# Active Context — PEDW FrontEnd

## Current development focus (from recent commits)

- Search/case navigation correctness, especially breadcrumb and back-link behavior.
- My Portal "view all" and DNS application path handling.
- Welsh/English email behavior for specific notification templates.
- PDF output formatting and hyperlink behavior.

## Recently changed areas (high signal)

- `components/breadcrumbs.js`
- `components/case/summary.js`
- `components/search/searchresults.js`
- `components/search/addresssearchresults.js`
- `components/myportal/viewall.js`
- `pages/myportal/case/[ticketnumber].js`
- `pages/api/email/notify.js`
- `actions/index.js`
- `actions/core/env.js`
- `actions/core/logger.js`
- `actions/core/hash.js`
- `actions/core/token.js`
- `actions/core/headers.js`
- `actions/services/legacyActionsService.js`
- `i18n.js`

## Active concerns

- Breadcrumb and route-state logic is complex and query-dependent (`va`, `adv`, `ads`, `key`), so regressions are easy.
- Locale-specific route and label behavior is still a high-risk area due to rewrite + component logic coupling.
- Sensitive logging remains present in auth/email/actions paths and should be reduced/redacted over time.
- Hash validation on some file endpoints appears inconsistent (some checks active, some commented), requiring careful change discipline.

## Refactor status update (2026-03-12)

- Priority 1 refactor (Phase 1) is in place:
    - `actions/index.js` now acts as a compatibility barrel.
    - Core helper concerns were extracted into `actions/core/*`.
    - Existing API/file/domain wrappers were moved into `actions/services/legacyActionsService.js` with backward-compatible exports retained via the barrel.
- No intentional behavior changes were introduced in this phase; focus was structural risk reduction.
- Priority 1 refactor (Phase 2) is now in place:
    - Domain service grouping modules added under `actions/services/*`.
    - `actions/services/index.js` now provides grouped service barrel exports.
    - `actions/index.js` now re-exports from `./services` and `./core/*` while preserving existing public action names.
- `legacyActionsService` remains as a compatibility backing module and should be slimmed in later increments as consumers move to direct service imports.

## Refactor status update (Priority 1 execution pass — 2026-03-12)

- Completed an additional Priority 1 consumer-migration pass focused on high-use portal/form helpers.
- Updated these files to use focused service/core imports instead of broad `actions` barrel imports:
    - `components/case/representation/representationElements.js`
    - `components/elements/index.js`
    - `components/utils/index.js`
    - `lib/newappeal/loadNewAppealPage.js`
    - `lib/myportal/loadMyPortalAppealPage.js`
    - `components/myportal/topthree.js`
    - `components/myportal/topthree_reps.js`
    - `components/myportal/awaitingsubmissionfromblob.js`
- Compatibility model remains in place via `actions/index.js`; migration is incremental and non-breaking by design.

## Refactor status update (Priority 1 execution pass — viewall/search/unsubscribe)

- Completed another focused import migration pass to reduce broad `actions` barrel coupling in user-facing high-use areas:
    - `components/myportal/viewall.js`
    - `components/search/addresssearchresults.js`
    - `pages/unsubscribe/[watchlistid].js`
    - `pages/unsubscribeall/[watchlistid].js`
- These files now use explicit imports from `actions/services/*` and `actions/core/*` modules.
- Remaining non-comment broad `actions` imports are now primarily in selected `pages/api/endpoint/*` and `pages/api/file/*` handlers.

## Refactor status update (Priority 1 execution pass — endpoint/file proxies)

- Completed focused import migration for selected endpoint and file proxy handlers:
    - `pages/api/endpoint/getmylpacases_api.js`
    - `pages/api/endpoint/getbasicdnssearchpaged_api.js`
    - `pages/api/endpoint/getsearchdocumentdetailspaged_api.js`
    - `pages/api/endpoint/getbasicsearchpaged_api.js`
    - `pages/api/file/getawaitingsubmissionfromblobproxy.js`
    - `pages/api/file/getrepsblobproxy.js`
    - `pages/api/file/getbloblistproxy.js`
    - `pages/api/file/createappealcompletemessageproxy_api.js`
- Replaced broad `../../../actions` imports with focused `actions/core/*` and service-module imports.
- Eliminated duplicated local hash helper in `getmylpacases_api.js` by reusing shared `actions/core/hash`.
- Current broad-import scan indicates only comment-only legacy references remain.

