docs(openspec): three retired capabilities still cited their deleted tests (#1931)

* docs(openspec): three retired capabilities still cited their deleted tests

Fourteen exclusions across gis-integration, mobiel-inspectie-offline and
supplier-portal named a PHPUnit class, a vitest spec or a Newman collection
that is not in this repository. In every case the capability was migrated or
removed and the named test was deleted with it, so the exclusion was doing
double duty: it took the scenario out of e2e coverage and made it look
handled.

gis-integration lost its bespoke geo stack in bac6f70 (issue #112, ADR-022)
when cases-on-map moved onto OpenRegister's maps-overview surface. GeoService,
WfsService, CaseGeoController and the /api/cases/geo and /wfs/cases endpoints
went with it. That spec had no status-note recording any of this while its
Purpose still described the removed code as present, so it gains one. The one
scenario that does still have a home in this app, the marker shaping, is
repointed at tests/vitest/casesOnMap.spec.js, which asserts the coordinate
order, the status colour and icon, malformed rows and non-array input.

mobiel-inspectie-offline and supplier-portal lost their backends in 062d9de.
Both specs already recorded that in their status-notes; only the citations
were left behind. Those five and two exclusions now say the capability is gone
and where it went, rather than naming a test to stand in for it. One of them
also cited a Newman collection that has never existed in any commit, in an app
that sets enable-newman false.

Also fixes this repository's only unparseable spec front matter. The
supplier-portal status-note was a plain YAML scalar containing a colon and a
space, which makes the mapping invalid. It becomes a folded block scalar with
byte-identical text.

gate-113 goes from fourteen unresolved citations to none, and one more
scenario resolves against a test that is really there.

* fix(tests): eight tests execute two transition helpers without declaring them

All six PHPUnit matrix cells fail with zero failures and zero errors:

    Tests: 3216, Assertions: 18704, Deprecations: 7, Skipped: 1, Risky: 8.
    Process completed with exit code 1

phpunit.xml sets beStrictAboutCoverageMetadata and failOnRisky, so a test that
touches a class the docblock does not list is risky, and a risky test exits 1
while printing no failure.

This is the same defect #1924 fixed for CaseResultWriter, in four more classes
and for two more helpers. StatusTypeLookup and TransitionSpecReader are reached
through StatusTransitionService and CaseStatusStore, which the tests do declare.

The fix is five @uses lines and nothing else: a pure insertion, zero deleted
lines, and php -l clean on all four files. Note that the annotations are real
@uses tags, not prose mentioning them; naming an annotation inside docblock
prose parses as an empty one and reddens the job by itself.

---------

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>

Author: rubenvdlinde

openspec/specs/gis-integration/spec.md

@@ -1,5 +1,18 @@
 ---
 status: done
+status-note: >-
+  2026-06 (migrate-cases-on-map-to-maps-overview-leaf, ADR-022, procest#112,
+  commit bac6f7073): the bespoke in-app geo stack is RETIRED. Removed:
+  GeoService, WfsService, WfsExportService, WmsWfsService, LocationService,
+  CaseGeoController and the /api/cases/geo and /wfs/cases endpoints, the
+  Leaflet components under src/components/map, caseGeoService,
+  coordinateService, gisProxyService and the gis store. The cases-on-map
+  surface now consumes OpenRegister's maps-overview endpoints through
+  src/services/casesOnMapApi.js and renders them with the shared CnMapWidget,
+  which owns clustering and the PDOK base layer. What remains in this app is
+  the marker shaping in src/services/mapFormatters.js, covered by
+  tests/vitest/casesOnMap.spec.js. This spec is retained for history; the geo
+  capability is owned by OpenRegister.
 ---
 
 # gis-integration Specification
@@ -38,7 +51,10 @@ canonical Feature on read.
 
 #### Scenario: Validate supported geometry types
 
-@e2e exclude Backend GeoService unit logic; covered by GeoServiceTest (PHPUnit), no UI surface.
+@e2e exclude the geometry validation this describes is no longer in this app.
+bac6f7073 (issue #112, ADR-022) removed the bespoke geo stack when cases-on-map
+moved onto OpenRegister's maps-overview surface, and the PHPUnit class this
+reason used to name was deleted with the code. Retained for history.
 
