Intent: an agent that guesses a path wrong gets a refusal it can read, not a 10 KB page.
Seen: GET /nope with Accept: application/json answers text/html; under /api/v1 the 404 is already JSON.
Done:
[ ] an unrouted path whose Accept prefers application/json over text/html answers 404 {"error":"not_found","message":…,"docs":"<origin>/llms.txt"} with the security headers
[ ] a browser's Accept still gets the HTML not-found page
[ ] a test for both
Files: the router's fallback, one test.
Risk: keep the decision to Accept alone; never sniff the user agent.
Intent: an agent that guesses a path wrong gets a refusal it can read, not a 10 KB page.
Seen:
GET /nopewithAccept: application/jsonanswerstext/html; under /api/v1 the 404 is already JSON.Done:
application/jsonovertext/htmlanswers 404{"error":"not_found","message":…,"docs":"<origin>/llms.txt"}with the security headersFiles: the router's fallback, one test. Risk: keep the decision to Accept alone; never sniff the user agent.