fix(compat): NC 32 floor + drop the impossible stable31 CI leg

[rubenvdlinde]

decidesk was the last repo in the fleet still installing NC stable31, and that leg is what blocked #425.

The mechanism

openregister declares min-version="32" as of ConductionNL/openregister#2384 (merged 2026-08-08 10:45Z). decidesk installs it via additional-apps while src/manifest.json names it a hard dependency:

"dependencies": ["openregister"]

On stable31, occ app:enable openregister refuses — "App "Open Register" cannot be installed because it is not compatible with this version of the server". But the shared workflow runs it as:

php occ app:enable "$name" || echo "::warning::Failed to enable $name, continuing..."

(verified verbatim in ConductionNL/.github .github/workflows/quality.yml@main, the floating ref this repo calls). So the refusal is a ##[warning], the run continues without its data layer, and dies ~70s later on missing schemas — which reads like an app fault. It is not.

Order compounded it. newman, playwright and journeydoc-capture each check the server out at fromJSON(inputs.nextcloud-test-refs)[0] (quality.yml lines 1748, 2049, 2839), so stable31 sitting first put all three on the one version openregister cannot load.

The change

Two halves, both required:

1. Matrix — '["stable31","stable32"]' → '["stable32"]'. stable33 deliberately not added: this removes an impossible leg, it does not widen the matrix.
2. info.xml — <nextcloud min-version> 28 → 32, per the rule that an app's floor must be ≥ the maximum floor of every app it hard-depends on (openconnector#1172/#1173). <php min-version="8.3"/> and max-version="34" are unchanged.

openspec/app-config.json carries the same matrix and moves with it, so /app-verify does not report drift.

This reverses #424 — deliberately, because its premise expired

#424 restored the 28 floor on the grounds that openregister had returned to 28 in openregister#2380. #2384 moved it back to 32 deliberately and fleet-wide, and names decidesk as one of eight consumers that must move their matrices to stable32. Measured now:

openregister/development: min-version="32"   ← what CI installs (additional-apps ref: development)
openregister/beta:        min-version="28"
openregister/main:        min-version="28"

decidesk installs openregister at ref: development, so 32 is the floor that actually binds here.

#424's other argument — "this repo's own CI runs stable31" — is circular: the stable31 leg is the defect, not a constraint to preserve.

Evidence: shown to fail, for the right reason

A consistency checker (declared floor vs CI legs vs the hard dependency's floor), run against the unmodified base tree and against this branch. Exit codes read directly, never through a pipe.

tree	result	exit
base (origin/development, untouched)	declared 28; legs [31,32] → INCONSISTENT ×3: advertises NC 28–30 untested; floor 28 < dependency floor 32; leg 31 is below openregister's floor	1
this branch	declared 32; legs [32] → CONSISTENT	0

Each half is independently load-bearing — single-mutation arms from this branch:

mutation	result	exit
revert only info.xml 32→28	INCONSISTENT: advertises NC 28–31 untested; floor below dependency floor	1
revert only the matrix	INCONSISTENT: CI leg [31] below openregister's floor 32	1

Positive control: with nextcloud-test-refs: commented out, the checker exits 2 (could-not-measure), not 0 — a commented-out matrix cannot manufacture a "CONSISTENT". It also strips YAML comments before matching, so the comment block added in this PR cannot itself be parsed as a live matrix.

Not done here, and why

No new PHPUnit test asserts this. vendor/ is absent in this worktree and the host disk is at 98%; composer install deletes vendor/ before reinstalling and would have broken sibling checkouts on a failed run. The mutation proof above is the same evidence standard openregister#2384 used for the same class of change.

[github-actions]

Quality Report — ConductionNL/decidesk @ dcf0c18

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 549/549
PHPUnit					✅
Newman					❌
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-08 12:19 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/decidesk @ dcf0c18

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 549/549
PHPUnit					✅
Newman					❌
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-08 13:05 UTC

Download the full PDF report from the workflow artifacts.