docs(migration): v4.0.0 ResourceDoc parity — update table + fix-candidate detail

After commit 2b24811 dropped v4.0.0 audit mismatches from 172 to 20,
update the per-version drift table and add a new "v4.0.0 — 20 specific
drifts" subsection with per-endpoint resolution notes. New total across
all migrated versions: 225 mismatches (was 377).

v4.0.0's residual drifts split into structural-rename buckets (mostly
ResourceDocMatcher disambiguation: VIEW_ID → GRANT_VIEW_ID, COUNTERPARTY_ID
→ COUNTERPARTY_ID_PARAM, hyphen → underscore for DYNAMIC-RESOURCE-DOC-ID,
firehose template bypass) plus 1 legitimate REST-correctness fix
(deleteExplicitCounterparty POST → DELETE) and 1 Lift URL-bug fix
(deleteCustomerAttribute). Also notes the 2 only-lift entries
(getAllAuthenticationTypeValidationsPublic / getAllJsonSchemaValidationsPublic)
as an outstanding migration gap to port to http4s.

Author: constantine2nd

LIFT_HTTP4S_MIGRATION.md

@@ -194,11 +194,11 @@ Separate from the resource-docs **serving** workstream above, there is a parity
 | v2_2_0 | 18  | 13 | 0 | 0 | not started |
 | v3_0_0 | 47  | 41 | 0 | 0 | not started |
 | v3_1_0 | 102 | 49 | 0 | 0 | not started |
-| v4_0_0 | 254 | 172| 2 | 5 | not started |
+| v4_0_0 | 254 | 20 | 2 | 5 | semantic fields restored; 20 structural drifts (placeholder renames + 1 verb fix) remain |
 | v5_0_0 | 39  | 8  | 0 | 3 | descriptions restored; structural/errors remain |
 | v5_1_0 | 111 | 1  | 1 | 2 | one verb-casing drift to fix |
 | v6_0_0 | 243 | 12 | 0 | 1 | 11 placeholder renames + 1 routing-shape upstream change |
-| **Total** | **956** | **377** | | | |
+| **Total** | **956** | **225** | | | |
 
 ### v6.0.0 — 12 specific drifts (each is a fix candidate)
 
@@ -231,6 +231,22 @@ Also:
 - 1 only-lift (`createConsentImplicit`) + 1 only-http4s (`createConsent`) — Lift had `lazy val createConsentImplicit = createConsent` aliasing and registered the doc under the alias; http4s registers under the canonical name. Fix: in http4s, either rename the partial function to `createConsentImplicit` to match Lift, or register a second `nameOf(createConsentImplicit)` doc for the same handler.
 - 1 only-http4s (`getBanks`) — kept in the v5.1.0 layer for metrics attribution (intentional addition; see comment at `Http4s510.scala:288`). Document.
 
+### v4.0.0 — 20 specific drifts + 2 only-lift + 5 only-http4s
+
+After semantic-field restoration (commit `2b24811e5`), the remaining drifts are all structural / functional:
+
+| Category | Count | Endpoints | Resolution |
+|---|---|---|---|
+| requestVerb | 1 | `deleteExplicitCounterparty` (Lift `POST` → http4s `DELETE`) | http4s is REST-correct. **Document** as deliberate fix. |
+| requestUrl — `VIEW_ID` → `GRANT_VIEW_ID` | 9 | `answerTransactionRequestChallenge` and 8 `createTransactionRequest*` variants (Account/AccountOtp/AgentCashWithDrawal/Counterparty/FreeForm/Refund/Sepa/Simple) | Middleware disambiguation rename. Verify if `VIEW_ID` collides in `ResourceDocMatcher`; if not, revert. If it does, **document**. |
+| requestUrl — hyphen→underscore | 6 | `delete`/`get`/`update` × `BankLevelDynamicResourceDoc` / `DynamicResourceDoc` (Lift `DYNAMIC-RESOURCE-DOC-ID` → http4s `DYNAMIC_RESOURCE_DOC_ID`) | The matcher's ALL_CAPS-with-underscores wildcard requires underscores. **Fix Lift**? No — Lift is source-of-truth. **Document** at the http4s site as a required matcher constraint. |
+| requestUrl — `COUNTERPARTY_ID` → `COUNTERPARTY_ID_PARAM` | 2 | `deleteExplicitCounterparty`, `getCounterpartyByIdForAnyAccount` | Same as v6's COUNTERPARTY rename family. Verify matcher behavior; revert if safe. |
+| requestUrl — `COUNTERPARTY_ID` → `EXPLICIT_COUNTERPARTY_ID` | 1 | `getExplicitCounterpartyById` | Same defensive rename pattern. |
+| requestUrl — firehose pattern | 1 | `getFirehoseAccountsAtOneBank` (Lift `BANK_ID/.../VIEW_ID` → http4s `FIREHOSE_BANK_ID/.../FIREHOSE_VIEW_ID`) | Middleware bypass for the prop-check-before-bank-lookup pattern (see CLAUDE.md "Prop check before role check" gotcha). **Document** — required for correctness. |
+| requestUrl — Lift URL malformed | 1 | `deleteCustomerAttribute` (Lift `/banks/BANK_ID/CUSTOMER_ID/attributes/.../...` is missing `/customers/`; http4s uses `/banks/BANK_ID/customers/attributes/...`) | Lift URL was buggy. http4s fixed it. **Document** as deliberate URL fix; flag that the Lift comment preserves the original bug as historical record. |
+
+Also: 2 only-lift (`getAllAuthenticationTypeValidationsPublic`, `getAllJsonSchemaValidationsPublic`) — these endpoints exist in Lift v4 but were not migrated to `Http4s400`. **Migration gap** — port them. 5 only-http4s (`createBankLevelDynamicEntity`, `createSystemDynamicEntity`, `updateBankLevelDynamicEntity`, `updateMyDynamicEntity`, `updateSystemDynamicEntity`) — dynamic-entity overrides added in http4s with no Lift equivalent. Document if intentional, or audit whether they should have Lift counterparts.
+
 ### v5.0.0 — 8 specific drifts + 3 only-http4s
 
 | Category | Count | Endpoints | Resolution |