feat(rm-handlers): D1 — issue create form (POST-redirect-GET)

[AdaWorldAPI]

What

The depth follow-on to #21's D2 chrome on the same /issues surface — closes the most-iconic Redmine flow:

list page  →  "New issue" link  →  form (Subject + Description)  →  submit  →  detail page
   /issues       /issues/new           Subject required, ≤255           303         /issues/<id>

New sibling module crates/rm-handlers/src/issues_form.rs:

GET  /issues/new   — render an empty form (clean state)
POST /issues       — accept submission, validate, persist, redirect-or-error

Per Plan §8 file ownership, the D-track form lives in a sibling to issues.rs so the W1 list/detail file stays the merge-conflict boundary for its own width. rm-server merges both routers.

Behavior

input	response
valid subject (trimmed)	303 See Other → /issues/<id> (POST-redirect-GET)
empty subject	200 + form re-rendered + inline error Subject is required.
whitespace-only subject	same as empty (trimmed first)
subject > 255 chars	200 + form re-rendered + inline error Subject must be 255 characters or fewer.
description empty after trim	persisted as None in NewIssue
description with content	trimmed + persisted as Some(String)

User's input is preserved on validation failure (no retyping). The kit HTML-escapes the echoed values on re-render — XSS-safe by construction.

#99 trap-spellbook pre-flight (5 questions cleared)

Q	answer
Q1 reading FROM	nothing — pure form handler (no producer reading)
Q2 lifecycle vocab	None
Q3 target IR	The NewIssue store row (already canonical) + the kit's FormSource
Q4 arrow direction	HTTP form → store, no SurrealQL spine substitution anywhere
Q5 inverse recover	N/A

Zero diagnostic signatures present.

Out of scope (named, gated)

• Edit (PATCH /issues/:id) — D1.2 follow-on; the kit's FormSource.record_id is the seam already present.
• CSRF token — csrf_token: "" for now; rm-auth integration is its own follow-on (rolling token enforcement applies once the auth infra is shared).
• Markdown preview + attachments — D5 / D6 follow-ons.
• Status / priority / tracker / assignee fields — the FK columns wait for W2/W3 taxonomy + W4 actor to land them on IssueRow. When they do, the form grows one input per FK; no chrome change.
• The "New issue" link on the /issues list page — one-line follow-on (literally <a href="/issues/new">New issue</a> in the chrome).

Build

• Toolchain 1.95. cargo test -p rm-handlers --lib → 89 passed (was 75 after feat(rm-handlers): D2 — issue list filter, sort, paginate (17-yr Redmine UX) #21; +14 new — 6 unit on validate(), 8 integration).
• cargo fmt --check clean; cargo clippy --all-targets -- -D warnings clean (matching CI's exact gate).
• One new module + 2 doc-comment updates. No new deps.

Cross-refs

• feat(rm-handlers): D2 — issue list filter, sort, paginate (17-yr Redmine UX) #21 — the D2 list chrome this depth-track sits next to.
• OGAR render-kit html_form.rs — FormSource / FormFieldSource / render_form consumed here.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.