@timber-js/app 0.2.0-alpha.9 → 0.2.0-alpha.91

package/src/server/rsc-entry/rsc-payload.ts

@@ -9,12 +9,12 @@
  *              16-metadata.md §"Head Elements"
  */
 
-import type { LayoutEntry } from '#/server/deny-renderer.js';
-import { renderDenyPageAsRsc } from '#/server/deny-renderer.js';
-import type { RouteMatch } from '#/server/pipeline.js';
-import type { RedirectSignal } from '#/server/primitives.js';
-import type { HeadElement, LayoutComponentEntry } from '#/server/route-element-builder.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
+import type { LayoutEntry } from '../deny-renderer.js';
+import { renderDenyPageAsRsc } from '../deny-renderer.js';
+import type { RouteMatch } from '../pipeline.js';
+import type { RedirectSignal } from '../primitives.js';
+import type { HeadElement, LayoutComponentEntry } from '../route-element-builder.js';
+import type { ManifestSegmentNode } from '../route-matcher.js';
 
 import {
   buildRedirectResponse,
@@ -69,10 +69,25 @@ export async function buildRscPayloadResponse(
     | { type: 'data'; chunk: ReadableStreamReadResult<Uint8Array> }
     | { type: 'signal' };
 
-  const first: RaceResult = await Promise.race([
-    reader.read().then((chunk) => ({ type: 'data' as const, chunk })),
-    signalDetected.then(() => ({ type: 'signal' as const })),
-  ]);
+  let first: RaceResult;
+  try {
+    first = await Promise.race([
+      reader.read().then((chunk) => ({ type: 'data' as const, chunk })),
+      signalDetected.then(() => ({ type: 'signal' as const })),
+    ]);
+  } catch (_readError) {
+    // RSC stream failed on first read — unhandled error in the page component.
+    // Return an error response so the client can hard-navigate for the
+    // SSR-rendered error page. See design/10-error-handling.md.
+    reader.cancel().catch(() => {});
+    signals.onSignal = undefined;
+    responseHeaders.set('X-Timber-Error', '1');
+    responseHeaders.set('content-type', 'application/json; charset=utf-8');
+    return new Response(JSON.stringify({ error: true, status: 500 }), {
+      status: 500,
+      headers: responseHeaders,
+    });
+  }
 
   // If data arrived first, still check signals — they may have fired
   // concurrently. Also do a final ceiling timeout check for edge cases
@@ -102,10 +117,36 @@ export async function buildRscPayloadResponse(
     );
   }
 
+  // Check for unhandled errors (RenderError or plain Error).
+  // These aren't redirect/deny signals but the RSC stream will be broken.
+  // Return an error response so the client can hard-navigate for the
+  // SSR-rendered error page. See design/10-error-handling.md
+  // §"Error Page Rendering for Client Navigation".
+  if (signals.renderError) {
+    reader.cancel().catch(() => {});
+    responseHeaders.set('X-Timber-Error', '1');
+    responseHeaders.set('content-type', 'application/json; charset=utf-8');
+    return new Response(
+      JSON.stringify({
+        error: true,
+        status: signals.renderError.status,
+      }),
+      { status: signals.renderError.status, headers: responseHeaders }
+    );
+  }
+
   // Extract the first chunk from the race result.
-  // If the signal won the race, read the first chunk now (the stream
-  // was already cancelled above, but we need a firstRead shape below).
-  const firstRead = first.type === 'data' ? first.chunk : await reader.read();
+  // If the signal won the race but neither redirect nor deny was detected
+  // (edge case), cancel the reader immediately rather than issuing a bare
+  // read() that could hang forever if the RSC stream has stalled.
+  // See TIM-519.
+  let firstRead: ReadableStreamReadResult<Uint8Array>;
+  if (first.type === 'data') {
+    firstRead = first.chunk;
+  } else {
+    await reader.cancel();
+    firstRead = { done: true, value: undefined };
+  }
 
   // Reconstruct the stream: prepend the buffered first chunk,
   // then continue piping from the original reader.
@@ -155,14 +196,20 @@ export async function buildRscPayloadResponse(
     responseHeaders.set('X-Timber-Skipped-Segments', JSON.stringify(skippedSegments));
   }
 
-  // Send route params so the client can populate useParams() after
-  // SPA navigation. Without this, useParams() returns {}.
-  if (Object.keys(match.params).length > 0) {
-    responseHeaders.set('X-Timber-Params', JSON.stringify(match.params));
+  // Send route params so the client can populate useSegmentParams() after
+  // SPA navigation. Without this, useSegmentParams() returns {}.
+  if (Object.keys(match.segmentParams).length > 0) {
+    responseHeaders.set('X-Timber-Params', JSON.stringify(match.segmentParams));
   }
 