 - **GIVEN** a Point, Polygon or MultiPolygon GeoJSON geometry
 - **WHEN** it is validated by `GeoService::validateGeometry()`
@@ -47,7 +63,10 @@ canonical Feature on read.
 
 #### Scenario: Normalise JSON-encoded stored geometry
 
-@e2e exclude Backend (de)serialisation logic; covered by GeoServiceTest (PHPUnit), no UI surface.
+@e2e exclude the stored-geometry normalisation this describes was removed by
+bac6f7073 with the rest of the bespoke geo stack. OpenRegister now owns the
+canonical representation, and the PHPUnit class this reason used to name was
+deleted with the code.
 
 - **GIVEN** a geometry stored JSON-encoded on a case location
 - **WHEN** it is read via `GeoService::normaliseGeometry()`
@@ -62,7 +81,10 @@ requesting user may read (no IDOR).
 
 #### Scenario: Clustered, filtered case locations
 
-@e2e exclude Server-side clustering + bbox/zaaktype/status filtering; covered by GeoServiceTest + CaseGeoControllerTest (PHPUnit) and Newman.
+@e2e exclude GET /api/cases/geo no longer exists here. bac6f7073 replaced it
+with a call to OpenRegister's maps-overview points endpoint, which does the
+clustering and the filtering. Both PHPUnit classes this reason used to name
+were deleted with the endpoint, and this app runs no Newman suite.
 
 - **GIVEN** cases with locations across the Netherlands
 - **WHEN** the client requests `/api/cases/geo` with a zoom level and optional zaaktype/status/bounds filters
@@ -72,7 +94,10 @@ requesting user may read (no IDOR).
 
 #### Scenario: Per-object access guard excludes inaccessible cases
 
-@e2e exclude Authorization guard verified by CaseGeoControllerTest (PHPUnit) — asserts only readable case ids reach the response; no deterministic UI assertion.
+@e2e exclude the per-object access guard moved with the endpoint. OpenRegister's
+maps-overview points endpoint returns markers already scoped by RBAC, so the
+guard is enforced there and not here. The PHPUnit class this reason used to
+name was deleted by bac6f7073.
 
 - **GIVEN** two located cases where the user may read only one
 - **WHEN** the user requests `/api/cases/geo`
@@ -88,15 +113,19 @@ when OpenRegister is unavailable.
 
 #### Scenario: GetCapabilities advertises the case feature type
 
-@e2e exclude OGC XML rendering; covered by WfsServiceTest (PHPUnit) and Newman — no UI surface.
+@e2e exclude the WFS endpoint was removed by bac6f7073. This app no longer
+serves /wfs/cases, the PHPUnit class this reason used to name was deleted with
+it, and this app runs no Newman suite. Retained for history.
 
 - **GIVEN** an authenticated WFS client
 - **WHEN** it requests `GET /wfs/cases?service=WFS&request=GetCapabilities`
 - **THEN** a well-formed WFS 2.0.0 capabilities document MUST advertise the `dossiq:cases` feature type and the supported operations
 
 #### Scenario: GetFeature returns GML members honouring BBOX
 
-@e2e exclude OGC GML rendering + bbox filtering; covered by WfsServiceTest (PHPUnit) and Newman — no UI surface.
+@e2e exclude GetFeature went with the rest of the WFS endpoint in bac6f7073.
+The PHPUnit class this reason used to name was deleted with it, and this app
+runs no Newman suite.
 
 - **GIVEN** located cases
 - **WHEN** a WFS client requests `GetFeature` with an optional BBOX
@@ -135,7 +164,10 @@ the backend or PDOK tiles are unavailable.
 
