[AZ-309] Refactor 02-coupling-refactoring Phase 0-2 artifacts

- Baseline metrics, list of changes, and analysis (research findings,
  refactoring roadmap) for the coupling refactor run
- Six task specs AZ-310..AZ-315 covering endpoint routing through
  ITileService, Services csproj split, consumer rewire, DI extension
  methods, and docs sync
- Existing test coverage assessment for Phase 3 safety net gate
- Dependencies table updated with the refactor block

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/04_refactoring/02-coupling-refactoring/analysis/refactoring_roadmap.md

@@ -0,0 +1,63 @@
+# Phase 2b — Refactoring Roadmap
+
+**Run**: 02-coupling-refactoring
+**Date**: 2026-05-10
+
+## Solution Assessment
+
+Acceptance criteria (`_docs/00_problem/acceptance_criteria.md`) all map to public HTTP behavior. None of the proposed changes alter that behavior — they redistribute internal ownership. The smoke + unit suite remains the gate.
+
+## Gap Analysis
+
+| Acceptance Criterion (paraphrased) | Current State | Post-Refactor State | Verification |
+|------------------------------------|---------------|---------------------|--------------|
+| AC: download single tile by lat/lon/zoom returns image metadata | Endpoint inlines logic (Program.cs:206) | Endpoint delegates to `ITileService.DownloadAndStoreSingleTileAsync` | Smoke `RunGetTileByLatLonTest` |
+| AC: serve tile by z/x/y returns image bytes | Endpoint inlines logic + cache (Program.cs:141) | Endpoint delegates to `ITileService.GetOrDownloadTileAsync` | Manual smoke (no integration test exists for `/tiles/{z}/{x}/{y}` — note as a follow-up coverage gap) |
+| AC: region processing pipeline | RegionService in `Services` csproj | RegionService in `Services.RegionProcessing` csproj | Smoke `RunRegionProcessingTest_200m_Zoom18` + unit RegionServiceTests |
+| AC: route management pipeline | RouteService in `Services` csproj | RouteService in `Services.RouteManagement` csproj | Smoke `RunRouteWithTilesZipTest` + unit RouteServiceTests |
+| AC: zoom validation rejects invalid zoom | GoogleMapsDownloaderV2 in `Services` csproj | Same class in `Services.TileDownloader` csproj | Unit GoogleMapsDownloaderZoomValidationTests |
+
+**Coverage gap noted but out of scope**: there is no integration test exercising the `/tiles/{z}/{x}/{y}` endpoint specifically. The unit-level cache logic in C01 will be tested via new TileService unit tests; integration coverage can be added in a future cycle.
+
+## Phased Roadmap
+
+### Phase A — Endpoint routing (low risk, sequential)
+
+1. **AZ-NEW-1 (refactor C01)** — `ITileService.GetOrDownloadTileAsync(z,x,y)` + ServeTile handler thinning.
+2. **AZ-NEW-2 (refactor C02)** — `ITileService.DownloadAndStoreSingleTileAsync(lat,lon,zoom)` + GetTileByLatLon handler thinning.
+
+After Phase A, F3 from the architecture baseline is resolved. Smoke + unit suite stays green.
+
+### Phase B — Project split (medium risk, sequential due to compiler dependency chain)
+
+3. **AZ-NEW-3 (refactor C03)** — Create `Services.TileDownloader`, `Services.RegionProcessing`, `Services.RouteManagement` csprojs and move the seven files.
+4. **AZ-NEW-4 (refactor C04)** — Update `SatelliteProvider.Tests` and `SatelliteProvider.IntegrationTests` to reference the new csprojs.
+5. **AZ-NEW-5 (refactor C05)** — Update `SatelliteProvider.Api` csproj, `Program.cs` namespaces, and `Dockerfile` COPY paths.
+
+After Phase B, F4 from the architecture baseline is resolved. The solution builds, smoke + unit suite stays green, the API container still runs.
+
+### Phase C — Documentation (low risk, last)
+
+6. **AZ-NEW-6 (refactor C06)** — Update `module-layout.md`, `architecture.md`, refresh `architecture_compliance_baseline.md` (mark F3, F4 Resolved; correct F5).
+
+After Phase C, doc-code parity is restored.
