fix(cache): classify explicit io probes

[james-elicx]

Follow-up stack 2/2. Exact head: 4311d92858fb18d6356fbd16b6de8bde0a14ab98. Base: #3099 at 7ab2b603d.

Chain: #3099 → #3097.

This layer closes the explicit io() ownership and post-certification admission gap for Cache Components:

• during a staged Cache Components prerender, io() notifies the outer render owner before returning its hanging promise, so a surrounding Suspense fallback cannot complete and be certified as static
• io() remains a no-op inside "use cache" and unstable_cache() scopes, matching Next.js even though vinext models those owners in separate async-local state
• legacy prerendering without Cache Components remains eligible; io() does not demote those routes
• hybrid Pages Router fallbacks run with legacy prerender ownership and clear the App Cache Components marker, matching Next.js where io() is a no-op in Pages GSSP, GSP, and component rendering
• the request records whether Cache Components are enabled, allowing a manifest-certified route that later takes an io() branch after an edge purge to fail closed before public CDN policy is restored

The built-workerd regression covers both sides of the lifecycle: authenticated probing classifies direct App io() as dynamic while proving a hybrid Pages React.use(io()) render completes, and a route certified through its static branch remains private when later application state selects io() after the warmed edge object is purged. A second request proves the private refill did not re-warm the edge.

This PR deliberately does not instrument Date, Math, Web Crypto, or Node crypto. Platform-I/O parity is separate from the request-derived cache disclosure fix and requires a design that does not rewrite node:crypto imports.

Next.js references:

• https://github.com/vercel/next.js/blob/canary/packages/next/src/server/request/io.ts
• https://github.com/vercel/next.js/blob/canary/test/e2e/app-dir/io/io.test.ts

Review size

Layer-only diff against #3099: 20 files, +425/-23.

Validation

• focused cache/admission/runtime tests — 1,551/1,551
• Cache Components built-workerd E2E — 2/2
• vp check
• git diff --check

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@vinext/cloudflare@3097

npm i https://pkg.pr.new/create-vinext-app@3097

npm i https://pkg.pr.new/@vinext/types@3097

npm i https://pkg.pr.new/vinext@3097

commit: 4311d92

[github-actions]

Example	Preview	Production	Original
app-router-cloudflare	preview	production
pages-router-cloudflare	preview	production
app-router-playground	preview	production	original
realworld-api-rest	preview	production
nextra-docs-template	preview	production
benchmarks	preview	production
hackernews	preview	production	original
workers-cache	preview	production
static-export	preview	production
web	preview	production

[github-actions]

Performance benchmarks

Compared 4311d92 against base 7ab2b60 using alternating same-runner rounds. Next.js was unchanged and skipped.

0 improved · 0 regressed · 6 within ±1.5%

Scenario	Framework	Baseline	Current	Change
Client bundle size (gzip)	vinext	142.3 KB	142.3 KB	⚫ +0.0%
Client entry size (gzip)	vinext	129.5 KB	129.5 KB	⚫ +0.0%
Dev server cold start	vinext	3.04 s	3.03 s	⚫ -0.3%
Production build time	vinext	3.27 s	3.28 s	⚫ +0.2%
RSC entry closure size (gzip)	vinext	119.0 KB	119.1 KB	⚫ +0.1%
Server bundle size (gzip)	vinext	202.4 KB	202.4 KB	⚫ +0.0%

View detailed results and traces

_{🟢 improvement · 🔴 regression · ⚫ change below 1.5% · paired base/head}

[james-elicx]

/bigbonk review for issues

[ask-bonk]

@james-elicx Bonk workflow was cancelled.

View workflow run · To retry, trigger Bonk again.