Captured the subdomain split: why the resource identifier is the hard part, not the DNS
Initial version — no prior content to diff against.
One subdomain per surface, and the endpoint sits at that host's root rather than under a path.
So a surface's path carries only a version, or nothing at all — never a prefix repeating what the subdomain already said. And cross-surface paths are a hard 404 in both directions: the API host does not serve the agent endpoint, and the agent host does not serve the API.
Rejected: one host with two path prefixes. It works, and it quietly makes every future decision harder — shared rate limits, shared CORS, shared firewall rules, and no way to point a client at one surface without also handing it the other.
The 404s are the part people skip. They are not tidiness: they are what keeps exactly ONE address per surface, which is the property the next note depends on.