## Delivery handover status (2026-03-13)

- Current import-migration wave has been checked in and completed through PR.
- This branch is now treated as the completed migration baseline.
- Next implementation chunk should start on a **new branch** and target decomposition of `actions/services/legacyActionsService.js`.
- Immediate focus for next branch:
    1. extract low-risk reference/search wrappers into direct service/client modules,
    2. migrate portal/document internals in small parity-checked batches,
    3. slim compatibility layer once parity is proven.

## Phase 5 kickoff status (2026-03-13)

- Branch in progress: `TASK21997-phase5-legacyactions-split`.
- First decomposition slice completed:
    - search wrappers extracted to `actions/services/searchDirectService.js`
    - reference-data wrappers extracted to `actions/services/referenceDataDirectService.js`
    - `searchService` and `referenceDataService` now route through these direct modules.
- `legacyActionsService` remains in place for non-migrated domains (portal/document/account/case/admin/notify/integration) pending next slices.

## Phase 5 status update (2026-03-13 — document slice)

- Added `actions/services/documentDirectService.js` and migrated `documentService.js` to route through it.
- `legacyActionsService` now remains for:
    - portal, account, case, admin, notify, integration domains.
- Search/reference/document grouped services now point at dedicated direct modules.

## Phase 5 completion status (2026-03-13)

- Grouped services now route through focused direct modules for all domains:
    - search, reference-data, document, portal, account, case, admin, integration, notify.
- `actions/services/legacyActionsService.js` has been removed.
- Current architecture baseline:
    - `actions/index.js` -> compatibility barrel re-exporting `actions/services` + core modules
    - `actions/services/*Service.js` -> grouped public service boundaries
    - `actions/services/*DirectService.js` -> implementation modules per domain
- Validation checkpoints completed:
    - zero `legacyActionsService` imports in `actions/services/*.js`
    - lint passes with warnings only
    - build succeeds

## Phase 6 hardening status (2026-03-13 — in progress)

- Working branch: `TASK21998-phase6-postphase5-hardening` (created from `SIPS-Development`).
- Main hardening actions completed so far:
    - Added focused parity test harness:
        - `tests/phase6/service-parity.test.cjs`
        - verifies grouped service import/export parity and `actions/services/index.js` re-export stability.
    - Added shared error-path helper:
        - `actions/services/httpServiceUtils.js`
        - consolidates repeated `consoleLogger + error.response` and `ErrResponse` generation patterns.
    - Applied safe duplication reduction in:
        - `searchDirectService.js`
        - `referenceDataDirectService.js`
        - `caseDirectService.js`
        - `adminDirectService.js`
    - Logging cleanup for sensitive/noisy service paths (removed debug `console.log` usage) in:
        - `searchDirectService.js`
        - `documentDirectService.js`
        - `portalDirectService.js`
        - `caseDirectService.js`
        - `adminDirectService.js`

### Current validation evidence

- `node tests/phase6/service-parity.test.cjs` -> pass
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
- `npm run lint` -> warnings only
- Targeted local smoke snapshots:
    - `GET /advancedsearch` and `GET /cy/advancedsearch` -> 200
    - `GET /case` and `GET /cy/case` -> 200
    - `GET /myportal` and `GET /cy/myportal` -> 307 redirect to `/auth/signin` (unauthenticated negative path)
    - `GET /api/file/getbloblistproxy?container=test&casefolderID=test` -> 400 (negative path)
    - `POST /api/email/notify` with empty payload -> 400 (negative path)

### Active caveat

- `GET /searchresults` and `GET /cy/searchresults` return 500 in current local dev run due pre-existing SSR serialization issue:
    - `initialState.search.searchString` is undefined in `getServerSideProps` payload.
    - captured in `/tmp/phase6-dev.log`.

