Release: merge development into beta

.githooks/pre-commit

@@ -43,4 +43,20 @@ if git diff --cached --name-only | grep -qE "^openspec/(specs/|features\.overlay
   fi
 fi
 
+# A NEW MIGRATION NEEDS A VERSION BUMP, and this is the cheapest place to be
+# told. Nextcloud reads an app's migration files only when appinfo/info.xml's
+# <version> is greater than the installed_version it recorded, so a migration
+# committed without a bump runs on no existing instance and says nothing about
+# it. CI (merge-hygiene) is the enforcement; this only tells you earlier.
+#
+# WARN ONLY, like everything else in this hook: a commit is a fine moment to
+# learn about it and a bad moment to be blocked, and the bump is often the last
+# thing you write. The gate on the PR is what actually holds the line.
+if git diff --cached --name-only --diff-filter=A | grep -q "^lib/Migration/.*\.php$"; then
+  if ! php scripts/check-migration-version-bump.php >/dev/null 2>&1; then
+    echo "pre-commit: WARNING — this change adds a migration without moving <version> in appinfo/info.xml." >&2
+    echo "            Run: php scripts/check-migration-version-bump.php" >&2
+  fi
+fi
+
 exit 0

.github/workflows/api-test-coverage.yml

@@ -131,6 +131,36 @@ jobs:
           # than 40 lines later where it reads as a dependency-install failure.
           docker exec nextcloud php /usr/local/bin/composer --version
 
+      - name: Provide git inside the container
+        # Same shape as the composer step above, and for the same reason: the
+        # unit suite runs INSIDE the nextcloud container, and that image ships
+        # no git.
+        #
+        # MigrationVersionBumpCheckTest builds a small repository per case and
+        # runs scripts/check-migration-version-bump.php over it, because a test
+        # that inspects THIS repository can only report whatever today's branch
+        # happens to look like. With no git the fixtures are never created, so
+        # all six repository cases failed with
+        #
+        #     /tmp/or-migration-gate-256a137d7fd3 is not a git repository
+        #
+        # which reads as a defect in the gate rather than an absent binary.
+        # Measured 2026-09-06: this job had failed on all eight development
+        # pushes since the gate landed in #3451, and `git --version` in the
+        # container answers `command not found`. With git present the class
+        # passes 8/8.
+        #
+        # apt rather than `docker cp` of the runner's binary: git is not a
+        # single file like the composer phar, and a copied binary would leave
+        # its shared libraries and helper programs behind.
+        run: |
+          set -e
+          docker exec -u root nextcloud bash -lc \
+            'apt-get update -qq && apt-get install -y -qq --no-install-recommends git'
+          # Prove it is usable HERE, as the user the suite runs as, rather than
+          # 40 lines later where it reads as a broken gate.
+          docker exec -u www-data nextcloud git --version
+
       - name: PHPUnit unit suite (in-container, HARD GATE)
         # The unit suite requires the full Nextcloud runtime — the OCP stubs
         # reference Doctrine\DBAL\* and OC\* internals that only resolve once

.github/workflows/code-quality.yml

@@ -172,7 +172,31 @@ permissions:
 
 jobs:
   quality:
-    if: github.event_name != 'push' || github.event.created != true
+    # SECOND CLAUSE: skip the run a STANDING release PR triggers.
+    #
+    # `Release: merge development into beta` is permanently open with
+    # `head_ref: development`, so every push to development fires this
+    # workflow TWICE on the SAME sha — once for `push`, once for that PR's
+    # `pull_request` event. The concurrency block above deliberately gives
+    # them separate lanes so the push run is not cancelled, which is right,
+    # and the consequence is that both run to completion.
+    #
+    # The PR run is the redundant one, not the push run: its head sha IS
+    # development's, which the push run already decided, and the push run
+    # carries jobs the PR run does not (Coverage Baseline Check, SBOM,
+    # Features Extract). Measured 2026-09-03: runs 33747123932 (push) and
+    # 33747129312 (pull_request), same sha b8eb72e2, four seconds apart.
+    #
+    # 20 of the fleet's 21 apps carry `beta` in `pull_request.branches` and
+    # so pay this on every development push. Removing `beta` from that list
+    # would also work and is worse: the `release/v*` and `sync/main-to-beta`
+    # PRs genuinely need their run, and they target `beta` too.
+    #
+    # A `development -> main` promotion PR is skipped by the same clause, for
+    # the same reason and just as correctly.
+    if: >-
+      (github.event_name != 'push' || github.event.created != true)
+      && (github.event_name != 'pull_request' || github.head_ref != 'development')
     uses: ConductionNL/.github/.github/workflows/quality.yml@main
     with:
       app-name: openregister

