@timber-js/app 0.2.0-alpha.207 → 0.2.0-alpha.209

package/src/server/rsc-entry/ssr-renderer.ts

@@ -14,29 +14,30 @@
 
 import type { ClientBootstrapConfig } from '../html-injectors.ts';
 import { flightInitScript } from '../flight-scripts.ts';
-import { getCspNonce, nonceAttr } from '../csp-nonce.ts';
+import { getCspNonce } from '../csp-nonce.ts';
+import { nonceAttr } from '../render-utils.ts';
 import { appVisibleSearch } from '../../shared/rsc-cache-key.ts';
-import { getSlotParamsForClient } from '../request-context.ts';
 import type { LayoutEntry } from '../deny-renderer.ts';
-import { renderDenyPage } from '../deny-renderer.ts';
 import type { RouteMatch } from '../pipeline.ts';
-import { isSsrStreamError } from '../primitives.ts';
+import { isSsrStreamError } from '../signal-identity.ts';
 import type { LayoutComponentEntry } from '../route-element-builder.ts';
 import type { ManifestSegmentNode } from '../route-matcher.ts';
 import type { SlotSkipEntry } from '../slot-resolver.ts';
-import type { NavContext } from '../ssr-bridge-types.ts';
+import type { NavContext, SsrRenderResult } from '../ssr-bridge-types.ts';
 
 import { htmlEscapeJsonString } from '../flight-scripts.ts';
-import { buildRedirectResponse, buildSegmentInfo, isAbortError } from './helpers.ts';
+import { buildSegmentInfo, isAbortError } from './helpers.ts';
 import { getCookiesForSsr } from '../cookie-context.ts';
 import { getDenyStatus, getFirstDeniedSegmentIndex } from '../deny-boundary.ts';
 import { renderErrorPage, type GlobalErrorFile } from './error-renderer.ts';
 import { callSsr } from './ssr-bridge.ts';
-import type { RenderSignals } from './rsc-stream.ts';
+import type { RenderSignals } from './render-signals.ts';
+import type { DenySignal, RedirectSignal } from '../primitives.ts';
 import { recordTiming } from '../server-timing.ts';
 import { teeWithErrorPropagation } from '../stream-utils.ts';
 import { addSpanEventSync } from '../tracing.ts';
 import { isDevMode } from '../debug.ts';
+import { swallow } from '../logger.ts';
 
 /**
  * Maximum number of queueMicrotask yields during signal promotion.
@@ -75,7 +76,7 @@ export const __test_only_signalPromotionDepth: { value: number } = { value: 0 };
  * Test-only observable: true when the promotion loop hit the cap without
  * capturing a signal (the silent-miss path — state 3 in TIM-970). False
  * when the loop captured a signal at any depth, when it was skipped via
- * `_fizzAllReadyResolved`, or when no signal was ever expected at a depth
+ * `fizzAllReadyResolved`, or when no signal was ever expected at a depth
  * shallower than the cap.
  *
  * Pairs with `__test_only_signalPromotionDepth`: depth alone cannot
@@ -112,13 +113,18 @@ interface SsrRenderOptions {
  * SSR will attempt to render the element tree progressively. Two outcomes:
  *
  * 1. deny() outside Suspense: the error appears in the RSC shell. SSR's
- *    renderToReadableStream fails (rejects). We catch the failure, check
- *    denySignal, and render the deny page with the correct status code.
+ *    renderToReadableStream fails (rejects). We catch the failure, find
+ *    the captured denySignal, and rethrow it to the pipeline.
  *
  * 2. deny() inside Suspense: the SSR shell succeeds (200 committed). The
  *    error streams into the connection as a React error boundary. The
  *    status is already committed — per design/05-streaming.md this is the
  *    expected degraded behavior for deny inside Suspense.
+ *
+ * @throws the captured `DenySignal` or `RedirectSignal` when one decides the
+ *   response. `runRenderPhase()` turns it into a `deny` / `redirect` outcome,
+ *   and the pipeline renders the deny page or builds the redirect, exactly as
+ *   for a signal thrown out of render (design/49 §"C").
  */
 export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Response> {
   const {
@@ -154,27 +160,12 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
     [ssrStream, inlineStream] = teeWithErrorPropagation(rscStream);
   }
 