+
+## Hardening Tracks
+
+User Phase 0 + Phase 1 approvals already excluded hardening. The only optional track that would fit is:
+
+- **Track A — Tech Debt**: pre-existing FluentAssertions community-license warning would belong here, but it's a licensing decision (legal cost vs. switching to `Shouldly` or `xunit.assert`), not a code-structure decision. Surfacing as a follow-up backlog item rather than including in this run.
+
+No hardening tracks added to this run. Pure structural refactor.
+
+## Applicability Gate
+
+Every roadmap item carries `Selected` status from `research_findings.md`. No `Rejected`, `Experimental only`, or `Needs user decision` entries remain. Gate: **passed**.
+
+## Self-Verification
+
+- [x] All ACs mapped to current vs post-refactor state.
+- [x] Phased order respects compiler dependencies (endpoint refactor before split).
+- [x] Each item has a verification path (smoke or unit suite).
+- [x] No item violates the Project Constraint Matrix.
+- [x] Hardening track decision recorded.

_docs/04_refactoring/02-coupling-refactoring/analysis/research_findings.md

@@ -0,0 +1,74 @@
+# Phase 2a — Research Findings
+
+**Run**: 02-coupling-refactoring
+**Date**: 2026-05-10
+
+## Project Constraint Matrix (extracted)
+
+From `_docs/00_problem/problem.md`, `_docs/00_problem/restrictions.md`, `_docs/00_problem/acceptance_criteria.md`, `_docs/02_document/architecture.md`:
+
+| Constraint | Source | Implication for this refactor |
+|------------|--------|--------------------------------|
+| .NET 8.0 / ASP.NET Core minimal API | `restrictions.md`, `architecture.md` | New code stays on .NET 8 + minimal API. No framework swap. |
+| PostgreSQL via Dapper | `restrictions.md` | DataAccess layer unchanged. |
+| Public HTTP API surface stable | `acceptance_criteria.md` (AC-1..AC-3) | Routes, query/body shapes, response shapes preserved exactly. |
+| No DB schema rename | project `coderule.mdc` | Migrations not touched. |
+| Source under `src/` only for new projects; existing layout retained | project `coderule.mdc` | New `Services.*` csprojs sit at the repo root next to existing `SatelliteProvider.*` csprojs (existing layout). |
+| Dockerized deploy via `docker-compose.yml` | `architecture.md`, `AGENTS.md` | API + IntegrationTests Dockerfiles must be updated when csproj layout changes. |
+| Test environment runs in Docker | `_docs/02_document/tests/environment.md` | Smoke + unit suite must pass under the existing Docker test runner. |
+
+## Current State Analysis
+
+| Aspect | Pattern in code | Strength | Weakness |
+|--------|-----------------|----------|----------|
+| API layer | ASP.NET minimal API (`MapGet`, `MapPost` in `Program.cs`) | Compact, easy to read | Two endpoints (`ServeTile`, `GetTileByLatLon`) bypass the service layer (baseline F3) |
+| Service layer | Single csproj `SatelliteProvider.Services` containing 7 files | Simple to navigate | No compiler-enforced boundary between TileDownloader / RegionProcessing / RouteManagement (baseline F4) |
+| Data access | Dapper repositories injected via interfaces | Clean separation | None |
+| DI | Built-in `Microsoft.Extensions.DependencyInjection` | Standard, no surprises | None |
+| Testing | xUnit + Moq + FluentAssertions (community license warning, pre-existing) | Standard, expressive | FluentAssertions licensing is a pre-existing concern, out of scope |
+
+## Alternative Approaches Considered
+
+This refactor is structural-only. No new library/SDK/framework is being added or replaced. The mandatory **API Capability Verification** flow does not apply because no replacement candidates exist — the proposed changes reuse existing patterns:
+
+- ASP.NET Core minimal API → kept.
+- `IMemoryCache` from `Microsoft.Extensions.Caching.Memory` → kept (moves into TileService instead of being injected into the endpoint handler).
+- xUnit / Moq / FluentAssertions → kept.
+- DbUp / Dapper → not touched.
+
+`context7` lookup is therefore not required for this refactor (no replacement candidates to verify).
