@rangojs/router 0.0.0-experimental.debug-cache-2383ca26 → 0.0.0-experimental.dfa55db4

package/skills/loader/SKILL.md

@@ -65,24 +65,10 @@ export const urlpatterns = urls(({ path, loader }) => [
 
 ## Consuming Loader Data
 
-Loaders are the **live data layer** — they resolve fresh on every request.
-The way you consume them depends on whether you're in a server component
-(route handler) or a client component.
-
-> **IMPORTANT: Prefer consuming loaders in client components.** Keeping data
-> fetching in loaders and consumption in client components creates a clean
-> separation: the server-side handler renders static markup that can be
-> freely cached with `cache()`, while loader data stays fresh on every
-> request. When you consume loaders in server handlers via `ctx.use()`, the
-> handler output depends on the loader data, which means caching the handler
-> also caches the data — defeating the purpose of the live data layer.
-
-### In Client Components (Preferred)
-
-Client components use `useLoader()` from `@rangojs/router/client`.
-The loader **must** be registered with `loader()` in the route's DSL
-segments so the framework knows to resolve it during SSR and stream
-the data to the client:
+Register loaders with `loader()` in the DSL and consume them in client
+components with `useLoader()`. This is the recommended pattern — it keeps
+data fetching on the server and consumption on the client, with a clean
+separation that works correctly with `cache()`.
 
 ```typescript
 "use client";
@@ -96,40 +82,60 @@ function ProductDetails() {
 ```
 
 ```typescript
-// Route definition — loader() registration required for client consumption
+// Route definition — loader() registration required
 path("/product/:slug", ProductPage, { name: "product" }, () => [
-  loader(ProductLoader), // Required for useLoader() in client components
+  loader(ProductLoader),
 ]);
 ```
 
-### In Route Handlers (Server Components)
+DSL loaders are the **live data layer** — they resolve fresh on every
+request, even when the route is inside a `cache()` boundary. The router
+excludes them from the segment cache at storage time and re-resolves them
+on retrieval. This means `cache()` gives you cached UI + fresh data by
+default.
 
-In server components, use `ctx.use(Loader)` directly in the route handler.
-This doesn't require `loader()` registration in the DSL — it works
-standalone. **However**, prefer client-side consumption when possible (see
-note above).
+### Cache safety
 
-```typescript
-import { ProductLoader } from "./loaders/product";
+DSL loaders can safely read `createVar({ cache: false })` variables
+because they are always resolved fresh. The read guard is bypassed for
+loader functions — they never produce stale data.
+
+### ctx.use(Loader) — escape hatch
+
+For cases where you need loader data in the server handler itself (e.g.,
+to set ctx variables or make routing decisions), use `ctx.use(Loader)`:
 
