---
title: Fix Anonymous Visitor Navigation Defects
type: task
status: completed
description: >-
  Fix the League-not-connected warning, the /leagues/undefined/players broken link, and other
  defects an unauthenticated prospect sees while browsing the site.
base_uri: user:task/league/fix-anonymous-visitor-navigation-defects.md
created_at: '2026-08-14T23:23:45.307Z'
entity_id: fa71fcfc-5245-43ae-b5bc-a6c3f89f2241
finished_at: '2026-08-15T03:18:47.820Z'
observations:
  - ████████████████████████████████████████████████
  - ████████████████████████████████████████████████
  - ████████████████████████████████████████████████
  - ████████████████████████████████████████████████
  - ████████████████████████████████████████████████
  - ████████████████████████████████████████████████
  - ████████████████████████████████████████████████
  - ████████████████████████████████████████████████
  - ████████████████████████████████████████████████
owner_identity_uri: █████████████████████████
public_read: true
relations:
  - relates [[user:orchestrator/manager-recruiting-2026/manager-recruiting-2026.md]]
tags:
  - user:tag/league-xo-football.md
updated_at: '2026-09-12T17:41:57.735Z'
visibility_analyzed_at: '2026-11-05T23:49:17.269Z'
---

# Fix Anonymous Visitor Navigation Defects

## Overview

Fix the visible defects an unauthenticated visitor hits, since prospective managers browse the site
logged out. Shipped 2026-08-14; every item below is done and deployed.

## What was wrong and what changed

- [x] **The landing page's call to action did not work.** Following the in-app link to `/leagues/1`
      rendered the DEFAULT league under that URL, with the sidebar still reading "League not
      connected" and no league links at all. `INIT_APP` fires once on mount, so nothing moved the
      connected league on a client-side navigation. A `SELECT_LEAGUE` action now carries the matched
      route's league, a saga pulls the league record, and the app effect fires it whenever the route's
      league id changes — so an in-app navigation lands in the same state as a full page load.
- [x] **The "League not connected" warning** is now rendered only to a signed-in user, for whom it is
      actionable. To everyone else it was the first thing in the sidebar and read as site breakage.
- [x] **"Data Views (Beta)"** is now "Data Views". The label appeared nowhere else in the tree.
- [x] **Trade review reported a refusal as an empty league.** The route is member-only, so every
      anonymous visitor was told "No accepted trades in this league" about a league holding 196. The
      reducer now carries `is_failed` and the page says the page needs a league member's session.
- [x] **`/` stays on the pitch for a visitor with no session.** `RootRoute` redirected on a bare
      league id, and a visitor now picks one up by browsing into a league, so the landing page would
      have become unreachable.
- [x] **Walked the full anonymous browse path** — landing, data views, plays, players, constitution,
      glossary, resources, guides, status, and all fourteen league-1 pages. Everything else renders.

## Not taken

- **The `Players` nav link stays unguarded.** The plan's `/leagues/undefined/players` is wrong:
  `league_defaults.LEAGUE_ID` is `0`, so the link renders `/leagues/0/players`, a working page on
  default league settings. Guarding it would remove a working public surface from the nav.
- **The landing page's missing contact route** — `questionnaire_url = null` is deliberate and the
  replacement is an operator decision.
- **`app/views/pages/players/players.js` age filter** (commented out, marked "TODO — fix") and
  **`app/views/components/app/app.js` auction TODO** for non-logged-in users. Neither is visible to an
  anonymous visitor as breakage; both are latent product work rather than trust defects.

## The `/docs` note, closed

The plan flagged the whole `docs/` directory being fetchable at `/docs` as worth a decision. It is
not: `mistakia/league` is a public GitHub repo and `docs/` is tracked in it, so every file is already
anonymously fetchable from `raw.githubusercontent.com`. Nothing in the corpus carries a credential,
hostname or IP. Whether to serve developer internals off the league's own domain is a presentation
choice, not an exposure.