C-437: Root Discovery Bridge — apex robots/sitemap/llms.txt + Cycle 0 proxy

epicon_id: EPICON_C-437_CORE_root-discovery-bridge_v1
ledger_id: kaizencycle
scope: core, docs
mode: normal
issued_at: 2026-09-18T00:00:00Z
expires_at: 2026-12-17T00:00:00Z
justification:
  VALUES INVOKED: transparency, non-duplication, verifiability, provenance.
  REASONING: The Cycle 0 / Virtue Accord discovery PR (mobius-browser-shell
    #103) was built on an unverified assumption that Browser Shell served
    mobius-substrate.com's root domain. A follow-up check against actual
    Vercel project domains found otherwise: the apex belongs to a separate
    project, mobius-landing, which is part of this repository
    (apps/mobius-landing). All discovery URLs published in #103 (canonical
    links, llms.txt, sitemap.xml) pointed at a domain that never served
    that content. The maintainer's direction was explicit: do not move the
    apex domain away from mobius-landing, do not settle for
    chambers.mobius-substrate.com as the only canonical location, and do
    not duplicate Cycle 0's text into a second app. This PR builds the
    requested Root Discovery Bridge instead, scoped narrowly to
    apps/mobius-landing plus one doc correction. This EPICON record exists
    because sentinel-review.yml's REQUIRE_EPICON hard rule requires a
    docs/epicon/* record on any PR it reviews; this file satisfies that
    while mirroring the same intent block already published in the PR
    body (Mobius-Substrate#450), per EPICON-02's own no-duplicate-source
    intent.
  ANCHORS:
    - mobius-browser-shell#103 (merged) and its own Codex review thread,
      where the topology gap was first surfaced and the maintainer's
      Option 3 (reverse-proxy from apex, not domain reassignment) was
      chosen
    - Vercel project API: mobius-browser-shell's only Mobius domain is
      chambers.mobius-substrate.com; mobius-landing owns
      mobius-substrate.com and www.mobius-substrate.com
    - apps/mobius-landing's existing app/ directory before this PR
      (app/page.tsx, app/[...page]/page.tsx, app/layout.tsx) had no
      robots.ts, sitemap.ts, or llms.txt route at all
  BOUNDARIES: Only apps/mobius-landing (new robots.ts, sitemap.ts,
    llms.txt route, a small lib/site.ts constant, and three lines of
    next.config.mjs rewrites) plus this docs/epicon record and one other
    doc correction (FIVE_SURFACES.md). No change to mobius-browser-shell
    or its canon content in this PR; no DNS/domain reassignment in
    Vercel; no duplication of Cycle 0 or Virtue Accord text into this
    app, since both proxy through to Browser Shell's existing pages
    unmodified.
  COUNTERFACTUAL: If the rewrite proxy breaks canonical-link resolution
    or introduces a redirect loop, revert next.config.mjs's rewrites()
    addition alone; robots.ts/sitemap.ts/llms.txt route stand
    independently of it. If a maintainer wants epicon.mobius-substrate.com
    listed in llms.txt, that requires provisioning the subdomain first —
    it was deliberately left out here because no such domain exists yet
    in this org's Vercel projects or docs.
counterfactuals:
  - If a human reviewer finds the proxy destination wrong, fix next.config.mjs's rewrites() array; no other file needs to change.
  - If ZEUS flags the /ops Disallow as out of stated scope, revert that one line independently — not load-bearing for the discovery bridge.
  - If next build still cannot be validated in CI the way it failed locally, that is a CI-environment question (Google Fonts egress), not a defect in these files.