SITE_URL and middleware's CANONICAL_HOST are two literals for one value, with nothing enforcing agreement

[hotlong]

Residual of #199, filed rather than left to dissolve into that merge. The dev who did #204 named it and correctly declined to do it, because the repair needs a fourth file the card had not granted.

State after #204

app/layout.tsx now derives metadataBase from SITE_URL. middleware.ts deliberately does not import it, and that decision is sound and measured — pointing middleware.ts at @/lib/seo grows the edge runtime bundle from 149,491 B to 14,849,913 B, roughly 99x, because lib/seo.ts imports lib/source.ts and pulls the whole MDX collection into the edge graph.

The part that makes it a card rather than a note: in that state next build still exits 0. No gate reports it. This app deploys to Cloudflare Workers, so the cost arrives at deploy time.

So both sides keep a literal, and both now carry a comment stating why. What neither carries is enforcement:

location	value
lib/seo.ts SITE_URL	the canonical host, for all page and route metadata
middleware.ts CANONICAL_HOST	the same host, for the domain redirect

Nothing fails if they drift. If they drift, the redirect sends traffic to one host while every canonical tag, og:url and hreflang alternate on the site names another — which is the specific failure this whole run of cards has been closing.

The repair

A leaf module — apps/docs/lib/site.ts — exporting the host string and nothing else, imported by both lib/seo.ts and middleware.ts.

It only works if it is genuinely a leaf. It must import nothing: not @/lib/source, not @/lib/i18n, not fumadocs, not anything that transitively reaches the MDX collection. If it imports anything, it reintroduces the 99x bundle and the build will still exit 0 while it does.

Acceptance — the size is the acceptance criterion, not a sanity check

• Read the edge runtime JS size from the build output before and after, and report both numbers. It must stay at the current baseline (149,491 B at 3433803, but re-measure rather than assuming that figure still holds). A build that exits 0 proves nothing here.
• If it grows at all, stop and report. Do not ship it and note the size.
• Rendered metadata must be unchanged. Use fix(docs): collapse the metadataBase hostname into SITE_URL, record the middleware decision #204's method — extract every URL-bearing head tag across the prerendered pages and diff those rows. A raw byte diff of .next is useless: Next salts every build with a fresh build ID, so all outputs differ between any two builds.
• The domain redirect must still work. fix(docs): collapse the metadataBase hostname into SITE_URL, record the middleware decision #204 exercised it against a running server across six cases including query preservation and the legacy /cn/ locale control; reuse that table.

Priority

Low. This is cleanup of a duplication that is currently correct and documented on both sides. It is filed because "currently correct and documented" is exactly the state that decays silently, and because the repair is small if the leaf-module constraint is respected.

[hotlong]

Unblocked — #225 merged (0c4351f). Dispatching. This is the last card in the queue.

Claim: PM loop round 17
Session: session_01G5zjYc2BoFV2NjKBBapC7C
Branch: claude/issue-205-site-host-leaf-module
Worktree: objectos-issue-205
Domain: n/a (objectos carries no domain:* lanes)
File surface: apps/docs/lib/site.ts (new), apps/docs/lib/seo.ts, apps/docs/middleware.ts, apps/docs/app/layout.tsx. Stop on breach; explain in the report.
Container and model: M, mode:subagent, model: opus — the acceptance criterion is a measurement that no gate performs.
Clause-②: no
Serial constraints cleared: nothing in flight. middleware.ts has been rewritten three times today — #204 (CANONICAL_HOST/LEGACY_HOST hoisted), #223 (truncation walk), #225 (folded index and the pathnameHasLocale 308). Base on current main and read the file; the card's picture of it is three revisions stale.

The size is the acceptance criterion, not a sanity check

Read the card, and take this seriously rather than as boilerplate: pointing middleware.ts at @/lib/seo grows the edge runtime bundle from 149,491 B to 14,849,913 B — roughly 99x — because lib/seo.ts reaches lib/source.ts and pulls the whole MDX collection into the edge graph.

And next build exits 0 while it does. Every gate we have passes. This app deploys to Cloudflare Workers, so the cost lands at deploy time on a change that looked like an import cleanup.

So:

• Read the edge runtime JS size from the build output before and after, and report both numbers. Re-measure the baseline rather than assuming 149,491 B still holds — three PRs have touched middleware.ts since that figure was taken.
• If it grows at all, stop and report. Do not ship it with a note about the size.
• apps/docs/lib/site.ts must import nothing. Not @/lib/source, not @/lib/i18n, not fumadocs, not anything that transitively reaches the MDX collection. If it needs an import to do its job, the job is wrong — stop and report.

