Rehydrate docs for Paper backend gap delivery wave

Update STATUS.md, IMPLEMENTATION_MASTERPLAN.md, and TESTING_GUIDE.md
to reflect the 10 Paper backend gap PRs (#1031-#1040, issues
#1015-#1024): ~460 new backend tests, 10 new API endpoints, 3 EF
Core migrations, and two rounds of adversarial review per PR.

Author: Chris0Jeky

docs/IMPLEMENTATION_MASTERPLAN.md

@@ -1,6 +1,6 @@
 # Taskdeck Implementation Masterplan
 
-Last Updated: 2026-04-25
+Last Updated: 2026-04-26
 <br>
 Planning Horizon: Next 8 to 12 weeks
 Companion Active Docs:
@@ -41,6 +41,15 @@ Update this file at the end of each meaningful delivery cycle or when new work i
 
 Delivered in the latest cycle:
 
+Paper backend gap delivery (2026-04-26, PRs `#1031`--`#1040`, 10 issues `#1015`--`#1024`):
+- 10 backend endpoints delivered for the Paper UI surfaces (PAPER-08 Today dossier + PAPER-06 Review deep-dive), closing all `paper-*-backend-gap-*` issues
+- Today dossier: cadence aggregation (`#1015`/`#1031`), 90-day streak query (`#1016`/`#1032`), seal-day action with EF migration (`#1017`/`#1037`), line-for-tomorrow autosave (`#1018`/`#1035`)
+- Review deep-dive: provenance rows with FK migration (`#1019`/`#1039`), 7-category side-effect analysis (`#1020`/`#1033`), 4-component confidence breakdown (`#1021`/`#1036`), conflict detection with 7 rules (`#1022`/`#1040`), card history ledger (`#1023`/`#1034`), similar past decisions with apply rate (`#1024`/`#1038`)
+- ~460 new backend tests across domain, application, and API layers
+- Two rounds of adversarial review per PR; Gemini Code Assist and Codex connector bot findings addressed on all 10 PRs
+- Key review fixes: 100k entity memory risk replaced with server-side GROUP BY (`#1032`), P1 false-warning for create-card ops (`#1040`), board-scoped similar-decision query (`#1038`), UnitOfWork unique constraint handlers for DailySnapshot/TomorrowNote (`#1037`/`#1035`), CancellationToken threading, reach formula correction (`#1036`), FK enforcement for provenance (`#1039`), entity caching in conflict detector (`#1040`)
+- New shared infrastructure: `TodayController`, `DailySnapshot` entity + repository, `TomorrowNote` entity + repository, `CountByDateAsync` aggregate audit query, `GetTerminalByActionTypeAsync` and `GetPendingByOperationTargetAsync` proposal repository methods
+
 Latest tooling addition (2026-04-25):
 - Codex high-autonomy workflow hardening delivered: `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md` now defines issue batch orchestration, worktree workers, PR review loops, CI/comment/conflict recovery, no-silent-deferral rules, and docs rehydration.
 - Repo-local Codex skills added for issue batch orchestration, isolated issue workers, PR review loops, and CI/conflict recovery.

docs/STATUS.md

@@ -1,8 +1,8 @@
 # Taskdeck Status (Source of Truth)
 
-Last Updated: 2026-04-25
+Last Updated: 2026-04-26
 
-Review-first AI roadmap v4 second-wave delivery (RFAI-02 through RFAI-08 foundational slices), plus flaky CI test fix, after roadmap v4 adoption and first-wave delivery.
+Paper backend gap delivery (10 issues, `#1015`–`#1024`, PRs `#1031`–`#1040`), after review-first AI roadmap v4 second-wave delivery.
 <br>
 Status Owner: Repository maintainers
 Authoritative Scope: Current implementation, verified test execution, and active phase progress
@@ -23,6 +23,23 @@ Rebranding thesis (2026-02-23):
 - automation should remain review-first and provenance-visible
 - product value is reducing maintenance overhead, not maximizing opaque autonomy
 