-// Route handler — server component
+```typescript
 path("/product/:slug", async (ctx) => {
   const { product } = await ctx.use(ProductLoader);
-  return <h1>{product.name}</h1>;
-}, { name: "product" })
+  ctx.set(Product, product); // make available to children
+  return <ProductPage />;
+}, { name: "product" }, () => [
+  loader(ProductLoader), // still register for client consumption
+])
 ```
 
-When you do register with `loader()` in the DSL, `ctx.use()` returns the
+When you register with `loader()` in the DSL, `ctx.use()` returns the
 same memoized result — loaders never run twice per request.
 
+**Limitations of ctx.use(Loader):**
+
+- The handler output depends on the loader data. If the route is inside
+  `cache()`, the handler is cached with the loader result baked in —
+  defeating the live data guarantee.
+- Non-cacheable variable reads (`createVar({ cache: false })`) inside the
+  handler still throw, even if the data came from a loader.
+- Prefer DSL `loader()` + client `useLoader()` for data that depends on
+  non-cacheable context variables.
+
 **Never use `useLoader()` in server components** — it is a client-only API.
 
 ### Summary
 
-| Context                      | API                 | `loader()` DSL required? |
-| ---------------------------- | ------------------- | ------------------------ |
-| Client component (preferred) | `useLoader(Loader)` | **Yes**                  |
-| Route handler (server)       | `ctx.use(Loader)`   | No                       |
+| Pattern                | API                 | Cache-safe | Recommended |
+| ---------------------- | ------------------- | ---------- | ----------- |
+| DSL + client component | `useLoader(Loader)` | Yes        | Yes         |
+| Handler escape hatch   | `ctx.use(Loader)`   | No         | When needed |
 
 ## Loader Context
 
@@ -548,7 +554,7 @@ export const ProductLoader = createLoader(async (ctx) => {
     .first();
 
   if (!product) {
-    throw new Response("Product not found", { status: 404 });
+    notFound("Product not found");
   }
 
   return { product };
@@ -564,10 +570,9 @@ export const CartLoader = createLoader(async (ctx) => {
   return { cart };
 });
 
-// urls.tsx
+// urls.tsx — register loaders in the DSL
 export const urlpatterns = urls(({ path, layout, loader, loading, cache, revalidate }) => [
   layout(<ShopLayout />, () => [
-    // Shared cart loader for all shop routes
     loader(CartLoader, () => [
       revalidate(({ actionId }) => actionId?.includes("Cart") ?? false),
     ]),
@@ -579,17 +584,22 @@ export const urlpatterns = urls(({ path, layout, loader, loading, cache, revalid
   ]),
 ]);
 
-// pages/product.tsx — server component (route handler)
+// components/ProductDetails.tsx — consume in client component
+"use client";
+import { useLoader } from "@rangojs/router/client";
 import { ProductLoader, CartLoader } from "./loaders/shop";
 
-async function ProductPage(ctx) {
-  const { product } = await ctx.use(ProductLoader);
-  const { cart } = await ctx.use(CartLoader);
+function ProductDetails() {
+  const { data: { product } } = useLoader(ProductLoader);
+  const { data: { cart } } = useLoader(CartLoader);
 
   return (
     <div>
       <h1>{product.name}</h1>
-      <AddToCartButton productId={product.id} inCart={cart?.items.includes(product.id)} />
+      <AddToCartButton
+        productId={product.id}
+        inCart={cart?.items.includes(product.id)}
+      />
     </div>
   );
 }

package/skills/middleware/SKILL.md

@@ -26,6 +26,8 @@ const router = createRouter<AppEnv>({})
   .routes(urlpatterns);
 ```
 
+When the router has a `basename`, pattern-scoped `.use()` patterns are automatically prefixed. For example, with `basename: "/app"`, `.use("/admin/*", mw)` matches `/app/admin/*`.
+
 ### Route middleware (`middleware()` in `urls()`)
 
 Registered inside `urls()` callback. Wraps **rendering only** -- it does NOT wrap server action execution. Actions run before route middleware, so when route middleware executes during post-action revalidation, it can observe state that the action set (cookies, context variables, headers).

package/skills/prerender/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: prerender
-description: Pre-render route segments at build time with Prerender and passthrough fallback
+description: Pre-render route segments at build time with Prerender and Passthrough live fallback
 argument-hint: [passthrough]
 ---
 
@@ -54,8 +54,14 @@ path("/blog/:slug", BlogPost, { name: "blog.post" })
 
