Onboarding guide

21. ADC Conference - UI

What this chapter covers. This is the consumer half of the "write-once UI, render everywhere" story (primer §2): the Blazor pages, page-local collaborators, and per-entity HTTP services that turn the Conference REST surface (G20) into the screens an organizer, a speaker, a sponsor, or an anonymous attendee actually touches. Everything here lives in the per-module Razor Class Library MMCA.ADC.Conference.UI (under MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/, the path every File:line citation below is relative to), which, like every consumer UI, assembles the reusable primitives taught in G15 (Common UI Framework) into concrete pages. There is very little new infrastructure here: the value is in seeing how a fourteen-area feature surface (events, sessions, speakers, conference categories and their items, questions, rooms, sponsors, partners, activities, session materials, feedback moderation, public browsing, session selection, and the conference landing page) is composed from the framework's list-page base, typed HTTP service base, validation bridge, device-capability abstractions, and module system. The headline lens is [Rubric §18, UI Architecture & Component Design], which assesses component reuse, separation of presentation from data access, and a coherent composition model. Because the same Razor components compile into the Blazor Server, WebAssembly, and .NET MAUI hybrid heads, this one library renders the conference across web, Android, iOS, macOS, and Windows with no per-platform reimplementation. [Rubric §22, Responsive & Cross-Browser/Device].

Folders follow the workspace's feature-by-folder rule with a technical root: pages live under Pages/<Aggregate>/ (Pages/Events/, Pages/Sessions/, Pages/Partners/, with the anonymous family nested one level deeper as Pages/Public/<Aggregate>/) and services under Services/<Aggregate>/, so a citation's folder names the feature area it belongs to.

The layering inside the UI: a page never touches HttpClient

Each page is a .razor + .razor.cs code-behind pair that depends on a UI service interface, never on HttpClient and never on the API's internals. The ten CRUD-shaped entities (events, sessions, speakers, conference categories, category items, questions, rooms, sponsors, partners, activities) each get a service deriving from Common's EntityServiceBase<TEntityDTO, TIdentifierType> and exposing the IEntityService<TEntityDTO, TIdentifierType> contract: EventService, SessionService, SpeakerService, ConferenceCategoryService, CategoryItemService, QuestionService, RoomService, SponsorService, PartnerService, and ActivityService (Services/Events/EventService.cs:22, Services/Sessions/SessionService.cs:10, Services/Speakers/SpeakerService.cs:19, Services/Categories/ConferenceCategoryService.cs:10, Services/Categories/CategoryItemService.cs:10, Services/Questions/QuestionService.cs:10, Services/Rooms/RoomService.cs:14, Services/Sponsors/SponsorService.cs:10, Services/Partners/PartnerService.cs:10, Services/Activities/ActivityService.cs:10). They inherit GetAllAsync/GetPagedAsync/GetByIdAsync/AddAsync/UpdateAsync/DeleteAsync and only add the handful of bespoke verbs the conference needs. Seven add nothing at all: ActivityService, SponsorService, PartnerService, SessionService, QuestionService, CategoryItemService, and ConferenceCategoryService are fourteen-line files whose entire job is to bind an endpoint name to a DTO and an identifier alias (Services/Partners/PartnerService.cs:11 to :12 is the whole of one), and their interfaces (IActivityUIService at Services/Activities/IActivityUIService.cs:9, ISponsorUIService at Services/Sponsors/ISponsorUIService.cs:9, IPartnerUIService at Services/Partners/IPartnerUIService.cs:9, and siblings) are equally empty extensions of the generic contract.

Three services show where extension goes. EventService layers PublishAsync, UnpublishAsync, RefreshFromSessionizeAsync, and RefreshFromSessionizeWithCodeAsync onto the inherited CRUD (Services/Events/EventService.cs:48, :60, :72, :93). The first two carry the loaded row version as an If-Match header built by ConcurrencyETag (Services/Events/EventService.cs:58, :70), so a publish races against a concurrent edit at the API rather than in the browser. The fourth is a small orchestration worth reading: an edited Sessionize code has to be persisted before the import runs (the import reads the code off the stored event), and the import rewrites the event's children and refresh stamp, so the method persists, imports, reloads, and hands back both halves as one SessionizeRefreshOutcome (Services/Events/EventService.cs:93 to :122, record at Services/Events/SessionizeRefreshOutcome.cs:13). That is the recurring shape: one call, one Result, one failure branch for the page. RoomService overrides AddAsync to reshape the POST body, because the API's AddRoomRequest contract names the key RoomId while the DTO calls it Id (Services/Rooms/RoomService.cs:18 to :40), and adds a two-argument DeleteAsync that passes the owning event on the query string (Services/Rooms/RoomService.cs:42). SpeakerService adds LinkUserAsync/UnlinkUserAsync for binding a speaker record to an identity account (Services/Speakers/SpeakerService.cs:44, :55). Both EventService and SpeakerService also override the inherited AddAsync/UpdateAsync/DeleteAsync, and only to drop this scope's memoized lookup once a write succeeds (Services/Events/EventService.cs:31 to :46, helper at :125; Services/Speakers/SpeakerService.cs:27 to :42, helper at :64): the organizers who write bypass the server's output cache, so the client memo was the only staleness they could see (Services/Events/EventService.cs:16 to :21). Publish and unpublish invalidate the event lookup the same way, and a Sessionize refresh drops the speaker lookup as well, because the import rewrites speakers (Services/Events/EventService.cs:52, :64, :86 to :87).

Nothing in this layer throws for a server answer. Every call funnels through the framework's HttpResultExecutor and ProblemDetailsResultReader, so a transport fault and a ProblemDetails body both arrive as a failed Result with a typed error the page can branch on (Services/Speakers/SpeakerLookupService.cs:92 and :101, Services/Sessions/Selection/SessionSelectionService.cs:21 and :31, Services/Feedback/OrganizerFeedbackService.cs:28 and :38). [Rubric §3, Clean Architecture] and [Rubric §9, API & Contract Design]: the page binds to a DTO contract (EventDTO, SessionDTO, SpeakerDTO, SponsorDTO, ActivityDTO) plus an interface, and the wire envelope is the uniform PagedCollectionResult<T> / CollectionResult<T> the API returns for every entity.

The list pages: two bases, one recipe

Twelve list screens hang off DataGridListPageBase<TDto>, which supplies server-side paging against MudDataGrid<T>, cancellation lifecycle, loading and load-failed state, filter and sort extraction from MudBlazor's GridState<T>, toast error surfacing, saved page/rows-per-page/scroll restoration, and viewport-driven mobile rendering that swaps the grid for a MobileInfiniteScrollList<TItem>. Six derive from it directly, because their rows are not scoped to a conference event: EventList, SessionList, QuestionList, ConferenceCategoryList, PublicEventList, and PublicSessionList (Pages/Events/EventList.razor.cs:17, Pages/Sessions/SessionList.razor.cs:22, Pages/Questions/QuestionList.razor.cs:12, Pages/Categories/ConferenceCategoryList.razor.cs:12, Pages/Public/Events/PublicEventList.razor.cs:30, Pages/Public/Sessions/PublicSessionList.razor.cs:24). A concrete page reduces to overriding Title, GridRef, SaveFilters/RestoreFilters, and a LoadServerData delegate that calls its service's GetPagedAsync, with delete-and-confirm delegated to the shared ListPageActions helper.

The other six list pages scope their rows to one conference event, and that repetition earned its own ADC-local base: EventFilteredListPageBase<TDto> (Pages/Common/EventFilteredListPageBase.cs:25), used by RoomList, SpeakerList, SponsorList, PartnerList, ActivityList, and PublicSpeakerList (Pages/Rooms/RoomList.razor.cs:13, Pages/Speakers/SpeakerList.razor.cs:19, Pages/Sponsors/SponsorList.razor.cs:19, Pages/Partners/PartnerList.razor.cs:19, Pages/Activities/ActivityList.razor.cs:20, Pages/Public/Speakers/PublicSpeakerList.razor.cs:32). It injects IEventLookupService (Pages/Common/EventFilteredListPageBase.cs:27), starts the event load before the first await of OnInitializedAsync and exposes it as EventsLoadTask (:51, armed at :145, awaited at :138) because the grid's first ServerData call can race ahead of initialization, and gives derived pages WaitForEventsAsync and ApplyEventFilter to close that race deterministically (:193, :196). It seals SaveFilters/RestoreFilters and hands pages SavePageFilters/RestorePageFilters instead (Pages/Common/EventFilteredListPageBase.cs:87, :90, :99, :111), so the eventId half of the saved state is written once, with the explicit "all" sentinel that distinguishes a deliberate clear from no saved state at all (:106, read back at :120). Default resolution is one method: a restored id that still exists wins, a dangling one falls back to the live-or-next event computed by CurrentEventSelector against the clock read through the injected TimeProvider (:183, clock at :188), and a page whose scope is locked is always pinned to that computed default (:170 to :190, opt-out property at :57, overridden by PublicSpeakerList to "only privileged readers choose" at Pages/Public/Speakers/PublicSpeakerList.razor.cs:52). Two details are worth internalizing. The event picker renders only once the component is interactive (Pages/Common/EventFilteredListPageBase.cs:73): an SSR prerender would paint a fully formed picker into static HTML whose clicks are silently swallowed until the interactive runtime attaches, which under InteractiveAuto's WebAssembly leg is a whole runtime boot later. And a failed lookup is remembered rather than swallowed (:43, :164), so a page that must fail closed can branch instead of falling through to an unscoped query. [Rubric §19, State Management & Data Flow] and [Rubric §23, Front-End Performance & Rendering].

Whether that event filter needs any translation at all depends on the entity. PartnerList is the simplest case in the family: EventId is a real Partner column, so the filter goes straight through the generic filter pipeline with no virtual-key resolution, and the page reduces to a title, a grid reference, a search box saved through SavePageFilters/RestorePageFilters, and a localized type column (Pages/Partners/PartnerList.razor.cs:19, rationale at :14 to :17, filters at :39 to :43, type label at :37). ActivityList is the same shape (Pages/Activities/ActivityList.razor.cs:20). The speaker lists are the hard case: a speaker's event association travels through join tables, so their event filter is a virtual key resolved server-side (Pages/Public/Speakers/PublicSpeakerList.razor.cs:18 to :19).

Two public lists deliberately opt out of the grid entirely. PublicSponsorList and PublicActivityList are plain ComponentBase pages (Pages/Public/Sponsors/PublicSponsorList.razor.cs:21, Pages/Public/Activities/PublicActivityList.razor.cs:22), because a sponsor roster and a social programme are bounded (both cap the fetch at 200 rows, Pages/Public/Sponsors/PublicSponsorList.razor.cs:24, Pages/Public/Activities/PublicActivityList.razor.cs:25) and render as tier-grouped logo cards and a chronological programme rather than a sortable table, so each fetches one page and orders it in memory (Pages/Public/Sponsors/PublicSponsorList.razor.cs:106 to :116, Pages/Public/Activities/PublicActivityList.razor.cs:112 to :114). PublicSpeakerList splits the difference: it keeps the base class's page-based mobile fetch path but appends each page to an accumulating list and hangs Common's InfiniteScrollSentinel below its card grid, twelve cards per chunk so a full chunk fills whole rows (Pages/Public/Speakers/PublicSpeakerList.razor.cs:24, :35).

Detail pages, form models, and one declaration of the rules

The organizer detail pages have no ADC-local base: all nine inherit Common's DetailPageBase (MMCA.Common/Source/Presentation/MMCA.Common.UI/Pages/Common/DetailPageBase.cs:26) from markup, and it owns what every one of them would otherwise repeat verbatim: the page-scoped CancellationTokenSource with its dispose pattern (DetailPageBase.cs:28, :52), a LatestLoadGuard for route-driven reloads (documented at :9 to :11), and the inline edit-mode lifecycle, IsEditing/IsDirty plus the BeginEdit/EndEdit transitions that keep the dirty flag from being left set behind a closed editor (:46, :49, :68, :75). The nine are EventDetail, SessionDetail, SpeakerDetail, ConferenceCategoryDetail, RoomDetail, QuestionDetail, SponsorDetail, PartnerDetail, and ActivityDetail (@inherits at Pages/Events/EventDetail.razor:9, Pages/Sessions/SessionDetail.razor:9, Pages/Speakers/SpeakerDetail.razor:10, Pages/Categories/ConferenceCategoryDetail.razor:3, Pages/Rooms/RoomDetail.razor:7, Pages/Questions/QuestionDetail.razor:7, Pages/Sponsors/SponsorDetail.razor:8, Pages/Partners/PartnerDetail.razor:7, Pages/Activities/ActivityDetail.razor:7), and the dirty flag feeds Common's UnsavedChangesGuard directly. [Rubric §24, Forms, Validation & UX Safety].

Editable fields are not loose page state. Each entity declares an abstract form model carrying its DataAnnotations, and the create page and the detail page's inline editor each bind a sealed subclass of it: EventFormModel with EventCreateModel and EventEditModel (Pages/Events/EventFormModel.cs:27, Pages/Events/EventCreateModel.cs:11, Pages/Events/EventEditModel.cs:11), and the same triad for sessions, speakers, rooms, questions, sponsors, partners, activities, and conference categories (SessionFormModel Pages/Sessions/SessionFormModel.cs:24, SpeakerFormModel Pages/Speakers/SpeakerFormModel.cs:25, RoomFormModel Pages/Rooms/RoomFormModel.cs:24, QuestionFormModel Pages/Questions/QuestionFormModel.cs:24, SponsorFormModel Pages/Sponsors/SponsorFormModel.cs:25, PartnerFormModel Pages/Partners/PartnerFormModel.cs:18 with PartnerCreateModel Pages/Partners/PartnerCreateModel.cs:10 and PartnerEditModel Pages/Partners/PartnerEditModel.cs:10, ActivityFormModel Pages/Activities/ActivityFormModel.cs:26, ConferenceCategoryFormModel Pages/Categories/ConferenceCategoryFormModel.cs:24). The rules live once: the MudForm fields bridge to the annotations through Common's ModelValidation rather than repeating Required/RequiredError per field, the length caps come from the DTO's own constants, and every ErrorMessage is a resource key resolved by the localizing DataAnnotationsModelValidator (ADR-027). PartnerFormModel is the compact worked example: its four text rules take their caps from PartnerDTO.NameMaxLength, DescriptionMaxLength, LogoUrlMaxLength, and WebsiteUrlMaxLength (Pages/Partners/PartnerFormModel.cs:28, :32, :37, :42), the missing-value key is a single const shared by the model's [Required] and the field's RequiredError affordance so the two can never drift (:24, :27), the two URL fields carry Common's AbsoluteUrl rule (:36, :41), and the one enum field defaults to PartnerType.Community on the stated rationale that, unlike a sponsorship tier, a partner type carries no commercial weight (:45 to :49). The subclasses own only the direction of travel: EventCreateModel.ToNew() builds the posted DTO and always as an unpublished draft, because publishing is a separate gesture on the detail page (Pages/Events/EventCreateModel.cs:25 to :42), while EventEditModel.LoadFrom(source) copies the loaded event into the editor in one call and ToUpdated(source) writes the edited values over the identity, row version, and published state that were loaded (Pages/Events/EventEditModel.cs:18, :48). Because both pages bind the same EventFormFields.razor component to an instance of the same base, a value the create page accepts is a value the detail page accepts. [Rubric §1, SOLID] and [Rubric §15, Best Practices & Code Quality]. The one model with no create page to mirror follows the same discipline anyway: ConferenceCategoryItemEditModel declares the inline item form's rules against CategoryItemDTO's own length constant (Pages/Categories/ConferenceCategoryItemEditModel.cs:19 to :31).

Two of the event form's fields cannot be checked by a length cap, and each gets a client rule that mirrors the server's so the form gives the verdict the API would rather than sending the user on a round trip to be refused. IanaTimeZoneAttribute resolves the typed identifier with the non-throwing TimeZoneInfo.TryFindSystemTimeZoneById (Pages/Events/IanaTimeZoneAttribute.cs:30, check at :48), which .NET answers from the same IANA set on the Blazor Server host, the WebAssembly head, and the MAUI heads (:23 to :27); a typo such as America/New York used to pass every client rule, and the time zone is the one field on that form where the refusal is not obvious from the value (:6 to :10). SessionizeCodeAttribute calls the shared SessionizeCodeFormat.IsValid from the module's Shared project rather than restating the charset (Pages/Events/SessionizeCodeAttribute.cs:23, call at :41), because that charset is a security control and not a cosmetic one: the import resolves a relative URI from the stored code, so a value carrying a slash or a colon could redirect the import to a foreign host, and a client copy that drifted from the server's would be worse than no client rule at all (:10 to :16). Both rules pass on null, empty, and whitespace, leaving presence to [Required] so a blank required field shows one message instead of two (IanaTimeZoneAttribute.cs:43 to :46, SessionizeCodeAttribute.cs:36 to :39), and both emit ErrorMessage unchanged rather than formatting it, which is exactly what lets a model declare a resource key there and have the localizing validator resolve it (IanaTimeZoneAttribute.cs:15 to :21). [Rubric §24, Forms, Validation & UX Safety].

Container and presentational split, and page-local collaborators

The behaviour-heavy screens do not keep everything in one code-behind: the page stays the container (data fetching, filter and paging state, service calls) and hands rendering to presentational children that receive parameters and raise callbacks. PublicSessionList is the fullest example, splitting into PublicSessionListFilterBar (privileged event picker or locked chip, debounced title search, room picker, All Sessions / My Schedule toggle, share action, Pages/Public/Sessions/PublicSessionListFilterBar.razor.cs:16) and PublicSessionListView (the mobile card list, the desktop grid, and the inline bookmark stars, Pages/Public/Sessions/PublicSessionListView.razor.cs:26), which exposes Grid and ReloadAsync back to the page so the base class's grid plumbing keeps working unchanged. The same split shows up on the category detail page via ConferenceCategoryItemsPanel, which owns the item table and its inline add/edit rows and hands the reloaded aggregate back through CategoryChanged (Pages/Categories/ConferenceCategoryItemsPanel.razor.cs:22, :32), on the speaker detail page via SpeakerCategoryItemsPanel (Pages/Speakers/SpeakerCategoryItemsPanel.razor.cs:18), and on the selection dashboard via SessionSelectionSpeakerOverlap and SessionSelectionAiScores (Pages/Sessions/Selection/SessionSelectionSpeakerOverlap.razor.cs:11, Pages/Sessions/Selection/SessionSelectionAiScores.razor.cs:12).

A second, quieter move keeps the code-behinds small: pure logic is lifted out into page-local collaborators, plain classes beside the page rather than registered services, each explicitly extracted to keep the component within the [Rubric §18] line budget. SessionSelectionDisplay holds the score colors and filter predicates the dashboard and its two children share (Pages/Sessions/Selection/SessionSelectionDisplay.cs:13, score color at :20); SessionStatusDisplay is the one status-to-color map for session status chips, shared by the organizer session list and the selection dashboard's children so a status reads the same color on every page (Pages/Sessions/SessionStatusDisplay.cs:11, map at :13, read at Pages/Sessions/SessionList.razor:87, Pages/Sessions/Selection/SessionSelectionAiScores.razor:79, Pages/Sessions/Selection/SessionSelectionSpeakerOverlap.razor:68); SessionSelectionFilters holds the five bound filter values and the option lists derived from the loaded board (Pages/Sessions/Selection/SessionSelectionFilters.cs:13, projection in SessionSelectionFilterOptions at Pages/Sessions/Selection/SessionSelectionFilterOptions.cs:12); PublicSessionListFilterState translates that page's filters to and from the persisted string map (Pages/Public/PublicSessionListFilterState.cs:12), and four more classes beside that page hold its event catalog, its bookmark state, its event-scope retry, and its overlapping grid loads (the public rendering section below walks them); PublicScheduleRoomOptions builds the room picker out of events the page already loaded, so narrowing by room costs no extra fetch, and re-validates the active room against the newly scoped list rather than leaving a filter that matches nothing (Pages/Public/PublicScheduleRoomOptions.cs:13); SessionLookups caches the session detail page's dictionaries per page instance, re-fetching rooms when the session's event changes (Pages/Sessions/SessionLookups.cs:32); SpeakerUserSearch fans three parallel IUserUIService lookups out and unions them, because GetPagedAsync ANDs its filters server-side and one call with all three set would return the empty intersection (Pages/Speakers/SpeakerUserSearch.cs:12, :42 to :44); FeedbackQuestionLoader pages until TotalItems is reached so a feedback report cannot silently truncate, with 100 rows per request and a 20-page runaway guard (Pages/Feedback/FeedbackQuestionLoader.cs:17, :20, :26); and ADCHomeContent holds the landing page's editorial data (Pages/Home/ADCHomeContent.cs:15). All of them are testable without rendering anything. [Rubric §28, Front-End Testing] and [Rubric §14, Testability].

Child-and-join entities: a thin POST/DELETE base

Sessions, speakers, and events own join relationships (a speaker added to a session, a category item to a speaker) that the generic CRUD base cannot model, because the write carries a parent id. These get four near-identical services (EventSpeakerService, SessionSpeakerService, SessionCategoryItemService, SpeakerCategoryItemService) over the shared ChildEntityServiceBase, which was hoisted out of this module into MMCA.Common.UI so every consumer module can reuse it (the note is left in place at Services/Common/ChildEntityServices.cs:89). Each Conference join service reduces to supplying its endpoint and adding typed AddAsync/DeleteAsync wrappers over the base's two verbs (Services/Common/ChildEntityServices.cs:22, :35, :48, :61), and their four interfaces live together in one file (Services/Common/IChildEntityUIService.cs:14, :26, :38, :50). Note the hard-won detail, now enforced by a helper rather than by discipline: the add payload always names the parent explicitly (new { EventId = eventId, SpeakerId = speakerId }, Services/Common/ChildEntityServices.cs:26), and every removal appends its owning aggregate's id through ChildEntityDeletePath (Services/Common/ChildEntityServices.cs:76, called at :29, :42, :55, :68). The join controllers remove a row by loading the parent aggregate and asking it to drop the child, so a DELETE without the parent binds it to default, finds nothing, and answers 404 while the UI reports a generic failure (Services/Common/ChildEntityServices.cs:14 to :21).

Display-enrichment lookups: the GetAll-vs-GetById populator gap, worked around in the UI

Because the API's list endpoints do not always populate every cross-entity navigation, several pages need a cheap id-to-name map to render speaker names beside a session or an event name beside a room, a sponsor, a partner, or an activity. Three lookup services fill that role, SpeakerLookupService, EventLookupService, and CategoryItemLookupService (behind ISpeakerLookupService, IEventLookupService, and ICategoryItemLookupService). Each reads its whole entity set through Common's PagedReadAll, which pages the /paged endpoint in stable id order with children and foreign keys suppressed until the server's reported total is reached, because a single read truncates silently at the API's 500-row page-size clamp (MMCA.Common/Source/Presentation/MMCA.Common.UI/Services/Api/PagedReadAll.cs:19, page size at :22, URL at :43, rationale at :13 to :17); each page is a GET through IdempotentReadRetry, and the rows fold into a Dictionary of lightweight projection records, SpeakerInfo, EventInfo, CategoryItemInfo (Services/Speakers/SpeakerLookupService.cs:29, read at :91 to :105, fold at :119 to :129; Services/Events/EventLookupService.cs:33; Services/Categories/CategoryItemLookupService.cs:12; records at Services/Speakers/ISpeakerLookupService.cs:9, Services/Events/IEventLookupService.cs:14, Services/Categories/ICategoryItemLookupService.cs:9). EventLookupService and SpeakerLookupService both memoize their read per scope for five minutes, matched to the server-side output-cache TTL, and cache the task rather than the result, so the overlapping loads EventFilteredListPageBase starts share one in-flight fetch and an attendee moving between the public session list and a session page pays one speaker read rather than one per navigation; no lock guards the cache because a scope's component callbacks run on one logical thread (Services/Events/EventLookupService.cs:14 to :24, TTL at :43, TimeProvider injected at :33, reuse check at :78; Services/Speakers/SpeakerLookupService.cs:14 to :26, TTL at :39). The speaker memo is per scope rather than per process because its payload is role-dependent (BR-239: a privileged caller sees speakers the public projection hides), so it must never be shared across users (Services/Speakers/SpeakerLookupService.cs:22 to :24). Only a successful fetch is stamped with an expiry, so a faulted, canceled, or failed read is retried on the next call rather than cached; each interface exposes an Invalidate that the write services call, and a generation counter keeps a fetch superseded by an invalidation from stamping the expiry of its replacement (Services/Events/IEventLookupService.cs:35, Services/Speakers/ISpeakerLookupService.cs:26, Services/Events/EventLookupService.cs:59, :117). EventInfo is the one projection that grew a feature-specific field: SponsorshipPacketUrl is an optional trailing parameter defaulting to null precisely so the many call sites that need only identity and dates stayed unchanged, and only the public sponsor page reads it (Services/Events/IEventLookupService.cs:10 to :21, read at Pages/Public/Sponsors/PublicSponsorList.razor.cs:88). The organizer detail pages use the same map for a plain display concern: PartnerDetail shows the owning event's name and falls back to the raw id when the lookup is unavailable, rather than failing the page over a label (Pages/Partners/PartnerDetail.razor.cs:24, :38 to :41). This is a deliberate client-side join over the navigation-populator (ADR-002) gap between the API's list and by-id read shapes.

One page needed three of these together, and got a composite rather than three nullable caches and three failure branches: SpeakerDetailLookupService gathers the category items, their owning category titles, and the question texts into a single SpeakerDetailLookups record answered as one Result, short-circuiting on the first failure (Services/Speakers/SpeakerDetailLookupService.cs:13, record at Services/Speakers/ISpeakerDetailLookupService.cs:14, interface at :25). The same "one call, one failure branch" instinct produced SessionizeRefreshOutcome above and SessionLookups beside the session detail page.

