refactor: establish frontend request and state boundaries

docs/governance/architecture-inventory.json

@@ -254,8 +254,8 @@
   "code_hotspots": [
     {
       "path": "static/app.js",
-      "bytes": 449457,
-      "lines": 9447
+      "bytes": 447568,
+      "lines": 9403
     },
     {
       "path": "static/styles.css",
@@ -274,8 +274,8 @@
     },
     {
       "path": "static/index.html",
-      "bytes": 133569,
-      "lines": 1871
+      "bytes": 133691,
+      "lines": 1873
     },
     {
       "path": "database.py",

docs/governance/stage-14-frontend-boundaries.md

@@ -0,0 +1,38 @@
+# Stage 14: Frontend Request and State Boundaries
+
+## Request Boundary
+
+`static/shared/api.js` is now the only application file allowed to call `fetch`. It owns:
+
+- JSON serialization and response parsing;
+- CSRF attachment for mutating requests;
+- expired-session notification;
+- abort signals;
+- NDJSON stream decoding and normalized stream errors.
+
+The mentor and review-assistant streams use the same client as ordinary API requests. Existing
+function signatures and page interactions remain unchanged.
+
+## State Boundary
+
+`static/shared/state.js` stores mutable state in explicit domains: session, market, entity
+details, review, screener, mentor, and heaven. A compatibility proxy retains the existing flat
+access syntax while rejecting unregistered fields. New page modules can request their owned
+domain without depending on another page's data.
+
+This stage establishes a migration boundary rather than splitting the build-free monolith in a
+single high-risk edit. Page extraction can now proceed domain by domain with no contract change.
+
+## Enforcement
+
+Automated checks require that:
+
+- only `shared/api.js` contains browser `fetch` calls;
+- shared state and API scripts load before `app.js`;
+- application state is created through the shared state boundary.
+
+## Residual Risk
+
+`static/app.js` still contains page renderers and event handlers in one file. The state domains
+make ownership explicit, but those functions should move into page modules only in later,
+independently verified stages.