fix(public): enforce the top-level real-404 deploy proof in the release lane

scripts/prepare-public-deploy-bundle.mjs

@@ -15,7 +15,8 @@
 //   - post-filter: the bundle must contain none of the forbidden markers and
 //     must still carry the neutral merged fixes used as deploy proof
 //     (H2-after-H1 on /promptly/support/ from #18/#20, JSON-LD on /contact/
-//     from #19, homepage brand disambiguation from #29).
+//     from #19, homepage brand disambiguation from #29, top-level real 404
+//     page from #34).
 //
 // CLI: node scripts/prepare-public-deploy-bundle.mjs --source public --output <dir>
 // Defaults: --source ./public, --output to a fresh temp directory (printed).
@@ -80,6 +81,20 @@ export const NEUTRAL_PROOFS = [
     file: "index.html",
     test: (html) => html.includes("not affiliated"),
   },
+  {
+    // The top-level 404 page is what terminates Cloudflare Pages' single-page
+    // application fallback: without it every unknown URL is served as the
+    // homepage with HTTP 200 (the soft-404 PR #34 fixed). It must therefore be
+    // part of the deploy-proof set, not just an existing file: if it is ever
+    // lost or becomes a homepage clone, the release lane itself fails closed
+    // instead of publishing a bundle that soft-404s again.
+    label: "top-level real 404 page (PR #34) - terminates Pages SPA fallback",
+    file: "404.html",
+    test: (html) =>
+      /<title>[^<]*not found[^<]*<\/title>/i.test(html) &&
+      !html.includes("<title>Tiny Studio | Promptly, Drishti, and 0509") &&
+      /<meta name="robots" content="noindex">/.test(html),
+  },
 ]
 
 // Files that must exist in every bundle.

scripts/test-public-deploy-bundle.mjs

@@ -3,7 +3,8 @@
 //     (PRs #10/#11, snoozed-by-Nish 2026-08-08) and leave nothing behind;
 //   - every neutral merged public fix used as deploy proof (H2-after-H1 on
 //     /promptly/support/ #18/#20, JSON-LD on /contact/ #19, homepage brand
-//     disambiguation #29) must survive the filter untouched.
+//     disambiguation #29, top-level real 404 page #34) must survive the
+//     filter untouched.
 //
 // The bundle is prepared in a temp directory; the worktree is never modified.
 import { mkdtempSync, rmSync, existsSync } from "node:fs"