Three feature areas that go beyond CRUD

First, the speaker self-service dashboard. SpeakerDashboard sits behind a plain [Authorize] attribute and is gated on the speaker_id JWT claim, showing the linked speaker's sessions, per-session bookmark counts, and feedback (Pages/Speakers/SpeakerDashboard.razor.cs:23). The sessions are narrowed to the current or next event, resolved through IEventLookupService and CurrentEventSelector, falling back to all of the speaker's sessions when no event resolves (Pages/Speakers/SpeakerDashboard.razor.cs:17 to :18, :126 to :130, resolver at :169). It leans on SpeakerDashboardService (behind ISpeakerDashboardUIService at Services/Speakers/ISpeakerDashboardUIService.cs:10), whose session read pushes the speaker filter server-side onto the virtual SpeakerId key, caps the page at 100 rows, and appends a per-call cache-bust parameter so this one read is a guaranteed miss against the shared sessions output cache and a just-made assignment shows immediately, while public list reads keep their cache (Services/Speakers/SpeakerDashboardService.cs:14, :19, :35, :38). Its bookmark counts come back from one batched endpoint rather than one hop per session (Services/Speakers/SpeakerDashboardService.cs:54), and it derives from Common's AuthenticatedServiceBase so its calls carry the bearer token and run through the shared retry policy. [Rubric §12, Performance & Scalability].

Second, organizer feedback moderation (BR-53). OrganizerEventFeedback and OrganizerSessionFeedback let organizers review and delete answers through OrganizerEventFeedbackService and OrganizerSessionFeedbackService (Pages/Feedback/OrganizerEventFeedback.razor.cs:18, Pages/Feedback/OrganizerSessionFeedback.razor.cs:18, services at Services/Feedback/OrganizerFeedbackService.cs:15, :70, behind IOrganizerEventFeedbackUIService and IOrganizerSessionFeedbackUIService at Services/Feedback/IOrganizerFeedbackUIService.cs:11, :27). The read is the unscoped organizer view, paged through PagedReadAll until the reported total, so the report never aggregates a truncated answer set (Services/Feedback/OrganizerFeedbackService.cs:25 to :27), and each delete passes the parent id explicitly on the query string to satisfy the controller's binding (Services/Feedback/OrganizerFeedbackService.cs:52, :107). [Rubric §11, Security]: the scoping is server-side and the pages carry [Authorize(Roles = "Organizer")], not a client-side hide.

Third, QR self-service. SpeakerQr renders a full-screen code a speaker can hold up at the podium, and the code itself needs no backend call: the speaker comes from the speaker_id claim and the payload is built locally, so the code renders on the prerender pass as readily as on the interactive one (Pages/Speakers/SpeakerQr.razor.cs:24, rationale at :15 to :17, claim read at :56). The one read is the name printed beside the code, so whoever scans can see whose profile they are about to open: the linked speaker's full name through ISpeakerUIService, whose self-read carve-out serves a speaker their own profile even while it is not public, with the account name standing in when that read fails (:17 to :19, fallback at :54, read at :66). The payload is always the absolute public URL from Common's IPublicLinkBuilder (Pages/Speakers/SpeakerQr.razor.cs:26, :62), never the WebView-internal origin, or a code scanned off the MAUI head would open for nobody else. The framework's QrCodeButton puts the same capability on five organizer and public print surfaces: public event detail (Pages/Public/Events/PublicEventDetail.razor:31), public session detail (Pages/Public/Sessions/PublicSessionDetail.razor:51), public speaker detail (Pages/Public/Speakers/PublicSpeakerDetail.razor:47), room detail (Pages/Rooms/RoomDetail.razor:61), and sponsor detail (Pages/Sponsors/SponsorDetail.razor:74).

Session materials, a resource deliberately not shaped as CRUD

Speakers publish the decks, handouts, and links that go with their own sessions, and anyone downloads them from the public session page (ADR-123, speaker session assets). This is the one area here that does not get an IEntityService<,>. ISessionAssetUIService declares exactly the five operations the API offers, GetBySessionAsync, AddLinkAsync, UploadFileAsync, UpdateAsync, and DeleteAsync (Services/SessionAssets/ISessionAssetUIService.cs:32, :41, :55, :72, :82), with the rationale recorded on the interface itself (:11 to :16): the endpoint has no paged list, no lookup, and no by-id read (an asset is only ever fetched as part of its session's list), and its two creates are different verbs on different routes. Declaring only what exists keeps a page from reaching for a CRUD method with no endpoint behind it. The two write bodies sit beside the service as SessionAssetLinkRequest and SessionAssetUpdateRequest (Services/SessionAssets/SessionAssetRequests.cs:14, :35) rather than being reused from the Application layer, because the UI RCL references the module's Shared project only (SessionAssetRequests.cs:7 to :13); neither carries the caller's identity, which the API stamps from the token, so a request body can never claim to be a speaker it is not. [Rubric §9, API & Contract Design].

SessionAssetService derives from Common's AuthenticatedServiceBase (Services/SessionAssets/SessionAssetService.cs:26) and is the clearest worked example in this library of per-verb transport policy. Adding a link appends a row, so that POST carries an Idempotency-Key and keeps the shared retry policy (:61, :74). The file POST carries the key but has no retry at all: a picked file's stream is single-shot (neither a browser file input nor a native picker rewinds), so a second attempt would post an exhausted body, while a repeated key replays the stored response instead of re-uploading 50 MB over venue wifi (:86 to :91, :108, :135). The upload streams straight from the browser file into the multipart body with the cap stated to OpenReadStream, because Blazor's 512 KB default would otherwise truncate every real deck (:112, note at :110 to :111), and the four part names match the controller's IFormFile parameter and its [FromForm] arguments exactly (:128 to :133). The update is conditional (the ADR-035 rule): the edited row version travels as If-Match through ConcurrencyETag, and a DTO carrying no token sends no header, so the API refuses with 428 rather than overwriting another editor's change (:154 to :156, header applied at :209 to :212). Both the key and the precondition are default headers on a client built once per logical operation, so every retry attempt states the same pair (:200, reasoning at :193 to :199). [Rubric §29, Resilience].

Three components consume that service. SessionAssetsPanel is the management half (Pages/SessionAssets/SessionAssetsPanel.razor.cs:31), a component rather than a page, so the organizer session detail page and a speaker's own dashboard host it by saying only which session and whether the viewer may manage it (parameters at :36, :42). CanManage decides only what the panel offers: the right itself is re-checked by the API on every write (a privileged role, or a speaker whose speaker_id claim is on the session), so a viewer who reaches a hidden control still gets SessionAsset.Forbidden (:20 to :22). [Rubric §11, Security]. The panel enforces the two limits client-side as courtesy rather than as the rule: the per-session cap closes the add controls and short-circuits both writes (:69, :110, :144, the constant SessionAssetLimits.MaxAssetsPerSession = 10 at MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.Shared/SessionAssets/SessionAssetLimits.cs:27), and the size check runs before the post so a speaker does not wait out a whole 50 MB upload on venue wifi to be told no (:151, cap at SessionAssetLimits.cs:11). Every refusal is worded from the API's machine-readable error code through a resource-key table, so SessionAsset.UnsupportedFormat, SessionAsset.LimitReached, and SessionAsset.StorageNotConfigured each read in the selected language instead of echoing the server's English sentence (ADR-027); Http.413 is the one transport status in that table, because Kestrel refuses an over-cap body before the friendly check ever runs (:252, entry at :279). And every write funnels through one MutateAsync shape: run it, report the refusal or the success, run the caller's own reset, reload the list (:214, value-returning adapter at :245).

SessionAssetComposer is the "add a material" half, split out of that panel so the panel keeps the list, the writes, and the status region while the composer owns only the draft the speaker is typing (Pages/SessionAssets/SessionAssetComposer.razor.cs:24, rationale at :6 to :9). It performs no write of its own: a well-formed link is raised on OnAddLink with its address already normalized, a refused address is raised on OnInvalidLinkAddress so the panel words the refusal in its own single aria-live region rather than growing a second one, and a picked file is raised untouched on OnFileSelected before any size or format check (:33 to :40, remarks at :12 to :17). The draft is cleared by the panel through ClearDraft rather than optimistically here, because only the panel knows whether the write actually succeeded and an EventCallback cannot report an outcome back to its raiser (:52 to :57, remarks at :18 to :22, called at SessionAssetsPanel.razor.cs:128 with the reference held at :67). One small detail earns its comment: the file input's id is per-instance rather than fixed, because a page can render one panel per session and a duplicated id would point the label at the wrong picker (:42 to :44). [Rubric §18, UI Architecture & Component Design].

SessionAssetsDownloadList is the public read-only half, embedded in the public session page (Pages/SessionAssets/SessionAssetsDownloadList.razor.cs:18, hosted at Pages/Public/Sessions/PublicSessionDetail.razor:121). It is anonymous because the list endpoint is, and a reader who cannot see the session gets an empty list rather than a refusal. A load failure here is deliberately silent: the materials are supplementary to the session page, so the section simply does not render rather than raising an alert for something the reader never asked for (:13 to :17, :48). Both components reload only when the session id actually changes (:36 to :43, panel at SessionAssetsPanel.razor.cs:71 to :78), and both swallow OperationCanceledException from disposal or the InteractiveAuto render-mode transition (SessionAssetsDownloadList.razor.cs:50). The presentation decisions they would otherwise duplicate live once in SessionAssetDisplay (Pages/SessionAssets/SessionAssetDisplay.cs:13): the icon that names an asset by kind and by format so a reader can tell a deck from an archive before clicking (:27), and a byte count split into an amount plus the resource key naming its unit, which the caller composes through its own localizer so a Spanish reader reads "1,4 MB" (:56). The extension is read off the stored blob name first, because a blob URL can carry a signature query string and taking the extension from that would yield the query rather than the format (SessionAssetDisplay.cs:79 to :86). [Rubric §18, UI Architecture & Component Design] and [Rubric §27, Internationalization & Localization].

Session-selection decision support, the asynchronous edge

The most behaviour-rich page is the organizer-only SessionSelectionDashboard (Pages/Sessions/Selection/SessionSelectionDashboard.razor.cs:16), which renders category distribution, speaker overlap, locality breakdown, and AI content-similarity scoring over an event's session pool via SessionSelectionService (Services/Sessions/Selection/SessionSelectionService.cs:14, behind ISessionSelectionUIService). Every load is stamped with a monotonic generation rather than an event id, so switching away from an event and back still discards the first response even though both carry the same id: the generation is snapshotted before the fetch, re-checked before the board is replaced or an error banner is painted, and re-checked again before the spinner is cleared. Filter options are recomputed from the returned SessionSelectionDashboardDTO itself. [Rubric §19, State Management & Data Flow].

Scoring is the asynchronous edge. ScoreSessionsAsync POSTs to the scoring endpoint with no retry pipeline, because starting a run is not idempotent and a retried POST could queue a second run behind the first (Services/Sessions/Selection/SessionSelectionService.cs:46 to :48). Because AI scoring of every eligible session can take minutes, the API does not run the pass inline: SessionSelectionController schedules a ScoreEventSessionsInternalCommand through the durable IInternalCommandScheduler and answers 202 Accepted with no body once it is queued (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.API/Controllers/Sessions/SessionSelectionController.cs:148 to :144, command at MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.Application/Sessions/UseCases/DecisionSupport/ScoreEventSessions/ScoreEventSessionsInternalCommand.cs:38), so the service reads the status before the body reader (which treats a body-less 2xx as a failure) and maps it to a sentinel ScoreEventSessionsResultDTO with SessionsScored = -1 (Services/Sessions/Selection/SessionSelectionService.cs:54 to :57). The page turns that sentinel, and only that sentinel, into a fire-and-forget polling session, leaving its scoring flag set for the poll loop to clear while every other branch clears it inline.

The loop itself is factored into three pieces, which is the part worth studying. ScorePollSession runs the polling (Pages/Sessions/Selection/ScorePollSession.cs:36, RunAsync at :51), re-reading the cadence through the host on every tick so a bUnit test can shrink it (:69) and abandoning the session the moment the page's generation moves (:70, :76). ScorePollHost is the record of callbacks through which that loop raises its UI side effects, so no rendering decision lives in the loop and none of the loop lives on the component (Pages/Sessions/Selection/ScorePollSession.cs:19). And ScorePollTracker is the pure state machine that turns each observation into a ScorePollSignal: keep polling, apply-and-continue, all sessions scored, counts stable long enough, or no scores at all within the zero-progress budget (Pages/Sessions/Selection/ScorePollTracker.cs:33, signal enum at :8). Its budgets are explicit constants, each with its sizing reason beside it: 225 polls for a 30-minute cap at the 8-second cadence (:36), 5 consecutive fetch failures (:43), 15 zero-progress polls, which must outlast the internal-command poll that picks the run up (60 seconds in production) plus the first scoring call (:51, reason at :45 to :50), and 6 stable polls before completion, long enough to outlast one 30-second scoring call and its save so a single slow call mid-pass does not read as the end of the run (:58, reason at :53 to :57). Progress counts only scores this run wrote: the session receives each already-scored session's ScoredOn as a baseline when the run starts and counts against it on every tick (Pages/Sessions/Selection/ScorePollSession.cs:48, :99). Because the service answers a server error with a failed Result rather than an exception, the consecutive-failure budget is fed from the result branch, or a persistently failing endpoint would poll silently to the cap without ever reporting (Pages/Sessions/Selection/ScorePollSession.cs:86, success read at :93). [Rubric §6, CQRS & Event-Driven] and [Rubric §29, Resilience].

Public versus authenticated rendering, and the offline-first path

A recurring [Rubric §11, Security] pattern: the same conference entity is exposed through two page families. No page under Pages/Public/ carries an @attribute [Authorize] at all, and those reads are output-cached at the API; the organizer family gates on the Organizer role in markup (Pages/Events/EventList.razor:2). PublicSessionList shows the nuance well. It is read-only for anonymous users (BR-43), but an authenticated user gets inline bookmark stars and a My Schedule toggle wired through the optional ISessionBookmarkUIService; because Blazor's [Inject] has no optional mode (an unregistered service throws at render), the page declares that dependency as a nullable property and resolves it via IServiceProvider.GetService, so it stays null when the Engagement module is disabled (Pages/Public/Sessions/PublicSessionList.razor.cs:35 to :37, resolved at :98). [Rubric §7, Microservices Readiness]. Who counts as privileged is one shared call: PublicReadAudience awaits the cascaded authentication state and tests it against the privileged-reader list ConferenceReadAudience, degrading a faulted state to the public (least-privileged) audience while letting a cancellation propagate, so an unreadable auth state never breaks a public page (Pages/Public/PublicReadAudience.cs:10, IsPrivilegedReaderAsync at :18, role test at :28, fault filter at :31), and the public session, speaker, and event pages all ask it rather than repeating the check (Pages/Public/Sessions/PublicSessionEventCatalog.cs:60 on the session list's behalf, Pages/Public/Speakers/PublicSpeakerList.razor.cs:97, Pages/Public/Events/PublicEventList.razor.cs:72, Pages/Public/Events/PublicEventDetail.razor.cs:67). Non-privileged readers are always locked to the computed current or next event via CurrentEventDefaults, so a shared privileged URL cannot pin an attendee to a different or unpublished event (Pages/Public/Sessions/PublicSessionEventCatalog.cs:129 to :144); when the events fetch failed and no scope resolved, a public reader's session query fails closed instead of running unscoped (PublicSessionEventCatalog.cs:69, :92, refused at Pages/Public/Sessions/PublicSessionList.razor.cs:257, :292), and only a privileged reader's resolved event choice is persisted at all (PublicSessionList.razor.cs:74, Pages/Public/PublicSessionListFilterState.cs:12).

PublicSessionList itself stays a container by handing its state to four page-local collaborators beside it, each kept out of the page for the code-behind size convention (Pages/Public/Sessions/PublicSessionList.razor.cs:43 to :50). PublicSessionEventCatalog loads the reader's audience, the events with their rooms, and the speaker lookup, resolves the default event, rescopes the room picker, and adds the title, event, and room filters to every query, while the page keeps only the toasts (Pages/Public/Sessions/PublicSessionEventCatalog.cs:17, load at :54, filters at :105, toasts at PublicSessionList.razor.cs:148 to :158). PublicSessionBookmarkState owns who the reader is and which sessions they starred; it starts eagerly from initialization because the grid's first ServerData call can race ahead of it, and a failed bookmark read in My Schedule mode is re-issued once and then surfaced as an error rather than as an empty schedule (Pages/Public/Sessions/PublicSessionBookmarkState.cs:14, StartLoad at :38, EnsureAsync at :51, started at PublicSessionList.razor.cs:121 to :122). PublicSessionEventScope holds the events lookup the grid loads wait on: each load re-issues a failed lookup at most once, loads that waited on the same failed lookup share one retry, and its Pending flag holds the load-failed state (and its Retry button) back while a lookup may still succeed (Pages/Public/Sessions/PublicSessionEventScope.cs:14, Pending at :23, EnsureAsync at :36, read at PublicSessionList.razor.cs:163 to :169). And NewestLoadTracker<T> answers overlapping grid loads with the newest load's result, because MudDataGrid applies whichever ServerData call completes last rather than the newest one, and a load superseded while it waited on the event scope would otherwise paint its own empty page (Pages/Public/Sessions/NewestLoadTracker.cs:14, rationale at :7 to :12, Track at :24, wired at PublicSessionList.razor.cs:211 to :212). The page also refuses to show a signed-out reader the full programme under a "My Schedule" title: on the interactive pass the ?mine=true deep link sends them to sign in first, and a restored My Schedule state is cleared once the reader is known to be anonymous (PublicSessionList.razor.cs:101 to :112, :140 to :143, :88 to :94). [Rubric §19, State Management & Data Flow] and [Rubric §18, UI Architecture & Component Design].

The single write on the public session detail page is extracted into its own component rather than growing the page: SessionBookmarkButton is the add-to / remove-from My Schedule toggle for one session, given only a session id and resolving everything else itself, so the page holds no bookmark state at all (Pages/Public/Sessions/SessionBookmarkButton.razor.cs:27, parameter at :38, hosted at Pages/Public/Sessions/PublicSessionDetail.razor:157). It repeats the optional-dependency move verbatim, resolving the Engagement-owned service through IServiceProvider.GetService and no-opping on every action when it is absent, so a deployment without Engagement renders exactly the same inert button it always did (:29, :33, resolved at :56, no-op guards at :75 and :109, reasoning at :18 to :25). It also skips its read during SSR prerender for the same reason the hosting pages skip theirs: under InteractiveAuto the interactive instance re-runs OnParametersSetAsync, so every visit would fetch the reader's bookmarks twice, and the prerender pass renders the unset star (:59 to :64). [Rubric §23, Front-End Performance & Rendering].

The public event page carries the one piece of third-party embedding in this library, and it is classified rather than trusted. VenueMapLinks decides whether a stored venue map URL is a Google Maps embed link, which Google serves only inside an iframe and which answers "The Google Maps Embed API must be used in an iframe" when opened as a top-level page (Pages/Public/Events/VenueMapLinks.cs:10, doc note at :3 to :9). The test is deliberately narrow: https only, one of three Google hosts, and either a /maps/embed path or a /maps path carrying output=embed (:16, :23 to :41); anything else keeps opening as an ordinary external link (Pages/Public/Events/PublicEventDetail.razor:73, :93, external link at :104). The host allow-list is not cosmetic: the page CSP's frame-src has to permit exactly those origins, a coupling recorded next to the array (VenueMapLinks.cs:14 to :15). The companion BuildSearchUrl escapes the venue street address into a regular (non-embed) Maps search link, and answers null when there is no address to search for, so the affordance is absent rather than dead (:48 to :51, used at PublicEventDetail.razor:86). PublicEventDetail is Pages/Public/Events/PublicEventDetail.razor.cs:18. [Rubric §11, Security].

The offline-first behaviour that used to sit in the page now lives behind an interface. IPublicSessionScheduleService / PublicSessionScheduleService run the live paged query and compose it with the framework's OfflineFirstPageSnapshot<TItem>, keeping the last successful first page in the device-local cache so a dead venue network still shows a programme (ADR-042 Wave 3, Services/Public/IPublicSessionScheduleService.cs:34, Services/Public/PublicSessionScheduleService.cs:19). The live path is never altered: the snapshot is consulted only when a fetch fails, a failure with nothing cached travels on to the grid's own handling unchanged, and the page owns only the "showing cached data" banner it raises through a callback (Pages/Public/Sessions/PublicSessionList.razor.cs:298, :305 to :312). The request is built once, so the fallback judges exactly the request a live fetch would send and never answers a My Schedule or narrowed request with the cached programme (:247 to :255). The one other door to the snapshot is a page whose query cannot run at all (a failed bookmark read, or an unresolved public scope): offline, the cached programme answers before either gate fails the page, since a dead venue network fails both reads alike, while online the snapshot never answers (:272 to :283). One page request is one SessionSchedulePageRequest (Services/Public/IPublicSessionScheduleService.cs:20), and My Schedule rides it as a set of bookmarked ids that scope the query server-side with an Id IN (...) filter rather than over-fetching and filtering in memory; an empty schedule short-circuits before the service is reached, so it can never overwrite the cached programme with nothing (Pages/Public/Sessions/PublicSessionList.razor.cs:262 to :267, live fetch at :269).

The rest of the device-capability layer (G26) shows up as injected interfaces that no-op on the web heads: the star toggle fires IHapticFeedbackService (Pages/Public/Sessions/PublicSessionListView.razor.cs:29, and again on the extracted toggle at Pages/Public/Sessions/SessionBookmarkButton.razor.cs:31), the filter bar shares a schedule screenshot through IScreenshotService and IShareService (Pages/Public/Sessions/PublicSessionListFilterBar.razor.cs:16), the public activity page opens directions through IMapNavigationService (Pages/Public/Activities/PublicActivityList.razor.cs:31), and /conference/sessions?mine=true is a deep link the MAUI head's home-screen quick action targets, which beats the saved page state when present (Pages/Public/Sessions/PublicSessionList.razor.cs:64, applied at :101). [Rubric §29, Resilience] and [Rubric §22, Responsive & Cross-Browser/Device].

Sponsors, partners, and activities, three feature areas in miniature

The sponsor surface is a compact tour of every pattern above. Organizers manage the roster through SponsorList / SponsorCreate / SponsorDetail: the list is an EventFilteredListPageBase<SponsorDTO> that inherits the default-event resolution and persistence wholesale (Pages/Sponsors/SponsorList.razor.cs:19), and the detail page edits every field except the owning event, on the stated rationale that moving a sponsorship between events is a create plus a delete (Pages/Sponsors/SponsorDetail.razor.cs:19). Attendees see the same data twice. PublicSponsorList resolves the featured event, filters the roster to it, and groups by SponsorTier ascending (package order) then by Sort and name, so the render order is deterministic rather than insertion-dependent (Pages/Public/Sponsors/PublicSponsorList.razor.cs:106 to :116); the featured event is chosen among published events only, because the events read is unscoped for privileged callers and could otherwise feature a draft (:79 to :80), and when the event publishes no packet URL the sponsorship call to action is hidden entirely rather than offering a dead link (Pages/Public/Sponsors/PublicSponsorList.razor.cs:88). ADCHome renders the same roster as a logo strip under the same tier-then-sort-then-name rule, reading it through the typed ISponsorUIService with a server-side filter to the featured event, so a second published edition's sponsors cannot bleed onto the landing page (Pages/Home/ADCHome.razor.cs:239, paged read at :248, filter built at :322 to :326, grouping at :263 to :267), and any failure leaves the strip empty and the call to action standing. The read passes an explicit 200-row roster cap because the paged endpoints default to 10 rows (Pages/Home/ADCHome.razor.cs:42, rationale at :38 to :41).

Partners are the sponsor shape run a second time, and they are the cheapest available proof that the composition actually is open for extension. The organizer trio is PartnerList / PartnerCreate / PartnerDetail (Pages/Partners/PartnerList.razor.cs:19, Pages/Partners/PartnerCreate.razor.cs:19, Pages/Partners/PartnerDetail.razor.cs:19) over PartnerService behind IPartnerUIService, an empty extension of the generic CRUD contract (Services/Partners/PartnerService.cs:10, Services/Partners/IPartnerUIService.cs:9). Where sponsors carry a commercial tier, partners carry a PartnerType, and the two pages differ from their sponsor counterparts only in that one field and its localized label (Pages/Partners/PartnerList.razor.cs:37, Pages/Partners/PartnerDetail.razor.cs:35). The create page makes the owning event a required field, precisely because the detail page refuses to move a partner afterwards, and pre-selects the current or next event through CurrentEventSelector so the common case is one click (Pages/Partners/PartnerCreate.razor.cs:14 to :18, default at :63 to :68, Pages/Partners/PartnerDetail.razor.cs:14 to :17). On the attendee side, ADCHome renders an announced-partners band grouped by type with Community first and each group ordered by Sort then name, read through the typed IPartnerUIService with the same server-side event filter, and any failure hides the whole band (Pages/Home/ADCHome.razor.cs:95, loaded at :152, fetched at :294, grouped at :308 to :312, remarks at :280 to :284). The whole area cost one nav entry, one route triple, and no edit at all to the module's service registration, for the reason the last section gives.

The activities area (the social programme: pre-conference party, coffee connect, after-party, closing ceremony) repeats the shape with two twists. ActivityCreate, ActivityDetail, and ActivityList are the organizer trio, with the create page defaulting the owning event to the current or next one through CurrentEventSelector (Pages/Activities/ActivityCreate.razor.cs:20, Pages/Activities/ActivityDetail.razor.cs:20, Pages/Activities/ActivityList.razor.cs:20). Because EventId is a real Activity column, the list's event filter needs no virtual-key resolution and goes straight through the base class's ApplyEventFilter, unlike the speaker list, whose event filter travels as a virtual key resolved server-side through the join tables (Pages/Public/Speakers/PublicSpeakerList.razor.cs:18 to :19). PublicActivityList renders the same programme chronologically for attendees, ordering by start time, then sort order, then name, so ties are deterministic (Pages/Public/Activities/PublicActivityList.razor.cs:112 to :114), and offers the directions affordance for an activity that carries its own off-site venue (:31).

