pedwfrontend/memory-bank/activeContext.md

Active Context — PEDW FrontEnd

Current development focus (from recent commits)

• Search/case navigation correctness, especially breadcrumb and back-link behavior.
• My Portal "view all" and DNS application path handling.
• Welsh/English email behavior for specific notification templates.
• PDF output formatting and hyperlink behavior.

Recently changed areas (high signal)

• components/breadcrumbs.js
• components/case/summary.js
• components/search/searchresults.js
• components/search/addresssearchresults.js
• components/myportal/viewall.js
• pages/myportal/case/[ticketnumber].js
• pages/api/email/notify.js
• actions/index.js
• actions/core/env.js
• actions/core/logger.js
• actions/core/hash.js
• actions/core/token.js
• actions/core/headers.js
• actions/services/legacyActionsService.js
• i18n.js

Active concerns

• Breadcrumb and route-state logic is complex and query-dependent (va, adv, ads, key), so regressions are easy.
• Locale-specific route and label behavior is still a high-risk area due to rewrite + component logic coupling.
• Sensitive logging remains present in auth/email/actions paths and should be reduced/redacted over time.
• Hash validation on some file endpoints appears inconsistent (some checks active, some commented), requiring careful change discipline.

Refactor status update (2026-03-12)

• Priority 1 refactor (Phase 1) is in place:
  • actions/index.js now acts as a compatibility barrel.
  • Core helper concerns were extracted into actions/core/*.
  • Existing API/file/domain wrappers were moved into actions/services/legacyActionsService.js with backward-compatible exports retained via the barrel.
• No intentional behavior changes were introduced in this phase; focus was structural risk reduction.
• Priority 1 refactor (Phase 2) is now in place:
  • Domain service grouping modules added under actions/services/*.
  • actions/services/index.js now provides grouped service barrel exports.
  • actions/index.js now re-exports from ./services and ./core/* while preserving existing public action names.
• legacyActionsService remains as a compatibility backing module and should be slimmed in later increments as consumers move to direct service imports.

Refactor status update (Priority 1 execution pass — 2026-03-12)

• Completed an additional Priority 1 consumer-migration pass focused on high-use portal/form helpers.
• Updated these files to use focused service/core imports instead of broad actions barrel imports:
  • components/case/representation/representationElements.js
  • components/elements/index.js
  • components/utils/index.js
  • lib/newappeal/loadNewAppealPage.js
  • lib/myportal/loadMyPortalAppealPage.js
  • components/myportal/topthree.js
  • components/myportal/topthree_reps.js
  • components/myportal/awaitingsubmissionfromblob.js
• Compatibility model remains in place via actions/index.js; migration is incremental and non-breaking by design.

Refactor status update (Priority 1 execution pass — viewall/search/unsubscribe)

• Completed another focused import migration pass to reduce broad actions barrel coupling in user-facing high-use areas:
  • components/myportal/viewall.js
  • components/search/addresssearchresults.js
  • pages/unsubscribe/[watchlistid].js
  • pages/unsubscribeall/[watchlistid].js
• These files now use explicit imports from actions/services/* and actions/core/* modules.
• Remaining non-comment broad actions imports are now primarily in selected pages/api/endpoint/* and pages/api/file/* handlers.

Refactor status update (Priority 1 execution pass — endpoint/file proxies)

• Completed focused import migration for selected endpoint and file proxy handlers:
  • pages/api/endpoint/getmylpacases_api.js
  • pages/api/endpoint/getbasicdnssearchpaged_api.js
  • pages/api/endpoint/getsearchdocumentdetailspaged_api.js
  • pages/api/endpoint/getbasicsearchpaged_api.js
  • pages/api/file/getawaitingsubmissionfromblobproxy.js
  • pages/api/file/getrepsblobproxy.js
  • pages/api/file/getbloblistproxy.js
  • pages/api/file/createappealcompletemessageproxy_api.js
• Replaced broad ../../../actions imports with focused actions/core/* and service-module imports.
• Eliminated duplicated local hash helper in getmylpacases_api.js by reusing shared actions/core/hash.
• Current broad-import scan indicates only comment-only legacy references remain.

