Audit follow-up: URL-mapped LIVE page can NPE when detail-page asset has no live version

Parent epic: #36004

Finding

For URL-mapped pages in LIVE mode, HTMLPageAssetRenderedAPIImpl appears to assume the detail-page asset has a live inode. If getLiveInode() returns null, the flow can produce a present Optional around a null page and later dereference htmlPageUrl.htmlPage.toString().

Report references: dotCMS/src/main/java/com/dotcms/rendering/page/HTMLPageAssetRenderedAPIImpl.java:545-546, dotCMS/src/main/java/com/dotcms/rendering/page/HTMLPageAssetRenderedAPIImpl.java:393-395

Potential impact

A plausible publishing misconfiguration may give frontend visitors or Page API callers a 500 instead of a clean 404.

Suggested validation

Use URL-mapped content where mapped content is live but the configured detail page asset has no live version, then request the page in LIVE mode.

Possible fix

Return null/empty when the live inode is blank or the resolved page is null, allowing the existing not-found handling to run.

Caveat

This was AI-found by Claude from .scratch/audit/REPORT.md. Please perform secondary validation of correctness, severity, and value before actioning.

Start in dotCMS/src/main/java/com/dotcms/rendering/page/HTMLPageAssetRenderedAPIImpl.java at lines 393-395 and 545-546, then trace the LIVE-mode URL-mapped page flow. Reproduce the case where mapped content is live but its detail-page asset has no live version, and confirm that the request reaches existing not-found handling rather than returning a 500.