 ### With Passthrough (live fallback for unknown params)
 
+Wrap a `Prerender` definition with `Passthrough()` to add a separate live handler
+for unknown params at runtime. The build handler runs at build time, the live
+handler runs at request time.
+
 ```typescript
-export const ProductPage = Prerender(
+import { Prerender, Passthrough } from "@rangojs/router";
+
+export const ProductPageDef = Prerender(
   async () => {
     const top = await db.query("SELECT id FROM products WHERE featured");
     return top.map(p => ({ id: p.id }));
@@ -64,32 +70,41 @@ export const ProductPage = Prerender(
     const product = await db.query("SELECT * FROM products WHERE id = ?", ctx.params.id);
     return <Product data={product} />;
   },
-  { passthrough: true, concurrency: 4 }
+  { concurrency: 4 }
 );
+
+// In route definition:
+path("/products/:id", Passthrough(ProductPageDef, async (ctx) => {
+  const product = await ctx.env.DB.query("SELECT * FROM products WHERE id = ?", ctx.params.id);
+  return <Product data={product} />;
+}), { name: "product" })
 ```
 
-## Passthrough Mode
+## Passthrough Wrapper
 
-Controls whether the handler stays in the RSC server bundle after build:
+`Passthrough(prerenderDef, liveHandler)` wraps a `Prerender` definition with a
+separate handler for runtime fallback. The build and live handlers are separate
+functions — no `ctx.build` branching needed.
 
-|                     | `passthrough: false` (default)          | `passthrough: true`                     |
-| ------------------- | --------------------------------------- | --------------------------------------- |
-| Known params        | Served from pre-rendered Flight payload | Served from pre-rendered Flight payload |
-| Unknown params      | Handler evicted, no live fallback       | Handler runs live at request time       |
-| `ctx.passthrough()` | Throws (not allowed)                    | Skips artifact, defers to live fallback |
-| Bundle size         | Handler code + imports removed          | Handler code kept in RSC bundle         |
-| `revalidate()`      | Not allowed (handler gone)              | Allowed (handler can re-render)         |
-| `loading()`         | Ignored (segments fully resolved)       | Works for live fallback renders         |
+|                     | Plain `Prerender` (no wrapper)          | `Passthrough(def, liveHandler)`          |
+| ------------------- | --------------------------------------- | ---------------------------------------- |
+| Known params        | Served from pre-rendered Flight payload | Served from pre-rendered Flight payload  |
+| Unknown params      | Handler evicted, no live fallback       | Live handler runs at request time        |
+| `ctx.passthrough()` | Throws (not on Passthrough route)       | Skips artifact, defers to live handler   |
+| Bundle size         | Build handler code + imports removed    | Build handler evicted, live handler kept |
+| `revalidate()`      | Not allowed (handler gone)              | Allowed (live handler can re-render)     |
+| `loading()`         | Ignored (segments fully resolved)       | Works for live fallback renders          |
 
-### When to use passthrough
+### When to use Passthrough
 
-Use `passthrough: true` when:
+Use `Passthrough()` when:
 
 - The route has a large or open-ended param space (e.g., user profiles, product pages)
 - You want to pre-render popular/known params for speed but still serve unknown params live
 - You need `revalidate()` on the route
+- The live handler needs runtime bindings (e.g., `ctx.env.DB`)
 
-Use `passthrough: false` (default) when:
+Use plain `Prerender` (no wrapper) when:
 
 - All possible params are known at build time (e.g., markdown files, config-driven pages)
 - You want maximum bundle size reduction (handler code + node:fs imports removed)
@@ -103,6 +118,7 @@ Handlers receive `BuildContext` at build time, a subset of the runtime `HandlerC
 interface BuildContext<TParams> {
   params: TParams; // From getParams
   build: true; // Always true at build time
+  dev: boolean; // true in Vite dev mode, false during production build
   use: <T>(handle: Handle<T>) => (data: T) => void; // Push handle data
   url: URL; // Synthetic URL from pattern + params
   pathname: string; // Pathname from synthetic URL
@@ -115,8 +131,9 @@ interface BuildContext<TParams> {
     params?: Record<string, string>,
     search?: Record<string, unknown>,
   ): string; // URL generation
-  passthrough(): PrerenderPassthroughResult; // Skip local artifact (passthrough routes only)
-  // NOT available: req, headers, cookies, env (throws descriptive errors)
+  passthrough(): PrerenderPassthroughResult; // Skip local artifact (Passthrough routes only)
+  env: DefaultEnv; // Available when buildEnv is configured in rango() (throws otherwise)
+  // NOT available: request, headers, cookies (always throw)
 }
 ```
 
@@ -183,18 +200,17 @@ In production builds, `Prerender` exports are replaced with stubs:
 // Original
 export const BlogPost = Prerender(getParams, handler);
 
-// Stubbed (ships to server bundle when passthrough: false)
+// Stubbed (all Prerender handlers are evicted)
 export const BlogPost = {
   __brand: "prerenderHandler",
   $$id: "abc123#BlogPost",
 };
 ```
 