+Paper backend gap delivery (2026-04-26, PRs `#1031`--`#1040`, 10 issues `#1015`--`#1024`):
+- All 10 Paper backend gaps delivered with two rounds of adversarial review per PR; ~460 new backend tests; bot review findings (Gemini Code Assist + Codex connector) addressed on all PRs
+- **Today dossier backends** (4 endpoints on `TodayController`, required by PAPER-08 `#1004`):
+  - Cadence aggregation (`#1015`/`#1031`): `GET /api/today/cadence?date=` returns 24-hour activity buckets with first/peak/last action timestamps; `CadenceBucket` and `CadenceSnapshot` value objects with cached `Empty()` singleton; queries `IAuditLogRepository`; 26 tests
+  - Streak query (`#1016`/`#1032`): `GET /api/today/streak?days=90` returns 90-day streak with intensity buckets (quartile-based) and current/longest streak lengths; `StreakDay`/`StreakResult` value objects; server-side `GROUP BY` via `CountByDateAsync` (replaced 100k entity load after review); 61 tests
+  - Seal day action (`#1017`/`#1037`): `POST /api/today/seal` and `GET /api/today/seal?date=` for idempotent day-sealing with `DailySnapshot` entity; EF Core migration with unique index on `(UserId, Date)`; `UnitOfWork` unique constraint handler for concurrent seals; CancellationToken threaded through all layers after review; 28 tests
+  - Line for tomorrow (`#1018`/`#1035`): `GET /api/today/tomorrow-note?date=` and `PUT /api/today/tomorrow-note` for autosave-friendly upsert; `TomorrowNote` entity (500 char max); 204 NoContent for missing notes; concurrent upsert race-condition handling via `UnitOfWork`; 25 tests
+- **Review deep-dive backends** (6 endpoints on `AutomationProposalsController`, required by PAPER-06 `#1002`):
+  - Provenance rows (`#1019`/`#1039`): `GET /api/automation/proposals/{id}/provenance` returns `ProvenanceRowDto[]` with icon/key/value/weight; 26-entry icon map; weight bucketing from `ProvenanceField` confidence; FK migration added after review; `Math.Round` for confidence display; 41 tests
+  - Side-effect analysis (`#1020`/`#1033`): `GET /api/automation/proposals/{id}/side-effects` returns 7-category breakdown (Cards/Subtasks/Comments/Activity/Notifications/Webhooks/Calendar) with active/passive tone and risk-based reversibility window (6h default, 3h for Critical); review fixed target-type checks and webhook-without-operations logic; 66 tests
+  - Confidence breakdown (`#1021`/`#1036`): `GET /api/automation/proposals/{id}/confidence` returns 4-component weighted breakdown (Pattern match 0.30, Reach 0.20, Reversibility 0.35, Recency 0.15) with threshold and explanatory note; review fixed reach formula, promoted weights to static field, removed unused userId; 63 tests
+  - Conflict detection (`#1022`/`#1040`): `GET /api/automation/proposals/{id}/conflicts` returns tone-classified rows (Warn/Info/Ok) from 7 detection rules; review fixed P1 false-warning for create-card ops, added `GetPendingByOperationTargetAsync` for proper duplicate detection, entity caching, safe JSON parsing; 46 tests
+  - Card history ledger (`#1023`/`#1034`): `GET /api/automation/proposals/{id}/history` returns per-card touch history with serial/event/age/status; bounded at 200 entries/card and 500 total; review fixed duplicate dedup, JSON property parsing, GUID single-pass, `InvariantCulture` formatting; 42 tests
+  - Similar past decisions (`#1024`/`#1038`): `GET /api/automation/proposals/{id}/similar-past` returns 3 nearest-neighbour prior decisions with apply rate; board-scoped query (review fixed userId filter that excluded non-caller proposals); 200-proposal lookback limit; UTC week formatting; 50 tests
+- New EF Core migrations: `AddDailySnapshots`, `AddTomorrowNotes`, `AddProvenanceEntities`, `AddProposalProvenanceForeignKey`, `ExtendProposalOutcomesForMetrics`
+- New repository methods: `IAuditLogRepository.CountByDateAsync`, `IAutomationProposalRepository.GetTerminalByActionTypeAsync`, `IAutomationProposalRepository.GetPendingByOperationTargetAsync`
+
 Roadmap v4 second-wave delivery (2026-04-25, PRs `#989`--`#994` + `#995`):
 - RFAI-02 (`#974`/`#989`): `IntentEnvelopeV1` domain spine with `SourceBlock`/`SourceSpan`, `IntentCandidate`, `EvidenceLink`, `TaskdeckProposalBatch`, `IIntentEnvelopeFactory` application interface, `IChatClient` adapter spike, handwritten `proposal-batch.v1.schema.json`; 117 tests; adversarial review fixed partial-write status transition bug, span length consistency, evidence fabrication prevention, nullable schema fields
 - RFAI-06 (`#978`/`#990`): `IVectorIndex` and `IEmbeddingGenerator` application interfaces, `InMemoryVectorIndex` (cosine similarity + SIMD), `InMemoryEmbeddingGenerator` (FNV-1a hash), `EmbeddingBackfillService` with batch processing and stale vector pruning, `FallbackSemanticSearchService`, `EmbeddingBackfillWorker`; 61 tests; adversarial review fixed batch API usage, stale vector cleanup, unbounded memory growth

