feat(cmdb-import): run the mapping packs stored in OpenRegister, seeded from the shipped files

[WilcoLouwerse]

What

The CMDB import runs the mapping packs stored in OpenRegister, where an admin views and edits them (ConductionNL/openregister#4602, the migration-pack editor). The packs under lib/Settings/cmdb-import/ stay the seed and the fallback. Rework of this PR's first version (read-only overview of the shipped files) after the decision of 2026-10-12: mappings are managed in OpenRegister. The settings UI for it, stackiq#1289 (which pack the next import runs, its source and version, "Edit in OpenRegister"), was stacked on this PR and is merged into it, so this PR carries both.

How

• Resolution (CmdbImportProfile, CmdbImportPackStore): module, manufacturer, usage and business owner come from OpenRegister's migration-pack store by slug; the municipality pack maps the import options and always comes from its file. A stored pack is validated by PackDefinitionValidator and by the import's own rules (CmdbImportPackRules): required targets, and the writable fields of the pack's target schema, read from the register stackiq ships (fragments included), so a property added to the schema can be mapped without a code change. Refused: object metadata, the keys and relations the import sets, every other relation, files, the publication dates and the admin fields; the business-owner pack writes into no schema and keeps name and role. A broken pack stops the import with 503 MAPPING_UNAVAILABLE naming the pack, never a silent fallback.
• Seeding (SeedCmdbImportPacks, install + post-migration; version bumped so it runs on upgrade): the 4 packs are created as built-in with an x-stackiq marker (shipped version + hash). A later release updates a stored pack that was not edited; an edited one is left alone and reported as "newer version shipped". A deleted pack is seeded again on the next import (not on a read of the mapping). The shipped TOPdesk packs start at version 1.0.0, their first version in OpenRegister; whether a stored pack is updated is decided by the shipped pack's hash, not its version.
• Store availability (CmdbImportPackStoreProbe): OpenRegister's pack store counts only when it has the slug-lock class of openregister#4602 and no write method of its pack controller carries an attribute or annotation that skips the CSRF check or admits non-admins (checked by reflection). Without it the import uses the shipped files and says so in the report; once a seed happened, a missing store fails closed.
• Viewing writes nothing: the mapping endpoint and every lazy load use loadForView() (store find() only): a pack not stored yet is shown from its shipped file, nothing is seeded, updated or recorded. Only the import run (load()) and the repair step write.
• No lost edits: updating an unedited pack passes the read pack's updatedAt; when an admin saved it in between, OpenRegister refuses (PackChangedException) and the store keeps the edit.
• Date columns: the profile's plus every column a pack maps with a date transform.
• GET /api/settings/cmdb-import/mapping adds per pack source, packId, storedVersion, shippedVersion, edited, newerShipped, editable, editUrl (IURLGenerator), and top-level openRegisterPacks; profile.archiveSheet names the archive sheet (null when the profile names none), so the section's help texts name the sheets the server's profile reads, the archive sheet included.
• The register's field rules (writable fields, hideOnForm, calculations, fragments, fail-closed on an unreadable fragment) are read by CmdbRegisterSchemaFields, split out of CmdbImportPackRules to stay within the phpmd limits.
• OpenSpec change cmdb-import-mapping-view rewritten for this scope (one mapping per instance); docs/features/cmdb-import.md explains viewing and editing in OpenRegister.

Checks

CI on 68c49f46: 39 green, 10 skipped, including PHPUnit (PHP 8.3, NC stable35, pgsql), Hydra Gates (89 of 89 applicable gates), phpcs, phpmd, phpstan, psalm and eslint. Since then (e8dce552, e7988c37, 8e027d2c, review fixes): jest 215 of 215, test:l10n, check:l10n-js, prettier and stylelint clean, openspec validate --strict valid for both changes, Hydra Gates locally 69 of 69 applicable gates; the PHPUnit service tests need a Nextcloud tree and run in CI.

Earlier, at e2081bb: the Cmdb services, the repair step and the mapping endpoint 130 of 130; e2e on the rig (OpenRegister with #4602): cmdb-import-packs.spec.ts and cmdb-import-mapping.spec.ts 9 of 9.

Rig (NC 35; OpenRegister development + openregister#4602; fixtures only): the 4 packs are seeded (on an instance that upgraded stackiq before OpenRegister had the hardened store, the seed runs at the next repair or import); the endpoint reports source: openregister with edit links; an edited pack is what the import runs (2/2 rows); a pack mapping provider stops the import with 503 naming the pack; restoring the pack makes it "not edited" again.

