fix: name the handler contract when a non-Response is returned in dev

[rturnq]

Description

@marko/run: a dev handler that returns anything other than a Response — return { items: [...] }, the auto-JSON habit from other frameworks — sailed through call(), whose terminal guard only rejected null and the NotHandled/NotMatched sentinels, and reached the node adapter as if it were a Response. The adapter then iterated response.headers on undefined and the developer saw headers is not iterable with a stack topping out in copyResponseHeaders in a dist file — no route, no verb, no contract.

A dev-only assertion in call() now rejects any truthy non-Response with an error naming everything the old one didn't:

Handler 'handler' for GET /api returned a value of type "object" instead of a Response.
Return `Response.json(value)` to send JSON, return a `new Response(...)`, or call `next()` to continue.

Production builds skip the check, keeping the hot path unchanged (pinned by a test).

Writing the guard flushed out a second, pre-existing bug: the NotHandled/NotMatched sentinels were per-copy unique symbols, and a build can load more than one copy of the runtime module — the not-handled fixture does. A sentinel returned from user code then failed the identity comparison in another copy and flowed onward into the adapter as if it were a response; the fixture only survived because its handler had already written to the platform response directly. The sentinels are now registered with Symbol.for, the same pattern kRender in the same module already uses.

The branch also carries the same two-word cspell addition as #244 (a separate, droppable commit) since main's local pnpm run lint currently fails without it.

Motivation and Context

The misleading error steers whoever reads it — developer or coding agent — toward editing adapter internals instead of their handler. Typed projects are protected by HandlerReturnValue, but plain-JS handlers are supported and get no compile-time signal.

Coverage: a new handler-returns-object fixture reproduces the original headers is not iterable failure on unmodified code and asserts the new message names GET /api (dev-only; preview skipped since the guard is dev-gated), and call-return-value.test.ts covers Response pass-through, fall-through on no return, the guard's message, production being unchecked, and cross-copy sentinel recognition. Both revert-checked in each direction.

Screenshots (if appropriate):

Checklist:

• I have updated/added documentation affected by my changes.
• I have added tests to cover my changes.

---

Generated by Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: bbb344a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@marko/run	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 22 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0ed9cf22-f0a8-4ff8-87d0-382d050bc85a

📥 Commits

Reviewing files that changed from the base of the PR and between 00c9cb2 and bbb344a.

📒 Files selected for processing (3)

• agent-feedback/bugs.md
• packages/run/src/__tests__/call-return-value.test.ts
• packages/run/src/runtime/internal.ts

Walkthrough

The runtime now registers NotHandled and NotMatched with Symbol.for for cross-runtime recognition. Development builds reject truthy handler results that are not Response instances and report the handler, method, and route. Tests cover response pass-through, continuation sentinels, invalid returns, and production behavior. A fixture verifies the resulting 500 response for an object return.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: naming the handler contract when a non-Response value is returned during development.
Description check	✅ Passed	The description accurately explains the development-only validation, cross-runtime sentinel fix, production behavior, tests, and lint update.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/handler-response-assert

---

_{Comment @coderabbitai help to get the list of available commands.}