docs/TESTING_GUIDE.md

@@ -2,33 +2,32 @@
 
 This is the active testing guide for Taskdeck.
 
-Last Updated: 2026-04-25
+Last Updated: 2026-04-26
 Companion Active Docs:
 - `docs/STATUS.md`
 - `docs/IMPLEMENTATION_MASTERPLAN.md`
 - `docs/TESTING_GUIDE.md`
 - `docs/MANUAL_TEST_CHECKLIST.md`
 - `docs/GOLDEN_PRINCIPLES.md`
 
-## Current Verified Totals (2026-04-25)
+## Current Verified Totals (2026-04-26)
 
-- Backend: **5,060 passing** (0 failing, 2 skipped; 5,062 total) -- verified 2026-04-25 via `dotnet test backend/Taskdeck.sln -c Release -m:1` on `main`
-  - Domain: 962 passed
-  - Application: 2,367 passed
+- Backend: **~5,520 passing** (estimated; 5,060 at last recertification + ~460 new tests from Paper backend gap wave PRs `#1031`–`#1040`)
+  - Domain: ~1,120 passed (962 + ~158 new domain tests)
+  - Application: ~2,670 passed (2,367 + ~302 new application tests)
   - API integration: 1,621 passed (0 failed, 2 skipped; 1,623 total)
   - CLI contract: 82 passed
   - Architecture boundaries: 8 passed
   - Integration (Testcontainers): 20 passed
 - Frontend unit: **2,805 passing** across 214+ test files -- verified 2026-04-25 via `npx vitest --run --reporter=verbose` on `main`
 - Frontend E2E (smoke + automation/ops + capture loop + starter-pack fixtures + concurrency harness + error recovery/multi-board/edge journeys + cross-browser matrix + onboarding/review/capture/keyboard/dark-mode + validation slices C/D/E + integrated verification): default required lane passing; +20 new scenarios in PRs `#821`–`#826`; +61 new validation/verification scenarios in PRs `#837`–`#840` + `#838`
-- Combined automated total: **7,865+ passing** (backend 5,060 + frontend unit 2,805 + E2E)
+- Combined automated total: **~8,325+ passing** (backend ~5,520 + frontend unit 2,805 + E2E)
 
 Verification note:
-- backend total of 5,060 passing (0 failing, 2 skipped; 5,062 total) recertified 2026-04-25 via `dotnet test backend/Taskdeck.sln -c Release -m:1` on `main` (PR `#987`)
-- frontend total of 2,805 passing across 214+ test files recertified 2026-04-25 via `npx vitest --run --reporter=verbose` on `main` (PR `#987`)
-- 5 previously-failing Api.Tests (3 CorsApiTests, 1 McpTelemetryMiddlewareTests, 1 SecurityHeadersApiTests) now pass
-- prior recertification: backend 4,979 (2026-04-23), frontend 2,607 (2026-04-23) at commit `97d4856c`
-- growth since last recertification: backend +81 tests, frontend +198 tests
+- backend total of ~5,520 is estimated pending recertification after Paper backend gap PRs merge; ~460 new tests verified individually per PR via CI
+- Paper backend gap wave (2026-04-26, PRs `#1031`–`#1040`): ~460 new tests across 10 issues; each PR CI-verified independently
+- prior recertification: backend 5,060 (2026-04-25), frontend 2,805 (2026-04-25) at PR `#987`
+- growth since last recertification: backend +~460 tests (Paper backend gaps), frontend unchanged
 