Delivery handover status (2026-03-13)

• Current import-migration wave has been checked in and completed through PR.
• This branch is now treated as the completed migration baseline.
• Next implementation chunk should start on a new branch and target decomposition of actions/services/legacyActionsService.js.
• Immediate focus for next branch:
  1. extract low-risk reference/search wrappers into direct service/client modules,
  2. migrate portal/document internals in small parity-checked batches,
  3. slim compatibility layer once parity is proven.

Phase 5 kickoff status (2026-03-13)

• Branch in progress: TASK21997-phase5-legacyactions-split.
• First decomposition slice completed:
  • search wrappers extracted to actions/services/searchDirectService.js
  • reference-data wrappers extracted to actions/services/referenceDataDirectService.js
  • searchService and referenceDataService now route through these direct modules.
• legacyActionsService remains in place for non-migrated domains (portal/document/account/case/admin/notify/integration) pending next slices.

Phase 5 status update (2026-03-13 — document slice)

• Added actions/services/documentDirectService.js and migrated documentService.js to route through it.
• legacyActionsService now remains for:
  • portal, account, case, admin, notify, integration domains.
• Search/reference/document grouped services now point at dedicated direct modules.

Phase 5 completion status (2026-03-13)

• Grouped services now route through focused direct modules for all domains:
  • search, reference-data, document, portal, account, case, admin, integration, notify.
• actions/services/legacyActionsService.js has been removed.
• Current architecture baseline:
  • actions/index.js -> compatibility barrel re-exporting actions/services + core modules
  • actions/services/*Service.js -> grouped public service boundaries
  • actions/services/*DirectService.js -> implementation modules per domain
• Validation checkpoints completed:
  • zero legacyActionsService imports in actions/services/*.js
  • lint passes with warnings only
  • build succeeds

Phase 6 hardening status (2026-03-13 — in progress)

• Working branch: TASK21998-phase6-postphase5-hardening (created from SIPS-Development).
• Main hardening actions completed so far:
  • Added focused parity test harness:
    • tests/phase6/service-parity.test.cjs
    • verifies grouped service import/export parity and actions/services/index.js re-export stability.
  • Added shared error-path helper:
    • actions/services/httpServiceUtils.js
    • consolidates repeated consoleLogger + error.response and ErrResponse generation patterns.
  • Applied safe duplication reduction in:
    • searchDirectService.js
    • referenceDataDirectService.js
    • caseDirectService.js
    • adminDirectService.js
  • Logging cleanup for sensitive/noisy service paths (removed debug console.log usage) in:
    • searchDirectService.js
    • documentDirectService.js
    • portalDirectService.js
    • caseDirectService.js
    • adminDirectService.js

Current validation evidence

• node tests/phase6/service-parity.test.cjs -> pass
• node tests/phase6/service-behaviour.test.cjs -> pass (8/8)
• npm run lint -> warnings only
• Targeted local smoke snapshots:
  • GET /advancedsearch and GET /cy/advancedsearch -> 200
  • GET /case and GET /cy/case -> 200
  • GET /myportal and GET /cy/myportal -> 307 redirect to /auth/signin (unauthenticated negative path)
  • GET /api/file/getbloblistproxy?container=test&casefolderID=test -> 400 (negative path)
  • POST /api/email/notify with empty payload -> 400 (negative path)

Active caveat

• GET /searchresults and GET /cy/searchresults return 500 in current local dev run due pre-existing SSR serialization issue:
  • initialState.search.searchString is undefined in getServerSideProps payload.
  • captured in /tmp/phase6-dev.log.

Phase 7 hardening status (2026-03-13)

• Working branch created from origin/SIPS-Development:
  • TASK21988a-phase7-postphase6-hardening
• Pre-existing search results SSR serialization issue now addressed:
  • pages/searchresults.js
  • changed setSearch(query.q) to setSearch(query?.q || "") in getServerSideProps.
  • local smoke result: both /searchresults and /cy/searchresults return 200 in this run.
• Behavioural test expansion delivered for remaining service domains:
  • tests/phase7/service-behaviour.test.cjs
  • covers document, portal, account, notify, integration.