Verification

• Rendered metadata unchanged, by fix(docs): collapse the metadataBase hostname into SITE_URL, record the middleware decision #204's method: extract every URL-bearing head tag across the prerendered pages and diff those rows. A raw byte diff of .next is useless — Next salts every build with a fresh build ID, so all outputs differ between any two builds. Note the page count is now 1140, not the 577 fix(docs): collapse the metadataBase hostname into SITE_URL, record the middleware decision #204 recorded, since zh-Hant shipped.
• The domain redirect still works. fix(docs): collapse the metadataBase hostname into SITE_URL, record the middleware decision #204 left a six-case table and fix(docs): match language tags case-insensitively, key folded and value never #225 re-ran it; reuse it, including query preservation and the legacy /cn/ control.
• node .github/scripts/check-locale-surface.mjs exit 0 at 409 URLs.
• pnpm turbo run type-check, build, test all exit 0.

The turbo cache is shared across worktrees and has actually replayed a sibling's green on this repo today — use --force where a comparison depends on it, and capture exit codes before any pipe.

What "done" looks like

Two literals for one value become one definition, and the reason middleware cannot import lib/seo stays written down where someone would be standing when they were about to try it. If the leaf module turns out not to be a leaf, saying so with the size measurement is a complete and acceptable outcome — the card exists because nothing enforces the two values agree, and establishing that they cannot be collapsed cheaply is worth knowing.

---

Generated by Claude Code

[hotlong]

os-dev-report

{
  "issue": 205,
  "status": "done",
  "branch": "claude/issue-205-site-host-leaf-module",
  "pr": "https://github.com/objectstack-ai/objectos/pull/227",
  "premise_still_valid": true,
  "summary": "apps/docs/lib/site.ts now holds the canonical host and nothing else (one exported string, zero imports); lib/seo.ts derives SITE_URL from it and middleware.ts redirects to it, so the two literals are one definition. app/layout.tsx needed no change - it still takes SITE_URL from lib/seo.ts, which continues to export it. The leaf held: edge runtime JS is 149,745 B before and 149,745 B after, and the three chunk files are byte-for-byte identical (same content-hashed names, same sizes), so the import adds no wrapper overhead at all. Beyond the card: the one remaining definition is now enforced, because check-locale-surface.mjs keeps a deliberately independent copy of the host and compares it against a sitemap built through lib/seo.ts - proved by mutating SITE_HOST and watching that gate go to exit 1 with 818 findings.",
  "tests": "All at branch head 98ecc0e, all turbo runs with --force (shared cache across worktrees), every exit code captured before any pipe. EDGE SIZE (the acceptance criterion) = sum of the JS chunks the middleware entry names in .next/server/middleware-manifest.json; next build prints no middleware size. Baseline re-measured at 0c4351f: EDGE_RUNTIME_JS_BYTES=149745 (not the 149,491 B the card carried; +254 B from #223/#225). Noise floor established first: a second build of unmodified source gave EDGE_RUNTIME_JS_BYTES=149745 again and a 0-line metadata diff, so the deltas below are measurements. Branch: EDGE_RUNTIME_JS_BYTES=149745, delta 0 B, identical chunk list ([root-of-the-server]__07_86ae._.js 139218 B in both). ABLATION (middleware.ts importing @/lib/seo): full rebuild via turbo run build --force, ABLATION_BUILD_EXIT=0, EDGE_RUNTIME_JS_BYTES=17375914 - measured on this tree, not quoted; the card's 14,849,913 B is stale, today it is 116x not 99x. Mutation confirmed on disk BEFORE the build by grep counts on both the injected and the removed text (ON_DISK: injected_seo_import=1 removed_site_import=0 injected_use=1 removed_use=0); restore ran from a trap on EXIT/INT/TERM with absolute paths, verified RESTORE_OK hash=9e985bacce0d8d92c1b36a606cd958303b02e92b matching the HEAD blob and RESTORE_DIFF_EMPTY=yes; the tree was then rebuilt so no later reading came off the mutated dist. SECOND ABLATION (SITE_HOST set to docs.objectos.invalid, ON_DISK: injected=1 removed_original=0, full rebuild): check-locale-surface.mjs exit 1, '.locale surface: 818 finding(s)'; restored RESTORE_OK hash=c06578ea480c9e3b33dc4f2dc5481078ae611cad, RESTORE_DIFF_EMPTY=yes, then rebuilt. Side reading from that run: 149750 B, exactly 5 B more, the hostname length difference - the string is inlined and the size tracks it byte for byte. METADATA (#204's method): every URL-bearing link/meta tag in the head of all 659 prerendered HTML files plus every absolute URL in robots.txt, sitemap.xml, llms.txt, llms-full.txt; ROWS=12696; diff baseline vs branch exit 0, 0 lines. No byte diff of .next attempted. REDIRECT TABLE against next start on the branch build, 6 cases plus 4 controls, all as expected: legacy host to canonical 308 (case 1), query preserved '?utm_source=x&q=a%20b' becomes '?utm_source=x&q=a+b' (case 2), root 308 (case 3), canonical host 200 (case 4), legacy /cn/ 308 to /zh-Hans (case 5), domain rule ordered before locale rule (case 6), and #225's controls /zh-Hant 200, /zh-hant 308, /en 307 intact. Server killed by explicit PID after confirming /proc/PID/cwd was inside this worktree; SERVER_ALIVE_AFTER_CLEANUP=no. GATES: turbo run build --force --filter=@objectos/docs exit 0, 1140/1140 pages; turbo run type-check --force --filter=@objectos/docs exit 0; turbo run test --force exit 0; node .github/scripts/check-locale-surface.mjs exit 0 with sitemap.xml read 409 / in scope 409 / expected 409 / unexpected 0 / missing 0. One caution recorded rather than hidden: an earlier locale-surface invocation returned exit 1 from the wrong cwd - that was MODULE_NOT_FOUND, not a red gate; re-run from the repo root it is exit 0, and the 409 figure above is from that run. No changeset: this repo has no .changeset directory and no changeset workflow.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #226: the legacy-host redirect compares the raw Host header, so www.objectos.app:8080 gets 200 instead of the canonical 308, while the same block explicitly clears the port on the target side; low severity, likely zero in production behind Cloudflare on 443"
  ]
}

