fix(schedule10): apply Story 11.2 code-review findings, resolved legacy-first

Four independent review layers over the Schedule 10 write path produced 49
findings. All patches applied; all eight decisions answered by reading
docs/nr-ilcr-2.0.4 rather than by preference.

TWO USER-FACING MESSAGE DEFECTS affected every rejection this story added.
Required fields answered a literal "{0}: Value is required." and all 28 range
constraints answered "Entered value must be between {0} and {1}", because
parameterised bundle keys were wired to Bean Validation annotations, which
supply no positional arguments. Legacy overrides no javax.faces.* key, so JSF
fills {0} from each component's label attribute; invalidRangeErrorMsg appears in
legacy in exactly one place, CheckStatus.java:196, with an args array. Both now
render legacy's resolved bytes. Percentages and side slope use legacy's OWN
existing keys rather than new ones.

TWO PATHS WROTE NULL INTO NOT NULL COLUMNS and surfaced as opaque 500s.
detailedEngineeringCostInd (@pattern treats null as valid) now defaults to "N",
matching legacy's two-item dropdown with no empty option. applyBallastCoupling's
missing default branch now forces material "NA", as legacy already does for its
other non-crushed methods.

DUPLICATE COST ROWS now take the LAST row instead of being summed.
Schedule10DAO:556-600 loops the cost rows and ASSIGNS per item -- legacy never
sums. Story 11.1's summing was an unrecorded deviation, and it was exactly what
made a duplicated value unfixable through the API: the write path's UPDATE sets
every duplicate row, and the read then re-summed them. Correcting the read needs
no row deletion, so AC5 ("a cost row is never deleted by a save") still holds.

ROAD-DETAIL EDITS no longer rewrite the derived moisture pair. Legacy's
filterMoistureCodeLists() rebuilds the dropdown LISTS and never assigns, so an
edit touching only comments must not flip a stored (F, Moist) to (SD, Moist)
through a tie-break invented for this port. This also gives the BEC
classification the unchanged-code exemption, so a stored row whose BEC has
dropped out of the offerable set is editable again -- and findStoredClassification,
previously dead code, is now its implementation.

Also: byte caps on roadName and divisionName, a constructionPeriod month range,
converter keys so a malformed percentage or volume no longer reports a COST
error, the four dead persistence keys wired, and mill/year/category scope added
to all five child UPDATE/DELETE statements so the invariant the file already
asserts is actually true.

THREE DECISIONS NEEDED NO CODE CHANGE -- an unmapped TFL blocking an edit,
HALF_UP rounding, and token-free deletes are all faithful legacy behaviour. A
fourth proved the STORY wrong rather than the code: legacy zeroes the four
stabilizing dimensions for method N only, keeps them for D, and never zeroes
ttTransfer. Pinned deviation (e) is amended to match legacy; deviation (l)'s TFL
key counts are corrected to 21 vs 20, differing only by the unstorable 52B,
which is now demoted to a comment as Schedule 6 had already done.

TEST CORRECTIONS, several of them tests that could not fail: a vacuous
intValue() assertion on a 0.3 input, three of the four "zeroed" dimensions never
asserted, isNotNull() on NOT NULL columns, and a Set-collapse that let
containsExactly pass with a constraint deleted. Added the missing coverage:
Check Status emission order, both unreachable-rule labels asserted positively,
ballast method D, three requireOffered negatives, the road-detail 409 path,
year/category/foreign-mill delete scoping, UPDATE_* re-stamping across all three
tables, and AC8's three untested road-detail endpoints. Schedule10CopyIT and
Schedule10DeleteIT no longer share a (mill, year) -- they passed only because
"Copy" sorts before "Delete".

ONE CLAIM WAS REMOVED RATHER THAN SATISFIED: Schedule10WriteAuthorizationIT
asserted that a controller unit test pins the EDIT action by name. No such test
exists, and because both shipped groups hold both actions, changing mayEdit() to
ask for VIEW_SCHEDULE would pass the entire suite. Recorded in deferred-work.md
instead of left as a claim the tests do not support.

