An unauthenticated visit to / now lands on the public /welcome page instead of bouncing straight to Dex. Deeper guarded paths still redirect to /auth/login so the post-login round-trip returns the visitor to the page they asked for. isPublicPath runs first, so no redirect loop. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>