@timber-js/app 0.2.0-alpha.207 → 0.2.0-alpha.209

package/src/server/rsc-entry/render-route.ts

@@ -5,12 +5,11 @@
  * pipeline construction. This module owns the steps that happen *after*
  * the pipeline has matched a route and before it commits a response:
  * element-tree build, RSC Flight render, and dispatch to either the SSR
- * HTML path or the RSC payload path. It also handles the
- * synchronous-signal escape hatches (deny / redirect / render error
- * thrown during stream creation) so the entry doesn't carry that logic.
+ * HTML path or the RSC payload path. A deny or redirect captured during the
+ * render is rethrown to the pipeline, which answers it.
  *
  * The function is parameterized over its dependencies — `clientBootstrap`,
- * `clientJsDisabled`, `rootSegment`, `globalError` — so the entry passes
+ * `clientJsDisabled`, `renderDenyFallback`, `globalError` — so the entry passes
  * them in once at handler-construction time and they ride along on every
  * call. No globals, no closures over the entry's createRequestHandler
  * scope.
@@ -27,25 +26,19 @@ import {
   collectRouteFonts,
   collectRouteModulepreloads,
 } from '../build-manifest.ts';
-import type { LayoutEntry } from '../deny-renderer.ts';
-import { renderDenyPage, renderDenyPageAsRsc } from '../deny-renderer.ts';
 import type { ClientBootstrapConfig } from '../html-injectors.ts';
 import type { InterceptionContext, RouteMatch } from '../pipeline.ts';
+import { DenySignal } from '../primitives.ts';
 import { buildRouteElement, NoPageComponentError } from '../route-element-builder.ts';
-import { ParamCoercionError } from '../param-coercion.ts';
-import type { ManifestSegmentNode } from '../route-matcher.ts';
 import { recordTiming } from '../server-timing.ts';
 import { parseClientStateTree } from '../state-tree-diff.ts';
 
-import { getFirstDeniedSegmentIndex } from '../deny-boundary.ts';
 import { handleApiRoute } from './api-handler.ts';
-import { renderErrorPage, renderNoMatchPage } from './error-renderer.ts';
-import { buildRedirectResponse } from './helpers.ts';
+import type { DenyFallbackRenderer } from './deny-fallback.ts';
 import { isRscRequest } from '../../shared/rsc-media-type.ts';
 import { buildRscPayloadResponse } from './rsc-payload.ts';
 import { renderRscStream } from './rsc-stream.ts';
 import { renderSsrResponse } from './ssr-renderer.ts';
-import { callSsr } from './ssr-bridge.ts';
 
 /**
  * Static-per-handler dependencies for `renderRoute` — captured once at
@@ -56,7 +49,7 @@ export interface RenderRouteDeps {
   clientBootstrap: ClientBootstrapConfig;
   clientJsDisabled: boolean;
   clientSegmentCache: boolean;
-  rootSegment: ManifestSegmentNode;
+  renderDenyFallback: DenyFallbackRenderer;
   buildManifest: BuildManifest;
   globalError?: { load: () => Promise<unknown>; filePath: string };
 }
@@ -78,7 +71,7 @@ export async function renderRoute(
   deps: RenderRouteDeps,
   interception?: InterceptionContext
 ): Promise<Response> {
-  const { clientBootstrap, clientJsDisabled, rootSegment, buildManifest, globalError } = deps;
+  const { clientBootstrap, clientJsDisabled, buildManifest, globalError } = deps;
   const segments = match.segments;
   const leaf = segments[segments.length - 1];
 