Verification: 1150 unit + 879 integration tests, 0 failures, BUILD SUCCESS; 0
checkstyle violations in schedule10 (1234 pre-existing elsewhere untouched).
Schedule 10 owns 259 tests across 17 classes, up from 243 before the review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Rylan-cgi

backend/src/main/java/ca/bc/gov/nrs/ilcr/exception/GlobalExceptionHandler.java

@@ -320,10 +320,21 @@ private static String converterKeyForField(String causeMessage) {
    * collection
    * hops ({@code CulvertSaveAllRequest["culverts"]->…->CulvertRequest["spanSize"]}).
    */
-  private static final Map<String, String> CONVERTER_KEYS_BY_TARGET = Map.of(
-      "CulvertRequest[\"spanSize\"]", "culvertSpanConverterErrorMsg",
-      "CulvertRequest[\"riseSize\"]", "culvertRiseConverterErrorMsg",
-      "CulvertRequest[\"culvertPieceCount\"]", "culvertPieceCountConverterErrorMsg");
+  private static final Map<String, String> CONVERTER_KEYS_BY_TARGET = Map.ofEntries(
+      Map.entry("CulvertRequest[\"spanSize\"]", "culvertSpanConverterErrorMsg"),
+      Map.entry("CulvertRequest[\"riseSize\"]", "culvertRiseConverterErrorMsg"),
+      Map.entry("CulvertRequest[\"culvertPieceCount\"]", "culvertPieceCountConverterErrorMsg"),
+      // Schedule 10 (code review 2026-08-18). Without these, every malformed Integer on a road
+      // detail — a percentage or a haul volume — fell through to the type default and told the
+      // reporter their COST was invalid.
+      Map.entry("RoadDetailRequest[\"sideSlopePct\"]", "sideSlopePercentageConverterErrorMsg"),
+      Map.entry("RoadDetailRequest[\"endHaulVolume\"]", "volumeConverterErrorMsg"),
+      Map.entry("RoadDetailRequest[\"overlandVolume\"]", "volumeConverterErrorMsg"),
+      Map.entry("MaterialCompositionRequest[\"solidRockPct\"]", "percentageConverterErrorMsg"),
+      Map.entry("MaterialCompositionRequest[\"rippableRockPct\"]", "percentageConverterErrorMsg"),
+      Map.entry("MaterialCompositionRequest[\"coarsePct\"]", "percentageConverterErrorMsg"),
+      Map.entry("MaterialCompositionRequest[\"finePct\"]", "percentageConverterErrorMsg"),
+      Map.entry("MaterialCompositionRequest[\"organicPct\"]", "percentageConverterErrorMsg"));
 
   /**
    * Handles authorization denials from method security ({@code @PreAuthorize}). Without this

backend/src/main/java/ca/bc/gov/nrs/ilcr/schedule10/MaterialCodeTypeRequiredException.java

@@ -0,0 +1,27 @@
+package ca.bc.gov.nrs.ilcr.schedule10;
+
+import ca.bc.gov.nrs.ilcr.exception.BusinessException;
+import org.springframework.http.HttpStatus;
+
+/**
+ * Raised when the additional-stabilizing material type is missing while the ballast method requires
+ * it.
+ *
+ * <p>Legacy makes this field conditionally required — {@code pageDtlASType} carries {@code
+ * required="#{...typeMandatory}"}, and {@code typeMandatory} is true only for ballast method {@code
+ * "C"} ({@code RoadConstructionReportDetailType:1129}). Because the requiredness depends on a
+ * sibling field, Bean Validation on a single record component cannot express it, so the check lives
+ * in the service and arrives here.
+ *
+ * <p>Maps to 400 {@code materialCodeTypeRequiredErrorMsg} — the resolved form of legacy's JSF
+ * required template with {@code {0}} filled from that component's {@code label="Material Code
+ * Type"}. It replaces {@code invalidCodeValueErrorMsg} ({@code A valid value must be selected from
+ * the list.}), used here until code review 2026-08-18: a pick-from-the-list message for a
+ * missing-required condition.
+ */
+public class MaterialCodeTypeRequiredException extends BusinessException {
+
+  public MaterialCodeTypeRequiredException() {
+    super(HttpStatus.BAD_REQUEST, "materialCodeTypeRequiredErrorMsg");
+  }
+}

