Segment cache cross-URL poisoning under htmlLimitedBots catch-all disables PPR serving
When htmlLimitedBots is set to /.*/ and cacheComponents/partialPrefetching are enabled, RSC prefetch responses bypass the PPR shell (no x-nextjs-postponed). The client still chooses the PPR fetch strategy, stores the full concrete page under a param-blind shell vary path, and sibling prefetches overwrite each other. Soft navigation then renders the wrong sibling page (e.g., /item/alpha shows Item delta). Affects Next.js 16.3.3 production; not reproducible on 16.4.0-canary.0.
