Something for consideration:

middleware.Timeout() and middleware.CloseNotify don't need to cancel() the context when the underlying handlers return. We might want to use explicit middleware.Cancel instead.

This way, all handlers would have context.Background() as a base context and it'd be up to developers to specify when the "context flow" ends. Timeout should only cancel underlying contexts on timeout. CloseNotify should only cancel underlying contexts on <-w.CloseNotify(). Explicit over magic.

If we wanted to have strict boundaries for context lifetime in the handler chain, we'd need to use context.WithCancel() instead of context.Background() in mux.ServeHTTPC().