Merge order and conflicts

• feat(migration-packs): view and edit migration packs in OpenRegister openregister#4602 is merged (2026-10-15). An instance needs it in its OpenRegister for the stored packs and editing; without it the import runs the shipped files and the report says so, and the endpoint answers source: file with no editUrl. Promote the OpenRegister beta before the stackiq beta.
• stackiq#1285 (with feat(cmdb-import): archive or soft-delete applications that left the export #1286 and feat(cmdb-import): offer the missing-records choice and an Archived quick filter #1287, WOO-587) is merged and its branch is merged into this one (8a80c178), so this PR must be merged with a merge commit, not squashed. The resolution: topdesk-profile.json stays at version 1.0.0 with feat(cmdb-import): read the archive sheet and let module and usage be archived #1285's description; the list-based sheet texts name the archive sheet; the shipped-fallback warning moved into addRunWarnings(); both changes now carry the same REQ-CMDB-014 block, so archiving them in either order keeps the whole requirement.
• composer.lock: symfony/yaml 6.4.40 → 6.4.48 for CVE-2026-109413, which made the composer audit fail on every stackiq branch; development still has 6.4.40 until this PR merges.
• The OpenRegister test stand-ins load only when OpenRegister does not ship the class, and mirror its constructors: since #4602, CI's OpenRegister has them.

Jira: WOO-588 — plan: https://github.com/ConductionNL/readonly-mirror-wilco-claude-plans/tree/dev-mirror/issues/jira/WOO-586/sub-tasks/WOO-588/

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/stackiq @ fb382bb

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 133/133
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1230/1230 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-12 10:38 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/stackiq @ 2913bd6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 133/133
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1231/1231 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-12 12:52 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

Verdict: APPROVE (Thorough) — self-review posted as COMMENT (GitHub blocks self-APPROVE)

No blockers: the endpoint is admin-only with CSRF, answers flat, logs unexpected errors with a static 500, and loads the profile through the same autowired CmdbImportProfile as the import. The unbounded failure reason was fixed before posting; what remains is that the view does not yet show the import's write rules.

Update 2026-10-12: The remaining concern was fixed on the branch after posting.

🟡 Concerns (1)

• Overview omits the write rules, so 'what the next import runs' is overclaimed — lib/Service/Cmdb/CmdbImportProfile.php:629. The docblock (and SettingsController.php:3899, design.md:11, proposal.md:10, spec.md:11) promise that the answer is exactly what the next import runs. ✅ Addressed in ecc9c8b0, df28777e, 6ecb274a.

🟢 Minor (3)

• 'Same loader' and 403 are asserted by no test — tests/Unit/Controller/SettingsControllerCmdbImportMappingTest.php:225. Contract-branch table: (1) 'the same loader the import uses': the test builds new CmdbImportProfile(...) itself, passes it in, and compares the answer with $profile->pack() of the same object, so it would stay green if the controller's fallback built a different directory or class; nothing ties it to the instance CmdbExportImportService gets (both are container-autowired today: no CmdbImportProfile registration …
• New 503/500 messages are not extractable and not translated in this slice — lib/Controller/SettingsController.php:3935. The two user-facing messages go through a private translate(string $text) that calls $this->l10n->t($text) with a variable.
• tasks.md marks Tasks 3-5 implemented; their files are not in this slice — openspec/changes/cmdb-import-mapping-view/tasks.md:34. Task 3 (CmdbImportMapping.vue, vitest), Task 4 (l10n, docs section) and Task 5 (e2e) carry [x] Implement, and the spec's @e2e tests/e2e/spec-coverage/cmdb-import-mapping.spec.ts points at a file that does not exist at this head (checked: CmdbImportMapping.vue, cmdbImportMapping.spec.js, cmdb-import-mapping.spec.ts are all absent).

✅ Fixed before posting (1)

• details.reason returns $e->getMessage() to the client — fixed in 0108ef0.

✅ Verified clean

• No auth attribute (Nextcloud default: admin + CSRF) with @auth admin-only <reason>, asserted by testTheRouteIsForNextcloudAdminsOnly.
• 503 path: no absolute path or stack trace reaches the body; the 500 path returns a static message and logs the exception.
• required is always a boolean; the spec's done → in-progress flip follows writing-specs' re-opening rule.