The landing page

ADCHome is the conference front door, shared by the web and MAUI heads; both keep their own copy of the editorial assets under wwwroot/images, so the default serves both and neither overrides the ImageBasePath parameter (Pages/Home/ADCHome.razor.cs:19 to :20, :64 to :66, parameter at :69). It reads the events list through the typed IEventUIService, the same contract the organizer pages use, and features the live-or-next published event via CurrentEventSelector, while a failed read leaves the fallback defaults in place; drafts are filtered out client-side, because the endpoint scopes only non-privileged callers to published events and an organizer's read would otherwise feature an unpublished edition (Pages/Home/ADCHome.razor.cs:52, read at :204, selection at :206 to :215). With the sponsor and partner reads going through their typed services as well, the page declares no wire shapes of its own: its dependencies are the three injected UI services plus the TimeProvider every clock read goes through (Pages/Home/ADCHome.razor.cs:51 to :61). Three rendering decisions are worth internalizing. First, during SSR prerender it skips the backend fetches and the timer entirely and renders the static fallback, because an untimed server-side call to a cold backend would block the prerender and therefore the post-login navigation (Pages/Home/ADCHome.razor.cs:143, loads at :150 to :152). Second, the per-second countdown ticking lives in a child component behind a render fence, so this page arms only a single one-shot timer for the Live-to-Ended flip (Pages/Home/ADCHome.razor.cs:154 to :156, :171, timer at :185), classifying the moment into the EventPhase enum Upcoming/Live/Ended from the event's own time zone and going through CurrentEventSelector.ToUtc so the spring-forward gap at a midnight boundary cannot throw out of the render path (Pages/Home/ADCHome.razor.cs:328 to :349, enum at :99). Third, the fallback date is a named constant with an explicit warning that it must track the published event date, since a stale value makes the hero date and the countdown visibly jump once the real event loads (Pages/Home/ADCHome.razor.cs:49, warning at :46 to :48). [Rubric §23, Front-End Performance & Rendering]. The editorial content it renders (the keynote, the eight-track catalog, and the two pre-conference workshops) is held as static records in ADCHomeContent: KeynoteSpeakerInfo, ConferenceTrackInfo, and PreConferenceWorkshopInfo (Pages/Home/ADCHomeContent.cs:86, :95, :103, data at :18, :35, and :64); the workshop record carries only proper nouns plus a resource-key stem, so its audience and description lines stay localized (Pages/Home/ADCHomeContent.cs:99 to :103). The separate ticketing page for that workshop day is a fixed product fact rather than an event field, and says so where it sits (Pages/Home/ADCHome.razor.cs:34, rationale at :25 to :30).

Routes, navigation, and localized strings

All paths are centralized in ConferenceRoutePaths, a static catalogue of literal routes and id-parameterized builder methods (EventDetails(id), PublicSessionDetails(id), SponsorDetails(id), PartnerDetails(id), ActivityDetails(id), EventFeedbackOrganizer(id), and so on) typed against the module's identifier aliases and formatted culture-invariantly, so a route change happens in one file (ConferenceRoutePaths.cs:8 to :73; the partner triple at :38 to :40 is what a new area adds here). Two entries in that file are deliberate duplicates of routes owned by Engagement.UI, SponsorVisitLink and RoomCheckInLink (ConferenceRoutePaths.cs:64, :65), because Conference.UI must not reference Engagement.UI yet the organizer print surfaces need those links to encode into a QR; the reason is recorded inline at ConferenceRoutePaths.cs:60 to :63. [Rubric §25, Navigation, Routing & Information Architecture]. User-facing strings are not inline English: every page injects an IStringLocalizer<TPage> in its markup (Pages/Events/EventList.razor:6) and resolves labels and snackbar messages through L["..."] over co-located .resx resource pairs, including enum labels composed as keys (Pages/Partners/PartnerList.razor.cs:37). Where a string is deliberately left untranslated (the conference brand name, a postal address, a ticketing URL, the English-only editorial content) the code carries an explicit // i18n: allow marker with a reason (Pages/Home/ADCHome.razor.cs:35, :106, :110, Pages/Home/ADCHomeContent.cs:10 to :13). [Rubric §27, Internationalization & Localization] assesses externalized strings and culture-aware formatting; this area embodies it under ADR-027, which superseded the single-locale ADR-011 (primer §6).

How it all plugs into the shell

Two registration types wire the area in. ConferenceUIModule implements Common's IUIModule (the front-end counterpart of the IModule back-end contract): it declares the module's seventeen NavItem entries, whose labels are resource keys (Nav.Events, Nav.Dashboard, and so on) resolved by the shared NavMenu at render time against the co-located ConferenceUIModule.resx pair (ConferenceUIModule.cs:14, :16 to :18). Those seventeen split three ways: five public entries for everyone, Events, Sessions, Speakers, Sponsors, and Activities (ConferenceUIModule.cs:21 to :25), two speaker_id-claim-gated entries in the user section, the dashboard and the speaker's own QR (ConferenceUIModule.cs:28, :29), and an Organizer-role-gated admin group of ten, Events, Sessions, Speakers, Categories, Questions, Rooms, Sponsors, Partners, Activities, and Session Selection (ConferenceUIModule.cs:32 to :41); it then exposes its assembly so the host can discover the Razor routes (ConferenceUIModule.cs:44).

The companion DependencyInjection extension AddConferenceUI() (a C# extension(IServiceCollection) member, primer §4) is the one call a host makes (MMCA.ADC.Conference.UI/DependencyInjection.cs:19, extension block at :21, method at :27). It delegates the prologue to Common's AddUIModule<ConferenceUIModule>(), which scans the module assembly for every IEntityService<,> implementation as scoped and registers the descriptor as a singleton IUIModule (MMCA.ADC.Conference.UI/DependencyInjection.cs:31), then explicitly registers what a scan cannot infer: the four child-entity services (:34 to :37), the speaker dashboard (:40), the two organizer feedback services (:43, :44), session selection (:47), the session-materials service, which is outside the scan for exactly the reason its interface records (:52, note at :49 to :51), the offline-first schedule service (:55), the three lookup services (:58 to :60), and the composite speaker-detail lookup (:64). Last, it TryAdds TimeProvider.System as a singleton, because the pages' current-event selection, the home countdown, and the event lookup cache all read the clock through TimeProvider, yet no UI head registers one and the Engagement UI's own TryAdd is skipped when that module is disabled (:70, reasoning at :66 to :69). Public share links are not registered here: IPublicLinkBuilder comes from the framework's own AddUIShared, and the MAUI head overrides that registration afterwards so shared links always point at the web app, a note left in place where the registration used to be (MMCA.ADC.Conference.UI/DependencyInjection.cs:72 to :75). Because the scan covers the entity services, the partner area arrived with no edit to this file at all, and because the module contributes its own nav and assembly, the shell folds it in with no edit to the shell either. [Rubric §1, SOLID] (Open/Closed) and [Rubric §18, UI Architecture]. Read the per-type sections that follow for the mechanics of each page, model, and service; the bUnit and Playwright tests that exercise this library live in the testing chapter (G28).

ConferenceRoutePaths

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI/ConferenceRoutePaths.cs:8 · Level 0 · class (static)

• What it is: one static class holding every Conference UI route, as public static readonly string constants for fixed paths and small factory methods for id-bearing paths. It covers the organizer management routes, the public attendee routes, the speaker surfaces, and the two QR landing links, so no @page directive or NavigateTo call has to hard-code a URL.
• Depends on: no first-party types. It uses the module's identifier aliases (EventIdentifierType, SessionIdentifierType, SpeakerIdentifierType, ConferenceCategoryIdentifierType, QuestionIdentifierType, RoomIdentifierType, SponsorIdentifierType, PartnerIdentifierType, ActivityIdentifierType) that the Conference Shared project declares as global using (see the primer on identifier-type aliases, and ADR-048), plus System.Globalization.CultureInfo (:1).
• Concept introduced: a centralized navigation vocabulary. [Rubric §25, Navigation and Information Architecture] assesses whether routes form a coherent, role-aware information architecture instead of scattered magic strings; this class is that story in miniature. The paths split into two deliberate namespaces mirroring the module's two audiences: organizers work under bare prefixes (/events :10, /sessions :14, /speakers :18, /conferencecategories :22, /questions :26, /rooms :30, /sponsors :34, /partners :38, /activities :42) while attendees work under a /conference/... prefix (PublicSessions :47, PublicEvents :48, PublicSpeakers :51, PublicSponsors :53, PublicActivities :54). Detail routes are methods rather than constants because they interpolate a typed id: EventDetails(EventIdentifierType id) (:12) builds /events/{id} with string.Create(CultureInfo.InvariantCulture, ...) so an integer id can never be formatted with a culture-specific group separator. [Rubric §27, Internationalization] shows up here as the negative case: URLs are the one place culture-aware formatting must be suppressed.
• Walkthrough: the file is a flat list grouped by entity, each group contributing a list route, a create route, and a details factory: events (:10-12), sessions (:14-16), speakers (:18-20), conference categories (:22-24), questions (:26-28), rooms (:30-32), sponsors (:34-36), partners (:38-40), activities (:42-44). The public attendee block follows (:46-54), and it carries two detail factories of its own, PublicEventDetails (:49) and PublicSessionDetails (:50), so an attendee-facing deep link never borrows an organizer route. Then the speaker surfaces SpeakerDashboard and SpeakerQr (:57-58), the two QR self-service links, the organizer feedback factories, and the selection dashboard.
  • The partners routes follow the same shape as every other organizer entity (:38-40): Partners, PartnerCreate, and PartnerDetails(PartnerIdentifierType id), inserted between sponsors and activities so the entity list stays alphabetically adjacent to its neighbor in both the route file and ConferenceUIModule's nav list.
  • The two QR links are deliberate duplicates (:64-65). SponsorVisitLink and RoomCheckInLink build /engage/sponsors/{id} and /engage/rooms/{id}, but those two pages are owned by Engagement.UI. The comment (:60-63) records the reason: Conference.UI must not reference Engagement.UI, yet the organizer print surfaces need the URL to encode into a QR code, and EngagementRoutePaths duplicates a Conference session route the same way. Both are consumed by a QrCodeButton on the sponsor and room detail pages (MMCA.ADC.Conference.UI/Pages/Sponsor/SponsorDetail.razor:70, MMCA.ADC.Conference.UI/Pages/Room/RoomDetail.razor:58).
  • Feedback routes nest under their parent entity: EventFeedbackOrganizer gives /events/{id}/feedback and SessionFeedbackOrganizer gives /sessions/{id}/feedback (:68-69), so the URL itself expresses the ownership hierarchy. SessionSelectionDashboard closes the file (:72).
  • Two factories differ from the rest: SpeakerDetails (:20) and PublicSpeakerDetails (:52) use plain interpolation rather than string.Create(CultureInfo.InvariantCulture, ...), because SpeakerIdentifierType is a Guid whose ToString() is already culture-invariant.
• Why it's built this way: if the admin prefix ever moves (say /events becomes /admin/events), editing the one constant propagates the change to every navigation call, with no grep-and-replace and no risk of a stale link. Keeping the parameterized routes as methods typed against the identifier aliases means a wrong-entity id is a compile error, not a 404.
• Where it's used: every Conference UI Blazor page's @page directive and NavigationManager.NavigateTo call, the "see all sponsors" link on the landing page (ADCHome.razor:308), the NavItems collection in ConferenceUIModule (ConferenceUIModule.cs:21-40), and even one Engagement page, which links back to PublicSponsors (MMCA.ADC.Engagement.UI/Pages/Sponsors/SponsorVisit.razor:42).

IanaTimeZoneAttribute

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Events · MMCA.ADC.Conference.UI/Pages/Events/IanaTimeZoneAttribute.cs:30 · Level 0 · sealed class (ValidationAttribute)

• What it is: a client-side DataAnnotations rule that a string is a valid IANA time zone identifier (for example America/New_York), rather than any free-form text. An empty or whitespace value passes (:43-46), so it composes with [Required] rather than duplicating it.
• Depends on: System.ComponentModel.DataAnnotations (ValidationAttribute, ValidationResult, ValidationContext) and System.TimeZoneInfo (externals only, no first-party types).
• Concept introduced: validating client-side against the same authority the runtime trusts. IsValid (:39-55) does not maintain its own list of legal identifiers; it calls TimeZoneInfo.TryFindSystemTimeZoneById (:48), the same lookup the .NET runtime itself uses to resolve a zone. That keeps the client rule and the server's actual interpretation of the value in permanent agreement, at the cost of the rule depending on the OS's installed time zone database rather than a fixed, portable list. [Rubric §24, Forms, Validation and UX Safety] assesses whether a form rejects only truly illegal input; this does, because "illegal" is defined by the same authority that will later parse the value.
• Walkthrough: the constructor (:33-36) seeds a default English message. IsValid (:39-55) guards the null ValidationContext with ArgumentNullException.ThrowIfNull (:41), returns success on anything that is not a non-empty string (:43-46), returns success when TryFindSystemTimeZoneById finds the zone (:48-51), and otherwise builds a ValidationResult carrying ErrorMessage against the failing member name (:53-54).
• Why it's built this way: EventFormModel's TimeZone property already carries [Required]; layering this attribute on top rejects a syntactically present but meaningless value ("Nowhere") before the record ever reaches the server, where the same check would otherwise run for the first time.
• Where it's used: EventFormModel.TimeZone (MMCA.ADC.Conference.UI/Pages/Events/EventFormModel.cs:54), resolved at render time through the page's IStringLocalizer per ADR-027.

SessionizeCodeAttribute

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Events · MMCA.ADC.Conference.UI/Pages/Events/SessionizeCodeAttribute.cs:23 · Level 1 · sealed class (ValidationAttribute)

• What it is: a client-side DataAnnotations rule that an event's optional Sessionize import code contains only letters, digits, underscores, and hyphens. Like IanaTimeZoneAttribute, an empty or whitespace value passes, so it composes with the field being optional rather than required.
• Depends on: System.ComponentModel.DataAnnotations (externals), plus the first-party SessionizeCodeFormat helper (:41) that owns the actual character-class check.
• Concept introduced: the attribute as a thin DataAnnotations adapter over a plain format check. The attribute itself holds no regular expression or character-class logic; it delegates to SessionizeCodeFormat.IsValid(code) (:41) and only translates the answer into a ValidationResult. That keeps the format rule reusable outside DataAnnotations (for example from a non-Blazor caller) while still surfacing it as a normal form attribute here. [Rubric §15, Best Practices and Code Quality]: the format rule has exactly one implementation, which this attribute wraps rather than duplicates.
• Walkthrough: the constructor (:26-29) seeds the default message ("may contain only letters, digits, underscores and hyphens"). IsValid (:32-48) guards the null context (:34), passes on anything that is not a non-empty string (:36-39), passes when SessionizeCodeFormat.IsValid accepts the code (:41-44), and otherwise returns a ValidationResult against the failing member (:46-47).
• Why it's built this way: the Sessionize import code is embedded in a URL the server builds when refreshing an event, so rejecting an unsafe character client-side avoids a round trip that the server would reject for the same reason.
• Where it's used: EventFormModel.SessionizeCode (MMCA.ADC.Conference.UI/Pages/Events/EventFormModel.cs:59).

ConferenceUIModule

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI/ConferenceUIModule.cs:14 · Level 3 · class (sealed)

• What it is: the Conference module's UI descriptor. It contributes the navigation items for the whole conference capability (public Events/Sessions/Speakers/Sponsors/Activities, the claim-gated speaker Dashboard and QR page, and an organizer admin group covering Events, Sessions, Speakers, Categories, Questions, Rooms, Sponsors, Partners, Activities, and Session Selection) and exposes its assembly so the host can discover the module's routable Blazor components.
• Depends on: IUIModule (the contract it implements), NavItem and NavSection (the nav vocabulary from MMCA.Common.UI.Common), RoleNames (the Organizer role string), ConferenceRoutePaths (the URLs), plus MudBlazor Icons and System.Reflection.Assembly (externals, :1, :5) and the co-located ConferenceUIModule.resx / ConferenceUIModule.es.resx pair.
• Concept introduced: the modular-UI descriptor, the front-end analogue of IModule. [Rubric §18, UI Architecture and Component Design] assesses whether UI is composed from cohesive, self-describing modules rather than a hard-coded master shell; a module declaring its own menu is exactly that, and it is the Open/Closed half of [Rubric §1, SOLID]: enabling a module adds its navigation with no edit to the shell. [Rubric §25, Navigation and Information Architecture] is served because the items are role- and claim-aware and grouped into sections. [Rubric §11, Security] applies with an important caveat: hiding a nav item is UX only. The services still enforce authorization server-side, so the claim and role here are not the security boundary. Per ADR-027 the Title and Group strings are resource keys, not literals: typeof(ConferenceUIModule) in the TitleResource position on every item tells the shared NavMenu to resolve them against the co-located .resx at render time, which the file's own comment records (:16-17). The record's own documentation adds the failure mode (MMCA.Common.UI/Common/NavItem.cs:14-18): a key the resource type does not declare renders as the raw string, so a not-yet-translated entry is legible rather than blank.
• Walkthrough: NavItems (:18-42) is an IReadOnlyList<NavItem> initialized with a collection expression in three tiers, seventeen items in all.
  • Public (:21-25): five items for everyone, anonymous included, pointing at the /conference/... routes: Events, Sessions, Speakers, Sponsors, Activities. They carry no RequiredRole and no Section, so they default to NavSection.General (MMCA.Common.UI/Common/NavItem.cs:16).
  • Speaker (:28-29): the Dashboard and the QR page, both carrying RequiredClaim: "speaker_id" and Section: NavSection.User, so they appear only for a user whose JWT links them to a speaker record and they render in the user menu rather than the main list.
  • Organizer (:32-41): ten items, each carrying RoleNames.Organizer, Section: NavSection.Admin, and Group: "Nav.Group.Conference" so they fold into one labelled admin group. The new Nav.Partners entry (:38) sits between Nav.Sponsors and Nav.Activities, pointing at ConferenceRoutePaths.Partners with Icons.Material.Filled.Diversity3, matching the position of the routes themselves in ConferenceRoutePaths; the tier ends with the Session Selection entry (:41).
  • Assembly (:44) returns typeof(ConferenceUIModule).Assembly so the host's Blazor router can discover this library's routable components. Note that "Events", "Sessions", "Speakers", "Sponsors", and "Activities" each appear twice in the list, once public and once organizer, differing only in route and gating: the same label serves two audiences with two destinations. Partners has no public counterpart, so it appears once.
• Why it's built this way: mirroring the backend IModule pattern on the UI side keeps the app extensible. A host that boots without the Conference module simply has no conference nav and no conference routes, with no conditional code anywhere in the shell. The class also leaves AppBarComponentTypes and LayoutComponentTypes at their interface defaults (MMCA.Common.UI/Common/Interfaces/IUIModule.cs:20-23): Conference contributes no app-bar badge and no root overlay.
• Where it's used: registered as a singleton IUIModule by this module's DependencyInjection through AddUIModule<ConferenceUIModule>() (DependencyInjection.cs:23, implemented at MMCA.Common.UI/DependencyInjection.cs:320-329) and aggregated by the shared UI navigation builder in group 15.

EventFormModel

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Events · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Events/EventFormModel.cs:27 · Level 3 · abstract class (form model)

• What it is: the editable shape of a conference event, declared once and bound by two different screens: the organizer create page and the detail page's inline editor. It is a plain DataAnnotations-decorated class with no Blazor, no service, and no MudBlazor reference.
• Depends on: EventDTO for every length cap and QuestionModerationDefault for the moderation field (MMCA.ADC.Conference.Shared.Events, line 2), plus AbsoluteUrlAttribute from MMCA.Common.UI.Validation (line 4), OptionalEmailAttribute from the same namespace, and the co-located IanaTimeZoneAttribute and SessionizeCodeAttribute. Externals: System.ComponentModel.DataAnnotations (Required, MaxLength).
• Concept introduced, the shared form model as the single declaration of a form's rules. A Blazor form can end up declaring its rules in three places at once: on the DTO, on each MudTextField's Required / RequiredError / MaxLength attributes, and again in a hand-written check inside the submit handler. This type collapses the first two. Each property carries its own [Required] / [MaxLength] / [OptionalEmail] / [AbsoluteUrl] (lines 44-89), and two of the properties add a format rule of their own: IanaTimeZoneAttribute on TimeZone (line 54) and SessionizeCodeAttribute on SessionizeCode (line 59). The pages bridge MudBlazor to them through ModelValidation.For rather than repeating a rule per field. The two ErrorMessage resource keys that name a missing value are hoisted to consts, NameRequiredKey (line 33) and TimeZoneRequiredKey (line 40), so the model's rule and the field's own RequiredError affordance quote the same key instead of two string literals that can drift. Every other ErrorMessage is a bare resource key too, resolved at render time by the page's DataAnnotationsModelValidator wrapped around that page's IStringLocalizer (ADR-027, Website/docs-src/adr/027-multi-locale-i18n.md). [Rubric §24, Forms, Validation & UX Safety] assesses whether a form can express only legal input and says why in place: the caps here are not invented, they are EventDTO.NameMaxLength and its siblings (lines 45, 49, 55, 60, 64, 69, 73, 78, 83, 88), so the client rejects exactly what the server column would reject. [Rubric §15, Best Practices & Code Quality] assesses whether one change lands in one place: adding a field to the event form means one property here plus one control in the shared EventFormFields component, and both screens get it. [Rubric §27, Internationalization]: no message is a literal, every one is a key (ADR-011, Website/docs-src/adr/011-single-locale-i18n.md, revisited by ADR-027).
• Walkthrough
  • Two resource-key consts (lines 34, 41) for the required-value messages.
  • Ten annotated text properties (lines 44-89): Name and TimeZone are required and non-nullable with string.Empty defaults; the eight optional ones are nullable. TimeZone also carries [IanaTimeZone] (line 54) so a value that is present but not a real zone identifier is rejected before it reaches the server, and the optional SessionizeCode carries [SessionizeCode] (line 59) for the same reason. OrganizerContactEmail adds [OptionalEmail] (line 77), the framework attribute that validates the address only when one is entered, and VenueMapUrl, SponsorshipPacketUrl, and TicketingUrl all add [AbsoluteUrl] (lines 68, 82, 87), the framework attribute that rejects a relative or scheme-less URL.
  • Three unannotated properties (lines 92, 95, 98): StartDate, EndDate, and QuestionModerationDefault. The class doc (lines 19-24) is explicit that this is deliberate: DataAnnotations cannot express a date-range rule or a picker's required affordance, so the pickers keep their own required markup and the pages keep the cross-field date check, but the values still live on the one model rather than as loose page fields.
• Why it's built this way: the create page and the detail editor edit the same thing, so a value one accepts must be a value the other accepts. Making the model abstract and letting the two concrete models add only their save shape (see EventCreateModel and EventEditModel) makes that guarantee structural instead of a convention someone has to remember.
• Where it's used: EventCreateModel and EventEditModel derive from it; EventCreate and EventDetail bind an instance to the shared EventFormFields component (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Events/EventFormFields.razor).

EventCreateModel

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Events · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Events/EventCreateModel.cs:11 · Level 4 · sealed class (form model)

• What it is: the create-side concrete of EventFormModel. It adds exactly two things to the shared base: the time zone a new event opens on, and the method that turns the entered values into the DTO the create posts.
• Depends on: EventFormModel and EventDTO (line 1). No services, no Blazor.
• Concept introduced, the model owns the save shape. The recurring alternative is a page handler that news up a DTO inline from a dozen backing fields. Moving that into ToNew means the "what a create posts" decision is one readable object initializer instead of a paragraph inside an async Task, and it is unit-testable without a renderer. [Rubric §14, Testability] assesses whether behavior can be exercised without its host: this class has no Blazor surface at all. [Rubric §18, UI Architecture & Component Design]: the code-behind keeps orchestration (validate, post, navigate) and delegates shape.
• Walkthrough
  • The parameterless constructor (line 14) seeds TimeZone = "America/New_York", the conference's home zone, so the common case needs no edit. That is the entire create-specific default.
  • ToNew() (lines 25-42) builds an EventDTO with Id = default (line 28), converts the two DateTime? pickers with DateOnly.FromDateTime (lines 31-32), copies the ten text fields across, and hard-codes IsPublished = false (line 41). The null-forgiving StartDate!.Value is safe because the page runs its date guards first; the <remarks> (lines 21-24) says exactly that.
  • Note what ToNew does not carry: QuestionModerationDefault is on the base but is not written into the created DTO, so a new event takes whatever default the server applies. Only EventEditModel posts it.
• Why it's built this way: Id = default hands identifier assignment to the server, and the unpublished default exists so an organizer can fill in venue details and refresh from Sessionize before anything is publicly visible. Publishing is a separate deliberate gesture on EventDetail.
• Where it's used: instantiated as the _model field of EventCreate (.../Pages/Event/EventCreate.razor.cs:44) and consumed by its CreateEventAsync (.../Pages/Event/EventCreate.razor.cs:84).