## Phase 7 hardening status (2026-03-13)

- Working branch created from `origin/SIPS-Development`:
    - `TASK21988a-phase7-postphase6-hardening`
- Pre-existing search results SSR serialization issue now addressed:
    - `pages/searchresults.js`
    - changed `setSearch(query.q)` to `setSearch(query?.q || "")` in `getServerSideProps`.
    - local smoke result: both `/searchresults` and `/cy/searchresults` return 200 in this run.
- Behavioural test expansion delivered for remaining service domains:
    - `tests/phase7/service-behaviour.test.cjs`
    - covers document, portal, account, notify, integration.

### Phase 7 validation evidence snapshot

- `node tests/phase6/service-parity.test.cjs` -> pass
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
- `npm run lint` -> warnings only (existing react-hooks dependency warnings; no new lint errors)

### Phase 7 smoke/negative-path snapshot

- Dev server auto-bound to `localhost:3001` (3000 already in use).
- `GET /searchresults`, `GET /cy/searchresults` -> 200
- `GET /case`, `GET /cy/case` -> 200
- `GET /myportal`, `GET /cy/myportal` -> 307 redirect to `/auth/signin`
- `GET /api/file/getbloblistproxy?container=test&casefolderID=test` -> 400
- `POST /api/email/notify` with `{}` -> 400

### Testing strategy decision (captured)

- Current phase includes **both**:
    1. migration/parity guard tests,
    2. focused behavioural unit tests for critical response/error contracts.
- Broader behavioural coverage remains a follow-on expansion item after this focused baseline.

## Phase 8 hardening status (2026-03-13)

- Working branch created from `origin/SIPS-Development`:
    - `TASK22017-phase8-hardening-slice`
- Sensitive API hardening slice completed across:
    - `pages/api/file/deleteblobcase.js`
    - `pages/api/file/deleteblobrep.js`
    - `pages/api/file/createappealcompletemessage_api.js`
    - `pages/api/endpoint/getportallogin_api.js`
- Hash/integrity posture updates:
    - re-enabled hash validation on previously bypassed/commented file handlers
    - added standardized early 400 handling for missing/invalid hash and missing key params
    - preserved response-shape contracts and function signatures
- Logging discipline updates:
    - removed noisy direct `console.log` usage in `createappealcompletemessage_api`
    - routed error paths through `consoleLogger` in updated sensitive flow
- Required consumer parity updates applied:
    - `actions/services/documentDirectService.js`
        - now appends hash for `deleteblobcase` and `deleteblobrep` calls
    - `actions/services/portalDirectService.js`
        - now appends hash for `createappealcompletemessage_api` call using existing hash path contract

### Phase 8 validation evidence snapshot

- `node tests/phase6/service-parity.test.cjs` -> pass
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)

### Phase 8 manual HTTP snapshot

- Dev server on `http://localhost:3001`.
- Negative-path checks for invalid/missing hash (and missing required params where relevant) return **400** across all 4 target handlers.
- Valid-hash spot-check for `getportallogin_api` reached hash-validated path but still returned **400** due local upstream relay/CRM dependency behavior.