Scope decision: slice 1 of 2 of the closed #1280, stacked on development; reviewed against its own base only.
Gates: CI quality / Hydra Gates and the required PHP/Vue quality checks green on {h}; quality / PHPUnit was still running at submission.
ADRs verified: ADR-005, ADR-012, ADR-031, ADR-050 — all resolve on hydra main.
Jira context: WOO-588 — CMDB-import: mapping inzichtelijk en beheerbaar voor de beheerder (status: Refinement)

[github-actions]

Quality Report — ConductionNL/stackiq @ 0b00bbc

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 133/133
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1368/1368 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-13 19:10 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

Verdict: APPROVE (Strict) — self-review posted as COMMENT (GitHub blocks self-APPROVE)

Round 3 under the convergence rule: the 2 blocking concerns and 6 minors found this round were fixed on the branch before posting, and so were all 14 open threads from rounds 1-2. Every thread is resolved. What still stands between this PR and a merge: 1 approval, and the merge order with openregister#4602 (the docs name it).

Round	Found	Status
1 (80dc551)	🟡 overview omitted the write rules · 3 🟢	resolved in ecc9c8b, d4d7f38, 3d8b789, 8f07929
2 (057abc0)	5 🟡 (GET wrote, update race, docs/spec described #1289's section, unconditional editing claim, SHALLs without scenario) · 7 🟢	resolved in 3d8b789, 8f07929, 3c81e23, 6111cb8, f7421aa
3 (0a349a8) — this review	2 🟡 (ITSM-owned fields mappable, the view showed a pack the import replaces) · 6 🟢	fixed before posting in c797020 … 0a349a8

Finding	Was	Now	Where
🟡 Read-only mapping GET seeds and updates packs	🟡 r2	resolved in 3d8b789 + 81b1bc7	thread
🟡 update() without expectedUpdatedAt	🟡 r2	resolved in 3d8b789 + 81b1bc7	thread
🟡 Docs and spec describe the settings section	🟡 r2	resolved in 3c81e23 + 6111cb8	thread
🟡 Docs promise editing unconditionally	🟡 r2	resolved in 3c81e23	thread
🟡 Section SHALLs without a scenario	🟡 r2	resolved in 3c81e23 + 6111cb8	thread
🟢 Fake update() not faithful	🟢 r2	resolved in 3d8b789	thread
🟢 "Hardened" asserted by a marker class	🟢 r2	resolved in 3d8b789 + f7421aa	thread
🟢 Untranslated 500 message	🟢 r2	resolved in 8f07929	thread
🟢 CHANGELOG omits the pack store	🟢 r2	resolved in 3c81e23	thread
🟢 Half of the "all usages Planned" assertion vacuous	🟢 r2	resolved in 3c81e23	thread
🟢 Task 6 unchecked	🟢 r2	resolved in 3c81e23	thread
🟢 Canonical spec status	🟢 r2	resolved in 3c81e23	thread
🟢 'Same loader' and 403 untested	🟢 r1	resolved in 3d8b789	thread
🟢 503/500 messages not translatable	🟢 r1	resolved in 8f07929	thread
🟡 Widened pack rule admits ITSM-owned usage fields	new	fixed before posting in c797020 + 0a349a8	lib/Service/Cmdb/CmdbImportPackRules.php
🟡 Mapping view shows a pack the next import replaces	new	fixed before posting in 81b1bc7	lib/Service/Cmdb/CmdbImportPackStore.php (find())

Details of this round

Scope decision: delta d4d7f38…e2081bb (6 commits, 36 files, 1,553 changed lines: 1fe71a1, 057abc0, 3d8b789, 8f07929, 3c81e23, e2081bb), reviewed in two slices (backend; spec/docs/e2e), plus this run's fix commits c797020, 81b1bc7, f7421aa, 6111cb8, 94f976e, 1004ee7 and 0a349a8.

✅ Fixed before posting (8)

• ITSM-owned usage fields were mappable (c797020, 0a349a8):
  • A target is refused as system when any definition, in the base register or a register.d fragment, carries hideOnForm: true or is an x-openregister-calculations key. That covers the serviceDesk* fields, suggestedTimeClassification, and the module relations shown read-only.
  • installedVersion is protected by name.
  • An unreadable fragment now fails closed (MAPPING_UNAVAILABLE), because fragments carry this protection.
  • Tests: testAFieldAnotherSubsystemOwnsIsRefused, testAHiddenCalculatedOrFilePropertyIsRefused, testAnUnreadableFragmentIsMappingUnavailable.
• The view showed a pack the next import replaces (81b1bc7): find() answers an unedited, outdated pack as the import will run it. That means the shipped pack and version, storedVersion set to what OpenRegister holds, and updatePending: true, still without writing.
• Update guard off when updatedAt is null (81b1bc7): such a pack is kept, in resolve() and in the view alike.
• Probe tests opened one method per marker (f7421aa): 5 write methods × 4 markers × attribute/docblock, plus the missing-method, missing-class, missing-service and throwing-container branches.
• Spec, proposal and design text (6111cb8): the section wording moved to #1289, the probe's requirements are stated, and type: file is in the REQ-CMDB-021 refusal list.
• e2e left a deleted pack deleted (94f976e): the finally re-imports.

