[0xcadams]

What

Save remote HTTP public URLs as deployment-owned bindings alongside private service endpoints. Manager apply can reserve an application URL without a listener address, or assign an installed publisher an explicit HTTP target through the existing signed public URL run lifecycle.

Why

Staging and production URLs must not live in a developer membership or change when a publisher is replaced. A custom hostname must remain separate from the deployment allocation namespace, and retiring that namespace must not release authority while saved URLs, DNS, certificates, or issuance work still exist.

Changes

• Reuse the existing project binding and public URL persistence/run owners; do not add another URL resource or publication engine. Preserve saved hostname and visitor policy across replacements, creator departure, and namespace changes.
• Accept declared remote HTTP public URL settings, capture exact host/domain intent, and retain app listener declarations without inventing a port. Installed workers exclude app-owned listeners.
• Publish explicit-address URL assignments through publisher.Run, with exact ID/hostname/revision checks, verified target/relay TLS, saved limits, readiness, and joined cleanup.
• Allow scoped runtime address/TLS updates on existing explicit-target URLs without policy/hostname changes. Keep app-owned listener declarations manager-controlled.
• Include saved URLs in namespace retirement fences and reject member/sibling namespace claims. Require the exact fresh tnl-control-fresh-v1-deployment-public-urls baseline; regenerate the HTTP models and validators.

Generation and selected owner routine tests passed. All 28 selected deployment/namespace PostgreSQL tests passed before the last explicit-target-update assertion; the two new ownership tests passed again afterward. The signed group callback carried actual HTTP visitor traffic and joined cleanup without allocating/deleting the saved URL. Initial fixture-revision and relay-TLS failures were corrected and repeated. Full CI, packaging, complete affected suites, deployment temporary allocation, independent publish approval, and app-led SDK handles remain for later slices and the requested backwards qualification pass.