Motir

Ask the Public Suffix List to treat the tenant base domain as a suffix, so browsers treat acme.<base> and beta.<base> as different SITES — no shared cookies, no shared storage, separate origins for every isolation rule a browser applies at the registrable-domain level. public-surface-hosts.md §4 named this as "a later refinement that only adds isolation BETWEEN tenants" — this is the card that refinement was owed. It blocks nothing: the separate registrable domain already gives the isolation from app.motir.co; this adds tenant-from-tenant.

Steps (the PSL's own procedure — read https://github.com/publicsuffix/list/wiki/Guidelines first; it changes)

1. Confirm the prerequisites the guidelines state: the domain is live and serving tenant subdomains (the domain card is done), and Motir does not itself need to set a cookie at <base> (the marketing app sets none — confirm by reading motir-marketing's code for Set-Cookie / cookies(); a hit is a stop).
2. Fork publicsuffix/list, add <base> to the PRIVATE section in sorted position with the required comment block (submitter, contact, date), and open the pull request.
3. Publish the _psl.<base> TXT record whose value is the pull-request URL — the list's maintainers verify ownership through it.
4. Follow the pull request to merge; browsers pick the list up on their own release cadence (weeks). Record the merge date and the first browser release that ships it.

Unverifiable-by-construction claims, stated as such: the guidelines' current requirements, the maintainers' turnaround, and whether a .co-style TLD affects eligibility — read them at the time, and if the submission is refused, paste the reason here and stop.

Acceptance criteria

• The pull request to publicsuffix/list is opened with <base> in the private section and its URL is pasted here; the _psl.<base> TXT is read back with dig +short _psl.<base> TXT @1.1.1.1 and pasted.
• On merge: the merge commit URL is pasted, and https://publicsuffix.org/list/public_suffix_list.dat is grepped for <base> with the output pasted.
• A grep of motir-marketing for cookie-setting APIs is pasted showing none at the base domain, or the card is stopped with the hit.

Context refs

• motir-core/docs/decisions/public-surface-hosts.md §4 — "PSL listing is a later refinement that only adds isolation between tenants"; GitHub's Yummy cookies across domains for why the mirrors are listed
• https://github.com/publicsuffix/list/wiki/Guidelines — the submission procedure and the _psl TXT
• the decision — Q1