backend/src/main/java/ca/bc/gov/nrs/ilcr/schedule10/RoadGroup10Lookup.java

@@ -94,12 +94,27 @@ static String rmgFor(String tsaNumber, String tsbNumberCode, String tflNumberCod
    * hold; this returns the canonical form so the stored value is the one that resolves.
    *
    * <p><strong>On which table validates.</strong> The legacy validator calls Schedule <em>6</em>'s
-   * lookup even for this screen. That reads like a defect, but the two tables accept an identical
-   * set of 22 keys — verified by diffing the {@code case} labels of both methods — so validating
-   * here against Schedule 10's own table accepts and rejects exactly what legacy does. Only the
-   * returned Road Group values differ between the tables, which is what this class exists to keep
-   * separate. The cross-wiring is still worth reporting upstream: the tables are maintained
-   * independently, so a future edit to either would silently split validation from derivation.
+   * lookup even for this screen, which reads like a defect. Validating here against Schedule 10's
+   * own table is behaviourally equivalent, but NOT because the tables are identical — an earlier
+   * version of this note claimed "an identical set of 22 keys", and that was wrong on both counts
+   * (corrected at code review 2026-08-18). The accurate position, from counting the {@code case}
+   * labels of both methods:
+   *
+   * <ul>
+   *   <li>this table holds <strong>21</strong> live keys; {@code schedule6.RoadGroupLookup} holds
+   *       <strong>20</strong>;
+   *   <li>the sets are identical on all 20 shared keys and differ only by {@code "52B"}, which
+   *       Schedule 6 demoted to a comment because {@code TFL_NUMBER_CODE} is {@code VARCHAR2(2)} —
+   *       a 3-character TFL is unstorable, and {@code ConstructionPageRequest.tflNumberCode}
+   *       carries {@code @Size(max = 2)} to match;
+   *   <li>so for every input that can physically reach either method, the two accept and reject
+   *       exactly the same values, and validating against this table matches legacy.
+   * </ul>
+   *
+   * <p>Only the returned Road Group values differ between the tables, which is what this class
+   * exists to keep separate. The cross-wiring is still worth reporting upstream: the tables are
+   * maintained independently, so a future edit to either would silently split validation from
+   * derivation.
    *
    * @param tflNumberCode the entered TFL number, possibly missing a leading zero
    * @return the canonical TFL to store, or {@code null} when the value is not a valid TFL
@@ -354,7 +369,12 @@ private static String rg10ByTflNumberCode(String tflNumberCode) {
       case "03", "23", "33", "55", "56":
         roadGroup = "11";
         break;
-      case "05", "52B":
+      // "52B" is legacy-live but unreachable, and is demoted to a comment here for the reason
+      // schedule6.RoadGroupLookup already records: TFL_NUMBER_CODE is VARCHAR2(2) on both sides,
+      // and ConstructionPageRequest.tflNumberCode carries @Size(max = 2), so a 3-character TFL
+      // never reaches this switch on read or on save. As a live case it read as an accepted value
+      // that the request contract rejects (code review 2026-08-18). case "52B": roadGroup = "5";
+      case "05":
         roadGroup = "5";
         break;
       case "30", "52", "53":

backend/src/main/java/ca/bc/gov/nrs/ilcr/schedule10/Schedule10PersistenceException.java

@@ -0,0 +1,40 @@
+package ca.bc.gov.nrs.ilcr.schedule10;
+
+import ca.bc.gov.nrs.ilcr.exception.BusinessException;
+import org.springframework.http.HttpStatus;
+
+/**
+ * Raised when a Schedule 10 write fails at the persistence layer, naming the resource that failed.
+ *
+ * <p>Maps to 500, exactly as {@code ScheduleNotSavedException} does, but carries one of the four
+ * resource-specific legacy keys instead of the generic {@code scheduleNotSavedErrorMsg}: §
+ * Validation rules directs the write path to use them "where the failing resource is known", which
+ * is what resolves the UC's otherwise-unattached ERR-004. Those four keys were declared but
+ * unreferenced until code review 2026-08-18, so every failure — page insert, detail insert, cost
+ * upsert, cascade delete — flattened into one message the reporter could not act on.
+ *
+ * <p>The {@code @Transactional} write boundary rolls back before this surfaces.
+ */
+public class Schedule10PersistenceException extends BusinessException {
+
+  /** The page could not be saved. */
+  public static final String PAGE_NOT_SAVED = "roadConstructionReportNotSavedErrorMsg";
+
+  /** The road detail could not be saved. */
+  public static final String DETAIL_NOT_SAVED = "roadConstructionReportDetailNotSavedErrorMsg";
+
+  /** The page could not be deleted. */
+  public static final String PAGE_NOT_DELETED = "roadConstructionReportNotDeletedErrorMsg";
+
+  /** The road detail could not be deleted. */
+  public static final String DETAIL_NOT_DELETED = "roadConstructionReportDetailNotDeletedErrorMsg";
+
+  /**
+   * Wraps a persistence failure against a named resource.
+   *
+   * @param messageKey one of the four constants on this class
+   */
+  public Schedule10PersistenceException(String messageKey) {
+    super(HttpStatus.INTERNAL_SERVER_ERROR, messageKey);
+  }
+}

