Summary

Visiting a CP URL with an invalid item (e.g. /cp/collections/invalid, /cp/collections/blog/entries/missing-id, invalid terms, etc.) rendered a blank page with a JS error instead of a 404. Logged-out users hitting the same URLs also got the blank page instead of being redirected to login.

Why

Route binders throw NotFoundHttpException inside SubstituteBindings, which is in the outer statamic.cp middleware group. That fires before the inner statamic.cp.authenticated group, so HandleAuthenticatedInertiaRequests never runs and the Inertia response is missing _statamic.sessionExpiry/nav. The default layout mounts SessionExpiry.vue, which destructures the missing prop → TypeError → blank page.

For the same reason, Authorize (which normally redirects unauthenticated users to login) never gets a chance to run when the binder throws first.

Changes

• resources/js/pages/errors/404.vue — use the Blank layout, matching errors/Error.vue. Error pages shouldn't depend on auth-only CP chrome props.
• src/Exceptions/Concerns/RendersHttpExceptions.php — when an HTTP exception fires on a CP route without a current user, return AuthenticationException::toResponse() (login redirect) instead of rendering the error Inertia page. Matches what Authorize would have produced.
• Added a "Return to Control Panel" button on both error pages.

Note: the catch-all /cp/{segments} 404 route previously rendered inside the full CP chrome (it's declared inside statamic.cp.authenticated, so auth middleware runs for it). With this change it renders on the blank layout too, making the two 404 paths consistent.

Test plan

• Logged in, visit /cp/collections/invalid → shows 404 page (no crash)
• Logged in, visit /cp/collections/<valid>/entries/invalid → shows 404 page (no crash)
• Logged in, visit /cp/not-a-route → shows 404 page
• Logged out, visit /cp/collections/invalid → redirects to login
• Logged out, visit /cp/not-a-route → redirects to login

🤖 Generated with Claude Code