docs(ai): refresh handoff state after PR #153 merge

- CURRENT_TASK rolls forward — PR #153 closed out, no active task,
  with recommended next moves (promote e2e gate to required, pick
  from TODO).
- HANDOFF rewritten — new home position is `main`; documents the
  e2e job's stub ANTHROPIC_API_KEY convention so future
  AI-touching e2e tests know what to expect.
- SESSION_LOG entry extended with the CI env-var diagnosis, the
  fix, the merge, and pointers to the natural next pickups.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.ai/CURRENT_TASK.md

@@ -1,28 +1,20 @@
 # CURRENT_TASK.md
 
-**Task:** Land PR #153 — fix the AssistantChatPage prefill `currentChatRef` bug that silently dropped AI follow-up responses in the task lane.
+**Task:** No active task — pick from [`TODO.md`](TODO.md).
 
-**Status:** in-progress (CI running on rebased branch)
+**Status:** ready for next pickup.
 
-**Definition of Done:**
-- [ ] PR #153 (`fix/tasklane-prefill-ref`) CI green on the rebased SHA `1559feb`. Backend, frontend, and e2e all pass.
-- [ ] PR #153 merged into `main`.
-- [ ] User-visible verification: from the dashboard, type a prefill, answer a subset of task-lane questions, click *Send N of M Responses* — AI follow-up renders.
+## Recommended next moves
 
-**Assumptions:**
-- Rebasing onto post-#150 main pulls in the workflow fixes (no host-port mapping for postgres, no upload-artifact step), so the prior CI failures on this PR are resolved structurally.
-- The new e2e regression spec (`frontend/e2e/assistant-chat-prefill.spec.ts`) doesn't depend on Anthropic — it uses `page.route` to stub `/ai-sessions/*/chat` deterministically, so it should be CI-stable.
-
-**Out of scope (deferred to TODO):**
-- Hardening the `currentChatRef.current !== sentForChatId` silent-return pattern across `handleSend`, `handleTaskSubmit`, `selectChat`, `refreshFacts`, `refreshActiveFix`, `refreshPreview`. PR #153 fixes the specific symptom; the broader audit is its own task in `TODO.md`.
-- Promoting `CI / e2e (pull_request)` to required on `main`. Holding off until two consecutive green PR runs (PR #150 was one; PR #153's run will be the second if it passes).
+1. **Promote `CI / e2e (pull_request)` to required on `main`.** Two consecutive PR runs (#150 and #153) have now finished green on the e2e job. That was the threshold the prior CI-recovery task set for promoting it. Branch protection update only — no code change.
+2. **Pick a backlog item.** Top of `TODO.md` "Up next" is the `data-testid` e2e-stability work (PR #152 spent five one-line selector updates chasing UI churn — adding stable test IDs to a small set of high-value elements would make those tests immune to copy/route renames). The new `currentChatRef` silent-return audit added in #153's session is in Backlog and is a natural pairing with the bug fix that was just shipped.
 
 ## Previous task — closed out
 
-**Task:** Land consolidated CI-recovery PR #150 and lock reliable CI gates on `main`.
+**Task:** Land PR #153 — fix the `AssistantChatPage` prefill `currentChatRef` bug that silently dropped AI follow-up responses in the task lane.
 
 **Status:** complete (2026-04-26).
 
-- PR #150 merged as commit `87bb20b` on `main`. Backend, frontend, and e2e all green on the merge SHA.
-- `CI / backend (pull_request)` added to required status checks on `main` (alongside the pre-existing `CI / frontend (pull_request)` requirement).
-- `CI / e2e (pull_request)` left as not-required pending one more green PR run.
+- PR #153 merged as commit `68fcdc6` on `main`. Backend, frontend, and e2e all green on the merged SHA after the env-var fix.
+- E2e CI needed a stub `ANTHROPIC_API_KEY` in the workflow so the AI-gated `POST /api/v1/ai-sessions` endpoint stops returning 503; the Playwright `page.route` stub still intercepts the actual `/chat` call in the browser, so no real Anthropic traffic occurs.
+- Regression test `frontend/e2e/assistant-chat-prefill.spec.ts` is part of the e2e suite going forward.

.ai/HANDOFF.md

@@ -2,54 +2,27 @@
 
 # HANDOFF.md
 
-**Last updated:** 2026-04-26 03:50 EDT
+**Last updated:** 2026-04-26 04:55 EDT
 
-**Active task:** Ship PR #153 — the AssistantChatPage prefill `currentChatRef` bug fix. See [CURRENT_TASK.md](CURRENT_TASK.md).
+**Active task:** None — pick from [`TODO.md`](TODO.md). See [`CURRENT_TASK.md`](CURRENT_TASK.md) for recommended next moves.
 