-  // Wire an AbortController so the Flight injector stops writing <script>
-  // tags when an unhandled RSC error is detected. Without this, React's
-  // Flight encoder may write model data for a chunk that already received
-  // an error row, causing the client's Flight decoder to crash with
-  // "enqueueModel is not a function". See TIM-938.
-  const errorAbort = new AbortController();
-  signals.onUnhandledError = () => errorAbort.abort();
-
   // Segment metadata for initial hydration: deferred to shell-flush time.
   // The SSR entry invokes this thunk AFTER renderSsrNodeStream /
   // renderSsrStream returns (shell ready ⇒ AccessGates settled), so
   // getFirstDeniedSegmentIndex() returns the authoritative ALS value
   // rather than the pre-render Infinity. See TIM-1365, TIM-1359.
 
-  // Params reach the browser inside the payload — a field on the root row of
-  // the same Flight stream that is inlined for hydration. SSR itself renders
-  // only the tree, and the client components it renders read params from the
-  // ALS context seeded below, which is also where server components answer
-  // `getSegmentParams(slotPath)` from.
-  const slotParams = getSlotParamsForClient();
-
   // Middleware has already run; if it read `ctx.nonce` for its CSP header,
   // that is the value every inline script must wear.
   const nonce = getCspNonce();
@@ -183,8 +174,6 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
   const navContext: NavContext = {
     pathname: reqUrl.pathname,
     search: appVisibleSearch(reqUrl).search,
-    segmentParams: match.segmentParams,
-    slotParams,
     statusCode: 200,
     responseHeaders,
     headHtml:
@@ -204,256 +193,71 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
     deferSuspenseFor: deferSuspenseFor > 0 ? deferSuspenseFor : undefined,
     signal: req.signal,
     cookies: getCookiesForSsr(),
-    _errorSignal: errorAbort.signal,
+    // Stops the Flight injector writing <script> tags once an unhandled RSC
+    // error is captured. Without this, React's Flight encoder may write model
+    // data for a chunk that already received an error row, causing the
+    // client's Flight decoder to crash with "enqueueModel is not a
+    // function". See TIM-938.
+    _errorSignal: signals.unhandledError,
   };
 
-  // Helper: check if render-phase signals were captured and return the
-  // appropriate HTTP response. Used after both successful SSR (signal
-  // promotion from Suspense) and failed SSR (signal outside Suspense).
+  // The signal a render captured, if any. Used after both successful SSR
+  // (signal promotion from Suspense) and failed SSR (signal outside Suspense).
+  // A captured deny or redirect is reported, not rendered: callers cancel the
+  // streams this render holds and rethrow it, and runRenderPhase() turns it
+  // into the same `deny` / `redirect` outcome a thrown signal becomes, so
+  // the pipeline's deny fallback and redirect builder answer it (design/49
+  // §"C"). Redirect wins over deny, as it always has.
   //
-  // When `skipHandledDeny` is true (SSR success path), skip DenySignal
-  // re-render if the denial was already handled by a TimberErrorBoundary.
-  // The boundary renders the deny page as its fallback AND sets the correct
-  // HTTP status code on navContext — no redundant renderDenyPage() needed.
-  // See TIM-664, LOCAL-298.
-  // Read the denied segment index from ALS — set by AccessGate during render
-  // (setFirstDeniedSegmentIndex). See TIM-1358, TIM-1365.
-  function resolvedDeniedIndex(): number {
-    return getFirstDeniedSegmentIndex();
-  }
-
-  function checkCapturedSignals(skipHandledDeny = false): Response | Promise<Response> | null {
-    if (signals.redirectSignal) {
-      return buildRedirectResponse(signals.redirectSignal, req, responseHeaders);
-    }
-    if (signals.denySignal && !(skipHandledDeny && navContext._denyHandledByBoundary)) {
-      // Deny was not handled by an in-tree error boundary.
-      // Fall back to renderDenyPage (separate React.cache scope).
-      // For single-render behavior, add a 'use client' status-code file
-      // (e.g., 4xx.tsx) — the error boundary handles it in-tree.
-      return renderDenyPage(
-        signals.denySignal,
-        segments,
-        layoutComponents as LayoutEntry[],
-        req,
-        match,
-        responseHeaders,
-        clientBootstrap,
-        callSsr,
-        undefined,
-        resolvedDeniedIndex()
-      );
-    }
-    if (signals.renderError) {
-      return renderErrorPage(
-        signals.renderError.error,
-        signals.renderError.status,
-        segments,
-        layoutComponents as LayoutEntry[],
-        req,
-        match,
-        responseHeaders,
-        clientBootstrap,
-        globalError,
-        resolvedDeniedIndex()
-      );
-    }
-    return null;
+  // A signal the detection phase below saw arrive past the promotion cap is
+  // discarded rather than promoted; this flag records that without writing
+  // into the producer's signals.
+  let detectionConfirmedLateSignal = false;
+  function capturedSignal(): RedirectSignal | DenySignal | null {
+    if (detectionConfirmedLateSignal) return null;
+    return signals.redirectSignal ?? signals.denySignal;
   }
 