Phase 7 validation evidence snapshot

• node tests/phase6/service-parity.test.cjs -> pass
• node tests/phase6/service-behaviour.test.cjs -> pass (8/8)
• node tests/phase7/service-behaviour.test.cjs -> pass (10/10)
• npm run lint -> warnings only (existing react-hooks dependency warnings; no new lint errors)

Phase 7 smoke/negative-path snapshot

• Dev server auto-bound to localhost:3001 (3000 already in use).
• GET /searchresults, GET /cy/searchresults -> 200
• GET /case, GET /cy/case -> 200
• GET /myportal, GET /cy/myportal -> 307 redirect to /auth/signin
• GET /api/file/getbloblistproxy?container=test&casefolderID=test -> 400
• POST /api/email/notify with {} -> 400

Testing strategy decision (captured)

• Current phase includes both:
  1. migration/parity guard tests,
  2. focused behavioural unit tests for critical response/error contracts.
• Broader behavioural coverage remains a follow-on expansion item after this focused baseline.

Phase 8 hardening status (2026-03-13)

• Working branch created from origin/SIPS-Development:
  • TASK22017-phase8-hardening-slice
• Sensitive API hardening slice completed across:
  • pages/api/file/deleteblobcase.js
  • pages/api/file/deleteblobrep.js
  • pages/api/file/createappealcompletemessage_api.js
  • pages/api/endpoint/getportallogin_api.js
• Hash/integrity posture updates:
  • re-enabled hash validation on previously bypassed/commented file handlers
  • added standardized early 400 handling for missing/invalid hash and missing key params
  • preserved response-shape contracts and function signatures
• Logging discipline updates:
  • removed noisy direct console.log usage in createappealcompletemessage_api
  • routed error paths through consoleLogger in updated sensitive flow
• Required consumer parity updates applied:
  • actions/services/documentDirectService.js
    • now appends hash for deleteblobcase and deleteblobrep calls
  • actions/services/portalDirectService.js
    • now appends hash for createappealcompletemessage_api call using existing hash path contract

Phase 8 validation evidence snapshot

• node tests/phase6/service-parity.test.cjs -> pass
• node tests/phase6/service-behaviour.test.cjs -> pass (8/8)
• node tests/phase7/service-behaviour.test.cjs -> pass (10/10)
• node tests/phase8/service-behaviour.test.cjs -> pass (5/5)
• npm run lint -> warnings only (pre-existing hook dependency warnings)

Phase 8 manual HTTP snapshot

• Dev server on http://localhost:3001.
• Negative-path checks for invalid/missing hash (and missing required params where relevant) return 400 across all 4 target handlers.
• Valid-hash spot-check for getportallogin_api reached hash-validated path but still returned 400 due local upstream relay/CRM dependency behavior.

Phase 9 hardening status (2026-03-13)

• Working branch created from origin/SIPS-Development:
  • TASK22019-phase-9-hardening
• Additional sensitive API hardening slice completed across:
  • pages/api/file/createrepcompletemessage_api.js
  • pages/api/file/upload.js
  • pages/api/file/uploadsinglefile.js
  • pages/api/file/setupcontainer.js
• Hash/integrity posture updates:
  • re-enabled/enforced hash checks in handlers where hash validation was bypassed/commented
  • standardized early 400 handling for missing/invalid hash and missing key query/body values
  • preserved response-shape contracts and function signatures
• Logging discipline updates:
  • removed noisy console.log traces from sensitive upload/rep-complete message paths
  • retained centralized error logging via consoleLogger where present
• Required caller parity updates applied:
  • actions/services/portalDirectService.js
    • sendRepCompleteMessage now appends hash
  • actions/services/documentDirectService.js
    • uploadFiles, uploadRepFiles, uploadSingleFile now append hash

Phase 9 validation evidence snapshot

• node tests/phase6/service-parity.test.cjs -> pass
• node tests/phase6/service-behaviour.test.cjs -> pass (8/8)
• node tests/phase7/service-behaviour.test.cjs -> pass (10/10)
• node tests/phase8/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase9/service-behaviour.test.cjs -> pass (5/5)
• npm run lint -> warnings only (pre-existing hook dependency warnings)

