Week notes: bootstrap fan-out, dead code, and quieter surfaces

A club-house that fires a dozen GETs on every visit teaches the wrong lesson about care. The week’s stake was responsiveness and cleanliness: aggregate what the desktop shell needs, stop shipping dead weight, and tighten access so public ops and cross-manager reads stayed appropriately quiet.

What shipped was a desktop club-house bootstrap that collapses tasks, morale, standings, matches, finance, press, staff, and cup context into one response (mobile kept its lean bootstrap), then route-level bootstraps for heavy areas — finances, transfers, tactics, training, staff, squad — with stale-while-revalidate across HTTP cache, persistence, and nav prefetch so returning felt instant without pretending stale was fresh forever. Separately, a verified dead-code pass removed confirmed unused inventory while retaining the ops and API surfaces we still meant to keep. Access controls and public ops surfaces were tightened at a product level — ownership and knowledge boundaries clarified without turning this diary into an authz catalogue. In simple terms: fewer round trips, less ghost code, and less accidental omniscience.

The challenges were aggregation honesty and redaction discipline. Bootstraps that drift from list DTOs crash widgets; caches that never revalidate lie; security write-ups that list endpoints help attackers more than managers. We mapped bootstrap match payloads to the same shapes list routes already used, and we treat hardening notes here as outcomes — quieter surfaces — rather than reproductions. The strength of BFF-style bootstraps is perceived performance; the drawback is a contract that must evolve whenever a widget gains a field.

Paths not taken included keeping the N+1 club-house forever, deleting anything the audit merely suspected, or publishing a detailed security matrix in this diary. Fan-out is familiar until mobile and desktop diverge; unverified deletes create support ghosts; forensic writeups belong nowhere near GitHub Pages.

What it unlocked was a cleaner stage for youth academy UI and API work — and an admin/game shell that could afford richer pages without paying the old request tax on every navigation.