docs: add current-state context pack and actionable sequence-b prompts

memory-bank/debt-list.md

@@ -51,4 +51,33 @@
 - Current baseline runtime for this debt plan is the standard Next runtime path (`npm start`).
 - Runtime canonicalization is therefore removed from the active prioritized debt list unless deployment evidence changes.
 
+## 5) Progress snapshot against architecture/debt review (2026-03-25)
+
+Cross-referenced with:
+
+- `context/architecture.md` (status + execution sequence)
+- `memory-bank/architect-review.md`
+
+Status by debt item:
+
+1. **Monolithic `actions/index.js`** -> **in progress**
+    - Significant modular extraction completed (shared clients and route helpers), but full domain split remains open.
+2. **Inconsistent API contracts** -> **major progress**
+    - Broad endpoint hardening and contract normalization completed across many route clusters.
+3. **Sensitive/verbose logging** -> **partial progress**
+    - Relay path improved; broader auth/email/file redaction standardization still pending.
+4. **Endpoint sprawl/duplication** -> **major progress**
+    - Shared relay/request helpers reduced repeated route logic; long-tail cleanup remains.
+5. **i18n rewrite complexity** -> **improving**
+    - Targeted EN/CY rewrite parity automation now exists; CI enforcement still pending.
+6. **Sparse high-risk tests** -> **major progress**
+    - Focused automation now covers auth redirect safety, signed-delete/upload negative paths, and EN/CY parity checks.
+7. **Legacy/stale patterns** -> **partial progress**
+    - Multiple cleanup slices completed; still an ongoing hygiene lane.
+
+Immediate recommended next lane (aligned to architecture Sequence B):
+
+- Consolidate signed-request patterns behind a focused helper.
+- Apply broader logging hardening in auth/file/email/account-sensitive paths.
+
 If you want, I can convert this into a sprint-ready debt register (ID, owner, effort, risk reduction, target milestone).

memory-bank/decisions.md

@@ -112,3 +112,61 @@ Related:
 
 - `context/runbook.md`
 - `memory-bank/change-log.md` (CL-032)
+
+---
+
+### D-004: Runtime canonicalization decision needed (`server.js` vs `server/server.js`)
+
+date: 2026-03-25  
+author: Cline  
+scope: runtime startup path, scripts, runbook documentation  
+type: decision  
+rationale: Architecture/debt review identifies persistent ambiguity from dual server entrypoints, increasing operational drift risk.  
+impact: Affects release reliability, troubleshooting clarity, onboarding consistency, and change safety for runtime-affecting work.  
+status: proposed
+
+Decision:
+
+- Adopt one explicit canonical runtime startup path for dev/test/prod and document it in runbook + scripts.
+- Mark the non-canonical server entrypoint as deprecated (or remove when safe) with rollback instructions.
+
+Consequences:
+
+- Reduces deployment and incident-response ambiguity.
+- Requires coordinated validation across environments before deprecating the alternate path.
+
+Related:
+
+- `memory-bank/architect-review.md`
+- `context/architecture.md`
+- `context/runbook.md`
+
+---
+
+### D-005: Introduce CI baseline checks for high-risk parity/coverage gates
+
+date: 2026-03-25  
+author: Cline  
+scope: CI policy for architecture/debt hardening lanes  
+type: decision  
+rationale: High-value focused tests now exist but are not yet fully institutionalized as explicit baseline gates for parity-sensitive change safety.  
+impact: Improves release confidence and reduces regression drift in auth/i18n/high-risk integration paths.  
+status: proposed
+
+Decision:
+
+- Add baseline CI checks for:
+    - `npm run lint`
+    - phase22 aggregate high-risk checks (`tests/phase22/index.test.cjs`)
+    - EN/CY parity validation checks (initial rewrite parity scope)
+
+Consequences:
+
+- Tightens merge discipline for high-risk changes.
+- May require staged rollout to avoid pipeline disruption while stabilizing flaky areas.
+
+Related:
+
+- `context/test-coverage-map.md`
+- `context/current-state-scorecard.md`
+- `memory-bank/open-questions.md` (Q-002)

memory-bank/open-questions.md

@@ -29,13 +29,20 @@ impact: Potential privacy/security exposure via operational logs.
 status: open
 
 Question:
-What mandatory redaction and logging policy should be enforced for auth/email/document flows?
+What mandatory redaction and structured logging policy should be enforced for auth/email/document flows (fields blocked, allowed metadata, and incident correlation expectations)?
 
 Needed from:
 Security lead + application owner
 
 Decision deadline:
-Before next auth/notification release
+Before Sequence B Workstream B2 rollout
+
+Current context:
+
+- Relay logging policy has already been hardened in middleware, but auth/email/file routes still have uneven logging style.
+- Reference planning docs:
+    - `context/next-work-plan-sequence-b.md`
+    - `context/current-state-scorecard.md`
 
 ### Q-002: Test Strategy Baseline for Sparse `tests/`
 
@@ -48,10 +55,36 @@ impact: Increased regression risk and slower release confidence.
 status: open
 
 Question:
-What minimum automated coverage should be required per change type (feature, bug fix, high-risk integration)?
+What minimum automated coverage should be required per change type (feature, bug fix, high-risk integration), and which suites become mandatory CI gates?
 
 Needed from:
 Engineering lead + QA
 
 Decision deadline:
-Before next major feature cycle
+Before enabling Sequence C CI parity gate rollout
+
+Current context:
+
+- Focused high-risk automation exists in phase21/phase22 (auth redirect, i18n route parity, relay hardening, endpoint contract slices).
+- A formal CI baseline decision is still needed to institutionalize these checks.
+
+---
+
+### Q-003: Runtime canonical startup path selection
+
+date: 2026-03-25  
+author: Cline  
+scope: runtime startup path and operational documentation  
+type: question  
+rationale: Dual server entrypoints (`server.js` and `server/server.js`) remain a known architecture ambiguity in review artifacts.  
+impact: Operational ambiguity can increase deployment and incident-response risk.  
+status: open
+
+Question:
+Which startup path is canonical for dev/test/prod, and what is the deprecation plan for the non-canonical entrypoint?
+
+Needed from:
+Technical lead + DevOps owner
+
+Decision deadline:
+Before runtime-affecting refactor or next deployment process update