https://en.wikipedia.org/wiki/Country_code_top-level_domain#...
There was also a .um for US minor outlying islands, removed in 2008.
It's absolutely possible that someone will asking for an exceptional reservation for IO at ISO and it can be kept alive forever.
I agree it's possible, I disagree with OP that it's a foregone conclusion.
At this point if I were the owner of a .io domain I would treat that as the unlikely best case scenario and start looking at what domain I'd fall back to if ICANN sticks to their rules.
https://en.m.wikipedia.org/wiki/ISO_3166-1_alpha-2
Breaking with ISO 3166-1 comes with the risk that a new ISO-standardized country cannot claim its TLD.
So in order to reclaim the TLD as generic, startups dont just have to persuade ICANN, they have to make the case to ISO that IO is a significant enough code that it should be an "exceptional reservation" like UK, UN, EU, and SU.
At one point, it was intended that moving the UK's internet resources to .gb would be the final stage of the transition from the internal JANET system.
By the time I first heard about that in the early 90s, that had already gained legendary "that'll never happen" status - and, sure enough, the transition was declared complete when the last UK.AC.SITE <-> ac.uk mail gateways were retired circa 1996.
Apparently "United" and "Kingdom" aren't valid for ISO, so they went with ignoring part of the name completely.
Jump a hundred years forwards to a hypothetical future where the USA is fragmenting, Iowa becomes a country, IA and IW are already assigned to some other countries that have sprung up, and ISO is somehow still relevant. When Iowa says “we want IO”, what do you say? “Sorry, we used that code a hundred years ago for a tiny island in the middle of nowhere, how do you feel about YA, it sounds a little like Iowa, right?”
(Admittedly if the USA fragmented, each state into a country, you’d have far worse problems than Iowa. Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana… eight Ms, and already M_ is down to only three available, MB, MI and MJ. M is a popular letter to start names with.)
There are already a few country codes assigned where I can’t see where the second letter came from, e.g. AW, AX, BJ, BQ, CW, GW, SX, PW. A definite habit of giving a W or X if they can’t come up with anything better.
A few country codes have already been reassigned once (having formerly been either assigned or reserved indefinitely, then deleted): AI, BQ, GE, LT, ME, RU, SK.
Accepting registrations for a domain is pretty useless when those domains aren't going to resolve to anything.
This was a known and willfully ignored business risk for these places.
It does seem likely that ICANN won't kill off all existing registrations, but this is supposition, not an answer. If we look only at what they've done historically to ccTLDs the most likely outcome is that new registrations become locked and ICANN attempts to phase the .io TLD out.
They may break that trend now given how much they've already polluted the TLD space, but they may not, and I think your comment is a bit too optimistic. People with .io domains should absolutely be paying close attention here.
Edit: gnfargbl found the actual written policy [0].
[0] https://news.ycombinator.com/item?id=41730559