@@ -113,19 +106,16 @@ export async function renderRoute(
       buildManifest.metadataRouteHashes
     );
   } catch (error) {
-    // Param coercion failed — render the custom 404 page via status files.
-    // Previously returned a bare Response(null, { status: 404 }) which bypassed
-    // custom 404 pages. Now routes through renderNoMatchPage so apps with
-    // 404.tsx render their custom page.
-    if (error instanceof ParamCoercionError) {
-      return renderNoMatchPage(req, rootSegment, responseHeaders, clientBootstrap);
-    }
-    // No PageComponent found — same treatment as param coercion: render custom 404.
+    // No PageComponent found — render the app's 404 page as for an
+    // unmatched URL: the root chain, not the matched one. No access.ts has
+    // run for the matched chain yet, so its layouts must not wrap the page
+    // (design/13-security.md). The deny fallback is the one assembler of
+    // that page; calling it with no match selects the root chain.
     if (error instanceof NoPageComponentError) {
       if (process.env.NODE_ENV !== 'production') {
         console.warn(`[timber] ${error.message}`);
       }
-      return renderNoMatchPage(req, rootSegment, responseHeaders, clientBootstrap);
+      return deps.renderDenyFallback(new DenySignal(404), req, responseHeaders);
     }
     throw error;
   }
@@ -205,67 +195,12 @@ export async function renderRoute(
     desc: 'RSC stream init',
   });
 
-  // Synchronous redirect — redirect() in access.ts or a non-async component
-  // throws during renderToReadableStream creation. Return HTTP redirect.
-  if (signals.redirectSignal) {
-    return buildRedirectResponse(signals.redirectSignal, req, responseHeaders);
-  }
-
-  // Synchronous deny — deny() in a non-async component throws during
-  // renderToReadableStream creation, caught in the try/catch above.
-  if (signals.denySignal) {
-    if (isRscRequest(req)) {
-      return renderDenyPageAsRsc(
-        signals.denySignal,
-        segments,
-        layoutComponents as LayoutEntry[],
-        req,
-        responseHeaders,
-        getFirstDeniedSegmentIndex()
-      );
-    }
-    return renderDenyPage(
-      signals.denySignal,
-      segments,
-      layoutComponents as LayoutEntry[],
-      req,
-      match,
-      responseHeaders,
-      clientBootstrap,
-      callSsr,
-      undefined,
-      getFirstDeniedSegmentIndex()
-    );
-  }
-
-  // Synchronous render error — renderToReadableStream threw before
-  // creating the stream. Render the error page with correct 5xx status.
-  // (Async render errors are tracked in onError and handled after SSR.)
-  // An RSC payload request gets the hard-navigate envelope rather than an
-  // error page — `renderErrorPage` owns that branch, so every one of its call
-  // sites is covered rather than this one alone (TIM-1322).
-  if (signals.renderError && !rscStream) {
-    return renderErrorPage(
-      signals.renderError.error,
-      signals.renderError.status,
-      segments,
-      layoutComponents as LayoutEntry[],
-      req,
-      match,
-      responseHeaders,
-      clientBootstrap,
-      globalError,
-      getFirstDeniedSegmentIndex()
-    );
-  }
-
   // For RSC payload requests (client navigation), return the RSC Flight
   // stream directly — skip SSR HTML rendering entirely.
   // See design/19-client-navigation.md §"RSC Payload Handling"
   if (isRscRequest(req)) {
     return buildRscPayloadResponse(
-      req,
-      rscStream!,
+      rscStream,
       signals,
       segments,
       layoutComponents,
@@ -278,7 +213,7 @@ export async function renderRoute(
   // Pipe through SSR for HTML rendering with streaming Suspense support.
   return renderSsrResponse({
     req,
-    rscStream: rscStream!,
+    rscStream,
     signals,
     segments,
     layoutComponents,

