@timber-js/app 0.2.0-alpha.207 → 0.2.0-alpha.209

package/src/server/pipeline.ts

@@ -55,15 +55,19 @@ import { isDebug } from './debug.ts';
 export interface RouteMatch {
   /** The matched segment chain from root to leaf. */
   segments: ManifestSegmentNode[];
-  /** Extracted segment params (catch-all segments produce string[]). Post-coercion, values may be non-string (TIM-1347). */
+  /**
+   * Segment params as the page sees them. The matcher sets them to the raw
+   * values; whoever runs `coerceSegmentParams()` replaces them with its
+   * result, whose values may be non-string (TIM-1347).
+   */
   segmentParams: CoercedParams;
   /**
-   * Raw segment params before codec coercion. Always string or string[].
-   * Used by slot resolution to reconstruct URL parts — coerced params may
-   * have been transformed by codecs and are unsuitable for URL matching.
-   * Set by the pipeline before coercion runs.
+   * Segment params as the URL carried them (catch-all segments produce
+   * string[]). Set by the matcher, which owns them, and never replaced.
+   * Slot resolution and URL-part reconstruction read these: coerced values
+   * need not round-trip to the URL (`"007"` → `7`).
    */
-  rawSegmentParams?: Record<string, string | string[]>;
+  rawSegmentParams: Record<string, string | string[]>;
   /** Middleware chain from the segment tree, ordered root-to-leaf. */
   middlewareChain: MiddlewareFn[];
 }
@@ -87,7 +91,6 @@ export type RouteRenderer = (
   req: Request,
   match: RouteMatch,
   responseHeaders: Headers,
-  requestHeaderOverlay: Headers,
   interception?: InterceptionContext
 ) => Response | Promise<Response>;
 
@@ -184,33 +187,6 @@ export interface PipelineConfig {
    */
   onPipelineError?: (error: Error, phase: string) => void;
 
-  /**
-   * Dev error handler with RSC debug context — set by the dev server after
-   * the RSC entry module is imported. `onPipelineError` resolves debug
-   * components from ALS and delegates to this handler.
-   *
-   * This is a mutable property (not a constructor argument) because the dev
-   * server imports the RSC entry module first (which constructs the config),
-   * then wires in the overlay handler. Moving the state here (from a
-   * module-level `let`) keeps it co-located with the config it belongs to
-   * and makes it visible in tests without module-level mutation.
-   *
-   * Undefined in production — zero overhead.
-   */
-  devPipelineErrorHandler?: (error: Error, phase: string) => void;
-
-  /**
-   * HMR connection options for dev-only HTML pages (dev 404 page, fallback
-   * error page) — set by the dev server after the RSC entry module is
-   * imported, like `devPipelineErrorHandler`. The RSC environment can't
-   * read the Vite server config (separate module graph), so the dev server
-   * plumbs the resolved HMR endpoint (protocol/host/port/path/token) here
-   * for the pages' auto-reload WebSocket. See TIM-1067.
-   *
-   * Undefined in production — zero overhead.
-   */
-  devHmrOptions?: import('../dev-tools/dev-page-shell.ts').DevErrorHmrOptions;
-
   /**
    * Fallback error renderer — called when a catastrophic error escapes the
    * render phase. Produces an HTML Response instead of a bare empty 500.
@@ -225,7 +201,13 @@ export interface PipelineConfig {
   renderFallbackError?: (
     error: unknown,
     req: Request,
-    responseHeaders: Headers
+    responseHeaders: Headers,
+    /**
+     * The matched route, when the error came after matching. A route.ts
+     * match is answered in the API route's JSON format, never a page
+     * (design/10-error-handling.md §"JSON Error Pages").
+     */
+    match?: RouteMatch
   ) => Response | Promise<Response>;
   /**
    * Fallback deny page renderer — called when a DenySignal escapes from
@@ -261,7 +243,10 @@ export interface PipelineConfig {
    *
    * The `reenter` parameter is the full pipeline function (including proxy,
    * ALS, tracing) for the no-JS validation rerender path — the synthetic
-   * GET flows through the complete pipeline.
+   * GET flows through the complete pipeline. Its `cookies` argument becomes
+   * that request's parsed cookies (`runWithRequestContext`'s `cookies`
+   * option), so the rerender reads the action's post-mutation state without
+   * the pipeline needing the same `Request` object to reach it.
    *
    * Moved into the pipeline (TIM-1213) so proxy.ts runs on action POSTs,
    * matching the design doc contract: "proxy.ts runs on every request,
@@ -270,7 +255,7 @@ export interface PipelineConfig {
   dispatchAction?: (
     req: Request,
     canonicalPath: string,
-    reenter: (req: Request) => Promise<Response>
+    reenter: (req: Request, cookies: Map<string, string>) => Promise<Response>
   ) => Promise<Response | null>;
 }
 
