<?xml version="1.0" encoding="UTF-8"?>
<!--
  sitemap.xml — the public, crawlable routes of rollcalltavern.com.

  Every <loc> below is a real route registered in client/src/main.tsx; the
  list was read off that router rather than guessed, and it should be re-read
  from there whenever routes move. Anything token-scoped (/player/:token,
  /join/:token, /lobby/:token), API, or behind a login is deliberately absent
  and is additionally blocked in robots.txt next to this file — see the long
  note there for why a crawled token is a leaked credential.

  <changefreq> and <priority> are omitted on purpose: Google has ignored both
  for years, and a stale hand-maintained priority column is just another thing
  to get wrong. <lastmod> is the one hint that still counts, so it is the one
  we keep — update it when the page's copy actually changes, not on every
  deploy, or it stops meaning anything.

  ⚠️ index.html currently ships a single static <link rel="canonical"> pointing
  at "/" for EVERY route (single-page app, no head manager). That tag tells a
  crawler the deeper pages here are duplicates of the home page, which works
  against this sitemap. Resolving that needs SSR/prerendering or a head
  manager — flagged in index.html, not fixed here.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

  <!-- Front door. HomeRoute renders the marketing page for anon visitors. -->
  <url>
    <loc>https://rollcalltavern.com/</loc>
    <lastmod>2026-08-20</lastmod>
  </url>

  <!-- Public site pages (Home WP v2) — the feature tour and the session
       walkthrough, both linked from the MarketingShell nav. -->
  <url>
    <loc>https://rollcalltavern.com/features</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://rollcalltavern.com/how-it-works</loc>
    <lastmod>2026-08-20</lastmod>
  </url>

  <!-- Docs: the index plus each topic page nested under DocsLayout. These are
       the pages most likely to earn search traffic on their own ("how do I
       run a battlemap", "shared dice rolls"), so they are listed
       individually rather than left for the crawler to discover. -->
  <url>
    <loc>https://rollcalltavern.com/docs</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://rollcalltavern.com/docs/getting-started</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://rollcalltavern.com/docs/the-workbench</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://rollcalltavern.com/docs/running-a-session</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://rollcalltavern.com/docs/dice</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://rollcalltavern.com/docs/maps</loc>
    <lastmod>2026-08-20</lastmod>
  </url>

  <!-- Auth entry points. Ungated by design (they have to work while logged
       out) and linked from every marketing page, so they are legitimately
       crawlable — unlike /reset-password and /verify-email, which are
       single-use emailed token links and stay out of here. -->
  <url>
    <loc>https://rollcalltavern.com/register</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://rollcalltavern.com/login</loc>
    <lastmod>2026-08-20</lastmod>
  </url>

  <!-- Published legal documents. Listed because people (and app stores, and
       payment processors) look for them directly, and because a findable
       policy is part of the point of publishing one. -->
  <url>
    <loc>https://rollcalltavern.com/tos</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://rollcalltavern.com/privacy</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://rollcalltavern.com/dmca</loc>
    <lastmod>2026-08-20</lastmod>
  </url>

</urlset>