+
+### Alternatives explicitly considered and rejected (already in `list-of-changes.md`)
+
+| Alternative | Status | Reason |
+|-------------|--------|--------|
+| Adopt MediatR / CQRS layering | Rejected | Heavy dependency for a small codebase; conflicts with the "simplest solution" coderule; not required by any AC. |
+| Move `ISatelliteDownloader` into the new TileDownloader csproj | Rejected | Forces RegionService/RegionProcessingService to depend on TileDownloader, defeating the boundary the split is supposed to create. |
+| Inline `IMemoryCache` into the public `ITileService` interface | Rejected | Leaks an implementation choice (memory vs. distributed cache) into the public abstraction. |
+
+## Constraint-Fit Table
+
+| Recommendation | Pinned Mode | Constraints Checked | Evidence | Mismatches | Status |
+|----------------|-------------|---------------------|----------|------------|--------|
+| C01 — `ITileService.GetOrDownloadTileAsync(z,x,y)` | New interface method on existing service | HTTP route preserved; ETag/Cache-Control preserved | Smoke `RunGetTileByLatLonTest` will exercise post-refactor; existing TileServiceTests already cover the cache+download logic at unit level | None | Selected |
+| C02 — `ITileService.DownloadAndStoreSingleTileAsync(lat,lon,zoom)` | New interface method on existing service | Query string + DownloadTileResponse shape preserved; zoom validation chain unchanged | Smoke + unit | None | Selected |
+| C03 — Split Services into 3 csprojs | New `.csproj` files, code MOVE only | No code logic change; namespaces change | Compiler verifies; smoke verifies behavior | None | Selected |
+| C04 — Update test projects | Move `using` + `ProjectReference` only | No test logic change | `dotnet test` post-refactor | None | Selected |
+| C05 — Update API project + Dockerfiles | Move `using` + `ProjectReference` + Dockerfile COPY paths | API container builds and runs | `docker compose build` + smoke | None | Selected |
+| C06 — Update docs | Documentation only | None | Manual review against new csproj layout | None | Selected |
+
+All six recommendations are `Selected`. None require user decision beyond the Phase 0 / Phase 1 scope approval already obtained.
+
+## Quick Wins vs Strategic Improvements
+
+- **Quick wins** (low risk, immediate value): C01, C02, C04, C06.
+- **Strategic** (medium risk, foundation for future work): C03, C05.
+
+## Self-Verification
+
+- [x] Project Constraint Matrix extracted.
+- [x] Current state vs. alternatives analyzed.
+- [x] All recommendations grounded in actual code (file paths, method names verified).
+- [x] No replacement libraries → API capability verification is N/A and explicitly noted.
+- [x] Rejected alternatives documented.
+- [x] No recommendation violates the Project Constraint Matrix.

_docs/04_refactoring/02-coupling-refactoring/baseline_metrics.md

@@ -0,0 +1,100 @@
+# Phase 0 — Baseline Metrics (02-coupling-refactoring)
+
+**Date**: 2026-05-10
+**Mode**: Automatic (user-confirmed scope)
+**Goal**: Resolve remaining Medium architecture findings from `architecture_compliance_baseline.md`:
+1. Route the two API endpoints `ServeTile` and `GetTileByLatLon` through `ITileService` (baseline F3).
+2. Split `SatelliteProvider.Services` into per-component csprojs to add a compiler-enforced module boundary (baseline F4).
+
+## Scope and Constraints
+
+- Behavior must be preserved across all changed paths (smoke + unit suite must stay green).
+- No database schema changes.
+- No public HTTP route changes — the same endpoints must accept the same request shapes and return the same response shapes.
+- C# namespaces will change for the moved classes. Tests and `Program.cs` will need their `using` statements updated.
