Service layer decoupling — Phase 0 inventory

Baseline source: dca3123dd9c80b89586cb6de89afb387b01c23a1 (imp/blazor-hybrid after the plan documentation merged). Implementation destination: imp/blazor-hybrid-service-layer-decoupling. Plan and phase acceptance criteria.

Executable dependency ratchet

The machine-readable checklist is head-consumers.json. Every consumer/dependency pair has an owning phase and a disposition. The baseline retains migrated entries with migration evidence; deleting a caller without recording its disposition fails the ratchet.

HeadConsumerRatchetTests scans all five production assemblies, including method bodies, fields, constructor parameters, generic service-location calls, nested messages, async/lambda bodies and generated Razor properties. Compiler-generated types are attributed to their source owner. Its Roslyn source complement identifies each declaring type and resolves references across Debug/Release and net10/iOS/Android preprocessor branches, so a native-only dependency cannot hide behind the neutral test target. Comments, literal text and unused imports are not consumers. Unresolved target identifiers fail with their source location.

Each run attaches head-consumers.actual.json to the NUnit/TRX result with member or source-line evidence. PR validation publishes the TRX attachments. Compare that report with the checked-in checklist before changing a phase entry. At Phase 0, 54 active dependency pairs remain (27 compiled type pairs and 27 source file/type pairs); eight retired pairs record four classifier consumers migrated in this phase. The current IL must come from a fresh build: stale bin assemblies are not an acceptable baseline.

IRestEndpointProvider is a temporary Application compatibility port. Its existence is permitted until phase 6; the ratchet prevents new consumers from prolonging it. Referencing a target's implementation/interface is recorded as an entry; references from a target to itself are excluded. Test fakes and documentation are outside the production inventory.

Route and serializer dispositions

Persisted JSON and raw mapping decisions

Phase 0 preserves every existing cache key and persisted schema. A future HTTP DTO is an input to a pure CreateFromRaw mapper. It is not automatically the object serialized into the existing cache. Infrastructure owns the transport-specific DTO/factory/codec; Application exposes the existing Domain-shaped contract. No mapper resolves services or reads options; the surrounding service supplies needed configuration.

The compatibility reader continues accepting today's persisted Domain-shaped JSON. A future codec must write that same shape (including names, casing, nulls and collections) and read legacy fixtures before any domain extraction can pass acceptance. Do not make a schema migration or purge users' caches as an incidental part of service movement. Byte-preservation applies to unchanged raw payload storage; equivalent object round-trips also require schema and Search parity, rather than assuming property ordering alone proves correctness.

LegacyCachePayloadTests holds six fixed synthetic legacy payloads, one per MEC/LEC partition. It verifies byte preservation through the real store, complete Newtonsoft model/schema round-trips (including nulls, computed properties and nested collections), Search identity, and security trimming. Six malformed-payload cases pin the current behavior: the opaque store retains the string, the legacy reader throws, Search removes the previous rows and emits none, and explicit Delete evicts the corrupt payload. This does not claim that every legacy query automatically evicts corrupt data; the future compatibility reader must adopt that behavior explicitly.

The four existing MEC/LEC SearchContentRegistry.Keys constants retain their original string values. Four MEC query methods address six separate cache partitions. Auth/JWT and push-registration registry placeholders are documentation-only and never persisted.

Search security trimming remains an independent per-key policy. The generation barrier rejects old-context publication for all coordinated member work; a reference-data Search classification is not permission to publish an old member's in-flight result into a new session.

Implementation and validation record

Implementation branch: codex/service-layer-phase0; PR target: imp/blazor-hybrid-service-layer-decoupling. This section is the historical Phase 0 safety baseline. Later phases extracted the domains and retired the aggregates; the test migration map identifies the current fixtures for the original evidence below.

Validation completed on 2026-09-19:

Validation commands and results are also recorded with this phase's PR. Every test run uses a separate TRX filename; the full suite includes the generated inventory attachment. Native builds check platform compilation. Device login/logout/offline smoke has not been executed by this change; no live feature acceptance is claimed.

Deliberate safety behavior changes

• An old context completes with ContextInvalidatedException (an OperationCanceledException), rather than returning old member data or falling back into the next member's cache. Caller cancellation also bypasses stale fallback.
• Menu and favorites participate because they already own extracted cache/memo paths that could otherwise bypass the same barrier.
• SaveDocument updates read state only on an existing catalogue row with the same publication date. A delayed UI callback cannot reinsert a document removed by logout or overwrite current catalogue metadata.
• Logout unconditionally clears the existing IAuthContextCache port even if flag equality suppresses LoggedInChanged. It revokes tokens before signed-out callbacks. Secure-storage deletion failure revokes memory values immediately; optional remembered-username retention cannot recursively trigger logout.
• Raw API cache writes and derived Search writes share the invalidation boundary. Generation is captured before auth/network work, never invented after a response arrives. No lock is held across an await.

Preserved auth and classifier policies

Limits and later markers

The barrier can wait for synchronous indexing or document hydration that already owns it. Controlled tests prove ordering; they do not measure UI responsiveness on a device. Theme styling/SecureStorage theme publication and a late JWT refresh reinstalling session tokens remain Phase 5 session-lifecycle work. The durable log queue remains the explicit non-query-cache exception.

Phase 1 still owns transport/retry/options validation. Phase 2 remains the first extracted-feature acceptance marker. Integrated device and UAT validation must pass on the dedicated implementation branch before its final PR into imp/blazor-hybrid.