docs site: any single-segment path containing a dot renders the homepage with 200 (soft-404 class)

[os-zhuang]

One-liner

/foo.txt, /ads.txt, /sitemap_index.xml, /security.txt — every single-segment path with a dot in it returns 200 with the full homepage. Paths without a dot 404 correctly. So the site publishes an unbounded set of duplicate homepages at exactly the URLs crawlers probe by default.

Measured (local dev server, same routing in production)

/foo.txt               200  title=<title>ObjectStack — Apps small enough for AI to hold whole.</title>
/ads.txt               200  title=<title>ObjectStack — Apps small enough for AI to hold whole.</title>
/sitemap_index.xml     200  title=<title>ObjectStack — Apps small enough for AI to hold whole.</title>
/security.txt          200  title=<title>ObjectStack — Apps small enough for AI to hold whole.</title>
/this-page-does-not-exist   404   ← no dot, correct

Root cause

apps/docs/proxy.ts matcher excludes dotted paths from locale rewriting:

matcher: ['/((?!api|_next/static|_next/image|favicon.ico|.*\\..*).*)'],

so /robots.txt skips the proxy and falls straight through to the single-segment dynamic route app/[lang]/page.tsx, which matches with lang = "robots.txt" and renders HomePage() — it never checks whether lang is a real locale. A dotless path is rewritten to /en/<path>, becomes two segments, matches nothing, and 404s properly.

Expected

[lang] accepts only the locales in lib/i18n.ts. Either export const dynamicParams = false alongside the existing generateStaticParams, or an explicit if (!i18n.languages.includes(lang)) notFound() in app/[lang]/layout.tsx — whichever the Next 16 app router honours for both the static and the dev path. Verify both, do not assume.

Why it matters

Soft-404s at this scale burn crawl budget and split ranking signal across junk URLs; and the two paths that matter most (/robots.txt, /sitemap.xml) are in the affected set, so this card and the robots/sitemap card must both land for either to be worth anything.

Acceptance

• /foo.txt, /ads.txt, /security.txt, /anything.html all return 404
• /robots.txt and /sitemap.xml still resolve to their real routes (regression check against the sibling card)
• /docs, /docs/<any real page>, /blog unchanged
• a test or gate pins the behaviour so the catch-all cannot silently return

Source

Found in an SEO review of the docs site (apps/docs) run on 2026-08-25, measured against the local dev server and against production. The canonical origin is https://objectstack.ai — maintainer ruling recorded in #10659:

这个仓的文档站规范 URL 是 https://objectstack.ai

[os-zhuang]

Claim: PM loop round 1 (epic PM for #12243)
Session: session_f9f0958b-ab68-46cc-801c-216aa7ee2107
Branch: claude/issue-12233-dotted-soft-404
Worktree: objectstack-issue-12233
Domain: domain:devx
File surface: apps/docs/proxy.ts and apps/docs/app/[lang]/layout.tsx (or the [lang] page, whichever the Next 16 router actually honours) plus a regression test (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — no path-derived mandate; routing semantics need measuring in both dev and build modes rather than reasoning
Clause-②: no
Serial constraints cleared: none. Disjoint from #12232 (which only adds files) and from #12236 (content only)

[os-zhuang]

Dev claim (os-dev subagent, dispatched by the PM claim above).

• Session: session_f9f0958b-ab68-46cc-801c-216aa7ee2107 (same session as the epic PM — I am the os-dev subagent it dispatched, not a second claimant)
• Branch: claude/issue-12233-dotted-soft-404 (pushed empty at start, base 20b0fdb568c648374963cc13fdab89f4f74594bf)
• Worktree: objectstack-issue-12233
• Body integrity: the quoted proxy.ts matcher arrived intact — it is byte-identical to apps/docs/proxy.ts on origin/main (blob 4c8540cfdbe284598b68d1d48592e5431b54559b), so no reconstruction was needed.

Plan: re-measure both halves of the asymmetry on a dev server first, confirm or correct the root-cause reading, then measure the candidate fixes in both next dev and a production next build + next start, since the card explicitly does not assume they agree.