@@ -303,12 +288,11 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
   // passes a synthetic GET back through the full pipeline (including
   // proxy, ALS, tracing). The inner closure captures `pipelineFn` by
   // name; by the time it's invoked, the const binding is initialized.
-  const pipelineFn = async (req: Request): Promise<Response> => {
+  const pipelineFn = async (req: Request, cookies?: Map<string, string>): Promise<Response> => {
     const url = new URL(req.url);
     const method = req.method;
     const path = url.pathname;
     const startTime = performance.now();
-    activeRequests++;
 
     // Establish per-request trace ID scope (design/17-logging.md §"trace_id is Always Set").
     // This runs before runWithRequestContext so traceId() is available from the
@@ -316,194 +300,206 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
     const traceIdValue = generateTraceId();
 
     return runWithTraceId(traceIdValue, async () => {
-      // Establish request context ALS scope so getHeaders() and getCookies() work
-      // throughout the entire request lifecycle (proxy, middleware, render).
-      return runWithRequestContext(req, async () => {
+      // Runs in the request context ALS scope, so getHeaders() and getCookies()
+      // work throughout the entire request lifecycle (proxy, middleware, render).
+      const inRequestContext = async () => {
         // In dev mode, wrap with timing collector for Server-Timing header.
         // The collector uses ALS so timing entries are per-request.
         const runRequest = async () => {
           logRequestReceived({ method, path });
 
-          const response = await withSpan(
-            'http.server.request',
-            { 'http.request.method': method, 'url.path': path },
-            async () => {
-              // If OTEL is active, the root span now exists — replace the UUID
-              // fallback with the real OTEL trace ID for log–trace correlation.
-              const otelIds = await getOtelTraceId();
-              if (otelIds) {
-                replaceTraceId(otelIds.traceId, otelIds.spanId);
-              }
+          // Incremented and decremented in one scope, the decrement in
+          // `finally`: a rejection that escaped the span used to skip it and
+          // leave the request counted as in flight for the life of the
+          // process (TIM-1537).
+          activeRequests++;
+          let concurrency = activeRequests;
+          let response: Response;
+          try {
+            response = await withSpan(
+              'http.server.request',
+              { 'http.request.method': method, 'url.path': path },
+              async () => {
+                // If OTEL is active, the root span now exists — replace the UUID
+                // fallback with the real OTEL trace ID for log–trace correlation.
+                const otelTraceId = await getOtelTraceId();
+                if (otelTraceId) {
+                  replaceTraceId(otelTraceId);
+                }
 
-              // Stage 0: Canonicalize URL at the outer boundary — before
-              // proxy.ts sees the request. Every layer (proxy, middleware,
-              // access, render) must see the same canonical path.
-              // See design/07-routing.md §"URL Canonicalization & Security".
-              const stripTrailingSlash = config.stripTrailingSlash ?? true;
-              const canonResult = canonicalize(url.pathname, stripTrailingSlash);
-              if (!canonResult.ok) {
-                if (isDebug()) {
-                  console.warn(
-                    `[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${canonResult.status}\n` +
-                      `  This usually means the URL contains encoded separators (%2f, %5c),\n` +
-                      `  null bytes (%00), path traversal (..), or malformed percent-encoding.`
-                  );
+                // Stage 0: Canonicalize URL at the outer boundary — before
+                // proxy.ts sees the request. Every layer (proxy, middleware,
+                // access, render) must see the same canonical path.
+                // See design/07-routing.md §"URL Canonicalization & Security".
+                const stripTrailingSlash = config.stripTrailingSlash ?? true;
+                const canonResult = canonicalize(url.pathname, stripTrailingSlash);
+                if (!canonResult.ok) {
+                  if (isDebug()) {
+                    console.warn(
+                      `[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${canonResult.status}\n` +
+                        `  This usually means the URL contains encoded separators (%2f, %5c),\n` +
+                        `  null bytes (%00), path traversal (..), or malformed percent-encoding.`
+                    );
+                  }
+                  return new Response(null, { status: canonResult.status });
+                }
+                const canonicalPath = canonResult.pathname;
+
+                // Construct a Request with the canonical URL so proxy.ts sees
+                // the same path that route matching will use. This prevents
+                // auth bypass via /admin/, /%61dmin, etc.
+                let canonicalReq = req;
+                if (url.pathname !== canonicalPath) {
+                  const canonicalUrl = new URL(req.url);
+                  canonicalUrl.pathname = canonicalPath;
+                  canonicalReq = new Request(canonicalUrl.toString(), req);
                 }
-                return new Response(null, { status: canonResult.status });
-              }
-              const canonicalPath = canonResult.pathname;
-
-              // Construct a Request with the canonical URL so proxy.ts sees
-              // the same path that route matching will use. This prevents
-              // auth bypass via /admin/, /%61dmin, etc.
-              let canonicalReq = req;
-              if (url.pathname !== canonicalPath) {
-                const canonicalUrl = new URL(req.url);
-                canonicalUrl.pathname = canonicalPath;
-                canonicalReq = new Request(canonicalUrl.toString(), req);
-              }
 
