Rehydrate docs for Paper backend gap delivery wave

Update STATUS.md, TESTING_GUIDE.md, IMPLEMENTATION_MASTERPLAN.md,
MANUAL_TEST_CHECKLIST.md, GOLDEN_PRINCIPLES.md, and ISSUE_EXECUTION_GUIDE.md
to reflect round 3 adversarial review findings and fixes across all 10 Paper
backend gap PRs (#1031-#1040): 3 critical bugs fixed (seal-day race,
tomorrow-note phantom data, card-history case mismatch), 8 important issues
resolved, test counts updated (~460→~465), manual test checklist expanded
with Today dossier and Review deep-dive API spot checks.

Author: Chris0Jeky

docs/GOLDEN_PRINCIPLES.md

@@ -1,6 +1,6 @@
 # Taskdeck Golden Principles
 
-Last Updated: 2026-04-25
+Last Updated: 2026-04-26
 Companion Active Docs:
 - `docs/STATUS.md`
 - `docs/IMPLEMENTATION_MASTERPLAN.md`

docs/IMPLEMENTATION_MASTERPLAN.md

@@ -45,9 +45,11 @@ Paper backend gap delivery (2026-04-26, PRs `#1031`--`#1040`, 10 issues `#1015`-
 - 10 backend endpoints delivered for the Paper UI surfaces (PAPER-08 Today dossier + PAPER-06 Review deep-dive), closing all `paper-*-backend-gap-*` issues
 - Today dossier: cadence aggregation (`#1015`/`#1031`), 90-day streak query (`#1016`/`#1032`), seal-day action with EF migration (`#1017`/`#1037`), line-for-tomorrow autosave (`#1018`/`#1035`)
 - Review deep-dive: provenance rows with FK migration (`#1019`/`#1039`), 7-category side-effect analysis (`#1020`/`#1033`), 4-component confidence breakdown (`#1021`/`#1036`), conflict detection with 7 rules (`#1022`/`#1040`), card history ledger (`#1023`/`#1034`), similar past decisions with apply rate (`#1024`/`#1038`)
-- ~460 new backend tests across domain, application, and API layers
-- Two rounds of adversarial review per PR; Gemini Code Assist and Codex connector bot findings addressed on all 10 PRs
-- Key review fixes: 100k entity memory risk replaced with server-side GROUP BY (`#1032`), P1 false-warning for create-card ops (`#1040`), board-scoped similar-decision query (`#1038`), UnitOfWork unique constraint handlers for DailySnapshot/TomorrowNote (`#1037`/`#1035`), CancellationToken threading, reach formula correction (`#1036`), FK enforcement for provenance (`#1039`), entity caching in conflict detector (`#1040`)
+- ~465 new backend tests across domain, application, and API layers
+- Three rounds of adversarial review per PR; Gemini Code Assist and Codex connector bot findings addressed on all 10 PRs
+- Round 2 key fixes: 100k entity memory risk replaced with server-side GROUP BY (`#1032`), P1 false-warning for create-card ops (`#1040`), board-scoped similar-decision query (`#1038`), UnitOfWork unique constraint handlers for DailySnapshot/TomorrowNote (`#1037`/`#1035`), CancellationToken threading, reach formula correction (`#1036`), FK enforcement for provenance (`#1039`), entity caching in conflict detector (`#1040`)
+- Round 3 critical fixes: concurrent seal race fabricated response data fixed with re-fetch after save (`#1037`), tomorrow-note phantom data on conflict recovery fixed with last-writer-wins re-fetch (`#1035`), card-history case-sensitive `"Card"` vs `"card"` TargetType mismatch silently breaking related proposal lookups (`#1034`)
+- Round 3 important fixes: PeakHour range validation on CadenceSnapshot (`#1031`), exhaustive `ProvenanceKind` switch in `MapWeight` (`#1039`), removed unused `userId` param from `ISideEffectAnalyzer` (`#1033`), `SideEffectTone` enum range validation (`#1033`), immutable `IReadOnlyDictionary` for confidence component weights (`#1036`), `AsNoTracking()` on similar-past read-only queries (`#1038`), dead `CardHistoryRow` domain entity removal (`#1034`), `date == default` validation guard (`#1035`)
 - New shared infrastructure: `TodayController`, `DailySnapshot` entity + repository, `TomorrowNote` entity + repository, `CountByDateAsync` aggregate audit query, `GetTerminalByActionTypeAsync` and `GetPendingByOperationTargetAsync` proposal repository methods
 
 Latest tooling addition (2026-04-25):

docs/ISSUE_EXECUTION_GUIDE.md

@@ -1,6 +1,6 @@
 # Issue Execution Guide
 
-Last Updated: 2026-04-25
+Last Updated: 2026-04-26
 Scope: How agents should execute the GitHub issue backlog safely, in dependency order, and with explicit priority discipline.
 