-The original module and its imports (node:fs, markdown libs) are excluded from
-the bundle. With `passthrough: true`, the handler code stays in the RSC bundle.
+All Prerender handlers are evicted in production. The live handler for
+`Passthrough()` routes lives in the urls module and is not evicted.
 
-In client and SSR environments, ALL prerender handlers are always stubbed
-(passthrough only affects the RSC server bundle).
+In client and SSR environments, ALL prerender handlers are always stubbed.
 
 ## Sub-use Semantics
 
@@ -231,15 +247,15 @@ path("/blog/:slug", BlogPost, { name: "blog.post" }, () => [
 | DSL item       | Behavior with Prerender                                                                                                                                                                                                                                             |
 | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `loader()`     | Live at runtime, bundled normally. Use `cache()` for caching.                                                                                                                                                                                                       |
-| `revalidate()` | Not allowed without passthrough. Allowed with passthrough.                                                                                                                                                                                                          |
+| `revalidate()` | Not allowed without Passthrough. Allowed with Passthrough.                                                                                                                                                                                                          |
 | `cache()`      | Orthogonal -- use on parent layouts and loaders.                                                                                                                                                                                                                    |
 | `layout()`     | Child layouts inside path are pre-rendered. Parent layouts are live.                                                                                                                                                                                                |
 | `parallel()`   | Parallel slots inside path are pre-rendered.                                                                                                                                                                                                                        |
 | `middleware()` | Skipped during pre-render (no request). Runs at request time for loaders.                                                                                                                                                                                           |
-| `loading()`    | Ignored without passthrough. Works for live fallback with passthrough.                                                                                                                                                                                              |
+| `loading()`    | Ignored without Passthrough. Works for live fallback with Passthrough.                                                                                                                                                                                              |
 | `intercept()`  | Pre-rendered at build time. Intercept variant stored under `/i` key alongside main segments. At runtime, the correct variant is served based on `ctx.isIntercept`. `when()` conditions are skipped at build time (all intercepts are pre-rendered unconditionally). |
 
-When passthrough revalidation is enabled, remember that revalidation is
+When Passthrough revalidation is enabled, remember that revalidation is
 still partial: opting a child segment into revalidation does not
 implicitly re-run outer prerender-derived handlers/layouts.
 