 #### Scenario: Map data shaping is pure and testable
 
-@e2e exclude Pure data-shaping helpers (toMapGeometries/buildGeoQuery/summariseGeo/toExportGeoJson); covered by caseGeoService.spec.js (vitest).
+@e2e exclude pure data-shaping helpers, covered by tests/vitest/casesOnMap.spec.js.
+After bac6f7073 the shaping is shapeMarkerFeatures in
+src/services/mapFormatters.js, and that vitest spec asserts the coordinate
+order, the status colour and icon, malformed rows and non-array input.
 
 - **GIVEN** a `/api/cases/geo` FeatureCollection
 - **WHEN** it is shaped for the map

openspec/specs/mobiel-inspectie-offline/spec.md

@@ -35,7 +35,10 @@ The system SHALL allow inspectors to synchronize their daily schedule to local s
 
 #### Scenario: Sync updates incomplete sync on connection loss
 
-@e2e exclude Resumable chunked download is a Service Worker / browser-network concern; not deterministically drivable headless. Replay-ordering logic is covered by tests/vitest/syncQueueEngine.spec.js.
+@e2e exclude resumable chunked download is a Service Worker and browser-network
+concern, not deterministically drivable headless. The replay-ordering engine
+this reason used to name was removed by 062d9dede with the rest of the
+orphaned mobile-inspection backend, so nothing in this app tests it.
 
 - **GIVEN** a sync download is in progress (15% complete) when network connection drops
 - **WHEN** the inspector taps "Dag synchroniseren" again and network is restored
@@ -235,7 +238,10 @@ The system SHALL detect when a colleague has edited the same case while the insp
 
 #### Scenario: Detect conflict on sync replay
 
-@e2e exclude Requires an offline-created result + a concurrent server edit to trigger a 409; not headless-deterministic. Conflict classification + record building is covered by PHPUnit (SyncControllerTest, ConflictDetectionServiceTest) and vitest (classifyConflict).
+@e2e exclude requires an offline-created result and a concurrent server edit to
+trigger a 409, which is not headless-deterministic. The conflict classification
+backend was removed by 062d9dede, so the two PHPUnit classes this reason used
+to name no longer exist here and this scenario has no coverage.
 
 - **GIVEN** inspector Anja completed a checklist offline with answer "goedgekeurd" for "Keuring afgewerkt?"
 - **AND** while she was offline, her colleague Piet (back at the office) changed the same case's inspection status to "afgekeurd"
@@ -260,7 +266,10 @@ The system SHALL detect when a colleague has edited the same case while the insp
 
 #### Scenario: Inspector resolves conflict
 
-@e2e exclude Resolution flow needs a live ConflictRecord; not headless-deterministic. The resolve → re-queue / discard policy is covered by PHPUnit (SyncControllerTest client_wins/server_wins) and vitest (resolveConflictChoice).
+@e2e exclude the resolution flow needs a live ConflictRecord and is not
+headless-deterministic. The resolve, re-queue and discard policy was removed by
+062d9dede, so the PHPUnit class this reason used to name no longer exists here
+and this scenario has no coverage.
 
 - **GIVEN** the merge UI is displayed
 - **WHEN** the inspector taps "Mijn versie gebruiken"
@@ -272,7 +281,10 @@ The system SHALL detect when a colleague has edited the same case while the insp
 
 #### Scenario: Permission lost during offline work
 
-@e2e exclude Requires revoking case permission while offline to force a 403 on replay; not headless-deterministic. Terminal permission_lost handling is covered by PHPUnit (SyncControllerTest) and vitest (classifyConflict/isConflictRetryable).
+@e2e exclude requires revoking case permission while offline to force a 403 on
+replay, which is not headless-deterministic. The terminal permission_lost
+handling went with the sync backend in 062d9dede, so the PHPUnit class this
+reason used to name no longer exists here.
 