.github/workflows/merge-hygiene.yml

@@ -33,7 +33,13 @@ jobs:
     name: Conflict markers and PHP syntax
     runs-on: ubuntu-latest
     steps:
+      # FULL HISTORY, deliberately. The migration/version check below compares
+      # this branch against the merge base with `development`, and a depth-1
+      # checkout has no merge base to find — it would report "no verdict" on
+      # every run, which is the silent skip the check exists to remove.
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       # Conflict markers, anywhere in the tree we author. A marker means a merge
       # was committed half-finished; every downstream signal from that commit is
@@ -69,6 +75,30 @@ jobs:
           php-version: '8.3'
           coverage: none
 
+      # A MIGRATION THAT SHIPS WITHOUT A VERSION BUMP REACHES NOBODY.
+      #
+      # Nextcloud runs an app's migrations only when appinfo/info.xml's
+      # <version> is greater than the installed_version it recorded. Equal
+      # versions mean `occ upgrade` answers "No upgrade required.", exits 0, and
+      # reads none of the migration files — no log line, no failure, and the
+      # feature that needed the table is simply absent.
+      #
+      # Measured on a throwaway NC 34 rig 2026-09-05: a migration added with the
+      # version left alone did not run, was not recorded, and
+      # `occ migrations:status openregister` reported "Pending Migrations: None"
+      # while showing 204 executed of 205 available. Bumping only <version>, with
+      # the code byte-identical, ran it. The version string is the whole gate.
+      #
+      # It lives here rather than in Code Quality because it needs the base ref
+      # and takes milliseconds — the same reason everything else in this file is
+      # here.
+      - name: A new migration moves the app version
+        run: |
+          set -euo pipefail
+          BASE="${{ github.event.pull_request.base.ref || 'development' }}"
+          git fetch --no-tags --prune origin "$BASE"
+          MIGRATION_VERSION_BASE_REF="origin/$BASE" php scripts/check-migration-version-bump.php
+
       # Every PHP file parses. A conflict marker is caught above, but so is any
       # other way a file can be committed unparseable — and this is the check
       # that would have failed within seconds of the merge landing.

.license-overrides.json

@@ -1,6 +1,6 @@
 {
 	"@fortawesome/free-solid-svg-icons": "License is (CC-BY-4.0 AND MIT) — both are approved open-source licenses, compound AND expression not parsed by checker",
 	"smalot/pdfparser": "License is LGPL-3.0 — equivalent to LGPL-3.0-only which is on the allowlist, SPDX identifier variation not recognized by checker",
-	"apexcharts": "License is MIT — license-checker misreads logo URL as custom license, see https://github.com/apexcharts/apexcharts.js/blob/main/LICENSE",
+	"apexcharts": "NOT MIT. The last MIT release is 5.0.0 -- 5.1.0 onward is the ApexCharts dual-license (Community free only below USD 2M annual revenue; sublicensing under different terms not permitted). This app declares ^7.0.0. Conduction confirmed 2026-08-31 it is below USD 2M, so it qualifies for the Community tier. 🔴 UNRESOLVED: an OEM/Redistribution licence is separately required when embedding ApexCharts in a product used by other people, and is only waived for STATIC charts users cannot interact with -- RegisterDetail.vue and SchemaDetails.vue both set toolbar.show and zoom.enabled, and this app ships to third parties via the Nextcloud App Store. Escalated to the maintainers; do not read this override as a clearance for redistribution.",
 	"dompdf/dompdf": "License is LGPL-2.1 — equivalent to LGPL-2.1-or-later which is on the allowlist; configured hermetically (isRemoteEnabled=false / isPhpEnabled=false) at the single instantiation site PdfReportWriter:69"
 }

appinfo/info.xml

@@ -40,7 +40,7 @@ Open Register drijft apps zoals OpenCatalogi, Procest, Pipelinq en Software Cata
 