 ## Roadmap v4 Verification Spine (Seeded 2026-04-25)
 
@@ -57,6 +56,131 @@ Pop-Location
 if ($code -ne 0) { exit $code }
 ```
 
+## Paper Backend Gap Testing (2026-04-26, PRs `#1031`–`#1040`)
+
+The Paper backend gap wave (PRs `#1031`–`#1040`) added ~460 new backend tests across 10 issues. Each PR received two rounds of adversarial review; the second round found and fixed issues including a P1 false-warning bug, a 100k entity memory risk, a board-scoping error, missing FK enforcement, and CancellationToken threading gaps.
+
+### Cadence Aggregation Tests (`#1015`/`#1031`)
+
+`backend/tests/Taskdeck.Domain.Tests/Entities/CadenceSnapshotTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/CadenceServiceTests.cs` — **26 tests** covering:
+- CadenceBucket hour validation (0-23), event count non-negative, equality semantics
+- CadenceSnapshot: 24-bucket invariant, null guard, cached `Empty()` singleton, first/peak/last action computation
+- CadenceService: empty day, single event, full day aggregation, peak hour ties, midnight boundary, date normalization
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~Cadence"
+```
+
+### Streak Query Tests (`#1016`/`#1032`)
+
+`backend/tests/Taskdeck.Domain.Tests/Entities/StreakDayTests.cs`, `StreakResultTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/StreakServiceTests.cs` — **61 tests** covering:
+- StreakDay: intensity bucket validation (0-4), DateOnly handling, sealed flag
+- StreakResult: current/longest streak invariant (current cannot exceed longest), empty days
+- StreakService: empty history, single day, continuous streak, gap in streak, gap at end, intensity quartile bucketing, day count boundaries (1, 90, 365), server-side `CountByDateAsync` aggregate query
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~Streak"
+```
+
+### Seal Day Tests (`#1017`/`#1037`)
+
+`backend/tests/Taskdeck.Domain.Tests/Entities/DailySnapshotTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/DailySealServiceTests.cs` — **28 tests** covering:
+- DailySnapshot: construction, seal idempotency (second seal is no-op preserving original timestamp), future date rejection, IsSealed property, empty userId rejection
+- DailySealService: seal new day, seal existing unsealed, seal already-sealed (idempotent), validation errors, status checks for missing/sealed/unsealed snapshots, CancellationToken propagation
+- UnitOfWork: DailySnapshot unique constraint violation recovery (concurrent seal race condition)
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~Seal or FullyQualifiedName~DailySnapshot"
+```
+
+### Tomorrow Note Tests (`#1018`/`#1035`)
+
+`backend/tests/Taskdeck.Domain.Tests/Entities/TomorrowNoteTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/TomorrowNoteServiceTests.cs` — **25 tests** covering:
+- TomorrowNote: constructor validation, text max length (500 chars), date handling, UpdateText behavior and timestamp
+- TomorrowNoteService: get existing/missing note, save new/update existing (upsert), empty userId rejection, null text handling, max length boundary
+- UnitOfWork: TomorrowNote unique constraint violation recovery (concurrent upsert race condition)
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~TomorrowNote"
+```
+
+### Provenance Query Tests (`#1019`/`#1039`)
+
+`backend/tests/Taskdeck.Application.Tests/Services/ProvenanceQueryServiceTests.cs` — **41 tests** covering:
+- Icon map: 26-entry case-insensitive map with fallback default icon
+- Weight bucketing: extractive >= 0.7 confidence → "primary", < 0.7 → "contextual", inferred → "inferred"
+- Human-readable value strings with quote snippet truncation, `Math.Round` for confidence display
+- Empty provenance (returns empty list, not error), missing proposal, authorization
+- FK enforcement via `AddProposalProvenanceForeignKey` migration
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~ProvenanceQuery"
+```
+
+### Side-Effect Analysis Tests (`#1020`/`#1033`)
+
+`backend/tests/Taskdeck.Domain.Tests/Entities/SideEffectTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/SideEffectAnalyzerTests.cs` — **66 tests** covering:
+- SideEffectRow: value object creation, tone enum, equality/hash contract
+- Reversibility: default 6h window (21,600,000ms), summary/description
+- SideEffectAnalyzer: 7-category tone classification (Cards, Subtasks, Comments, Activity, Notifications, Webhooks, Calendar), target-type-aware card mutation detection, column mutation inclusion, webhook conditional on operations existing, risk-based reversibility (Critical → 3h)
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~SideEffect"
+```
+
+### Confidence Breakdown Tests (`#1021`/`#1036`)
+
+`backend/tests/Taskdeck.Domain.Tests/Confidence/ConfidenceComponentTests.cs`, `ConfidenceBreakdownTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/Confidence/ConfidenceBreakdownServiceTests.cs` — **63 tests** covering:
+- ConfidenceComponent: value range [0..1], NaN/Infinity rejection, key validation
+- ConfidenceBreakdown: overall/threshold range, MeetsThreshold computed property, defensive component list copy
+- ConfidenceBreakdownService: 4-component weighted computation (Pattern match, Reach, Reversibility, Recency), reach formula `2.0 / (2.0 + log2(n))`, risk-level reversibility scoring, recency from expiry window, threshold note generation, static weight map
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~ConfidenceBreakdown"
+```
+
+### Conflict Detection Tests (`#1022`/`#1040`)
+
+`backend/tests/Taskdeck.Domain.Tests/Entities/ConflictRowTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/ProposalConflictDetectorTests.cs` — **46 tests** covering:
+- ConflictRow: tone enum, value object creation, equality
+- ProposalConflictDetector: 7 detection rules — stale data (excludes create-card ops), missing target card, WIP limit, duplicate pending proposals (all pending, not just latest), high/critical risk, outbound webhooks, active comments, multi-op on same card, positive signals (column capacity, fresh data)
+- Entity caching (each card/column fetched at most once), safe JSON parsing with ValueKind checks, tone-sorted output (Warn → Info → Ok)
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~ConflictRow or FullyQualifiedName~ConflictDetector"
+```
+
+### Card History Tests (`#1023`/`#1034`)
+
+`backend/tests/Taskdeck.Domain.Tests/Entities/CardHistoryRowTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/CardHistoryServiceTests.cs` — **42 tests** covering:
+- CardHistoryRow: serial formatting, status enum, validation, equality
+- CardHistoryService: single/multi-card history, serial numbering, age formatting (same day, yesterday, this week, older) with `InvariantCulture`, status classification (pending/applied/past), proposal deduplication via `HashSet<Guid>`, bounded output (200/card, 500 total), proper JSON property parsing for update events
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~CardHistory"
+```
+
+### Similar Past Decisions Tests (`#1024`/`#1038`)
+
+`backend/tests/Taskdeck.Domain.Tests/SimilarPast/SimilarPastDecisionTests.cs`, `SimilarPastResultTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/SimilarDecisionServiceTests.cs` — **50 tests** covering:
+- SimilarPastDecision: value object validation, title truncation (200 chars), verdict enum
+- SimilarPastResult: apply rate computation, division-by-zero safety, negative input rejection
+- SimilarDecisionService: board-scoped action-class matching (review fixed userId filter), user-scoped fallback, top-3 limiting with full-population apply rate, self-exclusion, serial/date formatting (ISO week with 2-digit year), 200-proposal lookback limit, SARGable `OrderByDescending(DecidedAt)` ordering
+
+Run:
+```bash
+dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~SimilarPast or FullyQualifiedName~SimilarDecision"
+```
+
 ## Roadmap v4 Second-Wave Testing (2026-04-25, PRs `#989`–`#994`)
 
 The RFAI-02 through RFAI-08 foundational slice wave (PRs `#989`–`#994`) added ~631 new backend tests across 6 PRs. Each PR received adversarial review with review-added tests fixing bot findings from Gemini and Codex connector reviews.