✅ Verified clean

• Every stored-pack consumer goes through the same rules. Managed keys, neverWritten, relations and the pinned defaults are still refused, and the shipped packs still pass.
• find() and resolve() branches are each covered by a named test: missing, current, outdated+unedited, outdated+edited, updatedAt null, renamed, store unavailable.
• The probe passes against openregister#4602 at 170f1cd, whose five write methods carry no opening marker.

Gates: CI quality / Hydra Gates ✅ on e2081bb. CI on 0a349a8 started with this push.
Checks after the fixes: phpunit --filter Cmdb 347 green (bootstrap remapped onto this tree, with a control mutation turning red first), phpcs and phpstan clean on lib/Service/Cmdb. The e2e suite was not run.
Jira context: WOO-588, CMDB-import mapping visible and manageable for the administrator.

Before the next round: this round's findings came mostly from the fixing. The next round's fixes go through the class sweep and the pre-push check first.

vendor/bin/phpunit --filter Cmdb    # 347 green
git grep -n "updatePending" -- lib openspec docs

After posting: PHP Quality (phpmd) went red on 0a349a8, because the fail-closed fragment check pushed CmdbImportPackRules over the class and method complexity limits. Fixed in afaa085: reading the register moved to CmdbRegisterSchemaFields, with unchanged behaviour (--filter Cmdb 347 green; a control mutation in the new class turns two red; phpcs, phpmd and phpstan clean). #1289 merged it in ba983a7.

[github-actions]

Quality Report — ConductionNL/stackiq @ 0b9dc20

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 133/133
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1368/1368 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-13 19:47 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/stackiq @ 59a5090

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 133/133
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1368/1368 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-15 08:33 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/stackiq @ a3ea48d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 133/133
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1426/1426 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-15 10:48 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

🟢 Minor — the profile version goes back from 2.1.0 to 1.0.0

On development (since stackiq#1285) the profile is at 2.1.0; this PR resets it to 1.0.0, because the PR body treats 1.0.0 as the first version for the administrator. That reason holds for the four packs, which are stored in OpenRegister; the profile itself is never stored there and always comes from this file. No code reads the version except the payload of mappingOverview(), so nothing breaks.

Kept as is on purpose (decision 2026-10-15): the PR body chose 1.0.0 deliberately. Worth a second look only if something starts comparing profile versions.

Verification: git grep -n "\[.version.\]\|->version\|profile\[.version" -- lib → only the overview payload reads it

[WilcoLouwerse]

🟢 Minor — without an archive sheet, the option texts still promise the trash

With archiveSheet null this paragraph says the import only archives, which matches reconcileTarget() (it deletes only when the archive sheet is present). The radio label "Archive or delete them", its help "…archived or moved to the trash" and the info line "…archived or deleted, unless you choose to keep them" in CmdbImport.vue do not switch on archiveSheet and still mention deleting.

The shipped profile always names an archive sheet, so this does not show today. Left as is: only relevant once a profile without an archive sheet is supported. Related, outside this diff: for such a profile addRunWarnings() reports Sheet "" was not found…, because archiveSheet() falls back to an empty name.

Verification: git grep -n "Archive or delete them\|moved to the trash" -- src/views → the three texts, none conditional on archiveSheet

[WilcoLouwerse]

Verdict: APPROVE (Strict) — self-review posted as COMMENT (GitHub blocks self-APPROVE)

Nothing blocking left: the 3 concerns and 2 of the 4 minors found this round were fixed on the branch before posting; 2 minors are left as-is on purpose, each in an open thread. What still stands between this PR and a merge: 1 approval, those 2 open threads (development requires every thread resolved), and CI on 727793f, which started with the last push.