Phase 9 manual HTTP snapshot

• Negative-path checks for missing/invalid hash and invalid/missing key params on all 4 phase-9 handlers return 400 on local server (localhost:3000).
• Valid-hash happy-path spot-check completed using .env.local hash key:
  • POST /api/file/uploadsinglefile?hash=<valid> -> 200

Phase 10 hardening status (2026-03-13)

• Continued on branch:
  • TASK22019-phase-9-hardening
• Additional sensitive API hardening slice completed across:
  • pages/api/file/getawaitingsubmissionfromblob.js
  • pages/api/file/getprogressobjblob.js
  • pages/api/file/getbloblist.js
  • pages/api/file/getrepsblob.js
• Hash/integrity posture updates:
  • explicit early 400 guards for missing/empty required query inputs and hash
  • standardized early hash-mismatch 400 behaviour in all 4 handlers
  • preserved response-shape contracts and function signatures
• Logging discipline updates:
  • removed old commented debug traces in touched handlers
• Caller parity:
  • no additional service-layer updates required in this slice; existing direct services already append hash for these APIs.

Phase 10 validation evidence snapshot

• node tests/phase6/service-parity.test.cjs -> pass
• node tests/phase6/service-behaviour.test.cjs -> pass (8/8)
• node tests/phase7/service-behaviour.test.cjs -> pass (10/10)
• node tests/phase8/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase9/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase10/service-behaviour.test.cjs -> pass (5/5)
• npm run lint -> warnings only (pre-existing hook dependency warnings)

Phase 10 manual HTTP snapshot

• Missing-hash negative-path checks for all 4 handlers return 400 (localhost:3000).
• Valid-hash spot-check result:
  • getbloblist returned 500 with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).

Phase 11 hardening status (2026-03-13)

• Continued on branch:
  • TASK22019-phase-9-hardening
• Additional sensitive API hardening slice completed across:
  • pages/api/file/getbloblist.js
  • pages/api/file/deleteblob.js
  • pages/api/file/deleteawaitingsubmissionfromblob.js
• Hash/integrity posture updates:
  • explicit early 400 guards for missing/empty required query inputs and hash
  • standardized early hash-mismatch 400 behaviour in all touched handlers
  • preserved response-shape contracts and function signatures
• Logging discipline updates:
  • removed old commented debug traces in touched handlers
• Caller parity:
  • no additional service-layer updates required in this slice.

Phase 11 validation evidence snapshot

• node tests/phase6/service-parity.test.cjs -> pass
• node tests/phase6/service-behaviour.test.cjs -> pass (8/8)
• node tests/phase7/service-behaviour.test.cjs -> pass (10/10)
• node tests/phase8/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase9/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase10/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase11/service-behaviour.test.cjs -> pass (4/4)
• npm run lint -> warnings only (pre-existing hook dependency warnings)

Phase 11 manual HTTP snapshot

• Missing/invalid-hash negative-path checks for selected handlers return 400 (localhost:3000).
• Valid-hash spot-check result:
  • getbloblist returned 500 with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).

Phase 12 hardening status (2026-03-13)

• Continued on branch:
  • TASK22019-phase-9-hardening
• Additional sensitive API hardening slice completed across:
  • pages/api/file/downloadblob.js
  • pages/api/file/getbloblistproxy.js
  • pages/api/file/getrepsblobproxy.js
  • pages/api/file/getawaitingsubmissionfromblobproxy.js
• Hash/integrity posture updates:
  • explicit early 400 guards for missing/empty required query inputs
  • standardized early hash-mismatch 400 behaviour in downloadblob
  • preserved response-shape contracts and function signatures

Phase 12 validation evidence snapshot

• node tests/phase6/service-parity.test.cjs -> pass
• node tests/phase6/service-behaviour.test.cjs -> pass (8/8)
• node tests/phase7/service-behaviour.test.cjs -> pass (10/10)
• node tests/phase8/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase9/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase10/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase11/service-behaviour.test.cjs -> pass (4/4)
• node tests/phase12/service-behaviour.test.cjs -> pass (4/4)
• npm run lint -> warnings only (pre-existing hook dependency warnings)

Phase 12 manual HTTP snapshot

• Missing/invalid-input negative-path checks for selected handlers return 400 (localhost:3000).
• Valid-hash spot-check result:
  • downloadblob returned 500 with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).

