fix(dmn): carry rule priority, and pass the uuid as the uuid to deleteObject

[rubenvdlinde]

Follow-up to #1561, driven by writing the Playwright e2e for it. Both fixes here were found by running the thing, not by reading it.

1. PRIORITY was accepted but could not rank

#1561 made the engine accept PRIORITY. Against a live instance that turned out to be half the story: the table evaluated, answered HTTP 200, and gave the wrong answer — the priority-1 rule beat the priority-10 one.

Two things dropped the rank before it ever reached the evaluator:

• The DecisionTable schema had no priority property on a rule, because dossiq's old engine never implemented the policy that uses it.
• DecisionTableService::validateRules() rebuilds every rule from a fixed list of four keys, so priority was stripped on write even after the schema allowed it.

Both fixed. priority is carried only when the author supplied it, so tables that do not use PRIORITY do not gain a meaningless field.

Verified end to end: a PRIORITY table ranked 1 and 10 now returns the rule ranked 10.

This is the argument for the e2e. A 200 with a plausible-looking decision is exactly what a unit test with a mocked evaluator cannot catch, and I had written those unit tests myself.

2. Five deletes that have never worked

OpenRegister's signature is deleteObject(uuid, register, schema, ...). Five dossiq services called it as deleteObject($register, $schema, $id) — all three arguments transposed. On a live instance the decision-table delete answered 500 with Did expect one result but found none against openregister_registers, because it was looking up a register whose id was really a schema's.

A sixth, TenantSaasService, passed id: as a named argument. There is no $id parameter, so it raised Unknown named parameter and was swallowed by the surrounding catch.

InspectionChecklistService already carries a docblock describing this exact defect, found the same way: "no checklist has ever been deleted through the UI". That instance was fixed; the class never was. Swept now, with every remaining call site checked.

Why no test caught it

AdvisoryBodyServiceTest's fake declared:

public function deleteObject(string $register, string $schema, string $id): void;

The fake had been written to agree with the caller rather than with OpenRegister, so it accepted the transposed call and the test passed on it. A fake that encodes the bug as the contract cannot fail.

The fake now carries the real signature, and a new test asserts the uuid arrives in the uuid slot. I put the transposed call back and confirmed the test goes red, because a test I have not seen fail is not evidence.

Verification

• Unit suite: 2606 tests, 11365 assertions, green; phpstan, phpcs, phpmd clean
• Playwright changed-surfaces.spec.ts: 5/5, including the new PRIORITY test, against a live instance
• DELETE /api/decisions/{id}: 200, was 500
• The e2e removes its own fixture, which only works now that delete does

[github-actions]

Quality Report — ConductionNL/dossiq @ 88f4e16

Check	PHP	Vue	Security	License	Tests
lint	⏭️
phpcs	⏭️
phpmd	⏭️
psalm	⏭️
phpstan	⏭️
phpmetrics	⏭️
eslint		⏭️
stylelint		⏭️
build		⏭️
composer			⏭️	⏭️
npm			⏭️	⏭️
app:check-code	⏭️
info.xml	⏭️
REUSE	⏭️
PHPUnit					❌
Newman					❌
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-31 05:54 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/dossiq @ 8ac4d7c

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
format		❌
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 106/106
npm			✅	✅ 540/540
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					🚨 NO VERDICT — enabled but never ran
Hydra gates					❌

---

Quality workflow — 2026-08-31 06:18 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/dossiq @ 85c6f78

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 106/106
npm			✅	✅ 540/540
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					🚨 NO VERDICT — enabled but never ran
Hydra gates					✅

---

Quality workflow — 2026-08-31 07:06 UTC

Download the full PDF report from the workflow artifacts.