castrum 0.9.8 → 0.9.9

package/src/ingress/abort.ts

@@ -0,0 +1,48 @@
+// src/ingress/abort.ts — PURE request-cancellation helpers.
+//
+// The async ingress reads `Request.signal` (fired when the client disconnects)
+// at its genuine async boundaries. A body read or a route wrapper that observes
+// an abort returns the cancelled-client response instead of running more work.
+// PURE: no addon / pool imports — safe for the route factories.
+
+/**
+ * The `err.code` value a body read carries when it is rejected because the
+ * client disconnected (`Request.signal` aborted).
+ */
+export const ABORT_CODE = 'REQUEST_ABORTED'
+
+/**
+ * Whether a thrown value is the cancellation error produced when `req.signal`
+ * aborts during a body read (see `readBodyWithLimit` in `./body`).
+ *
+ * @param err - The caught value.
+ * @returns `true` when `err.code === 'REQUEST_ABORTED'`.
+ * @example
+ * ```ts
+ * try {
+ *   await readBodyWithLimit(req, 1 << 20, true)
+ * } catch (err) {
+ *   if (isAbortError(err)) return abortResponse()
+ *   throw err
+ * }
+ * ```
+ */
+export function isAbortError(err: unknown): boolean {
+  return (err as { code?: unknown } | null | undefined)?.code === ABORT_CODE
+}
+
+/**
+ * Build the cancelled-client response: status **499** ("Client Closed
+ * Request", a de-facto nginx status) with no body. This is the only new
+ * outcome added by cancellation — it never replaces an existing success or
+ * error status.
+ *
+ * @returns A bodyless `Response` with status 499.
+ * @example
+ * ```ts
+ * if (req.signal?.aborted) return abortResponse()
+ * ```
+ */
+export function abortResponse(): Response {
+  return new Response(null, { status: 499 })
+}

package/src/ingress/body.ts

@@ -2,6 +2,7 @@
 // API.
 
 import { isBun } from '../shared/runtime'
+import { ABORT_CODE } from './abort'
 
 const EMPTY_BODY = new Uint8Array(0)
 
@@ -65,6 +66,59 @@ function bodyTooLargeError(): Error & { code?: string } {
   return err
 }
 
+function abortError(): Error & { code?: string } {
+  const err = new Error(ABORT_CODE) as Error & { code?: string }
+  err.code = ABORT_CODE
+  return err
+}
+
+/** Reject when `signal` is already aborted (the entry guard for every path). */
+function throwIfAborted(signal: AbortSignal | undefined): void {
+  if (signal?.aborted) throw abortError()
+}
+
+/** A reusable rejection promise + listener-cleanup pair for a read race. */
+interface ReadGuard {
+  promise: Promise<never>
+  cancel: () => void
+}
+
+/**
+ * Track `req.signal` as a rejection racer: settles with a `REQUEST_ABORTED`
+ * error when the client disconnects. Returns `null` when the request carries no
+ * signal, so runtimes without `Request.signal` are unaffected. The
+ * `{ once: true }` listener self-removes when it fires; `cancel()` detaches it
+ * on the read-completed-first path so no listener outlives the read.
+ */
+function createAbortGuard(signal: AbortSignal | undefined): ReadGuard | null {
+  if (!signal) return null
+  if (signal.aborted) {
+    return { promise: Promise.reject(abortError()), cancel: () => {} }
+  }
+  let listener: (() => void) | null = null
+  const promise = new Promise<never>((_resolve, reject) => {
+    listener = () => reject(abortError())
+    signal.addEventListener('abort', listener, { once: true })
+  })
+  return {
+    promise,
+    cancel: () => {
+      if (listener !== null) {
+        signal.removeEventListener('abort', listener)
+        listener = null
+      }
+    },
+  }
+}
+
+/** Race a read against guard rejections (a plain await when there are none). */
+function raceRead<T>(read: Promise<T>, guards: ReadonlyArray<ReadGuard>): Promise<T> {
+  if (guards.length === 0) return read
+  const racers: Promise<unknown>[] = [read]
+  for (const guard of guards) racers.push(guard.promise)
+  return Promise.race(racers) as Promise<T>
+}
+
 // ── Shared body-read deadline watchdog ──────────────────────────────────────
 // One interval timer sweeps ALL in-flight body reads that carry a deadline,
 // replacing a per-request `setTimeout` + `clearTimeout` + `timer.unref` on
@@ -145,6 +199,9 @@ function createDeadline(deadlineMs: number): { promise: Promise<never>; cancel:
  *   (thrown as soon as the limit is crossed — the body is never fully
  *   buffered first, which is the slowloris/large-body protection).
  * - `REQUEST_TIMEOUT` when `timeoutMs` elapses before the body completes.
+ * - `REQUEST_ABORTED` when `req.signal` aborts (client disconnect) before the
+ *   read settles — including an already-aborted signal at entry. The race's
+ *   abort listener is removed once the read settles.
  */
 export async function readBodyWithLimit(
   req: Request,
@@ -152,6 +209,10 @@ export async function readBodyWithLimit(
   guard: boolean,
   timeoutMs?: number,
 ): Promise<Uint8Array> {
+  // Client disconnect before any read work: reject immediately (also covers an
+  // already-aborted signal on every downstream path).
+  throwIfAborted(req.signal)
+
   const deadline = timeoutMs && timeoutMs > 0 ? timeoutMs : 0
 
