refactor(api): harden relay forwarding with timeout, retries and redacted logs

memory-bank/change-log.md

@@ -1107,3 +1107,44 @@ Validation:
 Follow-ups:
 
 - Batch 12 completes the previously listed remaining P2-S2 relay GET candidates.
+
+---
+
+### CL-030: TASK22236 P2-S3 relay forwarding hardening (timeouts, retries, structured redacted logs)
+
+date: 2026-03-24
+author: Cline
+scope: `pages/api/middleware/relayForwarding.js`, `tests/phase21/relay-forwarding-hardening.test.cjs`
+type: change
+rationale: Begin P2-S3 by hardening shared relay forwarding behavior with bounded timeout/retry controls and structured redacted operational logging, reducing transient failure impact while preserving endpoint contracts.
+impact: Improves resilience/observability for relay GET traffic; endpoint success/error contracts remain unchanged because caller handlers still manage response envelopes.
+status: completed
+
+Summary:
+
+- Hardened `forwardGetData` in `relayForwarding.js` with:
+    - configurable timeout (`RELAY_TIMEOUT_MS`, default 8000ms)
+    - bounded retries (`RELAY_RETRY_MAX`, default 2)
+    - exponential backoff with cap (`RELAY_RETRY_BASE_DELAY_MS`, `RELAY_RETRY_MAX_DELAY_MS`)
+    - retry eligibility for transient statuses/codes (`408/429/5xx`, selected network timeout/reset codes)
+- Added structured, redacted operational relay logs:
+    - `relay_request_retrying`
+    - `relay_request_failed`
+- Preserved compatibility behaviors:
+    - existing token/header/hash handling
+    - optional `appendHash` and custom `requestOptionsBuilder`
+    - endpoint-level `relayGet` error response semantics
+- Added focused Phase 21 hardening tests:
+    - retries on retryable status and succeeds
+    - does not retry non-retryable status
+    - applies timeout and respects `appendHash=false`
+
+Validation:
+
+- `node tests/phase21/relay-forwarding-hardening.test.cjs` -> pass (3/3)
+- `node tests/phase21/endpoint-handler-contract.test.cjs` -> pass (152/152)
+- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps`; no new lint errors)
+
+Follow-ups:
+
+- Optional next hardening increment: introduce endpoint-specific retry overrides for write paths (if future non-GET use is introduced) to keep retry policy conservative by operation type.