+  // Check if a DenySignal was caught in-tree by AccessGate or
+  // PageDenyBoundary. The deny page is in the Flight stream as a normal
+  // element — use the deny status for the HTTP response. See TIM-666.
+  const { getDenyStatus } = await import('../deny-page-resolver.js');
+  const denyStatus = getDenyStatus();
+
   return new Response(patchedStream, {
-    status: 200,
+    status: denyStatus ?? 200,
     headers: responseHeaders,
   });
 }

package/src/server/rsc-entry/rsc-stream.ts

@@ -10,14 +10,22 @@
  *              13-security.md §"Errors don't leak"
  */
 
-import { renderToReadableStream } from '#/rsc-runtime/rsc.js';
+import { renderToReadableStream } from '../../rsc-runtime/rsc.js';
 
-import { logRenderError } from '#/server/logger.js';
-import { DenySignal, RedirectSignal, RenderError } from '#/server/primitives.js';
-import { checkAndWarnRscPropError } from '#/server/rsc-prop-warnings.js';
+import { randomUUID } from 'node:crypto';
 
-import { createDebugChannelSink, isAbortError } from './helpers.js';
-import { isDebug } from '#/server/debug.js';
+import { logRenderError } from '../logger.js';
+import { DenySignal, RedirectSignal, RenderError } from '../primitives.js';
+import { checkAndWarnRscPropError } from '../rsc-prop-warnings.js';
+
+import {
+  createDebugChannelSink,
+  createDebugChannelCollector,
+  isAbortError,
+  type DebugComponentEntry,
+} from './helpers.js';
+import { isDebug } from '../debug.js';
+import { isDevMode } from '../debug.js';
 
 /**
  * Mutable signal state captured during RSC rendering.
@@ -33,6 +41,16 @@ export interface RenderSignals {
   denySignal: DenySignal | null;
   redirectSignal: RedirectSignal | null;
   renderError: { error: unknown; status: number } | null;
+  /**
+   * The last unhandled error seen by RSC onError that isn't a signal.
+   * Used as a fallback when SSR fails (SsrStreamError) but no structured
+   * signal was captured — provides the original error for the error page
+   * instead of relying on SsrStreamError.cause extraction.
+   *
+   * NOT used for page-level error detection (that would break Suspense
+   * error isolation). Only consumed when SSR actually fails.
+   */
+  lastUnhandledError: unknown | null;
   /** Callback fired when a redirect or deny signal is captured in onError. */
   onSignal?: () => void;
 }
@@ -40,6 +58,8 @@ export interface RenderSignals {
 export interface RscStreamResult {
   rscStream: ReadableStream<Uint8Array> | undefined;
   signals: RenderSignals;
+  /** Dev-only: server component debug info from the Flight debug channel. */
+  getDebugComponents?: () => DebugComponentEntry[];
 }
 
 /**
@@ -58,10 +78,15 @@ export function renderRscStream(element: React.ReactElement, req: Request): RscS
     denySignal: null,
     redirectSignal: null,
     renderError: null,
+    lastUnhandledError: null,
   };
 
   let rscStream: ReadableStream<Uint8Array> | undefined;
 
+  // In dev mode, collect debug channel data for the error overlay.
+  // In production, use the discard sink (no overhead).
+  const debugChannel = isDevMode() ? createDebugChannelCollector() : createDebugChannelSink();
+
   try {
     rscStream = renderToReadableStream(
       element,
@@ -126,13 +151,47 @@ export function renderRscStream(element: React.ReactElement, req: Request): RscS
             checkAndWarnRscPropError(error, new URL(req.url).pathname);
           }
 
