fix(fresh-ui): /design ships ungated — the defect class RFC 0005 guards against

[rickylabs]

Authority: RFC 0005 — DevTools contribution architecture §5 H-8 (merged on main).

Summary

The scaffolded /design route group ships to generated projects with no dev-only gate. RFC 0005 records this as an existing instance of the exact defect class the DevTools host is designed to avoid, and files it separately rather than fixing it inside the RFC's scope.

Context

RFC 0005 §5 mandates that the DevTools host be absent from production by two independent mechanisms — structural absence from the app build graph, and a fail-safe !== 'development' runtime refusal. The rationale is cited upstream evidence: Vite DevTools ships into production builds with client auth disabled, and TanStack deliberately distrusted a single signal because hosting providers set build command/mode inconsistently.

/design today has neither mechanism. Verified during the RFC's discovery pass: the (design) route templates contain zero mode-gate matches, and the only MODE read in the scaffold is a log line.

Scope

• Area: packages/cli scaffold assets — the (design)/design/ route group and its templates
• Not part of the DevTools epic; this is a pre-existing scaffold defect

Acceptance

• /design is absent from a production build of a scaffolded app, or is gated behind an explicit opt-in
• gate: an e2e assertion that a production build contains no (design) route output
• the chosen mechanism matches RFC 0005 §5's dual-exclusion posture, or the divergence is recorded

Notes (non-gating)

• Whether /design is intended to reach production users was never established during discovery — that question should be answered before choosing the mechanism.
• RFC 0005 owner fork F-20: "record and file separately; do not fix inside this RFC's scope."