test(ppr): pin the outlined-bake guarantee — ready Suspense content bakes; masked holes postpone (#702) - #703

Problem statement

Issue #702 suspected that the PPR capture abort could land before fizz flushed outlined-but-ready Suspense content (any boundary >500 bytes gets fallback-first + outlined treatment in a tracked-postpones prerender), silently postponing content that had zero pending data — suspected as the router-level cause of a measured storefront pathology (~100 postponed boundaries, ~2.7MB re-rendered per HIT).

Finding: the defect does not exist — and the guarantee was unpinned

Control experiments (taps since removed) proved:

• The capture already bakes outlined-ready content through the real abort path: a 30k-row synchronous section produced a 6.2MB prelude with postponed=null on a bare ppr route, and 6.2MB + 1.5KB postponed state beside a masked slot hole.
• Ready fizz work cannot lose the abort race structurally: React's tracked-postpones pings run on scheduleMicrotask; the post-quiesce hops and abort ride setTimeout — every runnable task drains before the first hop fires.
• The original red reproducer was doctrine-inconsistent: under route-level loading(), LoaderBoundary use()es the masked loader above the whole route subtree, so the entire body IS the hole — its rows were unreachable at capture (4.5KB prelude), not ready-but-unflushed.
• A counted-abort gate (the issue's proposed direction) would be a no-op for ready work and would break the physics-hole doctrine (parked unmasked I/O must postpone).

The storefront pathology is the app-level shape (content under Suspense wrappers whose data situation makes them holes), cured by page structure — not by abort policy.

What a consumer sees

No behavior change (the one src edit is a comment documenting the microtask-atomicity invariant so a work-quiet/counted gate is not re-attempted). The consumer-visible contract this PR pins with tests, previously unpinned:

path("/page", Page, { ppr: true }, () => [ /* slot with loader+loading = the hole */ ])
// Page renders: <Suspense fallback={...}><BigSyncSection/></Suspense>  + <ParallelOutlet name="@hole"/>

• <BigSyncSection/> (any size) bakes into the stored shell — served from the prelude on every HIT, zero per-request render;
• the masked slot hole still postpones — fallback frozen in the prelude, fresh value streams per request;
• and the doctrine clarification now lives in the fixture: content that must bake belongs beside the hole (slot/layout chrome), never under route-level loading() — under loading(), the whole route body is the hole by design.

Semantics table

Code-change summary

• e2e/test-app/src/urls/shell-cache.tsx — /shell-cache/outlined fixture: 10k-row outlined section + @outlinedBadge masked slot hole (own loader + loading()), ShellOutlinedChromeLayout; scar-tissue comments on the loading() shape.
• e2e/test-app/src/urls/shell-cache.defs.ts — ShellOutlinedBadgeLoader (isolated seq counter).
• e2e/shell-cache.test.ts — the guarantee test (byte-provenance via splitPrelude; runs in both dev and (production) describes via runShellCacheSpec).
• src/ssr/index.tsx — comment-only: the microtask-atomicity invariant on the abort hop loop.
• router.named-routes.gen.ts — regenerated (shellCacheOutlined).

Test plan

• New guarantee test green in dev (2.6s) and production (859ms); red form reconfirmed across 6 tap runs including 3000-hop / 1.9s-quiet variants (4.5KB prelude).
• Router unit: 326 files / 5052 passed; test:unit:all green across all packages.
• shell-cache + shell-secure + shell-cache-action: 33 dev / 34 production.
• prerender-ppr (producer B composition): 4 dev + 4 production.
• cloudflare ppr battery: 27 passed (3 pre-existing producer-B dev-boot MISS-retry flakes on local; files untouched by this PR — flagged below).
• typecheck 16/16, lint 0 warnings, format clean.

Notes

• Closes PPR capture: outlined-but-ready Suspense content postpones — counted-abort gate needed (large sync sections re-render per HIT) #702 as investigated-and-refuted; the issue's real-world motivation was resolved at the app level (Suspense-wrapper removal) and by this doctrine documentation.
• Observed locally (not from this PR): producer B's "build-time shell HIT on first request" dev tests MISS-then-retry-HIT consistently on a warm machine — possibly a dev-boot prerender-phase race worth a look in the feat(ppr): producer B — emit the shell entry at build time for prerendered routes (#699) #701 lineage.