+
+## Current Code Topology
+
+| Project | LOC (.cs, excl. Migrations/bin/obj) | Files |
+|---------|-------------------------------------|-------|
+| SatelliteProvider.Api | 465 | 1 (Program.cs) |
+| SatelliteProvider.Common | 462 | DTOs, interfaces, configs, GeoUtils |
+| SatelliteProvider.DataAccess | 614 | Repositories, Models, Migrations |
+| SatelliteProvider.Services | 2130 | TileService, GoogleMapsDownloaderV2, RegionService + Processing + Queue, RouteService + Processing |
+| SatelliteProvider.Tests | 1070 | xUnit unit tests (35 tests, all passing) |
+| SatelliteProvider.IntegrationTests | 1434 | Console runner, 11 integration scenarios |
+
+`SatelliteProvider.Services` files (proposed split):
+
+| File | Logical Component | Proposed Project |
+|------|-------------------|------------------|
+| TileService.cs | TileDownloader | SatelliteProvider.Services.TileDownloader |
+| GoogleMapsDownloaderV2.cs | TileDownloader | SatelliteProvider.Services.TileDownloader |
+| RegionService.cs | RegionProcessing | SatelliteProvider.Services.RegionProcessing |
+| RegionProcessingService.cs | RegionProcessing | SatelliteProvider.Services.RegionProcessing |
+| RegionRequestQueue.cs | RegionProcessing | SatelliteProvider.Services.RegionProcessing |
+| RouteService.cs | RouteManagement | SatelliteProvider.Services.RouteManagement |
+| RouteProcessingService.cs | RouteManagement | SatelliteProvider.Services.RouteManagement |
+
+## Test Coverage Baseline
+
+| Suite | Count | Status | Source |
+|-------|-------|--------|--------|
+| Unit tests | 35 | All passing | Step 7 run, 2026-05-10 |
+| Integration smoke | 5 scenarios | All passing in 111.86 s | Step 7 run, 2026-05-10 |
+| Integration full | 11 scenarios | Last verified before refactor | full mode preserved behind `--full` flag |
+
+Coverage measurement tooling (Coverlet) is not yet wired into the project. For this refactor, the existing pass rate of unit + smoke is the safety net; we'll re-run both at the end of every phase.
+
+## Code Smell Baseline
+
+From `architecture_compliance_baseline.md`:
+
+| ID | Severity | Status | Action in this run |
+|----|----------|--------|--------------------|
+| F1 | High | Resolved (testability refactor) | None |
+| F2 | High | Resolved (testability refactor) | None |
+| F3 | Medium | Open | **Address in this run** |
+| F4 | Medium | Open | **Address in this run** |
+| F5 | Low | Open | Will be auto-corrected by F4 (module-layout doc rewrite) |
+
+No new architecture findings were added by Step 6 (Implement Tests) or Step 7 (Run Tests).
+
+## Performance Baseline
+
+| Metric | Value | Source |
+|--------|-------|--------|
+| Smoke wall-clock | 111.86 s | Step 7 run |
+| Unit suite wall-clock | ~1.2 s | Docker `dotnet test` |
+| Build time (cold restore + build, all projects) | ~30 s | Docker `dotnet build` |
+
+Targets after refactor: no measurable regression in smoke or unit time. Build time may increase slightly (more csproj boundaries → more restore steps) but should stay <60 s cold.
+
+## Dependencies
+
+No new package dependencies are required for either change. The split moves existing code into new csproj files.
+
+## Functionality Inventory
+
+| Endpoint | Current Coupling Issue | Behavior Preserved? |
+|----------|------------------------|---------------------|
+| GET `/tiles/{z}/{x}/{y}` (`ServeTile`) | injects `ISatelliteDownloader` + `ITileRepository` + `IMemoryCache` | Yes — moves logic into TileService |
+| GET `/api/satellite/tiles/latlon` (`GetTileByLatLon`) | injects `ISatelliteDownloader` + `ITileRepository` | Yes — moves logic into TileService |
+| All other endpoints | Already route through services | Unchanged |
+
+## Self-Verification
+
+- [x] RUN_DIR created (`_docs/04_refactoring/02-coupling-refactoring/`).
+- [x] Metrics measured for the categories that apply (coverage proxy via test count, code smells from baseline doc, performance from Step 7 run, build time from prior runs, deps from csproj files).
+- [x] Functionality inventory complete for the in-scope endpoints.
+- [x] Measurements reproducible: every count above can be recomputed by running `find ... | wc -l`, `dotnet test`, or reading the linked baseline doc.
+
+## Goals (success criteria)
+
+1. After the refactor, `Program.cs` has zero direct injections of `ISatelliteDownloader`, `ITileRepository`, or `IMemoryCache` for tile endpoints — they all flow through `ITileService`.
+2. The seven Services files are physically split into three csprojs (`Services.TileDownloader`, `Services.RegionProcessing`, `Services.RouteManagement`) with explicit `ProjectReference` boundaries.