 Vrij en open source onder de EUPL-licentie.
     ]]></description>
-    <version>2.0.12</version>
+    <version>2.0.15-unstable.20260905143606</version>
     <licence>EUPL-1.2</licence>
     <author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>OpenRegister</namespace>
@@ -129,27 +129,26 @@ Vrij en open source onder de EUPL-licentie.
 		<job>OCA\OpenRegister\BackgroundJob\TransferCheckJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\SyncConfigurationsJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\SyncDataJob</job>
-		<job>OCA\OpenRegister\BackgroundJob\ScheduledWorkflowJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\ScheduledNotificationJob</job>
-		<job>OCA\OpenRegister\BackgroundJob\ActionScheduleJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\TenantDeprovisionJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\TenantPurgeJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\TenantUsageSyncJob</job>
-		<job>OCA\OpenRegister\BackgroundJob\ExecutionHistoryCleanupJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\FlowRunRetentionJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\AuditSealJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\AvgRetentionJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\DsarRetentionSweepJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\ReportRenderJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\NotificationQueueFlushJob</job>
+		<job>OCA\OpenRegister\BackgroundJob\TaskScheduledNotificationJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\ArchivalRetentionTask</job>
 		<job>OCA\OpenRegister\BackgroundJob\FlowRunWorker</job>
 		<job>OCA\OpenRegister\BackgroundJob\FlowScheduleWorker</job>
+		<job>OCA\OpenRegister\BackgroundJob\FlowTimerWorker</job>
 		<job>OCA\OpenRegister\BackgroundJob\HandoffQueueDrainJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\TemporalCalculationSweepJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\DsarDpiaDetectionJob</job>
-		<job>OCA\OpenRegister\BackgroundJob\ScheduleReconcilerJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\DbalIntrospectionJob</job>
+		<job>OCA\OpenRegister\BackgroundJob\OAuth2TokenRefreshJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\ScheduledReportJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\GroupReconcilerJob</job>
 	</background-jobs>
@@ -219,6 +218,27 @@ Vrij en open source onder de EUPL-licentie.
 			     Copies the register-authored ones across, disabled, leaving the
 			     register rows in place so the step stays reversible. -->
 			<step>OCA\OpenRegister\Repair\MigrateRegisterFlowsToTable</step>
+			<!-- CLEANS UP AFTER THE VERSION OF THE STEP ABOVE THAT DID NOT SCOPE
+			     ITS READ. It asked findAll() for register `flows` / schema `flow`
+			     at the TOP LEVEL of the config; ObjectService reads that pair
+			     from `filters` and nowhere else, so both keys were inert and the
+			     read ran against whatever register/schema the SHARED service was
+			     still carrying. saveObject() sets that context and never restores
+			     it, and ImportCredentialBrokerRegister saves two example objects
+			     through it four steps earlier — so the migration copied both
+			     `brokeredcredential` examples into openregister_flows: no nodes,
+			     no edges, no trigger, owner `__system__`.
+
+			     Post-migration ONLY. A fresh install runs the fixed migration,
+			     which cannot produce these rows, so listing this under <install>
+			     would be a guaranteed no-op.
+
+			     Removes a row ONLY on the full conjunction: openregister-owned,
+			     disabled, no nodes, no edges, no trigger/cron, never dispatched
+			     (lastRun* null AND zero run rows), AND its uuid still resolves to
+			     a register object whose schema is not `flow`. Anything ambiguous
+			     is REPORTED by uuid, not deleted. Idempotent. -->
+			<step>OCA\OpenRegister\Repair\PurgePhantomMigratedFlows</step>
 			<step>OCA\OpenRegister\Repair\ImportTrustConfigurationRegister</step>
 			<step>OCA\OpenRegister\Repair\SeedVocabularyRegister</step>
 			<step>OCA\OpenRegister\Repair\RegisterOpenRegisterWithDoriath</step>
@@ -240,6 +260,42 @@ Vrij en open source onder de EUPL-licentie.
 			     Post-migration, because it needs the flow_* columns the schema
 			     migration adds. -->
 			<step>OCA\OpenRegister\Repair\RechainAuditTrailForFlowAttribution</step>
+			<!-- Task fixtures (flow-task-entity, ADR-001): the five seed
+			     groups from the change's design.md, idempotent on uuid.
+			     OPT-IN: runs only when app config openregister/seed_demo_tasks
+			     is true, so a production instance never receives demo rows;
+			     a demo instance and the test environment switch it on.
+			     Post-migration because the step needs the openregister_tasks
+			     tables its own change's migration creates. -->
+			<step>OCA\OpenRegister\Repair\SeedTaskFixtures</step>
+			<!-- Business timers (flow-business-timers, ADR-001): the flow-timers
+			     register with its working-calendar and escalation-ladder schemas
+			     and seeded defaults (nl-national, nl-termijn-default), idempotent
+			     with force: false so administrator edits survive. Then the
+			     invariant check, which COUNTS orphaned or inconsistent timers and
+			     reports them rather than cancelling them. Post-migration because
+			     both need the openregister_flow_timers tables. -->
+			<step>OCA\OpenRegister\Repair\SeedFlowTimerRegister</step>
+			<step>OCA\OpenRegister\Repair\CheckFlowTimerInvariants</step>
+			<!-- Approval consolidation (flow-approval-consolidation): moves
+			     every approval chain, step set and in-flight decision onto
+			     task sequences, verifies the reconciliation and FAILS LOUDLY
+			     on any mismatch. Idempotent on the reconciliation columns.
+			     Post-migration because it needs openregister_task_sequences
+			     and the sequence columns on openregister_tasks. The legacy
+			     tables are kept; rollback is the
+			     openregister:approval:rollback-to-steps command. -->
+			<step>OCA\OpenRegister\Repair\MigrateApprovalChainsToTasks</step>
+			<step>OCA\OpenRegister\Repair\SeedCaseFixtures</step>
+			<!-- Business timers (flow-business-timers, ADR-001): the flow-timers
+			     register with its working-calendar and escalation-ladder schemas
+			     and seeded defaults (nl-national, nl-termijn-default), idempotent
+			     with force: false so administrator edits survive. Then the
+			     invariant check, which COUNTS orphaned or inconsistent timers and
+			     reports them rather than cancelling them. Post-migration because
+			     both need the openregister_flow_timers tables. -->
+			<step>OCA\OpenRegister\Repair\SeedFlowTimerRegister</step>
+			<step>OCA\OpenRegister\Repair\CheckFlowTimerInvariants</step>
 		</post-migration>
 		<install>
 			<step>OCA\OpenRegister\Repair\ReconcileDeclaredBackgroundJobs</step>
@@ -281,6 +337,7 @@ Vrij en open source onder de EUPL-licentie.
 			<step>OCA\OpenRegister\Repair\SeedVocabularyRegister</step>
 			<step>OCA\OpenRegister\Repair\RegisterOpenRegisterWithDoriath</step>
 			<step>OCA\OpenRegister\Repair\SeedZgwZakenMigrationPack</step>
+			<step>OCA\OpenRegister\Repair\SeedFlowTimerRegister</step>
 		</install>
 	</repair-steps>
 
