motir-core answers for motir.co — the host branch, the root route per host, and the two paths forwarded to motir-marketing

Type: code · Executor: coding_agent · Repo: motir-core · ONE PR.

Nothing in this story currently makes motir-core answer for motir.co. MOTIR-3884 redirects app.motir.co/explore and /docs to the brand host, MOTIR-3881 teaches the origin helpers that two origins exist, and the test gates assert the result — but no card gives the application a second hostname to serve, or decides what it does at / on that hostname. This card is that gap, and it is the one the two archived cards used to cover from the wrong direction.

⚠️ READ THE ADR FIRST — this card implements it, and does not pre-empt it

MOTIR-3879 chooses how motir.co is composed from two origins: motir-marketing serves the landing and /legal, motir-core serves /explore, /docs and later /p/*, and two Fly applications cannot both answer an apex. Its recommendation is that motir-core owns the apex and forwards / and /legal/* to motir-marketing — two stable paths, in proxy.ts, which already derives its matcher from the filesystem and has a test asserting it. This card is written against that recommendation and must be re-read against the record as approved. If the ADR chose differently, the deliverables below move to motir-marketing and this card is re-planned rather than stretched.

What it delivers, under the recommended arrangement

1. The host branch. motir-core serves two hostnames with different route sets. proxy.ts gains host-aware rules — it already runs on this application with a matcher enumerated from app/'s filesystem by tests/navigation/proxy-matcher.test.ts, so the branch belongs there rather than in a second mechanism, and the segments arrive through the same filesystem-derived guard, never as a hand-maintained list.
2. / on motir.co. app/page.tsx today resolves to the application root and redirects a signed-out visitor to /sign-in. On the brand host that is wrong: / is the landing, which lives in motir-marketing. Forward it, per the ADR.
3. /legal/* on motir.co — forwarded to motir-marketing for as long as that repository serves the documents (MOTIR-3909 is moving them there). This is the only OTHER forwarded path, and the pair is the whole cross-repo list — keep it that way, and keep it beside the guard.
4. The application host is unchanged. app.motir.co still resolves / to the application and app/(authed)/ is untouched.

⚠️ The deploy of this card must change NOTHING a visitor can see

The apex does not move until the cutover story runs, and the gap between this deploy and that cutover is unbounded. So the host branch is driven by the SAME configured public-site origin MOTIR-3881 introduces, and while that origin is unconfigured it resolves to the application origin — at which point the branch is a no-op and every request is served exactly as it is today. That equal-origins arm is a tested case, not an assumption, and it is what lets this card merge and sit deployed indefinitely.

The session cookie is a constraint, not a consequence

Both hostnames are served by one application, so it becomes possible to widen the Better-Auth cookie by accident. It stays host-only on app.motir.co. PublicTopBar renders UserMenu from the session and PublicAuthDialog returns the visitor to the page they signed in from, so state what a signed-out motir.co renders for those components rather than discovering it. The ADR records the rule; this card is where it is implemented and asserted.

Acceptance criteria

• With the public-site origin configured and different from the application origin: a request to the public host for /explore, /explore/topic/* and /docs is served by this application; / and /legal/* reach motir-marketing; app.motir.co/ still resolves to the application.
• With the public-site origin unconfigured — the deployed state until the cutover — every path behaves exactly as it does today, asserted as its own test arm. No self-redirect, no forwarding, no changed status code.
• proxy.ts's matcher covers the new segments and tests/navigation/proxy-matcher.test.ts still derives its expectations from app/'s filesystem — no hand-listed segment is introduced, and the /admin exclusion it asserts as deliberate is unchanged.
• The forwarded set is exactly / and /legal/*; a test asserts no third path is forwarded, so the cross-repo list cannot grow silently.
• document.cookie's session entry has no Domain= widening: the cookie remains host-only on app.motir.co, asserted.
• ≥90% coverage on the files this PR touches.

Context refs

• MOTIR-3879 — the ADR this card implements; read it as approved before building
• motir-core/proxy.ts · tests/navigation/proxy-matcher.test.ts — the mechanism and its filesystem-derived guard
• motir-core/app/page.tsx — the root route whose behaviour becomes host-dependent
• MOTIR-3881 — supplies the configured public-site origin this branch reads; wired blocked_by
• MOTIR-3909 — moves /legal into motir-marketing, the other end of the forwarded path

Advisory dispositions

• reference → MOTIR-3884 (advisory): not consumed, and the edge runs the OTHER way — 3884 redirects to a host this card makes answer, so 3884 is blocked_by this card, wired by the same plan that adds it. This card consumes nothing 3884 produces; it is named here because the gap it fills is only legible beside the redirect card.