EventEditModel

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Events · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Events/EventEditModel.cs:11 · Level 4 · sealed class (form model)

• What it is: the edit-side concrete of EventFormModel, used by EventDetail's inline editor. It is a round trip in two methods: LoadFrom fills the editor from the loaded event, ToUpdated produces the DTO the update posts.
• Depends on: EventFormModel and EventDTO (line 1).
• Concept introduced, shadow editing through a model instead of shadow fields. The live loaded EventDTO is never mutated: opening the editor copies it into this model, and only a validated save produces a new DTO. Because both directions are one method, a newly added property cannot be carried by one path and dropped by the other, which is exactly the failure mode a field-by-field transcription in the page invites (class doc, lines 13-15). [Rubric §8, Data Architecture] assesses whether concurrency is handled deliberately: ToUpdated re-sends the loaded RowVersion (line 55), the client half of the optimistic-concurrency token in Website/docs-src/adr/035-optimistic-concurrency.md, so a stale edit is rejected rather than silently overwriting a concurrent one. [Rubric §11, Security] assesses whether a client can move state through a path it should not: IsPublished is copied straight off the source (line 68), never off the form, so the edit form structurally cannot publish or unpublish.
• Walkthrough
  • LoadFrom(EventDTO source) (lines 18-35): ArgumentNullException.ThrowIfNull (line 20), then copies the ten text fields, converts the two DateOnly values back to DateTime at TimeOnly.MinValue for the pickers (lines 24-25), and copies QuestionModerationDefault (line 34).
  • ToUpdated(EventDTO source) (lines 48-71): builds a new EventDTO carrying identity and concurrency from the source (Id line 54, RowVersion line 55, IsPublished line 68), the edited text and dates from the model, and the edited QuestionModerationDefault (line 69). Same null-forgiving date access, same <remarks> justification (lines 44-47).
  • The class doc (lines 8-9) records the deliberate omission: no published flag on the form, because publishing and unpublishing are their own buttons.
• Why it's built this way: an update endpoint reads a full DTO, so something must write every property; doing it in one place is the only way to keep the read path and the write path in agreement as fields are added.
• Where it's used: the _model field of EventDetail (.../Pages/Event/EventDetail.razor.cs:53), driven by its StartEditing (.../Pages/Event/EventDetail.razor.cs:119) and SaveChangesAsync (.../Pages/Event/EventDetail.razor.cs:156).

EventCreate

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Events · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Events/EventCreate.razor.cs:16 · Level 6 · class (Blazor code-behind)

• What it is: the organizer form that creates a conference event. It binds an EventCreateModel to the shared EventFormFields block, validates, posts the record unpublished, and redirects to the new event's detail page. It is the place where the Conference create-form shape is taught.
• Depends on: IEventUIService (line 18), IToastService (line 20), EventCreateModel (line 50), ModelValidation plus DataAnnotationsModelValidator (line 44), ConferenceRoutePaths, ResultUiExtensions.NotifyOnFailure (line 105), and ErrorMessages (line 78). Externals: Blazor ([Inject], NavigationManager, OnInitialized), MudBlazor (MudForm, BreadcrumbItem, Icons.Material.Filled.Home), the UnsavedChangesGuard, EventFormFields, and ErrorSummary components wired in the template (.../Pages/Event/EventCreate.razor:10, 26, 41), and the IStringLocalizer<EventCreate> the template injects as L (.../Pages/Event/EventCreate.razor:6).
• Concept introduced, the partial-class code-behind create form. Every Conference page is a .razor template plus a .razor.cs partial holding the injected services, backing fields, and handlers. The create leg layers five recurring mechanisms on that split, and every other create page in this group repeats them:
  1. Cancel-on-disposal: a CancellationTokenSource _cts (line 22) is read through a LifetimeToken property (line 27, _cts.LifetimeToken()) and passed to the service call (line 99), then cancelled plus disposed through the standard Dispose(bool) pattern (lines 127-143), so an in-flight save cannot resolve against a torn-down component. The property exists because reading Token off a disposed source throws ObjectDisposedException; LifetimeToken() hands a handler that resumes after disposal an already-cancelled token instead, so it exits through its OperationCanceledException path (comment, lines 24-26; MMCA.Common/Source/Presentation/MMCA.Common.UI/Common/ComponentLifetimeExtensions.cs:26).
  2. Model-declared validation: OnInitialized builds one delegate, ModelValidation.For(_model, new DataAnnotationsModelValidator(L)) (line 44), and the template hands that single delegate to every field on EventFormFields (.../Pages/Event/EventCreate.razor:26). No Required or MaxLength is written in markup; the rules live on EventFormModel and the ErrorMessage keys are resolved through L (ADR-027).
  3. Validate-then-submit: await _form.ValidateAsync() followed by an IsValid guard (lines 75-80), then two hand-written cross-field checks DataAnnotations cannot express, both dates present (lines 82-86) and end not before start (lines 90-94). The second one's comment (lines 88-89) is explicit that it mirrors the server rule so the organizer sees it without a round trip. The IsSaving property (line 47) disables the button for the round trip and is always cleared in finally (lines 117-120).
  4. An unsaved-changes guard: _isDirty is set by MarkDirty() (line 66), passed to EventFormFields as OnFieldChanged (.../Pages/Event/EventCreate.razor:27), and read by the UnsavedChangesGuard component (.../Pages/Event/EventCreate.razor:10). It is cleared before the success redirect (line 109) so the guard does not block the page's own navigation.
  5. Two-tier failure handling: a failed Result is captured in _saveResult (line 100) and notified through created.NotifyOnFailure(Toast, L) (line 105), so the wording reaches both the snackbar and, inline, the template's ErrorSummary; the comment (lines 103-104) explains why the inline copy matters, the snackbar can time out while the reader is still reading the form. OperationCanceledException is swallowed as expected during disposal or an InteractiveAuto render-mode transition (lines 113-116). Website/docs-src/adr/056-blazor-render-mode-strategy.md is the record behind that second catch. [Rubric §24, Forms, Validation & UX Safety] assesses client validation, unsaved-change protection, and safe submits: this page validates before posting, tracks dirty state, and guards navigation away. [Rubric §18, UI Architecture & Component Design]: the code-behind holds orchestration, the model holds rules and shape, the shared field component holds markup. [Rubric §11, Security]: the route is organizer-only via @attribute [Authorize(Roles = "Organizer")] (.../Pages/Event/EventCreate.razor:2). [Rubric §27, Internationalization]: every label, breadcrumb, and toast reads through L (for example L["Snackbar.Created"], line 110), per ADR-011 and ADR-027.
• Walkthrough
  • OnInitialized (lines 33-45) builds the three-item breadcrumb trail (Home, the events list, a disabled "Create" leaf, lines 36-41) and wires the validation delegate (line 44).
  • _model (line 50) is a single EventCreateModel, whose constructor already seeded the time zone; the page keeps no per-field backing state of its own.
  • CreateEventAsync (lines 68-121) clears _saveResult (line 73), validates, runs the two date guards, sets IsSaving, posts _model.ToNew() with AddAsync (line 99), clears _isDirty, toasts success, and navigates to ConferenceRoutePaths.EventDetails(createdEvent.Id) (line 111) using the id the server returned.
  • NavigateToList (line 123) is the cancel path back to /events.
  • The template's ErrorSummary (.../Pages/Event/EventCreate.razor:41-42) collapses duplicates: its own comment (lines 36-40) notes MudBlazor validates a For-bound field through the model annotations as well as through the shared delegate, so one empty field can report the same rule twice, once localized and once as the bare key. Resolving every entry and de-duplicating leaves one wording per broken rule.
• Why it's built this way: a new event starts unpublished so an organizer can complete venue details and refresh from Sessionize before anything is publicly visible; publishing is a separate deliberate action on EventDetail. Binding the same EventFormFields block that the detail editor binds is what makes "a value the create page accepts is a value the detail page accepts" true by construction rather than by review.
• Where it's used: the /events/create route (.../Pages/Event/EventCreate.razor:1), reached from EventList's create button; on success it hands off to EventDetail.

EventList

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Events · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Events/EventList.razor.cs:17 · Level 6 · class (Blazor code-behind)

• What it is: the organizer browse page for events: a server-paged, server-sorted grid on desktop, an infinite-scroll card list on mobile, with a name search, a delete-with-confirmation action, and navigation into create and detail. It is the simplest inheritor of the shared list base and the place where the Conference list-page shape is taught.
• Depends on: extends DataGridListPageBase<TDto> over EventDTO (line 16) and injects IEventUIService (line 21). It uses ListPageActions (lines 40, 72), ErrorMessages (line 78), ConferenceRoutePaths, and the MobileInfiniteScrollList<TItem>, DeleteConfirmation, and ListNoRecordsContent components from MMCA.Common.UI. The toast service and the IsMobile flag come from the base.
• Concept introduced, the two-layout list page over one shared base. A Conference list page is short because everything hard lives in DataGridListPageBase<TDto>. The derived page supplies five things and nothing else:
  1. A grid reference: _dataGrid captured via @ref and surfaced through the overridden GridRef (lines 24-25), which the base needs to restore rows-per-page after first render.
  2. Filter persistence: SaveFilters / RestoreFilters (lines 33-37) write and read the page's own search string, and the base persists them so filters survive navigation, refresh, and a shared link. [Rubric §25, Navigation & Information Architecture].
  3. The fetch delegates: LoadServerData (lines 48-57) hands the base a lambda that calls EventService.GetPagedAsync and an additional-filters callback that appends Name contains <search> (lines 53-57). LoadServerDataAsync in the base owns cancellation-token resetting, page-index conversion, sort extraction, the IsLoading and LoadFailed flags, and uniform error reporting.
  4. A mobile fetch: FetchMobilePage (lines 60-66) repeats the same filter build for the card list, which pages by "load more" instead of a pager and sorts by Name asc (line 65). [Rubric §22, Responsive & Cross-Browser]: the page renders two genuinely different layouts off the base's IsMobile flag rather than reflowing one grid (.../Pages/Event/EventList.razor:31).
  5. Actions: DeleteEventAsync (lines 71-79) delegates the confirm, delete, toast, and reload sequence to ListPageActions.DeleteWithConfirmationAsync, and ReloadActiveLayoutAsync (lines 39-40) dispatches a refresh to whichever layout is live. The failure path is worth noting: when a fetch fails the base sets LoadFailed, and the template feeds it to ListNoRecordsContent with an OnRetry handler wired to RetryLoadAsync (line 28, .../Pages/Event/EventList.razor:131), so a failed load renders an inline retry instead of an empty list that reads as "no events". [Rubric §19, State Management & Data Flow]. Data access follows Website/docs-src/adr/094-client-entity-data-access.md: the page never touches HttpClient, only the typed I*UIService client, and expresses filters as operator-plus-value pairs the server model binder understands.
• Walkthrough
  • Title and EntityName (lines 18-19) come from the injected localizer; Title is the abstract member the base uses in its error messages.
  • OnSearchChanged (lines 42-46) stores the text and reloads the active layout, so typing drives a server round trip rather than a client-side filter over the current page.
  • OnMobileCardClick (line 68) and NavigateToDetails (lines 84-85) both route through ConferenceRoutePaths.EventDetails(id), and NavigateToCreate (lines 81-82) opens EventCreate.
  • The grid declares three sortable PropertyColumns over Name, StartDate, and EndDate (.../Pages/Event/EventList.razor:79, 87, 96), with Name carrying InitialDirection="SortDirection.Ascending" so the first page arrives ordered.
• Why it's built this way: many list pages across the workspace share this base, so browse behavior, state persistence, and error handling stay identical everywhere and a new list page costs a few dozen lines.
• Where it's used: the /events organizer route (.../Pages/Event/EventList.razor:1-2, Authorize(Roles = "Organizer")); rows open EventDetail and the create button opens EventCreate.

EventDetail

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Events · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Events/EventDetail.razor.cs:20 · Level 8 · class (Blazor code-behind)

• What it is: the organizer's event console. It loads one event by route id and offers four distinct operations on it: inline edit, publish/unpublish, refresh from Sessionize, and delete. It is the richest detail page in the Conference UI in terms of verbs, and the place where the detail-page shape is taught.
• Depends on: DetailPageBase (@inherits, .../Pages/Event/EventDetail.razor:6), IEventUIService (line 24) for all four operations, IToastService (line 26), EventEditModel (line 54), LatestLoadGuard through the base's LoadGuard (MMCA.Common/Source/Presentation/MMCA.Common.UI/Pages/Common/DetailPageBase.cs:43); EventDTO, RefreshFromSessionizeResultDTO, and QuestionModerationDefault; ConferenceRoutePaths, ErrorMessages (line 99), ResultUiExtensions.NotifyOnFailure (lines 108, 173, 180, 341), DomainHelper's Parse<T> extension (line 4), and the DeleteConfirmation, UnsavedChangesGuard, EventFormFields, and ErrorSummary components (.../Pages/Event/EventDetail.razor:11, 37, 51, 197).
• Concept introduced, load-once-on-parameters over a shared detail base. Four mechanisms combine here and recur in every detail page in this group:
  1. A shared base owns the boring half. DetailPageBase supplies PageToken (the page-scoped cancellation token with its dispose pattern) and the edit-mode lifecycle (IsEditing, IsDirty, BeginEdit, EndEdit), so this file contains no CancellationTokenSource and no Dispose at all. It also supplies LoadGuard, a LatestLoadGuard the load below uses so only the newest load may write the page.
  2. Route id as a string: the id arrives as [Parameter] public string Id (line 28) and is converted with Id.Parse<EventIdentifierType>() (line 90), so the page compiles unchanged whichever primitive the alias maps to (ADR-048, ADR-085).
  3. Load once per id, newest load wins: OnParametersSetAsync compares against _loadedId and returns early when the id is unchanged (lines 70-80), so a re-render does not refetch. When the id does change, LoadEventAsync starts with LoadGuard.Begin() (line 85), which supersedes any load still in flight, and a response that is no longer current is dropped (lines 91-94).
  4. Shadow editing through a model: StartEditing copies the loaded record into EventEditModel and calls BeginEdit (lines 126-135); CancelEditing is just EndEdit (line 137). The live Event object is never mutated until a validated save succeeds. [Rubric §24, Forms, Validation & UX Safety]. [Rubric §8, Data Architecture] assesses a deliberate concurrency strategy: every mutating call re-sends the loaded RowVersion, on save through EventEditModel.ToUpdated and on publish/unpublish explicitly (lines 220-221), which is the client half of the optimistic-concurrency token described in Website/docs-src/adr/035-optimistic-concurrency.md. [Rubric §6, CQRS & Event-Driven]: publish and unpublish are not IsPublished flag edits, they are their own named service operations (PublishAsync / UnpublishAsync, .../Services/IEventUIService.cs:13, 15), so each state transition stays a use case the server can guard on its own terms. [Rubric §13, Observability & Operability]: the Sessionize refresh returns a RefreshFromSessionizeResultDTO held in _refreshResult (line 64) so the organizer sees what the import actually did.
• Walkthrough
  • OnInitialized (lines 34-46) builds breadcrumbs and wires the validation delegate against _model (line 45), exactly as EventCreate does.
  • LoadEventAsync (lines 82-124): LoadGuard.Begin() yields a token and a generation (line 85), and GetByIdAsync(id, true, token) fetches with children (line 90); a response from a superseded generation returns without touching the page (lines 91-94). A NotFound result clears Event and toasts ErrorMessages.NotFound (lines 96-100); any other failure goes through NotifyOnFailure (line 108) so the server's own message reaches the user; success seeds _sessionizeCode (line 104). The finally clears IsLoading only for the current generation (lines 117-122), because an unconditional clear would let a superseded response switch off the spinner the newer load just turned on (comment, lines 117-118).
  • SaveChangesAsync (lines 139-197): validate the form, re-check both dates present and end not before start (lines 153-165, the same two guards EventCreate runs), post _model.ToUpdated(Event) (line 170), then refetch the record (line 177) so the page shows server truth rather than the values it just sent, toast, and EndEdit.
  • PublishAsync / UnpublishAsync (lines 199-201) both delegate to SetPublishedAsync(bool) (lines 208-249), which picks the failure message up front (line 215), calls the chosen named operation with the current RowVersion (lines 219-221), refetches, and reports the reload miss with the same message as the toggle itself, since the toggle is what the user asked for (doc comment, lines 203-207). A failed toggle shows ActionErrorMessage(toggled, failureMessage) (line 227): a refusal the API stated, such as a stale row version answering 412 with Concurrency.PreconditionFailed, shows its own localized message (comment, lines 224-226).
  • ActionErrorMessage(Result, fallback) (lines 261-269) is the shared rule for a failed user action: an ErrorType.Unexpected result (a 500, a transport failure, a timeout) shows the generic fallback rather than raw diagnostic text, anything else shows result.LocalizedErrorMessage(L) and falls back only when that is null (ADR-027 Decision 9 carve-out, per its doc comment). ErrorType is the classification it tests.
  • SessionizeCodeError (lines 251-259) is the Sessionize panel's own format check: null while the code is blank or well formed, otherwise the same Validation.SessionizeCodeFormat message the Edit form shows, since SessionizeCodeAttribute applies the same SessionizeCodeFormat rule.
  • RefreshFromSessionizeAsync (lines 271-322) first rejects a malformed code before any call, toasting SessionizeCodeError (lines 278-284), because the persist step would refuse it after a round trip with a less specific message. It then hands the whole gesture to one service call, RefreshFromSessionizeWithCodeAsync(Event, _sessionizeCode, PageToken) (line 292). The service owns persist-then-import-then-reload and returns a single outcome carrying both the summary and the refreshed event (lines 309-310), so the page keeps one failure message for the whole gesture. The failure branch toasts through ActionErrorMessage (line 295) and does one more thing: because the code persist and the refresh stamp can both commit before the import fails, moving the row version, it refetches the stored event and adopts it when the read succeeds (lines 301-304). The comment (lines 297-300) names the payoff: the next refresh, save, or publish carries the current RowVersion instead of hitting a 409 until a reload, while the typed _sessionizeCode is left as entered so a retry re-persists it. This is the same client half of ADR-035 described above, applied to a partially committed gesture.
  • DeleteEventAsync (lines 324-352): confirm through _deleteConfirm.ShowAsync(Event.Name) (line 331), delete, then navigate back to the list.
• Why it's built this way: an event is the root aggregate of the whole conference, so publishing, importing, and editing carry separate audit meaning rather than collapsing into one PUT; keeping each as its own service call is what lets the server enforce its own rules per transition. Pushing the three-step Sessionize gesture into the service (rather than sequencing it in the page) is the same instinct applied one level down.
• Where it's used: the /events/{Id} organizer route (.../Pages/Event/EventDetail.razor:1-2), reached from EventList rows and from EventCreate's success redirect. Its "view feedback" button opens OrganizerEventFeedback (.../Pages/Event/EventDetail.razor:135-136).
• Caveats / not-in-source: what the Sessionize refresh imports, and how it reconciles existing rows, is server-side; this page only shows the returned summary.

DependencyInjection

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI/DependencyInjection.cs:19 · Level 6 · class (static)

• What it is: the Conference UI composition root. Its single AddConferenceUI() method is the one call a host makes to register every Conference UI service (the per-entity CRUD services by assembly scan, then the child-entity, dashboard, feedback, selection, session-asset, offline-schedule, and lookup services explicitly) plus the module descriptor, and a fallback TimeProvider for the clock-reading pages.

• Depends on: ConferenceUIModule and, through AddUIModule<T> (MMCA.Common.UI/DependencyInjection.cs:320-329), Scrutor's assembly-scanning API and the open generic IEntityService<TEntityDTO, TIdentifierType>. Then this module's own service contracts: IEventSpeakerUIService, ISessionSpeakerUIService, ISessionCategoryItemUIService, ISpeakerCategoryItemUIService, ISpeakerDashboardUIService, IOrganizerEventFeedbackUIService, IOrganizerSessionFeedbackUIService, ISessionSelectionUIService, ISessionAssetUIService, IPublicSessionScheduleService, ISpeakerLookupService, IEventLookupService, ICategoryItemLookupService, and ISpeakerDetailLookupService.

• Concept introduced: the extension(IServiceCollection) registration block, half convention and half explicit. [Rubric §3, Clean Architecture] and [Rubric §15, Best Practices & Code Quality] both come down to keeping wiring at the edges; this file is the module's one wiring point. It uses the C# preview extension-type syntax extension(IServiceCollection services) (:21) to hang AddConferenceUI (:27) off IServiceCollection, the same idiom every module's DependencyInjection uses. The convention half is delegated to AddUIModule<ConferenceUIModule>() (:31), which does two things in one call (MMCA.Common.UI/DependencyInjection.cs:323-329): a Scrutor scan of this assembly registering every IEntityService<,> implementation AsImplementedInterfaces().WithScopedLifetime(), and the singleton registration of the descriptor itself. Registering AsImplementedInterfaces is what makes a page able to inject the narrow per-entity interface rather than the open generic, and it means adding a new entity service needs no edit here.

• Walkthrough: the scan runs first (:31), then the method registers by hand exactly the services the scan cannot see, because they do not implement IEntityService<,>:

  • four child-entity managers for the join relationships (:34-37);
  • the speaker dashboard service (:40);
  • the two organizer feedback moderation services, tagged BR-53 in the comment (:42-44);
  • the session-selection decision-support service (:47);
  • the session-asset service, registered explicitly because the endpoint has no paged list, no lookup, and no by-id read, so the service declares only the five operations the API actually offers, per the comment (:49-52);
  • the offline-first page fetch for the public session schedule, tagged to ADR-042 Wave 3 (:54-55);
  • three cross-module lookup services (:57-60);
  • the composite lookup for the speaker detail page (:64), whose comment states its purpose precisely (:62-63): one call and one failure branch over the three lookups that page needs together;
  • and TryAddSingleton(TimeProvider.System) (:70). The comment above it (:66-69) gives the reason: the pages' current-event selection, the home countdown, and the event lookup cache read the clock through TimeProvider, no UI head registers one (the heads never call AddInfrastructure, where the framework's registration lives), and the Engagement UI's own TryAdd is skipped when that module is disabled. TryAdd means whichever module registers first wins and the second call is a no-op, so the two UI modules can each guarantee the clock without colliding.

  Every per-service registration is AddScoped; the singletons are the descriptor and the TimeProvider, both stateless, so one instance per container is correct. The method returns services for chaining (:76).

• Why it's built this way: scanning the uniform bulk and spelling out the one-off collaborators keeps registration short without hiding the non-trivial wiring. The closing comment (:72-75) documents what this file deliberately does not register: IPublicLinkBuilder comes from the framework, where AddUIShared TryAdd-registers the browser-origin builder (MMCA.Common.UI/DependencyInjection.cs:194-196), and the MAUI head overrides it afterwards with AddCommonMauiPublicLinkBuilder() (MMCA.Common.UI.Maui/DependencyInjection.cs:140, called at MMCA.ADC/Source/Hosts/UI/MMCA.ADC.UI/MauiProgram.cs:145) so last-registration-wins points shared links at the configured public web URL. Recording an ordering dependency that lives in another repository, right where a reader would otherwise expect the registration, is the cheap version of [Rubric §34, Architecture Governance and Documentation].

• Where it's used: called once during startup by each of the three UI heads: the Blazor Server host (MMCA.ADC/Source/Hosts/UI/MMCA.ADC.UI.Web/Program.cs:171), the WebAssembly client (MMCA.ADC/Source/Hosts/UI/MMCA.ADC.UI.Web.Client/Program.cs:59), and the MAUI host (MMCA.ADC/Source/Hosts/UI/MMCA.ADC.UI/MauiProgram.cs:133), alongside the other modules' AddXxxUI() extensions.

PublicSessionListFilterState

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/PublicSessionListFilterState.cs:12 · Level 0 · class (internal static)

• What it is: the translation layer between PublicSessionList's live filter fields and the flat string-to-string map that DataGridListPageBase<TDto> persists per page. Two static methods, Save and Restore, and no state of its own (PublicSessionListFilterState.cs:12).
• Depends on: only System.Globalization (:1) and the RoomIdentifierType / EventIdentifierType aliases. No component base, no injected service, no fetch. The class doc records the placement rule (:5-10): it is kept beside the page, like PublicScheduleRoomOptions, so the code-behind holds only the live filter fields and the handlers that change them.
• Concept introduced, persisted filter state as a pure, audience-aware codec. The list-page base can only persist strings, so every page that saves filters needs a codec. Writing it as a static pair rather than as two page methods buys three things worth naming.
  1. A sentinel that distinguishes "cleared" from "never set". Save writes "all" when a privileged reader has explicitly cleared the event filter (:42), because an absent key means "no saved state, apply the default" while an empty string would be ambiguous. Restore reads that sentinel back as an explicit null plus a resolved flag (:66-70). [Rubric §19, State Management & Data Flow] (assesses that restored state is distinguishable from absent state).
  2. Persistence itself is audience-scoped. persistEventId is a caller-supplied flag (:33) and the parameter doc states the rule (:22-26): only a privileged reader persists an event choice, because everyone else is always locked to the computed current or next event, so persisting it would only leak into shared URLs. The room filter, by contrast, is persisted for every audience, and the roomId doc says why in one sentence (:17-20): a room only ever narrows within the reader's own event. [Rubric §26, Front-End Security] (assesses that a client-persisted preference cannot widen what a reader sees) and [Rubric §11, Security].
  3. A restore never destroys a value it cannot read. Every branch in Restore is guarded by a TryGetValue plus a TryParse, and each parameter is passed in and returned out unchanged when the map has nothing usable (:57-90), so a corrupt or partial map degrades to "keep what the page already has" instead of resetting the view. [Rubric §24, Forms, Validation & UX Safety].
• Walkthrough
  • Save (:27-44): writes search verbatim (:35), the My Schedule toggle as an invariant bool string (:36), the room id as an invariant number or empty (:37), and the event id only when persistEventId is true, with the "all" sentinel for an explicit clear (:39-43).
  • Restore (:57-91): parses eventId first, accepting "all" case-insensitively as an explicit clear and any invariant integer as a pick, setting eventFilterResolved in both cases so the page knows not to recompute the default (:64-76); then roomId (:78-82), then mySchedule compared case-insensitively against "true" (:84-87); search falls back to empty (:89). The five values leave as one named tuple (:57, returned at :90) that the caller destructures straight into its fields.
  • The method doc records the one thing Restore deliberately does not do (:46-49): a restored room that the resolved event does not offer is dropped afterwards by the page's room-options rescope, not here, because this type never sees the events.
• Why it's built this way: the codec is pure and total, so its rules (the sentinel, the audience gate, the keep-on-unparseable behavior) can be exercised without a renderer, and the page keeps a two-line SaveFilters / RestoreFilters pair instead of forty lines of string handling. [Rubric §14, Testability] and [Rubric §1, SOLID].
• Where it's used: called only from PublicSessionList's sealed base overrides, SaveFilters (PublicSessionList.razor.cs:78-81, passing persistEventId: _isPrivileged && _eventFilterResolved) and RestoreFilters (PublicSessionList.razor.cs:84-87).

