TASK22028: document signer allow-list follow-up

memory-bank/activeContext.md

@@ -521,6 +521,14 @@
 - phase16 behavioural suite: pass (4/4)
 - lint: warnings only (pre-existing)
 
+## Follow-up status (2026-03-13)
+
+- Applied targeted signer allow-list fix for browser delete-awaiting-submission path.
+- Updated `pages/api/endpoint/gethash_api.js` allow-list with:
+    - `/api/file/deleteblobcase`
+- Added focused behavioural test:
+    - `tests/phase14/service-behaviour.test.cjs` now includes allow-list coverage for deleteblobcase path.
+
 ## Likely next steps
 
 1. Stabilize and simplify breadcrumb/back-link decision logic with focused regression checks.

memory-bank/change-log.md

@@ -1018,3 +1018,30 @@ Validation:
 Follow-ups:
 
 - Continue incremental endpoint/file proxy consistency slices with same contract-preserving constraints.
+
+---
+
+### CL-028: Follow-up fix — signer allow-list expanded for deleteblobcase browser path
+
+date: 2026-03-13
+author: Cline
+scope: `pages/api/endpoint/gethash_api.js`, `tests/phase14/service-behaviour.test.cjs`
+type: change
+rationale: Resolve runtime failure where browser-side `deleteAwaitingSubmissionsFromBlob` hash signing requested a path not present in signer allow-list.
+impact: Restores browser-safe hash signing for delete-blob-case flow without weakening auth/session guard on signer endpoint.
+status: completed
+
+Summary:
+
+- Added `/api/file/deleteblobcase` to `gethash_api` allow-list.
+- Added focused test coverage in phase-14 suite for the new allow-listed path.
+
+Validation:
+
+- `node tests/phase14/service-behaviour.test.cjs` -> pass (6/6)
+- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
+- `npm run lint` -> warnings only (pre-existing)
+
+Follow-ups:
+
+- Keep signer allow-list additions minimal and path-specific.

memory-bank/progress.md

@@ -703,6 +703,20 @@
     - `tests/phase16/service-behaviour.test.cjs`
 2. Re-run phase6–phase16 tests and lint.
 
+## Latest update (2026-03-13 — signer allow-list follow-up)
+
+- Branch: `TASK22028-phase15-hardening-slice`
+- Fix applied:
+    - added `/api/file/deleteblobcase` to signer endpoint allow-list in `pages/api/endpoint/gethash_api.js`
+- Test update:
+    - extended `tests/phase14/service-behaviour.test.cjs` with deleteblobcase allow-list coverage
+
+### Validation snapshot (follow-up)
+
+- `node tests/phase14/service-behaviour.test.cjs` -> **pass** (6/6)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `npm run lint` -> **warnings only** (pre-existing)
+
 ## Outstanding risks / gaps
 
 - Navigation regressions across EN/CY + route query combinations.

memory-bank/refactor-plan-actions-index.md

@@ -536,6 +536,21 @@ Status key: `[x] done`, `[ ] pending`
     - `tests/phase16/service-behaviour.test.cjs`
 - Re-run phase6–phase16 baseline tests and lint.
 
+### Follow-up completion snapshot (2026-03-13)
+
+1. `[x]` Address browser signer failure for delete-awaiting-submission path
+    - added signer allow-list entry: `/api/file/deleteblobcase`
+2. `[x]` Add focused behavioural test coverage
+    - extended `tests/phase14/service-behaviour.test.cjs`
+3. `[x]` Validate
+    - phase14 behaviour tests pass (6/6)
+    - phase7 behaviour tests pass (10/10)
+    - lint warnings only (pre-existing)
+
+### Follow-up rollback notes
+
+- Revert commit `49dd990` to undo allow-list/test follow-up.
+
 ## Safe execution mode for migration chunks (required)
 
 To reduce terminal hangs during bulk migration work, run refactor chunks in **safe stepwise mode** instead of long chained commands.