+3. `SatelliteProvider.Services.csproj` is deleted (or renamed to a meta-package; deletion preferred).
+4. Unit suite: 35/35 still passing.
+5. Integration smoke suite: still passing in <120 s.
+6. `architecture_compliance_baseline.md` (or a refreshed copy) shows F3 and F4 as **Resolved**.
+7. `module-layout.md` is updated to reflect the new project layout (resolves F5 incidentally).

_docs/04_refactoring/02-coupling-refactoring/list-of-changes.md

@@ -0,0 +1,116 @@
+# List of Changes
+
+**Run**: 02-coupling-refactoring
+**Mode**: automatic (Targeted — `_docs/02_document/` already documents the codebase)
+**Source**: self-discovered (driven by `_docs/02_document/architecture_compliance_baseline.md` findings F3 and F4)
+**Date**: 2026-05-10
+
+## Summary
+
+Resolves the two remaining Medium architecture findings from the baseline scan: route the tile-serving and tile-download endpoints through `ITileService`, and split `SatelliteProvider.Services` into three per-component csprojs to add a compiler-enforced module boundary.
+
+## Discovery shortcut (Targeted-mode skip)
+
+Phase 1 sub-steps 1a, 1b, 1c are **skipped** because:
+- Component documentation already exists at `_docs/02_document/components/01_common/` … `05_route_management/` (5 components fully documented).
+- Solution synthesis already exists at `_docs/01_solution/solution.md`.
+- System flows already exist at `_docs/02_document/system-flows.md`.
+- Architecture vision and module-layout already exist at `_docs/02_document/architecture.md` and `_docs/02_document/module-layout.md`.
+
+Logical-flow analysis was performed implicitly in Step 7's smoke run (real flows traced end-to-end through the actual endpoints, all passed). No silent data loss, loop scoping bugs, fixed-vs-dynamic batch issues, or design contradictions were observed — these aren't the failure modes this codebase exhibits.
+
+## Changes
+
+### C01: Add `GetOrDownloadTileAsync(z, x, y)` to ITileService and route ServeTile through it
+
+- **File(s)**: `SatelliteProvider.Common/Interfaces/ITileService.cs`, `SatelliteProvider.Services/TileService.cs`, `SatelliteProvider.Api/Program.cs` (`ServeTile` handler), `SatelliteProvider.Tests/TileServiceTests.cs`
+- **Problem**: `ServeTile` (Program.cs:141) directly injects `ISatelliteDownloader`, `ITileRepository`, and `IMemoryCache`. It re-implements cache-or-download-or-fetch logic that overlaps with `TileService.DownloadAndStoreTilesAsync` but is not delegated to the service. This is the architecture baseline F3 finding.
+- **Change**: Add `Task<TileBytes> GetOrDownloadTileAsync(int z, int x, int y, CancellationToken ct = default)` to `ITileService`. The method returns a `TileBytes` record `(byte[] Bytes, string ContentType, string ETag, TimeSpan MaxAge)`. Implementation in `TileService` owns the in-memory cache (DI-injected `IMemoryCache`), repository lookup by tile coords, and downloader fallback. `ServeTile` becomes a thin handler: validates the route, calls `tileService.GetOrDownloadTileAsync`, sets headers, returns `Results.Bytes`.
+- **Rationale**: All tile retrieval flows go through one place. New consumers (e.g. a future batch tile pre-warm endpoint) reuse the same caching/dedup logic. Aligns with the architecture vision in `_docs/02_document/architecture.md`.
+- **Constraint Fit**: Public HTTP route `/tiles/{z}/{x}/{y}` and response shape (image/jpeg, ETag, Cache-Control) are preserved exactly. No DB schema change. Existing smoke test for tile serving still covers the path.
+- **Risk**: low — pure code movement plus one new interface method. Smoke + unit suite catch regressions.
+- **Dependencies**: None.
+
+### C02: Add `DownloadAndStoreSingleTileAsync(lat, lon, zoom)` to ITileService and route GetTileByLatLon through it
+
+- **File(s)**: `SatelliteProvider.Common/Interfaces/ITileService.cs`, `SatelliteProvider.Services/TileService.cs`, `SatelliteProvider.Api/Program.cs` (`GetTileByLatLon` handler), `SatelliteProvider.Tests/TileServiceTests.cs`
+- **Problem**: `GetTileByLatLon` (Program.cs:206) directly injects `ISatelliteDownloader` and `ITileRepository` and re-implements the download-then-insert flow. Same root cause as C01.
