Fix: browser navigations to /scope and /api/intake returned 404

[robbyrob42]

The intake form was unreachable from a browser from the moment the property went live. Not the Turnstile hostname, which I blamed earlier today — that was wrong.

Mechanism

Cloudflare's asset router applies not_found_handling only to requests carrying Sec-Fetch-Mode: navigate. A normal request that misses the asset manifest is passed to the Worker. A navigation that misses is answered with 404.html, and the Worker is never invoked.

/scope and /api/intake are the only routes on this site rendered on demand, so neither exists in the manifest. Every browser navigation to the scoping form got the 404 page — and since a form POST is also a navigation, the intake endpoint could not be reached from a browser at all.

Reproduced exactly, on the live site:

Sec-Fetch-Dest only   200
Sec-Fetch-Site only   200
Sec-Fetch-Mode only   404   <-

Why it survived every check

• Introduced with the 404 page in Forensics launch prep: structured data, a real 404, and product analytics #61. Before that there was no 404.html for the router to serve, so misses fell through to the Worker.
• sites/www has the identical not_found_handling and is fine only because it ships no 404.html. Its /contact works. A comment now records that trap, because adding a 404 page there would break it the same way.
• The property had no DNS record until today, so nothing could navigate to it.
• Every check I ran used curl, which sends no Sec-Fetch-Mode — so it always took the Worker path and always returned 200. The bug was invisible to the exact tool used to verify it.

The fix

run_worker_first: ["/scope", "/scope/", "/api/*"] — a route list rather than true, so the Worker runs only for the two on-demand paths and the static files keep being served by the asset router without invoking it. not_found_handling: "404-page" stays, so genuine misses still get the real 404 page.

Verified locally

wrangler dev, every request carrying Sec-Fetch-Mode: navigate:

Request	Before	After
GET /scope	404	200
GET /scope/	404	200
POST /api/intake	404	303 → /scope?error=captcha
GET /method/, /privacy/, /experts/robert-jacques/	200	200
GET /nope	404 (real page)	404 (real page)

The POST returning ?error=captcha is correct — no Turnstile token in a curl request.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J53xszP5CdZLXfhRJWsSyv