 ## Purpose

docs/MANUAL_TEST_CHECKLIST.md

@@ -2,7 +2,7 @@
 
 Use this checklist to manually validate current Taskdeck behavior on `main`.
 
-Last Updated: 2026-04-25
+Last Updated: 2026-04-26
 Companion Active Docs:
 - `docs/STATUS.md`
 - `docs/IMPLEMENTATION_MASTERPLAN.md`
@@ -98,6 +98,11 @@ Manual-only checks (non-automatable in generic local script):
    - Bug fixed (`#681`/`#691`): feature flags for shipped surfaces now default to `true`.
 5. Open `/workspace/today`.
    - Expected: agenda shows review/triage/overdue/due-today/blocked summary cards and the onboarding loop block.
+   - **Today dossier API spot checks** (Paper backend gap `#1015`–`#1018`, PRs `#1031`/`#1032`/`#1037`/`#1035`):
+     - `GET /api/today/cadence?date=2026-04-26` → 200 with 24 hourly buckets (all zero if no activity).
+     - `GET /api/today/streak?days=90` → 200 with `days[]`, `currentStreakLength`, `longestStreakLength`, `intensityBuckets`.
+     - `POST /api/today/seal` with `{"date":"2026-04-26"}` → 200 with `sealedAt`; repeat → 200 with `wasAlreadySealed: true`.
+     - `PUT /api/today/tomorrow-note` with `{"date":"2026-04-26","text":"test"}` → 200; `GET /api/today/tomorrow-note?date=2026-04-26` → 200 with text; `GET` for missing date → 204 NoContent.
 5. Start `Start Useful Board` from `Home` or `Today`, pick a starter shape, and create a board.
    - Expected: board opens immediately; when a starter pack applies successfully, the starter workflow is present, and when it fails, the board still opens with a warning.
 6. Dismiss onboarding from `Home` or `Today`, refresh, then replay it.
@@ -231,6 +236,13 @@ Manual-only checks (non-automatable in generic local script):
 11. Verify applied proposals are hidden by default; use clear/dismiss action to manage them.
 12. Verify expired proposal handling in Review:
     - Expected: expired proposals show distinct "Expired" status badge — not "Approved, ready to apply".
+13. **Review deep-dive API spot checks** (Paper backend gap `#1019`–`#1024`, PRs `#1039`/`#1033`/`#1036`/`#1040`/`#1034`/`#1038`):
+    - `GET /api/automation/proposals/{id}/provenance` → 200 with `ProvenanceRowDto[]` (icon/key/value/weight); empty `[]` if no provenance data.
+    - `GET /api/automation/proposals/{id}/side-effects` → 200 with 7 categories (Cards/Subtasks/Comments/Activity/Notifications/Webhooks/Calendar), each with tone and description; reversibility window object.
+    - `GET /api/automation/proposals/{id}/confidence` → 200 with 4-component breakdown (Pattern match/Reach/Reversibility/Recency), overall score, threshold, note.
+    - `GET /api/automation/proposals/{id}/conflicts` → 200 with conflict rows (tone: Warn/Info/Ok) from 7 detection rules; sorted Warn→Info→Ok.
+    - `GET /api/automation/proposals/{id}/history` → 200 with per-card touch history (serial/event/age/status); bounded at 500 total entries.
+    - `GET /api/automation/proposals/{id}/similar-past` → 200 with up to 3 nearest-neighbour prior decisions and apply rate.
     - Expected: expired proposals have a Dismiss button and explanatory notice.
     - Expected: dismissing an expired proposal removes it from the review list.
     - Expected: Apply/Approve buttons are not shown for expired proposals.

docs/STATUS.md

@@ -24,19 +24,20 @@ Rebranding thesis (2026-02-23):
 - product value is reducing maintenance overhead, not maximizing opaque autonomy
 