   // Fast path: a declared Content-Length lets us PROVE the body fits the
@@ -173,11 +234,34 @@ export async function readBodyWithLimit(
       // path — `req.bytes()` (Bun) / `arrayBuffer()` (Node) read the buffered
       // body directly, avoiding a lazily-constructed stream per write request.
       if (deadline <= 0) {
-        const bytes = await readBodyBytes(req)
-        if (guard && bytes.byteLength > maxBytes) {
-          throw bodyTooLargeError()
+        // No deadline: use the same buffered fast path as the deadline branch.
+        // Under Bun a small declared-length body is usually already buffered —
+        // `Bun.peek` returns the bytes synchronously, so the common case skips
+        // the abort race + microtask entirely. Only a genuinely pending read
+        // (slow/trickling body) or a runtime without `req.bytes()` (Node) pays
+        // the abort race.
+        const buffered = peekBufferedBody(req)
+        if (buffered !== false && 'bytes' in buffered) {
+          throwIfAborted(req.signal)
+          if (guard && buffered.bytes.byteLength > maxBytes) {
+            throw bodyTooLargeError()
+          }
+          return buffered.bytes
+        }
+        const abort = createAbortGuard(req.signal)
+        try {
+          const bytes = await raceRead(
+            buffered === false ? readBodyBytes(req) : buffered,
+            abort !== null ? [abort] : [],
+          )
+          throwIfAborted(req.signal)
+          if (guard && bytes.byteLength > maxBytes) {
+            throw bodyTooLargeError()
+          }
+          return bytes
+        } finally {
+          abort?.cancel()
         }
-        return bytes
       }
       // Deadline path. Under Bun, a small declared-length body is usually
       // already buffered — `Bun.peek` returns the bytes synchronously, so we
@@ -187,31 +271,38 @@ export async function readBodyWithLimit(
       const buffered = peekBufferedBody(req)
       if (buffered === false) {
         const dl = createDeadline(deadline)
+        const abort = createAbortGuard(req.signal)
         try {
-          const bytes = await Promise.race([readBodyBytes(req), dl.promise])
+          const bytes = await raceRead(readBodyBytes(req), abort !== null ? [dl, abort] : [dl])
+          throwIfAborted(req.signal)
           if (guard && bytes.byteLength > maxBytes) {
             throw bodyTooLargeError()
           }
           return bytes
         } finally {
           dl.cancel()
+          abort?.cancel()
         }
       }
       if ('bytes' in buffered) {
+        throwIfAborted(req.signal)
         if (guard && buffered.bytes.byteLength > maxBytes) {
           throw bodyTooLargeError()
         }
         return buffered.bytes
       }
       const dl = createDeadline(deadline)
+      const abort = createAbortGuard(req.signal)
       try {
-        const bytes = await Promise.race([buffered, dl.promise])
+        const bytes = await raceRead(buffered, abort !== null ? [dl, abort] : [dl])
+        throwIfAborted(req.signal)
         if (guard && bytes.byteLength > maxBytes) {
           throw bodyTooLargeError()
         }
         return bytes
       } finally {
         dl.cancel()
+        abort?.cancel()
       }
     }
   }
@@ -220,6 +311,7 @@ export async function readBodyWithLimit(
   // is only touched here — the declared-length fast path never needs it.
   const body = req.body
   if (!body) {
+    throwIfAborted(req.signal)
     return EMPTY_BODY
   }
 