@@ -304,12 +320,19 @@ export const BlogPost = Prerender(
     }
     return <PostPage slug={ctx.params.slug} />;
   },
-  { passthrough: true },
 );
+
+// Wrap with Passthrough to serve skipped params live at runtime
+export const BlogPost = Passthrough(BlogPostDef, async (ctx) => {
+  if (ctx.params.slug === "draft") {
+    throw new Skip("Draft articles are not pre-rendered");
+  }
+  return <PostPage slug={ctx.params.slug} />;
+});
 ```
 
-Skipped entries are excluded from the build output. With `passthrough: true`,
-the handler stays in the bundle and serves skipped params live at request time.
+Skipped entries are excluded from the build output. With `Passthrough()`,
+the live handler serves skipped params at request time.
 
 `Skip` also works in `Static` handlers:
 
@@ -326,7 +349,7 @@ export const TocSidebar = Static(() => {
 | Handler outcome             | Effect                                                |
 | --------------------------- | ----------------------------------------------------- |
 | JSX / `null`                | Normal prerender entry, log OK                        |
-| `return ctx.passthrough()`  | Skip entry, log PASS, continue (passthrough routes)   |
+| `return ctx.passthrough()`  | Skip entry, log PASS, continue (Passthrough routes)   |
 | `throw new Skip("reason")`  | Skip entry, log SKIP, continue with remaining entries |
 | `throw new Error("reason")` | Log FAIL, stop ALL pre-rendering, fail the build      |
 
@@ -366,56 +389,59 @@ falls back according to normal dev/runtime behavior.
 
 ## Per-Param Passthrough with ctx.passthrough()
 
-On `{ passthrough: true }` routes, a handler can return `ctx.passthrough()`
-to skip writing a local prerender artifact for a specific param set. At
-runtime, the missing entry falls through to the live handler.
+On routes wrapped with `Passthrough()`, the build handler can return
+`ctx.passthrough()` to skip writing a local prerender artifact for a specific
+param set. At runtime, the missing entry falls through to the live handler.
 
 ```typescript
-export const BlogPost = Prerender(
+export const BlogPostDef = Prerender(
   async () => [{ slug: "a" }, { slug: "b" }, { slug: "c" }],
   async (ctx) => {
     const post = await getPost(ctx.params.slug);
     if (!post) return ctx.passthrough();
     return <article>{post.content}</article>;
   },
-  { passthrough: true },
 );
+
+export const BlogPost = Passthrough(BlogPostDef, async (ctx) => {
+  const post = await getPost(ctx.params.slug);
+  return <article>{post.content}</article>;
+});
 ```
 
 ### Semantics
 
-- JSX or `null` from the handler produces a normal prerender entry.
+- JSX or `null` from the build handler produces a normal prerender entry.
 - `ctx.passthrough()` returns a sentinel that signals "no local artifact".
   The build skips the manifest entry for that param set.
-- `ctx.passthrough()` on a non-passthrough route throws an invariant error.
+- `ctx.passthrough()` on a route not wrapped with `Passthrough()` throws.
 - `ctx.passthrough()` at runtime (`ctx.build === false`) also throws.
   It is a build-time-only control flow.
-- `getParams()` still enumerates the param set; the handler decides per-param
-  whether to produce an artifact or defer to runtime.
+- `getParams()` still enumerates the param set; the build handler decides
+  per-param whether to produce an artifact or defer to the live handler.
 
 ### Difference from Skip
 
-| Mechanism           | Effect on build        | Runtime behavior                                     |
-| ------------------- | ---------------------- | ---------------------------------------------------- |
-| `throw new Skip()`  | Skips entry, logs SKIP | No artifact, no live fallback unless passthrough     |
-| `ctx.passthrough()` | Skips entry, logs PASS | Always defers to live handler (requires passthrough) |
+| Mechanism           | Effect on build        | Runtime behavior                                       |
+| ------------------- | ---------------------- | ------------------------------------------------------ |
+| `throw new Skip()`  | Skips entry, logs SKIP | No artifact, no live fallback unless Passthrough route |
+| `ctx.passthrough()` | Skips entry, logs PASS | Always defers to live handler (requires Passthrough)   |
 
-Use `ctx.passthrough()` when you want the handler to run live at request time
+Use `ctx.passthrough()` when you want the live handler to run at request time
 for specific params. Use `Skip` when you want to exclude params entirely.
 
 ### Use case: Remote storage
 
 `ctx.passthrough()` enables a pattern where build-time data is stored in a
-remote KV store instead of the local prerender manifest. The handler
+remote KV store instead of the local prerender manifest. The build handler
 pre-computes data during `getParams`, pushes it to KV, then calls
 `ctx.passthrough()` so the local build skips the artifact. At runtime,
-the live handler reads from KV:
+the Passthrough live handler reads from KV:
 
