fix: stop og and llms.mdx routes from caching made-up paths

[josemontesdeoca]

Why the change

The og and llms.mdx route handlers rendered and saved a new file for any made-up name under a real page (such as /og/setup/anything.png), and Next never deletes those files, so scanners could fill the disk; now both routes serve only what the build generated, and CI fails if a request adds a cache file or if any dynamic route can render on demand.

Special things to note

• Some URLs that used to return 200 now return 404: made-up file names under a real page, plus bare /llms.mdx and /llms.mdx/setup, which both served the index page's markdown. Nothing on the site links to them. Page metadata builds these URLs with getPageImage / getPageMarkdownUrl, and the proxy's markdown rewrites end in content.md. Unknown paths under both prefixes now get the HTML not-found page with Cache-Control: no-store instead of an empty 404.
• Each rejected og or llms.mdx request logs one 3-line Error: Internal: NoFallbackError stack. The handler itself rejects without logging, but Next then tries the next matching route, the [[...slug]] page, and that rejection is what gets logged. Unknown pages have logged the same line since fix: stop encoded probes from poisoning the robots.txt cache #15 (upstream: NoFallbackError logged to console.error when dynamicParams = false rejects a param vercel/next.js#90537). It replaces the Failed to update prerender cache warning that unknown og and llms.mdx pages used to print on every request.
• The new prerender-manifest check fails the smoke run for any dynamic route that does not export dynamicParams = false. If a future route really needs on-demand rendering, it has to be exempted in that check on purpose.

Change outline

Both handlers look a page up with the last slug segment dropped, so any file name under a real page resolved to that page. The fix is dynamicParams = false, the same guard #15 put on the page catch-all. With it, the build marks both routes fallback: false:

 .next/prerender-manifest.json → dynamicRoutes
-  "/og/[...slug]"          fallback: null    # render unknown params on demand, then store the result
-  "/llms.mdx/[[...slug]]"  fallback: null
+  "/og/[...slug]"          fallback: false   # not prerendered → 404
+  "/llms.mdx/[[...slug]]"  fallback: false
   "/[[...slug]]"           fallback: false   # since #15

What that does to a made-up path:

 GET /og/setup/anything.png        (likewise /llms.mdx/setup/other.md, /llms.mdx, /llms.mdx/setup)
   /og/[...slug]
-    run GET() for "setup" → Setup's image
-    save og/setup/anything.png.body + .meta      # never deleted
-  200 image/png
+    not prerendered → NoFallbackError, GET() never runs
+  next matching route, /[[...slug]] → not prerendered → NoFallbackError (logged)
+  404 not-found page, Cache-Control: no-store, nothing saved

The if (!page) notFound() checks stay. TypeScript needs them to narrow page, and next dev, which has no prerender manifest, still relies on them for its 404.

CI runs scripts/smoke-standalone.ts against both the public and the preview build. The script gains two checks on the whole build and a probe for each URL shape:

 main
   assembleStandalone
-  build = { robotsBody, robotsMeta }
+  build = { robotsBody, robotsMeta, cacheTree }   # every path under .next/server/app, before the server starts
+  checkPrerenderManifest()                        # names each dynamic route whose fallback is not false
   startServer
   runChecks
     1-3. robots probe, public pages, unknown page   (unchanged)
+    3b. /og/setup/image.png → 200
+        /og/setup/smoke-nonexistent.png, /og/smoke-nonexistent-page/image.png → 404
+    3c. /llms.mdx/setup/smoke-nonexistent.md, /llms.mdx,
+        /llms.mdx/smoke-nonexistent-page/content.md → 404
     4. warm robots probe
     server output has no "app-route received invalid cache entry"
+    server output has no "Failed to update prerender cache"
+    cache tree has no path the snapshot lacks     # lists each new path on failure

The tree check catches writes nobody predicted, and the manifest check covers routes that no probe requests.