@@ -231,11 +323,14 @@ export async function readBodyWithLimit(
   // per request. It is still required when the loop exits early (timeout/error).
   let completed = false
   const dl = deadline > 0 ? createDeadline(deadline) : null
+  const abort = createAbortGuard(req.signal)
+  const guards: ReadGuard[] = []
+  if (dl !== null) guards.push(dl)
+  if (abort !== null) guards.push(abort)
 
   try {
     for (;;) {
-      const { done, value } =
-        dl !== null ? await Promise.race([reader.read(), dl.promise]) : await reader.read()
+      const { done, value } = await raceRead(reader.read(), guards)
 
       if (done) {
         completed = true
@@ -253,6 +348,7 @@ export async function readBodyWithLimit(
     }
   } finally {
     dl?.cancel()
+    abort?.cancel()
     // Release the underlying stream. Cancelling while a read() is still
     // pending (the timeout case) can resolve that pending read() as `done`
     // and RACE the timeout rejection — so reject first, cancel only AFTER

package/src/ingress/handlers.ts

@@ -94,6 +94,7 @@ export type {
   CreateIngressServerOptions,
   GracefulShutdownOptions,
   ServerHandle,
+  StaticRoute,
 } from './server'
 export { createIngressServer, gracefulShutdown } from './server'
 export type { RouteHandler as IngressNodeRouteHandler } from './server-node'

package/src/ingress/health.ts

@@ -11,6 +11,11 @@
 //     "/livez":   { read: healthHandler() },
 //   }});
 //
+// For probes that are truly constant, prefer static promotion — it skips the
+// JS ingress pipeline entirely:
+//
+//   createIngressServer({ routes: { "/livez": { static: staticLiveness() } } });
+//
 // The liveness probe NEVER touches dependencies (process alive? -> 200).
 // The readiness probe runs the optional `check` (deps up? -> 200/503).
 // The health probe is an alias of liveness (process up) plus optional check.
@@ -36,6 +41,23 @@ export function livenessHandler() {
   return (_req: Request): Response => jsonResponse(200, { status: 'ok' })
 }
 
+/**
+ * Liveness probe as a PREBUILT `Response`, for static route promotion.
+ *
+ * Wire it as `{ static: staticLiveness() }` so `Bun.serve` snapshots the
+ * constant body into its native route table and serves `/livez` without
+ * entering the JavaScript ingress pipeline at all (see `BakedRoute.static` in
+ * src/ingress/server.ts). On the node:http adapter the bare `Response` is
+ * re-materialized per request from cached body bytes, so the one-shot body is
+ * never replayed. Unlike {@link readinessHandler}, it never runs a dependency
+ * check.
+ *
+ * @returns A fresh 200 `{"status":"ok"}` `Response`.
+ */
+export function staticLiveness(): Response {
+  return jsonResponse(200, { status: 'ok' })
+}
+
 /**
  * Readiness probe: runs the optional async `check` (dependency readiness).
  * Returns `200 {"status":"ready"}` when the check passes (or no check is

package/src/ingress/index.ts

@@ -22,6 +22,8 @@ export {
   serializeTraceParent,
 } from '../shared/trace'
 // ── Re-export the full public ingress API ─────────────────────────
+// Request cancellation helpers (client-disconnect → 499).
+export { ABORT_CODE, abortResponse, isAbortError } from './abort'
 export * from './constants'
 export * from './errors'
 export { createIngressFast, FastIngressResult } from './fast'
@@ -30,7 +32,7 @@ export type { CorsOptions, CorsStaticStrings } from './headers/cors'
 export type { HeaderTemplate, ResponseBuildContext } from './headers/fast-templates'
 export { buildResponseContext, headersForResult } from './headers/fast-templates'
 export type { SecurityHeadersOptions } from './headers/hsts'
-export { healthHandler, livenessHandler, readinessHandler } from './health'
+export { healthHandler, livenessHandler, readinessHandler, staticLiveness } from './health'
 export type { IngressMetrics } from './metrics'
 // ── Observability (zero-dep): metrics, health probes ─────────────
 export { createIngressMetrics, metricsHandler } from './metrics'