-          // Track unhandled errors for pre-flush handling (500 status)
-          if (!signals.renderError) {
-            signals.renderError = { error, status: 500 };
-          }
-          logRenderError({ method: req.method, path: new URL(req.url).pathname, error });
+          // Log the error but do NOT track it as a page-level render error.
+          // If this error is inside a <Suspense> boundary, React will emit
+          // an error row in the Flight stream and the Suspense fallback will
+          // render on the client. Tracking it as signals.renderError would
+          // cause the pipeline to treat the entire page as a 500, even though
+          // the shell rendered successfully. See TIM-524.
+          //
+          // Only track as renderError if no Suspense boundary contains it —
+          // React will call onShellError for truly unrecoverable errors.
+
+          // Track the last unhandled error so the pipeline can use it
+          // if SSR fails (SsrStreamError). This is NOT used for page-level
+          // error detection — only as a fallback when SSR actually fails.
+          signals.lastUnhandledError = error;
+
+          // Return a digest so React emits a per-row error in the Flight
+          // stream instead of leaving the lazy reference unresolved.
+          //
+          // SECURITY: Never include error.message in the digest — it may
+          // contain SQL queries, filesystem paths, secret fragments, or
+          // internal IDs. Use a generic message with a correlation ID so
+          // the error can be matched to server logs.
+          // See design/13-security.md §"Errors don't leak".
+          const errorId = randomUUID();
+          logRenderError({
+            method: req.method,
+            path: new URL(req.url).pathname,
+            error,
+            errorId,
+          });
+          return JSON.stringify({
+            type: 'error',
+            message: isDevMode()
+              ? error instanceof Error
+                ? error.message
+                : String(error)
+              : 'An unexpected error occurred.',
+            errorId,
+          });
         },
-        debugChannel: createDebugChannelSink(),
+        debugChannel,
       },
       {
         onClientReference(info: { id: string; name: string; deps: unknown }) {
@@ -160,5 +219,14 @@ export function renderRscStream(element: React.ReactElement, req: Request): RscS
     }
   }
 
-  return { rscStream, signals };
+  return {
+    rscStream,
+    signals,
+    // Expose the debug channel collector's getComponents in dev mode.
+    // The caller can retrieve component tree info when handling errors.
+    getDebugComponents:
+      'getComponents' in debugChannel
+        ? (debugChannel as { getComponents: () => DebugComponentEntry[] }).getComponents
+        : undefined,
+  };
 }

package/src/server/rsc-entry/ssr-bridge.ts

@@ -4,15 +4,24 @@
 
 /// <reference types="@vitejs/plugin-rsc/types" />
 
-import type { NavContext } from '#/server/ssr-entry.js';
+import type { NavContext } from '../ssr-entry.js';
 
 export async function callSsr(
   rscStream: ReadableStream<Uint8Array>,
   navContext: NavContext
 ): Promise<Response> {
-  const ssrEntry = await import.meta.viteRsc.import<typeof import('#/server/ssr-entry.js')>(
-    '../ssr-entry.js',
-    { environment: 'ssr' }
-  );
+  let ssrEntry: typeof import('../ssr-entry.js');
+  try {
+    ssrEntry = await import.meta.viteRsc.import<typeof import('../ssr-entry.js')>(
+      '../ssr-entry.js',
+      { environment: 'ssr' }
+    );
+  } catch (error) {
+    const original = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `[timber] Failed to load SSR entry from RSC environment.\n  ${original}\n  This usually means a module evaluation error in the SSR bundle.`,
+      { cause: error }
+    );
+  }
   return ssrEntry.handleSsr(rscStream, navContext);
 }

package/src/server/rsc-entry/ssr-renderer.ts

@@ -12,25 +12,49 @@
  *              05-streaming.md §"deferSuspenseFor and the Hold Window"
  */
 
-import type { ClientBootstrapConfig } from '#/server/html-injectors.js';
-import type { LayoutEntry } from '#/server/deny-renderer.js';
-import { renderDenyPage } from '#/server/deny-renderer.js';
-import type { RouteMatch } from '#/server/pipeline.js';
-import { SsrStreamError } from '#/server/primitives.js';
-import type { LayoutComponentEntry } from '#/server/route-element-builder.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import type { NavContext } from '#/server/ssr-entry.js';
+import type { ClientBootstrapConfig } from '../html-injectors.js';
+import { flightInitScript } from '../flight-scripts.js';
+import type { LayoutEntry } from '../deny-renderer.js';
+import { renderDenyPage } from '../deny-renderer.js';
+import type { RouteMatch } from '../pipeline.js';
+import { SsrStreamError } from '../primitives.js';
+import type { LayoutComponentEntry } from '../route-element-builder.js';
+import type { ManifestSegmentNode } from '../route-matcher.js';
+import type { NavContext } from '../ssr-entry.js';
 