-              // Build the inner handler — runs after proxy, before route
-              // matching. Checks for server action POSTs and dispatches them
-              // without entering the route match → middleware → render chain.
-              // Falls through to handleRequest for normal route handling.
-              // TIM-1213: action dispatch is now INSIDE the pipeline so
-              // proxy.ts runs on every request, including action POSTs.
-              const innerHandler = async (): Promise<Response> => {
-                if (config.dispatchAction) {
-                  const actionResult = await config.dispatchAction(
+                // Build the inner handler — runs after proxy, before route
+                // matching. Checks for server action POSTs and dispatches them
+                // without entering the route match → middleware → render chain.
+                // Falls through to handleRequest for normal route handling.
+                // TIM-1213: action dispatch is now INSIDE the pipeline so
+                // proxy.ts runs on every request, including action POSTs.
+                const innerHandler = async (): Promise<Response> => {
+                  if (config.dispatchAction) {
+                    const actionResult = await config.dispatchAction(
+                      canonicalReq,
+                      canonicalPath,
+                      pipelineFn
+                    );
+                    if (actionResult) return actionResult;
+                  }
+                  return handleRequest(config, canonicalReq, method, canonicalPath, true);
+                };
+
+                let result: Response;
+                if (proxyResolver) {
+                  const outcome = await runProxyPhase(
+                    config,
+                    proxyResolver,
                     canonicalReq,
+                    method,
                     canonicalPath,
-                    pipelineFn
+                    innerHandler
                   );
-                  if (actionResult) return actionResult;
+                  result = await outcomeToResponse(config, outcome, {
+                    req: canonicalReq,
+                    method,
+                    path: canonicalPath,
+                  });
+                } else {
+                  result = await innerHandler();
                 }
-                return handleRequest(config, canonicalReq, method, canonicalPath, true);
-              };
-
-              let result: Response;
-              if (proxyResolver) {
-                const outcome = await runProxyPhase(
-                  config,
-                  proxyResolver,
-                  canonicalReq,
-                  method,
-                  canonicalPath,
-                  innerHandler
-                );
-                result = await outcomeToResponse(config, outcome, {
-                  req: canonicalReq,
-                  method,
-                  path: canonicalPath,
-                });
-              } else {
-                result = await innerHandler();
-              }
 
