TASK22224: document downloadblob hotfix closure and next file-guard slice

memory-bank/refactor-backlog.md

@@ -32,6 +32,28 @@ Last updated: 2026-03-12
 - **Target outcome:** Shared guard middleware for hash/auth/input validation + consistent negative-path responses.
 - **Initial scope:** enforce a common pre-handler contract on high-risk routes first.
 
+### Priority 4 — Current slice status (2026-03-23)
+
+- Completed on `TASK22224-file-endpoint-contract-bundle`:
+    - `pages/api/file/downloadblob.js` hardening + hotfix closure
+    - path normalization compatibility (filename-only + prefixed path)
+    - encoded/raw hash validation compatibility guard
+- Confirmed outcome:
+    - user-reported download failures resolved
+    - phase21 file + combined contract suites passing
+
+### Priority 4 — Next recommended slice on this branch
+
+- Target routes:
+    - `pages/api/file/deleteblob.js`
+    - `pages/api/file/deleteblobcase.js`
+    - `pages/api/file/deleteblobrep.js`
+- Scope:
+    - align hash canonicalization strategy with `downloadblob.js`
+    - enforce explicit `respondError` contracts (`MISSING_REQUIRED_QUERY`, `INVALID_HASH`, route-specific `*_FAILED`)
+    - preserve existing success payload shapes
+    - extend `tests/phase21/file-handler-contract.test.cjs` with mixed encoded/raw hash variants and negative paths
+
 ## Priority 5 — Establish minimum automated regression baseline
 
 - **Problem:** Limited automated tests for high-risk logic.