 Paper backend gap delivery (2026-04-26, PRs `#1031`--`#1040`, 10 issues `#1015`--`#1024`):
-- All 10 Paper backend gaps delivered with two rounds of adversarial review per PR; ~460 new backend tests; bot review findings (Gemini Code Assist + Codex connector) addressed on all PRs
+- All 10 Paper backend gaps delivered with three rounds of adversarial review per PR; ~465 new backend tests; bot review findings (Gemini Code Assist + Codex connector) addressed on all PRs; round 3 review found and fixed 3 critical bugs, 8 important issues across 8 PRs
 - **Today dossier backends** (4 endpoints on `TodayController`, required by PAPER-08 `#1004`):
-  - Cadence aggregation (`#1015`/`#1031`): `GET /api/today/cadence?date=` returns 24-hour activity buckets with first/peak/last action timestamps; `CadenceBucket` and `CadenceSnapshot` value objects with cached `Empty()` singleton; queries `IAuditLogRepository`; 26 tests
+  - Cadence aggregation (`#1015`/`#1031`): `GET /api/today/cadence?date=` returns 24-hour activity buckets with first/peak/last action timestamps; `CadenceBucket` and `CadenceSnapshot` value objects with cached `Empty()` singleton; queries `IAuditLogRepository`; round 3 review added `PeakHour` range validation (0-23) to `CadenceSnapshot` constructor; 27 tests
   - Streak query (`#1016`/`#1032`): `GET /api/today/streak?days=90` returns 90-day streak with intensity buckets (quartile-based) and current/longest streak lengths; `StreakDay`/`StreakResult` value objects; server-side `GROUP BY` via `CountByDateAsync` (replaced 100k entity load after review); 61 tests
-  - Seal day action (`#1017`/`#1037`): `POST /api/today/seal` and `GET /api/today/seal?date=` for idempotent day-sealing with `DailySnapshot` entity; EF Core migration with unique index on `(UserId, Date)`; `UnitOfWork` unique constraint handler for concurrent seals; CancellationToken threaded through all layers after review; 28 tests
-  - Line for tomorrow (`#1018`/`#1035`): `GET /api/today/tomorrow-note?date=` and `PUT /api/today/tomorrow-note` for autosave-friendly upsert; `TomorrowNote` entity (500 char max); 204 NoContent for missing notes; concurrent upsert race-condition handling via `UnitOfWork`; 25 tests
+  - Seal day action (`#1017`/`#1037`): `POST /api/today/seal` and `GET /api/today/seal?date=` for idempotent day-sealing with `DailySnapshot` entity; EF Core migration with unique index on `(UserId, Date)`; `UnitOfWork` unique constraint handler for concurrent seals; CancellationToken threaded through all layers after review; round 3 review fixed critical concurrent seal race condition (re-fetch after save to return accurate `WasAlreadySealed` flag and `SealedAt` timestamp when conflict resolution detaches losing entity); 29 tests
+  - Line for tomorrow (`#1018`/`#1035`): `GET /api/today/tomorrow-note?date=` and `PUT /api/today/tomorrow-note` for autosave-friendly upsert; `TomorrowNote` entity (500 char max); 204 NoContent for missing notes; concurrent upsert race-condition handling via `UnitOfWork`; round 3 review fixed critical phantom-data race condition (re-fetch and last-writer-wins update after conflict resolution) and added `date == default` validation guard; 27 tests
 - **Review deep-dive backends** (6 endpoints on `AutomationProposalsController`, required by PAPER-06 `#1002`):
-  - Provenance rows (`#1019`/`#1039`): `GET /api/automation/proposals/{id}/provenance` returns `ProvenanceRowDto[]` with icon/key/value/weight; 26-entry icon map; weight bucketing from `ProvenanceField` confidence; FK migration added after review; `Math.Round` for confidence display; 41 tests
-  - Side-effect analysis (`#1020`/`#1033`): `GET /api/automation/proposals/{id}/side-effects` returns 7-category breakdown (Cards/Subtasks/Comments/Activity/Notifications/Webhooks/Calendar) with active/passive tone and risk-based reversibility window (6h default, 3h for Critical); review fixed target-type checks and webhook-without-operations logic; 66 tests
