<?xml version="1.0" encoding="UTF-8"?>
<!-- Public, logged-out-reachable pages only, on the canonical host.
     Cloudflare Pages 308-redirects /foo.html -> /foo, so the clean URL is the
     one listed: pointing a crawler at the redirect wastes its budget and splits
     signals across two URLs for the same page.
     dashboard.html is deliberately absent — it is the signed-in home and renders
     an empty shell to a logged-out crawler. -->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://flightway.ai/</loc></url>
  <url><loc>https://flightway.ai/quiz</loc></url>
  <url><loc>https://flightway.ai/pricing</loc></url>
  <!-- S2: the trust surface. Legal pages rank for nothing and that is fine —
       they are listed because a site whose Privacy/Terms are missing from its
       own sitemap looks like a site that does not have them. The list is
       gate-enforced: verify:meta asserts sitemap URLs and the `public` rows of
       its classification table are the same set, in both directions. -->
  <url><loc>https://flightway.ai/privacy</loc></url>
  <url><loc>https://flightway.ai/terms</loc></url>
  <url><loc>https://flightway.ai/security</loc></url>
  <url><loc>https://flightway.ai/contact</loc></url>
</urlset>
