From 858619213c2fbb65ba66a280ef76bce22ae3abdc Mon Sep 17 00:00:00 2001 From: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:31:25 -0700 Subject: [PATCH 1/2] docs(frontend): update stale /sandbox references after #3557 Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --- frontend/COPY_REMEDIATION_PLAN.md | 6 +++--- frontend/PAGE_AUDIT.md | 4 ++-- frontend/tests/visual/README.md | 10 ++++------ 3 files changed, 9 insertions(+), 11 deletions(-) diff --git a/frontend/COPY_REMEDIATION_PLAN.md b/frontend/COPY_REMEDIATION_PLAN.md index 7f871e845..99a42b4a1 100644 --- a/frontend/COPY_REMEDIATION_PLAN.md +++ b/frontend/COPY_REMEDIATION_PLAN.md @@ -218,8 +218,8 @@ Pure copy deletions/rewrites, one pass: label the portal sandbox-only. ### PR-8 — Dead CTAs and dead-ends (~half day) [Tier3] -- `/#sandbox` → `/sandbox` (7 links: demo:237, compare×3, fsma-204/[cte]:497, - SharedSandboxResult:107,341). +- `/#sandbox` links (demo:237, compare×3, fsma-204/[cte]:497) → `/ingest`. + The `/sandbox` route and SharedSandboxResult were deleted in #3557. - Wire or remove each dead button: kde-checker Print/CSV Template/Explore (wire Print to `window.print()`, CSV to a real template file, else remove); sop-generator Download PDF/Print; tlc-validator Schedule a Demo @@ -319,7 +319,7 @@ high-signal per its own guidance): `FSMA 204 Compliant`, `Tamper-proof`, `tamper-proof`, `Create Password`, `/#sandbox`, `we have identified`, `uptime_percent`, `rge_test_` (docs only), `Coming in v1.1`, `§ 1.1330` (scoped to ingest viewer), `dashboard_user`. -Add `/sandbox` to the critical-route allowlist. Re-run in CI (already +Re-run in CI (already wired). Note in PROMISE_AUDIT.md that COPY_AUDIT.md is the judgment-level companion. diff --git a/frontend/PAGE_AUDIT.md b/frontend/PAGE_AUDIT.md index 0cc135c2c..cf979a2eb 100644 --- a/frontend/PAGE_AUDIT.md +++ b/frontend/PAGE_AUDIT.md @@ -77,11 +77,11 @@ the link graph goes quiet before the pages are removed. ## Candidates for future archival Still reachable but low-usage. Keep for now, revisit if we prune: - `/portal/[portalId]` — supplier portal entry point -- `/sandbox/results/[id]` — sandbox analysis result share Resolved since the last audit: `/owner/*` (the unwired billing/contracts suite) has been deleted, and its prefix removed from -`src/lib/app-routes.ts`. +`src/lib/app-routes.ts`. `/sandbox` and `/sandbox/results/[id]` were deleted +in #3557; CSV upload lives at `/ingest`. ## Route map quick stats - Total page routes: 163 (including dynamic `[param]` variants) diff --git a/frontend/tests/visual/README.md b/frontend/tests/visual/README.md index ca40fe4a7..f60efdb75 100644 --- a/frontend/tests/visual/README.md +++ b/frontend/tests/visual/README.md @@ -92,13 +92,11 @@ Snapshot stems (`home`, `about`, `blog__`, …) match the designer's ## Expected findings (known on day one) -- `/demo` and `/sandbox` are classified `expectRedirectOr404`, but both - currently return 200 (`src/app/demo/page.tsx` renders the synthetic demo; - `/sandbox` renders UI or a disabled notice depending on - `isSandboxEnabled()`). Those assertions flag until the routes are retired - or reclassified to `public`. `/alpha` genuinely redirects to `/contact`. +- `/demo` and `/sandbox` are classified `expectRedirectOr404`. The `/sandbox` + route was deleted in #3557 (its upload flow now lives at `/ingest`), so it + is expected to 404. `/alpha` genuinely redirects to `/contact`. - The content word bans (`demo`, `sandbox`, `sample`, …) will flag current - production copy (e.g. sandbox CTAs, "interactive demo" links). That is the + production copy (e.g. "interactive demo" links). That is the point: the report inventories every occurrence for the copy cleanup. ## Baselines From 2ef89277048b38b2e98e8520909afe74cc3f3e00 Mon Sep 17 00:00:00 2001 From: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:35:40 -0700 Subject: [PATCH 2/2] docs: address review on sandbox doc leftovers Keep the true /demo 200 note, update ROUTE_CROSSCHECK and routes.json for the deleted /sandbox routes, note /ingest requires sign-in, and mark the sandbox handoff plan superseded. