[Work model] Validate cumulative WIP when a proposal restores multiple cards

[Chris0Jeky]

Confirmed MEDIUM from independent source review of #2920 at 434a043, before publication. No partial board write was identified; execution rolls back the failed proposal.

Trigger: a column has WIP limit 1 and no active cards, with two archived cards in that column. A proposal contains restore-lifecycle(A) and restore-lifecycle(B). ProposalOperationContractValidator validates each restore against the same current count, so both pass preview. Execution restores A, rejects B because the column is now full, and rolls back.

Acceptance: preview validation accounts for preceding supported operations when evaluating cumulative restore WIP, or the operation contract explicitly rejects unsupported multi-card lifecycle combinations. Keep preview/apply parity, atomic rollback, expectedUpdatedAt checks and the legacy archive-as-Block contract. Add a combined-lifecycle regression and a valid multi-operation control.

This is tracked separately from #2920's merge-blocking dependency-edge preservation repair under the bounded review rule. No new broad WIP redesign is requested. Current finding is source-proven; runtime regression has not yet been run.

[Chris0Jeky]

Additional source-traced MEDIUM from #2951 review comment 3983336933 at ad3780f: ProposalConflictDetector.GetProjectedColumnChangesAsync only projects create/move, not lifecycle effects. A WIP-1 column with one archived card plus a proposal restore-lifecycle(A) and create/move(B) can show capacity (1/1), while Apply restores A then rejects B and rolls back.

Include this in the existing bounded cumulative lifecycle WIP residual: align conflict warning/positive signals and contract preview with ordered restore/archive effects, with a mixed lifecycle + create/move regression and atomic no-write rejection control. The active-card baseline correction remains valid; this is the missing lifecycle delta. Source-traced, no new runtime proof yet. No partial mutation or authority bypass identified.

[Chris0Jeky]

Additional source-confirmed projection residual from PR #2951 comment 3983545705: when an outgoing move target becomes archived, the active-only column baseline excludes it but GetProjectedColumnChangesAsync still subtracts its source delta. A move-out plus incoming create/move can therefore show false capacity alongside the stale-card warning. Include active-state-aware move deltas in the ordered lifecycle projection acceptance. ProposalOperationContractValidator rejects archived non-lifecycle edits, so this is a MEDIUM preview truth defect, not a demonstrated committed WIP bypass. Runtime reproduction remains outstanding.

[Chris0Jeky]

[Claude lane claim v2]

• Lane: alpha-product-trust
• Base SHA: 4c479a7ff311912ffb96da027f6e525521bb70df (origin/main), worktree C:/wt/td-2926, branch issue-2926/cumulative-restore-wip
• Owned paths (exclusive):
  • backend/src/Taskdeck.Application/Services/Pipeline/ProposalOperationContractValidator.cs
  • backend/tests/Taskdeck.Application.Tests/Services/Pipeline/ProposalOperationContractValidatorTests.cs
• Shared-path leases (append-only, no restructuring):
  • backend/tests/Taskdeck.Api.Tests/AutomationProposalsApiTests.cs - one new pipeline test appended
  • autodoc/interfaces/proposal-operation-vocabulary.md - one sentence on the lifecycle bullet if contract wording changes
• Explicitly NOT touched: backend/src/Taskdeck.Application/Services/CardService.cs and AutomationExecutorService.cs are left to the concurrent worker on [Archive] Publish lifecycle notifications after proposal commit #2934. Apply-time WIP enforcement in CardService/RestoreExecutor is unchanged; this slice only makes preview reject what Apply already rejects.
• Scope: ordered, cumulative column-occupancy projection inside BoardValidationContext so a restore-lifecycle WIP check counts preceding operations in the same proposal (restore/archive lifecycle, card create, card move). Preview == Apply parity, expectedUpdatedAt checks, atomic rollback and the legacy archive-as-Block contract are unchanged.
• Out of scope here: ProposalConflictDetector.GetProjectedColumnChangesAsync lifecycle/active-state projection (the two follow-up comments on this issue). That is warning-surface truth, not the contract gate, and it is a different file with different tests; it stays tracked as a residual so this slice stays reviewable.
• Parallel-safe work: anything outside Services/Pipeline/ProposalOperationContractValidator.cs and its test file.
• Status: claimed, implementing.

[Chris0Jeky]

[Claude lane release v2]

• Lane: alpha-product-trust
• Head: bff1f6176ddfa9e9b2dbfb2b4e68cc011eed019a on issue-2926/cumulative-restore-wip
• PR: Validate cumulative WIP when a proposal restores a card behind other operations (#2926) #3019 (ready for review, not merged). closingIssuesReferences verified to contain only [Work model] Validate cumulative WIP when a proposal restores multiple cards #2926.
• Result: implemented. ProposalOperationContractValidator now projects the proposal's ordered per-column active-card occupancy (card create, card move, both lifecycle actions) and measures the restore-lifecycle WIP contract against it, so a restore behind an operation that takes the last slot is refused at approve instead of failing mid-apply and rolling back. Freed capacity counts too, so "move the occupant out, then restore" is no longer a false rejection.
• Owned paths released: backend/src/Taskdeck.Application/Services/Pipeline/ProposalOperationContractValidator.cs, backend/tests/Taskdeck.Application.Tests/Services/Pipeline/ProposalOperationContractValidatorTests.cs. Shared-path leases released: backend/tests/Taskdeck.Api.Tests/AutomationProposalsApiTests.cs (one appended test), autodoc/interfaces/proposal-operation-vocabulary.md, docs/STATUS.md, docs/product/FEATURE_CAPABILITIES.md.
• Not touched: CardService.cs and AutomationExecutorService.cs, left to the concurrent [Archive] Publish lifecycle notifications after proposal commit #2934 worker.

Two findings worth recording on this issue

1. The literal trigger in the issue body - restore(A) + restore(B) in one proposal - was already closed before this PR, by ProposalHierarchyValidator, which admits at most one hierarchy-affecting operation per proposal. That pair never reached the WIP check. A new test pins that gate. The live defect was the scenario in this issue's second comment: one lifecycle operation mixed with create/move. The Api regression fails on main (approve returns 200 OK for a proposal that cannot apply) and passes on the branch.
2. The archive/restore occupancy deltas are therefore latent under that gate and are carried deliberately, documented in the source, so that enabling batch restores later cannot silently reintroduce the hole.

Residual carried to a new tracker. ProposalConflictDetector.GetProjectedColumnChangesAsync still omits lifecycle effects and still subtracts a source delta for an outgoing move whose card is archived - the two follow-up comments above. That is the Review warning surface rather than the contract gate, so it was kept out of this slice and filed as #3012 to keep a tracker once this issue closes.