## Phase 9 hardening status (2026-03-13)

- Working branch created from `origin/SIPS-Development`:
    - `TASK22019-phase-9-hardening`
- Additional sensitive API hardening slice completed across:
    - `pages/api/file/createrepcompletemessage_api.js`
    - `pages/api/file/upload.js`
    - `pages/api/file/uploadsinglefile.js`
    - `pages/api/file/setupcontainer.js`
- Hash/integrity posture updates:
    - re-enabled/enforced hash checks in handlers where hash validation was bypassed/commented
    - standardized early 400 handling for missing/invalid hash and missing key query/body values
    - preserved response-shape contracts and function signatures
- Logging discipline updates:
    - removed noisy `console.log` traces from sensitive upload/rep-complete message paths
    - retained centralized error logging via `consoleLogger` where present
- Required caller parity updates applied:
    - `actions/services/portalDirectService.js`
        - `sendRepCompleteMessage` now appends hash
    - `actions/services/documentDirectService.js`
        - `uploadFiles`, `uploadRepFiles`, `uploadSingleFile` now append hash

### Phase 9 validation evidence snapshot

- `node tests/phase6/service-parity.test.cjs` -> pass
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)

### Phase 9 manual HTTP snapshot

- Negative-path checks for missing/invalid hash and invalid/missing key params on all 4 phase-9 handlers return **400** on local server (`localhost:3000`).
- Valid-hash happy-path spot-check completed using `.env.local` hash key:
    - `POST /api/file/uploadsinglefile?hash=<valid>` -> **200**

## Phase 10 hardening status (2026-03-13)

- Continued on branch:
    - `TASK22019-phase-9-hardening`
- Additional sensitive API hardening slice completed across:
    - `pages/api/file/getawaitingsubmissionfromblob.js`
    - `pages/api/file/getprogressobjblob.js`
    - `pages/api/file/getbloblist.js`
    - `pages/api/file/getrepsblob.js`
- Hash/integrity posture updates:
    - explicit early 400 guards for missing/empty required query inputs and hash
    - standardized early hash-mismatch 400 behaviour in all 4 handlers
    - preserved response-shape contracts and function signatures
- Logging discipline updates:
    - removed old commented debug traces in touched handlers
- Caller parity:
    - no additional service-layer updates required in this slice; existing direct services already append hash for these APIs.

### Phase 10 validation evidence snapshot

- `node tests/phase6/service-parity.test.cjs` -> pass
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)

### Phase 10 manual HTTP snapshot

- Missing-hash negative-path checks for all 4 handlers return **400** (`localhost:3000`).
- Valid-hash spot-check result:
    - `getbloblist` returned **500** with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).

## Phase 11 hardening status (2026-03-13)

- Continued on branch:
    - `TASK22019-phase-9-hardening`
- Additional sensitive API hardening slice completed across:
    - `pages/api/file/getbloblist.js`
    - `pages/api/file/deleteblob.js`
    - `pages/api/file/deleteawaitingsubmissionfromblob.js`
- Hash/integrity posture updates:
    - explicit early 400 guards for missing/empty required query inputs and hash
    - standardized early hash-mismatch 400 behaviour in all touched handlers
    - preserved response-shape contracts and function signatures
- Logging discipline updates:
    - removed old commented debug traces in touched handlers
- Caller parity:
    - no additional service-layer updates required in this slice.

### Phase 11 validation evidence snapshot

- `node tests/phase6/service-parity.test.cjs` -> pass
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)

### Phase 11 manual HTTP snapshot

- Missing/invalid-hash negative-path checks for selected handlers return **400** (`localhost:3000`).
- Valid-hash spot-check result:
    - `getbloblist` returned **500** with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).

## Phase 12 hardening status (2026-03-13)

- Continued on branch:
    - `TASK22019-phase-9-hardening`
- Additional sensitive API hardening slice completed across:
    - `pages/api/file/downloadblob.js`
    - `pages/api/file/getbloblistproxy.js`
    - `pages/api/file/getrepsblobproxy.js`
    - `pages/api/file/getawaitingsubmissionfromblobproxy.js`
- Hash/integrity posture updates:
    - explicit early 400 guards for missing/empty required query inputs
    - standardized early hash-mismatch 400 behaviour in `downloadblob`
    - preserved response-shape contracts and function signatures

### Phase 12 validation evidence snapshot

- `node tests/phase6/service-parity.test.cjs` -> pass
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)

### Phase 12 manual HTTP snapshot

- Missing/invalid-input negative-path checks for selected handlers return **400** (`localhost:3000`).
- Valid-hash spot-check result:
    - `downloadblob` returned **500** with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).