VenueMapLinks

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Events · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Events/VenueMapLinks.cs:10 · Level 0 · internal static class

• What it is: a small, stateless helper that decides how a stored venue map URL should render: as an embedded iframe, or as a plain outbound search link.
• Depends on: nothing first-party. Externals: System.Uri and System.StringComparer.
• Concept introduced, an allow-list of embeddable hosts. IsGoogleMapsEmbed (lines 159-177) only returns true for an https URL whose host is in the fixed EmbedHosts array (line 152: www.google.com, google.com, maps.google.com) and whose path is either /maps/embed or /maps with an output=embed query parameter. The in-code comment (lines 150-151) ties this directly to the page's CSP: the frame-src directive (BlazorCsp:FrameSources in the UI.Web host's appsettings.json) has to allow exactly these origins, so the allow-list here and the CSP origin list are two places that encode the same decision. [Rubric #26, Front-End Security] assesses exactly this: an arbitrary stored URL is never framed, only a URL from a host both this check and the CSP agree on.
• Walkthrough
  • IsGoogleMapsEmbed (lines 159-177) parses the URL, rejects anything not https or not on EmbedHosts, then accepts an /maps/embed path outright or an /maps path whose query string carries output=embed (case-insensitive on both the pair and its value).
  • BuildSearchUrl (lines 184-187) builds a plain (non-embed) Google Maps search URL from a venue address, Uri.EscapeDataString-encoding the trimmed address, or returns null when the address is blank.
• Why it's built this way: a Google Maps embed URL only renders correctly inside an iframe (Google refuses to open it as a page directly), so the venue detail page needs to know, from the stored URL alone, which rendering the value calls for, without ever framing a URL from a host that was not agreed on in advance.
• Where it's used: PublicEventDetail's markup calls IsGoogleMapsEmbed to decide whether to show the expand/collapse map toggle at all, and BuildSearchUrl to render the always-available "open in Google Maps" fallback link (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Events/PublicEventDetail.razor:73,86).

PublicReadAudience

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/PublicReadAudience.cs:10 · Level 2 · class (internal static)

• What it is: the one privileged-reader check the public Conference pages share. A single method, IsPrivilegedReaderAsync (PublicReadAudience.cs:18), answers whether the reader behind the cascaded authentication state holds one of ConferenceReadAudience.PrivilegedRoles (class doc, :6-9).
• Depends on: Microsoft.AspNetCore.Components.Authorization for AuthenticationState (:1) and ConferenceReadAudience from MMCA.ADC.Conference.Shared.Authorization (:2, read at :28). No injected service and no state.
• Concept introduced, a fail-closed audience read that still honors cancellation. Four pages branch on "is this reader an Organizer or a ContentEditor"; keeping the read in one method fixes the semantics in one place, and the method doc states them (:12-17):
  1. No cascaded state means the public audience. A null task returns false before any await (:20-23).
  2. The state is awaited, never read synchronously (:27), so a token that hydrates asynchronously from the HttpOnly cookie is settled before the role test at :28 runs. The callers' own comments explain why that ordering matters for them (see PublicEventList and PublicEventDetail).
  3. A faulted state degrades to the narrowest audience, a cancellation does not. The catch filter is ex is not OperationCanceledException (:31), so an unreadable auth state returns false (:34) and the public page still renders, while a cancellation propagates to the caller's own teardown handling. The CA1031 suppression carries its reason inline (:30). [Rubric §26, Front-End Security] (fail closed to the narrower audience) and [Rubric §11, Security].
• Walkthrough: IsPrivilegedReaderAsync(Task<AuthenticationState>?) (:18-36): null guard (:20-23), await the task (:27), then PrivilegedRoles.Any(authState.User.IsInRole) (:28); the filtered catch (:31-35) returns false.
• Why it's built this way: the audience decision gates what a public page shows (a grid, a breadcrumb, a redirect), so its edge cases (no state, a faulted state, a cancelled state) must answer identically on every page. One internal static helper makes that a property of the code rather than of four copies kept in step by hand, and it is unit-testable without a renderer. [Rubric §14, Testability].
• Where it's used: PublicEventList (PublicEventList.razor.cs:72), PublicEventDetail (PublicEventDetail.razor.cs:67), PublicSessionList (PublicSessionList.razor.cs:121) and PublicSpeakerList (PublicSpeakerList.razor.cs:97), each assigning _isPrivileged from it. PublicReadAudienceTests pins the eight behaviors, including both cancellation paths propagating (MMCA.ADC/Tests/Modules/Conference/MMCA.ADC.Conference.UI.Tests/Pages/Public/PublicReadAudienceTests.cs:79, :89) and a faulted state reading as non-privileged (:69).

PublicEventDetail

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Events · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Events/PublicEventDetail.razor.cs:18 · Level 8 · class (Blazor code-behind)

• What it is: the read-only public view of one event: venue information, rooms, support contacts, and the conference-day conveniences (copy the Wi-Fi details, open directions, a distance-to-venue hint, a collapsible venue map, a QR code for the page itself). For a public visitor it is also the landing page of the whole conference, because PublicEventList redirects them here.
• Depends on: IEventUIService (:20), EventDTO, IToastService (:22), PublicReadAudience (:67, which reads ConferenceReadAudience on the page's behalf), ConferenceRoutePaths (:77, :172, :174, :176), DomainHelper's Id.Parse<T> extension for the route string (:119, defined at MMCA.Common/Source/Core/MMCA.Common.Shared/Extensions/DomainHelper.cs:30), VenueMapLinks (called from the markup, not the code-behind, at PublicEventDetail.razor:73,86) to decide the venue-map rendering, and four device-capability abstractions: IClipboardService, IMapNavigationService, IGeolocationService, IGeocodingService (:23-26), whose GeoPoint results supply the DistanceKmTo used at :235. It also reads IConfiguration for the host-wide support contacts (:27, :64-65), and the LifetimeToken() extension on CancellationTokenSource from MMCA.Common/Source/Presentation/MMCA.Common.UI/Common/ComponentLifetimeExtensions.cs:26.
• Concept introduced, the load guard, the audience-shaped breadcrumb trail, and best-effort progressive enhancement. Three mechanisms are worth extracting.
  1. Load once per id, and let the newest load win. The route value arrives as [Parameter] string Id (:29), and OnParametersSetAsync compares it against _loadedId (:96-105) so a re-render does not refetch. On top of that, each LoadEventAsync call opens a fresh generation and cancellation token through _load.Begin() (:110), and both the fetch (:120) and the distance hint (:148) run under that token; every await point is re-checked against _load.IsCurrent(generation) (:121, :223, :229, :163), so a superseded fetch both drops its results and is actually cancelled, not merely ignored. The field doc explains why the generation and not the route id is authoritative (:85-90): _loadedId is stamped synchronously before the await, so two rapid route changes would otherwise let the later-completing fetch paint the wrong event. The finally is guarded by the same test (:159-167), because an unconditional clear would let a superseded response switch off the spinner the newer load just turned on. The load also resets _distanceMiles to null on entry (:112-114): the hint belongs to the previous event, and a venue-less or unsupported event never recomputes it, so without the reset the previous event's distance would stay on screen. [Rubric #19, State Management & Data Flow].
  2. The breadcrumb trail depends on the audience, and the audience is awaited first. OnInitializedAsync resolves privileged status through PublicReadAudience.IsPrivilegedReaderAsync (:67) before building the trail (:62-81), then adds the "Events" crumb only for a privileged reader (:75-78). The doc comment states both halves of the reasoning (:54-61): a public visitor was redirected to this page by the event list, so an Events crumb would bounce them straight back here, and the access token hydrates asynchronously from the HttpOnly cookie, so reading roles synchronously would render the wrong trail and correct it on the next render. A faulted auth read is treated as non-privileged by the shared helper, which lets a cancellation propagate instead (PublicReadAudience.cs:31). [Rubric #25, Navigation & Information Architecture] (assesses that navigation affordances lead somewhere the reader can actually use) and [Rubric #26, Front-End Security] (fail closed to the narrower audience).
  3. Every capability is optional. TryComputeDistanceAsync (:215-237) returns early when geolocation or geocoding is unsupported or the venue address is blank (:217-220), and again on any null result or superseded generation (:223, :229), so a denied permission or an offline geocoder simply leaves the hint off. The doc comment states the rule plainly: this must never block the page (:210-214). [Rubric #29, Resilience & Business Continuity] (assesses degradation when an optional dependency is absent) and [Rubric #26, Front-End Security] (a location read is soft and unblocking, never a gate on content). These come from the device-capability layer of ADR-042. A fourth detail is a small but real configuration rule: a per-event OrganizerContactEmail wins over the host-wide Support:Email, and it is re-evaluated on every load so navigating between events never leaves the previous organizer's address on screen (:141-146). [Rubric #15, Best Practices & Code Quality]: a conference can publish its own contact without a redeploy. A fifth is how the one-shot device calls get their token: LifetimeToken (:35-38) reads the source through LifetimeToken() instead of _cts.Token, because reading Token off a disposed source throws ObjectDisposedException; disposal cancels before it disposes, so a handler that resumes after the reader navigated away receives an already-cancelled token and stops through its OperationCanceledException path.
• Walkthrough
  • LoadEventAsync (:107-168): begin a fresh generation and token from _load.Begin() (:110), reset _distanceMiles (:112-114), parse the id (:119), fetch with children under that token (GetByIdAsync(eventId, true, token), :120), and on failure clear Event so a failed navigation never leaves the previous event on screen, toasting the not-found wording for a 404 and the page's fixed load-failure key otherwise (:126-135); on success reset _showMap to false (:139, so navigating to a different event never leaves the previous one's map expanded), resolve the support address (:141-146), and run the distance hint, passing both the generation and the same token (:148). OperationCanceledException is swallowed as expected teardown (:151-154) and a broad catch toasts the same load-failure key (:155-158).
  • _showMap (:51-52) and ToggleMap (:178) back a collapse/expand toggle for the venue map: the markup only offers it when VenueMapLinks.IsGoogleMapsEmbed recognizes the stored VenueMapUrl (PublicEventDetail.razor:73), and only actually renders the iframe when _showMap is true (PublicEventDetail.razor:90-99), so third-party map content does not load until the reader asks for it. VenueMapLinks.BuildSearchUrl always renders the plain "open in Google Maps" link beside the toggle as a fallback (PublicEventDetail.razor:86-89).
  • CopyWifiAsync (:182-193): copies Event.WiFiInfo through the clipboard abstraction under LifetimeToken (:189) and reports success or failure with one toast whose severity flips on the result (:190-192).
  • OpenDirectionsAsync (:195-208): native heads launch the platform maps app, browsers open a maps site, again under LifetimeToken (:203); a false return raises a warning.
  • TryComputeDistanceAsync (:215-237): takes the load generation and a CancellationToken from the caller rather than reading _cts itself, geocodes the venue under that token (:222), reads the current-or-last-known position the same way (:228), converts kilometres to miles with an explicit named constant (:234-235), and calls StateHasChanged() (:236) because the value arrives after the render that requested it; the markup renders it to one decimal in the viewer's culture (PublicEventDetail.razor:58-61).
  • Navigation helpers (:170-180) route back to the list (privileged readers only, per the comment at :170-171), on to the public schedule, on to the activities page, and to the event feedback form. Disposal (:239-262) is the standard cancel-on-disposal pattern over the CancellationTokenSource at :33, plus disposing the LatestLoadGuard itself (:252).
• Why it's built this way: the public event page is the one an attendee opens while standing in the building, so its extras (Wi-Fi, directions, distance, the venue map) are worth having, none of them is worth failing the page over, and the map specifically stays collapsed by default so the table stays compact and no third-party (Google) content loads until the reader chooses to see it (PublicEventDetail.razor:75-79 in-code comment).
• Where it's used: the /conference/events/{Id} route (PublicEventDetail.razor:1), reached from PublicEventList either as a grid row (privileged) or as a replace: true redirect (everyone else); its markup also renders the QrCodeButton for this page's own public link (PublicEventDetail.razor:30).

PublicEventList

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Events · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Events/PublicEventList.razor.cs:30 · Level 9 · class (Blazor code-behind)

• What it is: the /conference/events route, where the audience decides whether a list is shown at all. A privileged reader (Organizer or ContentEditor) gets the full grid of published and unpublished events; every other visitor is redirected to the current or next event's detail page (class doc, PublicEventList.razor.cs:13-29).
• Depends on: extends DataGridListPageBase<TDto> closed over EventDTO (:30); IEventUIService and IEventLookupService (:34-35), an injected TimeProvider (:37), PublicReadAudience (:72), CurrentEventSelector (:91), EventInfo (:81), ConferenceRoutePaths (:103, :147), MobileInfiniteScrollList<TItem> (:46, rendered at PublicEventList.razor:23), ListPageActions (:121), and Result in the mobile fetch signature (:137). Server-side the audience split is enforced by PublishedEventSpecification.
• Concept introduced, the audience gate as a routing decision, and the three-state render. This page is the sharpest example in the group of a UI decision that has to wait for identity.
  1. Resolve the audience before deciding anything. OnInitializedAsync awaits PublicReadAudience.IsPrivilegedReaderAsync over the cascading Task<AuthenticationState> first (:72). The comment (:69-71) and the class doc (:21-25) both name the failure this prevents: on all three heads (Blazor Server, WebAssembly, MAUI) the access token hydrates asynchronously from the HttpOnly cookie, so a synchronous role read would see an anonymous principal and bounce an organizer off their own list. A faulted read is treated as non-privileged by the shared helper (PublicReadAudience.cs:31). [Rubric §11, Security] and [Rubric §26, Front-End Security] (assess that an authorization-shaped branch reads a settled principal, and fails to the narrower audience).
  2. Three states, and one of them renders nothing. _showGrid (:53) opens the search box and the layout switch for a privileged reader (:74-78); _showEmpty (:61) is set only when nothing is published anywhere, so there is no redirect target and the page has to stay and say so (:107-109); and the redirect path deliberately leaves both false (:98-105), so the page stays blank until the navigation takes effect instead of flashing a list on the way out. The field doc spells this out (:55-60). [Rubric §18, UI Architecture & Component Design] (assesses that intermediate states are designed rather than incidental).
  3. replace: true on the redirect. The comment (:100-102) records the exact trap it prevents: left in the history stack, Back from the event detail would land here and redirect straight forward again, trapping the visitor on the detail page (NavigateTo at :103). [Rubric §25, Navigation & Information Architecture] (assesses that the Back button keeps working). The redirect target is computed with CurrentEventSelector.SelectCurrentOrNext, passing the four accessors explicitly because the lookup returns EventInfo rather than EventDTO, which the comment calls out (:87-96). "Now" comes from the injected TimeProvider (TimeProvider.GetUtcNow().UtcDateTime, :96) rather than the static system clock, so the live-window decision reads a replaceable clock. It is the same live-window math every other landing surface uses, so a visitor always lands on the conference that is actually happening. A failed lookup is non-critical and leaves events null (:80-85), which falls through to the empty state rather than to a broken redirect.
• Walkthrough
  • GridRef (:42) exposes the captured grid so the base can restore rows-per-page and current page; RetryLoadAsync (:45) re-runs the fetch from the inline error state the base renders when LoadFailed is set (MMCA.Common/Source/Presentation/MMCA.Common.UI/Pages/Common/DataGridListPageBase.cs:53). [Rubric §29, Resilience & Business Continuity].
  • SaveFilters / RestoreFilters (:112-116) persist the one search term; OnSearchChanged (:118-122) stores it and reloads whichever layout is active through ListPageActions.ReloadActiveLayoutAsync (MMCA.Common/Source/Presentation/MMCA.Common.UI/Pages/Common/ListPageActions.cs:26).
  • LoadServerData (:124-134) passes showCancelSnackbar: false (:134), so a superseded fetch (the reader typed another character) is silent rather than raising a toast, and turns the search string into a Name contains server filter (:131-132).
  • FetchMobilePage (:137-144) is the parallel infinite-scroll path, hard-sorted by Name ascending; OnMobileCardClick (:146-147) routes to PublicEventDetail.
• Why it's built this way: a public visitor cares about the conference that is running or coming up, not about a roster of past editions, while an organizer curating the catalog needs every row including the unpublished ones. One route serving both is cheaper than two, provided the audience is known before the branch is taken.
• Where it's used: the /conference/events route (PublicEventList.razor:1). Every non-privileged arrival leaves immediately for PublicEventDetail; privileged rows and cards navigate to the same page.
• Caveats / not-in-source: the published-only scoping of the underlying reads for non-privileged callers (BR-108, class doc :26-27) is enforced in the Conference API through PublishedEventSpecification, not on this page.

ConferenceTrackInfo

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Home · MMCA.ADC.Conference.UI/Pages/Home/ADCHomeContent.cs:95 · Level 0 · record (sealed, internal)

• What it is: one row of the landing page's track catalogue: a track Name, an Icon (a MudBlazor icon path constant), and a Topics string listing the track's subject areas (:81).
• Depends on: no first-party types. The Icon values are MudBlazor Icons.Material.Filled.* constants (external, imported at :1).
• Concept introduced: this is one of three static-content records held by ADCHomeContent; the two-tier content model is taught under KeynoteSpeakerInfo and reused by PreConferenceWorkshopInfo.
• Walkthrough: a three-property positional record. The whole catalogue is the ADCHomeContent.Tracks property, an IReadOnlyList<ConferenceTrackInfo> initialized inline as a collection expression (:34-52) with eight entries (:36, :38, :40, :42, :44, :46, :48, :50), each spanning two lines: the track name and its icon constant on the first, the topics blurb on the second. They run from "Foundations (Beginner & Student)" (:36-37) to "Career, Leadership & Community" (:50-51), with the two AI tracks, languages, web/mobile/cross-platform, security, and game/XR in between. Every Icon is a MudBlazor Icons.Material.Filled.* constant picked per track (School, Psychology, AutoAwesome, Code, Devices, Security, SportsEsports, Groups). Storing the icon as a string (rather than a RenderFragment or an enum) is what keeps the record a plain data type: the markup passes it straight to <MudIcon Icon="@track.Icon"> (ADCHome.razor:241).
• Why it's built this way: the track list changes once per conference cycle and is editorial rather than transactional, so it lives in the assembly instead of behind an API call or a CMS; the remark on ADCHomeContent names the track catalog alongside the keynote bio as deliberately English-only editorial content, with the localized chrome around it (:10-14). The collection is a get-only static property, so it is initialized once per process, not per render.
• Where it's used: ADCHomeContent.Tracks (:34), rendered as the track grid in ADCHome.razor (:233-250): one MudItem/MudCard per entry, keyed by track.Name (ADCHome.razor:236), showing the icon (:241), the name (:243), and the topics line (:245).

EventPhase

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Home · MMCA.ADC.Conference.UI/Pages/Home/ADCHome.razor.cs:99 · Level 0 · enum (private)

• What it is: the three-state classification of the featured event relative to now: Upcoming, Live, Ended (:71-76). It is the single switch the landing page's hero renders from.
• Depends on: nothing.
• Concept introduced: deriving a render state from a clock instead of storing it. [Rubric §19, State Management and Data Flow] assesses whether UI state is derived from a single source of truth or duplicated into flags. There is no IsLive boolean anywhere on the page: UpdateCountdown() recomputes _phase from DateTime.UtcNow against the converted UTC window every time it runs (:261-267), and the markup branches on that one field. Recomputing rather than storing means a stale phase is impossible after a timer callback, a parameter change, or the interactive render pass that follows prerender.
• Walkthrough: the assignment is a switch expression over now (:262-267): now < _startUtc gives Upcoming, now < _endUtc gives Live, anything later gives Ended. ArmPhaseTimerForEventEnd() reads it as its guard, returning immediately unless the phase is Live (:144-147), which is what makes the Live-to-Ended timer a single one-shot rather than a recurring tick. In the markup the loading branch comes first (ADCHome.razor:32-35, a PageLoadingState while _isLoading), then Upcoming renders the HomeCountdown child (ADCHome.razor:36-41), Live renders the "event live" chip plus a button to /happening-now (ADCHome.razor:42-56), and Ended renders the post-event chip (ADCHome.razor:57-65). The hero's ticketing button sits outside that branch (ADCHome.razor:67-80), so it shows in every phase the event publishes a URL.
• Why it's built this way: three named states read far better at the call site than nested date comparisons, and keeping the enum private to the component signals it is a view concern, not a domain concept. The domain's own notion of a live window lives server-side and in CurrentEventSelector.
• Where it's used: the _phase field on ADCHome (:63) and its Razor markup only.

KeynoteSpeakerInfo

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Home · MMCA.ADC.Conference.UI/Pages/Home/ADCHomeContent.cs:86 · Level 0 · record (sealed, internal)

• What it is: the keynote block's content: the speaker's Name, Title (their role), an optional Badge (a recognition chip rendered above the title, e.g. "Microsoft MVP"), the TalkTitle, an optional PhotoFileName, and BioParagraphs as an IReadOnlyList<string> (:86-92).
• Depends on: no first-party types. BCL only.
• Concept introduced: the two-tier content model of a landing page. The page splits its content into dynamic data fetched from the API (dates, venue, name, ticketing link, sponsors, as EventDTO and SponsorDTO through IEventUIService and ISponsorUIService, ADCHome.razor.cs:52-55 and :80-83) and editorial data compiled into the assembly (keynote, tracks, and workshops, held by ADCHomeContent as this record and its siblings ConferenceTrackInfo and PreConferenceWorkshopInfo). [Rubric §23, Front-End Performance and Rendering] is the payoff: the keynote, the workshop cards, and the track grid render on the first frame with zero network dependency, so a cold or unreachable backend degrades only the countdown, the hero ticketing button, and the sponsor strip, never the page. [Rubric §27, Internationalization] is the deliberate exception: the holder class carries a written remark recording that this English-only editorial content is the same copy the API would serve, while the chrome around it is localized instead (:10-14). That convention is how ADR-027 distinguishes "not yet translated" from "intentionally untranslated".
• Walkthrough: a six-property positional record. The single instance is the get-only ADCHomeContent.Keynote property, initialized inline (:18-31): Jared Rhodes, Title: "Principal Consultant, EPAM Systems", Badge: "Microsoft MVP", the talk "More Software, Different Work", PhotoFileName: "jared-rhodes.webp" (:26), and a three-paragraph abstract (:28-30). Splitting the recognition into its own Badge property rather than folding it into Title (as an earlier draft did, joining "Microsoft MVP" and the role into one string) lets the markup render the badge as a separate chip and omit it entirely for a keynote with none, since Badge is nullable. BioParagraphs is a list rather than one string so the template can emit each paragraph in its own element instead of relying on whitespace preservation (ADCHome.razor:203-206). The record carries only the portrait's file name, not a path: the usable src is composed from the head-specific ImageBasePath parameter through KeynoteImageSrc, which returns $"{ImageBasePath}/speakers/{fileName}" or null when no file name is supplied (ADCHome.razor.cs:56-57). That split exists because a head could package its assets elsewhere, and the null case is still guarded in the markup so the card renders name and title without a portrait (ADCHome.razor:179-192).
• Why it's built this way: the keynote changes once per conference cycle, so a database round-trip and an admin screen would be pure overhead. The image choice is the interesting half. The comment above the file name (:22-25) records that the shipped asset is a WebP derivative sized to the display resolution, 640px square against a 300px CSS frame so it still has headroom at 2x device pixel ratio, weighing 17 KB against 306 KB for the 2048px source JPEG, and that because both hosts resolve it through ImageBasePath the file must ship in both wwwroots (the Web client and the MAUI head). The original JPEG stays in the repo as the re-encode source. The markup adds loading="lazy" with the reason inline (ADCHome.razor:182-184): the keynote sits below the hero, so it is never the largest-contentful-paint element, and MudImage splats unmatched attributes onto the rendered img, so the hint actually reaches the DOM. Both are [Rubric §23, Front-End Performance and Rendering] in the small.
• Where it's used: ADCHomeContent.Keynote (:18), read by ADCHome.KeynoteImageSrc (ADCHome.razor.cs:56-57) and rendered in the keynote section of ADCHome.razor (:163-211): the portrait (:185-190), the alt text and name (:186, :193), the badge chip and the role (:195), the talk title (:202), and the paragraphs (:203-206).

PreConferenceWorkshopInfo

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Home · MMCA.ADC.Conference.UI/Pages/Home/ADCHomeContent.cs:103 · Level 0 · record (sealed, internal)

• What it is: one pre-conference workshop card: a resource-key stem Key, the workshop Title, a Subtitle, the Presenter name, an Icon, and a DetailsUrl for the workshop's public detail page (:103-109). Two instances make up the whole workshops section.
• Depends on: no first-party types. The Icon values are MudBlazor Icons.Material.Filled.* constants (external).
• Concept introduced: the half-localized content record. [Rubric §27, Internationalization] assesses whether user-facing text resolves through resources rather than sitting in code, and this record is the interesting middle case that the other two content records do not show. Instead of choosing "all in code" or "all in resources", it splits by kind of string: proper nouns and public-site addresses stay in code (workshop titles, subtitles, presenter names, and the DetailsUrl) because translating a talk title, a person's name, or a URL would be wrong, while the prose that describes each workshop lives in the .resx pair. The bridge is Key, documented on the record itself: the markup composes Workshops.{Key}.Audience and Workshops.{Key}.Description at render time (ADCHome.razor:136, :139), and those keys exist in both locales (MMCA.ADC.Conference.UI/Pages/Home/ADCHome.resx:26-29, with the Spanish twins in ADCHome.es.resx). One consequence worth noticing: adding a workshop means adding four resource entries per locale, and a typo in Key fails at runtime as a missing resource rather than at compile time.
• Walkthrough: a six-property positional record. The catalogue is the get-only ADCHomeContent.Workshops property (ADCHomeContent.cs:64-78) with two entries: "AiReadyDotNet", "Build an AI-Ready .NET App with an AI Pair", subtitled "One Day, the Whole SDLC with an AI Pair", presented by Ivan Ball-llovera with the SmartToy icon, linking to https://www.atldevcon.com/workshops/ivan-ball-llovera; and "SoftwareFactory", "Beyond the Basics: Starting Your Software Factory", subtitled "Automated Multi-Agent Development Pipelines", presented by Tim Rayburn with the PrecisionManufacturing icon, linking to https://www.atldevcon.com/workshops/tim-rayburn. The doc comment above the property states the split in one sentence. The property and the record's file are wrapped in an S1075 suppression pair, with the reason inline: the detail addresses are published pages on the public conference site, not environment-dependent paths, so there is nothing to configure. The markup renders the list as a two-column grid (ADCHome.razor:120-145), keyed by workshop.Key (:123), each card showing the icon in a circle (:128), the title (:130), the localized Workshops.PresenterLabel formatted with the presenter name (:132-134), the audience line (:135-137), and the description (:138-140).
• Why it's built this way: the workshop day runs before the conference day, and the section is placed between the hero and the keynote so the page reads in the same order as the event, which the markup comment records (ADCHome.razor:86-88). Two facts the cards would otherwise repeat, the schedule and the venue, are hoisted into one shared logistics line above the grid (ADCHome.razor:107-118), which is why they are resources (Workshops.Schedule, Workshops.Venue, ADCHome.resx:21-22) rather than record fields. Ticketing is the other deliberate asymmetry: the workshop day sells on its own TicketLeap page, so its call to action reads the PreConferenceTicketingUrl constant (ADCHome.razor.cs:29-30) and always renders (ADCHome.razor:147-159), while the hero's conference-day button reads TicketingUrl off the featured event and hides itself when absent. DetailsUrl is a newer addition than the ticketing constant: it gives each card a link to the presenter's own detail page on the public conference site rather than only naming the presenter inline. [Rubric §26, Front-End Security]: the workshop ticketing button opens with Target="_blank" together with rel="noopener noreferrer" (ADCHome.razor:155).
• Where it's used: ADCHomeContent.Workshops (:64) and the workshops section of ADCHome.razor (:85-161) only.

