## 1) Prioritized debt list

1. Monolithic `actions/index.js` (over-coupled “god module”)
2. Inconsistent API error handling/response contracts across `pages/api/**`
3. Sensitive/verbose logging in app + API paths
4. Endpoint sprawl and duplicated proxy patterns (`pages/api/endpoint/*_api.js`)
5. i18n routing complexity in large rewrite maps
6. Sparse automated test coverage for high-risk flows
7. Legacy/stale commented patterns in critical files

## 2) Impact of each item

- **1) `actions/index.js` monolith**
    - High blast radius for any change; weak modularity and hard ownership boundaries.
    - Evidence: ~100+ exports mixing search, auth, account, file, PDF, notify, CRM concerns.

- **2) API contract inconsistency**
    - Clients must handle errors inconsistently; reliability and observability suffer.
    - Evidence: many handlers return raw `res.status(400).json(error)` while others shape custom outputs.

- **3) Verbose/sensitive logging**
    - Privacy/security risk plus noisy telemetry.
    - Evidence: 300+ `console.log` occurrences, including auth/email/upload-related contexts.

- **4) Endpoint duplication**
    - Maintenance cost and drift risk (validation/auth/error semantics diverge over time).
    - Evidence: repeated patterns across many `_api.js` proxy handlers.

- **5) i18n rewrite complexity**
    - Higher risk of EN/CY divergence as routes evolve.
    - Evidence: large manual rewrite map + separate i18n page namespace config.

- **6) Sparse tests**
    - Release confidence depends heavily on manual checks; slower, riskier change cadence.

- **7) Stale patterns**
    - Increased cognitive load and unclear source-of-truth behavior in some modules.

## 3) Recommended next cleanup targets

1. **Decompose `actions/index.js` by domain** (structure-only first, keep barrel exports).
2. **Add shared API handler utilities** for validation/error envelope; migrate top sensitive endpoints first.
3. **Implement logging redaction wrapper + policy** and remove direct logs in auth/email/file paths.
4. **Create high-risk smoke tests** (auth callback, search endpoint, upload negative-path, email failure-path).
5. **Extract proxy/integration helpers** (token/hash/header/retry) to reduce endpoint duplication.
6. **Add EN/CY parity CI checks** for route and locale key consistency.

## 4) Runtime note (updated)

- `server.js` and `server/server.js` exist in the repository but are **not the active production concern** for the current refactor stream.
- Current baseline runtime for this debt plan is the standard Next runtime path (`npm start`).
- Runtime canonicalization is therefore removed from the active prioritized debt list unless deployment evidence changes.

## 5) Progress snapshot against architecture/debt review (2026-03-25)

Cross-referenced with:

- `context/architecture.md` (status + execution sequence)
- `memory-bank/architect-review.md`

Status by debt item:

1. **Monolithic `actions/index.js`** -> **in progress**
    - Significant modular extraction completed (shared clients and route helpers), but full domain split remains open.
2. **Inconsistent API contracts** -> **major progress**
    - Broad endpoint hardening and contract normalization completed across many route clusters.
3. **Sensitive/verbose logging** -> **partial progress**
    - Relay path improved; broader auth/email/file redaction standardization still pending.
4. **Endpoint sprawl/duplication** -> **major progress**
    - Shared relay/request helpers reduced repeated route logic; long-tail cleanup remains.
5. **i18n rewrite complexity** -> **improving**
    - Targeted EN/CY rewrite parity automation now exists; CI enforcement still pending.
6. **Sparse high-risk tests** -> **major progress**
    - Focused automation now covers auth redirect safety, signed-delete/upload negative paths, and EN/CY parity checks.
7. **Legacy/stale patterns** -> **partial progress**
    - Multiple cleanup slices completed; still an ongoing hygiene lane.

Immediate recommended next lane (aligned to architecture Sequence B):

- Consolidate signed-request patterns behind a focused helper.
- Apply broader logging hardening in auth/file/email/account-sensitive paths.

If you want, I can convert this into a sprint-ready debt register (ID, owner, effort, risk reduction, target milestone).