backend/src/main/java/ca/bc/gov/nrs/ilcr/schedule10/Schedule10Repository.java

@@ -655,9 +655,12 @@ int countRoadDetail(
    * @param costItemId the legacy cost-item ordinal
    * @param cost the amount, or {@code null} to clear it in place
    * @param user the actor stamped into the audit columns
+   * @param millId the mill the owning page must belong to
+   * @param year the reporting year the owning page must belong to
    */
-  default void upsertCostLine(int roadDetailId, int costItemId, Integer cost, String user) {
-    if (updateCostLine(roadDetailId, costItemId, cost, user) == 0) {
+  default void upsertCostLine(
+      int roadDetailId, int costItemId, Integer cost, String user, long millId, int year) {
+    if (updateCostLine(roadDetailId, costItemId, cost, user, millId, year) == 0) {
       insertCostLine(nextCostDetailId(), roadDetailId, costItemId, cost, user);
     }
   }
@@ -673,10 +676,19 @@ default void upsertCostLine(int roadDetailId, int costItemId, Integer cost, Stri
              UPDATE_TIMESTAMP = SYSTIMESTAMP
        WHERE ROAD_CONSTRUCTION_REPRT_DTL_ID = :roadDetailId
          AND ILCR_REPORT_COST_ITEM_ID = :costItemId
+         AND EXISTS (SELECT 1
+                       FROM THE.ROAD_CONSTRUCTION_REPRT_DTL d
+                       JOIN THE.ROAD_CONSTRUCTION_REPRT r
+                         ON r.ROAD_CONSTRUCTION_REPRT_ID = d.ROAD_CONSTRUCTION_REPRT_ID
+                      WHERE d.ROAD_CONSTRUCTION_REPRT_DTL_ID = :roadDetailId
+                        AND r.ILCR_MILL_ID = :millId
+                        AND r.REPORT_YEAR = :year
+                        AND r.ILCR_CATEGORY_ID = '10')
       """)
   int updateCostLine(
       @Param("roadDetailId") int roadDetailId, @Param("costItemId") int costItemId,
-      @Param("cost") Integer cost, @Param("user") String user);
+      @Param("cost") Integer cost, @Param("user") String user, @Param("millId") long millId,
+      @Param("year") int year);
 
   /**
    * Insert half of {@link #upsertCostLine}. Schedule 10 cost rows carry a NULL {@code
@@ -708,8 +720,18 @@ void insertCostLine(
   @Query("""
       DELETE FROM THE.ILCR_COST_REPORT_DETAIL
        WHERE ROAD_CONSTRUCTION_REPRT_DTL_ID = :roadDetailId
+         AND EXISTS (SELECT 1
+                       FROM THE.ROAD_CONSTRUCTION_REPRT_DTL d
+                       JOIN THE.ROAD_CONSTRUCTION_REPRT r
+                         ON r.ROAD_CONSTRUCTION_REPRT_ID = d.ROAD_CONSTRUCTION_REPRT_ID
+                      WHERE d.ROAD_CONSTRUCTION_REPRT_DTL_ID = :roadDetailId
+                        AND r.ILCR_MILL_ID = :millId
+                        AND r.REPORT_YEAR = :year
+                        AND r.ILCR_CATEGORY_ID = '10')
       """)
-  int deleteCostsForRoadDetail(@Param("roadDetailId") int roadDetailId);
+  int deleteCostsForRoadDetail(
+      @Param("roadDetailId") int roadDetailId, @Param("millId") long millId,
+      @Param("year") int year);
 
   /**
    * Delete every cost line belonging to any road detail of one page — the first step of the page
@@ -721,26 +743,47 @@ void insertCostLine(
        WHERE ROAD_CONSTRUCTION_REPRT_DTL_ID IN (
              SELECT d.ROAD_CONSTRUCTION_REPRT_DTL_ID
                FROM THE.ROAD_CONSTRUCTION_REPRT_DTL d
-              WHERE d.ROAD_CONSTRUCTION_REPRT_ID = :pageId)
+               JOIN THE.ROAD_CONSTRUCTION_REPRT r
+                 ON r.ROAD_CONSTRUCTION_REPRT_ID = d.ROAD_CONSTRUCTION_REPRT_ID
+              WHERE d.ROAD_CONSTRUCTION_REPRT_ID = :pageId
+                AND r.ILCR_MILL_ID = :millId
+                AND r.REPORT_YEAR = :year
+                AND r.ILCR_CATEGORY_ID = '10')
       """)
-  int deleteCostsForPage(@Param("pageId") int pageId);
+  int deleteCostsForPage(
+      @Param("pageId") int pageId, @Param("millId") long millId, @Param("year") int year);
 
