fix(manifest): drop the two bulk-action keys nothing reads

[rubenvdlinde]

Fixes the gate-53 failure diagnosed in #1465.

BudgetToProgrammeLinker's "Link to Programme" bulk action declared requiresSelection and dialog. The manifest schema's action definition is additionalProperties: false and allows neither:

/pages/432/config/bulkActions/0 — must NOT have additional properties

Not a stale vendored schema, which was my first hypothesis given the failure appeared on the nc-vue 2.31.1 bump while .github last synced its copy at 2.28.0. nc-vue 2.31.1's own src/schemas/app-manifest-v2.schema.json rejects both keys identically.

Nothing reads either key. No match for requiresSelection anywhere in @conduction/nextcloud-vue, none in this app's src/ beyond a prose docblock in BbvLinkerFilterBar.vue, and nothing reads action.dialog. The declared dialog — target programme select, effective date, submit and cancel labels — rendered nowhere.

This deletes declared intent, deliberately

REQ-BBL-001 wanted a linking dialog on that bulk action, and it has never worked. The supported shape is type: "open-modal", which merges the selection into the modal's props as selectedIds / count — but that needs a modal component this app does not have, so building it is feature work rather than a fix.

Removing the dead declaration makes the gap visible instead of leaving a promise the manifest cannot keep. If the dialog is still wanted, it should come back as a real modal.

Why a dependency bump surfaced it

70ba77f changed only package.json and the lockfile. The violation is older than the commit that exposed it — the bump moved the gate onto a code path that validates this page.

Verification

• The fragment is byte-identical apart from the two removed keys — parsed both sides and compared structurally rather than reading the diff.
• The full run-hydra-gates.sh now exits 0, with [gate-53] effective-manifest-crossref: PASS (13 WARN findings remain, all non-blocking and all pre-existing).

Worth fixing separately

I could only see this violation because I ran the gate on a machine where /tmp survives. In CI it is written to /tmp/hydra-gates.<rand>/ and discarded, and neither quality-report.md nor the 154-byte result-hydra-gates artifact carries it — so the failure reads as "1 structural violation" with no way to learn which. Uploading that log alongside the existing artifact would turn this class of failure from an afternoon into a minute. Noted on #1465.

[github-actions]

Quality Report — ConductionNL/shillinq @ 567cc5d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-manifest-shell		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-manifest-budget		✅
check-markers		✅
check-registers		✅
check-seeds		✅
check-fragment-required		✅
check-nav-reachability		✅
check-job-registration		✅
test-l10n		✅
composer			✅	✅ 106/106
npm			✅	✅ 537/537
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-09-03 05:35 UTC

Download the full PDF report from the workflow artifacts.