feat(flow): anchor a task read to one run, and give a run an address

[rubenvdlinde]

Why

Building the flow editor's run view turned up two things the server did not
offer. Both were found by trying to build the tab, not by reading the code.

A run-anchored task read

task#index had no runUuid parameter at all, and it defaults to
scope=assigned. A client-side filter would therefore have answered "what
did this run ask me" — an empty list for every run whose performer is a
group, which reads as a run that asked nobody.

So runUuid anchors rather than filters:

• it replaces the scope narrowing, because the run's view asks what the
  run asked;
• it lifts the external exclusion, exactly as the objectUuid anchor
  already does: a run that asked a resident through the portal did ask
  somebody, and hiding that ask would report the run as waiting on nothing;
• it does not relax visibility. A non-admin is still held to one of the
  sanctioned relationships, and for a run's own tasks that relationship is
  requester, which the engine stamps with the run's acting identity. The
  run's owner therefore sees all of it and a passer-by sees none, without
  the anchor knowing anything about ownership.

An empty ?runUuid= is read as absent. A query string carries it as '',
never as null, and '' applied as a real predicate matches no row: a tab
that forgot to fill the uuid in would have reported the run as having asked
nobody, rather than reporting that it asked nothing of the server.

An address for a run

/apps/openregister/flow-runs/{uuid}, on the same terms as the task deep
link beside it. A run gets no screen of its own — the flow editor already
shows the replay, the steps, the objects and the log — but without an
address, "open this run in a new tab" cannot be a link, and what is not a
link cannot be middle-clicked, bookmarked, or pasted into a ticket.

The page is a resolver: it reads the run, learns its flow, and replaces
itself with that flow's editor holding the run inspected. replace, never
push, so a redirect nobody chose does not sit in their history. It renders
a real failure state rather than bouncing to the dashboard, because a dead
link that lands you somewhere plausible is the one that cannot be diagnosed.

The consuming half is nc-vue's: the Runs list renders the <a href>, and the
editor reads ?run=. This is the server side of that contract.

How it was verified

• The five new mapper tests were each seen RED first, by neutering the
  scope anchor and then the filter in turn (4 of 5 red, then 1 of 5 red).
• PHPCS, Psalm and PHPStan clean on the changed files.
• 347 Task unit tests green.
• Both l10n gates green, all 36 locales at parity. The two new strings are
  derived from the sibling "No such task" strings, so each locale keeps its
  own established terms for a run and for a flow.
• Exercised against a live instance: the anchored read returns the run's
  group-assigned task that scope=assigned hides; the unanchored read is
  unchanged; the empty anchor falls back to unanchored rather than to zero.

Two things reviewers should know

The l10n diff is large and almost entirely whitespace. l10n-ai.js add
rewrote all 37 bundles into the canonical Nextcloud/Transifex layout (4-space
indent, " : " separator), which is not the layout they were committed in. I
verified per locale that the only content change is the two new keys: every
other line differs by separator spacing alone, every plural array is
byte-identical, and every nplurals header survives. l10n/*.js must never
be hand-edited, so this is the tool's output, not a choice.

Ten unrelated unit errors exist in this environment, in
FlowClaimMapperTest and FlowRunStepOrderingMapperTest. They mock
IQueryBuilder::forUpdate, which the vendored nextcloud/ocp stub has and
the local server checkout's lib/public copy does not. This PR touches
neither file, and the failure is a stale checkout rather than a defect.

[github-actions]

Quality Report — ConductionNL/openregister @ 2f263ff

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
check-l10n-js		❌
composer			✅	✅ 174/174
npm			✅	✅ 543/543
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					❌
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					❌

---

Quality workflow — 2026-09-06 07:38 UTC

Download the full PDF report from the workflow artifacts.