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --- docs/sandbox-operational-handoff-plan.md | 2 ++ frontend/COPY_REMEDIATION_PLAN.md | 7 +++++-- frontend/PAGE_AUDIT.md | 3 ++- frontend/tests/visual/README.md | 8 +++++--- frontend/tests/visual/ROUTE_CROSSCHECK.md | 6 +++--- frontend/tests/visual/routes.json | 2 +- 6 files changed, 18 insertions(+), 10 deletions(-) diff --git a/docs/sandbox-operational-handoff-plan.md b/docs/sandbox-operational-handoff-plan.md index a223d769b..501b13c20 100644 --- a/docs/sandbox-operational-handoff-plan.md +++ b/docs/sandbox-operational-handoff-plan.md @@ -1,5 +1,7 @@ # Sandbox Operational Handoff Plan +> **Superseded:** the frontend `/sandbox` route (and `/sandbox/results/[id]`) was deleted in #3557; the upload flow is `/ingest` (sign-in required). + Branch: `codex/sandbox-operational-handoff` ## Goal diff --git a/frontend/COPY_REMEDIATION_PLAN.md b/frontend/COPY_REMEDIATION_PLAN.md index 99a42b4a1..c09f919fd 100644 --- a/frontend/COPY_REMEDIATION_PLAN.md +++ b/frontend/COPY_REMEDIATION_PLAN.md @@ -218,8 +218,11 @@ Pure copy deletions/rewrites, one pass: label the portal sandbox-only. ### PR-8 — Dead CTAs and dead-ends (~half day) [Tier3] -- `/#sandbox` links (demo:237, compare×3, fsma-204/[cte]:497) → `/ingest`. - The `/sandbox` route and SharedSandboxResult were deleted in #3557. +- `/#sandbox` links (demo:237, compare×3, fsma-204/[cte]:497): the `/sandbox` + route and SharedSandboxResult were deleted in #3557. The CSV upload flow is + `/ingest`, which requires sign-in (it is in `AUTHENTICATED_APP_ROUTE_PREFIXES`, + `src/lib/app-routes.ts`). For anonymous marketing CTAs, use the public + `/tools/drill-simulator` or `/signup`; link `/ingest` only where sign-in is expected. - Wire or remove each dead button: kde-checker Print/CSV Template/Explore (wire Print to `window.print()`, CSV to a real template file, else remove); sop-generator Download PDF/Print; tlc-validator Schedule a Demo diff --git a/frontend/PAGE_AUDIT.md b/frontend/PAGE_AUDIT.md index cf979a2eb..6730ded08 100644 --- a/frontend/PAGE_AUDIT.md +++ b/frontend/PAGE_AUDIT.md @@ -81,7 +81,8 @@ Still reachable but low-usage. Keep for now, revisit if we prune: Resolved since the last audit: `/owner/*` (the unwired billing/contracts suite) has been deleted, and its prefix removed from `src/lib/app-routes.ts`. `/sandbox` and `/sandbox/results/[id]` were deleted -in #3557; CSV upload lives at `/ingest`. +in #3557; CSV upload lives at `/ingest`, which requires sign-in (public +alternative: `/tools/drill-simulator`). ## Route map quick stats - Total page routes: 163 (including dynamic `[param]` variants) diff --git a/frontend/tests/visual/README.md b/frontend/tests/visual/README.md index f60efdb75..4df472e5f 100644 --- a/frontend/tests/visual/README.md +++ b/frontend/tests/visual/README.md @@ -92,9 +92,11 @@ Snapshot stems (`home`, `about`, `blog__`, …) match the designer's ## Expected findings (known on day one) -- `/demo` and `/sandbox` are classified `expectRedirectOr404`. The `/sandbox` - route was deleted in #3557 (its upload flow now lives at `/ingest`), so it - is expected to 404. `/alpha` genuinely redirects to `/contact`. +- `/demo` and `/sandbox` are classified `expectRedirectOr404`. `/demo` still + returns 200 (`src/app/demo/page.tsx` renders the synthetic demo), so its + assertion flags until the route is retired or reclassified to `public`. + `/sandbox` was deleted in #3557 (no `src/app/sandbox/` remains), so it is + expected to 404. `/alpha` genuinely redirects to `/contact`. - The content word bans (`demo`, `sandbox`, `sample`, …) will flag current production copy (e.g. "interactive demo" links). That is the point: the report inventories every occurrence for the copy cleanup. diff --git a/frontend/tests/visual/ROUTE_CROSSCHECK.md b/frontend/tests/visual/ROUTE_CROSSCHECK.md index c4470306e..bc5c22633 100644 --- a/frontend/tests/visual/ROUTE_CROSSCHECK.md +++ b/frontend/tests/visual/ROUTE_CROSSCHECK.md @@ -24,11 +24,11 @@ the source list. ## Coverage statement -`routes.json` covers all 155 source-list routes plus `/`: +`routes.json` covers all 155 source-list routes plus `/`, minus `/sandbox/results/[id]` (deleted in #3557): - `public`: 78 (designer crawl minus the 3 deliberate exclusions; was 82 before reconciliation — see below) - `authOnly`: 