   /** Delete one road detail, scoped to its parent page. Its cost lines must already be gone. */
   @Modifying
   @Query("""
       DELETE FROM THE.ROAD_CONSTRUCTION_REPRT_DTL
        WHERE ROAD_CONSTRUCTION_REPRT_DTL_ID = :roadDetailId
          AND ROAD_CONSTRUCTION_REPRT_ID = :pageId
+         AND EXISTS (SELECT 1
+                       FROM THE.ROAD_CONSTRUCTION_REPRT r
+                      WHERE r.ROAD_CONSTRUCTION_REPRT_ID = :pageId
+                        AND r.ILCR_MILL_ID = :millId
+                        AND r.REPORT_YEAR = :year
+                        AND r.ILCR_CATEGORY_ID = '10')
       """)
-  int deleteRoadDetail(@Param("roadDetailId") int roadDetailId, @Param("pageId") int pageId);
+  int deleteRoadDetail(
+      @Param("roadDetailId") int roadDetailId, @Param("pageId") int pageId,
+      @Param("millId") long millId, @Param("year") int year);
 
   /** Delete every road detail of one page — the second step of the page cascade. */
   @Modifying
   @Query("""
       DELETE FROM THE.ROAD_CONSTRUCTION_REPRT_DTL
        WHERE ROAD_CONSTRUCTION_REPRT_ID = :pageId
+         AND EXISTS (SELECT 1
+                       FROM THE.ROAD_CONSTRUCTION_REPRT r
+                      WHERE r.ROAD_CONSTRUCTION_REPRT_ID = :pageId
+                        AND r.ILCR_MILL_ID = :millId
+                        AND r.REPORT_YEAR = :year
+                        AND r.ILCR_CATEGORY_ID = '10')
       """)
-  int deleteRoadDetailsForPage(@Param("pageId") int pageId);
+  int deleteRoadDetailsForPage(
+      @Param("pageId") int pageId, @Param("millId") long millId, @Param("year") int year);
 
   /**
    * Delete one page, scoped to mill/year/category. Runs LAST in the cascade, after its cost lines
@@ -768,20 +811,31 @@ int deletePage(
              d.ILCR_ROAD_BALLAST_METHOD_CODE  AS ballast_method_code,
              d.ILCR_ROAD_BALLAST_MATERL_CODE  AS ballast_material_code,
              d.REL_SOIL_MOIST_RGM_CLS_CODE    AS rsmr_class_code,
-             d.BECBIOGEO_CATALOGUE_ID         AS bec_id
+             d.BECBIOGEO_CATALOGUE_ID         AS bec_id,
+             d.RELATIVE_SOIL_MOISTUR_RGM_CODE AS asm_code,
+             d.ILCR_SOIL_MOISTURE_CODE        AS soil_moisture_code
         FROM THE.ROAD_CONSTRUCTION_REPRT_DTL d
        WHERE d.ROAD_CONSTRUCTION_REPRT_DTL_ID = :roadDetailId
       """)
   Optional<StoredClassification> findStoredClassification(@Param("roadDetailId") int roadDetailId);
 
   /**
-   * The classification codes a road detail already carries.
-   *
-   * <p>Used only for the exemption that lets an unchanged code survive its own expiry: a code that
-   * has since been retired must not permanently block re-saving a row that already holds it.
+   * The classification codes a road detail already carries, plus the moisture pair derived from
+   * them.
+   *
+   * <p>Read on every edit so an UNCHANGED classification keeps the moisture pair already stored.
+   * Legacy's {@code filterMoistureCodeLists()} ({@code Schedule10MB:665-689}) rebuilds only the two
+   * dropdown LISTS — it never assigns to the detail — so the stored ASM and soil-moisture codes
+   * change in legacy only when the user picks new ones. Re-deriving unconditionally would rewrite
+   * two NOT NULL columns the legacy print reports consume during an edit that touched neither input
+   * (code review 2026-08-18).
+   *
+   * <p>This also delivers the unchanged-code exemption for the BEC classification: a stored id that
+   * has since dropped out of the offerable xref-gated set would otherwise make its road detail
+   * permanently unsaveable, because the derivation rejects a zero-candidate pair.
    */
   record StoredClassification(
       String roadLifetimeCode, String ballastMethodCode, String ballastMaterialCode,
-      String rsmrClassCode, Integer becId) {
+      String rsmrClassCode, Integer becId, String asmCode, String soilMoistureCode) {
   }
 }