## Phase 13 hardening status (2026-03-13)

- Continued on branch:
    - `TASK22019-phase-9-hardening`
- Additional sensitive API hardening slice completed across:
    - `pages/api/file/deleteblobcase.js`
    - `pages/api/file/deleteblobrep.js`
    - `pages/api/file/createcaseinvolvement_api.js`
    - `pages/api/file/createrepinvolvement_api.js`
- Hash/integrity posture updates:
    - explicit early 400 guards for missing/empty required query/body inputs
    - standardized early hash-mismatch 400 behaviour in delete-blob handlers
    - preserved response-shape contracts and function signatures
- Logging discipline updates:
    - removed noisy direct body/query logging from involvement handlers

### Phase 13 validation evidence snapshot

- `node tests/phase6/service-parity.test.cjs` -> pass
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)

### Phase 13 manual HTTP snapshot

- Missing/invalid-input negative-path checks for selected handlers return **400** (`localhost:3000`).
- Valid-hash spot-check result:
    - `deleteblobcase` returned **500** with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).

## Phase 14 hardening status (2026-03-13)

- Continued on branch:
    - `TASK22019-phase-9-hardening`
- Addressed browser runtime error in authenticated new-appeal journey:
    - `TypeError` in `hashAPIPath` caused by client-side code attempting to parse server-only `HASHKEY`.
- Implemented server-side hash signing bridge for browser callers:
    - new endpoint `pages/api/endpoint/gethash_api.js`
    - session-gated (`getSession`), allow-listed supported API prefixes, returns `{ hash }`.
- Updated direct service callers to use signer endpoint instead of direct client hash computation:
    - `actions/services/documentDirectService.js`
    - `actions/services/portalDirectService.js`
- Maintained contract compatibility for target file APIs and existing response shapes.

### Phase 14 validation evidence snapshot

- phase6 parity/behaviour tests -> pass
- phase7/8/9/10/11/12/13 behaviour tests -> pass
- phase14 behaviour tests -> pass (4/4)
- lint -> warnings only (pre-existing hook dependency warnings)

## Phase 14 closeout follow-up status (2026-03-13)

- Continued on branch:
    - `TASK22019-phase-9-hardening`
- Browser-safe hash signing expanded for portal login flow:
    - `actions/services/accountDirectService.js`
        - `getPortalLogin` now requests signed hash from `/api/endpoint/gethash_api`
        - server fallback retained for non-browser contexts when `HASHKEY` is present
    - `pages/api/endpoint/gethash_api.js`
        - allow-list now includes `/api/endpoint/getportallogin_api`
- Contract alignment + runtime fix updates:
    - `pages/api/file/getrepsblob.js`
        - removed hard requirement for `casefolderID` to match actual route contract (`container + hash`)
    - `components/elements/index.js`
        - restored missing `updateLinks` import required by Quill-related runtime path

### Follow-up validation evidence

- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
- full previously-run phase6–phase14 suite remains passing
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` set)

### Active risk posture after follow-up

- Signer endpoint scope remains controlled by strict allow-list (single new path added).
- Response-shape contract stability preserved for touched handlers/services.
- Remaining risk is primarily external dependency behavior on valid-hash happy paths in local environments (relay/storage), not hash-bypass behavior.