package/src/server/rsc-entry/render-signals.ts

@@ -0,0 +1,108 @@
+/**
+ * Render signals — the deny / redirect / unhandled-error state one RSC
+ * render captures, and the recorder that writes it.
+ *
+ * Kept apart from `rsc-stream.ts` so the contract carries no Flight runtime:
+ * consumers and tests can hold signals without loading the renderer.
+ *
+ * Design docs: 02-rendering-pipeline.md §"Single-Pass Rendering",
+ *              49-explicit-subsystem-boundaries.md §"C"
+ */
+
+import type { DenySignal, RedirectSignal } from '../primitives.ts';
+
+/**
+ * Signal state captured during RSC rendering. Read-only for consumers: only
+ * the render that produced it records into it (`createSignalRecorder`).
+ *
+ * Signals fire asynchronously via `onError` during stream consumption.
+ * The first deny wins; a later redirect replaces an earlier one.
+ *
+ * The two notification channels are values the producer owns and returns,
+ * not callback slots a consumer assigns after the fact. A slot only works if
+ * no `await` separates `renderRscStream()` from the assignment — add one and
+ * an early signal fires into an empty slot with no trace. A promise that has
+ * already resolved, and an `AbortSignal` that is already aborted, carry the
+ * early event to a late reader.
+ */
+export interface RenderSignals {
+  readonly denySignal: DenySignal | null;
+  /**
+   * The first deny that no in-tree catch site could place — no `owners`, so
+   * no boundary may claim its error row and only the re-render fallback can
+   * produce a page for it.
+   *
+   * Tracked apart from `denySignal` because one render can produce both. A
+   * deep page can hoist a 404 to a boundary that will render it while an
+   * outer layout separately throws a 403 nothing matches; whichever lands in
+   * `denySignal` first, the unplaced one still needs the fallback, and
+   * deciding from `denySignal.owners` alone would strand it. See TIM-1356.
+   */
+  readonly unplacedDeny: DenySignal | null;
+  readonly redirectSignal: RedirectSignal | null;
+  /**
+   * Resolves when the first deny or redirect is captured; never rejects.
+   * Consumers race it to react the instant `onError` fires instead of
+   * polling with setTimeout/queueMicrotask.
+   */
+  readonly captured: Promise<void>;
+  /**
+   * Aborted when the first unhandled (non-signal) error is captured. Halts
+   * Flight data injection into the inline stream (TIM-938).
+   */
+  readonly unhandledError: AbortSignal;
+}
+
+/** The write side of `RenderSignals`, held by the render that captures. */
+export interface SignalRecorder {
+  readonly signals: RenderSignals;
+  deny(signal: DenySignal): void;
+  redirect(signal: RedirectSignal): void;
+  unhandledError(): void;
+}
+
+/**
+ * Create the signal state for one render. `renderRscStream()` records into
+ * it from Flight's `onError`; tests record into it to stand in for Flight.
+ */
+export function createSignalRecorder(): SignalRecorder {
+  let denySignal: DenySignal | null = null;
+  let unplacedDeny: DenySignal | null = null;
+  let redirectSignal: RedirectSignal | null = null;
+  let notifyCaptured!: () => void;
+  const captured = new Promise<void>((resolve) => {
+    notifyCaptured = resolve;
+  });
+  const errorAbort = new AbortController();
+
+  return {
+    signals: {
+      get denySignal() {
+        return denySignal;
+      },
+      get unplacedDeny() {
+        return unplacedDeny;
+      },
+      get redirectSignal() {
+        return redirectSignal;
+      },
+      captured,
+      unhandledError: errorAbort.signal,
+    },
+    deny(signal) {
+      // First-wins: two concurrent denies from separately serialized
+      // subtrees must commit a deterministic status. See
+      // spike-TIM-1441 §"two-concurrent-denials scenario".
+      denySignal ??= signal;
+      if (!signal.owners) unplacedDeny ??= signal;
+      notifyCaptured();
+    },
+    redirect(signal) {
+      redirectSignal = signal;
+      notifyCaptured();
+    },
+    unhandledError() {
+      errorAbort.abort();
+    },
+  };
+}

package/src/server/rsc-entry/revalidate-renderer.ts

@@ -30,34 +30,25 @@ import { stringifyCookie } from 'cookie';
 
 import type { BuildManifest } from '../build-manifest.ts';
 import { canonicalize } from '../canonicalize.ts';
-import { getCookiesForSsr, seedRequestCookies } from '../cookie-context.ts';
+import { getCookiesForSsr } from '../cookie-context.ts';
 import { logRenderError } from '../logger.ts';
+import { ParamCoercionError } from '../param-coercion.ts';
 import type { RouteMatch, RouteMatcher } from '../pipeline.ts';
 import { DenySignal, RedirectSignal } from '../primitives.ts';
 import { applyRequestHeaderOverlay, setSegmentParams } from '../request-context.ts';
 import { requestContextAls } from '../als-registry.ts';
 import { buildRouteElement } from '../route-element-builder.ts';
-import type { RevalidateRenderer, RevalidationResult } from '../actions.ts';
+import { createReactCacheScope } from '../react-cache-scope.ts';
+import {
+  RevalidationDropped,
+  type RevalidateRenderer,
+  type RevalidationResult,
+} from '../actions.ts';
+import type { CoercedParams } from '../../shared/param-value.ts';
 
