# Functional Design Plan — U1 Hosting & Serving

**Unit**: U1 Hosting & Serving
**Round**: R1 (with U2 Data Durability)
**Requirements**: FR-07, FR-10, FR-24
**Components**: C-04, C-10, C-13, U1 portion of C-16

---

## Step 1: Analyze unit context
- [x] Read the U1 definition from `unit-of-work.md`
- [x] Read the requirement assignment from `unit-of-work-story-map.md`
- [x] Read the carried-in design items — § 5.2 pipeline ordering, missing-directory startup behaviour

## Step 2: Design static-file serving behaviour
- [x] Define mount registration order and request-path resolution for the two mounts
- [x] Define default-file handling per mount
- [x] Define SPA fallback precedence between `/admin/{*path:nonfile}` and `{*path:nonfile}`
- [x] Define behaviour when `wwwroot/web/` is absent at startup
- [x] Define behaviour when `wwwroot/web/` exists but has no `index.html`
- [x] Define trailing-slash handling for `/admin`
- [x] Confirm directory browsing stays disabled

## Step 3: Design the health endpoint
- [x] Define the response contract for healthy and unhealthy states
- [x] Confirm no dependency probing is performed
- [x] Define behaviour while the instance is availability-disabled
- [x] Define what the endpoint must never expose

## Step 4: Design the availability-gate changes
- [x] Define the `/health` bypass placement within the existing prefix list
- [x] Resolve the FR-24 implementation approach — pipeline ordering versus in-middleware validation
- [x] Define admin-bypass behaviour for valid, forged, expired and absent tokens
- [x] Confirm the preserved behaviour: a valid Owner or Administrator token still bypasses the gate

## Step 5: Define business rules
- [x] Enumerate path-resolution rules with precedence
- [x] Enumerate health-reporting rules
- [x] Enumerate admin-bypass rules
- [x] Identify error and edge-case scenarios

## Step 6: Generate artifacts
- [x] Generate `business-logic-model.md`
- [x] Generate `business-rules.md`
- [x] Generate `domain-entities.md`
- [x] Validate all diagrams against the Mermaid standards
- [x] Verify Security Baseline compliance for this unit's design