feat(contracts): record licences bought and in use, and see where use runs over the licence

[rubenvdlinde]

Change: contracts-licence-seats (archived here as 2026-09-29-contracts-licence-seats; its spec is now openspec/specs/licence-seats/spec.md).

Rows moved to built: stackiq:ctr-licence-model and stackiq:ctr-seat-count (both rated yes now).

What a user can now do: record on a licence contract how the licence is measured (per named user, per concurrent user, per device, per inhabitant, per organisation or other) and how many licences were bought and are in use. The contract page shows a Licences panel with in use against bought as a bar and as numbers, and the state Within licence, Over licence by N, Unknown or Not counted, with the date of the last change. The License posture page has a Seats section that lists every counted licence contract, the ones furthest over their licence first.

How: a register fragment lib/Settings/register.d/contracts-licence-seats.json adds licenceMetric, licencesBought and licencesInUse (integers, minimum 0) to catalogContract; seatPosition() and seatRows() in src/utils/licensePosture.js; ContractSeatsPanel registered as a custom component on ContractDetail; the Seats section in LicensePostureView; two seeded demo contracts, one over and one within its licence. The overlay marks license-and-seat-tracking stable.

Scenarios and the tests that prove them:

• A contract records metric and counts, a negative count is refused: tests/Unit/Settings/LicenceSeatsDeclarationTest.php (merged register: six metric values, both counts integer with minimum 0, schema version raised). Red on development: the fields do not exist there.
• Over licence by N, Not counted for per organisation and other, Unknown for an empty count, over-use first, uncounted contracts left out: tests/vitest/licenceSeats.spec.js and tests/vitest/licenceSeatsLabels.spec.js. Red on development: seatPosition and seatRows do not exist there.
• The panel and the Seats section in the browser: tests/e2e/spec-coverage/licence-seats.spec.ts (Playwright, seeds and removes its own contracts). It lists (2 tests); it was not run here, because no local instance has a seeded stackiq register.

New text is in English and Dutch. Docs: docs/features/licence-seats.md; its screenshots wait for a seeded instance. The tasks named licensePosture.spec.js and an available overlay status; the tests live in licenceSeats.spec.js and the overlay's shipped value is stable, and the archived tasks say so.

Checks (one run on the branch head, which contains development at 1edd2ba): composer check:strict exit 0; PHPUnit unit suite 922 tests, 20 errors, all inherited and identical by name to development (MigrateRegisterSlugTest x12, MigrateSchemaApplicationIdTest x7, PortfolioReportControllerTest x1); npm lint, stylelint, format, test:l10n, check:schema-l10n, check:l10n-js, check:manifest, check:vue-demi all exit 0; jest 100 passed; vitest 314 passed; Hydra Gates at CI version (ConductionNL/.github main, full coverage) exit 0, all 85 applicable gates passed. openspec validate --strict valid before archive; parity_verify.py --strict no finding but the census.

Inherited: the 20 PHPUnit errors above, not touched here.

Live check: after the register re-imports, open a Licence contract, edit it, choose Per named user, 400 bought, 460 in use, save; the Licences panel reads Over licence by 60 with a red bar. Open License posture; the Seats section lists that contract first.

[github-actions]

Quality Report — ConductionNL/stackiq @ c03b481

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 130/130
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					✅

---

Quality workflow — 2026-09-29 18:09 UTC

Download the full PDF report from the workflow artifacts.