-import { runMiddlewareForAction, type CoerceSegmentParamsFn } from './action-middleware-runner.ts';
+import { runMiddlewareForAction } from './action-middleware-runner.ts';
 import { RSC_CONTENT_TYPE } from '../../shared/rsc-media-type.ts';
 
-/**
- * Sentinel thrown when revalidation cannot proceed because middleware
- * returned a short-circuit `Response` (a non-redirect HTTP response that
- * we cannot translate back to an element tree). `executeAction` catches
- * this and drops the revalidation — the action result is still delivered,
- * but no `_tree` is piggybacked onto the response. The matching name
- * `RevalidationDropped` is exported so callers can identify it via
- * `instanceof` without leaking the message text to clients.
- */
-export class RevalidationDropped extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = 'RevalidationDropped';
-  }
-}
-
 /** Result of validating a `revalidatePath()` argument. */
 type PathValidation =
   | { ok: true; pathname: string; search: string }
@@ -137,6 +128,9 @@ function serializeCookieMap(cookies: Map<string, string>): string {
   }
 }
 
+/** Coerce a matched route's raw segment params via its `app/schema.ts` codecs. */
+export type CoerceSegmentParamsFn = (match: RouteMatch) => Promise<CoercedParams>;
+
 /** Dependencies for the revalidate renderer factory. */
 export interface RevalidateRendererDeps {
   matchRoute: RouteMatcher;
@@ -150,7 +144,7 @@ export interface RevalidateRendererDeps {
  * The returned renderer:
  *   1. Validates the requested path.
  *   2. Matches the canonicalized path against the route tree.
- *   3. Coerces segment params via the matched chain's `params.ts` codecs.
+ *   3. Coerces segment params via the `app/schema.ts` codecs.
  *   4. Runs the matched route's `middleware.ts` chain inside a fresh
  *      `runWithRequestContext` scope (via `runMiddlewareForAction`).
  *      Deny/redirect signals are re-thrown so `executeAction` can apply
@@ -222,9 +216,13 @@ export function createRevalidateRendererFactory(
       // Only attempt this inside a request context — `getCookiesForSsr`
       // throws otherwise — and bail out gracefully if no context is
       // active (the legacy call-site contract permitted this).
-      const inRequestContext = Boolean(requestContextAls.getStore());
-      const ryw = inRequestContext ? getCookiesForSsr() : new Map<string, string>();
-      if (inRequestContext) {
+      //
+      // The same map becomes the middleware scope's parsed cookies, so
+      // its `runWithRequestContext` skips `parseCookieHeader` — the H-3
+      // smuggling primitive mitigated by TIM-868. The Cookie header stays
+      // for code that reads `ctx.req.headers.get('cookie')` directly.
+      const ryw = requestContextAls.getStore() ? getCookiesForSsr() : undefined;
+      if (ryw) {
         if (ryw.size === 0) {
           revalidateHeaders.delete('cookie');
         } else {
@@ -234,20 +232,29 @@ export function createRevalidateRendererFactory(
       const revalidateReq = new Request(revalidateUrl.toString(), {
         headers: revalidateHeaders,
       });
-      // Seed the parsed map directly so the child `runWithRequestContext`
-      // inside `runMiddlewareForAction` skips `parseCookieHeader` — the
-      // same H-3 smuggling primitive mitigated by TIM-868. The Cookie
-      // header above remains in place for code that reads
-      // `ctx.req.headers.get('cookie')` directly.
-      if (inRequestContext) {
-        seedRequestCookies(revalidateReq, new Map(ryw));
-      }
 