 ```typescript
-export const Product = Prerender(
+export const ProductDef = Prerender(
   async () => {
     const products = await db.getFeaturedProducts();
-    // Pre-compute and store in remote KV during build
     for (const p of products) {
       await kv.put(`product:${p.id}`, await renderProduct(p));
     }
@@ -423,14 +449,16 @@ export const Product = Prerender(
   },
   async (ctx) => {
     // At build time: skip local artifact, data is in KV
-    if (ctx.build) return ctx.passthrough();
-    // At runtime: read from KV
-    const cached = await kv.get(`product:${ctx.params.id}`);
-    if (cached) return cached;
-    return <Product data={await db.getProduct(ctx.params.id)} />;
+    return ctx.passthrough();
   },
-  { passthrough: true },
 );
+
+export const Product = Passthrough(ProductDef, async (ctx) => {
+  // At runtime: read from KV, fall back to DB
+  const cached = await kv.get(`product:${ctx.params.id}`);
+  if (cached) return cached;
+  return <Product data={await ctx.env.DB.getProduct(ctx.params.id)} />;
+});
 ```
 
 ### Build logs
@@ -458,8 +486,8 @@ Flight payload. They do not update at request time.
 ### Server actions work normally
 
 Actions do not re-render the B segment. The pre-rendered handler output stays
-frozen. Loaders are live and can be revalidated by actions. With `passthrough: true`
-and `revalidate()`, the handler itself can re-render live.
+frozen. Loaders are live and can be revalidated by actions. With `Passthrough()`
+and `revalidate()`, the live handler can re-render.
 
 ### Empty getParams
 
@@ -470,21 +498,21 @@ If `getParams` returns an empty array, no Flight payloads are written. No error.
 Routes using `Prerender` must have a `name` in path options.
 The name is used as the storage key for Flight payloads.
 
-### No revalidate without passthrough
+### No revalidate without Passthrough
 
-Using `revalidate()` with `passthrough: false` produces a build-time warning.
+Using `revalidate()` without `Passthrough()` produces a build-time warning.
 The handler is evicted -- there is nothing to re-render.
 
-### loading() is ignored without passthrough
+### loading() is ignored without Passthrough
 
 Pre-rendered segments are fully resolved at build time and never suspend.
-With `passthrough: true`, `loading()` works for live fallback renders.
+With `Passthrough()`, `loading()` works for live fallback renders.
 
 ## Complete Example
 
 ```typescript
 // pages/guides-handler.tsx
-import { Prerender } from "@rangojs/router";
+import { Prerender, Passthrough } from "@rangojs/router";
 import { Link } from "@rangojs/router/client";
 import { href } from "../router.js";
 
@@ -493,7 +521,7 @@ const knownGuides: Record<string, string> = {
   caching: "Caching Guide",
 };
 
-export const GuidesDetail = Prerender<{ slug: string }>(
+export const GuidesDetailDef = Prerender<{ slug: string }>(
   async () => Object.keys(knownGuides).map((slug) => ({ slug })),
   async (ctx) => {
     const title = knownGuides[ctx.params.slug] ?? `Guide: ${ctx.params.slug}`;
@@ -509,9 +537,23 @@ export const GuidesDetail = Prerender<{ slug: string }>(
       </div>
     );
   },
-  { passthrough: true },
 );
 
+export const GuidesDetail = Passthrough(GuidesDetailDef, async (ctx) => {
+  const title = knownGuides[ctx.params.slug] ?? `Guide: ${ctx.params.slug}`;
+  return (
+    <div>
+      <h1>{title}</h1>
+      <p>Slug: {ctx.params.slug}</p>
+      <nav>
+        <Link to={href("guides.detail", { slug: "routing" })}>Routing</Link>
+        {" | "}
+        <Link to={href("guides.detail", { slug: "dynamic-test" })}>Dynamic</Link>
+      </nav>
+    </div>
+  );
+});
+
 // pages/guides.tsx
 import { urls } from "@rangojs/router";
 import { GuidesDetail } from "./guides-handler.js";
@@ -588,12 +630,12 @@ Loaders run fresh at request time for both variants.
 Pre-rendered routes set flags on the route trie leaf at build time:
 
