perf(platform): optimize Cloudflare critical paths

[iamjr15]

Summary

• Measures Cloudflare request, database, service-binding, Durable Object, Workflow, and user-visible streaming milestones.
• Removes duplicate Gateway authentication and sidebar query fan-out while retaining existing auth, RLS, billing, and rate-limit behavior.
• Streams provider text through AgentRun with retry-safe provisional identities and moves generated-output delivery to a lightweight private Artifact Worker.
• Adds Worker performance budgets, dashboard queries, and explicit Cloudflare zone/cache IaC without moving the Vercel frontend.

Plan

docs/plans/cloudflare-critical-path-performance.md

What's included

Measurement foundation

• Request-scoped performance recorder and safe Server-Timing exposure.
• Analytics Engine dimensions for release, colo, placement, reconnect, provider/model, and cold/warm paths.
• Browser milestones for response headers, first status, first model text, and stream completion.

Gateway critical path

• Memoized authenticated principal with one JWT verification and internal-user lookup per request.
• Native Workers Rate Limiting bindings for cheap/public reads; strict write and run limits remain on Durable Objects.
• One bounded navigation bootstrap query and browser preconnect to the Gateway.

Durable streaming

• Provider streaming via Mastra with deterministic provisional batches.
• Final canonical checkpoint supersedes provisional text so Workflow retries and reconnects do not duplicate visible output.
• Existing tool policy, model fallback, cancellation, and managed-preview semantics are retained.

Artifact delivery and placement

• New cheatcode-artifacts Worker deployed before Gateway binding activation.
• Private R2 delivery supports Range/206, ETag/304, invalid Range/416, stored metadata, and streaming without buffering.
• Smart Placement is limited to the database-heavy artifact surface; Gateway remains user-near.

Operations

• Bundle/startup budgets in CI.
• Terraform definitions for DNS-only Vercel apex, TLS 1.3, HTTP/3, compression, and deny-by-default cache rules.
• Analytics Engine percentile query templates and updated deployment documentation.

Architecture decisions

Decision	Choice	Reasoning
Frontend hosting	Keep Vercel and DNS-only apex	Next.js remains on its native platform; Cloudflare gains are on API and stream paths.
Strict coordination	Keep Durable Objects	Writes, quota, run admission, and idempotency require exact coordination.
Cheap-read limiting	Native binding	Avoids a Durable Object hop while allowing safe, high-headroom eventual enforcement.
Streaming owner	AgentRun Durable Object	Preserves authorization, ordering, cancellation, persistence, and reconnect cursors.
Artifact cache	Private no-store	Retains deletion and revocation guarantees while enabling resumable transfers.
Tenant SQL cache	Disabled	Generic Hyperdrive query caching is unsafe for signed transaction-local RLS context.

Compatibility and edge cases

• No visual, navigation, model-selection, prompt, tool, billing, permission, or RLS changes.
• Existing APIs remain available for rollback.
• Invalid/expired output capabilities and deleted R2 objects remain inaccessible.
• Native rate-limit binding failures fail open only on read paths; strict limits retain their exact path.
• Reconnect and Workflow retry identities prevent duplicate provisional text.

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode
• pnpm architecture:check
• pnpm turbo skills:build
• pnpm worker:performance-budgets
• terraform -chdir=infra/cloudflare fmt -check -recursive
• terraform -chdir=infra/cloudflare validate
• Docker development image build
• Local browser shell, navigation, composer, console, and Gateway preconnect QA

No database migration is included. Production Worker rollout and browser verification will follow required GitHub checks.