+  // Only the SSR call is guarded: everything after it runs on a document
+  // SSR produced, and a captured signal rethrown there must reach
+  // runRenderPhase() rather than this renderer's own failure handling.
+  let ssr: SsrRenderResult;
   try {
-    const ssrResponse = await callSsr(ssrStream, navContext);
-
-    // Record SSR sub-phase timings for Server-Timing header (detailed mode).
-    // These are populated by handleSsr() in the SSR environment and passed
-    // back via navContext._ssrTimings across the RSC→SSR boundary.
-    if (navContext._ssrTimings) {
-      const t = navContext._ssrTimings;
-      recordTiming({ name: 'ssr-decode', dur: t.decodeMs, desc: 'RSC Flight decode' });
-      recordTiming({ name: 'ssr-shell', dur: t.shellMs, desc: 'Fizz onShellReady' });
-      recordTiming({ name: 'ssr-pipeline', dur: t.pipelineMs, desc: 'stream transforms' });
-      recordTiming({
-        name: 'ssr-total',
-        dur: t.totalMs,
-        desc: t.nodeStreams ? 'SSR (Node streams)' : 'SSR (Web Streams)',
-      });
-    }
-
-    // Signal promotion: check if any signals were captured during rendering
-    // inside Suspense boundaries. If no signals are present yet, we may
-    // need to yield microtasks so async component rejections propagate
-    // through the full rejection chain to the RSC onError callback before
-    // we commit the response.
-    //
-    // Option 1 short-circuit: when Fizz's `stream.allReady` settled before
-    // the `deferSuspenseFor` hold ended (navContext._fizzAllReadyResolved),
-    // Flight has closed its stream, every `onError` already fired, and the
-    // signals object is fully populated. The retry loop would be a no-op.
-    // See design/spike-signal-promotion-protocol.md §"Option 1".
-    //
-    // Fallback path (hold timed out, no hold window, or shell-only return):
-    // the known rejection chain depth for a withSpan-wrapped page is 3+
-    // microtasks —
-    //   1. PageComponent throws DenySignal/RedirectSignal
-    //   2. withSpan catches and re-throws (microtask 1)
-    //   3. TracedPage promise rejects (microtask 2)
-    //   4. React Flight rejection handler → onError (microtask 3+)
-    // so a bounded retry loop (max 5) is required to catch signals whose
-    // propagation is still in-flight when callSsr returns. The loop exits
-    // early as soon as a signal is detected. Uses queueMicrotask instead
-    // of setTimeout(0) to avoid yielding to the full event loop.
-    // See design/05-streaming.md §"deferSuspenseFor and the Hold Window"
-    if (!signals.redirectSignal && !signals.denySignal && !signals.renderError) {
-      let yieldsConsumed = 0;
-      let detectionConfirmedLateSignal = false;
-      if (!navContext._fizzAllReadyResolved) {
-        // Promotion phase: bounded cap of SIGNAL_PROMOTION_MAX_YIELDS.
-        // Signals captured here are honored by checkCapturedSignals and
-        // become the response (redirect/deny/error page).
-        for (let i = 0; i < SIGNAL_PROMOTION_MAX_YIELDS; i++) {
-          await new Promise<void>((r) => queueMicrotask(r));
-          yieldsConsumed++;
-          if (signals.redirectSignal || signals.denySignal || signals.renderError) break;
-        }
-
-        // Detection phase (TIM-970): if the promotion cap was hit without
-        // capturing a signal, yield a few more times to disambiguate state 2
-        // ("no signal was ever coming" — the common legitimate-200 case) from
-        // state 3 ("signal arrived one microtask past the cap" — the silent
-        // miss). Telemetry-only: if a late signal is observed it triggers
-        // the warning and span event but is NOT promoted. Promoting it would
-        // effectively raise the cap to MAX_YIELDS + DETECTION_EXTRA_YIELDS,
-        // which the ticket defers to the E.2 investigation. The signals are
-        // cleared so checkCapturedSignals does not pick them up.
-        if (
-          yieldsConsumed === SIGNAL_PROMOTION_MAX_YIELDS &&
-          !signals.redirectSignal &&
-          !signals.denySignal &&
-          !signals.renderError
-        ) {
-          for (let i = 0; i < SIGNAL_PROMOTION_DETECTION_EXTRA_YIELDS; i++) {
-            await new Promise<void>((r) => queueMicrotask(r));
-            if (signals.redirectSignal || signals.denySignal || signals.renderError) {
-              detectionConfirmedLateSignal = true;
-              signals.redirectSignal = null;
-              signals.denySignal = null;
-              signals.renderError = null;
-              break;
-            }
-          }
-        }
-      }
-      __test_only_signalPromotionDepth.value = yieldsConsumed;
-      __test_only_signalPromotionCapHit.value = detectionConfirmedLateSignal;
-
-      if (detectionConfirmedLateSignal) {
-        if (isDevMode()) {
-          console.warn(
-            `[timber] Signal promotion cap reached (${SIGNAL_PROMOTION_MAX_YIELDS} microtask yields) — a deny()/redirect()/renderError signal arrived just past the cap and was discarded. ` +
-              `Likely cause: a page using deny()/redirect() inside a deeply-wrapped async component (custom withSpan, decorators, etc.). ` +
-              `Simplify the async chain or reduce withSpan/wrapper depth. ` +
-              `See design/05-streaming.md §"Signal Promotion".`
-          );
-        }
-        addSpanEventSync('timber.ssr.signal_promotion_cap_reached', {
-          depth: SIGNAL_PROMOTION_MAX_YIELDS,
-          signal_types_checked: 'redirect,deny,renderError',
-        });
-      }
-    }
-
-    const promoted = checkCapturedSignals(/* skipHandledDeny */ true);
-    if (promoted) {
-      ssrResponse.body?.cancel();
-      return promoted;
-    }
-
-    // Check if a DenySignal was caught in-tree by AccessGate or
-    // PageDenyBoundary. The deny page was rendered as a normal element
-    // (no error in the Flight stream), so SSR succeeded with status 200.
-    // Override the status code from the ALS-stored deny status. See TIM-666.
-    const denyStatus = getDenyStatus();
-    if (denyStatus) {
-      return new Response(ssrResponse.body, {
-        status: denyStatus,
-        headers: ssrResponse.headers,
-      });
-    }
-
-    return ssrResponse;
+    ssr = await callSsr(ssrStream, navContext);
   } catch (ssrError) {
+    // SSR failed, so nothing will read the teed inline stream: every answer
+    // below renders its own streams or none. Without explicit cancellation
+    // the orphaned tee branch keeps the RSC source stream alive, preventing
+    // garbage collection — so release it before anything returns or throws.
+    inlineStream
+      ?.cancel()
+      .catch((err: unknown) => swallow(err, 'orphaned RSC inline stream did not cancel'));
+
     // Connection abort — the client disconnected (page refresh, navigation
     // away). No response needed; return empty 499 (client closed request).
     if (isAbortError(ssrError) || req.signal?.aborted) {
-      inlineStream?.cancel().catch(() => {});
       return new Response(null, { status: 499 });
     }
 
