fix(notifications): make the accepted filter grammar the executable one

[rubenvdlinde]

Closes #2787

What was broken

24 scheduled-notification filter entries across three apps were accepted at save time and matched nothing at scan time — silently, for months. Every deadline rappel in decidesk, shillinq's contract and AP reminders, and openconnector's job-overdue rule ran daily against nothing while reading as configured and enabled.

The cause was one grammar written down twice, disagreeing. NotificationAnnotationValidator::validateScheduledFilterEntry() opened with:

// Scalar shortcut: always accepted (legacy v1 strict equality).
if (is_array($spec) === false || array_key_exists('operator', $spec) === false) {
    return [];
}

Any array without an operator key was accepted. ScheduledFilterEvaluator then compared that array to a scalar field with ===. Accepted, then false forever.

Three teams had independently invented three dialects the four-operator grammar could not express — decidesk a bare list for set membership (18 rules), shillinq an all combinator with notIn/before (4 rules), openconnector the key op with lt (1 rule, 2 entries).

The fix

One ScheduledFilterParser. The validator reports its errors; the evaluator walks its AST. "A shape the validator accepts but the evaluator cannot execute" is now a contradiction rather than a bug that recurs. No second enumeration of operators exists in lib/.

The grammar grows what three teams reached for, which is why 22 of the 23 dead rules come back with no edit in any app:

form	means
in / notIn (values)	membership; an array-valued field matches on non-empty intersection
before / after (value)	against "now", an absolute ISO date, or a signed duration
["a","b"]	bare list is shorthand for in
all / any	conjunction / disjunction, nested to MAX_DEPTH

before "P7D" reads equally naturally as "a week from now" and "a week ago", so the past direction is spelled -P7D and there is no unsigned past form. An ambiguous date operator in a reminder engine is how a thousand wrong emails get sent.

An empty all matches; an empty any does not — "any of nothing" is false, and the alternative silently widens a rule to the whole table.

Verification

Fleet census replayed against the new parser — 61 scheduled filters across the fleet:

parse (executable): 60
rejected:            1   <- openconnector job.job-overdue ("op" instead of "operator")

The single rejection is exactly the one intended, and it now produces a message naming operator rather than a silent accept.

Behaviour, old vs new, on the real annotations:

• decidesk bare list {"lifecycle": ["open","in-uitvoering"]} — matches open and in-uitvoering, not afgedaan, not a missing field.
• shillinq all + notIn + before — matches open-and-overdue, not paid, not future-dated.

Tests: 267 notification tests pass, 540 assertions — including the 80 pre-existing tests unchanged, which is the backward-compatibility proof for the 49 filter entries that already worked (28 scalar, 21 canonical operator objects).

Gates: PHPCS 0 errors, PHPMD exit 0, PHPStan OK, Psalm no errors.

One correction to the issue as I first filed it

I originally wrote that a stricter validator "would have blocked" these. It would not have. SchemaMapper::validateNotificationsAnnotation() (lib/Db/SchemaMapper.php:1364-1381) calls the validator and discards its errors by design, so a malformed optional annotation never aborts a register import. Tightening the validator is still right — it is what makes the accept-set equal the executable-set — but the Hydra gate is the only mechanism that can actually block this, and the spec argues it that way. Gate work is task 5.3, in ConductionNL/.github, and is not in this PR.

Follow-ups (named, not done here)

• openconnector: job.job-overdue needs op -> operator and lt -> before; plus call_log.call-failed and job_log.job-error, which pass map-shaped op filters to the created-trigger path and were also never firing.
• Gate-18 check (c) in hydra-gates, pinned against a fixture generated from ScheduledFilterGrammar so gate and engine cannot drift.
• The deferred created-vs-scheduled convergence: converge the clause shape and vocabulary, explicitly not the comparison semantics (created is string-coercing, scheduled is strict ===; merging either direction silently un-matches live rules).

The design for all of this is the notification-scheduled-filter-grammar OpenSpec change, which ships in #2791.

[github-actions]

Quality Report — ConductionNL/openregister @ ebff7fa

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
composer			✅	✅ 175/175
npm			✅	✅ 528/528
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					❌
Newman					✅
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-22 11:11 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ ffe897a

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
composer			✅	✅ 175/175
npm			✅	✅ 528/528
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-22 11:27 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ ef365d6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
composer			✅	✅ 175/175
npm			✅	✅ 528/528
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-22 11:42 UTC

Download the full PDF report from the workflow artifacts.