TASK22168 bundle C endpoint login/account consistency extension

memory-bank/progress.md

@@ -802,6 +802,54 @@
     - `node tests/phase21/api-contract-slice1.test.cjs`
     - `npm run lint`
 
+## Latest update (2026-03-19 — TASK22168 Bundle C extension on same branch)
+
+- Continued same branch with user-approved larger bundle:
+    - `TASK22168-endpoint-account-contract-consistency`
+- Added contract-consistency coverage for login/portal/account-adjacent endpoints:
+    - `pages/api/endpoint/getlogin_api.js`
+    - `pages/api/endpoint/getportallogin_api.js`
+    - `pages/api/endpoint/getportalloginproxy_api.js`
+    - `pages/api/endpoint/getpersonalaccount_api.js`
+- Scope delivered:
+    - removed dead imports/commented debug/noisy logging remnants
+    - standardized structured 400 errors for required-input negative paths and catch/failure paths
+    - preserved success payload contracts via `respondSuccess` pass-through
+- Phase21 endpoint suite expanded in:
+    - `tests/phase21/endpoint-handler-contract.test.cjs`
+    - test count grew from 7 to 18 for endpoint handler coverage
+
+### Validation snapshot (TASK22168 Bundle C)
+
+- `node tests/phase21/api-contract-slice1.test.cjs` -> **pass**
+    - helper: 4/4
+    - file-handler: 11/11
+    - email-handler: 12/12
+    - endpoint-handler: 18/18
+- `npm run lint` -> **warnings only** (pre-existing `react-hooks/exhaustive-deps` warnings)
+
+### Risks + mitigations (TASK22168 Bundle C)
+
+- Risk: contract drift from broad endpoint touch surface.
+    - Mitigation: constrained to login/account adjacency group only and preserved success pass-through behavior.
+- Risk: hash-path behavior regression in `getportallogin_api`.
+    - Mitigation: explicit tests for missing hash, invalid hash, and catch path.
+- Risk: inconsistent required-input behavior across adjacent handlers.
+    - Mitigation: standardized explicit required-input envelopes in all four newly touched handlers.
+
+### Rollback plan (TASK22168 Bundle C)
+
+1. Revert endpoint files:
+    - `pages/api/endpoint/getlogin_api.js`
+    - `pages/api/endpoint/getportallogin_api.js`
+    - `pages/api/endpoint/getportalloginproxy_api.js`
+    - `pages/api/endpoint/getpersonalaccount_api.js`
+2. Revert endpoint contract test updates:
+    - `tests/phase21/endpoint-handler-contract.test.cjs`
+3. Re-run:
+    - `node tests/phase21/api-contract-slice1.test.cjs`
+    - `npm run lint`
+
 ### Manual HTTP checks (Phase 16)
 
 - Dev server on `http://localhost:3002`.