-      // ── 3. Match the canonical path ─────────────────────────────────
-      const match = deps.matchRoute(validation.pathname);
-      if (!match) {
+      // ── 3. Match the canonical path and coerce its params ───────────
+      //
+      // Coercion runs before middleware, as in the page pipeline, and on
+      // both branches below. The match keeps its raw params beside the
+      // coerced ones, so slot resolution in step 6 reads URL values.
+      const rawMatch = deps.matchRoute(validation.pathname);
+      if (!rawMatch) {
         throw new Error(`revalidatePath('${path}') — no matching route`);
       }
+      let match: RouteMatch;
+      try {
+        match = { ...rawMatch, segmentParams: await deps.coerceSegmentParams(rawMatch) };
+      } catch (error) {
+        // Bad params on the target path — drop revalidation. The action's
+        // own response still goes back to the client.
+        if (error instanceof ParamCoercionError) {
+          throw new RevalidationDropped(
+            `revalidatePath('${path}') — segment param coercion failed`
+          );
+        }
+        throw error;
+      }
 
       // ── 4. Run middleware in a fresh ALS scope ──────────────────────
       //
@@ -256,25 +263,22 @@ export function createRevalidateRendererFactory(
       // overlay) — matching the page pipeline's behavior in
       // `handleRequest` where `runMiddlewarePhase` is gated on
       // `middlewareChain.length > 0`.
+      //
+      // The scope opened here is fresh — the action body read through its
+      // own scope before it mutated — and the revalidated tree renders in it
+      // later, so this middleware shares React.cache with that render.
+      const reactCacheScope = createReactCacheScope();
       let overlay: Headers | undefined;
       if (match.middlewareChain.length > 0) {
-        const outcome = await runMiddlewareForAction(
-          revalidateReq,
-          match,
-          deps.coerceSegmentParams
-        );
+        const outcome = await runMiddlewareForAction(revalidateReq, match, {
+          reactCacheScope,
+          cookies: ryw,
+        });
 
-        if (outcome.kind === 'param-coercion-error') {
-          // Bad params on the target path — drop revalidation. The
-          // action's own response still goes back to the client.
-          throw new RevalidationDropped(
-            `revalidatePath('${path}') — segment param coercion failed`
-          );
-        }
         if (outcome.kind === 'error') {
-          // Re-throw unhandled middleware errors so `executeAction`'s
-          // existing `console.error` fallback logs them. Not surfaced
-          // to the action client (revalidation is best-effort).
+          // Re-throw unhandled middleware errors so `executeAction` logs
+          // them and the action handler reports them. Not surfaced to the
+          // action client (revalidation is best-effort).
           throw outcome.error;
         }
         if (outcome.kind === 'redirect') {
@@ -311,15 +315,9 @@ export function createRevalidateRendererFactory(
         }
 
         // `continue` — capture the overlay so we can apply it to the
-        // action's request-context store below. We deliberately do NOT
-        // forward `outcome.cookies` or `outcome.setCookieHeaders` here;
-        // see the module docstring for why.
+        // action's request-context store below. Cookies the middleware set
+        // are not forwarded; see this factory's docstring for why.
         overlay = outcome.overlay;
-      } else {
-        // No middleware on the target — still coerce params so segment
-        // params reach `setSegmentParams` typed. `runMiddlewareForAction`
-        // would have done this for us; do it manually on the bypass path.
-        await deps.coerceSegmentParams(match);
       }
 
       // ── 5. Lift state onto the action's ALS store ───────────────────
@@ -344,6 +342,7 @@ export function createRevalidateRendererFactory(
       );
       return {
         payload: routeResult.payload,
+        reactCacheScope,
       };
     };
   };

package/src/server/rsc-entry/rsc-payload.ts

@@ -19,19 +19,16 @@
  *              04-authorization.md §"Status codes on the RSC payload path"
  */
 