package/src/ingress/router.ts

@@ -27,7 +27,7 @@ import type { NativeRoutePlan } from './native-route'
 import { type IngressHandlerOptions, warnRateLimitWithoutGetIp } from './options'
 import type { PathMatch } from './path-matcher'
 import { buildPathMatcher } from './path-matcher'
-import type { BakedRoute, RouteHandler } from './server'
+import type { BakedRoute, RouteHandler, StaticRoute } from './server'
 import { buildRouteHandlers } from './server'
 import type { BakedContext, NativeResponder, OptimizedIngressHandler, TerminalStyle } from './types'
 
@@ -88,6 +88,20 @@ export interface RouterRouteSpec {
   /** Terminal envelope style for this route's responder (default: router-level
    *  `terminalStyle` or `'castrum'`). */
   terminalStyle?: TerminalStyle
+  /**
+   * A prebuilt constant response served directly for GET, OUTSIDE the ingress
+   * pipeline (static route promotion). Like `raw`, it OWNS THE WHOLE SPEC: the
+   * router compiles no `IngressInner` for a `static` route, so `read`/`write`/
+   * `echo`/etc. on the same spec are ignored.
+   *
+   * This differs from `BakedRoute.static` in src/ingress/server.ts, where
+   * `static` only takes GET precedence and leaves `write`/`echo`/`delete`
+   * wired — the router cannot mirror that because a `static`-only spec has no
+   * compiled ingress to hand those methods. Do not unify the two semantics.
+   *
+   * See `BakedRoute.static` for the one-shot-body contract.
+   */
+  static?: StaticRoute
   /**
    * A raw request→Response handler served directly for GET, OUTSIDE the
    * ingress pipeline (health/metrics probes, /metrics). When set, `read`/
@@ -175,6 +189,17 @@ export function createIngressRouter(options: CreateIngressRouterOptions): Ingres
   if (options.copyBody !== undefined) baseOpts.copyBody = options.copyBody
 
   for (const [path, spec] of Object.entries(options.routes)) {
+    if (spec.static !== undefined) {
+      // Static promotion: a prebuilt constant response owns the route. Placed
+      // verbatim so Bun.serve can serve it from its native table (a bare
+      // Response) with zero JS.
+      bakedRoutes[path] = {
+        static: spec.static,
+        maxBodyBytes: spec.maxBodyBytes,
+        bodyTimeoutMs: spec.bodyTimeoutMs,
+      }
+      continue
+    }
     if (spec.raw) {
       // Raw handler: served directly, outside the pipeline.
       bakedRoutes[path] = { read: spec.raw as RouteHandler }
@@ -277,6 +302,16 @@ export function createIngressRouter(options: CreateIngressRouterOptions): Ingres
     if (typeof methodHandler === 'function') {
       return (methodHandler as RouteHandler)(req, srv, matched.params)
     }
+    if (methodHandler instanceof Response) {
+      // Static route (bare Response value). `instanceof Response` assumes the
+      // value was built with the global `Response` constructor (the one this
+      // router also uses). `clone()` tees the body without consuming the
+      // original, so every request gets a fresh, complete body. A `static`
+      // factory is a function and is handled above. The cast bridges Bun's
+      // `Response.clone()` return type (which resolves against the bundled
+      // fetch types) to this module's global `Response`.
+      return methodHandler.clone() as unknown as Response
+    }
     // A route matched but this method isn't wired — 405, or a bare OPTIONS 204
     // when the route answers preflights.
     if (req.method === 'OPTIONS' && typeof matched.methods.OPTIONS === 'function') {

package/src/ingress/routes/common.ts

@@ -1,5 +1,6 @@
 // src/ingress/routes/common.ts — Shared route-handler options + helpers.
 
