[Pages] Deleted preview deployments still execute Functions from edge — orphaned hash hosts serve after API 404

## Summary

Six Pages preview deployments for project `dailyknack` were deleted from the control plane.
`GET /deployments/{id}` returns 404 / `8000009` for all six, and none appear in the full preview
deployment listing (676 rows, paginated). Despite this, their `.dailyknack.pages.dev`
hostnames still resolve and **execute Pages Functions** from the edge — this is not a cached
HTML response. Functions return dynamic JSON with `Cache-Control: no-store` and `CF-Cache-Status`
absent on all probes.

Related: workers-sdk#15083, developer-platform#67.

## Control-plane proof

| Short hash | GET /deployments/{id} | In deployment list? |
|---|---|---|
| `4ce1493b` | 404 — 8000009 | No |
| `ce6ad059` | 404 — 8000009 | No |
| `1d34e24a` | 404 — 8000009 | No |
| `e600186e` | 404 — 8000009 | No |
| `82f620ca` | 404 — 8000009 | No |
| `166727ef` | 404 — 8000009 | No |

All six return: `The deployment ID you have specified does not exist.`

## Edge behavior (2026-09-03, ~09:01 UTC)

### POST /api/checkout — all six orphans

All six return **401** `login_required` · `Cache-Control: no-store` · `application/json` ·
`server: cloudflare` · CF-Cache-Status absent. Identical response body hash across all six
(37 bytes). Functions are executing with live bindings — this is not stale cache.

| Short hash | Timestamp (UTC) | CF-Ray (redacted — full IDs available privately) |
|---|---|---|
| `4ce1493b` | 09:01:16Z | `a35391a…-AMD` |
| `ce6ad059` | 09:01:17Z | `a35391a…-NAG` |
| `1d34e24a` | 09:01:19Z | `a35391b…-HYD` |
| `e600186e` | 09:01:21Z | `a35391b…-AMD` |
| `82f620ca` | 09:01:22Z | `a35391c…-NAG` |
| `166727ef` | 09:01:23Z | `a35391d…-AMD` |

### Asymmetry: 4ce1493b vs. the other five

| | `4ce1493b` | Other five |
|---|---|---|
| GET / | **200** — full HTML (~556 KB) | **500** — Worker 1101-class shell (~21 KB) |
| GET /api/scored-audio-gate | 404 HTML | 500 |
| GET (missing route) | 404 HTML | 500 |
| POST /api/checkout | **401** `login_required` (Function live) | **401** `login_required` (Function live) |

`4ce1493b` retains a fully intact edge representation (assets + Worker). The other five have
assets purged (500 on static routes) but the checkout Function still executes — partial purge.

### Live alias (contrast — not orphaned)

Branch alias `stg-dk7x4q.dailyknack.pages.dev` → listed deployment `3bf776b8` (present in
control plane). Correctly serves `503 checkout_unavailable` on POST /api/checkout. This
deployment is healthy and should not be affected by any purge.

## Requested action

1. Purge/disable the six orphaned edge deployments.
2. Confirm their hash URLs no longer execute Functions.
3. Verify the live alias (`stg-dk7x4q` → `3bf776b8`) remains unaffected.

## Full evidence available privately

The following are redacted from this public post and available to Cloudflare staff on request:

- Account ID
- Full deployment UUIDs (all six)
- Full orphan URLs (long-form UUID + short-hash `.pages.dev`)
- Full CF-Ray IDs (all probes, orphans + live alias)
- Response body SHA-256 hashes
- Project config (bindings, subdomain, custom domains)

**Please provide a secure channel** (private security disclosure, support case, or DM to a
Pages team engineer) and I will send the complete evidence packet.

Start by reviewing workers-sdk#15083 and developer-platform#67, then reproduce the orphaned hash-host behavior using the deployment IDs and probe details in this report. Done means the six orphaned edge deployments no longer execute Functions, while the listed live alias continues serving its expected response; full identifiers require a secure channel.

Written by the indexing model from the issue text.