fix(backend): resolve the body datum placeholder from at, not UtcNow (RB-29)

LetterHtml.Render already receives the letter's instant and uses it
for the letterhead date. The body's "datum" placeholder resolved
through ResolveAuto, which ignored that instant and read the wall
clock instead. This is not a shipped bug today, because every current
caller passes Now() at render time. It becomes one the moment Render
runs with a historical instant (an archive re-render, a back-dated
letter): the letterhead and the body would then disagree within one
document.

Thread the existing "at" parameter down through RenderParagraphs and
RenderNode into ResolveAuto's "datum" case. Render's own signature,
and every call site, stays unchanged.

Add two tests with a fixed historical "at": one pins the body's
rendered date to the expected Dutch string, the other asserts the
letterhead date and the body date agree. Both fail red against the
old code, showing today's date instead of the pinned one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Domain/Letters/LetterHtml.cs

@@ -56,7 +56,7 @@ public static class LetterHtml
     {
       sb.Append("<section><h3>").Append(Enc(section.Title)).Append("</h3>");
       foreach (var block in section.Blocks)
-        RenderParagraphs(sb, block.Content.Paragraphs, defs);
+        RenderParagraphs(sb, block.Content.Paragraphs, defs, at);
       sb.Append("</section>");
     }
     sb.Append("</div>");
@@ -89,7 +89,8 @@ public static class LetterHtml
   private const string RecipientPlaceholder = "Adres van de geadresseerde\n(wordt ingevuld bij verzending)";
 
   private static void RenderParagraphs(
-      StringBuilder sb, IReadOnlyList<ParagraphDto> paragraphs, IReadOnlyDictionary<string, PlaceholderDefDto> defs)
+      StringBuilder sb, IReadOnlyList<ParagraphDto> paragraphs, IReadOnlyDictionary<string, PlaceholderDefDto> defs,
+      string at)
   {
     string? openList = null;
     foreach (var para in paragraphs)
@@ -101,14 +102,14 @@ public static class LetterHtml
         openList = para.List;
       }
       sb.Append(openList is null ? "<p>" : "<li>");
-      foreach (var node in para.Nodes) RenderNode(sb, node, defs);
+      foreach (var node in para.Nodes) RenderNode(sb, node, defs, at);
       sb.Append(openList is null ? "</p>" : "</li>");
     }
     if (openList is not null) sb.Append(openList == "bullet" ? "</ul>" : "</ol>");
   }
 
   private static void RenderNode(
-      StringBuilder sb, RichTextNodeDto node, IReadOnlyDictionary<string, PlaceholderDefDto> defs)
+      StringBuilder sb, RichTextNodeDto node, IReadOnlyDictionary<string, PlaceholderDefDto> defs, string at)
   {
     switch (node.Type)
     {
@@ -122,7 +123,7 @@ public static class LetterHtml
         var key = node.Key ?? "";
         var def = defs.GetValueOrDefault(key);
         var label = def?.Label ?? key;
-        sb.Append(def is { AutoResolvable: true } ? Enc(ResolveAuto(key, label)) : Enc($"[NOG IN TE VULLEN: {label}]"));
+        sb.Append(def is { AutoResolvable: true } ? Enc(ResolveAuto(key, label, at)) : Enc($"[NOG IN TE VULLEN: {label}]"));
         break;
     }
   }
@@ -131,11 +132,11 @@ public static class LetterHtml
   // single demo applicant (SeedData.Registration — no per-brief resolved value is
   // ever stored, see the class doc above). Falls back to the label itself for any
   // other auto-resolvable key, mirroring the FE canvas' own `sampleFor` fallback.
-  private static string ResolveAuto(string key, string label) => key switch
+  private static string ResolveAuto(string key, string label, string at) => key switch
   {
     "naam_zorgverlener" => SeedData.Registration.Naam,
     "big_nummer" => SeedData.Registration.BigNummer,
-    "datum" => FormatDatumNl(DateTimeOffset.UtcNow.ToString("o")),
+    "datum" => FormatDatumNl(at),
     _ => label,
   };
 

backend/tests/BigRegister.Tests/LetterHtmlTests.cs

@@ -80,6 +80,44 @@ public class LetterHtmlTests
 
   private static readonly string GoldenPath = Path.Combine(AppContext.BaseDirectory, "LetterHtml.golden.html");
 
+  // A minimal brief whose body renders the "datum" placeholder — the golden-file
+  // fixture above never uses it in the body, only in the letterhead, so it cannot
+  // exercise ResolveAuto's "datum" case (TE-007).
+  private static BriefEntity FixtureBriefWithDatumInBody() => new()
+  {
+    BriefId = "datum-brief-1",
+    Owner = "golden",
+    Beroep = "arts",
+    TemplateId = "besluit-arts",
+    DrafterId = BriefStore.DrafterId,
+    Placeholders = new[]
+    {
+      new PlaceholderDefDto("datum", "Datum", true),
+    },
+    Sections = new()
+    {
+      new("kern", "Kern van het besluit", true, new List<LetterBlockDto>
+      {
+        new("freeText", "kern-1", new RichTextBlockDto(new[]
+        {
+          new ParagraphDto(new[] { new RichTextNodeDto("placeholder", Key: "datum") }),
+        })),
+      }),
+    },
+    Status = new BriefStatusDto("draft"),
+  };
+
+  private static string ExtractLetterheadDate(string html) =>
+      Regex.Match(html, "<dt>Datum</dt><dd>([^<]+)</dd>").Groups[1].Value;
+
+  private static string ExtractBodyDatumParagraph(string html)
+  {
+    var bodyStart = html.IndexOf("<div class=\"letter__body\">", StringComparison.Ordinal);
+    var bodyEnd = html.IndexOf("<div class=\"letter__signature\">", StringComparison.Ordinal);
+    var body = html[bodyStart..bodyEnd];
+    return Regex.Match(body, "<p>([^<]+)</p>").Groups[1].Value;
+  }
+
   [Fact]
   public void Render_matches_the_golden_file()
   {
@@ -88,6 +126,29 @@ public class LetterHtmlTests
     Assert.Equal(golden, html);
   }
 
+  [Fact]
+  public void Render_resolves_the_body_datum_placeholder_from_the_given_at_not_the_wall_clock()
+  {
+    const string historicalAt = "2019-03-14T08:00:00.0000000+00:00";
+
+    var html = LetterHtml.Render(FixtureBriefWithDatumInBody(), Template, historicalAt, watermark: false);
+
+    Assert.Equal("14 maart 2019", ExtractBodyDatumParagraph(html));
+  }
+
+  [Fact]
+  public void Render_keeps_the_letterhead_date_and_the_body_datum_in_agreement_for_a_historical_at()
+  {
+    // A historical `at` (an archive re-render, a back-dated letter) is the case
+    // where the letterhead and the body datum placeholder could disagree within
+    // one document, if the body still read the wall clock (TE-007).
+    const string historicalAt = "2019-03-14T08:00:00.0000000+00:00";
+
+    var html = LetterHtml.Render(FixtureBriefWithDatumInBody(), Template, historicalAt, watermark: false);
+
+    Assert.Equal(ExtractLetterheadDate(html), ExtractBodyDatumParagraph(html));
+  }
+
   [Fact]
   public void Every_letter_prefixed_class_exists_in_letter_css()
   {