# Stage 14: Frontend Request and State Boundaries

## Request Boundary

`static/shared/api.js` is now the only application file allowed to call `fetch`. It owns:

- JSON serialization and response parsing;
- CSRF attachment for mutating requests;
- expired-session notification;
- abort signals;
- NDJSON stream decoding and normalized stream errors.

The mentor and review-assistant streams use the same client as ordinary API requests. Existing
function signatures and page interactions remain unchanged.

## State Boundary

`static/shared/state.js` stores mutable state in explicit domains: session, market, entity
details, review, screener, mentor, and heaven. A compatibility proxy retains the existing flat
access syntax while rejecting unregistered fields. New page modules can request their owned
domain without depending on another page's data.

This stage establishes a migration boundary rather than splitting the build-free monolith in a
single high-risk edit. Page extraction can now proceed domain by domain with no contract change.

## Enforcement

Automated checks require that:

- only `shared/api.js` contains browser `fetch` calls;
- shared state and API scripts load before `app.js`;
- application state is created through the shared state boundary.

## Residual Risk

`static/app.js` still contains page renderers and event handlers in one file. The state domains
make ownership explicit, but those functions should move into page modules only in later,
independently verified stages.