xiaobaifupan/docs/governance/stage-14-frontend-boundaries.md

Stage 14: Frontend Request and State Boundaries

Request Boundary

static/shared/api.js is now the only application file allowed to call fetch. It owns:

• JSON serialization and response parsing;
• CSRF attachment for mutating requests;
• expired-session notification;
• abort signals;
• NDJSON stream decoding and normalized stream errors.

The mentor and review-assistant streams use the same client as ordinary API requests. Existing function signatures and page interactions remain unchanged.

State Boundary

static/shared/state.js stores mutable state in explicit domains: session, market, entity details, review, screener, mentor, and heaven. A compatibility proxy retains the existing flat access syntax while rejecting unregistered fields. New page modules can request their owned domain without depending on another page's data.

This stage establishes a migration boundary rather than splitting the build-free monolith in a single high-risk edit. Page extraction can now proceed domain by domain with no contract change.

Enforcement

Automated checks require that:

• only shared/api.js contains browser fetch calls;
• shared state and API scripts load before app.js;
• application state is created through the shared state boundary.

Residual Risk

static/app.js still contains page renderers and event handlers in one file. The state domains make ownership explicit, but those functions should move into page modules only in later, independently verified stages.