docs: comprehensive post-merge sweep for PRs #821-#826

Update STATUS.md, IMPLEMENTATION_MASTERPLAN.md, TESTING_GUIDE.md,
and MANUAL_TEST_CHECKLIST.md for the supplementary test depth wave.

- Add delivery entry 134 to masterplan for 6 parallel worktree PRs
- Update test counts: backend ~4,479+, frontend ~2,454+, combined ~6,950+
- Add new TESTING_GUIDE section with run commands and test breakdowns
- Add Z22 manual validation checklist for new test categories
- Update date stamps to 2026-04-13

Author: Chris0Jeky

docs/IMPLEMENTATION_MASTERPLAN.md

@@ -1,6 +1,6 @@
 # Taskdeck Implementation Masterplan
 
-Last Updated: 2026-04-12
+Last Updated: 2026-04-13
 <br>
 Planning Horizon: Next 8 to 12 weeks
 Companion Active Docs:
@@ -655,6 +655,16 @@ Delivered in the latest cycle:
     - comprehensive documentation sweep: STATUS.md, TESTING_GUIDE.md, IMPLEMENTATION_MASTERPLAN.md, AUTHENTICATION.md updated to reflect all shipped features
     - stale worktrees pruned and merged-PR local branches cleaned up
     - test suite recertified: backend 4,279, frontend 2,245, combined ~6,500+ passing
+134. Supplementary test depth wave (2026-04-13, PRs `#821`–`#826`, ~429 new tests):
+    - 6 parallel worktree agents implementing supplementary test depth for TST-54 wave topics (concurrency, store integration, E2E expansion, view coverage, property-based/adversarial, resilience)
+    - each PR received two rounds of adversarial review (self-review + independent cold review); round 2 caught and fixed: 1 critical thread-pool deadlock (`#825`), 1 critical missing baseURL (`#822`), 3 CI-blocking unused imports (`#823`, `#824`, `#826`), 12 weak assertions (`#821`), silent 500-skip (`#824`), DOM pollution (`#826`), incorrect generic type (`#826`), race conditions in test setup (`#825`), unhandled promise rejections (`#823`)
+    - concurrency stress tests (`#705`/`#825`): 22 tests across 7 files — queue claim races, card update conflicts, proposal approval races, webhook delivery, board presence, rate limiting, cross-user isolation; `SemaphoreSlim` barriers for true simultaneous execution
+    - frontend store integration tests (`#711`/`#821`): 88 tests across 6 files — chatApi, boardStore conflicts, queueStore polling, sessionStore OIDC, notificationStore realtime, workspaceStore persistence; mocks HTTP layer to test full store → API → HTTP chain
+    - E2E scenario expansion (`#712`/`#822`): 20 Playwright scenarios across 5 files — onboarding, review proposals, capture edge cases, keyboard navigation, dark mode
+    - frontend view/component coverage (`#716`/`#826`): 107 tests across 8 files — ArchiveView, MetricsView, BoardView, ReviewView, AutomationChatView, CardItem, BoardCanvas, BoardActionRail
+    - property-based/adversarial input tests (`#717`/`#824`): 162 tests across 8 files — domain property tests (93), application fuzz (19), API adversarial (50); shared adversarial string generator with ~45 vectors
+    - resilience/degraded-mode tests (`#720`/`#823`): 30 tests across 3 files — LLM provider resilience, queue accumulation, frontend slow-API/storage
+    - estimated combined total after merge: backend ~4,479+, frontend ~2,454+, combined ~6,950+
 