-              // Set response status on the root span before it ends —
-              // DevSpanProcessor reads this for tree/summary output.
-              await setSpanAttribute('http.response.status_code', result.status);
-
-              // Vary on exactly the headers the `_rsc` cache key hashes.
-              //
-              // Those two mechanisms answer the same question — which request
-              // headers change this response — so they are the same list, not
-              // two lists that happen to agree. A separate hand-written list
-              // here drifted from `RSC_KEY_HEADERS` the moment the key set
-              // grew, and the drift is invisible: `Vary` is the *fallback*
-              // layer, used only when a cache omits the query from its key,
-              // which is precisely when nobody is watching (TIM-1268).
-              //
-              // Why any of it: without `Vary: Accept` a shared cache may serve
-              // an RSC Flight payload to a browser expecting HTML, or the
-              // reverse (GHSA-wfc6-r584-vfw7, design/13-security.md). The
-              // `_rsc` param puts that distinction in the URL, so correctness
-              // no longer *depends* on `Vary` — which is opt-in configuration
-              // on Cloudflare and CloudFront. `Vary` covers the requests that
-              // arrive without the param: a stripped query, a hand-rolled
-              // client.
-              //
-              // It costs no hit rate. Document requests send no `X-Timber-*`
-              // header at all, so they collapse to a single cache key; payload
-              // requests are already fragmented by these same values via the
-              // URL.
-              const varyTokens = [...RSC_KEY_HEADERS];
-              const existingVary = result.headers.get('Vary');
-              const existingTokens = existingVary
-                ? existingVary
-                    .toLowerCase()
-                    .split(',')
-                    .map((t) => t.trim())
-                : [];
-              const newTokens = varyTokens.filter((t) => !existingTokens.includes(t.toLowerCase()));
-              if (newTokens.length > 0) {
-                result.headers.set(
-                  'Vary',
-                  existingVary ? `${existingVary}, ${newTokens.join(', ')}` : newTokens.join(', ')
+                // Set response status on the root span before it ends —
+                // DevSpanProcessor reads this for tree/summary output.
+                await setSpanAttribute('http.response.status_code', result.status);
+
+                // Vary on exactly the headers the `_rsc` cache key hashes.
+                //
+                // Those two mechanisms answer the same question — which request
+                // headers change this response — so they are the same list, not
+                // two lists that happen to agree. A separate hand-written list
+                // here drifted from `RSC_KEY_HEADERS` the moment the key set
+                // grew, and the drift is invisible: `Vary` is the *fallback*
+                // layer, used only when a cache omits the query from its key,
+                // which is precisely when nobody is watching (TIM-1268).
+                //
+                // Why any of it: without `Vary: Accept` a shared cache may serve
+                // an RSC Flight payload to a browser expecting HTML, or the
+                // reverse (GHSA-wfc6-r584-vfw7, design/13-security.md). The
+                // `_rsc` param puts that distinction in the URL, so correctness
+                // no longer *depends* on `Vary` — which is opt-in configuration
+                // on Cloudflare and CloudFront. `Vary` covers the requests that
+                // arrive without the param: a stripped query, a hand-rolled
+                // client.
+                //
+                // It costs no hit rate. Document requests send no `X-Timber-*`
+                // header at all, so they collapse to a single cache key; payload
+                // requests are already fragmented by these same values via the
+                // URL.
+                const varyTokens = [...RSC_KEY_HEADERS];
+                const existingVary = result.headers.get('Vary');
+                const existingTokens = existingVary
+                  ? existingVary
+                      .toLowerCase()
+                      .split(',')
+                      .map((t) => t.trim())
+                  : [];
+                const newTokens = varyTokens.filter(
+                  (t) => !existingTokens.includes(t.toLowerCase())
                 );
-              }
+                if (newTokens.length > 0) {
+                  result.headers.set(
+                    'Vary',
+                    existingVary ? `${existingVary}, ${newTokens.join(', ')}` : newTokens.join(', ')
+                  );
+                }
 
