[rubenvdlinde]

Part 2 of building launchpad's open OpenSpec changes (decisions 121-124). Cut from #826's head; development (with #826 merged) is merged in.

Built

dashboards-and-who-may-see-them, partly built (sections 1, 4, 5, 6; no matrix rows)

• 1.5 personal layer sweep: Tier-A cleanup category orphaned_personal_layer_entries. The daily OrphanedDataCleanupJob now calls PersonalLayerService::pruneOrphans(), which had no caller before. orphaned-data-cleanup spec data model updated to list five shipped categories, three of them Tier-A.
• 4 Activity reporting with a declared purpose. It is off by default and cannot be turned on without a purpose. The purpose shows on every report about somebody else. Every read or export of somebody else's activity goes to the platform audit trail (CriticalActionPerformedEvent). A person reads their own on the personal settings page, with no audit entry. Figures are counts per activity type and a calendar of intensity per day. Events only, never hours. CSV export totals match the screen. Admin tab "Activity reporting".
• 5 Colleague activity widget (colleague-activity): what colleagues did that reached the reader. Dashboard events are rechecked against canViewDashboard() and counted after the filter.
• 6 In-widget filter on row widgets (table, object-list, people, news, files, attention). It only marks DOM rows, so the placement and its saved search are never written, and a reload clears it.
• 26 new strings in all 36 locales, edited line by line (the catalogues carry duplicate keys).
• e2e specs are written, not run (live pass, decision 139): tests/e2e/api-direct/activity-reporting.api.spec.ts, tests/e2e/widget-row-filter.spec.ts.

Also: fix-l10n-domain-mismatch task 8 ticked (the checkpoint vitest run). ActivitySettingsTest now reads info.xml as a string, because under the Nextcloud bootstrap simplexml_load_file() returned false (the stable35 PHPUnit red on #826). That fix landed with #826.

Still owed

• dashboards-and-who-may-see-them sections 2, 3, 7, 8: product questions Q-launchpad-2 to Q-launchpad-5 (which reports ship first, what a status report is about, what "rate" per area means, what a storage "workspace" and "past retention" are).
• 9.1 and 9.2: sibling asks to dossiq and openregister (for-ruben/launchpad-sibling-asks.md).
• Live pass (decision 139): run the two e2e specs above. Recipe: seeded rig (tests/e2e/seed.sh, user e2e-grantee), npx playwright test tests/e2e/widget-row-filter.spec.ts tests/e2e/api-direct/activity-reporting.api.spec.ts. Check admin_audit's log for one "LaunchPad activity report read" line per colleague read.

Checks (local, on this head's code)

• composer check:strict: lint, phpcs (0 errors), psalm, phpstan and PHPUnit (1974 tests, OK) all passed. phpmd found 5 new findings, now fixed. phpmd on the changed files was rerun: exit 0 (both rulesets).
• npm run lint 0. check:l10n-parity 0. check:schema-l10n 0. check:manifest 0. Full vitest 0 (121 files, 971 tests).
• format exit 1: inherited (src/__tests__/App.navigationPanel.spec.js, red on development too).
• Hydra gates (CI shape): gate 16 and gate 25 were new and are fixed. Gate 23 (1 match, decision 69) is inherited. Gates 22, 53, 104 and 107 are inherited: they come from newer hydra-gates rules on the unchanged src/manifest.json, and feat: build open OpenSpec changes (launchpad, part 1) #826 showed the same.
• Red-first evidence was not captured for this stretch. The machine was at load 200 with 2 GB free when the tests were written, and the overnight stop came before the slot freed.

[github-actions]

Quality Report — ConductionNL/launchpad @ d31dce3

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
format		❌
check-schema-l10n		✅
composer			✅	✅ 107/107
npm			✅	✅ 636/636
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌ 1975/1975 (no test failed, the job failed for another reason — see its log)
Newman					✅ 224/224
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-10 09:00 UTC

Download the full PDF report from the workflow artifacts.