refactor(actions): include residual axios-risk slices in branch

context/architecture.md

@@ -75,3 +75,58 @@ Guidance:
 
 - Do not treat these files as active runtime architecture unless explicitly reactivated.
 - If reactivation is proposed, document rationale and rollout/rollback in `memory-bank/change-log.md` and `context/runbook.md`.
+
+## Current State Assessment and Prioritised Next Steps (2026-03-25)
+
+### Assessment summary
+
+The platform has moved into a stronger operational and architectural posture through sustained bounded refactor slices and contract hardening.
+
+Strengths:
+
+1. **Governance maturity is high**
+    - Guardrails are explicit for auth/session integrity, CSP/security headers, Prisma source-of-truth, relay hash integrity, and EN/CY parity.
+2. **API reliability posture has improved materially**
+    - Endpoint contract hardening and phase21 contract test expansion have reduced inconsistency in negative-path handling.
+3. **Relay operations are significantly more robust**
+    - Shared relay forwarding now includes bounded retry/timeout policy, structured redacted lifecycle logging, and documented rollout/rollback controls.
+4. **Façade decomposition is delivering low-risk progress**
+    - `actions` layer migration to shared clients (`relayClient`, `endpointClient`) is reducing duplicated request boilerplate and lowering drift risk.
+
+Primary residual risks/gaps:
+
+1. **Remaining direct-service inconsistency**
+    - Some direct services still contain legacy axios/request patterns and bespoke signed-request blocks.
+2. **Coverage concentration**
+    - Contract tests are strong in targeted slices, but end-to-end/high-value journey coverage in sensitive flows remains comparatively sparse.
+3. **Logging hygiene variance**
+    - Structured redaction exists in relay paths, but broader codebase logging still has uneven consistency.
+4. **i18n parity assurance remains process-heavy**
+    - EN/CY parity relies heavily on manual discipline rather than automated parity checks.
+
+### Prioritised next steps
+
+1. **Complete direct-service consistency sweep (low risk, high maintainability)**
+    - Prioritise `actions/services/searchDirectService.js` for `getJson`/`requestJson` adoption in bounded slices.
+    - Preserve existing error-return behavior contracts per function.
+2. **Consolidate signed-request patterns (medium risk, high security clarity)**
+    - Introduce a focused signed-request helper for hash-based/signed delete/get pathways currently repeated in service modules.
+    - Keep existing hash/header semantics unchanged while reducing duplication.
+3. **Add high-value regression automation (high value)**
+    - Add focused automated checks for:
+        - auth callback/redirect safety
+        - one signed-delete negative path
+        - one upload/document authorization negative path
+        - one EN/CY route parity check
+4. **Perform targeted logging hardening in sensitive paths**
+    - Continue replacing direct/verbose logging in `auth`, `file`, `email`, and account-sensitive endpoint paths with redacted structured logging patterns.
+5. **Introduce EN/CY parity CI checks**
+    - Add automated checks for route rewrite parity and locale key alignment to reduce drift and manual burden.
+6. **Continue endpoint sprawl reduction**
+    - Keep collapsing duplicated proxy/request patterns behind shared helpers in bounded route clusters while preserving public response contracts.
+
+### Recommended execution sequence
+
+- **Sequence A (immediate):** Step 1 + Step 3 (fastest risk reduction per effort)
+- **Sequence B (next):** Step 2 + Step 4 (security/logging consistency consolidation)
+- **Sequence C (after):** Step 5 + Step 6 (institutionalise parity and reduce long-tail maintenance cost)