+import { abortResponse } from '../abort'
 import type { BakedIngressResult } from '../decode/baked-result'
 import { memoizedHeaders } from '../headers/memoized-headers'
 import { secondsFromMs } from '../shared'
@@ -93,11 +94,18 @@ export function buildSuccessInit(
  * runner: resolve the client IP once and dispatch through the native pipeline
  * (`ingress.run` with a null body). Used by the read / head / fallback route
  * factories whose responder never needs the request object.
+ *
+ * A disconnected client (`req.signal?.aborted`) short-circuits to the 499
+ * cancelled response BEFORE `ingress.run`, so no pooled output buffer is
+ * acquired for a request that can no longer be delivered.
  */
 export function runBaked(
   ingress: OptimizedIngressHandler,
   opts: BakedHandlerOptions,
   respond: (result: BakedIngressResult, ctx: BakedContext) => Response,
 ): (req: Request, srv?: unknown) => Response {
-  return (req, srv) => ingress.run<Response>(req, resolveIp(req, srv, opts), null, respond)
+  return (req, srv) => {
+    if (req.signal?.aborted) return abortResponse()
+    return ingress.run<Response>(req, resolveIp(req, srv, opts), null, respond)
+  }
 }

package/src/ingress/routes/echo.ts

@@ -1,5 +1,6 @@
 // src/ingress/routes/echo.ts — Pre-baked echo handler.
 
+import { abortResponse, isAbortError } from '../abort'
 import { readBodyWithLimit } from '../body'
 import { HV_JSON } from '../constants'
 import { ERROR_BODIES } from '../response/error-bodies'
@@ -53,6 +54,8 @@ export function echoHandler(
   return async (req, srv) => {
     const ip = resolveIp(req, srv, opts)
 
+    if (req.signal?.aborted) return abortResponse()
+
     const prep = ingress.run<{
       terminal?: Response
       headers?: ReadonlyArray<[string, string]>
@@ -79,6 +82,9 @@ export function echoHandler(
 
     if (prep.terminal) return prep.terminal
 
+    // The client may have disconnected while the native prep ran.
+    if (req.signal?.aborted) return abortResponse()
+
     const baseHeaders: ReadonlyArray<[string, string]> = prep.headers ?? []
 
     const requestedContentType = safeEchoContentType(
@@ -125,11 +131,15 @@ export function echoHandler(
       // oversized or trickling body before rejecting it.
       const bodyBytes = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs)
 
+      // Disconnect during the read must not be answered with a body.
+      if (req.signal?.aborted) return abortResponse()
+
       return new Response(bodyBytes.byteLength > 0 ? bodyBytes : null, {
         status: 200,
         headers: withEchoHeaders(requestedContentType),
       })
     } catch (err) {
+      if (isAbortError(err)) return abortResponse()
       const code = (err as { code?: string } | null)?.code
       const isTooLarge = code === 'BODY_TOO_LARGE'
       const isTimeout = code === 'REQUEST_TIMEOUT'

package/src/ingress/routes/json-write.ts

@@ -2,6 +2,7 @@
 // (POST/PUT/PATCH).
 
 import { decodeUtf8 } from '../../shared/codec'
+import { abortResponse, isAbortError } from '../abort'
 import { readBodyWithLimit } from '../body'
 import { DEFAULT_BODY_TIMEOUT_MS, DEFAULT_MAX_BODY_BYTES } from '../shared'
 import type { OptimizedIngressHandler } from '../types'
@@ -58,6 +59,10 @@ export function jsonWriteHandler(
   return async (req, srv) => {
     const ip = resolveIp(req, srv, opts)
 
