<?xml version="1.0" encoding="UTF-8"?>
<!--
  The eight routes in App.tsx that render for a signed-out visitor. Everything
  else either needs an account (nothing to show a crawler) or carries a token
  in its URL, where the token IS the credential — `/s/` and `/invite/` are
  disallowed in robots.txt for exactly that reason and must never appear here.

  This file exists because its absence could not be seen. The SPA catch-all
  rewrite in vercel.json answers ANY unmatched path with index.html at status
  200, so `curl /sitemap.xml` returned "200 text/html" and every tool that
  checks by status code reported a sitemap that was never there. Noticed in
  round 20, written in the 2026-11-03 SEO audit.

  It is hand-written rather than generated, and that is a deliberate trade: a
  generator reading App.tsx would have to decide which routes are public, and
  "public" is not something App.tsx states — each page decides for itself
  whether to render a sign-in prompt. Guessing it wrong leaks a token route
  into a search index.

  The guard test (src/__tests__/sitemap-public-routes.test.ts) therefore checks
  the two directions that CAN be read off the source: that every URL here
  matches a real static route, and that none of them is under a robots.txt
  Disallow prefix. It cannot check the direction that matters most — that a
  newly added public page was remembered here. Adding a page meant to be found
  means adding a line here by hand.

  No <priority> and no <changefreq>: Google ignores both, and has said so.
  <lastmod> is only honoured when it is accurate, so it is omitted rather than
  stamped with a build date that would claim every page changed at once.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://www.chordnest.net/</loc></url>
  <url><loc>https://www.chordnest.net/tuner</loc></url>
  <url><loc>https://www.chordnest.net/metronome</loc></url>
  <url><loc>https://www.chordnest.net/tools</loc></url>
  <url><loc>https://www.chordnest.net/pro</loc></url>
  <url><loc>https://www.chordnest.net/privacy</loc></url>
  <url><loc>https://www.chordnest.net/terms</loc></url>
  <url><loc>https://www.chordnest.net/delete-account</loc></url>
</urlset>
