Release: merge development into beta

.procedure-code-baseline.json

@@ -0,0 +1 @@
+{"count": 0}

appinfo/info.xml

@@ -40,7 +40,7 @@ Open Register drijft apps zoals OpenCatalogi, Procest, Pipelinq en Software Cata
 
 Vrij en open source onder de EUPL-licentie.
     ]]></description>
-    <version>2.1.35-unstable.20261009130000</version>
+    <version>2.1.35-unstable.20261012153000</version>
     <licence>EUPL-1.2</licence>
     <author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>OpenRegister</namespace>
@@ -131,6 +131,7 @@ Vrij en open source onder de EUPL-licentie.
 
 	<background-jobs>
 		<job>OCA\OpenRegister\BackgroundJob\LogCleanUpTask</job>
+		<job>OCA\OpenRegister\BackgroundJob\FormUploadPurgeJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\RecomputeTimersForCalendarJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\StateHistoryRebuildJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\ViewAlertSweepJob</job>
@@ -181,13 +182,21 @@ Vrij en open source onder de EUPL-licentie.
 		<job>OCA\OpenRegister\BackgroundJob\FlowRunWorker</job>
 		<job>OCA\OpenRegister\BackgroundJob\FlowScheduleWorker</job>
 		<job>OCA\OpenRegister\BackgroundJob\FlowTimerWorker</job>
+		<job>OCA\OpenRegister\BackgroundJob\CasePlanTimerRearmJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\HandoffQueueDrainJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\TemporalCalculationSweepJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\DsarDpiaDetectionJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\DbalIntrospectionJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\OAuth2TokenRefreshJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\ScheduledReportJob</job>
 		<job>OCA\OpenRegister\BackgroundJob\GroupReconcilerJob</job>
+		<!--
+			Removes the drafts that outlived their schema's draft lifetime:
+			30 days, or what the configuration key draftLifetimeDays says
+			(decisions 216 and 228). Without this line the lifetime is
+			stored and never acted on.
+		-->
+		<job>OCA\OpenRegister\BackgroundJob\DraftExpiryJob</job>
 	</background-jobs>
 
 	<repair-steps>
@@ -273,6 +282,7 @@ Vrij en open source onder de EUPL-licentie.
 			     and a reversal that has nothing to read. -->
 			<step>OCA\OpenRegister\Repair\ImportMergeOperationRegister</step>
 			<step>OCA\OpenRegister\Repair\ImportDismissedPairRegister</step>
+			<step>OCA\OpenRegister\Repair\ImportDecisionTableRegister</step>
 			<!-- ONE STORE PER FLOW. Flows lived in two places — this table and
 			     objects in the `flows` register — and every subsystem reads the
 			     table. Measured with controls: the same definition fires and
@@ -450,6 +460,7 @@ Vrij en open source onder de EUPL-licentie.
 			     and a reversal that has nothing to read. -->
 			<step>OCA\OpenRegister\Repair\ImportMergeOperationRegister</step>
 			<step>OCA\OpenRegister\Repair\ImportDismissedPairRegister</step>
+			<step>OCA\OpenRegister\Repair\ImportDecisionTableRegister</step>
 			<!-- ONE STORE PER FLOW. Flows lived in two places — this table and
 			     objects in the `flows` register — and every subsystem reads the
 			     table. Measured with controls: the same definition fires and
@@ -509,19 +520,26 @@ Vrij en open source onder de EUPL-licentie.
 		<command>OCA\OpenRegister\Command\DedupeConfigurationsCommand</command>
 		<command>OCA\OpenRegister\Command\ResolverListCommand</command>
 		<command>OCA\OpenRegister\Command\TimeReconcileCommand</command>
+		<!-- Read-only: how many drafts the daily draft cleanup would remove per
+		     schema. For a look before the first run after an upgrade (decision 228). -->
+		<command>OCA\OpenRegister\Command\DraftsExpiredCommand</command>
 		<!-- Web Push VAPID keypair generation (openregister-web-push-engine). Light DI graph (IAppConfig only). -->
 		<command>OCA\OpenRegister\Command\GenerateVapidKeys</command>
 		<!-- Reconcile the `tables` virtual register with the Nextcloud Tables app. -->
 		<command>OCA\OpenRegister\Command\TablesSyncCommand</command>
 		<!-- Batched Context Chat backfill for opted-in, published objects. -->
 		<command>OCA\OpenRegister\Command\ContextChatReindexCommand</command>
+		<!-- Story example sets: one cast, a fragment per app (example-sets). The
+		     store fetches ObjectService lazily, so the DI graph stays light. -->
+		<command>OCA\OpenRegister\Command\ExampleSetInstallCommand</command>
+		<command>OCA\OpenRegister\Command\ExampleSetRemoveCommand</command>
+		<command>OCA\OpenRegister\Command\ExampleSetListCommand</command>
 	</commands>
 