+    // Client already gone: do no work (no content-type check, no body read,
+    // no native run). A disconnect DURING the body read is handled below.
+    if (req.signal?.aborted) return abortResponse()
+
     const contentType = req.headers.get('content-type') ?? ''
     if (!isJsonContentType(contentType)) {
       // Always 415 for an unsupported media type. Do NOT short-circuit on the
@@ -87,6 +92,9 @@ export function jsonWriteHandler(
       // never fully buffered first.
       bodyBytes = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs)
     } catch (err) {
+      // Client disconnect is NOT a bad request / timeout: return the cancelled
+      // response without running the native pipeline.
+      if (isAbortError(err)) return abortResponse()
       const code = (err as { code?: string } | null)?.code
       const isTooLarge = code === 'BODY_TOO_LARGE'
       return fallback.run(req, ip, null, (result, ctx) => {
@@ -104,6 +112,9 @@ export function jsonWriteHandler(
       })
     }
 
+    // The client may have disconnected while the body was streaming in.
+    if (req.signal?.aborted) return abortResponse()
+
     return ingress.run(req, ip, bodyBytes, (result, ctx) => {
       const terminal = ingress.terminalResponse(req, result, ctx)
       if (terminal) return terminal

package/src/ingress/routes/native.ts

@@ -21,6 +21,7 @@
 
 import { decoder } from '../../shared/bytes'
 import { generateRequestId } from '../../shared/request-id'
+import { abortResponse, isAbortError } from '../abort'
 import { readBodyWithLimit } from '../body'
 import type { NativeRoute } from '../native-route'
 import type { RouteWireResult } from '../packing/route-wire'
@@ -29,6 +30,7 @@ import { DEFAULT_BODY_TIMEOUT_MS, DEFAULT_MAX_BODY_BYTES } from '../shared'
 import type { NativeRequestContext, NativeResponder } from '../types'
 import type { BakedHandlerOptions } from './common'
 import { resolveIp } from './common'
+import { assignOwn, safeRecord } from './safe-record'
 
 /** Options for {@link nativeRouteHandler}. */
 export interface NativeRouteHandlerOptions extends BakedHandlerOptions {
@@ -36,11 +38,22 @@ export interface NativeRouteHandlerOptions extends BakedHandlerOptions {
   readBody?: boolean
 }
 
-/** The `+`-to-space / `%XX` decoding is done natively; keys are last-wins. */
-function pairsToRecord(pairs: ReadonlyArray<[string, string]>): Record<string, string> {
-  const out: Record<string, string> = {}
-  for (const [k, v] of pairs) out[k] = v
-  return out
+/**
+ * Build a prototype-safe record from native packed pairs. The `+`-to-space /
+ * `%XX` decoding is done natively; keys are last-wins. Keys are written as OWN
+ * data via {@link assignOwn}: `__proto__` is defined (never routed through the
+ * inherited setter), and other keys — including `constructor` / `prototype` —
+ * are plain own shadowing properties. The record keeps `Object.prototype`.
+ *
+ * Exported for the prototype-pollution tests.
+ *
+ * @param pairs - Decoded `[key, value]` pairs from the native route stack.
+ * @returns A record with `Object.prototype` preserved (last value wins per key).
+ */
+export function pairsToRecord(pairs: ReadonlyArray<[string, string]>): Record<string, string> {
+  const out = safeRecord()
+  for (const [k, v] of pairs) assignOwn(out, k, v)
+  return out as Record<string, string>
 }
 
 /**
@@ -78,6 +91,8 @@ export function nativeRouteHandler(
 
   return async (req, srv, _params) => {
     const ip = resolveIp(req, srv, opts)
+    // Client already gone: no request-id work, body read, or native run.
+    if (req.signal?.aborted) return abortResponse()
     const requestId = decoder.decode(generateRequestId())
 
     let body: Uint8Array | null = null
@@ -85,10 +100,14 @@ export function nativeRouteHandler(
       try {
         body = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs)
       } catch (err) {
+        // Client disconnect: the cancelled response, never a 400/408/413.
+        if (isAbortError(err)) return abortResponse()
         const code = (err as Error & { code?: string }).code
         const status = code === 'REQUEST_TIMEOUT' ? 408 : code === 'BODY_TOO_LARGE' ? 413 : 400
         return terminal(status, 'BAD_REQUEST', 'Request body read failed')
       }
+      // Disconnect while the body was streaming in.
+      if (req.signal?.aborted) return abortResponse()
     }
 
     // Extract the query substring + Cookie header (the only request inputs the

package/src/ingress/routes/options.ts

@@ -1,5 +1,6 @@
 // src/ingress/routes/options.ts — Pre-baked OPTIONS handler (CORS preflight).
 