-**Branch:** `fix/tasklane-prefill-ref` → PR #153.
+**Branch:** `main` is the home position. Recent merges: PR #150 (CI recovery, `87bb20b`), PR #153 (prefill `currentChatRef` fix, `68fcdc6`).
 
-## Current resume point
+## Where things stand
 
-PR #150 is merged. Branch `fix/tasklane-prefill-ref` has been rebased onto the new `main` (HEAD `1559feb`) and force-pushed; that pulled in the workflow fixes from #150, so the prior backend port-conflict and frontend upload-artifact failures are gone structurally.
-
-CI was kicked off automatically on the rebased SHA. Watch:
-
-- `CI / backend (pull_request)` — should pass now that postgres uses the docker-network DNS name `postgres:5432` (no host port race).
-- `CI / frontend (pull_request)` — should pass now that the `actions/upload-artifact@v4` step is removed.
-- `CI / e2e (pull_request)` — runs on its own postgres + builds frontend inline. Includes the new `e2e/assistant-chat-prefill.spec.ts` regression test, which stubs `/ai-sessions/*/chat` with `page.route` and is independent of Anthropic.
-
-If all three go green, merge #153 into `main`.
-
-## What this PR fixes
-
-Reported symptom: in a troubleshooting (chat) session, after answering a subset of the task-lane questions and clicking *Send N of M Responses*, no AI response appeared.
-
-Root cause: the dashboard prefill effect in `AssistantChatPage` set `activeChatId` after creating a new session but never updated `currentChatRef.current`. The `currentChatRef.current !== sentForChatId` guard inside `handleSend` and `handleTaskSubmit` then bailed silently on every later request and discarded the AI's reply.
-
-Fix is a single line: assign `currentChatRef.current = session.session_id` immediately after `setActiveChatId(session.session_id)` in the prefill effect, mirroring `handleNewChat` and `handleResumeNew`.
-
-## Verification completed
-
-- New regression test `frontend/e2e/assistant-chat-prefill.spec.ts` drives the real dashboard prefill flow against the real backend, stubs `/ai-sessions/*/chat` for deterministic turn-1/turn-2 responses, asserts the second AI message renders. Confirmed it fails on unfixed code at the exact assertion (`Got it — based on your answer…` never appears) and passes once the fix is restored.
-- `tsc -b` clean. No new lint errors. Adjacent specs (`flowpilot-chat`) still pass.
-
-## Branch protection on main (current)
-
-- PR-only merges
-- `CI / frontend (pull_request)` required
-- `CI / backend (pull_request)` required (added during PR #150 close-out)
-- Force-push blocked
-- No review required (solo)
+- CI is healthy on `main`: backend, frontend, and e2e all green on the latest commits.
+- Branch protection on `main`: PR-only merges, force-push blocked, **`CI / frontend (pull_request)` required**, **`CI / backend (pull_request)` required**, `CI / e2e (pull_request)` not yet required.
+- Two consecutive PR runs (#150, #153) finished green on e2e. The "promote e2e to required" gate from the prior task is now satisfiable.
+- Backend AI-gated endpoints (`POST /ai-sessions`, `/chat`, `/respond`, etc.) call `_require_ai_enabled()` and return 503 if no provider key is set. The e2e CI job now sets a stub `ANTHROPIC_API_KEY` so any future test that exercises those flows can rely on it; tests should still stub the actual AI calls in the browser via `page.route` so no real Anthropic traffic occurs.
 
 ## Immediate next steps
 
-1. Watch PR #153 CI on `1559feb`.
-2. Merge PR #153 when all three checks are green.
-3. After merge, decide whether to promote `CI / e2e (pull_request)` to required (would make this two consecutive green PR e2e runs in a row, the threshold from the prior CURRENT_TASK).
-4. Pick next item from `.ai/TODO.md` — top "Up next" is the `data-testid` audit; the `currentChatRef` silent-return follow-up is in Backlog and is a natural pairing with this fix.
+1. (Optional, ops-only) Promote `CI / e2e (pull_request)` to required on `main` in Gitea branch protection.
+2. Pick the next backlog item from `TODO.md`. Top of "Up next" is the `data-testid` e2e-stability audit; the new `currentChatRef` silent-return audit (added to backlog in this session) is a natural pairing with the bug fix that just shipped.
 
