Phase 1 reliability/stabilisation: auth logging, logout client, loader+xml hardening

memory-bank/change-log.md

@@ -16,6 +16,46 @@ Validation:
 Follow-ups:
 ```
 
+### CL-2026-05-13-PH1: reliability & stabilisation pass (auth/session + new-appeal loader hardening)
+
+date: 2026-05-13  
+author: Cline  
+scope: `actions/core/logger.js`, `lib/auth/logoutClient.js`, `pages/api/auth/[...nextauth].js`, `pages/myportal/index.js`, `components/{header.js,myportal/servicebanner.js,timeout/index.js}`, `lib/forms/readFormXml.js`, `lib/newappeal/loadNewAppealPage.js`  
+type: change  
+rationale: Phase 1 stabilisation work to improve session/auth observability, reduce logout-flow drift, add defensive SSR handling, and apply low-risk XML read performance caching while preserving live behaviour.  
+impact: Refactor/stabilisation only; no intended business-rule or route-contract changes; improved auth diagnostics and safer failure handling in new-appeal SSR loader path.  
+status: completed
+
+Summary:
+
+- Added structured `logInfo(...)` helper in `actions/core/logger.js` (with existing redaction path reuse).
+- Added shared logout client helper `lib/auth/logoutClient.js` and wired logout calls in:
+    - `components/header.js`
+    - `components/myportal/servicebanner.js`
+    - `components/timeout/index.js`
+- Fixed service-banner regression from refactor artifact (`handleLogout` undefined) and removed orphaned sign-in/logout call path.
+- Updated `pages/api/auth/[...nextauth].js`:
+    - added auth callback/session/verification logging events
+    - added readable verification URL console lines for emailAPI flow
+    - made debug/cookie secure config environment-aware (`NODE_ENV`)
+- Added auth guard redirect logging in `pages/myportal/index.js` for missing-session redirects.
+- Hardened `lib/newappeal/loadNewAppealPage.js` with:
+    - missing-session logging before redirect
+    - XML read try/catch + safe redirect fallback (`/error?reason=formxml`)
+- Added process-level XML cache in `lib/forms/readFormXml.js` to avoid repeated reads for same appeal type.
+
+Validation:
+
+- Manual code-path verification performed for modified files.
+- Syntax issues introduced during patching were corrected in `pages/api/auth/[...nextauth].js` and `components/myportal/servicebanner.js`.
+- Targeted `next lint --file ...` execution could not be completed in current environment due to existing local Node/Next CLI compatibility issue (`SyntaxError: Unexpected token ?` in Next bundled commander), unrelated to these functional edits.
+
+Follow-ups:
+
+- Branching guardrail alignment: split this stabilisation work into explicit refactor slices on short-lived branches created from `refactor` (one concern per slice), then merge back to `refactor`.
+- Re-run required validation gates (`npm run lint` in compatible environment + protected journey regression + EN/CY parity checks) before promotion.
+- Add/record PR minimum details (scope, files, risk notes, validation evidence, rollback plan) per branch rules.
+
 ---
 
 ### CL-22541: breadcrumb/back-link route-state helper extraction (`va/adv/ads/key`)