Merge pull request #142 from pikasTech/fix/gate-diagnostics-contract

fix: add Cloud Web gate route contract

docs/reference/cloud-workbench.md

@@ -8,7 +8,12 @@ Cloud Workbench is the default user-facing frontend at
 ## Default Route
 
 - `/` must show the Cloud Workbench, not Gate, status, help, or diagnostics.
+- The default first screen must not show Gate, `BLOCKED`, `M0-M5`, or
+  acceptance-review copy. Those terms may remain in hidden/internal views.
 - Gate and diagnostics are secondary routes or right-panel support views.
+- `/gate` and `/diagnostics/gate` are internal diagnostic aliases served by the
+  same Cloud Web app router. They may carry Gate, blocker, and M0-M5 evidence
+  because they are not the default homepage.
 - `http://74.48.78.17:16667/` remains the API/edge boundary.
 - Browser data sources are same-origin `/v1`, read-only `/json-rpc`, source
   reports, gate reports, and blocked reports.
@@ -63,6 +68,11 @@ node web/hwlab-cloud-web/scripts/build.mjs
 node scripts/dev-cloud-workbench-smoke.mjs --static
 ```
 
+The static smoke checks both sides of the route contract: `/` remains the
+user-facing workbench, while `/gate` and `/diagnostics/gate` remain available
+for internal diagnostics. This PR-class check is intentionally source-only and
+does not deploy, restart services, or run browser e2e.
+
 Live checks against `http://74.48.78.17:16666/` are read-only and must report
 blocked/skip instead of false green when the browser or network path is not
 available.