-    // SsrStreamError: SSR's renderToReadableStream failed because the RSC
-    // stream contained an uncontained error (e.g., slot without error boundary).
-    //
-    // Error pages now use SSR-only rendering (Fizz directly, no RSC Flight),
-    // which imports layouts in the SSR environment where ALS is active. This
-    // means we CAN include layouts — they'll call getHeaders()/getCookies() correctly.
+    // A captured signal explains the failure, whichever shape it took: the
+    // signal was in the shell, outside any Suspense boundary.
+    const signal = capturedSignal();
+    if (signal) throw signal;
+
+    // SsrStreamError with no captured signal: SSR's renderToReadableStream
+    // failed because the RSC stream contained an uncontained error (e.g., a
+    // slot without an error boundary).
     //
-    // Deny pages still go through RSC → SSR (plain props), so they pass empty
-    // layouts to avoid re-executing server components in the RSC environment's
-    // stale ALS scope. See LOCAL-293.
     // SsrStreamError is thrown in the SSR environment but caught here in
     // RSC — separate Vite module graphs, so `instanceof` can never match.
     // isSsrStreamError() checks the Symbol.for brand instead. See
     // design/18-build-system.md §"Dev Mode: Signal Identity Across Program Reloads".
     if (isSsrStreamError(ssrError)) {
-      // Cancel the teed inline stream — SSR failed so this response will
-      // be replaced by renderErrorPage which creates its own clean streams.
-      // Without explicit cancellation the orphaned tee branch keeps the
-      // RSC source stream alive, preventing garbage collection.
-      inlineStream?.cancel().catch(() => {});
-
-      if (signals.redirectSignal) {
-        return buildRedirectResponse(signals.redirectSignal, req, responseHeaders);
-      }
-      if (signals.denySignal) {
-        // SSR failed (SsrStreamError) — the deny was in the shell and
-        // the error boundary didn't catch it during Fizz rendering.
-        // Fall back to renderDenyPage (separate render). See TIM-664.
-        return renderDenyPage(
-          signals.denySignal,
-          segments,
-          layoutComponents as LayoutEntry[],
-          req,
-          match,
-          responseHeaders,
-          clientBootstrap,
-          callSsr,
-          undefined,
-          resolvedDeniedIndex()
-        );
-      }
-      if (signals.renderError) {
-        // RenderError: TSX error pages use SSR-only path (layouts OK),
-        // MDX error pages use RSC path (plain props, no Error object).
-        return renderErrorPage(
-          signals.renderError.error,
-          signals.renderError.status,
-          segments,
-          layoutComponents as LayoutEntry[],
-          req,
-          match,
-          responseHeaders,
-          clientBootstrap,
-          globalError,
-          resolvedDeniedIndex()
-        );
-      }
-      // No captured signal — unhandled error in the RSC stream.
-      // Use the lastUnhandledError from RSC onError if available (more
-      // reliable than extracting SsrStreamError.cause). Falls back to
-      // cause extraction for backward compatibility.
-      const originalError =
-        signals.lastUnhandledError ?? (ssrError as { cause?: unknown }).cause ?? ssrError;
+      // The cause is the error Flight relayed for the row that failed the
+      // shell — not the last error the RSC render reported, which may be one
+      // a Suspense boundary contained (TIM-1552).
       return renderErrorPage(
-        originalError,
+        ssrError.cause ?? ssrError,
         500,
         segments,
         layoutComponents as LayoutEntry[],
@@ -462,16 +266,131 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
         responseHeaders,
         clientBootstrap,
         globalError,
-        resolvedDeniedIndex()
+        getFirstDeniedSegmentIndex()
       );
     }
 