58 -- `skippedDynamic`: 5 (`/fsma-204/[cte]`, `/ingest/results/[id]`, `/portal/[portalId]`, `/requests/[id]`, `/sandbox/results/[id]`) +- `skippedDynamic`: 4 (`/fsma-204/[cte]`, `/ingest/results/[id]`, `/portal/[portalId]`, `/requests/[id]`; `/sandbox/results/[id]` was removed when #3557 deleted it) - `expectRedirectOr404`: 14 (was 10 before reconciliation) - excluded entirely: `/auth/sso/mock` (mock SSO fixture; reason in `excludedReason`, visited by no spec) @@ -53,7 +53,7 @@ params, so every non-dynamic route was crawled exactly once, including |---|---|---| | `/auth/sso/mock` | Crawled 200 | Excluded entirely (unchanged): mock SSO fixture page (`CHROMELESS_EXACT_ROUTES`). Never screenshotted or visited by monitoring, regardless of status. | | `/demo` | Crawled 200 | Stays in `expectRedirectOr404` (unchanged): demo surface. The crawl independently confirms the OBSERVED 200 noted in `routes.json`; the assertion flags until the route is retired or reclassified to `public`. | -| `/sandbox` | Crawled 200 | Stays in `expectRedirectOr404` (unchanged): demo surface, flag-gated by `isSandboxEnabled()`. Same as `/demo`: flags until retired or reclassified. | +| `/sandbox` | Crawled 200 (before #3557) | Stays in `expectRedirectOr404`. The route was deleted in #3557 (no `src/app/sandbox/`), so it is now expected to 404 and the assertion should pass. | ### In our `public`, not in the designer list (4) — adopted, moved to `expectRedirectOr404` diff --git a/frontend/tests/visual/routes.json b/frontend/tests/visual/routes.json index fa7036b06..ebfb734ce 100644 --- a/frontend/tests/visual/routes.json +++ b/frontend/tests/visual/routes.json @@ -1 +1 @@ -{"_generated":"2026-10-23 from /tmp/re-all-routes.txt (155 non-empty lines) crosschecked against frontend/src/app/**/page.{tsx,jsx}; reconciled 2026-10-23 with the designer crawl (81 routes 200-no-redirect on production): 4 routes moved public->expectRedirectOr404 (/design-system, /tools/anomaly-simulator, /trust-center, /verticals/food-safety)","_note":"Single replaceable route data file for the visual suite. Public vs auth determined by frontend/src/proxy.ts requireAppAuth + AUTHENTICATED_APP_ROUTE_PREFIXES in frontend/src/lib/app-routes.ts + GATED_DEV_ROUTES (/developer/portal) + next.config.js redirects(). Signed-out behavior only.","authOnly":["/admin","/admin/api-console","/api-keys","/audit","/compliance/labels","/compliance/profile","/compliance/snapshots","/compliance/status","/compliance/traceability-plan","/controls","/dashboard","/dashboard/agent-reviews","/dashboard/alerts","/dashboard/audit-log","/dashboard/compliance","/dashboard/export-jobs","/dashboard/heartbeat","/dashboard/inflow-lab","/dashboard/integrations","/dashboard/issues","/dashboard/notifications","/dashboard/products","/dashboard/qa-health","/dashboard/recall-drills","/dashboard/recall-report","/dashboard/recall-response","/dashboard/receiving","/dashboard/scan","/dashboard/settings","/dashboard/suppliers","/dashboard/team","/developer/portal","/developer/portal/keys","/exceptions","/fsma","/fsma/assessment","/fsma/field-capture","/fsma/integration","/identity","/ingest","/ingest/curation","/onboarding","/onboarding/bulk-upload","/onboarding/setup","/onboarding/setup/facility","/onboarding/setup/ftl-check","/onboarding/setup/welcome","/records","/remediation","/requests","/review","/rules","/settings/notifications","/settings/profile","/settings/security","/settings/support","/sysadmin","/trace"],"baseURLEnv":"VISUAL_BASE_URL","excludedReason":{"/admin":"auth-gated: /admin prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/admin/api-console":"auth-gated: /admin prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/alpha":"redirect(): src/app/alpha/page.tsx redirects to /contact; asserted in expectRedirectOr404","/api-keys":"auth-gated transitively: bare redirect() to gated /developer/portal/keys (see GATED_DEV_ROUTES comment in proxy.ts)","/audit":"auth-gated: /audit prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/auth/sso/mock":"excluded entirely: mock SSO fixture page (CHROMELESS_EXACT_ROUTES); must never be screenshotted or visited by monitoring","/compliance":"redirect source: next.config.js 308 /compliance -> /dashboard/compliance; also auth-gated (/compliance prefix); asserted in expectRedirectOr404","/compliance/labels":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/compliance/profile":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/compliance/snapshots":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/compliance/status":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/compliance/traceability-plan":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/controls":"auth-gated: /controls prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/agent-reviews":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/alerts":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/audit-log":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/compliance":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/export-jobs":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/heartbeat":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/inflow-lab":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/integrations":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/issues":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/notifications":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/products":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/qa-health":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/recall-drills":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/recall-report":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/recall-response":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/receiving":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/scan":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/settings":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/suppliers":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/team":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/demo":"demo surface: asserted in expectRedirectOr404 (no baseline). OBSERVED 2026-10-23: src/app/demo/page.tsx currently renders 200 with synthetic data and is linked from /sandbox, so this assertion flags until the route is retired or reclassified to public","/design-system":"404 on production: src/app/design-system/page.tsx calls notFound() when NODE_ENV=production (Internal, development only); absent from the designer 200-no-redirect crawl; asserted in expectRedirectOr404","/developer/portal":"auth-gated: GATED_DEV_ROUTES in proxy.ts; signed-out proxy redirects to /login","/developer/portal/keys":"auth-gated: GATED_DEV_ROUTES in proxy.ts; signed-out proxy redirects to /login","/exceptions":"auth-gated: /exceptions prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/fsma":"auth-gated: /fsma prefix in AUTHENTICATED_APP_ROUTE_PREFIXES (exact + slash match only; does NOT cover /fsma-204); signed-out proxy redirects to /login","/fsma-204/[cte]":"dynamic [cte] param: no fixed URL to baseline; needs a param allowlist before it can be covered","/fsma/assessment":"auth-gated: /fsma prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/fsma/field-capture":"auth-gated: /fsma prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/fsma/integration":"auth-gated: /fsma prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/identity":"auth-gated: /identity prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/ingest":"auth-gated: /ingest prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/ingest/curation":"auth-gated: /ingest prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/ingest/results/[id]":"dynamic [id] param: no fixed URL to baseline; also auth-gated (/ingest prefix)","/onboarding":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/bulk-upload":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/setup":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/setup/facility":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/setup/ftl-check":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/setup/welcome":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/portal/[portalId]":"dynamic [portalId] param: no fixed URL to baseline","/records":"auth-gated: /records prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/remediation":"auth-gated: /remediation prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/requests":"auth-gated: /requests prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/requests/[id]":"dynamic [id] param: no fixed URL to baseline; also auth-gated (/requests prefix)","/retailer-readiness":"redirect source: next.config.js 308 /retailer-readiness -> /buyer-programs; page.tsx exists but the redirect wins; asserted in expectRedirectOr404","/review":"auth-gated: /review prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/rules":"auth-gated: /rules prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/sandbox":"demo surface: asserted in expectRedirectOr404 (no baseline). OBSERVED 2026-10-23: flag-gated by isSandboxEnabled() (@/lib/sandbox-cta) but renders 200 in both states (sandbox UI vs disabled notice), so this assertion flags until the route is retired or reclassified to public","/sandbox/results/[id]":"dynamic [id] param: no fixed URL to baseline","/settings":"redirect source: next.config.js 308 /settings -> /dashboard/settings; also auth-gated (/settings prefix); asserted in expectRedirectOr404","/settings/notifications":"auth-gated: /settings prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/settings/profile":"auth-gated: /settings prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/settings/security":"auth-gated: /settings prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/settings/support":"auth-gated: /settings prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/settings/users":"redirect source: next.config.js 308 /settings/users -> /dashboard/settings/users; has NO page.tsx (see ROUTE_CROSSCHECK.md); also auth-gated; asserted in expectRedirectOr404","/sysadmin":"auth-gated: /sysadmin prefix in AUTHENTICATED_APP_ROUTE_PREFIXES (+ sysadmin-only check); signed-out proxy redirects to /login","/tools/anomaly-simulator":"redirect(): src/app/tools/anomaly-simulator/page.tsx permanentRedirects to /tools/drill-simulator (in public); excluded from the designer 200-no-redirect crawl as redirecting; asserted in expectRedirectOr404","/tools/readiness-assessment":"redirect source: next.config.js 308 /tools/readiness-assessment -> /tools/self-reported-checklist; asserted in expectRedirectOr404","/tools/recall-readiness":"redirect source: next.config.js 308 /tools/recall-readiness -> /tools/records-request-checklist; asserted in expectRedirectOr404","/tools/retailer-readiness":"redirect source: page.tsx redirects to /retailer-readiness, which 308s to /buyer-programs; asserted in expectRedirectOr404","/trace":"auth-gated: /trace prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/trust-center":"redirect(): src/app/trust-center/page.tsx redirects to /trust (in public); excluded from the designer 200-no-redirect crawl as redirecting; asserted in expectRedirectOr404","/verticals/food-safety":"redirect(): src/app/verticals/food-safety/page.tsx redirects to /fsma-204 (in public); excluded from the designer 200-no-redirect crawl as redirecting; asserted in expectRedirectOr404"},"expectRedirectOr404":["/demo","/sandbox","/alpha","/retailer-readiness","/tools/recall-readiness","/tools/readiness-assessment","/tools/retailer-readiness","/settings","/settings/users","/compliance","/design-system","/tools/anomaly-simulator","/trust-center","/verticals/food-safety"],"priority":["/","/pricing","/integrations","/developers","/trust","/why-regengine","/proof","/tools/scan","/login","/signup"],"public":["/","/about","/accept-invite","/auth/verify","/blog","/blog/24-hour-rule","/blog/fda-food-traceability-requirements","/blog/food-traceability-software","/blog/fsma-204-compliance-checklist-2026","/blog/fsma-204-compliance-guide","/blog/fsma-204-cte-kde-guide","/blog/fsma-204-mid-market-guide","/blog/fsma-204-traceability-lot-codes","/blog/regengine-vs-spreadsheets-traceability","/buyer-programs","/case-studies","/compare/foodlogiq","/compare/repositrak","/compare/tracegains","/contact","/developers","/developers/compliance-verticals","/docs","/docs/api","/docs/authentication","/docs/changelog","/docs/connectors/inflow-lab","/docs/errors","/docs/fsma-204","/docs/quickstart","/docs/rate-limits","/docs/sdks","/docs/walkthrough","/docs/webhooks","/dpa","/fsma-204","/integrations","/legal/vulnerability-disclosure","/login","/pricing","/privacy","/product","/proof","/proof/recall-drill","/proof/transformation","/security","/signup","/status","/supplier-compliance","/terms","/tools","/tools/ask","/tools/cte-mapper","/tools/data-import","/tools/drill-simulator","/tools/export","/tools/fsma-unified","/tools/ftl-checker","/tools/inflow-lab","/tools/inflow-lab-dashboard-preview","/tools/kde-checker","/tools/knowledge-graph","/tools/label-scanner","/tools/notice-validator","/tools/obligation-scanner","/tools/records-request-checklist","/tools/roi-calculator","/tools/scan","/tools/self-reported-checklist","/tools/sop-generator","/tools/tlc-validator","/trust","/trust/architecture","/trust/retention","/trust/support","/verify","/walkthrough","/why-regengine"],"skippedDynamic":["/fsma-204/[cte]","/ingest/results/[id]","/portal/[portalId]","/requests/[id]","/sandbox/results/[id]"]} \ No newline at end of file +{"_generated":"2026-10-23 from /tmp/re-all-routes.txt (155 non-empty lines) crosschecked against frontend/src/app/**/page.{tsx,jsx}; reconciled 2026-10-23 with the designer crawl (81 routes 200-no-redirect on production): 4 routes moved public->expectRedirectOr404 (/design-system, /tools/anomaly-simulator, /trust-center, /verticals/food-safety)","_note":"Single replaceable route data file for the visual suite. Public vs auth determined by frontend/src/proxy.ts requireAppAuth + AUTHENTICATED_APP_ROUTE_PREFIXES in frontend/src/lib/app-routes.ts + GATED_DEV_ROUTES (/developer/portal) + next.config.js redirects(). Signed-out behavior only.","authOnly":["/admin","/admin/api-console","/api-keys","/audit","/compliance/labels","/compliance/profile","/compliance/snapshots","/compliance/status","/compliance/traceability-plan","/controls","/dashboard","/dashboard/agent-reviews","/dashboard/alerts","/dashboard/audit-log","/dashboard/compliance","/dashboard/export-jobs","/dashboard/heartbeat","/dashboard/inflow-lab","/dashboard/integrations","/dashboard/issues","/dashboard/notifications","/dashboard/products","/dashboard/qa-health","/dashboard/recall-drills","/dashboard/recall-report","/dashboard/recall-response","/dashboard/receiving","/dashboard/scan","/dashboard/settings","/dashboard/suppliers","/dashboard/team","/developer/portal","/developer/portal/keys","/exceptions","/fsma","/fsma/assessment","/fsma/field-capture","/fsma/integration","/identity","/ingest","/ingest/curation","/onboarding","/onboarding/bulk-upload","/onboarding/setup","/onboarding/setup/facility","/onboarding/setup/ftl-check","/onboarding/setup/welcome","/records","/remediation","/requests","/review","/rules","/settings/notifications","/settings/profile","/settings/security","/settings/support","/sysadmin","/trace"],"baseURLEnv":"VISUAL_BASE_URL","excludedReason":{"/admin":"auth-gated: /admin prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/admin/api-console":"auth-gated: /admin prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/alpha":"redirect(): src/app/alpha/page.tsx redirects to /contact; asserted in expectRedirectOr404","/api-keys":"auth-gated transitively: bare redirect() to gated /developer/portal/keys (see GATED_DEV_ROUTES comment in proxy.ts)","/audit":"auth-gated: /audit prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/auth/sso/mock":"excluded entirely: mock SSO fixture page (CHROMELESS_EXACT_ROUTES); must never be screenshotted or visited by monitoring","/compliance":"redirect source: next.config.js 308 /compliance -> /dashboard/compliance; also auth-gated (/compliance prefix); asserted in expectRedirectOr404","/compliance/labels":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/compliance/profile":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/compliance/snapshots":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/compliance/status":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/compliance/traceability-plan":"auth-gated: /compliance prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/controls":"auth-gated: /controls prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/agent-reviews":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/alerts":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/audit-log":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/compliance":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/export-jobs":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/heartbeat":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/inflow-lab":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/integrations":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/issues":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/notifications":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/products":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/qa-health":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/recall-drills":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/recall-report":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/recall-response":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/receiving":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/scan":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/settings":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/suppliers":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/dashboard/team":"auth-gated: /dashboard prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/demo":"demo surface: asserted in expectRedirectOr404 (no baseline). OBSERVED 2026-10-23: src/app/demo/page.tsx currently renders 200 with synthetic data, so this assertion flags until the route is retired or reclassified to public","/design-system":"404 on production: src/app/design-system/page.tsx calls notFound() when NODE_ENV=production (Internal, development only); absent from the designer 200-no-redirect crawl; asserted in expectRedirectOr404","/developer/portal":"auth-gated: GATED_DEV_ROUTES in proxy.ts; signed-out proxy redirects to /login","/developer/portal/keys":"auth-gated: GATED_DEV_ROUTES in proxy.ts; signed-out proxy redirects to /login","/exceptions":"auth-gated: /exceptions prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/fsma":"auth-gated: /fsma prefix in AUTHENTICATED_APP_ROUTE_PREFIXES (exact + slash match only; does NOT cover /fsma-204); signed-out proxy redirects to /login","/fsma-204/[cte]":"dynamic [cte] param: no fixed URL to baseline; needs a param allowlist before it can be covered","/fsma/assessment":"auth-gated: /fsma prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/fsma/field-capture":"auth-gated: /fsma prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/fsma/integration":"auth-gated: /fsma prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/identity":"auth-gated: /identity prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/ingest":"auth-gated: /ingest prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/ingest/curation":"auth-gated: /ingest prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/ingest/results/[id]":"dynamic [id] param: no fixed URL to baseline; also auth-gated (/ingest prefix)","/onboarding":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/bulk-upload":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/setup":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/setup/facility":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/setup/ftl-check":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/onboarding/setup/welcome":"auth-gated: /onboarding prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/portal/[portalId]":"dynamic [portalId] param: no fixed URL to baseline","/records":"auth-gated: /records prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/remediation":"auth-gated: /remediation prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/requests":"auth-gated: /requests prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/requests/[id]":"dynamic [id] param: no fixed URL to baseline; also auth-gated (/requests prefix)","/retailer-readiness":"redirect source: next.config.js 308 /retailer-readiness -> /buyer-programs; page.tsx exists but the redirect wins; asserted in expectRedirectOr404","/review":"auth-gated: /review prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/rules":"auth-gated: /rules prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/sandbox":"deleted in #3557: src/app/sandbox/ no longer exists, so the route is expected to 404; asserted in