-import type { LayoutEntry } from '../deny-renderer.ts';
-import { renderDenyPageAsRsc } from '../deny-renderer.ts';
-import type { RedirectSignal } from '../primitives.ts';
 import type { LayoutComponentEntry } from '../route-element-builder.ts';
 import type { ManifestSegmentNode } from '../route-matcher.ts';
 import type { SlotSkipEntry } from '../slot-resolver.ts';
 
-import { buildRedirectResponse, buildSegmentInfo } from './helpers.ts';
+import { buildSegmentInfo } from './helpers.ts';
 import { RSC_CONTENT_TYPE } from '../../shared/rsc-media-type.ts';
 
 import { rscErrorEnvelope } from '../rsc-error-envelope.ts';
 
-import type { RenderSignals } from './rsc-stream.ts';
+import type { RenderSignals } from './render-signals.ts';
 
 /**
  * Ceiling on waiting for a first chunk that is already in flight, used only
@@ -55,14 +52,17 @@ const FIRST_CHUNK_CEILING_MS = 50;
  * plus one macrotask turn. Nothing is held for it. A signal that lands
  * inside the window still gets a server-level answer — a redirect response,
  * the fallback deny page, the hard-navigate envelope — because the race
- * below and the one timer turn after it deliver it for free. A signal that
+ * below and the one timer turn after it deliver it for free. This function
+ * reports that signal rather than answering it: it cancels the stream and
+ * rethrows, and the pipeline's outcome translator builds the redirect or
+ * calls the deny fallback (`rsc-entry/deny-fallback.ts`), exactly as for a
+ * signal thrown out of render (design/49 §"C"). A signal that
  * lands after it is a row in the stream, and the client's boundaries answer
  * it. Waiting for the shell components to settle (TIM-1045, TIM-1208) made
  * the payload path pretend to a status contract it could not keep for
  * nested components, and was removed in TIM-1495.
  */
 export async function buildRscPayloadResponse(
-  req: Request,
   rscStream: ReadableStream<Uint8Array>,
   signals: RenderSignals,
   segments: ManifestSegmentNode[],
@@ -73,8 +73,8 @@ export async function buildRscPayloadResponse(
 ): Promise<Response> {
   // Read the first chunk from the RSC stream before committing headers.
   // Race the first read against signal detection — if an async component
-  // throws a RedirectSignal or DenySignal, the onError callback fires
-  // signals.onSignal() and we can react immediately without waiting for
+  // throws a RedirectSignal or DenySignal, the onError callback resolves
+  // signals.captured and we can react immediately without waiting for
   // the full macrotask queue.
   //
   // The rejection chain for an async-wrapped page component:
@@ -88,9 +88,6 @@ export async function buildRscPayloadResponse(
   // (no signal). A 50ms ceiling timeout guards against edge cases
   // where onError never fires.
   const reader = rscStream.getReader();
-  const signalDetected = new Promise<void>((resolve) => {
-    signals.onSignal = resolve;
-  });
 
   type RaceResult =
     | { type: 'data'; chunk: ReadableStreamReadResult<Uint8Array> }
@@ -108,14 +105,14 @@ export async function buildRscPayloadResponse(
   try {
     first = await Promise.race([
       pendingRead.then((chunk) => ({ type: 'data' as const, chunk })),
-      signalDetected.then(() => ({ type: 'signal' as const })),
+      signals.captured.then(() => ({ type: 'signal' as const })),
     ]);
   } catch (_readError) {
-    // RSC stream failed on first read — unhandled error in the page component.
+    // The RSC stream itself errored on first read. (A component's error is
+    // not this: it arrives as an error row in a stream that reads fine.)
     // Return an error response so the client can hard-navigate for the
     // SSR-rendered error page. See design/10-error-handling.md.
     reader.cancel().catch(() => {});
-    signals.onSignal = undefined;
     return rscErrorEnvelope(500, responseHeaders);
   }
 
@@ -136,15 +133,14 @@ export async function buildRscPayloadResponse(
     await new Promise<void>((r) => setTimeout(r, 0));
   }
 