Round	Found	Status
1 (80dc551)	🟡 overview omitted the write rules · 3 🟢	resolved
2 (057abc0)	5 🟡 · 7 🟢	resolved
3 (0a349a8)	2 🟡 · 6 🟢, fixed before posting	resolved
4 (727793f) — this review	3 🟡 (REQ-CMDB-014 split over two changes, archive sheet from a constant, stale description) · 4 🟢 (untested info sentence, test stand-ins without constructors, profile version back to 1.0.0, option texts without an archive sheet)	3 🟡 + 2 🟢 fixed before posting; 2 🟢 left as-is

Finding	Was	Now	Where
🟡 Two open changes each replace REQ-CMDB-014 in full	new	resolved in 8e027d2	openspec/changes/*/specs/cmdb-export-import/spec.md
🟡 Archive sheet named from a constant, not the profile	new	resolved in e7988c3	src/utils/cmdbImport.js, CmdbImportProfile::mappingOverview()
🟡 PR description no longer described the PR	new	resolved (description updated 2026-10-15)	PR description
🟢 No test for the info panel's archive sentence	new	resolved in e7988c3	src/views/settings/sections/CmdbImport.spec.js
🟢 Test stand-in exceptions without OpenRegister's constructors	new	resolved in e8dce55	tests/Unit/Support/OpenRegister/
🟢 Profile version back from 2.1.0 to 1.0.0	new	left as-is (deliberate, see thread)	thread
🟢 Without an archive sheet the option texts still promise the trash	new	left as-is (no such profile ships)	thread

Details of this round

Scope: the delta since round 3 (0a349a8), 12 commits: afaa085 (the register's field rules into CmdbRegisterSchemaFields), the merge of stackiq#1285–#1287 into this branch (8a80c17, reviewed as its conflict resolutions with git show --remerge-diff, 16 files), 6070859 (symfony/yaml 6.4.40 → 6.4.48 for CVE-2026-109413) and 68c49f4 (OpenRegister stand-ins load only when OpenRegister does not ship the class, since openregister#4602 put them on its development). The merges of #1286, #1287 and #1289 were reviewed in their own PRs.

✅ Fixed before posting (5 + 6 from the pre-push check)

• REQ-CMDB-014 (8e027d2): both cmdb-import-mapping-view and cmdb-import-archive-reconciliation now carry one identical block (the missing-applications choice, the four counts, reconciliation rows, the mapping block, the archive sheet from the profile, the "keep missing applications" scenario), with a note in each that a change goes into both; openspec validate --strict valid for both.
• Archive sheet from the profile (e7988c3): mappingOverview() answers profile.archiveSheet; mappingArchiveSheet() falls back to the shipped name only until the mapping has loaded; the info text, the too-large hint and the missing-applications paragraph name the profile's sheet, and without one leave it out and say the import only archives (as reconcileTarget() does). Mutations turning the section's pass-through off make the new tests fail.
• Stand-ins (e8dce55): constructors and getErrors() as in OpenRegister's development.
• Description: rewritten Checks and Merge-order sections; #1289, CmdbRegisterSchemaFields, the yaml bump and the stand-in fix described.
• The pre-push check on these fixes found the literal sheet name still in the info-panel paragraph, two defaults using the constant directly, an @e2e exclude reason that did not hold, small wording gaps and a singular/plural slip; all fixed before the push. CI then flagged an import order (perfectionist/sort-named-imports), fixed in 727793f.

✅ Verified clean

• afaa085: same behaviour (relation-wins merge, reasonOf order, fail-closed on an unreadable register, fragment or glob, hideOnForm/calculations as system, lazy cache); CmdbImportPackRulesTest 31/31, probe 44/44.
• Merge resolution: no live copy of the replaced {first}/{second} keys; en/nl json and js in sync; warning order unchanged for every test; CmdbImport.vue help and info panel as on development plus the mapping block; docs, CHANGELOG, spec list and e2e imports keep both sides.
• 6070859: lock only, tag v6.4.48 (2026-10-12), in packages-dev.
• 68c49f4: every "store unavailable" test injects made-up class names, so the real classes make none of them pass vacuously.

Gates: CI quality / Hydra Gates ✅ on 68c49f4 (89 of 89 applicable gates); locally on the fixes 69 of 69 applicable gates. CI on 727793f started with the last push.
Checks after the fixes: jest 215/215, test:l10n, check:l10n-js, prettier, stylelint clean, phpcs/phpmd/phpstan clean on CmdbImportProfile.php. Not run locally: the PHPUnit service tests (need a Nextcloud tree, CI runs them), eslint (local Node too old; CI caught the one error), vitest's cmdbImportMapping.spec.js (local Node).
Jira context: WOO-588 (mapping), WOO-590 (beta release).

Before the next round: fix rules ON — fix-induced 5 + missed-sibling 0 ≥ new 1 (copy-missed 1). This round's findings came almost all from the conflict resolution and the CI fixes; the next round's fixes go through the class sweep and the pre-push check first.

[github-actions]

Quality Report — ConductionNL/stackiq @ 34578a7

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 133/133
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1426/1426 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-15 12:02 UTC

Download the full PDF report from the workflow artifacts.