 ## Current Planning Pivot (2026-03-07)
 
@@ -1254,7 +1264,8 @@ Additional P1 issues from the same session (tracked in `#510`–`
 13. **Mutation testing pilot** (`#90`): Stryker.NET (backend Domain) and Stryker JS (frontend captureStore/boardStore) configured with non-blocking weekly CI lane; policy at `docs/testing/MUTATION_TESTING_POLICY.md`; scope expansion to Application layer and additional stores planned after baseline calibration from first 3-4 runs.
 20. **Platform expansion wave (2026-04-09)**: 10 issues (`#84`, `#85`, `#87`, `#88`, `#90`, `#91`, `#95`, `#104`, `#105`, `#111`) across 10 PRs (`#796`–`#805`) delivered platform hardening (PLAT-01/02/03), testing infrastructure (TST-02/03/05/06), PWA readiness (UX-09), and ops documentation (OPS-12/14). 5 new ADRs (ADR-0023 through ADR-0027). Two rounds of adversarial review per PR caught 22 CRITICAL + 32 HIGH issues, all resolved. New test projects: `Taskdeck.Integration.Tests` (Testcontainers). New CI workflows: cross-browser matrix, visual regression, mutation testing, container integration. New infra: `ICacheService`, SignalR Redis backplane, VitePWA service worker.
 21. **Feature, security, and ops expansion wave (2026-04-09)**: 8 issues (`#82`, `#94`, `#101`, `#251`, `#334`, `#338`, `#549`, `#676`) across 8 PRs (`#806`–`#813`) delivered calendar/timeline views (UX-08), staged deployment workflow (OPS-09, ADR-0028), Storybook baseline (UI-12), note-style import (INT-05), agent mode surfaces (AGT-03), error tracking/analytics (OBS-02), OAuth PKCE + account linking (CLD-03), and SSO/OIDC + MFA (SEC-07, ADR-0029). Two rounds of adversarial review per PR (self + independent cold review); the independent round caught 9 CRITICAL and 11 HIGH findings — all resolved. ~231+ new tests. New controllers: NoteImport, Telemetry. New frontend views: CalendarView, AgentsView, AgentRunsView, AgentRunDetailView. New auth infra: DB-backed auth codes, PKCE, OIDC provider factory, TOTP MFA. New dev tooling: Storybook 10.3.5 with 17 primitive stories. New ops: 4-phase deployment workflow, smoke test script, CD staging gate CI workflow, observability setup guide.
-22. Test suite baseline counts recertified 2026-04-09: backend ~3,600+ passing, frontend ~1,984+ passing, combined ~5,600+.
+22. Test suite baseline counts recertified 2026-04-12: backend 4,279 passing, frontend 2,245 passing, combined ~6,500+. Supplementary depth wave (PRs `#821`–`#826`, 2026-04-13) adds ~429 new tests; estimated post-merge: backend ~4,479+, frontend ~2,454+, combined ~6,950+.
+23. **Supplementary test depth wave (2026-04-13)**: 6 parallel worktree agents delivered PRs `#821`–`#826` (~429 new tests) covering concurrency stress (22 tests), frontend store integration (88 tests), E2E scenario expansion (20 tests), frontend view/component coverage (107 tests), property-based/adversarial input (162 tests), and resilience/degraded-mode (30 tests). Two rounds of adversarial review per PR caught 1 critical deadlock, 1 critical missing baseURL, 3 CI-blocking imports, 12 weak assertions, and multiple race conditions — all fixed. Topics supplement earlier deliveries from the TST-54 wave.
 
 ## Documentation Operating Model
 Active docs:

docs/MANUAL_TEST_CHECKLIST.md

@@ -2,7 +2,7 @@
 
 Use this checklist to manually validate current Taskdeck behavior on `main`.
 
-Last Updated: 2026-04-10
+Last Updated: 2026-04-13
 Companion Active Docs:
 - `docs/STATUS.md`
 - `docs/IMPLEMENTATION_MASTERPLAN.md`
@@ -1176,6 +1176,27 @@ Status legend: `[ ]` = not yet performed, `[x]` = verified.
    - Create a webhook subscription pointing to an unreachable endpoint.
    - Expected: delivery retries with increasing intervals; dead-lettered after max retries.
 
+### Z22. Supplementary Test Depth Wave (PRs #821–#826 — pending merge)
+
+1. [ ] Verify concurrency stress tests pass without deadlocks or flakiness.
+   - Run: `dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~Concurrency" -m:1`
+   - Expected: all 22 concurrency tests pass; no timeouts or deadlocks; SQLite serialization behaviors documented in XML comments.
+2. [ ] Verify frontend store integration tests pass with real API client chain.
+   - Run: `cd frontend/taskdeck-web && npx vitest --run --reporter=verbose -- src/tests/store/`
+   - Expected: all 88 store integration tests pass; HTTP mocks (not API mocks) are used.
+3. [ ] Verify E2E scenario expansion tests pass against dev server.
+   - Run: `cd frontend/taskdeck-web && npx playwright test tests/e2e/onboarding.spec.ts tests/e2e/review-proposals.spec.ts tests/e2e/capture-edge-cases.spec.ts tests/e2e/keyboard-navigation.spec.ts tests/e2e/dark-mode.spec.ts`
+   - Expected: 17+ pass, 3 gracefully skipped (dark mode toggle).
+4. [ ] Verify frontend view/component coverage tests pass.
+   - Run: `cd frontend/taskdeck-web && npx vitest --run --reporter=verbose -- src/tests/views/`
+   - Expected: all 107 view/component tests pass.
+5. [ ] Verify property-based/adversarial tests pass and no 500 errors from random input.
+   - Run: `dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~PropertyBased|FullyQualifiedName~Fuzz|FullyQualifiedName~Adversarial" -m:1`
+   - Expected: all 162 tests pass; no 500 Internal Server Error from adversarial input.
+6. [ ] Verify resilience/degraded-mode tests pass.
+   - Run: `dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~Resilience" -m:1`
+   - Expected: all 30 resilience tests pass; degraded responses are structured, not raw exceptions.
+
 ---
 
