TASK22211: version memory-bank and backfill change-log stream

memory-bank/pitfalls.md

@@ -0,0 +1,62 @@
+# Pitfalls
+
+## Entry Template
+
+```
+date: YYYY-MM-DD
+author: <agent|name>
+scope: <files/routes/features>
+type: pitfall
+rationale: <why recorded>
+impact: <user/system/security/i18n/a11y>
+status: open|mitigated|resolved
+
+Pitfall:
+How to detect:
+How to avoid:
+```
+
+---
+
+### PF-001: Locale Rewrite Drift
+
+date: 2026-03-11  
+author: Cline  
+scope: `next.config.js`, `i18n.js`, user-facing routes  
+type: pitfall  
+rationale: Route/content parity can silently break across EN/CY if only one side is updated.  
+impact: Broken navigation and inconsistent bilingual experience.  
+status: mitigated
+
+Pitfall:
+Adding or modifying a route in one locale without corresponding rewrite/translation updates.
+
+How to detect:
+
+- Manual navigation check for EN and CY aliases.
+- Verify page namespace mappings in `i18n.js`.
+
+How to avoid:
+
+- Treat route + translation + rewrite as one change unit.
+
+### PF-002: Sensitive Logging in Auth/Notification Paths
+
+date: 2026-03-11  
+author: Cline  
+scope: `pages/api/auth/[...nextauth].js`, `pages/api/email/**`, `actions/index.js`  
+type: pitfall  
+rationale: Debug logs in these paths can expose identifiers or callback tokens.  
+impact: Security and privacy risk.  
+status: open
+
+Pitfall:
+Verbose console logs around auth URLs, email payloads, or user identifiers.
+
+How to detect:
+
+- Search changed files for `console.log` and inspect payload content.
+
+How to avoid:
+
+- Use redacted logging and avoid printing callback tokens/user-sensitive data.