Phase 13 hardening status (2026-03-13)

• Continued on branch:
  • TASK22019-phase-9-hardening
• Additional sensitive API hardening slice completed across:
  • pages/api/file/deleteblobcase.js
  • pages/api/file/deleteblobrep.js
  • pages/api/file/createcaseinvolvement_api.js
  • pages/api/file/createrepinvolvement_api.js
• Hash/integrity posture updates:
  • explicit early 400 guards for missing/empty required query/body inputs
  • standardized early hash-mismatch 400 behaviour in delete-blob handlers
  • preserved response-shape contracts and function signatures
• Logging discipline updates:
  • removed noisy direct body/query logging from involvement handlers

Phase 13 validation evidence snapshot

• node tests/phase6/service-parity.test.cjs -> pass
• node tests/phase6/service-behaviour.test.cjs -> pass (8/8)
• node tests/phase7/service-behaviour.test.cjs -> pass (10/10)
• node tests/phase8/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase9/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase10/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase11/service-behaviour.test.cjs -> pass (4/4)
• node tests/phase12/service-behaviour.test.cjs -> pass (4/4)
• node tests/phase13/service-behaviour.test.cjs -> pass (7/7)
• npm run lint -> warnings only (pre-existing hook dependency warnings)

Phase 13 manual HTTP snapshot

• Missing/invalid-input negative-path checks for selected handlers return 400 (localhost:3000).
• Valid-hash spot-check result:
  • deleteblobcase returned 500 with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).

Phase 14 hardening status (2026-03-13)

• Continued on branch:
  • TASK22019-phase-9-hardening
• Addressed browser runtime error in authenticated new-appeal journey:
  • TypeError in hashAPIPath caused by client-side code attempting to parse server-only HASHKEY.
• Implemented server-side hash signing bridge for browser callers:
  • new endpoint pages/api/endpoint/gethash_api.js
  • session-gated (getSession), allow-listed supported API prefixes, returns { hash }.
• Updated direct service callers to use signer endpoint instead of direct client hash computation:
  • actions/services/documentDirectService.js
  • actions/services/portalDirectService.js
• Maintained contract compatibility for target file APIs and existing response shapes.

Phase 14 validation evidence snapshot

• phase6 parity/behaviour tests -> pass
• phase7/8/9/10/11/12/13 behaviour tests -> pass
• phase14 behaviour tests -> pass (4/4)
• lint -> warnings only (pre-existing hook dependency warnings)

Phase 14 closeout follow-up status (2026-03-13)

• Continued on branch:
  • TASK22019-phase-9-hardening
• Browser-safe hash signing expanded for portal login flow:
  • actions/services/accountDirectService.js
    • getPortalLogin now requests signed hash from /api/endpoint/gethash_api
    • server fallback retained for non-browser contexts when HASHKEY is present
  • pages/api/endpoint/gethash_api.js
    • allow-list now includes /api/endpoint/getportallogin_api
• Contract alignment + runtime fix updates:
  • pages/api/file/getrepsblob.js
    • removed hard requirement for casefolderID to match actual route contract (container + hash)
  • components/elements/index.js
    • restored missing updateLinks import required by Quill-related runtime path

Follow-up validation evidence

• node tests/phase7/service-behaviour.test.cjs -> pass (10/10)
• node tests/phase14/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase9/service-behaviour.test.cjs -> pass (5/5)
• full previously-run phase6–phase14 suite remains passing
• npm run lint -> warnings only (pre-existing react-hooks/exhaustive-deps set)

Active risk posture after follow-up

• Signer endpoint scope remains controlled by strict allow-list (single new path added).
• Response-shape contract stability preserved for touched handlers/services.
• Remaining risk is primarily external dependency behavior on valid-hash happy paths in local environments (relay/storage), not hash-bypass behavior.