ADCHomeContent

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Home · MMCA.ADC.Conference.UI/Pages/Home/ADCHomeContent.cs:15 · Level 1 · class (static, internal)

• What it is: the landing page's editorial content, lifted out of the code-behind into its own file: the keynote card, the conference track catalog, and the pre-conference workshop catalog, as three get-only static properties.
• Depends on: KeynoteSpeakerInfo, ConferenceTrackInfo, and PreConferenceWorkshopInfo (all three declared in this same file, :86, :95, :103), plus MudBlazor's Icons.Material.Filled.* constants (:1).
• Concept introduced: separating content from orchestration inside one page. [Rubric §18, UI Architecture and Component Design] assesses whether a component has one job and whether its structure makes that job legible. The class summary states the intent verbatim (:5-9): the content is kept beside the page, like the other page-local data holders, so the code-behind stays orchestration only. That is the practical difference between a 313-line code-behind that reads as a lifecycle (fetch, classify, arm a timer, dispose) and one where three paragraphs of conference copy sit between OnInitializedAsync and Dispose. [Rubric §15, Best Practices & Code Quality] is the follow-on: editing the track list for next year's conference touches exactly one file that contains no logic, so the review is a content review. The other reason this is a distinct type rather than a region: the internal accessibility. The three records and the holder are all internal sealed / internal static, so they are visible to the page and to nothing outside the assembly, but unlike the private inner records of ADCHome they can live in their own file. [Rubric §27, Internationalization]: the class remark (:10-14) is where the deliberate English-only decision for this content is recorded, per ADR-027.
• Walkthrough: three static get-only properties, each initialized once at type initialization.
  • Keynote (:18-31): a single KeynoteSpeakerInfo, including the WebP-derivative comment that explains the shipped portrait (:22-25).
  • Tracks (:34-52): an IReadOnlyList<ConferenceTrackInfo> collection expression with the eight conference tracks.
  • Workshops (:64-78): an IReadOnlyList<PreConferenceWorkshopInfo> with the two pre-conference workshops, above the doc comment that spells out which fields are code and which resolve from resources, and wrapped in the S1075 suppression pair for the two DetailsUrl addresses (:63, :79).
• Why it's built this way: exposing the three as { get; } properties rather than public fields means the collections are initialized exactly once per process and shared by every circuit on the server head, which matters because the server head renders this page for every connected user. Returning IReadOnlyList<T> rather than an array keeps the markup's @foreach honest about the collection being read-only.
• Where it's used: ADCHome only: KeynoteImageSrc reads ADCHomeContent.Keynote.PhotoFileName (ADCHome.razor.cs:56-57), and the markup reads all three (ADCHome.razor:121 for the workshop grid, :186, :193, :195, :202, :203 for the keynote card, :234 for the track grid).

PublicScheduleRoomOptions

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/PublicScheduleRoomOptions.cs:13 · Level 3 · class (internal static)

• What it is: the pure functions behind the public schedule's Room picker and Room column. Given the events PublicSessionList has already loaded, IndexNames builds the id-to-name map the list renders with, and Scope returns the ordered room options for the active event filter plus the room filter that survives that scoping (PublicScheduleRoomOptions.cs:20, :37).
• Depends on: RoomDTO and EventDTO from MMCA.ADC.Conference.Shared.Events (:1), plus the RoomIdentifierType and EventIdentifierType aliases. Nothing else: no injected service, no fetch, no component base.
• Concept introduced, the derived filter option set with a self-healing selection. Two ideas are worth extracting from a sixty-line file.
  1. Derive, do not fetch. The class doc states the rule (:5-9): the page already reads /events?includeChildren=true, so its rooms are in memory and narrowing the schedule by room costs zero extra round trips. The same doc records the security consequence that comes for free: that events read is published-only for non-privileged audiences server-side, so an unpublished event's rooms can never reach the picker. [Rubric §23, Front-End Performance & Rendering] (assesses avoidable network work per interaction) and [Rubric §26, Front-End Security] (assesses that a client-derived option set cannot widen what the server already scoped).
  2. A selection that cannot go stale. The last block of Scope (:53-55) re-validates selectedRoomId against the freshly scoped list and returns null when the room is no longer offered. The comment names both ways that happens (:51-52): the reader switched events, or a stale choice was restored from saved page state by PublicSessionListFilterState. Without it, an unreachable room id would filter every session out and the reader would see an empty schedule with no visible cause. [Rubric §19, State Management & Data Flow] (assesses that derived state is reconciled rather than left to drift) and [Rubric §24, Forms, Validation & UX Safety].
• Walkthrough
  • IndexNames (:18-27): a nested loop over every loaded event's Rooms, adding each Id-to-Name pair with TryAdd (:24) so a room that two loaded events both reference is indexed once rather than throwing. The map it fills is the page's own _roomNames dictionary, added to in place (:17), which is what the list's Room column and mobile card line read.
  • Scope (:37-58): scoping (:42-44), where a non-null eventId takes that event's Rooms (an unknown id yields an empty list through the ?? [] fallback) and a null id, which only a privileged reader viewing every event can produce, takes the union across all loaded events; shaping (:46-49), DistinctBy(r => r.Id) because the union can repeat a room, then OrderBy(Sort).ThenBy(Name, StringComparer.OrdinalIgnoreCase) so the picker order is the organizer's intended order with a deterministic case-insensitive tiebreak; reconciliation (:53-55) and the tuple return (:57), which the caller destructures straight into its two fields.
• Why it's built this way: keeping this out of the page makes it a plain static function over data, directly unit-testable without a renderer, and it keeps the page's own code down to one line (PublicSessionList.razor.cs:168-169). [Rubric §14, Testability] and [Rubric §1, SOLID].
• Where it's used: IndexNames is called once per events load (PublicSessionList.razor.cs:136); Scope is called by that page's RefreshRoomOptions (:151-152), from the initial load (:147) and from every event-filter change (:216). The options it returns are passed down to PublicSessionListFilterBar's Rooms parameter and the surviving id to its SelectedRoomId.

ADCHome

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Home · MMCA.ADC.Conference.UI/Pages/Home/ADCHome.razor.cs:22 · Level 9 · class (sealed partial component)

• What it is: the conference landing page: hero with a live countdown and a ticketing button, pre-conference workshops, keynote, track catalogue, sponsor strip with a sponsorship call to action, a partners band, and venue block. It loads the published events through the UI service layer to find which event to feature, classifies that event as Upcoming/Live/Ended, loads that event's sponsors and partners, and renders the rest from the compiled-in editorial content in ADCHomeContent. It is shared verbatim by the Web and MAUI heads, and its class doc records that both heads serve the static images from their own site root, so neither overrides ImageBasePath today (:9-16).

• Depends on: IEventUIService (:51-52), ISponsorUIService (:54-55), and IPartnerUIService (:57-58) for the three reads, an injected TimeProvider (:60-61) as the page's only clock, EventDTO for the featured event (:89), SponsorDTO and PartnerDTO for the grouped strips (:91-92, :94-95), EventPhase (a private inner enum, :99-104), ADCHomeContent with its KeynoteSpeakerInfo, ConferenceTrackInfo, and PreConferenceWorkshopInfo records, CurrentEventSelector from MMCA.ADC.Conference.Shared.Events, SponsorTier and PartnerType, and ConferenceRoutePaths for the "see all sponsors" link (ADCHome.razor:308). Externals: IStringLocalizer<ADCHome> injected in the markup as L (ADCHome.razor:1), System.Threading.Timer, TimeZoneInfo, MudBlazor, the Blazor RendererInfo API, and the LifetimeToken() extension on CancellationTokenSource (MMCA.Common/Source/Presentation/MMCA.Common.UI/Common/ComponentLifetimeExtensions.cs:26). It composes one first-party child component, HomeCountdown (ADCHome.razor:40), which lives in the same folder as a single .razor file with no code-behind.

• Concept introduced: rendering correctly across the prerender and interactive passes. [Rubric §23, Front-End Performance and Rendering] assesses whether a page avoids wasted renders and blocking work; this component is the chapter's clearest case study, and both of its decisions are recorded in the code comments. See ADR-056 for the render-mode strategy these two decisions live inside.

  • Skip the fetch during prerender. OnInitializedAsync checks RendererInfo.IsInteractive and, when false, sets _isLoading = false, computes the countdown from defaults, and returns without touching the network (:143-148). The comment (:138-142) states why: an untimed server-side call to a cold or unreachable backend would block the prerender, and therefore the page load and the post-login NavigateTo("/"), indefinitely. The static fallback renders immediately and the interactive pass loads the real event. Prerender is a one-shot static render, so the timer is moot there. [Rubric §29, Resilience and Business Continuity] is the same point from the availability angle.
  • Fence the per-second re-render. The ticking digits live in the HomeCountdown child, which owns its own timer, so this page arms only a single one-shot Timer for the Live-to-Ended flip (:167-186). The comment records the alternative: a 1-second timer would re-render the entire landing page, the largest static page in the app, for the whole event, per circuit, just to catch one transition. The child goes further still: it ticks once a minute while more than 65 minutes remain and switches to once a second only for the final hour (MMCA.ADC.Conference.UI/Pages/Home/HomeCountdown.razor:32, :52-56, :59, :70-74), and it too refuses to start a timer unless RendererInfo.IsInteractive (HomeCountdown.razor:51-52).

  Four more rubric threads run through it. [Rubric §22, Responsive and Cross-Browser/Device]: one component compiles into the Blazor Server, WebAssembly, and MAUI heads, with the per-head difference reduced to the ImageBasePath parameter (:69). [Rubric §27, Internationalization]: user-facing chrome resolves through L[...], while the strings that must not be translated carry explicit // i18n: allow markers with reasons (the ticketing URL, the brand name, the postal address). [Rubric §20, Design System and Theming]: the page's scoped stylesheet is a single shared copy rendered by both heads, and an architecture fitness test embeds it and fails the build if it re-hardcodes the brand hex instead of using var(--mmca-primary) (MMCA.ADC/Tests/Architecture/MMCA.ADC.Architecture.Tests/Ui/BrandColorTokenTests.cs:12-17, embedded via MMCA.ADC.Architecture.Tests.csproj:11-13). [Rubric §14, Testability]: every read of "now" (featured-event selection :215, the end-of-event timer :178, the phase switch :344) goes through the injected TimeProvider rather than DateTime.UtcNow, so the event choice and the phase share one clock that a test host can replace.

• Walkthrough, in lifecycle order:

  • Constants and state (:24-97): the PreConferenceTicketingUrl constant placed first because SA1203 requires constants before fields, with its doc block and S1075 suppression (:24-36), then MaxRoster (:38-42), a fixed upper bound of 200 on one event's sponsor or partner roster passed explicitly to the paged reads because the underlying endpoints default to 10 rows per page and a conference announces dozens, not thousands. EventStartTime (:44) and FallbackStartDate (:46-49) follow. Then the three injected UI services (:51-58), the injected TimeProvider (:60-61), the ImageBasePath parameter (:63-69) and the derived KeynoteImageSrc (:75-76), a CancellationTokenSource (:78) with a LifetimeToken accessor over it (:80-83), the one-shot _phaseTimer, the computed _startUtc/_endUtc, _phase, the nullable _event (EventDTO?, :89), the grouped _sponsorTiers over SponsorDTO (:91-92) and _partnerGroups over PartnerDTO (:94-95), _isLoading (starting true), and a _disposed guard the timer callback checks (:97). LifetimeToken exists because reading Token off a disposed source throws ObjectDisposedException; Dispose cancels before it disposes, so a load that resumes after the reader navigated away gets an already-cancelled token and stops through its OperationCanceledException path (comment :80-82).
  • Derived display properties (:106-113): EventName, EventDescription, VenueAddress, and MapSearchUrl are each _event?.X ?? <fallback>, so the page is fully renderable before and without a successful fetch. MapSearchUrl builds a Google Maps search URL with Uri.EscapeDataString over the address.
  • HeroTitleParts() (:115-132): splits the event name so the hero can accent the keyword between "Atlanta " and " Conference" (in "2026 Atlanta Developers Conference" it accents "Developers"). It uses IndexOf/LastIndexOf with StringComparison.Ordinal and falls back to rendering the whole name plain when the name does not match the brand shape, which is why an arbitrary event name never renders broken markup; the markup branches on the accent being non-empty (ADCHome.razor:19-26).
  • OnInitializedAsync (:134-157): creates the CTS, takes the prerender short-circuit described above, otherwise awaits LoadEventAsync(), LoadSponsorsAsync(), then LoadPartnersAsync() in sequence (both the sponsor and partner calls need the featured event id) and arms the phase timer.
  • LoadEventAsync (:199-227): calls EventService.GetAllAsync(cancellationToken: LifetimeToken) (:204) and, on a successful Result, picks the event with CurrentEventSelector.SelectCurrentOrNext(...) passing three accessor lambdas plus TimeProvider.GetUtcNow().UtcDateTime (:210-215). The candidates are events.Where(e => e.IsPublished) (:211): the endpoint scopes only non-privileged callers to published events, while an Organizer or ContentEditor reads it unscoped, so a draft edition has to be filtered out here or the landing page would feature it (comment :206-209, tagged OBS-7). The comment is also the reason it is not a FirstOrDefault: the endpoint returns events unordered, so a naive first-item pick would pin the oldest seeded event. A failed read (API unavailable) surfaces as an unsuccessful Result handled by the if, which simply leaves the fallback defaults in place; the only exception caught is OperationCanceledException, meaning the component was disposed mid-load (:218-221). The finally block always clears _isLoading and recomputes the countdown (:222-226), so no failure path leaves a spinner on screen.
  • LoadSponsorsAsync (:229-275): returns immediately when no event was featured (:241-244), then calls SponsorService.GetPagedAsync filtered to the featured event, pageNumber: 1, pageSize: MaxRoster, sorted by Sort ascending, under LifetimeToken (:248-254), and on a successful page reduces sponsors.Items to a tier-grouped list: tiers ascending in package order (Platinum first), each tier ordered by Sort then Name (:256-269, comment at :258-259). The event scoping happens server-side; the method's remarks record that the endpoint filters to the featured event the way PublicSponsorList does, so a second published edition's sponsors never bleed onto this page (:232-238). Its one catch arm is OperationCanceledException (:271-274) and, on any unsuccessful page, _sponsorTiers simply stays at its previous value, which is a supported render state rather than an error state.
  • LoadPartnersAsync (:277-320): the same shape as LoadSponsorsAsync one method up: returns immediately with no featured event (:287-290), otherwise calls PartnerService.GetPagedAsync the same way, again under LifetimeToken (:294-300), and reduces a successful page's partners.Items to the type-grouped list, Community first (:302-314). Its one catch arm mirrors the sponsor load (:316-319) and an unsuccessful page leaves _partnerGroups empty, which hides the whole partners band rather than rendering a partial one.
  • EventFilter (:322-326): a small static helper that builds the one-entry {"EventId": ("equals", eventId)} filter dictionary both GetPagedAsync calls pass, formatting the id with CultureInfo.InvariantCulture so the filter value is stable regardless of the host's culture.
  • UpdateCountdown (:328-351): converts the event's local start and end into UTC using TimeZoneInfo.FindSystemTimeZoneById(timeZoneId) with "America/New_York" as the default (:334, :340), calling CurrentEventSelector.ToUtc rather than ConvertTimeToUtc because the midnight end boundary does not exist in zones that transition at 00:00 and a raw conversion would throw out of the render path (comment :336-339; MMCA.ADC.Conference.Shared/Events/CurrentEventSelector.cs:89-94). now is read from TimeProvider (:344) and _phase is then assigned from the switch described under EventPhase (:345-350).
  • Phase timing: OnCountdownElapsedAsync (:160-165) is the EventCallback the HomeCountdown child raises at zero (HomeCountdown.razor:82), which recomputes the phase, re-arms, and calls InvokeAsync(StateHasChanged). ArmPhaseTimerForEventEnd (:171-186) returns unless the phase is Live and the remaining time, measured against TimeProvider.GetUtcNow() (:178), is positive, then disposes any prior timer and schedules one callback at untilEnd with Timeout.InfiniteTimeSpan as the period, meaning fire once and never repeat (:185). OnEventEnded (:188-197) checks _disposed before re-rendering.
  • FormatEventDate (:353-360): formats the date with a pattern read from a resource (L["Hero.DateFormat"]) against CultureInfo.CurrentCulture, so both the layout and the month names follow the selected language (ADR-027).
  • Dispose (:362-369): sets _disposed, cancels and disposes the CTS, and both stops (Change(-1, -1)) and disposes the phase timer. Stopping before disposing is what prevents a callback already in flight from touching a torn-down component.

• Why it's built this way: the landing page is the app's most-hit surface and the post-login destination, so its correctness budget is dominated by two failure modes that have nothing to do with its content: a slow backend blocking the prerender, and a per-second render loop multiplied by every connected circuit. Both are solved structurally (skip the fetch, fence the tick) rather than by tuning, and every dynamic block has a defined empty state, so the page is never blank. Routing the three reads through IEventUIService, ISponsorUIService, and IPartnerUIService keeps the event-scoping filter server-side and lets the page consume the same Result-based service layer every other page in the group uses. The two conditional calls to action follow the same discipline: the hero ticketing button and the sponsorship packet block each render only when the featured event publishes the corresponding URL, and hide entirely otherwise rather than offering a dead link, which the markup comments state at both sites.

• Where it's used: resolved as the home component by each head's ADCHomePageContent. The Web client points ComponentType straight at this shared component (MMCA.ADC/Source/Hosts/UI/MMCA.ADC.UI.Web.Client/Pages/ADCHomePageContent.cs:13); the MAUI head points at a thin local wrapper page that renders <ADCHome /> with no parameters (MMCA.ADC/Source/Hosts/UI/MMCA.ADC.UI/Pages/ADCHomePageContent.cs:10, MMCA.ADC/Source/Hosts/UI/MMCA.ADC.UI/Pages/ADCHome.razor:6). [Rubric §28, Front-End Testing]: a bUnit suite renders the page directly (MMCA.ADC/Tests/Modules/Conference/MMCA.ADC.Conference.UI.Tests/Pages/Home/ADCHomeTests.cs), covering the hero eyebrow and title class, the workshop cards and their links, the ticketing call to action with and without a URL (:163, :220), and the partners band ordering and empty state (:256, :306). Two suites hold it to account from outside as well: the brand-token fitness test above and the E2E pseudo-localization sentinel, which probes this page's Location.OpenInMaps resource and settles on the always-rendered .location-section, precisely because that button is static markup rather than event-load-gated (MMCA.ADC/Tests/E2E/MMCA.ADC.E2E.Tests/Workflows/PseudoLocalizationTests.cs:35-48).

• Caveats / not-in-source: the page's own countdown window is not identical to the selector's. UpdateCountdown starts the event at EventStartTime = 08:00 local (:44, applied at :332), while CurrentEventSelector starts its live window at midnight local (MMCA.ADC.Conference.Shared/Events/CurrentEventSelector.cs:71). Both end at midnight after the last day (CurrentEventSelector.cs:70; :333 here). So between midnight and 08:00 on day one, the selector already treats the event as live while the hero still shows a countdown. Whether that is intended is not determinable from source. Also note the two hard-coded fallbacks used when no event loads: the date 2026-10-17 (:46-49), whose comment warns it must track the published event date or the hero date and countdown visibly jump once the real event arrives, and the venue address (:110).

SessionAssetComposer

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.SessionAssets · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/SessionAssets/SessionAssetComposer.razor.cs:24 · Level 0 · class (Blazor code-behind)

• What it is: the input surface for one new session material, add-a-link or pick-a-file, extracted out of SessionAssetsPanel as its own component. It owns the two link text fields and validates and normalizes the typed address before ever raising an event; the panel still owns the cap check, the actual write, and every status message.
• Depends on: SessionAssetsPanel as its only host (line 43, _fileInputId), and the Blazor primitives EventCallback<T> and InputFileChangeEventArgs/IBrowserFile (lines 35, 38, 41, 80). No first-party service or domain type.
• Concept introduced, a composer that validates before it emits. Rather than raise a raw string and let the host re-validate, AddLinkAsync (lines 60-78) checks CanSubmitLink (lines 50-51) and normalizes the address through TryNormalizeWebUrl (lines 100-125) itself, and only ever raises one of two outcomes: OnAddLink with the trimmed title and the normalized absolute URL, or OnInvalidLinkAddress with no payload at all, leaving the host to word the refusal. [Rubric #19, State Management & Data Flow] assesses where UI state is owned: the draft fields (_newLinkTitle, _newLinkUrl, lines 47-48) live entirely in the composer, and ClearDraft (lines 54-58) is the only way the host reaches back in, called only once a write has actually succeeded (the host's AddLinkAsync calls _composer?.ClearDraft() after MutateAsync reports success).
• Walkthrough
  • Disabled (line 32) is one flag the host sets whenever every control should render inert (at the session's material cap or mid-write), rather than the composer re-deriving that from state it does not own.
  • _fileInputId (line 45) is generated per instance with Guid.NewGuid():N, because a page renders one composer per session and a fixed id would collide across composers and mis-point the file input's label.
  • AddLinkAsync (lines 60-78) re-checks CanSubmitLink, normalizes through TryNormalizeWebUrl, echoes the normalized URL back into _newLinkUrl (line 75, so the speaker sees the address that will actually be stored) before raising OnAddLink with the trimmed title and normalized URL.
  • OnFileSelectedAsync (lines 80-88) forwards the picked IBrowserFile through OnFileSelected; it does no size or format check itself, that stays the host's job against SessionAssetLimits.
  • TryNormalizeWebUrl (lines 100-125) accepts a value that already parses as an absolute http/https URL as-is (Ordinal scheme comparison, lines 107-108, matching the domain invariant and the FluentValidation rule that guard the same value server-side), and otherwise prefixes a scheme-less value with https:// and re-parses (lines 111-122), so a speaker pasting github.com/me/repo is treated as a web address rather than rejected outright.
• Why it's built this way: pulling the add-link fields and their normalization out of the panel keeps the panel's MutateAsync gateway focused on the write itself, and gives the input surface a ClearDraft the host can call only when a write actually lands, so a refused write leaves the speaker with what they typed instead of silently emptying the fields.
• Where it's used: rendered inside SessionAssetsPanel's markup as the add-material affordance.
• Caveats / not-in-source: TryNormalizeWebUrl duplicates the method of the same name and shape that used to live on SessionAssetsPanel itself (removed by the same change that added this component); whether a shared helper was considered instead of the duplication is not determinable from source.

NewestLoadTracker<T>

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Sessions · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Sessions/NewestLoadTracker.cs:14 · Level 0 · class (internal sealed, generic)

• What it is: a tiny tracker that makes overlapping asynchronous loads all resolve to the result of the newest one. Track records a load as the newest and returns a task that completes with the newest load's result (NewestLoadTracker.cs:24-28).
• Depends on: nothing beyond Task<T>; the only state is _newest (:16).
• Concept introduced, newest wins without cancelling. A grid can issue a second ServerData call while the first is still waiting on a prerequisite. Rather than let the superseded call paint its own (possibly empty) page, NewestResultAsync (:30-40) awaits its own load, then loops while _newest is a different task, switching to it and awaiting it, until the task it just finished is the newest. Every caller therefore returns the same final data. The doc (:18-22) states the contract: call Track before anything yields, so an earlier load resuming afterwards already sees this one as its successor. [Rubric §19, State Management & Data Flow].
• Walkthrough
  • Track(load) (:24-28) assigns _newest = load (:26) and returns NewestResultAsync(load) (:27), so the assignment happens synchronously on the caller's turn.
  • NewestResultAsync (:30-40): the while (_newest is { } newest && !ReferenceEquals(newest, load)) loop (:33) advances load and data (:35-36) until nothing newer exists, then returns data (:39).
• Why it's built this way: cancelling the older load is not an option here because the older load is the grid's own pending request; making it answer with the newer result removes the visible flash of an empty page without touching the grid.
• Where it's used: held as _gridLoads and applied in PublicSessionList.LoadServerData (PublicSessionList.razor.cs:44, :211-212), where it fixes the U-35 case of a load superseded while waiting on the event scope.

