fix: rename the Projects org settings URL to /settings/projects

[claude]

Requested by Chris Arderne · Slack thread

What changed

Before: the org settings page that lists projects lived at /orgs/:organizationSlug/settings/runtime-updates. The page had already been rebuilt into a general "Projects" page — it is titled "Projects" and the side-menu item is "Projects" — but the URL still described only the runtime-update banner that sits at the top of it.

After: the page lives at /orgs/:organizationSlug/settings/projects. The old settings URL /orgs/:organizationSlug/settings/runtime-updates still works: it redirects to the new one, keeping the org slug and any query string.

How: the route folder was renamed from _app.orgs.$organizationSlug.settings.runtime-updates to _app.orgs.$organizationSlug.settings.projects (the flat-route filename is the URL segment). The path helper organizationRuntimeUpdatesPath became organizationProjectsPath, matching its siblings organizationTeamPath / organizationRolesPath / organizationSsoPath, and the page component was renamed RuntimeUpdatesPage → ProjectsPage. The redirect at the old segment is a redirect-only loader following the convention already used by orgs.$organizationSlug.team.ts, orgs.$organizationSlug.usage.ts and orgs.$organizationSlug.billing.ts. The /_/ deeplink table gains a projects key, so /_/projects lands on the new URL. There is deliberately no runtime-updates deeplink alias: /_/runtime-updates is not a recognised key, so it falls through to the generic unknown-deeplink behaviour and redirects to the caller's default environment dashboard, exactly like any other unrecognised /_/ path. The redirect for the old settings URL is a separate thing and is unaffected.

Names that describe the runtime-update feature rather than the URL — projectRuntimeUpdates.server, organizationHasProjectRuntimeUpdate, the ProjectRuntimeRow type — are unchanged, since they are still accurate.

---

✅ Checklist

• I have followed every step in the contributing guide
• The PR title follows the convention.
• I ran and tested the code works

---

Testing

• pnpm turbo run typecheck --filter webapp — passes (20/20 tasks).
• pnpm --filter webapp run lint — clean.
• pnpm --filter webapp exec vitest run app/utils/deeplinkPages.test.ts — 27/27 pass.
• pnpm run format / pnpm run knip — clean (ran via the pre-push hook).

The deeplink unit test covers /_/projects resolving to the projects page, and pins that runtime-updates is absent from the org deeplink table so the alias cannot creep back in.

---

Changelog

The org settings "Projects" page moved from /settings/runtime-updates to /settings/projects. The old settings URL redirects to the new one.

---

Screenshots

No visual change — the page itself is untouched, only its URL.

💯

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3cf89da

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Observability map

As of 3cf89da.

19/100 over 445 measured of 462 entry points (base 19, no change)

What this PR changed

route	base	head	now failing
/_app/orgs/:organizationSlug/settings/projects	new	0	request-context
/orgs/:organizationSlug/settings/runtime-updates	new	not measured

1 entries removed

FIX FIRST

• /api/v1/projects/:projectRef/envvars (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 22 of 445 entry points name a tenant on a failure path. 344 appear only here, 39 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
  error-classification  179 applicable, 102 pass,   0 sole, global without it 12
  auth-boundary          62 applicable,  57 pass,   0 sole, global without it 16
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 19
  request-context       445 applicable,  22 pass, 244 sole, global without it 64
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

The score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md.

[devin-ai-integration]

Devin Review found 1 new potential issue.