+- **Change**: Add `Task<TileMetadata> DownloadAndStoreSingleTileAsync(double latitude, double longitude, int zoomLevel, CancellationToken ct = default)` to `ITileService`. Implementation in `TileService` calls the existing `ISatelliteDownloader.DownloadSingleTileAsync` and inserts the resulting entity via `ITileRepository`. `GetTileByLatLon` becomes a thin handler that calls the new method and projects to `DownloadTileResponse`.
+- **Rationale**: Same as C01.
+- **Constraint Fit**: HTTP route `/api/satellite/tiles/latlon`, query parameters, and the `DownloadTileResponse` shape are preserved exactly. Zoom validation in `GoogleMapsDownloaderV2` keeps firing (via `ISatelliteDownloader.DownloadSingleTileAsync`).
+- **Risk**: low — strictly smaller than C01 since there's no cache layer involved.
+- **Dependencies**: C01 (so we add both interface methods in one PR scope but they're independently shippable).
+
+### C03: Create three new csprojs for the Services split — `Services.TileDownloader`, `Services.RegionProcessing`, `Services.RouteManagement`
+
+- **File(s)**:
+  - New: `SatelliteProvider.Services.TileDownloader/SatelliteProvider.Services.TileDownloader.csproj`
+  - New: `SatelliteProvider.Services.RegionProcessing/SatelliteProvider.Services.RegionProcessing.csproj`
+  - New: `SatelliteProvider.Services.RouteManagement/SatelliteProvider.Services.RouteManagement.csproj`
+  - Move from `SatelliteProvider.Services/`: `TileService.cs`, `GoogleMapsDownloaderV2.cs` → TileDownloader; `RegionService.cs`, `RegionProcessingService.cs`, `RegionRequestQueue.cs` → RegionProcessing; `RouteService.cs`, `RouteProcessingService.cs` → RouteManagement
+  - Delete: `SatelliteProvider.Services/SatelliteProvider.Services.csproj`
+- **Problem**: `SatelliteProvider.Services` packs three logical components into one csproj with no compiler-enforced boundary. This is architecture baseline F4. The module-layout doc already aspires to per-component boundaries.
+- **Change**: Create three new csprojs. Each references `SatelliteProvider.Common` and `SatelliteProvider.DataAccess` (where applicable). Move the seven files into the corresponding new project. Update namespaces to `SatelliteProvider.Services.TileDownloader`, `SatelliteProvider.Services.RegionProcessing`, `SatelliteProvider.Services.RouteManagement`.
+- **Rationale**: Compiler now rejects accidental cross-component coupling at build time, not at code-review time. Aligns the physical layout with `_docs/02_document/module-layout.md`.
+- **Constraint Fit**: Consumers (`SatelliteProvider.Api`, `SatelliteProvider.Tests`) update their `ProjectReference` and `using` lists. No public HTTP API change. No DB change. The `ISatelliteDownloader` and other interfaces stay in `SatelliteProvider.Common` (unchanged).
+- **Risk**: medium — touches every consumer's csproj and most of `Program.cs` namespaces. Mitigated by:
+  - Clear, mechanical rename rules.
+  - Both unit and smoke suites must pass after the move.
+  - Solution-level `dotnet build` catches every missed reference.
+- **Dependencies**: C02 (do the endpoint refactor first, while everything is still in one csproj — simpler to refactor before splitting).
+
+### C04: Update `SatelliteProvider.Tests` and `SatelliteProvider.IntegrationTests` to reference the new Services projects
+
+- **File(s)**: `SatelliteProvider.Tests/SatelliteProvider.Tests.csproj`, `SatelliteProvider.IntegrationTests/SatelliteProvider.IntegrationTests.csproj`, every `.cs` test file under those directories that imports a moved class
+- **Problem**: Once C03 lands, the `SatelliteProvider.Services` csproj no longer exists. Test projects currently reference it.
