# Crawling rules for meridianlabssoftware.com (#54).
#
# Copied to the root of the published site by scripts/assemble-site.mjs, which
# is why this lives here and not in dist/ — dist/ is published under /demo/,
# and a robots.txt anywhere but the origin root is ignored. Until #54 this
# file did not exist and /robots.txt answered 404.
#
# Two things share this origin and they want opposite treatment:
#
#   /            the marketing site — must stay crawlable and indexable. It
#                carries the entity name, the ABN and the legal pages, and it
#                is where a sceptical visitor lands when they truncate a demo
#                link back to the domain (#18). Keeping it findable is the
#                point of the shared origin.
#   /demo/…      one prospect's demo per unlisted URL — must stay out of
#                search results.
#
# So: nothing is disallowed, and the demos are kept out of the index by
# `<meta name="robots" content="noindex">` in index.html instead, plus an
# X-Robots-Tag on /demo/* in _headers for the venue configs, which are JSON
# and carry no meta tag.
#
# THE COMBINATION THAT LOOKS RIGHT IS THE ONE THAT FAILS. Disallowing /demo/
# here *and* serving noindex there defeats itself, and the ticket that added
# this file originally asked for both. Google's own documentation:
#
#   "For the noindex rule to be effective, the page or resource must not be
#   blocked by a robots.txt file, and it has to be otherwise accessible to
#   the crawler. If the page is blocked by a robots.txt file or the crawler
#   can't access the page, the crawler will never see the noindex rule, and
#   the page can still appear in search results, for example if other pages
#   link to it."
#
# and, separately, that robots.txt "is not a mechanism for keeping a web page
# out of Google". Sources, both read 2026-07-28:
#   https://developers.google.com/search/docs/crawling-indexing/block-indexing
#   https://developers.google.com/search/docs/crawling-indexing/robots/intro
#
# That matters here specifically rather than in general. #54's threat model is
# a *forwarded link* — which is exactly the discovery path that produces a
# URL-only index entry for a page a crawler was told not to fetch. Disallowing
# /demo/ would ship the one configuration that leaves the door open while
# reading as though it had been shut.
#
# A crawler cannot find a demo by itself in any case: every slug carries an
# unguessable token and nothing anywhere links to one. This file and the
# noindex tag are what happens if somebody publishes their link.

User-agent: *
Disallow: