValue;
-  return isDev ? 'detailed' : 'total';
+  return 'total';
 }
 
 /**

package/src/server/rsc-entry/render-route.ts

@@ -31,11 +31,8 @@ import type { LayoutEntry } from '../deny-renderer.ts';
 import { renderDenyPage, renderDenyPageAsRsc } from '../deny-renderer.ts';
 import type { ClientBootstrapConfig } from '../html-injectors.ts';
 import type { InterceptionContext, RouteMatch } from '../pipeline.ts';
-import {
-  buildRouteElement,
-  NoPageComponentError,
-  ParamCoercionError,
-} from '../route-element-builder.ts';
+import { buildRouteElement, NoPageComponentError } from '../route-element-builder.ts';
+import { ParamCoercionError } from '../param-coercion.ts';
 import type { ManifestSegmentNode } from '../route-matcher.ts';
 import { recordTiming } from '../server-timing.ts';
 import { requestContextAls } from '../als-registry.ts';
@@ -146,8 +143,8 @@ export async function renderRoute(
     layoutComponents,
     deferSuspenseFor,
     skippedSegments,
-    shellSettled,
     slotSkipInfo,
+    leafDenyChain,
   } = routeResult;
 
   // Build head HTML for injection into the SSR output.
@@ -201,8 +198,7 @@ export async function renderRoute(
 
   // Render to RSC Flight stream with signal tracking.
   const _rscStart = performance.now();
-  const { rscStream, signals, getDebugComponents } = renderRscStream(payload, req);
-  if (shellSettled) signals.shellSettled = shellSettled;
+  const { rscStream, signals, getDebugComponents } = renderRscStream(payload, req, leafDenyChain);
 
   // Store the debug components getter in ALS so onPipelineError can
   // include component tree context for render-phase errors (dev mode only).

package/src/server/rsc-entry/rsc-payload.ts

@@ -5,7 +5,18 @@
  * returned directly without SSR HTML rendering. The client decodes it via
  * `createFromFetch` and renders into the hydrated React root.
  *
- * Design docs: 19-client-navigation.md §"RSC Payload Handling"
+ * The response's HTTP status carries no deny semantics: a payload response
+ * commits 200 when Flight's opening window closes (the first chunk plus one
+ * macrotask), and a deny, redirect, or error that lands after that rides
+ * the payload as a Flight error row for the client's boundaries — the same
+ * way a nested component's already did. The status
+ * code contract (design/05) is a document-path contract, enforced by Fizz's
+ * `onShellReady`; Flight has no such checkpoint, and the only reader of a
+ * payload response's status is the static generator's check for an error
+ * envelope — the client router reads the body. See TIM-1495.
+ *
+ * Design docs: 19-client-navigation.md §"RSC Payload Handling",
+ *              04-authorization.md §"Status codes on the RSC payload path"
  */
 
 import type { LayoutEntry } from '../deny-renderer.ts';
@@ -18,7 +29,7 @@ import type { SlotSkipEntry } from '../slot-resolver.ts';
 import { buildRedirectResponse, buildSegmentInfo, createDebugChannelSink } from './helpers.ts';
 import { RSC_CONTENT_TYPE } from '../../shared/rsc-media-type.ts';
 
-import { rscErrorEnvelope } from '../../shared/rsc-error-envelope.ts';
+import { rscErrorEnvelope } from '../rsc-error-envelope.ts';
 
 import type { RenderSignals } from './rsc-stream.ts';
 
@@ -39,6 +50,16 @@ const FIRST_CHUNK_CEILING_MS = 50;
  * renderToReadableStream. Reading one chunk triggers rendering of the
  * initial component tree, allowing onError to capture DenySignal/
  * RedirectSignal before we commit the response. See TIM-344.
+ *
+ * The commit point is the close of Flight's opening window: the first chunk
+ * plus one macrotask turn. Nothing is held for it. A signal that lands
+ * inside the window still gets a server-level answer — a redirect response,
+ * the fallback deny page, the hard-navigate envelope — because the race
+ * below and the one timer turn after it deliver it for free. A signal that
+ * lands after it is a row in the stream, and the client's boundaries answer
+ * it. Waiting for the shell components to settle (TIM-1045, TIM-1208) made
+ * the payload path pretend to a status contract it could not keep for
+ * nested components, and was removed in TIM-1495.
  */
 export async function buildRscPayloadResponse(
   req: Request,
@@ -98,36 +119,25 @@ export async function buildRscPayloadResponse(
     return rscErrorEnvelope(500, responseHeaders);
   }
 