 - `pr: true` -- route has pre-rendered B segment data
-- `pt: true` -- passthrough mode (handler available for live fallback)
+- `pt: true` -- route wrapped with `Passthrough()` (live handler available)
 
 At runtime, the cache-lookup middleware uses these flags:
 
 - `pr + hit` -- serve pre-rendered Flight payload
-- `pr + pt + miss` -- fall through to live handler (handler kept in bundle)
+- `pr + pt + miss` -- fall through to Passthrough live handler
 - `pr + miss` (no pt) -- fall through (handler stubbed, no live render)
 
 ## Contributor Checklist
@@ -603,7 +645,7 @@ Before changing prerender behavior, read these docs and run these tests.
 ### Docs to re-read
 
 - [Prerender API design](../../docs/prerender-api-design.md) -- canonical
-  architecture: build-time flow, runtime flow, storage, passthrough, intercept
+  architecture: build-time flow, runtime flow, storage, Passthrough, intercept
 - [Execution model](../../docs/internal/execution-model.md) -- handler-first
   ordering, middleware scope, context visibility rules
 - [Semantic change checklist](../../docs/internal/semantic-change-checklist.md)
@@ -612,7 +654,7 @@ Before changing prerender behavior, read these docs and run these tests.
 ### Tests to run
 
 ```bash
-# Core prerender e2e (passthrough, eviction, loaders, sub-use, intercept)
+# Core prerender e2e (Passthrough, eviction, loaders, sub-use, intercept)
 pnpm --filter @rangojs/router exec playwright test prerender
 
 # Prerender-specific unit test
@@ -632,7 +674,7 @@ pnpm --filter @rangojs/router exec playwright test handler-first
   `/__rsc_prerender` endpoint tests and node.js dev-server fallback.
 - Log-based assertions (build output lines, debug cache logs) are inherently
   dev/build-only and do not need a production counterpart.
-- Behavioral assertions (rendered content, loader freshness, passthrough
+- Behavioral assertions (rendered content, loader freshness, Passthrough
   fallback, intercept variant selection) must work in the production build.
 
 ## Maintenance References

package/skills/route/SKILL.md

@@ -181,6 +181,37 @@ String keys still work (`ctx.set("key", value)` / `ctx.get("key")`), but
 Only route handlers and middleware can call `ctx.set()`. Layouts, parallels,
 and intercepts can only read via `ctx.get()`.
 
+#### Non-cacheable context variables
+
+Mark a var as non-cacheable when it holds inherently request-specific data
+(sessions, auth tokens, per-request IDs). There are two ways:
+
+```typescript
+// Var-level: every value written to this var is non-cacheable
+const Session = createVar<SessionData>({ cache: false });
+
+// Write-level: escalate a normally-cacheable var for this specific write
+const Theme = createVar<string>();
+ctx.set(Theme, userTheme, { cache: false });
+```
+
+"Least cacheable wins" — if either the var definition or the write site says
+`cache: false`, the value is non-cacheable.
+
+Reading a non-cacheable var inside `cache()` or `"use cache"` throws at
+runtime. This prevents request-specific data from leaking into cached output:
+
+```typescript
+// This throws — Session is non-cacheable
+async function CachedWidget(ctx) {
+  "use cache";
+  const session = ctx.get(Session); // Error: non-cacheable var read inside cache scope
+  return <Widget />;
+}
+```
+
+Cacheable vars (the default) can be read freely inside cache scopes.
+
 ### Revalidation Contracts for Handler Data
 
 Handler-first guarantees apply within a single full render pass. For partial