---

Generated by Claude Code

[hotlong]

ACCEPT — merging #227.

CI 2/2 green on 98ecc0e, three files plus the new leaf module, exactly the granted surface.

The size was measured with a noise floor, which is what makes 0 B evidence

tree	edge runtime JS
baseline 0c4351f	149,745 B
baseline rebuilt, no source change (control)	149,745 B
this branch	149,745 B
ablation: middleware.ts importing @/lib/seo	17,375,914 B

The control row is the one I did not ask for and the one that turns this into a measurement. Without it, "the number did not change" is a hope; with it, two builds of unmodified source are known to produce the identical byte count, so a 0 B delta means something.

And it did not stop at equal totals: the three chunk files are byte-for-byte identical to the baseline, same content-hashed names. The bundler inlines the imported constant exactly as it inlined the local one.

Both figures I had been repeating were stale, and you re-measured rather than quoting. The baseline is 149,745 B, not 149,491 B — 254 B higher, consistent with #223 and #225 landing since. More importantly the ablation on today's tree is 17,375,914 B, 116x rather than 99x, and growing with the collection. I have been citing 99x in every dispatch today; the hazard is worse than the number I was propagating, and it gets worse as content is added.

You answered the card's actual question, not just its request

The card asked for one definition. What it was for was that nothing failed if the two values drifted — and one definition alone only removes the drift, it does not add enforcement.

check-locale-surface.mjs keeps its own copy of the host deliberately, as the independent oracle. sitemap.ts builds through lib/seo.ts, which now derives from SITE_HOST — so the gate transitively pins the middleware's redirect host, which it could not do before. Proven, not asserted: SITE_HOST set to docs.objectos.invalid, rebuilt, gate exits 1 with 818 findings, then restored and verified by hash.

That is the difference between "they can no longer disagree" and "if this one moves, something goes red."

And the 5-byte observation is the best incidental evidence in the whole run. The invalid-host build came in at 149,750 B — exactly the length difference between the two hostnames. The host string is inlined into the edge chunk and the size tracks it byte for byte, which independently confirms that nothing but the string crosses the import. Nobody asked for that and it is the strongest single line of proof that the leaf is a leaf.

The rest

Metadata unchanged by #204's method, extended: 12,696 rows across 659 prerendered HTML files plus every absolute URL in robots.txt, sitemap.xml, llms.txt and llms-full.txt. Zero differing lines — and a control diff (baseline vs its own rebuild, also zero) proving the extraction is build-salt-insensitive rather than merely quiet.

The redirect table re-run with three extra controls for what #223 and #225 established, including case 6 as the ordering control: the domain rule runs before the legacy-locale rule, so the host is corrected first and /cn/ is handled on the next hop. Testing the interaction between two rules rather than each in isolation is what catches an ordering change nobody meant to make.

app/layout.tsx needing no change — because it takes SITE_URL from lib/seo.ts, which still exports it — is the right outcome and worth stating: the granted surface was three files and only two moved.

#226 graded pm:queue / Bug, low priority, direction adjudicated. The asymmetry argument in it is strong — the same block clears the port on the target side, so the port was considered on one side and not the other — and the honest "low, possibly zero in production" severity is what lets it be scheduled rather than inflated.

Closing the chain

This was the last card in the queue. Twenty-eight merged since the keyword-optimization question was asked. What remains is with the maintainer: #171 (whether docs.objectos.ai cedes head terms to www.objectos.ai — blocking #167) and #197 (the fumadocs stringifier route, with #160 held behind it).

---

Generated by Claude Code