fix(events): resolve the schema slug listeners compare against (gated, default off)

[rubenvdlinde]

⚠️ Gated, default OFF — read before flipping the flag

This fixes a comparison that has never once been true. Correcting it wakes two listeners that have never executed, one of which is a fail-closed validation guard. The fix therefore ships behind openbuild.listener_slug_contract, default off, mirroring how openregister#2248 shipped the sibling ObjectTransitionedEvent defect.

The bug

ProductionVersionGuardListener and AutomationCleanupListener each carried a private extractSchemaSlug() that:

1. probed for ObjectEntity::getSchemaSlug() — a method that does not exist, then
2. fell back to @self.schema, which is the schema's numeric id.

Both then compared that id against a slug literal:

$schema = $this->extractSchemaSlug(entity: $entity);
if ($schema !== ApplicationVersionService::APPLICATION_SCHEMA) {   // "28" !== "application"
    return;                                                        // ← always taken
}

ObjectEntity::$schema is declared ?string but SaveObject writes it as (string) $schemaId, so it holds "28", never "application". Every call returned at the guard. No exception, no log line — the listeners simply did nothing, silently, for their entire life.

The fix

One shared ObjectSchemaSlugResolver replaces both private helpers, resolving the id via SchemaMapper::find() (already request-cached; memoised here including misses so a hot write path does not become an N+1 — docudesk measured 1,471 find() calls per object save from exactly this shape).

It matches the register as well as the schema. A schema slug is not unique instance-wide: this instance carries two distinct schemas with the slug automation (ids 71 and 5103). Matching on schema slug alone would fire OpenBuild's handlers for another app's objects. This mirrors the register+schema pair pattern already shipped in petstore and planix.

⚠️ Blast radius — why it is gated

listener	what waking it does
ProductionVersionGuardListener	FAIL-CLOSED guard, currently failing OPEN. Mismatched production-version back-references are never blocked today. Enabling it starts rejecting writes that currently succeed ($event->stopPropagation() + setErrors()).
AutomationCleanupListener	Starts deleting compiled artifacts when an automation is deleted. Correct behaviour — every deleted automation to date has orphaned its artifacts — but it is a destructive path that has never run.

Neither has ever executed, so neither has ever been exercised against real data. Enabling is a rollout decision, not a bug fix:

occ config:app:set openbuild listener_slug_contract --value=yes

Verification status — please read

• php -l clean; phpcs clean on all four touched files (remaining warnings are pre-existing missing @spec tags — I have not invented spec paths).
• The two-schemas-named-automation collision and the id-vs-slug shape are both verified directly against the database, not inferred.
• I have not run a live positive control proving each handler body now executes for a real matching write. That is the control that matters, and it is exactly what this change enables but does not yet demonstrate. It should be done on a disposable instance with the flag on, per listener, before the flag is enabled anywhere real. Flagging this explicitly rather than implying more verification than was done.

Not addressed here

DocumentGenerationListener and AutomationApprovalTriggerListener carry the same id-vs-slug defect via schemaOf(), but they feed the id into automation trigger matching rather than a literal comparison, so they need a separate change. (AutomationApprovalTriggerListener already injects SchemaMapper and resolves correctly in the other direction at line 429 — the pattern is present in the file, just not applied to the trigger side.)

HybridMetadataLockListener and ApprovalOutcomeListener are not affected: the former documents this exact id problem and deliberately uses payload-shape detection instead.

[github-actions]

Quality Report — ConductionNL/openbuild @ 744dba0

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 659/659
PHPUnit					❌
Newman					⏭️
Playwright					⏭️

Coverage: 89.4% (17/19 statements)

---

Quality workflow — 2026-08-01 21:41 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openbuild @ 866d464

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 659/659
PHPUnit					✅
Newman					⏭️
Playwright					⏭️

Coverage: 89.4% (17/19 statements)

---

Quality workflow — 2026-08-02 07:18 UTC

Download the full PDF report from the workflow artifacts.