moooon's legal documents leave motir-core — /legal moves to motir-marketing, and the core keeps configurable legal links

content/legal/*.md is moooon B.V.'s own contract text, and it is sitting in a GPL-3.0 repository that other people run. This story takes it out.

What is true today (read from origin/main, 2026-08-29)

motir-core ships seven documents — privacy.md, terms.md, dpa.md, subprocessors.md, acceptable-use.md, cookies.md, model-providers.md — rendered by app/(public)/legal/page.tsx and app/(public)/legal/[slug]/page.tsx. They name moooon B.V., its subprocessors and its transfer bases. Anybody who deploys motir-core today serves another company's privacy policy and terms of service from their own domain.

Why this one MOVES rather than being gated

The cloud gate is the right remedy for a capability that only makes sense hosted. This is content: no runtime flag makes moooon's contracts appropriate in an open-source repository, because the problem is not that they are reachable, it is that they are in the tree at all — copied by every fork, carried by every clone, and legally somebody else's. Gating it would leave the text exactly where it is.

What replaces it in motir-core

The application still needs to link to terms and a privacy policy — sign-up, the footer, the cookie notice. So the renderer's REPLACEMENT is configuration, not deletion of the concept: motir-core reads legal-link targets from config, defaults to unset, and renders the links only when an operator has supplied them. That default is a decision to state, not to leave to whoever writes the code — what a self-hosted sign-up page shows when no legal URLs are configured is part of this story.

The referrer sweep is the bulk of the work

The verb here is MOVE, so the referrers are call sites, not cards. Before this story is sized, grep every reader of the legal routes and content and give each hit one of exactly two dispositions — in this story's scope, or a named sibling card. There is no third option, and "the rest later" without a card is the orphan. Known readers to start from, not to finish at: the sign-up and cookie surfaces, the footer, app/sitemap.ts, the OpenAPI/API-docs pages, lib/apiDocs/*, and the legalDocumentSlugs helper app/sitemap.ts calls. And the abandoned path is itself a deliverable: after the content leaves, ask why the route is still there, and delete it in the same story rather than leaving a live invitation to re-adopt.

What motir-marketing receives

The seven documents and a renderer for them, on the host that serves the brand. This half is motir-marketing's and is a normal port: the documents are markdown, they have no database and no session.

Boundary

• It does not decide which host serves motir.co/legal. That is MOTIR-3876's ADR, and this story is blocked_by it — the documents move into whatever origin arrangement that record chooses.
• It does not rewrite the documents. They port across as they are; their content is moooon's legal work, not a planning deliverable.
• It does not touch /docs, which stays in motir-core because it is generated from this repository's own registries.

Verification recipe

1. On a build with no legal URLs configured, open sign-up and the footer — the legal links are absent or point where the operator configured them, and nothing 404s or renders moooon's text.
2. git grep -n "moooon\|content/legal" over motir-core returns only the configuration seam and its tests.
3. motir.co/legal and each of the seven documents render from motir-marketing.
4. motir.co/sitemap.xml lists the legal documents; motir-core's sitemap does not.

Acceptance criteria

• Every child is done. The repository set is motir-core + motir-marketing, one pull request each.
• The seven documents and their renderer are gone from motir-core, and its sitemap no longer emits them.
• motir-core renders legal links from configuration, with a stated and tested default for the unconfigured case.
• The PR body carries the full grep result for every reader of the legal routes and content, with a per-hit disposition — changed here, or a named sibling card.
• The abandoned route is deleted, not left unreferenced, and the sweep for leftovers is recorded.
• motir-marketing serves all seven documents, and motir.co/legal resolves.

Context refs

• motir-core/content/legal/*.md — the seven documents
• motir-core/app/(public)/legal/ — the renderer being removed
• motir-core/app/sitemap.ts · lib/apiDocs/* — known readers; the grep is the population
• motir-marketing — the receiving repository
• MOTIR-3876 — the origin arrangement this story lands into