[nedtwigg]

Moves the one-time phone page off Pocket's origin onto its own, try.dormouse.sh, so the origin that renders what a link sends holds no paired phone's keys.

What changes

• New Worker dormouse-try: serves the page and the client route, and implements OneTimeRoom. It has no Hyperdrive and no secret.
• Relay Worker: keeps the Burrow route and binds the room by script name. It no longer has a page, assets for one, or a client route.
• Link: a stock Hosted build writes HOSTED_ONE_TIME_ORIGIN into the link it shows, as https://try.dormouse.sh/connect/#…. Its socket stays on the relay origin, and it never connects to the new origin.
• Socket origin: the client route admits only the try Worker's APP_ORIGIN, so a page on the relay's origin cannot join.
• Frames: the frame Worker's frame-ancestors now names both origins (CLIENT_ORIGINS), and frameDomainFor admits both.

Links from older builds

Older builds show https://relay.dormouse.sh/connect/#… and mint on the relay's Burrow route. Both keep working:

• The relay answers /connect and /connect/ with a 308 to the new origin. A browser carries the fragment across the redirect, and the prologue binds no origin, so the same link completes unchanged.
• Rooms minted on the relay and joined from the page's origin share one namespace.

The old path therefore renders nothing from the first deploy that includes this, with no grace period. The redirect stays while a shipped Burrow may show such a link. A phone that already had the old page open at the moment of the deploy reads generic failure copy at its Connect tap and needs a new link.

Previews and local development

• Previews: each PR gets dormouse-try-pr-N, wired to that PR's relay.
• Local: dor tool one-time runs both Workers, the relay at PORT and the try Worker on the next port, sharing the room through Wrangler's local registry.
• Dev builds: a dev Hosted build's link names its relay origin and takes the redirect, so no second origin is baked.

Deploy order

Production deploys frames, try, relay, voice, then account. The try Worker must pass its revision check and page smoke before the relay starts redirecting to it. The relay's v3 migration deletes its old OneTimeRoom and is a rollback floor.

Hosted production must run before any desktop release built from this. docs/specs/deploy.md -> "Release checklist" states this. The new hostname also needs setup before the release; see hosted/README.md -> "Provision the production boundary", step 5.

Decision to check

The link keeps the /connect/ path on the new origin, so old and new links share one grammar and dev builds need no second baked origin. https://try.dormouse.sh/#… would be shorter, but it would need a second link shape or a dev-only baked origin.

Testing

• pnpm test at the root passes except one unrelated timing failure: lib/src/lib/lath/group-drop.test.ts hit its 5 s timeout under load and passes when run alone. The Postgres-backed relay, relay-room, workers, and billing suites pass, and so do pnpm build:hosted with its Wrangler dry runs, tsc -b in lib, and tsc --noEmit in standalone/.
• Real Chrome on localhost, against both Workers under wrangler dev: a link at the relay's old path followed the 308, kept its fragment, and reached the Connect screen on the page's origin. Connect joined a room minted on the relay, and the Burrow stand-in received the init frame. That run predates the last refactor of the dev configs and the rename to try.dormouse.sh, which change names and strings and which the unit tests and Miniflare suites cover.
• New tests were checked by removing the line each pins, and each went red.
• Not tested: a real Cloudflare deploy, including the cross-script room binding and the v3 deletion, and the redirect in Safari on a real phone.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	7d5e1ed
Status:	✅  Deploy successful!
Preview URL:	https://41194d92.mouseterm.pages.dev
Branch Preview URL:	https://one-time-own-origin.mouseterm.pages.dev

View logs

[dormouse-bot]

One stale comment outside the diff: OneTimeRoom.fetch in hosted/server/one-time-room.ts still says it is "Reached only through oneTimeRoutes", which this PR splits into oneTimeBurrowRoute (relay Worker) and oneTimeClientRoute (connect Worker). Since the room is now reached from two Workers, the comment is the one place a reader learns who has already checked the upgrade, Origin, room id, and rate limit, so it's worth naming both. I can push that one-line fix if you want it.

[nedtwigg]

The stale comment is fixed in 361a0a5: OneTimeRoom.fetch now names oneTimeBurrowRoute on the relay Worker and oneTimeClientRoute on the connect Worker. No other code still names oneTimeRoutes; the one remaining spelling, in scripts/e2e-lint-selftest.mjs, is a planted name that tests the Relay rule, so it stays. No need to push the fix.