[jasnell]

Under typescript_implemented_streams, the default controller ignored
the expectedLength its underlying source declared: only byte sources,
a TransformStream's readable (through an internal setter) and native
streams reported a length. A body built from a default source that
declared its length was therefore sent with chunked encoding, where
the C++ implementation sends a Content-Length.

The default controller now caches the converted source's
expectedLength, as the byte controller does, and TransformStream
passes its transformer's through the source it builds for its
readable, which retires the internal setter.

Body consumption already treated a TransformStream readable's
declaration as an exact total (readable ledger #21); that now covers
any default source that declares one. A source that delivers more
than it declared rejects text(), arrayBuffer() and the other
consumers with a RangeError and is cancelled with it, where the C++
implementation returns everything. The divergence is intentional:
the declaration is the exact-total contract that byte and native
sources already enforce.

typescript_implemented_streams is still experimental, with no enable
date, so the change needs no compatibility flag.

Fixes: #8040

[clanky-the-clanker]

💬 Approved with comments — The approver's follow-ups (underflow enforcement and the draining reader's length after a read) are fixed. The only remaining finding is an INFO about a comment that overstates how closely the C++ implementation matches on underflow.

Findings: 1 info

Not opened by the correctness review: 1 changed file it was meant to read

• src/per_isolate/webstreams/types.d.ts

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

📝 Documentation: 💬 1 info

One comment overstates how closely the C++ implementation matches on underflow.

Recommendation: 💬 Optional Nits

• [INFO] The comment says a declared-length breach cancels the stream "as the C++ AllReader does", but for underflow the C++ implementation returns the short body (see the expectedLengthUnderflow test). Limit the comparison to overflow. (src/per_isolate/webstreams/readable.ts:4584)

View full review

The comment at src/per_isolate/webstreams/readable.ts:4581-4585 says a declared-length breach names its cause and cancels the stream "as the C++ AllReader does". That holds for overflow but not for underflow: the C++ implementation returns the short body, as the new expectedLengthUnderflow test records. Limit the comparison to overflow, or remove it.

The earlier INFO about the #expectedLength comment is resolved, now that consumption enforces both overflow and underflow.

---

✅ All other checks passed

🔒 Security: ✅ LGTM

Body consumption now rejects a body that delivers more or fewer bytes than it declared, and cancels the stream. A partly read stream, or a fork made after a read, reports no length, so a body cannot advertise a Content-Length larger than what is left to send. The internal setControllerExpectedLength export is removed.

---

📖 AGENTS.md: ✅ LGTM

The AGENTS.md ledger updates match the tests and configuration changes.

---

📋 Code Quality: ✅ LGTM

• Underflow: collectChunks now rejects a stream that closes short of its declared expectedLength and cancels it, matching the overflow check.
• Draining reader: its expectedLength getter uses getReadableStreamExpectedLength, so it agrees with the C++ bridge after a read or a fork.
• Native streams: they remain exempt from the read/fork guard.
• Writable sink and TransformStream: both changes behave as before.

---

⚡ Performance: ✅ LGTM

The default controller reads expectedLength once and caches it. The underflow check runs once, at end of stream. The writable controller no longer allocates three closures per instance.

---

_{Reviewed commit: 30509c11 — same changes as 57dd4310, so this is that commit's review (no new review was run; line numbers are as of 57dd4310)}

[ask-bonk]

Since last review: 0 resolved, 0 still open, 0 new.
LGTM!

Not re-run: api-compat, tests, docs, compat-flags, design-simplicity, jsg-gc, kj-style, memory-safety (no author changes in their files since the last review)

Specialist findings not posted (1)

• correctness#1 [WARNING] src/per_isolate/webstreams/readable.ts:1781: A default source's declared total is never enforced while it is streamed as a Request/Response body. For example, a source with expectedLength: 10 that enqueues a five-byte Uint8Array then closes … — The current diff rejects a declared-length underflow at EOF in collectChunks(), and the added integration regression covers both default and TransformStream bodies.

---

_{Reviewed commit: 30509c11 · github run}

[ry]

LGTM. A few follow-ups inline. Ledgers #36 and #37 are C++ bugs, both from ReadableStreamJsController::tryGetLength returning expectedLength regardless of encoding or reads; worth tracking issues.