 - **GIVEN** an inspector worked offline on a sensitive case (e.g., social-welfare home visit)
 - **AND** while she was offline, a manager revoked her read permission on that case
@@ -339,7 +351,10 @@ The system SHALL record all conflict resolution decisions in an immutable audit
 
 #### Scenario: Audit log entry for conflict resolution
 
-@e2e exclude Immutable audit-trail persistence depends on a resolved live ConflictRecord + the OR audit log; not headless-deterministic. The conflict-resolution record (resolvedBy/resolvedAt/resolution) is built + asserted by PHPUnit (ConflictDetectionService.applyResolution, SyncControllerTest).
+@e2e exclude immutable audit-trail persistence depends on a resolved live
+ConflictRecord and the OpenRegister audit log, and is not headless-deterministic.
+The conflict-resolution record building was removed by 062d9dede, so the
+PHPUnit class this reason used to name no longer exists here.
 
 - **GIVEN** inspector Anja resolves a conflict by choosing her local version
 - **WHEN** the resolution is processed

openspec/specs/supplier-portal/spec.md

@@ -1,6 +1,30 @@
 ---
 status: done
-status-note: Reverse-synced 2026-06-13 from archived implemented changes. Member 09 (contract backend) completed 2026-06-13 — the previously-deferred ContractController (GET /contracts/list, GET /contracts/{id}, POST /contracts/{id}/request-renewal; supplier-scoped, 403 on cross-supplier) and the nightly ScanExpiringContractsJob (TimedJob wrapping ContractRenewalService::scanAndFlagExpiring) are now genuinely built, routed, and unit-tested. 2026-07-07 (move-portals-to-portaliq, ADR-046, procest#162): the in-app supplier portal VIEWS (src/views/leverancier/*) + nav/routes/manifest fragment are RETIRED — the supplier surface is rendered by the shared Portaliq portal as the `supplier` audience of PortalContributionProvider. The backend supplier services + /api/leverancier-portaal/* endpoints and the OpenRegister schemas remain unchanged. 2026-07-08 (procest#loose-ends): SUPERSEDED for the in-app implementation — the now-consumerless backend was removed too. Deleted: SupplierPortalController / SupplierProfileController / ContractController + all /api/leverancier-portaal/* routes, SupplierAuthMiddleware, the supplier services (Scope/Session/Dashboard/KpiAggregation/Message/MasterDataMutation/Leverancier+Tender ViewModel/TenderVisibility/InvoicePaymentForecast/Auth/UserManagement), and the ContractRenewalService + ScanExpiringContractsJob renewal chain. The OpenRegister schemas (supplierTender/Contract/Invoice/Message) are UNCHANGED and are read directly by Portaliq (field-projected), which is now the sole supplier surface. This spec is retained for history; the live supplier experience is owned by Portaliq.
+status-note: >-
+  Reverse-synced 2026-06-13 from archived implemented changes. Member 09
+  (contract backend) completed 2026-06-13 — the previously-deferred
+  ContractController (GET /contracts/list, GET /contracts/{id}, POST
+  /contracts/{id}/request-renewal; supplier-scoped, 403 on cross-supplier) and
+  the nightly ScanExpiringContractsJob (TimedJob wrapping
+  ContractRenewalService::scanAndFlagExpiring) are now genuinely built,
+  routed, and unit-tested. 2026-07-07 (move-portals-to-portaliq, ADR-046,
+  procest#162): the in-app supplier portal VIEWS (src/views/leverancier/*) +
+  nav/routes/manifest fragment are RETIRED — the supplier surface is rendered
+  by the shared Portaliq portal as the `supplier` audience of
+  PortalContributionProvider. The backend supplier services +
+  /api/leverancier-portaal/* endpoints and the OpenRegister schemas remain
+  unchanged. 2026-07-08 (procest#loose-ends): SUPERSEDED for the in-app
+  implementation — the now-consumerless backend was removed too. Deleted:
+  SupplierPortalController / SupplierProfileController / ContractController +
+  all /api/leverancier-portaal/* routes, SupplierAuthMiddleware, the supplier
+  services
+  (Scope/Session/Dashboard/KpiAggregation/Message/MasterDataMutation/Leverancier+Tender
+  ViewModel/TenderVisibility/InvoicePaymentForecast/Auth/UserManagement), and
+  the ContractRenewalService + ScanExpiringContractsJob renewal chain. The
+  OpenRegister schemas (supplierTender/Contract/Invoice/Message) are UNCHANGED
+  and are read directly by Portaliq (field-projected), which is now the sole
+  supplier surface. This spec is retained for history; the live supplier
+  experience is owned by Portaliq.
 ---
 # supplier-portal Specification
 