-  // If data arrived first, still check signals — they may have fired
-  // concurrently. Wait for all deny-capable shell components (layouts
-  // with deny chains + page) to settle so async deny() calls preceded
-  // by I/O are captured. See TIM-1045, TIM-1208.
+  // The first chunk arrived with no signal yet. Give Flight's opening window
+  // one macrotask to close before committing: Flight pings continuation
+  // tasks as microtasks only during that window (`startWork` closes it with
+  // a `setTimeout(0)`) and as macrotasks after it, so everything that throws
+  // synchronously or after microtask-only work — a page body calling
+  // `redirect()`, a hundred nested components awaiting `Promise.resolve()` —
+  // has reached `onError` by the time this timer fires, and gets the server
+  // answer below (the 204 redirect, the fallback deny page, the envelope)
+  // rather than a row the client has to answer. Anything that awaited a
+  // timer or I/O has left the window and rides the payload. Nothing is
+  // tracked and nothing is waited for: the cost is one timer turn, and the
+  // status is 200 either way — this decides which mechanism answers, not
+  // what the response claims.
   if (first.type === 'data' && !signals.redirectSignal && !signals.denySignal) {
-    // Sync deny (AccessGate pre-pass replay) sets getDenyStatus() during
-    // renderToReadableStream — before the first chunk is read. Skip the
-    // wait entirely: components below the denied gate never execute.
-    const { getDenyStatus: earlyDenyCheck } = await import('../deny-boundary.ts');
-    if (signals.shellSettled && !earlyDenyCheck()) {
-      // Wait for all deny-capable shell components to finish, or for an
-      // in-tree layout deny to short-circuit (setDenyStatus already
-      // called), or for a signal to escape to onError. TIM-1045, TIM-1208.
-      await Promise.race([signals.shellSettled, signalDetected]);
-      // onSettled fires from the raw metadata promise's rejection handler,
-      // which runs in the same microtask as the rejection. React Flight's
-      // onError fires synchronously inside that microtask (serializeThenable
-      // rejection → erroredTask → logRecoverableError → onError). One
-      // macrotask yield is enough for onError to set signals.denySignal /
-      // signals.redirectSignal / signals.renderError before we check.
-      // Pinned by tests/react-server/metadata-signal-ordering.test.ts.
-      await new Promise<void>((r) => setTimeout(r, 0));
-    } else if (!earlyDenyCheck()) {
-      // No deny-capable shell components (client component page, no deny
-      // chain) — brief yield to let in-flight microtask rejections complete.
-      await new Promise<void>((r) => setTimeout(r, 0));
-    }
+    await new Promise<void>((r) => setTimeout(r, 0));
   }
 
-  // Detach the callback — no longer needed after this point.
+  // Detach the callback — the window has closed, and a signal arriving after
+  // it is a row in the stream the client answers.
   signals.onSignal = undefined;
 
   // Check for redirect/deny signals detected during initial rendering
@@ -139,11 +149,9 @@ export async function buildRscPayloadResponse(
   // An addressed deny needs no fallback: the payload already carries its error
   // row, aimed at the boundary the client has mounted at that segment, which
   // renders it. Cancelling would throw a finished render away and re-run the
-  // whole route — the exact cost TIM-666 removed. The status still lands,
-  // because the catch site called setDenyStatus() before re-throwing (read
-  // below via getDenyStatus).
+  // whole route — the exact cost TIM-666 removed.
   //
-  // The question is asked of `unplacedDeny`, not of `denySignal.ownerKey`,
+  // The question is asked of `unplacedDeny`, not of `denySignal.owners`,
   // because one render can produce both kinds and `denySignal` holds only one
   // of them. A deny nothing could place has no boundary that may claim it, so
   // its row would otherwise stream to a client with nothing to render it —
@@ -193,7 +201,7 @@ export async function buildRscPayloadResponse(
   let firstRead: ReadableStreamReadResult<Uint8Array>;
   if (first.type === 'data') {
     firstRead = first.chunk;
-  } else if (signals.denySignal?.ownerKey) {
+  } else if (signals.denySignal?.owners) {
     // An addressed deny won the race before its own error row surfaced.
     // Cancelling here would hand the client a 4xx payload with nothing in it
     // — no row for the owning boundary to render, so the navigation shows
@@ -266,10 +274,11 @@ export async function buildRscPayloadResponse(
   // for state tree diffing on subsequent navigations. Request-dependency
   // is determined by static module-graph analysis (not runtime taint).
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
-  // Read the deny state before describing the tree — what mounted depends on it.
-  // Both values are recorded in ALS during render by AccessGate's catch path.
-  const { getDenyStatus, getFirstDeniedSegmentIndex } = await import('../deny-boundary.ts');
-  const denyStatus = getDenyStatus();
+  // Read the deny index before describing the tree — what mounted depends on
+  // it. Recorded in ALS during render by AccessGate's catch path; a gate that
+  // denies after this point leaves it unset, and the header then describes
+  // the full chain, which is the merge-point answer either way.
+  const { getFirstDeniedSegmentIndex } = await import('../deny-boundary.ts');
   const resolvedDenyIndex = getFirstDeniedSegmentIndex();
 
   // Emitted in full even when a deny rendered, because this header answers two
@@ -280,9 +289,10 @@ export async function buildRscPayloadResponse(
   //
   // What it must not also do on a deny is seed the segment cache, since the
   // deny page replaced a subtree and part of that chain never mounted. That
-  // half is handled at the commit site from the response status, where the
-  // merge point has already been chosen. See `client/router-pipeline.ts` and
-  // TIM-1356.
+  // half is decided on the client by the boundary that renders the status
+  // page, at the commit that puts it on screen — the only place that knows,
+  // since the row may arrive after this response has been returned. See
+  // `client/navigation-commit.ts` and TIM-1356, TIM-1495.
   const segmentInfo = buildSegmentInfo(
     segments,
     layoutComponents,
@@ -298,8 +308,15 @@ export async function buildRscPayloadResponse(
     responseHeaders.set('X-Timber-Skipped-Segments', JSON.stringify(skippedSegments));
   }
 
+  // Always 200. A deny that already streamed — addressed at its owner's
+  // boundary — is in the body, not the status line, and the one consumer of
+  // this response, the client router, reads the body. A status here would be
+  // right only for denies that happened to land before this line and wrong
+  // for every nested component that denies after I/O, and a status that is
+  // sometimes right is a contract nothing may rely on. So it makes no claim.
+  // See design/04-authorization.md §"Status codes on the RSC payload path".
   return new Response(patchedStream, {
-    status: denyStatus ?? 200,
+    status: 200,
     headers: responseHeaders,
   });
 }