# app.ferrow.ai — the signed-in surface. Not indexable, on purpose (R7-27).
#
# THIS IS NOT ferrow.ai. The marketing site has its own robots.txt with `Allow: /` and a sitemap,
# and it stays that way: it is the site that is meant to be found. THIS host is where a customer
# signs in, where every password-reset and verification link lands, and where the whole of the
# content sits behind a session. A search result pointing here can only ever be one of two things —
# a sign-in form somebody landed on instead of the page that would have explained the product, or a
# URL that never existed. Both are worse than not appearing at all.
#
# Until this file existed, the second kind was unbounded: Cloudflare Pages with no 404.html serves
# index.html with a 200 for every missing path, so `app.ferrow.ai/anything-at-all` returned the same
# 74KB document with a success status. Every page on ferrow.ai links `app.ferrow.ai/#signup` from its
# nav, so crawlers arrive here by design; one typo'd link was all it took to start minting duplicate
# indexable URLs on the domain people type their password into.
#
# THREE LAYERS, BECAUSE NONE OF THEM IS SUFFICIENT ALONE. robots.txt is advisory and is read only by
# crawlers that choose to; the `<meta name="robots">` in index.html is invisible to anything that
# fetched only headers, and cannot speak for a .mjs or a .woff2; `X-Robots-Tag` in web/_headers
# reaches every response but says nothing about status codes. web/404.html supplies the fourth thing
# none of them can: a real 404, so a link checker is told the truth.
#
# The sitemap line is deliberately absent. There is nothing here to submit.

User-agent: *
Disallow: /