 ## Useful breadcrumbs
 
-- Bug fix: [`frontend/src/pages/AssistantChatPage.tsx`](../frontend/src/pages/AssistantChatPage.tsx) around line 258 — the `currentChatRef.current = session.session_id` line in the prefill `sendPrefill` effect.
+- The fix that just landed: [`frontend/src/pages/AssistantChatPage.tsx`](../frontend/src/pages/AssistantChatPage.tsx) — `currentChatRef.current = session.session_id` after `setActiveChatId` in the dashboard prefill effect.
 - Regression test: [`frontend/e2e/assistant-chat-prefill.spec.ts`](../frontend/e2e/assistant-chat-prefill.spec.ts).
-- TODO entry tracking the broader silent-return audit: [`.ai/TODO.md`](TODO.md).
+- E2e env convention: [`.gitea/workflows/ci.yml`](../.gitea/workflows/ci.yml) — `ANTHROPIC_API_KEY` is stubbed in the e2e job env. Tests that exercise AI-gated endpoints should stub the actual AI calls in the browser, not rely on a real key.
+- Silent-return follow-up entry: [`.ai/TODO.md`](TODO.md), Backlog section.

.ai/SESSION_LOG.md

@@ -21,8 +21,11 @@
 - First CI run on PR #153 failed on infrastructure issues already addressed by PR #150: backend hit `Bind for 0.0.0.0:5432 failed: port is already allocated`, frontend hit `actions/upload-artifact@v4 not supported on GHES`. PR #150 was already merged (commit `87bb20b` on `main`). Rebased `fix/tasklane-prefill-ref` onto new `main` (force-push `1a8cb06` → `1559feb`), resolved a `.ai/TODO.md` conflict by keeping both backlog item sets, kicked off CI on the rebased SHA.
 - Confirmed `CI / backend (pull_request)` is now in branch protection's required-status-checks list (added during PR #150 close-out). `CI / e2e (pull_request)` left as not-required pending one more clean PR run as the threshold.
 - Recorded the broader silent-return concern in TODO backlog: the `currentChatRef.current !== sentForChatId` guard is applied across `handleSend`, `handleTaskSubmit`, `selectChat`, `refreshFacts`, `refreshActiveFix`, and `refreshPreview`. PR #153 fixes one symptom but the same pattern can mask other drift. Either log a Sentry breadcrumb on the mismatch path or distinguish "expected stale" (chat switch) from "unexpected stale" (ref never updated) so the latter alerts.
-- Left for next session: watch PR #153 CI on `1559feb`, merge when green, then decide whether to promote `CI / e2e (pull_request)` to required and pick the next item from `TODO.md` — natural pairing is the `currentChatRef` silent-return audit added to backlog this session.
-- Files touched: `frontend/src/pages/AssistantChatPage.tsx` (the one-line fix + comment), `frontend/e2e/assistant-chat-prefill.spec.ts` (new regression test), `.ai/TODO.md` (silent-return follow-up entry, plus conflict resolution preserving PR #150's backlog additions), `.ai/CURRENT_TASK.md` (rolled forward to PR #153 active task; previous task closed out), `.ai/HANDOFF.md` (new resume point), `.ai/SESSION_LOG.md` (this entry).
+- First CI run on the rebased SHA passed backend and frontend but failed e2e: the new prefill regression test couldn't render the task-lane question text. Diagnosed via the job log: `POST /api/v1/ai-sessions` calls `_require_ai_enabled()` and returns 503 when no provider key is set. The e2e CI job had neither `ANTHROPIC_API_KEY` nor `GOOGLE_AI_API_KEY` in env. Locally the dev backend has a real key, hence the local pass. The Playwright `page.route` stub on `/chat` was correct but never had a chance to fire because the upstream session-creation call was 503-ing.
+- Fix: added a stub `ANTHROPIC_API_KEY: ci-stub-key-not-used-by-tests` to the e2e job env in `.gitea/workflows/ci.yml`. The Playwright stub still intercepts the actual `/chat` call in the browser, so the backend never contacts Anthropic — the gate just needs to clear. Documented the convention in a workflow comment so future AI-touching e2e tests know what to expect. Pushed `11fe32f`; CI went all-green.
+- Merged PR #153 as `68fcdc6` on `main`. Local feature branch and remote both deleted via Gitea's `delete_branch_after_merge`.
+- Opened a small follow-up `chore/post-153-handoff` PR to refresh the now-stale `.ai/` files (this entry, plus `CURRENT_TASK.md` rolling forward to "no active task — pick from `TODO.md`" and `HANDOFF.md` updating to the post-merge home position). The `data-testid` audit at the top of `TODO.md` "Up next" or the `currentChatRef` silent-return audit added in this session's backlog are the natural next pickups.
+- Files touched: `frontend/src/pages/AssistantChatPage.tsx` (the one-line fix + comment), `frontend/e2e/assistant-chat-prefill.spec.ts` (new regression test), `.gitea/workflows/ci.yml` (stub `ANTHROPIC_API_KEY` for e2e), `.ai/TODO.md` (silent-return follow-up entry, plus conflict resolution preserving PR #150's backlog additions), `.ai/CURRENT_TASK.md`, `.ai/HANDOFF.md`, `.ai/SESSION_LOG.md` (this entry).
 
 ## 2026-04-25 16:41 EDT — Codex — Stabilize PR #150 e2e selectors