 import {
   buildRedirectResponse,
   buildSegmentInfo,
   createDebugChannelSink,
   isAbortError,
-  parseCookiesFromHeader,
 } from './helpers.js';
-import { renderErrorPage } from './error-renderer.js';
+import { getCookiesForSsr } from '../request-context.js';
+import { getDenyStatus } from '../deny-page-resolver.js';
+import { renderErrorPage, type GlobalErrorFile } from './error-renderer.js';
 import { callSsr } from './ssr-bridge.js';
 import type { RenderSignals } from './rsc-stream.js';
+import { recordTiming } from '../server-timing.js';
+import { teeWithErrorPropagation } from '../stream-utils.js';
+
+/**
+ * Maximum number of queueMicrotask yields during signal promotion.
+ * The known rejection chain depth for a withSpan-wrapped component is 3+
+ * microtasks. We use 5 to tolerate additional async wrappers or React
+ * Flight internals adding extra microtask hops. Do not increase beyond 8 —
+ * a deeper chain indicates a structural problem.
+ */
+const SIGNAL_PROMOTION_MAX_YIELDS = 5;
+
+/**
+ * Test-only observable: records how many microtask yields were consumed
+ * during the last signal promotion check. Import this in tests to assert
+ * the actual rejection chain depth and detect regressions if wrappers
+ * add more async hops.
+ *
+ * Only populated when the object is imported and exists — production
+ * bundles that don't import it pay zero cost (the typeof check is free).
+ */
+export const __test_only_signalPromotionDepth: { value: number } = { value: 0 };
 
 interface SsrRenderOptions {
   req: Request;
@@ -44,6 +68,8 @@ interface SsrRenderOptions {
   clientJsDisabled: boolean;
   headHtml: string;
   deferSuspenseFor: number;
+  /** Tier 2 global-error.tsx file, if present in app/. */
+  globalError?: GlobalErrorFile;
 }
 
 /**
@@ -77,11 +103,26 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
     clientJsDisabled,
     headHtml,
     deferSuspenseFor,
+    globalError,
   } = opts;
 
   // Tee the RSC stream — one copy goes to SSR for HTML rendering,
   // the other is inlined in the HTML for client-side hydration.
-  const [ssrStream, inlineStream] = rscStream.tee();
+  // Uses teeWithErrorPropagation to ensure errors on either branch
+  // cancel the other (preventing hung responses) and to monitor
+  // buffer divergence between SSR and inline consumers.
+  //
+  // When client JS is disabled, skip the tee — the inline stream would
+  // never be consumed, causing monotonic buffer divergence that eventually
+  // triggers the 5MB guard and cancels the SSR stream.
+  let ssrStream: ReadableStream<Uint8Array>;
+  let inlineStream: ReadableStream<Uint8Array> | undefined;
+  if (clientJsDisabled) {
+    ssrStream = rscStream;
+    inlineStream = undefined;
+  } else {
+    [ssrStream, inlineStream] = teeWithErrorPropagation(rscStream);
+  }
 
   // Embed segment metadata in HTML for initial hydration.
   // The client reads this to populate its segment cache before the
@@ -91,26 +132,33 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
     ? ''
     : `<script>self.__timber_segments=${JSON.stringify(buildSegmentInfo(segments, layoutComponents))}</script>`;
 
-  // Embed route params in HTML so useParams() works on initial hydration.
-  // Without this, useParams() returns {} until the first client navigation.
+  // Embed route params in HTML so useSegmentParams() works on initial hydration.
+  // Without this, useSegmentParams() returns {} until the first client navigation.
   const paramsScript =
-    clientJsDisabled || Object.keys(match.params).length === 0
+    clientJsDisabled || Object.keys(match.segmentParams).length === 0
       ? ''
-      : `<script>self.__timber_params=${JSON.stringify(match.params)}</script>`;
+      : `<script>self.__timber_params=${JSON.stringify(match.segmentParams)}</script>`;
 
   const navContext: NavContext = {
     pathname: new URL(req.url).pathname,
-    params: match.params,
+    params: match.segmentParams,
     searchParams: Object.fromEntries(new URL(req.url).searchParams),
     statusCode: 200,
     responseHeaders,
-    headHtml: headHtml + clientBootstrap.preloadLinks + segmentScript + paramsScript,
+    headHtml:
+      headHtml +
+      clientBootstrap.preloadLinks +
+      segmentScript +
+      paramsScript +
+      // Initialize __timber_f in <head> so it exists before any streaming
+      // chunk scripts arrive in <body>. See flight-scripts.ts, LOCAL-415.
+      (clientJsDisabled ? '' : flightInitScript()),
     bootstrapScriptContent: clientBootstrap.bootstrapScriptContent,
     // Skip RSC inline stream when client JS is disabled — no client to hydrate.
     rscStream: clientJsDisabled ? undefined : inlineStream,
     deferSuspenseFor: deferSuspenseFor > 0 ? deferSuspenseFor : undefined,
     signal: req.signal,
-    cookies: parseCookiesFromHeader(req.headers.get('cookie') ?? ''),
+    cookies: getCookiesForSsr(),
   };
 