-              // A request may only claim an `_rsc` cache key that matches its
-              // own headers. The key is predictable by design, so without this
-              // a caller could render its own variant under another client's
-              // key and have a shared cache store it there (TIM-1268).
-              await enforceRscCacheKey(canonicalReq, result);
-
-              // Flight payloads must never be sniffable into a renderable
-              // type — applied at this single exit so every producer is
-              // covered, not just the success path (TIM-1268).
-              hardenRscPayloadResponse(result);
-
-              // A HEAD response carries the headers its GET would produce and
-              // no content (RFC 9110 §9.3.2). Applied at this single exit so
-              // every response shape is covered — page render, API route,
-              // metadata route, deny page, error page, proxy short-circuit —
-              // rather than per-renderer, where it was missing for page
-              // renders entirely (TIM-1324). The render still runs: the
-              // headers have to be the ones a GET would have sent.
-              result = stripHeadBody(result, method);
-
-              // Append Server-Timing header based on configured mode.
-              // Header mutability is guaranteed by the producer-side clone
-              // in `outcomeToResponse` and the metadata-route / auto-sitemap
-              // user-handler clones in `handleRequest`, so we can write
-              // directly without a runtime probe. See TIM-866.
-              if (serverTiming === 'detailed') {
-                // Detailed: per-phase breakdown (proxy, middleware, render).
-                const timingHeader = getServerTimingHeader();
-                if (timingHeader) {
-                  result.headers.set('Server-Timing', timingHeader);
+                // A request may only claim an `_rsc` cache key that matches its
+                // own headers. The key is predictable by design, so without this
+                // a caller could render its own variant under another client's
+                // key and have a shared cache store it there (TIM-1268).
+                await enforceRscCacheKey(canonicalReq, result);
+
+                // Flight payloads must never be sniffable into a renderable
+                // type — applied at this single exit so every producer is
+                // covered, not just the success path (TIM-1268).
+                hardenRscPayloadResponse(result);
+
+                // A HEAD response carries the headers its GET would produce and
+                // no content (RFC 9110 §9.3.2). Applied at this single exit so
+                // every response shape is covered — page render, API route,
+                // metadata route, deny page, error page, proxy short-circuit —
+                // rather than per-renderer, where it was missing for page
+                // renders entirely (TIM-1324). The render still runs: the
+                // headers have to be the ones a GET would have sent.
+                result = stripHeadBody(result, method);
+
+                // Append Server-Timing header based on configured mode.
+                // Header mutability is guaranteed by the producer-side clone
+                // in `outcomeToResponse` and the metadata-route / auto-sitemap
+                // user-handler clones in `handleRequest`, so we can write
+                // directly without a runtime probe. See TIM-866.
+                if (serverTiming === 'detailed') {
+                  // Detailed: per-phase breakdown (proxy, middleware, render).
+                  const timingHeader = getServerTimingHeader();
+                  if (timingHeader) {
+                    result.headers.set('Server-Timing', timingHeader);
+                  }
+                } else if (serverTiming === 'total') {
+                  // Total only: single `total;dur=N` — no phase names.
+                  // Prevents information disclosure while giving browser
+                  // DevTools useful timing data.
+                  const totalMs = Math.round(performance.now() - startTime);
+                  result.headers.set('Server-Timing', `total;dur=${totalMs}`);
+                }
+                // serverTiming === false: no header at all
+
+                // Wrap the response body with stream-lifecycle timing when
+                // detailed mode is on. Logs firstChunk/lastChunk/maxGap/close
+                // on stream close — measures the post-flush stream tail that
+                // the Server-Timing header can't capture (TIM-1106).
+                if (serverTiming === 'detailed' && result.body) {
+                  result = new Response(wrapResponseWithStreamTiming(result.body, startTime), {
+                    status: result.status,
+                    statusText: result.statusText,
+                    headers: result.headers,
+                  });
                 }
-              } else if (serverTiming === 'total') {
-                // Total only: single `total;dur=N` — no phase names.
-                // Prevents information disclosure while giving browser
-                // DevTools useful timing data.
-                const totalMs = Math.round(performance.now() - startTime);
-                result.headers.set('Server-Timing', `total;dur=${totalMs}`);
-              }
-              // serverTiming === false: no header at all
-
-              // Wrap the response body with stream-lifecycle timing when
-              // detailed mode is on. Logs firstChunk/lastChunk/maxGap/close
-              // on stream close — measures the post-flush stream tail that
-              // the Server-Timing header can't capture (TIM-1106).
-              if (serverTiming === 'detailed' && result.body) {
-                result = new Response(wrapResponseWithStreamTiming(result.body, startTime), {
-                  status: result.status,
-                  statusText: result.statusText,
-                  headers: result.headers,
-                });
-              }
 
-              return result;
-            }
-          );
+                return result;
+              }
+            );
+          } finally {
+            concurrency = activeRequests;
+            activeRequests--;
+          }
 
           // Post-span: structured production logging
           const durationMs = Math.round(performance.now() - startTime);
           const status = response.status;
-          const concurrency = activeRequests;
-          activeRequests--;
           logRequestCompleted({ method, path, status, durationMs, concurrency });
 
           if (slowRequestMs > 0 && durationMs > slowRequestMs) {
@@ -514,7 +510,8 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
         };
 
         return serverTiming === 'detailed' ? runWithTimingCollector(runRequest) : runRequest();
-      });
+      };
+      return runWithRequestContext(req, inRequestContext, { cookies });
     });
   };
 

