docs: add current-state context pack and actionable sequence-b prompts

context/architecture.md

@@ -102,7 +102,7 @@ Primary residual risks/gaps:
 3. **Logging hygiene variance**
     - Structured redaction exists in relay paths, but broader codebase logging still has uneven consistency.
 4. **i18n parity assurance remains process-heavy**
-    - EN/CY parity relies heavily on manual discipline rather than automated parity checks.
+    - EN/CY parity now has targeted automated coverage, but still relies on manual discipline for broader journey-level assurance and CI enforcement.
 
 ### Prioritised next steps
 
@@ -112,12 +112,13 @@ Primary residual risks/gaps:
 2. **Consolidate signed-request patterns (medium risk, high security clarity)**
     - Introduce a focused signed-request helper for hash-based/signed delete/get pathways currently repeated in service modules.
     - Keep existing hash/header semantics unchanged while reducing duplication.
-3. **Add high-value regression automation (high value)**
-    - Add focused automated checks for:
+3. **Broaden high-value regression automation (high value)**
+    - Initial focused checks are now in place for:
         - auth callback/redirect safety
-        - one signed-delete negative path
-        - one upload/document authorization negative path
-        - one EN/CY route parity check
+        - signed-delete negative path
+        - upload/document authorization negative path
+        - EN/CY route parity
+    - Next, expand breadth/depth (more journey-level assertions and CI integration).
 4. **Perform targeted logging hardening in sensitive paths**
     - Continue replacing direct/verbose logging in `auth`, `file`, `email`, and account-sensitive endpoint paths with redacted structured logging patterns.
 5. **Introduce EN/CY parity CI checks**
@@ -130,3 +131,35 @@ Primary residual risks/gaps:
 - **Sequence A (immediate):** Step 1 + Step 3 (fastest risk reduction per effort)
 - **Sequence B (next):** Step 2 + Step 4 (security/logging consistency consolidation)
 - **Sequence C (after):** Step 5 + Step 6 (institutionalise parity and reduce long-tail maintenance cost)
+
+### Status update (2026-03-25)
+
+- Sequence A targeted intent is now covered on this branch:
+    - Step 1: direct-service consistency sweep completed for this bundle stream
+    - Step 3: focused checks added for auth redirect safety and EN/CY rewrite parity, alongside existing signed-delete and upload/document negative-path coverage
+- Remaining work is primarily Sequence B and Sequence C scope.
+
+### Cross-check update vs debt list and architect review (2026-03-25)
+
+This architecture status has been cross-checked against:
+
+- `memory-bank/debt-list.md`
+- `memory-bank/architect-review.md`
+
+Current progress snapshot:
+
+1. **Actions monolith decomposition** -> in progress with strong momentum
+    - shared clients/helpers introduced (`relayClient`, `endpointClient`, `fileClient`, `fileRouteBuilder`) and adopted across key service modules
+    - residual monolith risk remains until broader domain split is complete
+2. **API contract consistency** -> materially improved
+    - large endpoint hardening footprint already delivered, with remaining long-tail cleanup still open
+3. **Sensitive logging hardening** -> partial
+    - relay path improvements exist, but wider auth/email/file logging standardization remains open
+4. **Endpoint sprawl reduction** -> materially improved
+    - repeated relay/proxy patterns reduced through helper reuse
+5. **i18n parity assurance** -> initial automation in place
+    - targeted EN/CY rewrite parity checks now exist; CI-level institutionalization still recommended
+6. **High-risk regression automation** -> materially improved
+    - focused auth redirect safety + signed-delete + upload/document negative-path + EN/CY parity checks now covered
+7. **Runtime canonicalization** -> still open
+    - server entrypoint ambiguity (`server.js` vs `server/server.js`) remains an explicit follow-on architecture decision.