expectRedirectOr404","/settings":"redirect source: next.config.js 308 /settings -> /dashboard/settings; also auth-gated (/settings prefix); asserted in expectRedirectOr404","/settings/notifications":"auth-gated: /settings prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/settings/profile":"auth-gated: /settings prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/settings/security":"auth-gated: /settings prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/settings/support":"auth-gated: /settings prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/settings/users":"redirect source: next.config.js 308 /settings/users -> /dashboard/settings/users; has NO page.tsx (see ROUTE_CROSSCHECK.md); also auth-gated; asserted in expectRedirectOr404","/sysadmin":"auth-gated: /sysadmin prefix in AUTHENTICATED_APP_ROUTE_PREFIXES (+ sysadmin-only check); signed-out proxy redirects to /login","/tools/anomaly-simulator":"redirect(): src/app/tools/anomaly-simulator/page.tsx permanentRedirects to /tools/drill-simulator (in public); excluded from the designer 200-no-redirect crawl as redirecting; asserted in expectRedirectOr404","/tools/readiness-assessment":"redirect source: next.config.js 308 /tools/readiness-assessment -> /tools/self-reported-checklist; asserted in expectRedirectOr404","/tools/recall-readiness":"redirect source: next.config.js 308 /tools/recall-readiness -> /tools/records-request-checklist; asserted in expectRedirectOr404","/tools/retailer-readiness":"redirect source: page.tsx redirects to /retailer-readiness, which 308s to /buyer-programs; asserted in expectRedirectOr404","/trace":"auth-gated: /trace prefix in AUTHENTICATED_APP_ROUTE_PREFIXES; signed-out proxy redirects to /login","/trust-center":"redirect(): src/app/trust-center/page.tsx redirects to /trust (in public); excluded from the designer 200-no-redirect crawl as redirecting; asserted in expectRedirectOr404","/verticals/food-safety":"redirect(): src/app/verticals/food-safety/page.tsx redirects to /fsma-204 (in public); excluded from the designer 200-no-redirect crawl as redirecting; asserted in expectRedirectOr404"},"expectRedirectOr404":["/demo","/sandbox","/alpha","/retailer-readiness","/tools/recall-readiness","/tools/readiness-assessment","/tools/retailer-readiness","/settings","/settings/users","/compliance","/design-system","/tools/anomaly-simulator","/trust-center","/verticals/food-safety"],"priority":["/","/pricing","/integrations","/developers","/trust","/why-regengine","/proof","/tools/scan","/login","/signup"],"public":["/","/about","/accept-invite","/auth/verify","/blog","/blog/24-hour-rule","/blog/fda-food-traceability-requirements","/blog/food-traceability-software","/blog/fsma-204-compliance-checklist-2026","/blog/fsma-204-compliance-guide","/blog/fsma-204-cte-kde-guide","/blog/fsma-204-mid-market-guide","/blog/fsma-204-traceability-lot-codes","/blog/regengine-vs-spreadsheets-traceability","/buyer-programs","/case-studies","/compare/foodlogiq","/compare/repositrak","/compare/tracegains","/contact","/developers","/developers/compliance-verticals","/docs","/docs/api","/docs/authentication","/docs/changelog","/docs/connectors/inflow-lab","/docs/errors","/docs/fsma-204","/docs/quickstart","/docs/rate-limits","/docs/sdks","/docs/walkthrough","/docs/webhooks","/dpa","/fsma-204","/integrations","/legal/vulnerability-disclosure","/login","/pricing","/privacy","/product","/proof","/proof/recall-drill","/proof/transformation","/security","/signup","/status","/supplier-compliance","/terms","/tools","/tools/ask","/tools/cte-mapper","/tools/data-import","/tools/drill-simulator","/tools/export","/tools/fsma-unified","/tools/ftl-checker","/tools/inflow-lab","/tools/inflow-lab-dashboard-preview","/tools/kde-checker","/tools/knowledge-graph","/tools/label-scanner","/tools/notice-validator","/tools/obligation-scanner","/tools/records-request-checklist","/tools/roi-calculator","/tools/scan","/tools/self-reported-checklist","/tools/sop-generator","/tools/tlc-validator","/trust","/trust/architecture","/trust/retention","/trust/support","/verify","/walkthrough","/why-regengine"],"skippedDynamic":["/fsma-204/[cte]","/ingest/results/[id]","/portal/[portalId]","/requests/[id]"]}