Registers the next batch before implementation starts, so the design is
versioned and reviewable rather than living only on disk.
Scope: crearte-server only. content.go is 856 lines / 30 functions, the sole
outlier in internal/service (next largest production file auth.go is 234 lines;
content.go alone is 22% of the directory) and carries five unrelated
responsibility lines in one struct whose five fields are all shared repository
dependencies with no mutable internal state.
Three survey findings make the split low-risk rather than aspirational:
- the seven cross-line calls all target package-level helper functions, with
zero method-to-method cross-line calls, so splitting creates no cross-service
callbacks and no import cycle;
- each of the five handlers uses exactly one line's methods with zero overlap,
so each dependency face narrows from 22 methods to its own 2-6 with no adapter;
- 11 of the 19 test construction sites only construct and never call methods,
and a Go embedding spike (H1-H4, run in golang:1.24-alpine, vet clean)
confirmed the promoted method set satisfies consumer-defined narrow
interfaces — so the composite root keeps every construction site and all five
serve.go wirings unchanged while handlers still narrow.
The survey also found ContentService.now is a dead field: zero s.now references
in the file, no test seam injecting it, while the sibling services that share
the pattern do use theirs (auth.go reads s.now(), cleanup.go has SetNow). It is
removed as part of the split rather than being assigned a line.
Two risks were falsified by measurement before designing: no code inside the
package reads ContentService's private fields (AccountService holds
repository.ContentStore, not *ContentService, so it is untouched), and the type
is never interface-ised, type-asserted, or used as a method value.
Deliberately out of scope: the 170-line Approve function (its seven phases are
mapped and logged for a later batch — one concern per batch), memory_content.go
(814 lines but a test double with zero non-test references), and handler
error-mapping dedup (92 WriteError sites but only 2 errors.Is checks, so the
duplication does not justify itself).
Verification plan: four gates in the dockerized toolchain plus structural
metrics (content.go under 120 lines, largest of the six files under 300, zero
service.ContentService references left in handlers, zero existing test files
modified) and three mutations the new architecture guard must fail on.
Brings the P13 batch into this wrapper's version control: spec and plan enter
the repo, ROADMAP gains the P13 row and its document-index entry, and the four
stale 'C dark mode' backlog mentions carried since P9/P10/P9-B/P12 are marked
cleared in place — following the P12 precedent of annotating the historical row
rather than rewriting it, since those entries were true when written.
Wrapper CHANGELOG 0.3.6 records the crearte-only dark-mode delivery
(983e7c4, merge-base e59a171), the parallel server micro-batch delivered during
the survey phase while the implementer owned crearte exclusively (dbf7fe5,
0.17.2: a real uploads.go error-fallthrough defect with zero prior coverage,
plus a decision-record comment on the bundle-key route after grep overturned the
initial suspicion of a hole), and three lessons:
- max(a,b) >= k is a vacuous-assertion hot zone: when the two sides are
complementary the max has a non-trivial lower bound (here sqrt(16.50) =
4.0621), so any threshold below it can never fail. The controller's own first
correction to the scrim guard shipped exactly that, and the same
one-directional verification recurred in the alpha fallback. Fixing a guard
now requires proving both no false-red on legal values and no false-green
under mutation.
- Tailwind v4 scans every source file including test files, so a class-name
literal in a test comment burns a dead utility into the artifact.
- A universal claim needs a universal grep: 'accent is the only background use'
was false because both the spike-0 grep and the new guard covered app/ while
runtime/ sits beside it. That blind spot cost a false spec fact and hid a real
pre-existing WCAG violation (paper on accent = 3.2590 in light, since P9-B).
ROADMAP's P13 row cites merge commit 983e7c4 per the P12 convention, with the
bookkeeping commits named separately so the reference cannot be mistaken for
them.
Register the P12 spec and plan in the ROADMAP doc index, add the P12 batch row,
and update two backlog lines that this batch's measurements settled:
- The 'mobile header / hamburger menu' backlog entry carried since P9-B is
falsified and removed: nav content width is only 74-158px and measures zero
horizontal overflow at 320/360/375/412/768/1280px. Building it would have
shipped a hamburger menu nobody needs.
- Nav links wrapping per-character at phone widths stays parked pending a
design decision, not a CSS tweak: it is cosmetic only (no overflow, no
clipping, no lost function), whitespace-nowrap costs +11px at 320px, and all
seven gap-reduction variants measured fail at 320px + long name because
logo 77px + nowrap nav 138-158px + truncated name 96px do not fit. It
competes for the same pixels as the header fix.
- The P11 polish backlog is partially retired: three of P9-B's four items plus
P11-N5/N6 are closed by this batch; the remaining nine P11 minor notes are
documentation-only with no actionable change.
Merged and pushed: crearte e59a171 (0.25.0), crearte-server d56c593 (0.17.1),
crearte-deploy 529a988 (0.7.1). Three task-level reviews plus a whole-branch
final review verdict APPROVE with notes, zero critical and zero important; all
notes adjudicated before merge. The final reviewer independently reproduced
three mutations rather than accepting the controller's claims.
ROADMAP P11 row -> 完成 with the D-A->D-A' re-pin narrative; doc index updated;
CHANGELOG 0.3.4 (Done section, bilingual) recording the endpoint-verification
catch: the original subnet-trust design was a rate-limit bypass under compose's
docker SNAT, corrected to an empty TRUSTED_PROXIES default. Register the P11
spec + plan in the doc index.
XingfenD