+import { abortResponse } from '../abort'
 import type { OptimizedIngressHandler } from '../types'
 import { type BakedHandlerOptions, buildSuccessInit, resolveIp } from './common'
 
@@ -16,11 +17,14 @@ export function optionsHandler(
   ingress: OptimizedIngressHandler,
   opts: BakedHandlerOptions = {},
 ): (req: Request, srv?: unknown) => Response {
-  return (req, srv) =>
-    ingress.run<Response>(req, resolveIp(req, srv, opts), null, (result, ctx) => {
+  return (req, srv) => {
+    // Client already gone: no pipeline run, no pooled output buffer.
+    if (req.signal?.aborted) return abortResponse()
+    return ingress.run<Response>(req, resolveIp(req, srv, opts), null, (result, ctx) => {
       const terminal = ingress.terminalResponse(req, result, ctx)
       if (terminal) return terminal
 
       return new Response(null, buildSuccessInit(ingress, result, ctx, 204))
     })
+  }
 }

package/src/ingress/routes/responder.ts

@@ -16,6 +16,7 @@
 
 import { decoder } from '../../shared/bytes'
 import { generateRequestId } from '../../shared/request-id'
+import { abortResponse, isAbortError } from '../abort'
 import { readBodyWithLimit } from '../body'
 import type { BakedIngressResult } from '../decode/baked-result'
 import { errorCodeName, errorMessage } from '../errors'
@@ -68,12 +69,25 @@ function buildIgngexTerminal(result: BakedIngressResult, _ctx: BakedContext): Re
   return new Response(body, { status, headers })
 }
 
-/** Parse a `queryJson()`/`cookiesJson()` section into an object (empty on failure). */
-function parseSection(json: string): Record<string, unknown> {
+/**
+ * Parse a `queryJson()`/`cookiesJson()` section into a record (empty on
+ * failure).
+ *
+ * Prototype-safe by construction: `JSON.parse` creates `__proto__` as an OWN
+ * enumerable data property (it never invokes the setter), so the returned
+ * object keeps `Object.prototype` and carries `__proto__` as inert own data.
+ *
+ * Exported for the prototype-pollution tests.
+ *
+ * @param json - The section JSON emitted by the native pipeline.
+ * @returns The decoded object, or an empty record for a non-object / malformed
+ *   section.
+ */
+export function parseSection(json: string): Record<string, unknown> {
   try {
-    const v: unknown = JSON.parse(json)
-    return v !== null && typeof v === 'object' && !Array.isArray(v)
-      ? (v as Record<string, unknown>)
+    const parsed: unknown = JSON.parse(json)
+    return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
       : {}
   } catch {
     return {}
@@ -97,6 +111,8 @@ export function nativeResponderRoute(
 
   return async (req, srv, _params) => {
     const ip = resolveIp(req, srv, opts)
+    // Client already gone: no request-id work, body read, or native run.
+    if (req.signal?.aborted) return abortResponse()
     // The request-id the framework surfaces (same source as the pre-baked path's
     // `ctx.requestIdHeader`): the baked result does not carry it, so generate it
     // here — the native pipeline uses the same rid for its internal frame.
@@ -109,6 +125,8 @@ export function nativeResponderRoute(
       try {
         body = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs)
       } catch (err) {
+        // Client disconnect: the cancelled response, never a 400/408/413.
+        if (isAbortError(err)) return abortResponse()
         const code = (err as Error & { code?: string }).code
         const status = code === 'REQUEST_TIMEOUT' ? 408 : code === 'BODY_TOO_LARGE' ? 413 : 400
         const payload = JSON.stringify({ error: 'Bad Request', status, code: 'BAD_REQUEST' })
@@ -116,6 +134,8 @@ export function nativeResponderRoute(
         headers.set('content-type', 'application/json; charset=utf-8')
         return new Response(payload, { status, headers })
       }
+      // Disconnect while the body was streaming in.
+      if (req.signal?.aborted) return abortResponse()
     }
 
     let terminal: Response | null = null