-  // Detach the callback — the window has closed, and a signal arriving after
-  // it is a row in the stream the client answers.
-  signals.onSignal = undefined;
-
-  // Check for redirect/deny signals detected during initial rendering
-  const trackedRedirect = signals.redirectSignal as RedirectSignal | null;
-  if (trackedRedirect) {
+  // The window has closed: signals are read once, here, and one arriving
+  // after this is a row in the stream the client answers.
+  //
+  // A redirect or an unplaced deny replaces the payload, so the stream is
+  // released before the signal is rethrown to the pipeline.
+  if (signals.redirectSignal) {
     reader.cancel().catch(() => {});
-    return buildRedirectResponse(trackedRedirect, req, responseHeaders);
+    throw signals.redirectSignal;
   }
   // An addressed deny needs no fallback: the payload already carries its error
   // row, aimed at the boundary the client has mounted at that segment, which
@@ -156,47 +152,18 @@ export async function buildRscPayloadResponse(
   // of them. A deny nothing could place has no boundary that may claim it, so
   // its row would otherwise stream to a client with nothing to render it —
   // and it needs the fallback whether or not some other deny was addressed
-  // first. See TIM-1356.
+  // first. See TIM-1356. The fallback also owns the hard-navigate answer
+  // for a deny AccessGate marked `_hardNavigate` (TIM-1363).
   if (signals.unplacedDeny) {
     reader.cancel().catch(() => {});
-
-    // A skipped segment whose access just flipped to deny marks the signal
-    // for hard-navigate: rendering a deny page here would execute the denied
-    // segment's protected layout and place it inside cached client chrome
-    // (TIM-1074). Return rscErrorEnvelope so the client hard-navigates for
-    // a clean full render with correct deny page placement. See TIM-1363.
-    if (signals.unplacedDeny._hardNavigate) {
-      return rscErrorEnvelope(signals.unplacedDeny.status, responseHeaders);
-    }
-
-    // Read the denied segment index from ALS — set by AccessGate during
-    // render. See TIM-1358, TIM-1365.
-    const { getFirstDeniedSegmentIndex: getDeniedIdx } = await import('../deny-boundary.ts');
-    return renderDenyPageAsRsc(
-      signals.unplacedDeny,
-      segments,
-      layoutComponents as LayoutEntry[],
-      req,
-      responseHeaders,
-      getDeniedIdx()
-    );
-  }
-
-  // Check for unhandled errors (RenderError or plain Error).
-  // These aren't redirect/deny signals but the RSC stream will be broken.
-  // Return an error response so the client can hard-navigate for the
-  // SSR-rendered error page. See design/10-error-handling.md
-  // §"Error Page Rendering for Client Navigation".
-  if (signals.renderError) {
-    reader.cancel().catch(() => {});
-    return rscErrorEnvelope(signals.renderError.status, responseHeaders);
+    throw signals.unplacedDeny;
   }
 
-  // Extract the first chunk from the race result.
-  // If the signal won the race but neither redirect nor deny was detected
-  // (edge case), cancel the reader immediately rather than issuing a bare
-  // read() that could hang forever if the RSC stream has stalled.
-  // See TIM-519.
+  // Extract the first chunk from the race result. If a signal won the race,
+  // the redirect and the unplaced deny were rethrown above, so only an
+  // addressed deny reaches the second branch. The last branch is a fail-safe
+  // for a signal that is neither: it cancels the reader rather than issuing
+  // a bare read() that could hang forever on a stalled stream (TIM-519).
   let firstRead: ReadableStreamReadResult<Uint8Array>;
   if (first.type === 'data') {
     firstRead = first.chunk;
@@ -219,7 +186,7 @@ export async function buildRscPayloadResponse(
     // absent, and fabricating `done: true` here would produce the very empty
     // 4xx this branch exists to prevent.
     //
-    // Nor can it fall to `renderDenyPageAsRsc`. That renderer re-resolves from
+    // Nor can it fall to the deny fallback. That renderer re-resolves from
     // the FULL leaf chain and wraps whatever it finds, ignoring `ownerKey` —
     // so an `/admin` denial addressed to a root `4xx.tsx` would come back as
     // `/admin/secret/403.tsx` with the denied layouts executed, which is the