feat(site): public records in the shared cards and table, papers on any collection

[rubenvdlinde]

Change site-member-voting-record-and-confidential-papers, tasks T3 and T4. T6 stays open.

T3, the public records block, now uses the shared widgets. The block drew its own cards and table. A record's summary now renders through KpiCards and its rows through CollectionTable, as design.md D2 says. CollectionTable's link column may take its address from another field (hrefField), so "Onderwerp" reads as text and links to subjectUrl. The table keeps only a site path or an http(s) address as a link, so a javascript: value is plain text. Before, the block bound subjectUrl to href directly.

T3, the page editor picks the list. app and list were two free text fields. The editor now offers the lists that the installed apps contribute to the page's portal, read from the anonymous /api/content/contributions answer. Choosing one sets both. Without that answer the field stays a text input, the same fallback the shared block picker has.

T4, papers on any collection. DocumentsBlock read only through the case screen's route. A collection that declares documents and is not kind: cases now lists and opens its papers on /portal/api/collections/{register}/{schema}/{id}/documents (routes built earlier in this change). A case keeps its own route and its upload. A paper that the opened hook refuses (503) says it could not be opened. T4 is ticked.

Still open

• T3: no server-side render for readers without JavaScript. It waits on site-honest-without-javascript, which has 0 of its 16 tasks built and no /site/plain route. The e2e is the live pass (decision 139).
• T3, board drift, not amended: board PtStemgedrag shows a side card (Voor gestemd, Tegen gestemd, Afwezig), meeting and vote filters, and paging (5 of 48). The block shows figure cards above a full table. Following the board is its own change.
• T6: the sign-in prompt on the contributed page and the return to the same route. stepUp is in the subject aggregate, but ContributionPage has no site to build the Inloggen cards from (signInRoutes). That needs a prop through MijnHome.
• screens.md added (Inloggen, PtStemgedrag), the same lines as chore(openspec): every change and spec names its screens #1475.

Tests

• tests/public-records.spec.mjs: 10 pass. New: summary and columns mapping; record renders through kpi-block and collection-table; a javascript: subject is not a link; the editor picker maps the anonymous answer and sets both props.
• tests/mijn-documents.spec.mjs: 8 pass. New: a non-case collection reads and opens on its own route, never the case route; no upload; 404 reads as failed; a case keeps the case route. On the old code the new test fails (the block asked fetchCitizenCase).
• tests/case-documents-screen.spec.mjs: 6 pass. The new API calls hit /collections/decidiq/agendaItem/a%207/documents[/p1] with the bearer.
• page-editor, shared-page-blocks, editor-text-toolbar, and every spec that touches CollectionTable: green.

No PHP changed, so check:strict and PHPUnit were not run. No new class. _rbac: none in the diff.

Exit codes: npm run lint 0, stylelint 0, format 0, check:specs 0, check:l10n-js 0, check:schema-l10n 0, check:manifest 0, check:reuse 0. Gate 102 checker 1: the two placeholders nl and https://www.example.nl from #1536, inherited and fixed by #1570. Land #1570 first.

[github-actions]

Quality Report — ConductionNL/portaliq @ b0ccdc9

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-reuse		✅
composer			✅	✅ 108/108
npm			✅	✅ 984/984
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 3883/3883 · 1 skipped
Newman					✅ 1/1
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-14 19:47 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/portaliq @ 4ea9ae0

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		❌
check-specs		✅
check-manifest		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-reuse		✅
composer			✅	✅ 108/108
npm			✅	✅ 984/984
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 3900/3900 · 1 skipped
Newman					✅ 1/1
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-15 07:25 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/portaliq @ 14a0f65

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		❌
check-l10n-js		✅
check-schema-l10n		✅
check-reuse		✅
composer			❌	✅ 108/108
npm			✅	✅ 984/984
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 3903/3903 · 1 skipped
Newman					✅ 1/1
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-15 10:47 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/portaliq @ 26f52dc

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-reuse		✅
composer			✅	✅ 108/108
npm			✅	✅ 984/984
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 3903/3903 · 1 skipped
Newman					✅ 1/1
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-15 17:22 UTC

Download the full PDF report from the workflow artifacts.