 	<settings>
 		<admin>OCA\OpenRegister\Settings\OpenRegisterAdmin</admin>
 		<admin>OCA\OpenRegister\Settings\IntegrationsAdminSettings</admin>
 		<admin-section>OCA\OpenRegister\Sections\OpenRegisterAdmin</admin-section>
-		<personal>OCA\OpenRegister\Settings\OpenRegisterPersonal</personal>
 	</settings>
 
 	<!-- The notifier is registered in PHP:

appinfo/routes.php

@@ -125,6 +125,12 @@
         ['name' => 'objectOwnership#setOwnerGroup', 'url' => '/api/objects/{register}/{schema}/{id}/ownership/group', 'verb' => 'PUT',  'requirements' => ['register' => '[^/]+', 'schema' => '[^/]+', 'id' => '[^/]+']],
         ['name' => 'objectOwnership#reassign',      'url' => '/api/ownership/reassign',                               'verb' => 'POST'],
 
+        // A draft's owner makes it definitive (decision 216). An explicit action:
+        // a PUT or PATCH that sets `@self.status` to `active` stays refused, so
+        // nothing leaves draft by accident. A plain Controller, so a refusal
+        // keeps its status (OCSMiddleware would turn a 403 into a 200).
+        ['name' => 'objectDraft#activate', 'url' => '/api/objects/{register}/{schema}/{id}/activate', 'verb' => 'POST', 'requirements' => ['register' => '[^/]+', 'schema' => '[^/]+', 'id' => '[^/]+']],
+
         // Who holds which right on one object, and how that set changed. The
         // other direction of `/api/scopes`: that one answers a caller about
         // themselves, these answer an auditor about everybody. Reading the
@@ -1193,6 +1199,11 @@
         ['name' => 'objects#geocode', 'url' => '/api/geo/geocode', 'verb' => 'GET'],
 