   // Helper: check if render-phase signals were captured and return the
@@ -118,14 +166,19 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
   // promotion from Suspense) and failed SSR (signal outside Suspense).
   //
   // When `skipHandledDeny` is true (SSR success path), skip DenySignal
-  // promotion if the denial was already handled by a TimberErrorBoundary
-  // (e.g., slot error boundary). The boundary sets navContext._denyHandledByBoundary
-  // during SSR rendering. See LOCAL-298.
+  // re-render if the denial was already handled by a TimberErrorBoundary.
+  // The boundary renders the deny page as its fallback AND sets the correct
+  // HTTP status code on navContext — no redundant renderDenyPage() needed.
+  // See TIM-664, LOCAL-298.
   function checkCapturedSignals(skipHandledDeny = false): Response | Promise<Response> | null {
     if (signals.redirectSignal) {
       return buildRedirectResponse(req, signals.redirectSignal, responseHeaders);
     }
     if (signals.denySignal && !(skipHandledDeny && navContext._denyHandledByBoundary)) {
+      // Deny was not handled by an in-tree error boundary.
+      // Fall back to renderDenyPage (separate React.cache scope).
+      // For single-render behavior, add a 'use client' status-code file
+      // (e.g., 4xx.tsx) — the error boundary handles it in-tree.
       return renderDenyPage(
         signals.denySignal,
         segments,
@@ -147,7 +200,8 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
         req,
         match,
         responseHeaders,
-        clientBootstrap
+        clientBootstrap,
+        globalError
       );
     }
     return null;
@@ -156,18 +210,51 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
   try {
     const ssrResponse = await callSsr(ssrStream, navContext);
 
+    // Record SSR sub-phase timings for Server-Timing header (detailed mode).
+    // These are populated by handleSsr() in the SSR environment and passed
+    // back via navContext._ssrTimings across the RSC→SSR boundary.
+    if (navContext._ssrTimings) {
+      const t = navContext._ssrTimings;
+      recordTiming({ name: 'ssr-decode', dur: t.decodeMs, desc: 'RSC Flight decode' });
+      recordTiming({ name: 'ssr-shell', dur: t.shellMs, desc: 'Fizz onShellReady' });
+      recordTiming({ name: 'ssr-pipeline', dur: t.pipelineMs, desc: 'stream transforms' });
+      recordTiming({
+        name: 'ssr-total',
+        dur: t.totalMs,
+        desc: t.nodeStreams ? 'SSR (Node streams)' : 'SSR (Web Streams)',
+      });
+    }
+
     // Signal promotion: check if any signals were captured during rendering
-    // inside Suspense boundaries. If no signals are present yet, yield one
-    // microtask so async component rejections propagate to the RSC onError
-    // callback before we commit the response.
+    // inside Suspense boundaries. If no signals are present yet, yield
+    // multiple microtasks so async component rejections propagate through
+    // the full rejection chain to the RSC onError callback before we
+    // commit the response.
+    //
+    // The known rejection chain depth for a withSpan-wrapped page:
+    //   1. PageComponent throws DenySignal/RedirectSignal
+    //   2. withSpan catches and re-throws (microtask 1)
+    //   3. TracedPage promise rejects (microtask 2)
+    //   4. React Flight rejection handler → onError (microtask 3+)
+    //
+    // A single queueMicrotask only advances the queue by one step, which
+    // is insufficient for chains deeper than 1. We retry up to
+    // SIGNAL_PROMOTION_MAX_YIELDS (5) times, exiting early as soon as a
+    // signal is detected. This tolerates future wrappers adding depth
+    // without requiring code changes.
     //
     // When signals are already captured (onSignal already fired), skip the
     // yield entirely — react immediately. Uses queueMicrotask instead of
-    // setTimeout(0) for the fallback to avoid yielding to the full event
-    // loop (timers phase).
+    // setTimeout(0) to avoid yielding to the full event loop (timers phase).
     // See design/05-streaming.md §"deferSuspenseFor and the Hold Window"
     if (!signals.redirectSignal && !signals.denySignal && !signals.renderError) {
-      await new Promise<void>((r) => queueMicrotask(r));
+      let yieldsConsumed = 0;
+      for (let i = 0; i < SIGNAL_PROMOTION_MAX_YIELDS; i++) {
+        await new Promise<void>((r) => queueMicrotask(r));
+        yieldsConsumed++;
+        if (signals.redirectSignal || signals.denySignal || signals.renderError) break;
+      }
+      __test_only_signalPromotionDepth.value = yieldsConsumed;
     }
 
