Neither vercel.json rewrites nor redirects nor a _redirects file has any effect:
the origin serves files literally and no routing layer is in front of it (no
Vercel or Pages headers on any response). Leaving dead config in place would
imply the paths are blocked when they are not. protection is robots.txt only
(Disallow: /*.md$) until these docs live outside the deployed tree.
Vercel serves an existing static file before applying a rewrite, so the
previous rewrite block did nothing and the strategy docs returned 200.
Redirects run before the filesystem check, so these now leave the site.
.vercelignore does not take effect on this deployment (growth/PLAN.md
returned 200 live after being added to it), so block /.agents/* and
/growth/* with rewrites to a nonexistent path instead.