Phase 15 hardening status (2026-03-13)

• Working branch created from origin/SIPS-Development:
  • TASK22028-phase15-hardening-slice
• Delivered consistency-only hardening across 4 additional sensitive file handlers:
  • pages/api/file/upload.js
  • pages/api/file/uploadsinglefile.js
  • pages/api/file/createappealcompletemessage_api.js
  • pages/api/file/setupcontainer.js
• Hardening posture updates:
  • standardized explicit early 400 on missing hash where validation was already required
  • standardized early hash-mismatch return path style in setupcontainer
  • preserved response-shape/signature contracts (no intended contract changes)
• Added focused phase-15 tests:
  • tests/phase15/service-behaviour.test.cjs
  • negative-path checks for missing/invalid hash across all selected handlers
  • required-input negative-path checks where applicable
  • one valid-hash mocked happy-path check (setupcontainer response shape)

Phase 15 validation evidence snapshot

• node tests/phase6/service-parity.test.cjs -> pass
• node tests/phase6/service-behaviour.test.cjs -> pass (8/8)
• node tests/phase7/service-behaviour.test.cjs -> pass (10/10)
• node tests/phase8/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase9/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase10/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase11/service-behaviour.test.cjs -> pass (4/4)
• node tests/phase12/service-behaviour.test.cjs -> pass (4/4)
• node tests/phase13/service-behaviour.test.cjs -> pass (7/7)
• node tests/phase14/service-behaviour.test.cjs -> pass (5/5)
• node tests/phase15/service-behaviour.test.cjs -> pass (5/5)
• npm run lint -> warnings only (pre-existing react-hooks/exhaustive-deps warnings)

Phase 15 manual HTTP snapshot

• Dev server run on http://localhost:3002.
• Missing/invalid hash negative-path checks for selected handlers -> 400.
• Missing required params where applicable -> 400.
• Valid-hash spot-check:
  • GET /api/file/setupcontainer?ident=c1&hash=<valid> -> 200.

Phase 16 hardening status (2026-03-13)

• Continued on branch:
  • TASK22028-phase15-hardening-slice
• Added a consistency-only file-proxy hardening slice across:
  • pages/api/file/getbloblistproxy.js
  • pages/api/file/getrepsblobproxy.js
  • pages/api/file/getawaitingsubmissionfromblobproxy.js
• Changes focused on:
  • standardized required-input guards via hasValue
  • removed unused imports/dead constants from touched proxy handlers
  • preserved existing response contracts and status semantics
• Added focused test pack:
  • tests/phase16/service-behaviour.test.cjs

Phase 16 validation evidence snapshot

• phase6 parity + phase6–phase15 behavioural suites: pass
• phase16 behavioural suite: pass (4/4)
• lint: warnings only (pre-existing)

Follow-up status (2026-03-13)

• Applied targeted signer allow-list fix for browser delete-awaiting-submission path.
• Updated pages/api/endpoint/gethash_api.js allow-list with:
  • /api/file/deleteblobcase
• Added focused behavioural test:
  • tests/phase14/service-behaviour.test.cjs now includes allow-list coverage for deleteblobcase path.

Follow-up status (2026-03-13 — additional delete flows)

• Expanded signer allow-list for additional browser delete paths:
  • /api/endpoint/deletemyrepresentations_api
  • /api/endpoint/deletewatchedcases_api
  • /api/file/deleteblobrep
• Migrated affected direct-service delete calls to signer-based hash retrieval:
  • portalDirectService.deleteWatchedCases
  • portalDirectService.deleteMyRepresentations
  • documentDirectService.deleteAwaitingSubmissionsFromBlob
  • documentDirectService.deleteMyRepresentationsFromBlob

Likely next steps

1. Stabilize and simplify breadcrumb/back-link decision logic with focused regression checks.
2. Standardize hash-check enforcement patterns across file and endpoint APIs.
3. Reduce verbose logging in sensitive flows (auth/email/file/account).
4. Expand automated tests for navigation and representation eligibility edge-cases (currently minimal tests/).

See memory-bank/refactor-backlog.md for the prioritized refactor plan and sequencing. Priority 1 detailed execution plan is documented in memory-bank/refactor-plan-actions-index.md.

Areas currently important for contributors

• components/breadcrumbs.js
• components/case/summary.js
• pages/api/endpoint/**
• pages/api/file/**
• pages/api/auth/[...nextauth].js
• pages/api/email/notify.js
• next.config.js, i18n.js, locales/**