PublicSessionEventScope

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Sessions · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Sessions/PublicSessionEventScope.cs:14 · Level 0 · class (internal sealed)

• What it is: the coordinator for the page's events lookup. It remembers the initial lookup task, reports whether a lookup is still pending, and lets overlapping grid loads await it, re-issuing it at most once while the scope is unresolved so the Retry button heals a transient failure (PublicSessionEventScope.cs:18-22, :31-35).
• Depends on: nothing beyond Task and delegates supplied by the caller (scopeUnresolved, reissue, onReissued, :36); state is _lookup and _resolutionsInFlight (:16-17).
• Concept introduced, a shared single re-issue. Several grid loads can wait on the same failed lookup. EnsureAsync (:36-68) counts itself in _resolutionsInFlight (:38), awaits the current lookup (:45), and if the lookup it waited on has since been replaced by a sibling load's re-issue it joins that new one instead and marks itself as retried (:47-53). It only re-issues when it has not retried and the scope is still unresolved (:55-62), storing the new task in _lookup and calling onReissued so the page can re-render its pending state. The result is at most one extra lookup however many loads overlap. [Rubric §29, Resilience & Business Continuity].
• Walkthrough
  • Pending (:23) is true while _lookup has not completed or any EnsureAsync call is still resolving, because a resolving load may yet re-issue a failed lookup (doc :19-22).
  • Start(lookup) (:27) records the page's initial lookup and returns it for the caller to await.
  • EnsureAsync (:36-68) decrements _resolutionsInFlight in a finally (:65-67), so Pending cannot stick after a fault.
• Why it's built this way: the page previously held the lookup task and the retry rule itself; pulling it out gives the retry-race behavior a home that can be exercised without rendering the grid.
• Where it's used: held as _eventScope by PublicSessionList (PublicSessionList.razor.cs:43); Start is called in OnInitializedAsync (:128), Pending backs EventsLookupPending (:163), and EnsureAsync backs EnsureEventScopeAsync (:178-179).

SessionAssetDisplay

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.SessionAssets · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/SessionAssets/SessionAssetDisplay.cs:13 · Level 2 · internal static class

• What it is: a small, stateless helper shared by the two session-materials components: it picks the icon for an asset and formats a byte count for display. Everything on it is a pure function over its arguments.
• Depends on: SessionAssetDTO and SessionAssetKind (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.Shared/SessionAssets/SessionAssetDTO.cs, .../SessionAssets/SessionAssetKind.cs), SessionAssetLimits.MaxFileBytes (line 28). Externals: MudBlazor Icons.Material.Filled.* (lines 45, 52-58), System.Globalization.CultureInfo (line 80).
• Concept introduced, deriving display facts instead of storing them. Neither the icon nor the formatted size is persisted anywhere; both are computed on demand from the asset's Kind and stored byte count, so a rendering change (a new icon, a different rounding) touches this one file and nothing in the data model. [Rubric §15, Best Practices & Code Quality] assesses whether a number lives in one place: the upload cap shown in the UI hint and the over-size message is MaxFileMegabytes (line 28), derived from SessionAssetLimits.MaxFileBytes by division rather than restated as a literal, so the client hint and the server-enforced cap cannot drift apart. [Rubric §27, Internationalization] assesses whether user-facing text is externalized: FormatSize returns the numeric amount and a resource key ("Size.Megabytes", "Size.Kilobytes", "Size.Bytes"), not a formatted sentence, so the caller composes it through its own localizer and a Spanish reader sees "1,4 MB" rather than an English-punctuated string (doc, lines 62-65).
• Walkthrough
  • IconFor(SessionAssetDTO asset) (lines 39-60) null-guards (line 41), returns the link icon outright for SessionAssetKind.Link (lines 43-46), and otherwise switches on ExtensionOf(asset) over a closed set of upper-cased extensions (.PDF, .PPTX, .DOCX, .XLSX, .ZIP, .MD/.TXT, lines 50-59), falling back to a generic file icon. The in-code comment (lines 48-49) explains the upper-casing: the comparison is over a closed set the code owns, so SonarAnalyzer's CA1308 wants the round-trip-safe casing rather than a culture-sensitive lower-case.
  • FormatSize(long sizeBytes) (lines 68-81) picks the largest unit the value clears (megabytes, then kilobytes, then bytes, lines 70-80) and rounds through Round (lines 83-84), which formats with "0.#" under CultureInfo.CurrentCulture so the decimal separator matches the active locale.
  • ExtensionOf(SessionAssetDTO asset) (lines 86-103) reads the extension off the stored blob name first, and only falls back to parsing the asset's Url when the blob name is blank (lines 93-98). The doc comment states why the order matters (lines 86-89): a blob URL can carry a signature query string, and taking the extension from the URL first would yield the query string rather than the file's actual format.
• Why it's built this way: both helpers are pure and side-effect-free, so a component that needs an icon or a formatted size calls a static method instead of duplicating the switch or the rounding logic; keeping the file extension check on the blob name first (not the URL) is what keeps the icon correct for a signed download link.
• Where it's used: IconFor renders the material icon on SessionAssetsPanel and SessionAssetsDownloadList; FormatSize backs DescribeSize on both of those components (.../SessionAssets/SessionAssetsPanel.razor.cs:486-490, .../SessionAssets/SessionAssetsDownloadList.razor.cs:157-161); MaxFileMegabytes is quoted in SessionAssetsPanel's over-size message (.../SessionAssetsPanel.razor.cs:333).
• Caveats / not-in-source: the extension switch (lines 50-59) recognizes six formats explicitly; any other extension, including one the API itself accepts, falls back to the generic file icon. Whether the set of icons is meant to track the server's allowed-format list is not determinable from this source.

PublicSessionListFilterBar

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Sessions · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Sessions/PublicSessionListFilterBar.razor.cs:16 · Level 3 · class (Blazor code-behind)

• What it is: the presentational filter bar for PublicSessionList: the privileged-reader Filter-by-Event picker (or the locked "Showing" chip for everyone else), the debounced title search box, the Room picker, the All Sessions / My Schedule toggle, and the share-my-schedule action (class doc, PublicSessionListFilterBar.razor.cs:9-15).
• Depends on: EventDTO and RoomDTO (:2); IScreenshotService, IShareService, and IToastService (:18-20). Its Rooms option set is produced by PublicScheduleRoomOptions.
• Concept introduced, the container/presentational split. The bar owns no filter state. Every value arrives as a [Parameter] and every change leaves through a matching EventCallback: IsPrivileged (:26), Events (:29), SelectedEventId / SelectedEventIdChanged (:32, :35), SearchString / SearchStringChanged (:38, :41), Rooms (:47), SelectedRoomId / SelectedRoomIdChanged (:50, :53), and ShowMyScheduleOnly / ShowMyScheduleOnlyChanged (:56, :59). The page stays the single source of truth and the bar is a pure view over it, with no lifecycle method of its own. [Rubric §18, UI Architecture & Component Design] (assesses decomposition and separation of layout from behavior) and [Rubric §19, State Management & Data Flow] (assesses where mutable state lives): with nothing to initialize, the bar cannot drift from the data the grid actually fetched. Three details reward a close read. The parameter is IsPrivileged, not "is organizer", because the privileged read audience is a role set (ConferenceReadAudience) rather than one role. Rooms documents its own empty case (:43-46): an empty list hides the Room picker entirely, because an event with no rooms has nothing to narrow by, so a control with no meaningful options is removed rather than shown disabled ([Rubric §24, Forms, Validation & UX Safety]). And the localizer injected in the markup is IStringLocalizer<PublicSessionList>, not one of its own (PublicSessionListFilterBar.razor:3), so the split into three components did not split the page's resource file into three. [Rubric §27, Internationalization].
• Walkthrough
  • GetSelectedEventName() (:61-62): resolves the chip label from the passed-in Events list, returning empty when nothing is selected.
  • ShareScheduleAsync() (:64-85): captures the current view to a file through IScreenshotService and hands it to IShareService as image/png (:68-70); a null capture or a failed share collapses into one warning toast (:72), and the || short-circuit means a null path never reaches the share call. The whole body sits in a try that swallows OperationCanceledException as expected disposal or an InteractiveAuto transition (:75-78) and turns any other exception into the same warning toast (:79-84): it runs from an OnClick callback, where on the native heads an escaped exception is fatal to the host (comment :81-82, tag A-08). This is a native-head capability (ADR-042 Wave 3) that degrades quietly on the web. [Rubric §29, Resilience & Business Continuity].
• Why it's built this way: pushing all filter state to the page means the same chrome can sit above both the desktop grid and the mobile card list without either layout owning a second copy of the filters.
• Where it's used: rendered once by PublicSessionList (PublicSessionList.razor:11-21); its callbacks land on that page's OnEventFilterChanged, OnSearchChanged, OnRoomFilterChanged and OnMyScheduleToggled handlers (PublicSessionList.razor.cs:182-204).

PublicSessionBookmarkState

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Sessions · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Sessions/PublicSessionBookmarkState.cs:14 · Level 4 · class (internal sealed, primary constructor)

• What it is: the reader-and-bookmarks state for PublicSessionList: whether the reader is signed in, their user id, and the dictionary of starred sessions. The same dictionary instance is handed to PublicSessionListView, which patches it in place as stars toggle (doc PublicSessionBookmarkState.cs:27-30).
• Depends on: the cascaded Task<AuthenticationState>? and the optional ISessionBookmarkUIService as primary-constructor parameters (:14-16); ClaimsPrincipalExtensions's GetUserId (:79); Result for the kept failure (:19).
• Concept introduced, a load whose failure is kept rather than thrown. The state is built from the page's already-resolved authentication task and bookmark service, so it has no [Inject] surface of its own. StartLoad (:38-42) runs LoadAsync and stores the task, because the page must start it eagerly: the grid's first ServerData call can race ahead of initialization (doc :33-36). [Rubric §19, State Management & Data Flow] (assesses where mutable state lives and how loads are ordered).
• Walkthrough
  • LoadAsync (:67-97) returns immediately when there is no authentication task or no bookmark service (:69-72), so a disabled Engagement module leaves the reader anonymous with an empty dictionary. Otherwise it awaits the authentication state, reads the id through GetUserId (:79, accepting both the sub claim and the NameIdentifier form the bearer handler maps it to), sets CurrentUserId and IsAuthenticated (:81-82), and loads the bookmarked ids (:86). The failure is stored in _loadFailure (:87) and a success replaces BookmarkedSessions (:88-91). OperationCanceledException is swallowed as expected disposal or an InteractiveAuto transition (:94-97).
  • EnsureAsync(showMyScheduleOnly) (:51-65) awaits the load task and returns null unless My Schedule is active for a signed-in reader whose read failed (:58-61). In that case it re-issues the load once (:63) and returns the still-held failure (:64), so the page shows an error, not an empty schedule (doc :44-48). Plain browsing is unaffected: a failed read only leaves the stars unset (comment :83-85). [Rubric §29, Resilience & Business Continuity].
• Why it's built this way: My Schedule is the one view that cannot be answered without the bookmark read, so the failure has to be kept somewhere the fetch path can see it. Holding it here keeps that rule out of the page.
• Where it's used: created per page initialization as _bookmarks (PublicSessionList.razor.cs:121-122), awaited by FetchSessionsAsync through EnsureAsync (:245), and read for IsAuthenticated and BookmarkedSessions when building the request (:255, :264).

SessionAssetsDownloadList

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.SessionAssets · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/SessionAssets/SessionAssetsDownloadList.razor.cs:18 · Level 5 · class (Blazor code-behind, IDisposable)

• What it is: the read-only, attendee-facing list of a session's slides, links and files. It loads once per session and renders nothing organizers-only, no add/rename/delete affordances at all.
• Depends on: ISessionAssetUIService (line 20 injected field), SessionIdentifierType (line 23 parameter), SessionAssetDisplay.FormatSize (line 58), and the LifetimeToken extension on the CancellationTokenSource (line 30). Externals: Blazor [Inject]/[Parameter], System.Threading.CancellationTokenSource.
• Concept introduced, none new. This component is the minimal half of the pattern SessionAssetsPanel teaches in full: load-once-per-session, swallow OperationCanceledException during disposal, dispose the _cts exactly once. Reading the two side by side is the point: this one keeps only the load and render path and drops every mutation. [Rubric §19, State Management] assesses whether fetched state is invalidated deliberately: OnParametersSetAsync (lines 36-54) returns immediately when _loadedSessionId == SessionId (lines 38-41), the same reload guard the mutable panel uses, so re-rendering the same session never refetches.
• Walkthrough
  • OnParametersSetAsync (lines 36-54) sets _loadedSessionId (line 43), then awaits SessionAssetService.GetBySessionAsync(SessionId, cancellationToken: LifetimeToken) (line 47), where LifetimeToken (line 30, comment lines 27-29) is _cts.LifetimeToken(): reading Token off a disposed source throws ObjectDisposedException, and because Dispose cancels before it disposes, a load that resumes after the user navigated away gets an already-cancelled token and stops through its OperationCanceledException catch (line 50) instead. It leaves bypassCache at its false default so the attendee read is served from the shared output cache (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Services/SessionAssets/ISessionAssetUIService.cs:25-34), and unwraps the Result with TryGetValue, falling back to an empty list on failure (line 48) rather than surfacing an error state.
  • DescribeSize(long sizeBytes) (lines 56-60) forwards to SessionAssetDisplay.FormatSize and resolves the returned unit key through the component's own localizer (L[unitKey, amount].Value, line 59).
  • The _disposed-guarded Dispose(bool) / Dispose pair (lines 62-84) cancels and disposes _cts exactly once, identical in shape to every other component in this group.
  • The per-instance _headingId (line 31) exists for the same reason as on SessionAssetsPanel: a page can render more than one materials list, and a fixed id would break the label/heading association across instances.
• Why it's built this way: an attendee never edits a session's materials, so giving them a component with no mutation surface at all (rather than the organizer panel with CanManage="false") means there is no upload input, no delete button and no edit state to accidentally expose in a public view.
• Where it's used: rendered on the public session detail page wherever attendee-visible materials are shown, keyed by the session's identifier.
• Caveats / not-in-source: a failed load renders an empty list with no visible error (line 48), so an attendee cannot distinguish "this session has no materials" from "the materials failed to load".

SessionAssetsPanel

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.SessionAssets · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/SessionAssets/SessionAssetsPanel.razor.cs:31 · Level 5 · class (Blazor code-behind, IDisposable)

• What it is: the organizer- and speaker-facing manager for a session's materials: add a link, upload a file, rename or delete an asset, all behind a shared cap and a shared failure-to-message mapping. A CanManage parameter toggles it into the same read-only rendering SessionAssetsDownloadList provides. Its add-link and pick-a-file inputs live in a child SessionAssetComposer (line 67 field _composer); this panel keeps the cap check, the write itself, and every status message.
• Depends on: ISessionAssetUIService (line 33 injected field), SessionIdentifierType (line 36 parameter), SessionAssetComposer (line 67), SessionAssetDisplay for MaxFileMegabytes and FormatSize, SessionAssetLimits.MaxAssetsPerSession (line 69), SessionAssetLinkRequest (lines 115-121) and SessionAssetUpdateRequest (lines 186-190), the LifetimeToken extension on _cts (line 49 property), and Result (line 214). Externals: Blazor ([Inject], [Parameter], IBrowserFile), MudBlazor (Severity), and a DeleteConfirmation component (line 66) from MMCA.Common.UI.Components.
• Concept introduced, one mutation gateway for every write. Add-link, upload-file, rename and delete are four different service calls, but they all route through MutateAsync (lines 214-238, plus the Task<Result<T>>-adapting overload at lines 244-245): set busy, run the operation, report the failure through DescribeFailure or the success through a localized toast state, reload the list, clear busy in a finally. A caller supplies only the operation delegate, the success resource key, and an optional post-success callback (AddLinkAsync clears the composer's draft, SaveTitleAsync calls CancelEditing). [Rubric #24, Forms, Validation & UX Safety] assesses whether a rejection is explained in place: FailureResourceKeys (lines 264-280) maps every machine-readable error code the four write paths can return to a resource key, with the field's own doc comment (lines 247-263) explaining two edge cases directly in the source (lines 252-255 and 258-261): Http.413 is the one transport-level status in the table, because Kestrel refuses an over-cap request body before the friendly SessionAsset.InvalidUpload domain check ever runs, which is the one case the client-side size check (line 151) cannot catch (a body inflated past the cap by multipart framing); and a title refusal is listed under two different codes because two layers can raise it, the domain invariant (SessionAsset.Title.*) and the request validator's FluentValidation defaults (NotEmptyValidator / MaximumLengthValidator), which the request validator leaves unwrapped rather than remapping. DescribeFailure (lines 287-298) falls back to one generic sentence for any code not in the table (a transport fault, a concurrency refusal, an unexpected
  500. rather than surfacing the server's raw text. [Rubric #27, Internationalization] assesses whether every user-facing string is externalized: every key in FailureResourceKeys and every success key passed into MutateAsync is a resource lookup through L[...], never an inline sentence.
• Walkthrough
  • IsAtCap (line 69) is the one gating boolean the panel itself computes; the markup passes it into the composer as Disabled alongside the busy flag.
  • LifetimeToken (line 49, comment lines 46-48) is _cts.LifetimeToken(): reading Token off a disposed source throws ObjectDisposedException, and because Dispose cancels before it disposes, a load or handler that resumes after the user navigated away gets a cancelled token and stops through its OperationCanceledException path. Every service call below (load, add link, upload, rename, delete) passes it instead of _cts.Token.
  • OnParametersSetAsync / LoadAsync (lines 71-105) mirror SessionAssetsDownloadList's reload guard, but differ in two ways. The fetch passes bypassCache: true (line 87): the list endpoint is served under a shared output-cache policy, so an owner's read could otherwise hit an entry built for an anonymous caller and miss a material they just added, and the flag makes the UI service add a unique query parameter that is a guaranteed cache miss (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Services/SessionAssets/ISessionAssetUIService.cs:25-34). And on a failed fetch this version keeps the list empty and sets a status message (SetStatus, line 95), unlike the read-only list's silent fallback.
  • AddLinkAsync (lines 107-129) takes the (Title, Url) tuple the composer already normalized, re-checks only IsAtCap, builds a SessionAssetLinkRequest with SortOrder = _assets.Count (line 120), and clears the composer's draft (_composer?.ClearDraft()) only once MutateAsync reports the write succeeded, so a refused write leaves the speaker with what they typed (in-code comment, lines 123-124).
  • ReportInvalidLinkAddress (lines 131-137) words the composer's own refusal of a typed address. The doc comment explains why the wording stays here rather than moving into the composer: every outcome of every action reaches the one aria-live status region below, and the sentence stays beside the matching API refusal it mirrors in FailureResourceKeys.
  • OnFileSelectedAsync (lines 139-162) takes the composer's forwarded IBrowserFile directly, rejects an over-cap file client-side against SessionAssetLimits.MaxFileBytes (line 151) before ever posting, with a title defaulted by DefaultTitleFor (lines 312-324), which strips the extension and falls back to the raw file name only if the stripped result is blank, capped at SessionAssetDTO.TitleMaxLength.
  • StartEditing / CancelEditing (lines 164-175) toggle the inline rename state; SaveTitleAsync (lines 177-196) echoes the asset's own SortOrder back unchanged (in-code comment: omitting it would silently move the material to the top) and posts through UpdateAsync with the asset's RowVersion for optimistic concurrency.
  • DeleteAsync (lines 198-208) confirms through the injected DeleteConfirmation component rather than a native browser confirm() (in-code comment: unstyled, untranslated and unreachable from the MAUI head), then deletes through MutateAsync.
  • The _disposed-guarded dispose pair follows the same shape as every other component in this group.
• Why it's built this way: four writes with the same busy/report/reload shape and a shared failure vocabulary are cheaper to keep correct as one gateway method than as four hand-written try/catch blocks, and centralizing FailureResourceKeys is what lets a new server error code be wired to a message in one place instead of four. Extracting the add-link fields into SessionAssetComposer keeps this gateway focused on the write itself rather than also owning the draft the write is built from.
• Where it's used: rendered on the organizer's and the speaker's session detail surfaces, with CanManage distinguishing an editable view from a read-only preview; SessionAssetDisplay.IconFor and FormatSize supply the icon and size text for every rendered asset.
• Caveats / not-in-source: CanManage="false" renders the same read-only shape SessionAssetsDownloadList provides independently, so the codebase carries two components capable of a read-only materials list rather than one component the other wraps. Whether that duplication is deliberate is not determinable from this source.

PublicSessionListView

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Sessions · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Sessions/PublicSessionListView.razor.cs:26 · Level 5 · class (Blazor code-behind)

• What it is: the presentational session-list view for PublicSessionList: the mobile infinite-scroll card list and the desktop server-paged data grid, including the inline bookmark stars and their toggle flow (class doc, PublicSessionListView.razor.cs:15-25).
• Depends on: SessionDTO, the optional ISessionBookmarkUIService (:60), SpeakerInfo (:69), Result in the mobile fetch delegate's signature (:78), ConferenceRoutePaths (:185), MobileInfiniteScrollList<TItem> (:80, rendered at PublicSessionListView.razor:6), ListPageActions (:94), IToastService and IHapticFeedbackService (:28-29), plus MudBlazor's MudDataGrid<T> / GridState<T> / GridData<T> and NavigationManager.
• Concept introduced, the presentational child that patches container-owned state in place. Like PublicSessionListFilterBar, the view owns no fetch or filter state: the page hands down its ServerData and FetchPageResult delegates (:75, :78), its paging parameters (:42-48), the speaker and room lookups (:69, :72), and the shared BookmarkedSessions dictionary (:66). The subtlety is that the view mutates that dictionary in place when a star is toggled (AddBookmarkAsync writes BookmarkedSessions[sessionId] = bookmark.Id at :170, RemoveBookmarkAsync removes at :150), so the page's My Schedule fetch, which reads the same dictionary to scope the query, sees the change without a round trip. The class doc names the sibling that uses the same pattern, SessionLivePollPanel (:20-21). It also exposes the captured Grid reference (:90) and ReloadAsync() (:93-94) so the page's DataGridListPageBase<TDto> plumbing keeps restoring rows-per-page and current page unchanged. [Rubric §18, UI Architecture & Component Design] and [Rubric §19, State Management & Data Flow]: state has exactly one owner (the page) and one mutation point (this component). The class doc also records a deliberate omission (:23-24): the list shows no track or category chips, because the detail page is where a session's categories are read and the list stays scannable on time, speakers, and room. [Rubric §25, Navigation & Information Architecture].
• Walkthrough
  • IsBookmarked (:96-97) is a dictionary lookup, so star state costs nothing per row.
  • CanBookmark (:139-143): a session is bookmarkable only when the user is authenticated, the Engagement-owned service resolved, the session is not a service session, and SessionStatuses.IsEligible accepts its status. The comment (:136-138) records this as the BR-49 allow-list (unset or "Accepted"), the same rule the server-side bookmark validation applies, precisely so the UI never shows a star the server would then reject. [Rubric §11, Security] and [Rubric §24, Forms, Validation & UX Safety].
  • ToggleBookmarkAsync (:110-137): guards re-entry with a per-session HashSet whose Add doubles as the guard test (:112, field at :83), fires Haptics.Click() (:116, a no-op off native heads), then removes or adds, catching OperationCanceledException as expected teardown or an InteractiveAuto transition (:129-132) and clearing the guard entry in the finally (:135). The per-session guard is a fixed defect worth reading: the comment at :81-82 records that a single global in-flight flag made one slow toggle swallow every other star's click, so the list stopped responding until that request came back.
  • RemoveBookmarkAsync (:139-158): a delete that comes back not-found is treated as success, because a bookmark that is already gone still leaves the user where they asked to be (:143-148, the tolerance expressed as removed.IsFailure && !removed.IsNotFound() over ResultUiExtensions.IsNotFound, MMCA.Common/Source/Presentation/MMCA.Common.UI/Common/ResultUiExtensions.cs:340); it then clears the entry, toasts, and reloads when the My Schedule view is active so the removed row disappears (:150-157).
  • AddBookmarkAsync (:160-172): a create that did not come back with a bookmark leaves the star unset, so the page reports a warning rather than a success toast that would contradict its own UI (:162-168).
  • GetSpeakerList (:174-182) maps a session's SessionSpeakers to display names through the passed-in lookup, skipping ids the lookup does not know; OnMobileCardClick (:184-185) routes to PublicSessionDetail through ConferenceRoutePaths.
• Why it's built this way: separating the grid and card layouts from the page's fetch-and-filter logic lets one bookmark implementation serve both, while the page remains the owner of every piece of state either layout renders.
• Where it's used: rendered by PublicSessionList, which holds it as _view (PublicSessionList.razor.cs:41, captured at PublicSessionList.razor:31) and reads _view?.Grid for its GridRef override (:70) and _view?.ReloadAsync() for every filter change (:232).