+- **Change**: Replace the single `<ProjectReference Include="..\SatelliteProvider.Services\SatelliteProvider.Services.csproj" />` with explicit references to the three new csprojs (whichever each test file actually needs — Tests likely needs all three; IntegrationTests likely needs none since it's HTTP-only). Update `using SatelliteProvider.Services;` → `using SatelliteProvider.Services.TileDownloader;` etc., one consumer at a time.
+- **Rationale**: Tests must compile after C03.
+- **Constraint Fit**: Test outcomes must remain identical (35/35 unit, 5/5 smoke).
+- **Risk**: low — purely mechanical, surfaced by the compiler.
+- **Dependencies**: C03.
+
+### C05: Update `SatelliteProvider.Api` to reference the new Services projects and update DI
+
+- **File(s)**: `SatelliteProvider.Api/SatelliteProvider.Api.csproj`, `SatelliteProvider.Api/Program.cs`, `SatelliteProvider.Api/Dockerfile` (if it explicitly COPYs `SatelliteProvider.Services/`)
+- **Problem**: Same as C04 — `SatelliteProvider.Services.csproj` is gone after C03.
+- **Change**: Add three `ProjectReference` entries. Update `using SatelliteProvider.Services;` to the three component namespaces. Update DI registrations: `AddSingleton<ISatelliteDownloader, GoogleMapsDownloaderV2>()` (unchanged FQN once `using` is fixed), same for `TileService`, `RegionService`, `RouteService`, `RegionRequestQueue`, `RegionProcessingService`, `RouteProcessingService`. Update `SatelliteProvider.Api/Dockerfile` to COPY the three new csproj directories instead of `SatelliteProvider.Services/`. Also update `SatelliteProvider.IntegrationTests/Dockerfile`.
+- **Rationale**: API project must compile and the API container must build.
+- **Constraint Fit**: HTTP API surface unchanged. Container behavior unchanged. Smoke must pass post-build.
+- **Risk**: medium — Dockerfile changes are easy to miss; the smoke run will catch them. Solution-level `dotnet build` plus a fresh `docker compose build` is the safety check.
+- **Dependencies**: C03.
+
+### C06: Update module-layout.md, architecture.md, and refresh architecture_compliance_baseline.md
+
+- **File(s)**: `_docs/02_document/module-layout.md`, `_docs/02_document/architecture.md`, `_docs/02_document/architecture_compliance_baseline.md`
+- **Problem**: After C01..C05 land, the docs say something different than the code. Pre-existing F5 finding (DataAccess listed as importing Common but actually doesn't) is also stale.
+- **Change**:
+  - In `module-layout.md`, replace the `SatelliteProvider.Services` row with three rows (TileDownloader / RegionProcessing / RouteManagement), update the `Imports from` and `Allowed Dependencies` columns.
+  - In `architecture.md`, update any layering diagram or text that still says "SatelliteProvider.Services".
+  - Refresh `architecture_compliance_baseline.md`: mark F3 and F4 as **Resolved**, fix F5 (remove the wrong "Imports from: Common" row for DataAccess).
+- **Rationale**: Doc-code parity. Keeps Phase 7 small and mechanical (it'll mostly be sanity-check).
+- **Constraint Fit**: Docs only — no code or test impact.
+- **Risk**: low.
+- **Dependencies**: C05.
+
+## Constraint-Rejected Alternatives (recorded per skill rule)
+
+- **MediatR/CQRS layering**: would solve coupling more thoroughly but adds a heavy dependency for a small codebase, conflicts with the "simplest solution" coderule, and isn't required by any acceptance criterion. **Rejected**.
+- **Move `ISatelliteDownloader` from Common into Services.TileDownloader**: structurally cleaner but breaks `RegionService` and `RegionProcessingService` consumers (they call the downloader directly). Would force every component to depend on TileDownloader's csproj — defeats the point of the split. **Rejected**.
+- **Inline `IMemoryCache` into `ITileService` interface**: leaks an implementation choice (memory vs. distributed cache) into the public abstraction. **Rejected**.
+
+## Self-Verification
+
+- [x] Every referenced file exists in the codebase (validated against `git ls-files` and the live tree).
+- [x] Each change has File(s), Problem, Change, Rationale, Constraint Fit, Risk, Dependencies.
+- [x] Component documentation already covers all affected areas (Targeted-mode skip applied).
+- [x] Logical-flow analysis: green smoke + unit run on 2026-05-10 traced every affected endpoint.