@@ -512,7 +536,10 @@ The system SHALL flag contracts within 90 days of expiry and compute the days re
 
 #### Scenario: Contract within the threshold is flagged
 
-@e2e exclude Backend-only — driven by the nightly ScanExpiringContractsJob (TimedJob) with no UI surface; covered by ScanExpiringContractsJobTest + ContractRenewalServiceTest. Contract UI is chain member 10.
+@e2e exclude backend-only, with no UI surface in this app. The nightly job and
+the renewal service this reason used to name were deleted by 062d9dede when the
+consumerless supplier backend was removed. Portaliq is now the sole supplier
+surface and reads the OpenRegister Contract schema directly.
 
 - GIVEN the nightly expiry-scan job runs
 - WHEN a contract's `endDate` is within 90 days
@@ -527,7 +554,10 @@ account manager.
 
 #### Scenario: Renewal request opens a Dossiq case
 
-@e2e exclude Backend REST contract — exercised via the Newman leverancier-contract-api collection + ContractControllerTest (role gate, manual-only, window, cross-supplier 403); no UI surface in this chain member. Contract renewal UI is chain member 10.
+@e2e exclude backend REST contract with no UI surface in this app. The
+controller and the /api/leverancier-portaal/* routes this reason used to name
+were deleted by 062d9dede, the collection it named has never existed, and this
+app sets enable-newman false. Portaliq now renders the supplier experience.
 
 - GIVEN a contracts or admin user requests renewal of a manual-renewal contract within 90 days
 - WHEN the request endpoint is called

tests/Unit/Service/CmmnBpmnCoexistenceRegressionTest.php

@@ -51,6 +51,7 @@
  * @uses \OCA\Dossiq\Service\Transitions\CaseStatusStore
  * @uses \OCA\Dossiq\Service\Transitions\TransitionAuthorizer
  * @uses \OCA\Dossiq\Service\Transitions\TransitionSpecReader
+ * @uses \OCA\Dossiq\Service\Transitions\StatusTypeLookup
  */
 final class CmmnBpmnCoexistenceRegressionTest extends TestCase {
 

tests/Unit/Service/StatusTransitionServiceReplayRegressionTest.php

@@ -58,6 +58,7 @@ public function searchObjects(array $query): array;
  * @uses \OCA\Dossiq\Service\Transitions\CaseResultWriter
  * @uses \OCA\Dossiq\Service\Transitions\CaseStatusStore
  * @uses \OCA\Dossiq\Service\Transitions\TransitionAuthorizer
+ * @uses \OCA\Dossiq\Service\Transitions\StatusTypeLookup
  */
 class StatusTransitionServiceReplayRegressionTest extends TestCase {
 

tests/Unit/Service/StatusTransitionServiceRouteSeamTest.php

@@ -64,6 +64,8 @@ public function saveObject(array $object, mixed $register = null, mixed $schema
  * @uses \OCA\Dossiq\Service\Transitions\CaseResultWriter
  * @uses \OCA\Dossiq\Service\Transitions\CaseStatusStore
  * @uses \OCA\Dossiq\Service\Transitions\TransitionAuthorizer
+ * @uses \OCA\Dossiq\Service\Transitions\StatusTypeLookup
+ * @uses \OCA\Dossiq\Service\Transitions\TransitionSpecReader
  */
 class StatusTransitionServiceRouteSeamTest extends TestCase {
 

tests/Unit/Service/Transitions/CaseStatusStoreOwnershipTest.php

@@ -38,6 +38,7 @@
 
 /**
  * @covers \OCA\Dossiq\Service\Transitions\CaseStatusStore
+ * @uses \OCA\Dossiq\Service\Transitions\StatusTypeLookup
  */
 class CaseStatusStoreOwnershipTest extends TestCase {
 	/**