 ## Incident Rehearsals

docs/STATUS.md

@@ -1,6 +1,6 @@
 # Taskdeck Status (Source of Truth)
 
-Last Updated: 2026-04-12
+Last Updated: 2026-04-13
 <br>
 Status Owner: Repository maintainers
 Authoritative Scope: Current implementation, verified test execution, and active phase progress
@@ -119,6 +119,14 @@ Current constraints are mostly hardening and consistency:
 
 - Mutation testing pilot now delivered (`#90`): Stryker.NET targeting `Taskdeck.Domain` (backend) and Stryker JS targeting `captureStore`/`boardStore` (frontend); non-blocking weekly CI lane (`.github/workflows/mutation-testing.yml`); policy and triage guidance at `docs/testing/MUTATION_TESTING_POLICY.md`; 60% low / 80% high thresholds with 0% break (triage signal, not enforcement gate); scope expansion roadmap covers Application layer and additional frontend stores
 
+- Supplementary test depth wave (2026-04-13, PRs `#821`–`#826`, ~429 new tests with two rounds of adversarial review per PR):
+  - **Frontend store integration tests** (`#711`/`#821`): 88 new tests across 6 files — chatApi integration (22), boardStore column reorder/conflict (11), queueStore polling/transitions (12), sessionStore OIDC/SSO (14), notificationStore realtime (15), workspaceStore mode persistence (14); mocks HTTP layer (not API modules) to test full store → API → HTTP chain; round 2 review fixed missing in-memory state assertions, incorrect resetForLogout test comment, and 12 weak `rejects.toBeDefined()` assertions replaced with type-specific matchers
+  - **E2E scenario expansion** (`#712`/`#822`): 20 new Playwright scenarios across 5 spec files — onboarding (5), review proposals (3), capture edge cases (4), keyboard navigation (4), dark mode (4); 17 passing, 3 gracefully skipped (dark mode toggle not present in current UI); round 2 review fixed missing `baseURL` in browser context (critical), brittle CSS selectors replaced with `getByLabel`, no-op assertions, unreliable `body.click()` defocusing, and misleading header comments
+  - **Resilience and degraded-mode behavior tests** (`#720`/`#823`): 30 new tests across 3 files — LLM provider resilience (13: garbage/empty/missing-choices/429/timeout for OpenAI and Gemini, probe unhealthy), queue accumulation resilience (3: accumulation without corruption, item processability, rapid concurrent captures), frontend slow-API/storage resilience (14: loading states, throttle dedup, corrupted localStorage/token handling); round 2 review fixed CI-breaking unused import, unhandled promise rejections, contradictory test name, and misleading JWT comment
+  - **Property-based and adversarial input tests** (`#717`/`#824`): 162 new tests across 8 files — domain property tests (93: ChatSession, ChatMessage, Notification, KnowledgeDocument, WebhookSubscription with adversarial strings, boundary lengths, state machine exhaustion), application fuzz tests (19: JSON round-trip for chat/notification DTOs), API adversarial tests (50: raw JSON with adversarial positions, XSS/injection payloads, unicode blocks, extra unknown fields, control chars); round 2 review fixed silent 500-skip, fake `[Property]` on deterministic tests, 7× copy-pasted generators replaced with shared adversarial generator (~45 vectors), and misleading URL trim comment
+  - **Concurrency and race condition stress tests** (`#705`/`#825`): 22 new tests across 7 files — queue claim races (4), card update conflicts (5), proposal approval races (4), webhook delivery concurrency (2), board presence concurrency (2), rate limiting (3), cross-user isolation stress (2); uses `SemaphoreSlim` barriers for true simultaneous execution; SQLite write serialization limitations documented; round 2 review fixed critical thread-pool deadlock (blocking `Barrier.SignalAndWait` in async lambdas), cross-user isolation race condition, silent pass on broken rate limiting, and 2 data-loss-hiding weak assertions
+  - **Frontend view and component coverage gaps** (`#716`/`#826`): 107 new tests across 8 files — ArchiveView (11), MetricsView (16), BoardView (12), ReviewView (10), AutomationChatView (16), CardItem (21), BoardCanvas (12), BoardActionRail (9); covers loading/error/empty states, user interactions, ARIA attributes, drag events; round 2 review fixed CI-blocking unused import, DOM pollution (missing afterEach cleanup), incorrect generic type, and misleading test name
+
 Target experience metrics for the capture direction:
 - capture action to saved artifact should feel under 10 seconds in normal use
 - capture artifact to reviewed/applicable proposal should be achievable inside a ~60-second loop