         ['name' => 'objects#create', 'url' => '/api/objects/{register}/{schema}', 'verb' => 'POST'],
+        // Decision 179 (ADR-117): a form submits into its destination object.
+        ['name' => 'forms#validate', 'url' => '/api/forms/validate', 'verb' => 'POST'],
+        ['name' => 'forms#submit', 'url' => '/api/forms/{formId}/submit', 'verb' => 'POST'],
+        ['name' => 'forms#upload', 'url' => '/api/forms/{formId}/uploads', 'verb' => 'POST'],
+        ['name' => 'forms#draft', 'url' => '/api/forms/{formId}/draft', 'verb' => 'POST'],
         ['name' => 'objects#export', 'url' => '/api/objects/{register}/{schema}/export', 'verb' => 'GET'],
         // BEFORE objects#show, because `{id}` matches `[^/]+` and a route with
         // a longer path must be declared first or the generic one swallows it.
@@ -1238,6 +1249,7 @@
         ['name' => 'objectRelations#removeReferences', 'url' => '/api/objects/{register}/{schema}/{id}/relation-references/{anchor}', 'verb' => 'DELETE', 'requirements' => ['id' => '[^/]+', 'anchor' => '[^/]+']],
         ['name' => 'objectRelations#derive',      'url' => '/api/objects/{register}/{schema}/{id}/derive',                     'verb' => 'POST',   'requirements' => ['id' => '[^/]+']],
         ['name' => 'objectRelations#graph',       'url' => '/api/objects/{register}/{schema}/{id}/graph',                      'verb' => 'GET',    'requirements' => ['id' => '[^/]+']],
+        ['name' => 'objectRelations#tree',        'url' => '/api/objects/{register}/{schema}/{id}/tree',                       'verb' => 'GET',    'requirements' => ['id' => '[^/]+']],
         ['name' => 'objectRelations#exportGraph', 'url' => '/api/objects/{register}/{schema}/{id}/graph/export',               'verb' => 'GET',    'requirements' => ['id' => '[^/]+']],
         // Locks.
             // Whether a row exists in other registers, and nothing about the
@@ -1837,6 +1849,13 @@
 		['name' => 'views#update', 'url' => '/api/views/{id}', 'verb' => 'PUT', 'requirements' => ['id' => '[^/]+']],
 		['name' => 'views#patch', 'url' => '/api/views/{id}', 'verb' => 'PATCH', 'requirements' => ['id' => '[^/]+']],
 		['name' => 'views#destroy', 'url' => '/api/views/{id}', 'verb' => 'DELETE', 'requirements' => ['id' => '[^/]+']],
+		// Record templates (records-saved-templates D-4): named values for a new record, shared like a view.
+		['name' => 'recordTemplates#index', 'url' => '/api/record-templates', 'verb' => 'GET'],
+		['name' => 'recordTemplates#show', 'url' => '/api/record-templates/{id}', 'verb' => 'GET', 'requirements' => ['id' => '[^/]+']],
+		['name' => 'recordTemplates#create', 'url' => '/api/record-templates', 'verb' => 'POST'],
+		['name' => 'recordTemplates#update', 'url' => '/api/record-templates/{id}', 'verb' => 'PUT', 'requirements' => ['id' => '[^/]+']],
+		['name' => 'recordTemplates#patch', 'url' => '/api/record-templates/{id}', 'verb' => 'PATCH', 'requirements' => ['id' => '[^/]+']],
+		['name' => 'recordTemplates#destroy', 'url' => '/api/record-templates/{id}', 'verb' => 'DELETE', 'requirements' => ['id' => '[^/]+']],
 		// Read-only presentation data — drag-to-move goes through the existing
 		// guarded object PATCH/PUT (/api/objects/{register}/{schema}/{id}), never
 		// a bespoke endpoint here (REQ-VIEW-KANBAN-03).
@@ -2011,12 +2030,14 @@
 		// Migration mapping packs (migration-mapping-packs): declarative
 		// source-format-to-schema import mappings. Reads (index/show/export)
 		// are available to any authenticated user so the import flow can
-		// browse packs; create/update/destroy/import are admin-gated. The
+		// browse packs; create/update/destroy/import and the preview dry run
+		// are admin-gated and CSRF-protected. The
 		// `packId` request param on registers#import (below) resolves a
 		// pack by its `packSlug` and runs each row through it before save.
 		['name' => 'migrationPacks#index', 'url' => '/api/migration-packs', 'verb' => 'GET'],
 		['name' => 'migrationPacks#create', 'url' => '/api/migration-packs', 'verb' => 'POST'],
 		['name' => 'migrationPacks#import', 'url' => '/api/migration-packs/import', 'verb' => 'POST'],
+		['name' => 'migrationPacks#preview', 'url' => '/api/migration-packs/preview', 'verb' => 'POST'],
 		['name' => 'migrationPacks#show', 'url' => '/api/migration-packs/{id}', 'verb' => 'GET', 'requirements' => ['id' => '\d+']],
 		['name' => 'migrationPacks#update', 'url' => '/api/migration-packs/{id}', 'verb' => 'PUT', 'requirements' => ['id' => '\d+']],
 		['name' => 'migrationPacks#destroy', 'url' => '/api/migration-packs/{id}', 'verb' => 'DELETE', 'requirements' => ['id' => '\d+']],
@@ -2123,6 +2144,9 @@
 		// organisation-scoped like `active`. Same ordering rule: it MUST stay above
 		// the `{uuid}` route or `show('completed')` answers it with a 404.
 		['name' => 'flowRun#completedForSubject', 'url' => '/api/flow-runs/completed', 'verb' => 'GET'],
+		// Per flow: newest run and runs since a moment (flow-run-summary). Same
+		// ordering rule: above `{uuid}`, or `show('summary')` answers with a 404.
+		['name' => 'flowRun#summary', 'url' => '/api/flow-runs/summary', 'verb' => 'GET'],
 		['name' => 'flowRun#show', 'url' => '/api/flow-runs/{uuid}', 'verb' => 'GET', 'requirements' => ['uuid' => '[^/]+']],
 		['name' => 'flowRun#objects', 'url' => '/api/flow-runs/{uuid}/objects', 'verb' => 'GET', 'requirements' => ['uuid' => '[^/]+']],
 		['name' => 'flowRun#retry', 'url' => '/api/flow-runs/{uuid}/retry', 'verb' => 'POST', 'requirements' => ['uuid' => '[^/]+']],

docs/Features/organisations.md

@@ -380,6 +380,7 @@ Beyond CRUD operations, special rights grant additional capabilities:
 | **agent_use** | Use AI agents for processing and analysis | 'ai-user', 'developer', 'admin' |
 | **dashboard_view** | Access organisation dashboard and analytics | 'manager', 'admin', 'analyst' |
 | **llm_use** | Use Large Language Model features | 'ai-user', 'researcher', 'admin' |
+| **grant_manage** | List, add and remove the grants on records the holder does not own, and name their owning group. Enforced. An entry can be narrowed to a register and schemas. Only an administrator or the organisation's owner assigns it. | a service account's group |
 
 ### Permission Check Example