Merged PR 2315: Auth stabilistatiion and hardening

Related work items: #23020

context/performance-and-stability-baseline.md

@@ -0,0 +1,29 @@
+# Performance & Stability Baseline (Phase 1)
+
+Last updated: 2026-05-13
+
+## Baseline observations
+
+### Performance
+
+- Loader-heavy pages (myportal/representation/new appeal) perform multiple external calls per SSR request.
+- Form XML is read/normalized repeatedly from disk in SSR path.
+- Some large components still combine orchestration + rendering, increasing rerender work.
+
+### Stability
+
+- Several SSR/data paths assume nested API response shapes without guard rails.
+- Representation resume/new loader had crash/redirect fragility around missing contact/representation objects.
+- Logging noise can mask actionable failure signals.
+
+## Changes started in this phase
+
+1. Added in-memory XML cache in `lib/forms/readFormXml.js` (safe, process-local).
+2. Added null/redirect guards in `lib/representation/pageLoaders.js` for missing user/contact and missing representation entry.
+3. Began auth-path de-duplication and redirect hardening (see auth reliability doc).
+
+## Next baseline improvements
+
+1. Add guarded defaults in remaining loader paths (`loadNewAppealPage`, myportal page loaders).
+2. Introduce structured non-sensitive SSR failure telemetry for dependency failures.
+3. Expand bounded concurrency/parallelism where safe and contract-preserving.