## Phase 15 hardening status (2026-03-13)

- Working branch created from `origin/SIPS-Development`:
    - `TASK22028-phase15-hardening-slice`
- Delivered consistency-only hardening across 4 additional sensitive file handlers:
    - `pages/api/file/upload.js`
    - `pages/api/file/uploadsinglefile.js`
    - `pages/api/file/createappealcompletemessage_api.js`
    - `pages/api/file/setupcontainer.js`
- Hardening posture updates:
    - standardized explicit early 400 on missing hash where validation was already required
    - standardized early hash-mismatch return path style in `setupcontainer`
    - preserved response-shape/signature contracts (no intended contract changes)
- Added focused phase-15 tests:
    - `tests/phase15/service-behaviour.test.cjs`
    - negative-path checks for missing/invalid hash across all selected handlers
    - required-input negative-path checks where applicable
    - one valid-hash mocked happy-path check (`setupcontainer` response shape)

### Phase 15 validation evidence snapshot

- `node tests/phase6/service-parity.test.cjs` -> pass
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)

### Phase 15 manual HTTP snapshot

- Dev server run on `http://localhost:3002`.
- Missing/invalid hash negative-path checks for selected handlers -> **400**.
- Missing required params where applicable -> **400**.
- Valid-hash spot-check:
    - `GET /api/file/setupcontainer?ident=c1&hash=<valid>` -> **200**.

## Phase 16 hardening status (2026-03-13)

- Continued on branch:
    - `TASK22028-phase15-hardening-slice`
- Added a consistency-only file-proxy hardening slice across:
    - `pages/api/file/getbloblistproxy.js`
    - `pages/api/file/getrepsblobproxy.js`
    - `pages/api/file/getawaitingsubmissionfromblobproxy.js`
- Changes focused on:
    - standardized required-input guards via `hasValue`
    - removed unused imports/dead constants from touched proxy handlers
    - preserved existing response contracts and status semantics
- Added focused test pack:
    - `tests/phase16/service-behaviour.test.cjs`

### Phase 16 validation evidence snapshot

- phase6 parity + phase6–phase15 behavioural suites: pass
- phase16 behavioural suite: pass (4/4)
- lint: warnings only (pre-existing)

## Follow-up status (2026-03-13)

- Applied targeted signer allow-list fix for browser delete-awaiting-submission path.
- Updated `pages/api/endpoint/gethash_api.js` allow-list with:
    - `/api/file/deleteblobcase`
- Added focused behavioural test:
    - `tests/phase14/service-behaviour.test.cjs` now includes allow-list coverage for deleteblobcase path.

## Follow-up status (2026-03-13 — additional delete flows)

- Expanded signer allow-list for additional browser delete paths:
    - `/api/endpoint/deletemyrepresentations_api`
    - `/api/endpoint/deletewatchedcases_api`
    - `/api/file/deleteblobrep`
- Migrated affected direct-service delete calls to signer-based hash retrieval:
    - `portalDirectService.deleteWatchedCases`
    - `portalDirectService.deleteMyRepresentations`
    - `documentDirectService.deleteAwaitingSubmissionsFromBlob`
    - `documentDirectService.deleteMyRepresentationsFromBlob`

## Follow-up status (2026-03-13 — myportal + i18n alignment)

- Updated myportal representation delete call sites to pass `caseRef`:
    - `components/myportal/topthree_reps.js`
    - `components/myportal/viewall.js`
- Applied small view-all presentation cleanup and watched-case refresh filtering adjustment.
- Added missing `myportal` namespace mapping in `i18n.js` for `/newappeal/[appealtypes]`.

## Likely next steps

1. Stabilize and simplify breadcrumb/back-link decision logic with focused regression checks.
2. Standardize hash-check enforcement patterns across file and endpoint APIs.
3. Reduce verbose logging in sensitive flows (auth/email/file/account).
4. Expand automated tests for navigation and representation eligibility edge-cases (currently minimal `tests/`).

See `memory-bank/refactor-backlog.md` for the prioritized refactor plan and sequencing.
Priority 1 detailed execution plan is documented in `memory-bank/refactor-plan-actions-index.md`.

## Areas currently important for contributors

- `components/breadcrumbs.js`
- `components/case/summary.js`
- `pages/api/endpoint/**`
- `pages/api/file/**`
- `pages/api/auth/[...nextauth].js`
- `pages/api/email/notify.js`
- `next.config.js`, `i18n.js`, `locales/**`