Explain route exposure decisions

docs/fixture-manifests.md

@@ -60,8 +60,8 @@ Fixture interaction policy defaults to:
 Protocol-level options can declare the base fixture policy that AMPB should check.
 
 When `[[site.interactions.route]]` entries are configured, AMPG emits additional fixtures
-for public route groups. Routes with `tier = "internal"` or `public_allowed = false` are
-not emitted.
+for public route groups. Routes with `tier = "internal"`, `public_allowed = false`, or a
+match covered by `deny_routes` are not emitted.
 
 Routes imported from `site.interactions.route_manifest` are treated the same way as inline
 TOML routes.

docs/interactive-apps.md

@@ -66,6 +66,22 @@ Optional top-level fields:
 - `default_tier`: inherited by route entries without a `tier`.
 - `deny_routes`: route patterns that must not be published.
 
+## Route Exposure Checks
+
+Use route checks before publishing an application target:
+
+```sh
+python3 -m ampg --config gateway.toml routes explain
+python3 -m ampg --config gateway.toml routes validate
+```
+
+`routes explain` prints one decision per route and enabled protocol. Decisions include the
+route source, tier, protocol `max_tier`, status, and reason.
+
+`routes validate` exits nonzero when a public, non-denied route has no compatible enabled
+protocol. Routes marked `internal`, `public_allowed = false`, or matched by
+`deny_routes` are treated as intentionally unpublished.
+
 ## Protocol Mapping
 
 | Tier | Clearnet | Tor/I2P | Gemini | IPFS | Reticulum |