     const promoted = checkCapturedSignals(/* skipHandledDeny */ true);
@@ -175,6 +262,19 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
       ssrResponse.body?.cancel();
       return promoted;
     }
+
+    // Check if a DenySignal was caught in-tree by AccessGate or
+    // PageDenyBoundary. The deny page was rendered as a normal element
+    // (no error in the Flight stream), so SSR succeeded with status 200.
+    // Override the status code from the ALS-stored deny status. See TIM-666.
+    const denyStatus = getDenyStatus();
+    if (denyStatus) {
+      return new Response(ssrResponse.body, {
+        status: denyStatus,
+        headers: ssrResponse.headers,
+      });
+    }
+
     return ssrResponse;
   } catch (ssrError) {
     // Connection abort — the client disconnected (page refresh, navigation
@@ -185,19 +285,34 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
 
     // SsrStreamError: SSR's renderToReadableStream failed because the RSC
     // stream contained an uncontained error (e.g., slot without error boundary).
-    // Render the deny/error page WITHOUT layout wrapping to avoid re-executing
-    // server components (which call headers()/cookies() and fail in SSR's
-    // separate ALS scope). See LOCAL-293.
-    if (ssrError instanceof SsrStreamError) {
+    //
+    // Error pages now use SSR-only rendering (Fizz directly, no RSC Flight),
+    // which imports layouts in the SSR environment where ALS is active. This
+    // means we CAN include layouts — they'll call getHeaders()/getCookies() correctly.
+    //
+    // Deny pages still go through RSC → SSR (plain props), so they pass empty
+    // layouts to avoid re-executing server components in the RSC environment's
+    // stale ALS scope. See LOCAL-293.
+    // Name-based check: SsrStreamError is thrown in the SSR environment
+    // but caught in the RSC environment. Since RSC and SSR are separate
+    // Vite module graphs, `instanceof` fails (different class identities).
+    // Use error.name instead. See design/18-build-system.md §"Virtual Module
+    // Resolution Quirks".
+    const isSsrStreamError =
+      ssrError instanceof SsrStreamError ||
+      (ssrError instanceof Error && ssrError.name === 'SsrStreamError');
+    if (isSsrStreamError) {
       if (signals.redirectSignal) {
         return buildRedirectResponse(req, signals.redirectSignal, responseHeaders);
       }
       if (signals.denySignal) {
-        // Render deny page without layouts — pass empty layout list
+        // SSR failed (SsrStreamError) — the deny was in the shell and
+        // the error boundary didn't catch it during Fizz rendering.
+        // Fall back to renderDenyPage (separate render). See TIM-664.
         return renderDenyPage(
           signals.denySignal,
           segments,
-          [] as LayoutEntry[],
+          layoutComponents as LayoutEntry[],
           req,
           match,
           responseHeaders,
@@ -207,19 +322,37 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
         );
       }
       if (signals.renderError) {
+        // RenderError: TSX error pages use SSR-only path (layouts OK),
+        // MDX error pages use RSC path (plain props, no Error object).
         return renderErrorPage(
           signals.renderError.error,
           signals.renderError.status,
           segments,
-          [] as LayoutEntry[],
+          layoutComponents as LayoutEntry[],
           req,
           match,
           responseHeaders,
-          clientBootstrap
+          clientBootstrap,
+          globalError
         );
       }
-      // No captured signal — return bare 500
-      return new Response(null, { status: 500, headers: responseHeaders });
+      // No captured signal — unhandled error in the RSC stream.
+      // Use the lastUnhandledError from RSC onError if available (more
+      // reliable than extracting SsrStreamError.cause). Falls back to
+      // cause extraction for backward compatibility.
+      const originalError =
+        signals.lastUnhandledError ?? (ssrError as { cause?: unknown }).cause ?? ssrError;
+      return renderErrorPage(
+        originalError,
+        500,
+        segments,
+        layoutComponents as LayoutEntry[],
+        req,
+        match,
+        responseHeaders,
+        clientBootstrap,
+        globalError
+      );
     }
 
     // SSR shell rendering failed — the error was outside Suspense.