Origin topology: per-user subdomains, PSL listing, the app-sandbox origin, origin migration

[lannbot]

Decide the origin layout: per-user subdomains, the PSL, the app-sandbox origin, and origin migration. See NOTES.md — Origin topology.

Under static-only there is no server-side tenant state, so per-user subdomains buy client-side isolation: separate IndexedDB/OPFS for device keys and grants on shared browsers (bounded blast radius for a sandbox escape or framework bug), plus quota separation. The dedicated app-sandbox origin is wanted regardless (see the sandboxing issue).

Mechanism: process isolation is per site (eTLD+1), not per origin; Origin-Agent-Cluster is only a hint; siblings can toss Domain=-wide cookies. PSL listing makes each subdomain its own site (the github.io model). Costs: a PSL PR, propagation lag, effective irreversibility, wildcard DNS + cert (ACME DNS-01).

Consequences to record: origin migration = device re-enrollment (origin-rooted storage; non-extractable keys don't move — by design; never fix this by making keys extractable); accountless multi-tenancy (identical bytes on every subdomain ⇒ signup is client-side; the host's only dynamic control plane is wildcard DNS + cert).

Open sub-questions:

• Per-user subdomains at v1, or single origin + sandbox origin only (if one-human-per-browser-profile is the assumed norm)?
• When to list on the PSL (before first hosted user, effectively).
• Migration UX: what re-enrollment looks like when the old origin is still reachable vs gone.