-    // SSR shell rendering failed — the error was outside Suspense.
-    // Check captured signals (redirect, deny, render error).
-    const signalResponse = checkCapturedSignals();
-    if (signalResponse) return signalResponse;
-
     // No tracked error — rethrow (infrastructure failure)
     throw ssrError;
   }
+
+  const { response: ssrResponse, timings: t, fizzAllReadyResolved } = ssr;
+
+  // Record SSR sub-phase timings for the Server-Timing header. recordTiming
+  // is a no-op outside a detailed-mode timing collector.
+  recordTiming({ name: 'ssr-decode', dur: t.decodeMs, desc: 'RSC Flight decode' });
+  recordTiming({ name: 'ssr-shell', dur: t.shellMs, desc: 'Fizz onShellReady' });
+  recordTiming({ name: 'ssr-pipeline', dur: t.pipelineMs, desc: 'stream transforms' });
+  recordTiming({
+    name: 'ssr-total',
+    dur: t.totalMs,
+    desc: t.nodeStreams ? 'SSR (Node streams)' : 'SSR (Web Streams)',
+  });
+
+  // Signal promotion: check if any signals were captured during rendering
+  // inside Suspense boundaries. If no signals are present yet, we may
+  // need to yield microtasks so async component rejections propagate
+  // through the full rejection chain to the RSC onError callback before
+  // we commit the response.
+  //
+  // Option 1 short-circuit: when Fizz's `stream.allReady` settled before
+  // the `deferSuspenseFor` hold ended (`fizzAllReadyResolved`),
+  // Flight has closed its stream, every `onError` already fired, and the
+  // signals object is fully populated. The retry loop would be a no-op.
+  // See design/spike-signal-promotion-protocol.md §"Option 1".
+  //
+  // Fallback path (hold timed out, no hold window, or shell-only return):
+  // the known rejection chain depth for a withSpan-wrapped page is 3+
+  // microtasks —
+  //   1. PageComponent throws DenySignal/RedirectSignal
+  //   2. withSpan catches and re-throws (microtask 1)
+  //   3. TracedPage promise rejects (microtask 2)
+  //   4. React Flight rejection handler → onError (microtask 3+)
+  // so a bounded retry loop (max 5) is required to catch signals whose
+  // propagation is still in-flight when callSsr returns. The loop exits
+  // early as soon as a signal is detected. Uses queueMicrotask instead
+  // of setTimeout(0) to avoid yielding to the full event loop.
+  // See design/05-streaming.md §"deferSuspenseFor and the Hold Window"
+  if (!capturedSignal()) {
+    let yieldsConsumed = 0;
+    if (!fizzAllReadyResolved) {
+      // Promotion phase: bounded cap of SIGNAL_PROMOTION_MAX_YIELDS.
+      // A signal captured here is rethrown below and becomes the
+      // response (redirect or deny page).
+      for (let i = 0; i < SIGNAL_PROMOTION_MAX_YIELDS; i++) {
+        await new Promise<void>((r) => queueMicrotask(r));
+        yieldsConsumed++;
+        if (capturedSignal()) break;
+      }
+
+      // Detection phase (TIM-970): if the promotion cap was hit without
+      // capturing a signal, yield a few more times to disambiguate state 2
+      // ("no signal was ever coming" — the common legitimate-200 case) from
+      // state 3 ("signal arrived one microtask past the cap" — the silent
+      // miss). Telemetry-only: if a late signal is observed it triggers
+      // the warning and span event but is NOT promoted. Promoting it would
+      // effectively raise the cap to MAX_YIELDS + DETECTION_EXTRA_YIELDS,
+      // which the ticket defers to the E.2 investigation. Setting
+      // detectionConfirmedLateSignal keeps capturedSignal() from picking
+      // them up.
+      //
+      // The signal is discarded, but a late deny's status still applies: an
+      // in-tree catch site that hoisted it recorded the status before
+      // rethrowing (handleCaughtDeny), so the getDenyStatus() override below
+      // serves this document with the deny's 4xx. A late deny that no status
+      // file matched recorded nothing and stays a 200, as does any deny that
+      // lands after this window — the override is read once, below.
+      if (yieldsConsumed === SIGNAL_PROMOTION_MAX_YIELDS && !capturedSignal()) {
+        for (let i = 0; i < SIGNAL_PROMOTION_DETECTION_EXTRA_YIELDS; i++) {
+          await new Promise<void>((r) => queueMicrotask(r));
+          if (capturedSignal()) {
+            detectionConfirmedLateSignal = true;
+            break;
+          }
+        }
+      }
+    }
+    __test_only_signalPromotionDepth.value = yieldsConsumed;
+    __test_only_signalPromotionCapHit.value = detectionConfirmedLateSignal;
+
+    if (detectionConfirmedLateSignal) {
+      if (isDevMode()) {
+        console.warn(
+          `[timber] Signal promotion cap reached (${SIGNAL_PROMOTION_MAX_YIELDS} microtask yields) — a deny()/redirect() signal arrived just past the cap and was discarded. ` +
+            `Likely cause: a page using deny()/redirect() inside a deeply-wrapped async component (custom withSpan, decorators, etc.). ` +
+            `Simplify the async chain or reduce withSpan/wrapper depth. ` +
+            `See design/05-streaming.md §"Signal Promotion".`
+        );
+      }
+      addSpanEventSync('timber.ssr.signal_promotion_cap_reached', {
+        depth: SIGNAL_PROMOTION_MAX_YIELDS,
+        signal_types_checked: 'redirect,deny',
+      });
+    }
+  }
+
+  // A captured signal replaces this document, so its body is never read.
+  const promoted = capturedSignal();
+  if (promoted) {
+    ssrResponse.body
+      ?.cancel()
+      .catch((err: unknown) => swallow(err, 'discarded SSR document body did not cancel'));
+    throw promoted;
+  }
+
+  // Check if a DenySignal was caught in-tree by AccessGate or
+  // PageDenyBoundary. The deny page was rendered as a normal element
+  // (no error in the Flight stream), so SSR succeeded with status 200.
+  // Override the status code from the ALS-stored deny status. See TIM-666.
+  // A hoisted deny whose signal arrived past the promotion cap lands here
+  // too, with the status its catch site recorded (see the detection phase).
+  const denyStatus = getDenyStatus();
+  if (denyStatus) {
+    return new Response(ssrResponse.body, {
+      status: denyStatus,
+      headers: ssrResponse.headers,
+    });
+  }
+
+  return ssrResponse;
 }