@@ -295,6 +352,9 @@ Vrij en open source onder de EUPL-licentie.
 		<!-- App-rename repair: re-points registers and schemas at a new owning
 		     app id. Only a DB connection, so the DI graph stays light. -->
 		<command>OCA\OpenRegister\Command\MigrateSchemaApplicationCommand</command>
+		<!-- The approval consolidation's reverse repair: an operator-run
+		     rollback tool, deliberately NOT a repair step. -->
+		<command>OCA\OpenRegister\Command\RollbackApprovalMigrationCommand</command>
 		<command>OCA\OpenRegister\Command\RechainAuditTrailCommand</command>
 		<!-- Read-only report: which RBAC groups this instance declares, and whether
 		     anyone belongs to them. Provisioning guarantees a declared group EXISTS;
@@ -310,8 +370,14 @@ Vrij en open source onder de EUPL-licentie.
 		<!-- field-level-object-encryption: encrypt existing plaintext values of a newly-flagged property. -->
 		<command>OCA\OpenRegister\Command\EncryptFieldCommand</command>
 		<command>OCA\OpenRegister\Command\DedupeRegistersCommand</command>
+		<command>OCA\OpenRegister\Command\AdoptLeafOrganisationsCommand</command>
+		<command>OCA\OpenRegister\Command\PruneRetiredSchemasCommand</command>
 		<command>OCA\OpenRegister\Command\RelinkRegisterSchemasCommand</command>
 		<command>OCA\OpenRegister\Command\ReconcileMagicTablesCommand</command>
+		<!-- The sanctioned administrative purge. Every HTTP delete route refuses an
+		     archival record; this is the one path that can still destroy one, and it
+		     needs shell access plus an explicit force flag. -->
+		<command>OCA\OpenRegister\Command\PurgeObjectCommand</command>
 		<command>OCA\OpenRegister\Command\DedupeConfigurationsCommand</command>
 		<command>OCA\OpenRegister\Command\ResolverListCommand</command>
 		<command>OCA\OpenRegister\Command\TimeReconcileCommand</command>
@@ -363,4 +429,14 @@ Vrij en open source onder de EUPL-licentie.
 	<contactsmenu>
 		<provider>OCA\OpenRegister\Contacts\ContactsMenuProvider</provider>
 	</contactsmenu>
+	<!-- The in-band write-back hook for projected task VTODOs
+	     (flow-task-inbox-projections, design D-6). apps/dav's PluginManager
+	     loads it into the Sabre server; it acts only on VTODOs carrying
+	     X-OPENREGISTER-TASK and refuses an unauthorized edit with a DAV 403
+	     before the client records it. -->
+	<sabre>
+		<plugins>
+			<plugin>OCA\OpenRegister\Dav\TaskVtodoWriteBackPlugin</plugin>
+		</plugins>
+	</sabre>
 </info>