package/src/server/prebuilt/capture-render.ts

@@ -0,0 +1,118 @@
+/**
+ * One build-time capture entry (server/prebuilt-builder.ts): render a
+ * registered component in isolation under the synthetic build store and
+ * drain its flight payload under a deadline.
+ */
+
+import { createElement } from 'react';
+
+import { SlotOutlet } from '../../client/slot-outlet.tsx';
+import type { CoercedParams } from '../../shared/param-value.ts';
+import { renderToReadableStream } from '../../rsc-runtime/rsc.ts';
+import { requestContextAls } from '../als-registry.ts';
+import { readAllBytesWithDeadline } from '../stream-utils.ts';
+import type { PrebuiltRegistration } from '../prebuilt-runtime.ts';
+import { createCaptureScope, type NestedWrapperRender } from './capture-state.ts';
+import { resolveTags } from './lifetime.ts';
+import { LAYOUT_CHILDREN_SLOT } from './slots.ts';
+import { createBuildTimeStore } from './synthetic-store.ts';
+
+/** Wrap payload bytes as a single-chunk stream for the smoke revival. */
+export function bytesToStream(bytes: Uint8Array): ReadableStream<Uint8Array> {
+  return new ReadableStream({
+    start(c) {
+      c.enqueue(bytes);
+      c.close();
+    },
+  });
+}
+
+/**
+ * View of a registered component that satisfies createElement — same
+ * narrowing rationale as prebuilt-runtime.ts.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type RenderableComponent = (props: any) => React.ReactNode;
+
+export interface EntryOutcome {
+  bytes: Uint8Array | null;
+  failure: unknown;
+  nested: NestedWrapperRender[];
+  resolvedTags: string[] | undefined;
+  segmentParamsRead: boolean;
+}
+
+/**
+ * Render one (component, props, coerced-params) entry in isolation and drain
+ * its flight payload. Any `onError` during serialization fails the entry —
+ * a payload with an embedded error row would replay that error on every
+ * future request, so only fully clean renders are captured.
+ */
+export async function renderEntry(
+  registration: PrebuiltRegistration,
+  props: Record<string, unknown>,
+  coercedParams: CoercedParams,
+  timeoutMs: number,
+  isLayout: boolean
+): Promise<EntryOutcome> {
+  const storeHandle = createBuildTimeStore(registration.id, coercedParams);
+  const { store, violations } = storeHandle;
+  let failure: unknown = null;
+
+  const capture = createCaptureScope(registration.id, registration.options, props);
+  let bytes: Uint8Array | null = null;
+  let resolvedTags: string[] | undefined;
+  try {
+    // Render AND drain inside one ALS scope. Flight renders in the context
+    // it was started from (and pinged from), not the one that pulls the
+    // stream, so the render itself only needs the scope at creation; the
+    // drain sits inside it too so everything in this capture reads the
+    // synthetic store (segmentParams.get() inside the component).
+    // Tag resolution also runs inside this scope so function-form tags
+    // that read segment params see the synthetic store (codex P2 on PR #858).
+    // Layout captures get <SlotOutlet slot="children" /> as children so
+    // the cached payload has a context-driven hole (design/45, TIM-1181).
+    const renderProps =
+      isLayout && !('children' in props)
+        ? { ...props, children: createElement(SlotOutlet, { slot: LAYOUT_CHILDREN_SLOT }) }
+        : props;
+    // The capture scope wraps the render the same way, so every wrapper
+    // inside it reports to this entry (cycle + nesting clamp).
+    bytes = await capture.run(() =>
+      requestContextAls.run(store, async () => {
+        const stream = renderToReadableStream(
+          createElement(registration.component as RenderableComponent, renderProps),
+          {
+            onError(error: unknown) {
+              failure ??= error ?? new Error('unknown render error');
+              // Digest string keeps flight from warning about a missing
+              // digest; the payload is discarded because `failure` is set.
+              return 'timber-prebuilt-capture-error';
+            },
+          }
+        );
+        // On timeout the reader is cancelled, never abandoned mid-read
+        // (design/13 A2/A3), and the entry fails.
+        const drained = await readAllBytesWithDeadline(stream, timeoutMs, 'render');
+        const tags = resolveTags(registration.options, props);
+        resolvedTags = tags.length > 0 ? tags : undefined;
+        return drained;
+      })
+    );
+  } catch (error) {
+    // Sync component throw (renderToReadableStream creation), drain
+    // timeout, or stream error.
+    failure ??= error;
+  }
+  const nested = capture.nestedRenders();
+
+  // Side-channel check FIRST: a component that touched per-request context
+  // is a hard error even when it caught the throw and rendered a fallback —
+  // accepting that payload would bake the request-dependent branch for
+  // every future request (codex P1 on PR #836).
+  const { segmentParamsRead } = storeHandle;
+  if (violations.length > 0)
+    return { bytes: null, failure: violations[0], nested, resolvedTags, segmentParamsRead };
+  if (failure !== null) return { bytes: null, failure, nested, resolvedTags, segmentParamsRead };
+  return { bytes, failure: null, nested, resolvedTags, segmentParamsRead };
+}