package/src/server/rsc-entry/wrap-action-dispatch.ts

@@ -30,10 +30,10 @@
 import type { FormRerender } from '../action-handler.ts';
 import { handleActionRequest, isActionRequest } from '../action-handler.ts';
 import type { BodyLimitsConfig } from '../body-limits.ts';
-import { validateCsrf, type CsrfConfig } from '../csrf.ts';
+import { validateCsrf, csrfRejectionResponse, type CsrfConfig } from '../csrf.ts';
 import { runWithFormFlash } from '../form-flash.ts';
-import { seedRequestCookies } from '../cookie-context.ts';
 import type { RouteMatcher } from '../pipeline.ts';
+import { isApiRouteChain } from '../route-matcher.ts';
 import type { SensitiveFieldsOption } from '../sensitive-fields.ts';
 import type { RevalidateRenderer } from '../actions.ts';
 
@@ -95,7 +95,7 @@ export function wrapPipelineWithActionDispatch(
     // Runs on EVERY unsafe-method request, before any dispatch decision.
     const csrfResult = validateCsrf(req, deps.csrfConfig);
     if (!csrfResult.ok) {
-      return new Response(null, { status: csrfResult.status });
+      return csrfRejectionResponse(req, csrfResult);
     }
 
     return pipeline(req);
@@ -120,12 +120,12 @@ export function buildActionDispatcher(
 ): (
   req: Request,
   canonicalPath: string,
-  reenter: (req: Request) => Promise<Response>
+  reenter: (req: Request, cookies: Map<string, string>) => Promise<Response>
 ) => Promise<Response | null> {
   return async (
     req: Request,
     canonicalPath: string,
-    reenter: (req: Request) => Promise<Response>
+    reenter: (req: Request, cookies: Map<string, string>) => Promise<Response>
   ): Promise<Response | null> => {
     if (!isActionRequest(req)) return null;
 
@@ -138,11 +138,8 @@ export function buildActionDispatcher(
     // which re-encodes the path. The matcher expects the decoded canonical form.
     if (deps.matchRoute) {
       const match = deps.matchRoute(canonicalPath);
-      if (match) {
-        const leaf = match.segments[match.segments.length - 1];
-        if (leaf?.route) {
-          return null;
-        }
+      if (match && isApiRouteChain(match.segments)) {
+        return null;
       }
     }
 
@@ -161,8 +158,8 @@ export function buildActionDispatcher(
         // Build a synthetic GET request for the rerender pipeline:
         //   - Same URL (so route matching lands on the same page)
         //   - Cookie header DROPPED entirely. The post-action RYW state
-        //     is threaded into the rerender request context as a parsed
-        //     `Map<string, string>` via `seedRequestCookies` below.
+        //     is handed to `reenter` as a parsed `Map<string, string>`,
+        //     which becomes the rerender request context's cookies.
         //   - Method GET because the rerender is conceptually a page render.
         const rerenderHeaders = new Headers(req.headers);
         rerenderHeaders.delete('cookie');
@@ -170,8 +167,9 @@ export function buildActionDispatcher(
           method: 'GET',
           headers: rerenderHeaders,
         });
-        seedRequestCookies(rerenderReq, formRerender.cookies);
-        const response = await runWithFormFlash(formRerender.rerender, () => reenter(rerenderReq));
+        const response = await runWithFormFlash(formRerender.rerender, () =>
+          reenter(rerenderReq, formRerender.cookies)
+        );
         // Apply Set-Cookie headers snapshotted from the action's ALS scope.
         for (const value of formRerender.setCookieHeaders) {
           response.headers.append('Set-Cookie', value);