SessionBookmarkButton

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Sessions · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Sessions/SessionBookmarkButton.razor.cs:27 · Level 5 · class (Blazor code-behind)

• What it is: the standalone bookmark star for one session, extracted out of PublicSessionDetail so that page no longer has to inject the Engagement-owned bookmark service or carry a reader's authentication state just to draw one toggle.
• Depends on: optionally ISessionBookmarkUIService, resolved through IServiceProvider (:29); IToastService and IHapticFeedbackService (:30-31); the SessionId parameter typed as SessionIdentifierType (:38); UserIdentifierType and UserSessionBookmarkIdentifierType for its local state (_currentUserId and _bookmarkId, :48-50); and ClaimsPrincipalExtensions's GetUserId, read off the cascading AuthenticationStateTask (:35, :86).
• Concept introduced, an optional cross-module service resolved per component instance rather than per page. Like the pages that used to hold this logic, Blazor's [Inject] has no optional mode (an unregistered service throws at render), so BookmarkService is resolved with ServiceProvider.GetService<T>() in OnInitialized (:53-57) and every call site null-checks before using it. Because the resolution now happens once per rendered star instead of once per hosting page, moving it here is what let PublicSessionDetail drop its own copy of the same pattern entirely. [Rubric section 7, Microservices Readiness] (assesses that a module can be switched off without breaking its consumers) and [Rubric section 18, UI Architecture & Component Design] (assesses decomposition: one focused component owns one piece of optional behavior instead of every host page repeating it).
• Walkthrough
  • LifetimeToken (:45, comment :41-44) is _cts.LifetimeToken(): reading Token off a disposed source throws ObjectDisposedException, and because Dispose cancels before it disposes, a read or toggle that resumes after the reader navigated away gets a cancelled token and ends through its OperationCanceledException catch. The bookmark read and both toggle writes pass it (:94, :122, :137).
  • OnParametersSetAsync (:59-71) skips the read during SSR prerender for the reason every other interactive page states: under InteractiveAuto the interactive instance re-runs this method, so without the guard every visit would fetch the reader's bookmarks twice; the prerender pass renders the unset star. It then reloads only when SessionId actually changed (:64, :69-70).
  • LoadBookmarkStateAsync (:73-105): awaits the cascading authentication state, reads the identifier through GetUserId (:86, accepting both the sub claim and the NameIdentifier form the bearer handler maps it to, and parsing invariantly), then loads the bookmarked ids; a failed read is non-critical and leaves the star unset (:93-99).
  • ToggleBookmarkAsync (:107-157): a single _isTogglingBookmark re-entry guard, a haptic click (:113, a no-op off native heads), then a delete that tolerates an already-gone (404) bookmark as a successful remove (:120-127), or a create that reports a warning rather than a success toast when the response comes back without a bookmark body (:137-142). Both branches catch OperationCanceledException as expected component disposal or an InteractiveAuto transition, and clear the re-entry guard in the finally (:153-156).
  • Disposal (:159-184) is the standard cancel-on-disposal pattern over the component's own CancellationTokenSource (:40).
• Why it's built this way: a bookmark toggle is genuinely optional (it needs the Engagement module, which ADC can run without), and every page that renders a session benefits from the same fail-soft behavior, so the toggle is a component with its own lifecycle instead of logic duplicated per host.
• Where it's used: rendered by PublicSessionDetail for its single session's star. PublicSessionListView keeps its own inline bookmark implementation (a per-session HashSet re-entry guard over a shared BookmarkedSessions dictionary, not this component), because a list needs to mutate one shared dictionary in place across many rows rather than own independent per-row state.

PublicSessionDetail

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Sessions · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Sessions/PublicSessionDetail.razor.cs:24 · Level 9 · class (Blazor code-behind)

• What it is: the public read-only view of one session (speakers, categories, room and wayfinding) plus the contextual actions an authenticated attendee gets: the bookmark toggle (rendered through SessionBookmarkButton), the feedback link, a listen-aloud button, and the Live entry point when the Engagement module is present and the session is inside its event's live window.
• Depends on: ISessionUIService, ISpeakerLookupService, IRoomUIService, ICategoryItemLookupService (:26-29), IEventLookupService and an injected BCL TimeProvider for the live-window check (:34-35); optionally ISessionLiveUIService (field :40, resolved at :58); ITextToSpeechService (:33); SessionDTO, RoomDTO, IToastService (:31), CurrentEventSelector.GetLiveWindowUtc (:270-273), ConferenceRoutePaths (:62, :278), and DomainHelper's Id.Parse<T> (:130). The bookmark toggle itself, including ISessionBookmarkUIService and the ClaimsPrincipalExtensions-based user lookup this page used to hold, now lives entirely in SessionBookmarkButton, which the page renders and no longer injects services for.
• Concept introduced, optional cross-module service resolved through the container. Blazor's [Inject] has no optional mode (an unregistered service throws at render), so the Engagement-owned ISessionLiveUIService is resolved with ServiceProvider.GetService<T>() in OnInitialized and left null when that module is disabled (field :40, resolved at :58). The markup only renders the Live button when SessionLive resolved. [Rubric section 7, Microservices Readiness] (assesses that a module can be switched off without breaking its consumers): the Conference page degrades to a plain read-only session view when Engagement is absent, rather than failing to render. [Rubric section 3, Clean Architecture]: the dependency is on an interface owned by the other module's UI contract, never on its internals. The page repeats two mechanisms taught above. The prerender skip (:94-102) carries the same reasoning as the other public detail pages: under InteractiveAuto the interactive instance re-runs OnParametersSetAsync, so without the guard every visit fetched the session, all speakers, all category items and the room twice, and it names the category-item read as the expensive one, a full-table read per view; now that the bookmark toggle moved to its own component, this page's own prerender skip no longer covers bookmark state. [Rubric section 23, Front-End Performance & Rendering]. The load-tracking field is a LatestLoadGuard (:75), which pairs the generation check with a per-load CancellationTokenSource: LoadSessionAsync calls _load.Begin() (:116) to get back both the token and the generation, so starting a new load also cancels the fetch already in flight rather than merely letting its result drop once _load.IsCurrent(generation) (re-checked at :131) comes back false. The field doc explains why the generation rather than the route id is authoritative (:69-74), and Dispose(bool) disposes the guard alongside the page's own _cts (:323). The page's own token is read through LifetimeToken (:49, comment :45-48), which is _cts.LifetimeToken(): reading Token off a disposed source throws, and since Dispose cancels first, a late resume gets a cancelled token instead; the listen-aloud call uses it (:302). It also repeats the BR-49 status allow-list as IsStatusIneligible (:88-91), with the comment pointing at SessionStatuses.IsEligible as the same rule the server applies.
• Walkthrough
  • LoadSessionAsync (:113-184): right after Begin() it resets the derived per-session state (_room, _roomName, _speakerNames, _categoryNames, _isLiveNow, :121-125) so a session with no room, or a failed enrichment lookup, never shows the previous session's room, speakers, categories or live state (comment :118-120, tag L156). It then fetches the session with children (:130), clears Session and toasts not-found-versus-load-failed on failure (:136-145), then runs three resolvers in a single short-circuiting condition (:150-152) so any one failing raises one load-failure toast (:154-160), each resolver taking the load's own cancellation token, and finally ResolveLiveWindowAsync (:162). The remaining broad catch (Exception) (:168) no longer guards a bookmark-state read (that moved into SessionBookmarkButton); its comment records that every resolve step above answers with a Result, so nothing here is expected to throw, and a fault that does must still leave the reader with a message rather than a blank card.
  • ResolveSpeakerNamesAsync (:190-202) and ResolveCategoryNamesAsync (:205-221) join the session's child collections against the two lookup services, skipping ids the lookup does not know; the category resolver prefixes the owning category title when present, so a chip reads "Level: Intermediate".
  • ResolveRoomAsync (:228-250): returns success immediately for a session with no room, otherwise fetches the room including wayfinding info (BR-94) and treats a not-found as a tolerable miss that leaves the wayfinding block empty, which the markup renders field by field. It no longer clears _room / _roomName on a miss: LoadSessionAsync already reset them up front.
  • ResolveLiveWindowAsync (:259-276): decides whether the session is inside its event's live window. It looks the event up through IEventLookupService (:262), re-checks the generation, and returns with _isLiveNow false when the lookup failed or the event is unknown (:263-268). Otherwise CurrentEventSelector.GetLiveWindowUtc turns the event's start date, end date and time zone into a UTC range from the first day 00:00 to the day after the last (doc :252-258, the same window the server enforces), compared against TimeProvider.GetUtcNow().UtcDateTime (:274-275). A missing Live button is deliberately not worth a toast. [Rubric section 29, Resilience & Business Continuity].
  • ToggleListenAsync (:285-308): text to speech over the description, where the same button stops playback; SpeakAsync completes when playback finishes or StopAsync cancels it, and the finally clears _isSpeaking either way. [Rubric section 21, Accessibility] (assesses alternative modalities for content) and ADR-042 Wave 3.
  • Navigation (:278, :280) returns to the schedule or opens the session feedback form; disposal is the standard cancel-on-disposal pattern over the CancellationTokenSource this page still owns directly (:44; it has not been moved onto DetailPageBase the way SponsorDetail has), now also disposing the LatestLoadGuard (:323).
• Why it's built this way: this is the page an attendee opens in a hallway, so the expensive lookups are done once per id, the optional Live capability fails soft, and the bookmark toggle is a self-contained component so the page's own load path no longer has to carry a user's authentication state just to draw one star.
• Where it's used: the /conference/sessions/{Id} route, reached from PublicSessionListView rows and cards and from PublicSpeakerDetail; its markup renders SessionBookmarkButton for the star and a QrCodeButton for its own public link.

PublicSessionEventCatalog

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Sessions · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Sessions/PublicSessionEventCatalog.cs:17 · Level 10 · class (internal sealed)

• What it is: the page-state holder for everything PublicSessionList knows about events, rooms and speakers: the loaded events with their rooms, the Room picker options, a room-name index, the speaker lookup, and the event and room filter selection (PublicSessionEventCatalog.cs:22-43). It was extracted out of the page, which now holds one instance as _catalog (PublicSessionList.razor.cs:47).
• Depends on: IEventUIService and ISpeakerLookupService as LoadAsync arguments (:54-59), a BCL TimeProvider (:57), the cascaded Task<AuthenticationState> (:58), PublicReadAudience (:60), PublicScheduleRoomOptions (:75, :127), CurrentEventDefaults (:142), SpeakerInfo (:34), and EventDTO / RoomDTO.
• Concept introduced, state plus its rules in a plain class. The catalog takes its collaborators as method arguments rather than injecting them, so the page keeps ownership of the [Inject] surface and the catalog stays a plain object whose rules (who is privileged, which event is the default, what a failed fetch means) sit beside the data they govern. [Rubric §18, UI Architecture & Component Design] (assesses decomposition of a page into focused units).
• Walkthrough
  • LoadAsync (:54-83) resolves privilege through PublicReadAudience (:60), fetches events with children using CancellationToken.None (:63), and on success indexes every event's rooms into RoomNames and loads the speaker lookup (:71-78). A failed events fetch is remembered in _eventsLoadFailed (:69) and deliberately skips the speaker lookup, because it only labels sessions of the events that failed to load (comment :66-68). It then resolves the default event filter and rescopes the Room picker (:80-81) and returns which reads failed as (EventsFailed, SpeakersFailed) (:82) so the page can toast.
  • ScopeUnresolvedForPublicReader (:92) is !IsPrivileged && !SelectedEventId.HasValue && _eventsLoadFailed: true only for a non-privileged reader with no selected event because the fetch failed. A successful fetch that finds no current or next event stays unscoped, and the doc (:85-91) records that the view also renders its load-failed state with Retry while this holds, because a pre-rendered empty grid could otherwise read as "No sessions found.". [Rubric §29, Resilience & Business Continuity].
  • SelectEvent (:96-100) switches the event filter and rescopes the Room picker in one call.
  • ApplyFilters (:105-123) adds Title contains, EventId equals and RoomId equals to the query's filter dictionary. The comment on the room branch (:117-118) notes that Session.RoomId is a real nullable column, so it rides the generic filter pipeline like EventId.
  • ResolveDefaultEventFilter (:129-144): a privileged reader keeps a restored id only if it still exists in the loaded events (:135-140); everyone else is always locked to CurrentEventDefaults.SelectCurrentOrNext evaluated against timeProvider.GetUtcNow().UtcDateTime (:142), so a shared privileged URL can never pin an attendee to a different or unpublished event (comment :131-134). [Rubric §11, Security].
• Why it's built this way: the audience rule and the fail-closed rule are the page's security-relevant logic, and a plain class can hold them where the page's unit tests reach them without rendering a grid.
• Where it's used: held as _catalog by PublicSessionList (PublicSessionList.razor.cs:47), which loads it in LoadEventsAndResolveDefaultAsync (:150), saves and restores its selection through PublicSessionListFilterState (:71-84), and applies its filters to every fetch (:314-315).

PublicSessionList

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Public.Sessions · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Public/Sessions/PublicSessionList.razor.cs:24 · Level 11 · class (Blazor code-behind)

• What it is: the public conference schedule and the most heavily wired page in this unit. It is the container half of a three-part page (this class, PublicSessionListFilterBar, PublicSessionListView), and it now delegates its state to four small helpers: PublicSessionEventCatalog for events, rooms, speakers and the event and room filters, PublicSessionBookmarkState for who the reader is and what they starred, PublicSessionEventScope for the in-flight events lookup, and NewestLoadTracker<T> for racing grid loads. The page itself keeps the search string, the My Schedule flag and the server-paged fetch (class doc, PublicSessionList.razor.cs:15-23).
• Depends on: extends DataGridListPageBase<TDto> closed over SessionDTO (:24); IPublicSessionScheduleService (:28) with its SessionSchedulePageRequest (:249), IEventUIService and ISpeakerLookupService (:29-30), an injected BCL TimeProvider (:32), NavigationManager for the sign-in redirect (:33, :143), the optional ISessionBookmarkUIService (:37); the four helpers above (:43-50); PublicSessionListFilterState (:72, :80), ConferenceRoutePaths (:143), and Result (:232). Event, room and speaker types (EventDTO, RoomDTO, SpeakerInfo), PublicReadAudience, PublicScheduleRoomOptions and CurrentEventDefaults are now used inside PublicSessionEventCatalog, and ClaimsPrincipalExtensions's GetUserId inside PublicSessionBookmarkState.
• Concept introduced, the container page with racing loads, a dual-branch fetch, and a fail-closed scope. Everything the sibling list pages do once, this page does twice and then adds a mode switch.
  1. Two startup tasks, both awaited by the fetch path. OnInitializedAsync (:96-137) creates _bookmarks and starts its load (:121-122), then starts the events load through _eventScope.Start(...) (:128), both before the first await that matters. The comments (:115-120, :124-127) name the failure each guards: the MudDataGrid's first ServerData call can run ahead of initialization, notably on in-app back-navigation where there is no SSR prerender to supply grid data, and a half-initialized (not yet authenticated) state would make the My Schedule branch silently fall through to fetching all sessions. LoadScopedPageAsync (:215-226) awaits EnsureEventScopeAsync (:219) before entering the base's LoadServerDataAsync (:221), because ApplyAdditionalFilters runs inside it, and FetchSessionsAsync (:232-270) awaits the bookmark load through _bookmarks.EnsureAsync (:245). [Rubric §19, State Management & Data Flow].
  2. Racing grid loads resolve to the newest. LoadServerData (:211-212) wraps each load in _gridLoads.Track(LoadScopedPageAsync(state)). NewestLoadTracker<T> records the load as the newest before anything yields, so a load superseded while it waited on the event scope answers with the newest load's result instead of painting its own empty page (doc :208-210, tag U-35). [Rubric §19, State Management & Data Flow].
  3. Two fetch branches, both truly server-paged. In My Schedule mode with bookmarks present, the page passes the bookmarked ids as MyScheduleSessionIds on the SessionSchedulePageRequest (:255) and the service turns them into a server-side Id IN (...) filter so the server still pages (MMCA.ADC.Conference.UI/Services/Public/IPublicSessionScheduleService.cs:14-19). The request is built once (:249-255), so the offline fallback judges exactly the request a live fetch would send (comment :247-248, tag M208). An empty bookmark set short-circuits to ([], 0) (:264-267) rather than issuing a query that would return the whole catalog, and returns before the offline snapshot is written so an empty schedule never overwrites the cached programme (comment :262-263). [Rubric §12, Performance & Scalability].
  4. Audience-scoped filter persistence. Only privileged readers persist an event choice, expressed as persistEventId: _catalog.IsPrivileged && _catalog.EventFilterResolved in the call to PublicSessionListFilterState.Save (:71-74). The default-event rule itself (everyone else locked to the current or next event) lives in PublicSessionEventCatalog.ResolveDefaultEventFilter. [Rubric §11, Security] and [Rubric §26, Front-End Security].
  5. Fail closed, with a retry that heals. When the public scope is unresolved, or the bookmark read failed in My Schedule mode, FetchSessionsAsync routes to AnswerUnqueryablePageAsync (:257-260, :275-293). Offline, the cached programme answers first because a dead venue network fails both reads alike (doc :272-274, tag A-09; :280). Otherwise a bookmark failure is returned as a failed Result carrying the same errors (:285-288), and an unresolved scope throws an InvalidOperationException rather than issue an unscoped session query (:292); the comment (:290-291) records that the base turns the exception into the failed grid state with a retry, which re-resolves the scope first. EnsureEventScopeAsync (:178-179) delegates to PublicSessionEventScope.EnsureAsync, which re-issues a failed events lookup at most once and lets overlapping loads share that one re-issue. EventsLookupPending (:163) and ShowLoadFailed (:169) hold the load-failed state back while a lookup is still in flight (doc :165-168, tag U-35), and ScopeFailureShown (:172) does not count an unresolved scope as a failure when the offline snapshot is on screen. [Rubric §29, Resilience & Business Continuity] and [Rubric §11, Security].
  6. A deep link that beats saved state, unless the reader is signed out. [SupplyParameterFromQuery(Name = "mine")] (:64-65) carries the MAUI head's home-screen quick action into the My Schedule view, and OnInitializedAsync applies it after the base has restored saved page state so intent wins (:101-103). When the reader is not authenticated, the interactive pass redirects to sign in instead of showing the full programme under a "My Schedule" title (:105-112, tag A-23): RedirectToLogin (:140-144) sets _redirectingToLogin and navigates to /login with a returnUrl back to ?mine=true, and FetchSessionsAsync returns an empty page while that flag is set (:240-243). [Rubric §25, Navigation & Information Architecture] and ADR-042 Wave 2.
  7. A restored My Schedule is not an intent (L155). ClearMyScheduleForAnonymousReader (:88-94) drops _showMyScheduleOnly once the reader is known to be anonymous (_readerKnownAnonymous, :54, set at :135). It runs after the initial load (:136) and again at the end of RestoreFilters (:78-84, remark :77), because the base page's later sessionStorage restore can re-apply a stale flag. [Rubric §25, Navigation & Information Architecture].
  8. The offline snapshot lives in the service, not the page. The section comment (:295-297) states the division: IPublicSessionScheduleService keeps the last successful first page of the programme so a dead venue network still shows a schedule, and only the banner stays here. The page passes OnCacheStateChanged into the fetch (:269) and that handler flips ShowingCachedData (:307), calling StateHasChanged() only on the raise, because the clear rides the render the grid does for the fresh rows anyway (:305-312). The chip itself is markup (PublicSessionList.razor:23-29). [Rubric §29, Resilience & Business Continuity] and ADR-042 Wave 3.
• Walkthrough
  • SaveFilters / RestoreFilters (:71-84) delegate to PublicSessionListFilterState, reading and writing the catalog's SelectedEventId, EventFilterResolved and SelectedRoomId rather than page fields.
  • LoadEventsAndResolveDefaultAsync (:148-159): one call to _catalog.LoadAsync (:150), then a single toast for whichever read failed, the events error taking precedence over the speakers error (:151-158). One children-loaded events fetch plus one speaker lookup replace per-row enrichment calls. [Rubric §23, Front-End Performance & Rendering].
  • Filter handlers (:182-204) each update one value (the search string, the catalog's selection, or the My Schedule flag) and call ReloadViewAsync (:206), which forwards to the view child's ReloadAsync() and no-ops when the child is not yet rendered.
  • ApplyAdditionalFilters (:314-315) forwards to _catalog.ApplyFilters(filters, _searchString); the Title, EventId and RoomId filters are described under PublicSessionEventCatalog. The room branch is worth reading against PublicSpeakerList: Session.RoomId is a real nullable column, so it rides the generic filter pipeline with no virtual-key interception in the controller, unlike the speaker page's EventId.
  • FetchMobilePage (:318-327) awaits the same EnsureEventScopeAsync (:320), builds the same filters, and reuses FetchSessionsAsync, passing an explicit title-ascending sort (:326) so the infinite-scroll list matches the desktop grid's initial sort; the API's own default is start time. Both layouts share one fetch implementation including its offline path and its fail-closed guard.
  • The optional Engagement service is resolved with GetService (:98) for the same reason as on PublicSessionDetail: [Inject] has no optional mode (:35-36).
• Why it's built this way: this is the highest-traffic page of the conference, viewed on bad networks by both anonymous browsers and signed-in attendees managing a personal schedule. That drives every design decision visible here: server-side everything, one enrichment fetch, ordering guarantees around the grid's eager first call, newest-load-wins when loads overlap, an audience-locked event filter that refuses to run unscoped when its scope could not be loaded, a room filter derived from data already in hand, and a cached last-known-good first page owned by the service rather than the page.
• Where it's used: the /conference/sessions route (PublicSessionList.razor:1, matching ConferenceRoutePaths.PublicSessions at MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/ConferenceRoutePaths.cs:47), including the ?mine=true deep link; it renders PublicSessionListFilterBar (PublicSessionList.razor:11-21) and PublicSessionListView (:31) and routes onward to PublicSessionDetail.

ScorePollSignal

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Sessions.Selection · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Sessions/Selection/ScorePollTracker.cs:8 · Level 0 · enum (internal)

• What it is: the five-valued verdict that ScorePollTracker returns for one observation of the AI-scoring poll loop. It says what should happen next: keep waiting, re-render with fresh data, or stop and report an outcome.
• Depends on: nothing. It is a bare internal enum declared above the tracker in the same file (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Sessions/Selection/ScorePollTracker.cs:8), visible to the bUnit test project through the project's InternalsVisibleTo (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/MMCA.ADC.Conference.UI.csproj:9).
• Concept introduced: the decision/effect split. [Rubric §18, UI Architecture] assesses whether components stay thin and free of tangled control flow; naming each outcome as an enum member is how that is achieved here. The decision (what did this poll mean?) is computed by a pure state machine, ScorePollTracker, and the effects (toast, re-render, stop the loop) are applied in a single switch inside ScorePollSession, so neither half has to know the other's internals. [Rubric §14, Testability] follows for free: the signal sequence for a synthetic count series can be asserted without rendering anything.
• Walkthrough: Continue (ScorePollTracker.cs:11) means nothing changed this tick, keep polling. Progressed (:12) means new scores arrived, so apply the fresh board, re-render, and keep polling. CompletedAll (:15) means every session now has a score, so apply and finish successfully. CompletedStable (:19) means the count has been unchanged long enough to call scoring done, with the success-versus-partial wording decided from coverage. GaveUpNoScores (:22) means no score was ever produced inside the zero-progress budget, so fail loudly rather than wait out the full cap.
• Why it's built this way: the poll loop has four terminal outcomes that each need a different user-facing message (complete, partial, timed out, never started). An enum makes the exhaustive switch in ScorePollSession readable and keeps that failure vocabulary in one place.
• Where it's used: returned by ScorePollTracker.RegisterFetch (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Sessions/Selection/ScorePollTracker.cs:96) and consumed by ScorePollSession.HandleSignalAsync (MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Sessions/Selection/ScorePollSession.cs:138-168).

SessionSelectionDisplay

MMCA.ADC.Conference.UI · MMCA.ADC.Conference.UI.Pages.Sessions.Selection · MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Sessions/Selection/SessionSelectionDisplay.cs:13 · Level 1 · class (static, internal)

• What it is: a stateless helper holding the display and filter-matching rules shared by the session-selection dashboard and its two presentational sub-components. It answers four kinds of question with no side effects: what color a score chip should be, whether a locality tier counts as local or is the "Unknown" sentinel, and whether a session passes the active score-tier or status filter. Status chip colors now come from SessionStatusDisplay.
• Depends on: the MudBlazor Color enum (external NuGet, imported at SessionSelectionDisplay.cs:2) and SessionStatuses for the eligibility rule. No other first-party types: it is deliberately dependency-light so both SessionSelectionSpeakerOverlap and SessionSelectionAiScores can call the same predicates, and so can the page markup itself.
• Concept introduced: extracting view logic into testable pure functions. [Rubric §18, UI Architecture] rewards keeping decision logic out of .razor markup so it can be unit-tested and reused; [Rubric §14, Testability] is the same point from the other side. Every method here is static and total (each switch has a default arm), so the same input always yields the same color or boolean regardless of component state.
• Walkthrough: UnknownLocalityTier (SessionSelectionDisplay.cs:19, the literal "Unknown") is the tier name the dashboard handler reports for a speaker with no resolvable locality; it is a sentinel rather than data, so IsUnknownTier (:21-22, an ordinal equality test) lets the page swap in the localized Chip.Unknown label instead of showing the raw string. IsLocalTier (:24-27) folds three locality substrings (Atlanta, Georgia, Surrounding, all matched with StringComparison.OrdinalIgnoreCase) into one "is this speaker local" test. GetScoreColor (:29-35) buckets a decimal score into four bands (at or above 8.0 success, 6.0 info, 4.0 warning, otherwise error). ScoreMatchesFilter (:37-48) turns a filter token ("9.0" down to "3.0", plus "<3.0") into a threshold predicate, with an unrecognized token matching everything; <3.0 is the only strict-less-than case. MatchesAcceptedFilter (:50-51) now compares against SessionStatuses.Accepted instead of a literal, and SessionMatchesStatus (:53-56) delegates the null-status case to SessionStatuses.IsEligible rather than inlining the null-or-Accepted check; every other filter is still a plain case-insensitive equality test.
• Why it's built this way: the two sibling sections filter over different DTO shapes but must agree on what "score tier 8.0" or "status Accepted" means; hoisting the rules here guarantees they never drift apart. Routing the status literal and the eligibility rule through SessionStatuses keeps this file and SessionSelectionFilterOptions from drifting on what "Accepted" means. The tier tokens it understands are exactly the values SessionSelectionFilters.ScoreTierOptions offers in the picker.
• Where it's used: by SessionSelectionSpeakerOverlap (SessionMatchesStatus and ScoreMatchesFilter, MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.UI/Pages/Sessions/Selection/SessionSelectionSpeakerOverlap.razor.cs:62 and :69), by SessionSelectionAiScores (MatchesAcceptedFilter and ScoreMatchesFilter, .../SessionSelectionAiScores.razor.cs:48 and :63), and directly from markup for chip coloring: .../SessionSelectionAiScores.razor:72 and :76, .../SessionSelectionSpeakerOverlap.razor:45, :61, :65, and the locality tiles on the page itself (.../SessionSelectionDashboard.razor:194).