diff --git a/src/Backend/AutopilotMonitor.Functions/Services/SlaBreachEvaluationService.cs b/src/Backend/AutopilotMonitor.Functions/Services/SlaBreachEvaluationService.cs
index 8f680bf1..26886545 100644
--- a/src/Backend/AutopilotMonitor.Functions/Services/SlaBreachEvaluationService.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Services/SlaBreachEvaluationService.cs
@@ -30,7 +30,9 @@ namespace AutopilotMonitor.Functions.Services
     /// </summary>
     public class SlaBreachEvaluationService
     {
-        private const string DashboardUrl = Constants.WebsiteBaseUrl + "/sla";
+        // Portal host — /sla is an authenticated portal page; www…/sla links in
+        // already-sent notifications reach it via the client-side host bounce.
+        private const string DashboardUrl = Constants.PortalBaseUrl + "/sla";
         private const int MaxConflictRetries = 4;
         private const int MinAppInstallSampleSize = 5;
 
diff --git a/src/Web/autopilot-monitor-web/app/robots.ts b/src/Web/autopilot-monitor-web/app/robots.ts
index 81924bfe..aa3ddeaa 100644
--- a/src/Web/autopilot-monitor-web/app/robots.ts
+++ b/src/Web/autopilot-monitor-web/app/robots.ts
@@ -26,6 +26,7 @@ export default function robots(): MetadataRoute.Robots {
           // query-based since the static export).
           "/sessions",
           "/diagnosis",
+          "/sla",
           "/admin/",
           "/settings",
           "/preview",
diff --git a/src/Web/autopilot-monitor-web/lib/hostRouting.ts b/src/Web/autopilot-monitor-web/lib/hostRouting.ts
index 22cf187e..f6569774 100644
--- a/src/Web/autopilot-monitor-web/lib/hostRouting.ts
+++ b/src/Web/autopilot-monitor-web/lib/hostRouting.ts
@@ -27,7 +27,13 @@ export const PUBLIC_PATH_PREFIXES = [
   "/privacy",
   "/terms",
   "/roadmap",
-  "/sla",
+  // NOTE: /sla is deliberately NOT here. It is a fully authenticated portal
+  // page (ProtectedRoute + token fetches) that only LOOKED public because SLA
+  // notifications historically linked www…/sla. As a public path it dead-ends:
+  // ProtectedRoute stands down on the public host, so the page waits forever
+  // for a sign-in (prod incident 2026-07-29). Off the list, old www…/sla links
+  // bounce to portal/sla where auth works; new notifications link portal
+  // directly (SlaBreachEvaluationService.DashboardUrl).
   "/robots.txt",
   "/sitemap.xml",
   "/IndexNow.txt",