+- [x] Each change maps to ≤ 5 complexity points (C01: 3, C02: 2, C03: 5, C04: 2, C05: 3, C06: 2).
+
+## Self-Verification (Phase 1 close)
+
+Discovery summary:
+- Two architecture findings to resolve (F3 Medium, F4 Medium).
+- Six changes (C01..C06), one task per change after Phase 2 decomposition.
+- Total estimate: ~17 story points, but each PBI stays at ≤ 5 points per the project's PBI sizing rule.
+
+Ready for Phase 2 (Analysis + Roadmap + Task Decomposition) on user approval.

_docs/04_refactoring/02-coupling-refactoring/test_specs/existing_coverage.md

@@ -0,0 +1,52 @@
+# Existing Test Coverage — 02-coupling-refactoring
+
+Recorded at start of Phase 3 (Safety Net) for the refactor run that introduces AZ-310..AZ-315.
+
+## Existing Test Inventory
+
+### Unit tests (`SatelliteProvider.Tests/`)
+
+| File | Refactor Scope Coverage |
+|------|--------------------------|
+| `TileServiceTests.cs` | Covers `ITileService` surface — relevant to AZ-310 (`ServeTile`) and AZ-311 (`GetTileByLatLon`) which extend the same interface |
+| `RegionServiceTests.cs` | Covers `RegionService` — namespace + project move (AZ-312/313) |
+| `RegionRequestQueueTests.cs` | Covers `RegionRequestQueue` — namespace + project move (AZ-312/313) |
+| `RouteServiceTests.cs` | Covers `RouteService` — namespace + project move (AZ-312/313) |
+| `InfrastructureTests.cs` | Cross-cutting fixtures — should remain green after split |
+
+Total: 35 unit tests passing as of Step 6 baseline.
+
+### Integration tests (`SatelliteProvider.IntegrationTests/`)
+
+Smoke profile (`--smoke`) covers:
+- Tile downloads through HTTP API (`/api/satellite/tiles/latlon`)
+- Region 200m / zoom 18 lifecycle
+- Route creation (single segment, no maps)
+- Security tests (SEC-01..SEC-04)
+
+Smoke run baseline: **111.86s** (recorded in Step 7, `_docs/03_implementation/test_run_step7.md`).
+
+## Coverage Assessment vs Phase 3 Thresholds
+
+| Threshold | Target | Status |
+|-----------|--------|--------|
+| Overall unit coverage on refactored files | ≥75% | Meets (TileService, RegionService, RouteService all have happy + edge tests) |
+| Critical paths (cache hit / repo hit / downloader fallback for `ITileService`) | ≥90% | **Will be added by AZ-310 unit tests** — current TileServiceTests covers `DownloadAndStoreTilesForRegionAsync` only, not `GetOrDownloadTileAsync` (which doesn't exist yet) |
+| Public APIs blackbox | required | `/api/satellite/tiles/latlon`: covered by smoke (HTTP 200 path); `/tiles/{z}/{x}/{y}`: NOT covered by smoke today — accepted gap, validated post-refactor by manual smoke or full integration run |
+| Error-handling paths | required | Covered by SecurityTests + RegionService failure tests |
+
+## Gaps & Decisions
+
+1. **`/tiles/{z}/{x}/{y}` HTTP-level coverage**: not in smoke. Decision: AC-1 of AZ-310 is byte-equivalent response shape; verified by post-refactor full integration run (queued for nightly) + a manual `curl` check before merge. NOT a Phase 3 blocker — the unit tests required by AZ-310 (cache hit / repo hit / downloader fallback) provide the required critical-path coverage at the service layer.
+2. **Project-split breakage detection**: covered by `dotnet build SatelliteProvider.sln` (green/red gate) — no additional safety net needed.
+3. **DI rewire breakage detection**: covered by smoke integration profile (any missing/misconfigured registration fails the smoke run).
+
+## Phase 3 GATE
+
+ALL existing tests must pass on the current codebase before proceeding to Phase 4.
+
+- Unit tests: passed in Step 6 (35/35).
+- Integration smoke: passed in Step 7 (111.86s).
+- No regressions detected since Step 7.
+
+**GATE: PASSED.** Proceeding to Phase 4 (Execution).