Answer prose round 1: 0 🔴, 10 🟡 (0 misread); define code health, restore the topic index, give each decision a premise of its own

2026-11-08 21:09:19 +01:00
parent 4c8ba083ce
commit 3179be0d11
8 changed files with 88 additions and 62 deletions
@@ -30,7 +30,8 @@ export function permissionName(resource: AdminResource, action: AdminAction): st
 // Every screen reads on GET/HEAD and mutates on POST. The route table and the in-handler guard both
 // go through this rather than each spelling the permission out, so they cannot drift. Deliberately
 // local: generalised, it would make authorization a function of the transport verb
-// (docs/decisions.md).
+// (docs/decisions.md → "`actionForMethod` is plugin-local and stays out of
+// `@plainpages/plugin-api`").
 export function actionForMethod(method: string): AdminAction {
  const verb = method.toUpperCase();
  return verb === "GET" || verb === "HEAD" ? "read" : "write";