-  - Confidence breakdown (`#1021`/`#1036`): `GET /api/automation/proposals/{id}/confidence` returns 4-component weighted breakdown (Pattern match 0.30, Reach 0.20, Reversibility 0.35, Recency 0.15) with threshold and explanatory note; review fixed reach formula, promoted weights to static field, removed unused userId; 63 tests
+  - Provenance rows (`#1019`/`#1039`): `GET /api/automation/proposals/{id}/provenance` returns `ProvenanceRowDto[]` with icon/key/value/weight; 26-entry icon map; weight bucketing from `ProvenanceField` confidence; FK migration added after review; `Math.Round` for confidence display; round 3 review made `MapWeight` exhaustive switch (throws on unrecognized `ProvenanceKind`); 41 tests
+  - Side-effect analysis (`#1020`/`#1033`): `GET /api/automation/proposals/{id}/side-effects` returns 7-category breakdown (Cards/Subtasks/Comments/Activity/Notifications/Webhooks/Calendar) with active/passive tone and risk-based reversibility window (6h default, 3h for Critical); review fixed target-type checks and webhook-without-operations logic; round 3 review removed unused `userId` parameter from `ISideEffectAnalyzer` and added `SideEffectTone` enum range validation; 66 tests
+  - Confidence breakdown (`#1021`/`#1036`): `GET /api/automation/proposals/{id}/confidence` returns 4-component weighted breakdown (Pattern match 0.30, Reach 0.20, Reversibility 0.35, Recency 0.15) with threshold and explanatory note; review fixed reach formula, promoted weights to static field, removed unused userId; round 3 review made `ComponentWeights` truly immutable via `IReadOnlyDictionary`; 63 tests
   - Conflict detection (`#1022`/`#1040`): `GET /api/automation/proposals/{id}/conflicts` returns tone-classified rows (Warn/Info/Ok) from 7 detection rules; review fixed P1 false-warning for create-card ops, added `GetPendingByOperationTargetAsync` for proper duplicate detection, entity caching, safe JSON parsing; 46 tests
-  - Card history ledger (`#1023`/`#1034`): `GET /api/automation/proposals/{id}/history` returns per-card touch history with serial/event/age/status; bounded at 200 entries/card and 500 total; review fixed duplicate dedup, JSON property parsing, GUID single-pass, `InvariantCulture` formatting; 42 tests
-  - Similar past decisions (`#1024`/`#1038`): `GET /api/automation/proposals/{id}/similar-past` returns 3 nearest-neighbour prior decisions with apply rate; board-scoped query (review fixed userId filter that excluded non-caller proposals); 200-proposal lookback limit; UTC week formatting; 50 tests
+  - Card history ledger (`#1023`/`#1034`): `GET /api/automation/proposals/{id}/history` returns per-card touch history with serial/event/age/status; bounded at 200 entries/card and 500 total; review fixed duplicate dedup, JSON property parsing, GUID single-pass, `InvariantCulture` formatting; round 3 review fixed critical case-sensitive `"Card"` vs `"card"` TargetType mismatch that silently broke related proposal lookups, removed dead `CardHistoryRow` domain entity; 25 tests
+  - Similar past decisions (`#1024`/`#1038`): `GET /api/automation/proposals/{id}/similar-past` returns 3 nearest-neighbour prior decisions with apply rate; board-scoped query (review fixed userId filter that excluded non-caller proposals); 200-proposal lookback limit; UTC week formatting; round 3 review added `AsNoTracking()` to read-only 200-proposal queries; 50 tests
+- Round 3 review summary: 3 critical fixes (seal-day concurrent race fabricated data, tomorrow-note phantom data on conflict recovery, card-history case-sensitive TargetType mismatch), 8 important fixes (PeakHour validation, exhaustive ProvenanceKind switch, removed unused SideEffect userId param, SideEffectTone enum guard, immutable ComponentWeights dictionary, AsNoTracking on similar-past queries, dead CardHistoryRow removal, date-default validation)
 - New EF Core migrations: `AddDailySnapshots`, `AddTomorrowNotes`, `AddProvenanceEntities`, `AddProposalProvenanceForeignKey`, `ExtendProposalOutcomesForMetrics`
 - New repository methods: `IAuditLogRepository.CountByDateAsync`, `IAutomationProposalRepository.GetTerminalByActionTypeAsync`, `IAutomationProposalRepository.GetPendingByOperationTargetAsync`