FKITDEV-9194

Generali devel update in preparation for release 1.9.11.19 — merge origin/devel into customization/generali-atvilagitas in vuer_oss + vuer_css, validate locally, hand over for PR. The merge was textually conflict-free in both repos and still broke three things, plus one near-miss that would have shipped the release without its headline feature.

For Agents

• Ticket: FKITDEV-9194 — “Generáli - Generáli Release 1.9.11.19 előkészítés”, State Open, assignee andras.lederer.
• Parent: ASSGRALI-72 — “Generáli Release 1.9.11.19”. Its changelog carried TODO: core update változtatások pending on exactly this work.
• Branch (both repos): chore/FKITDEV-9194-generali-update-2026-08-08, off customization/generali-atvilagitas.
• Result: vuer_oss df01e922ce, vuer_css e3c8996d4. Both 0 behind live devel. NOT pushed, no PR opened.
• Worktrees: /Users/levander/coding/facekom/vuer_oss-FKITDEV-9194, /Users/levander/coding/facekom/vuer_css-FKITDEV-9194.

Scope — where Generali actually lives

Generali has customization in vuer_oss + vuer_css only. Verified: zero generali references in portal_css, esign_oss, esign_css. Two Generali branch lines exist:

Branch	Status	Evidence
customization/generali-atvilagitas	Live — the release line	tag generali-atvilagitas-1.9.11.18
customization/generali-kar	DEAD	last commit 2022-01-24, 1754 commits behind devel

Branch naming follows the precedent set by the previous round, chore/FKITDEV-9073-generali-update-2026-07-15 (and satisfies the commit ruleset).

The near-miss — a stale devel got merged, silently

The first vuer_css merge used a devel that was 10 days old — and nothing said so

vuer_css’s local clone has a narrowed fetch refspec (+refs/heads/customization/raiffeisen:… only). git fetch origin devel therefore updates only FETCH_HEAD, never refs/remotes/origin/devel — while printing a success line and exiting 0. The following git merge origin/devel merged a stale tree, conflict-free, with zero warning.

First css merge used devel @ 7d4f9956c8 (2026-07-28); live devel was 3ace8872c3 (2026-08-07). 6 commits dropped, including 6bdf66d16 fix: [fkitdev-8887] recover WebRTC audio after iOS Safari interruption (#3066) — which is ASSGRALI-63, the headline changelog item of the very release being prepared. The release would have shipped without its main feature.

Full write-up, including the assertion that catches it: narrowed-fetch-refspec-stale-devel-merge.

vuer_oss has a full +refs/heads/*:refs/remotes/origin/* refspec and was unaffected.

Semantic breaks a conflict-free merge hid

This is the actual work of a devel update. A textually clean merge is not a working merge: devel deletes and refactors core files while the customization/ tree keeps requiring them by path or calling them by name. Git has no opinion about either.

1. vuer_css — deleted core helper still required by a Generali route

customization/server/web/routes/waiting-room.endpoint.js:5 required server/util/aiActHelper.ts, which devel DELETED. Devel replaced it with server/web/helper/getAiActData.js:

async getAiActData(req) → { shouldShowAiIdentificationConsent, consentDocumentUrl, consentData }

Left as merged, the waiting-room route would throw Cannot find module at request time. Fixed by mirroring devel’s own core refactor inside the Generali override, keeping Generali’s gen-waiting-room.template.twig path.

Same class of failure as nusz-devel-update-2026-06-16-lint-merge-fix (core .js→.ts rename vs extensionless require()), except here the target was deleted outright rather than renamed.

2. vuer_css — socket-connection refactor bypassed by Generali page overrides

Devel commit a6185aa41 fix: [fkitdev-8846] remove duplicated socket connections (#3130) replaced the auth() call with SocketService.getConnection('<page>.script') plus a “Missing layout socket connection provider” guard.

Generali’s page overrides still called auth(...) from their .script.js:

• customization/ui/pages/gen-self-service-consent-pep/{*.script.js,*.ui.js}
• customization/ui/pages/gen-self-service-consent-ttny/{*.script.js,*.ui.js}

Fixed to mirror core, keeping the gen-* identifiers.

3. vuer_oss — clean

No semantic breaks found, and that was proven, not assumed:

• Programmatically resolved all 704 relative requires under customization/. The only unresolved hits were commented-out placeholder examples, byte-identical on the base commit.
• supportedSteps — removed by devel’s feat: [fkitdev-9119] — has 0 references in real source in either repo.

Validation

Node version matters before you run anything

All validation ran on Node 24.18.0 from /opt/homebrew/opt/node@24. The repo-default node is v22.22.3, which is below the >=24.9 that jest needs here. Wrong node ⇒ failures that tell you nothing. (Same trap as recorded in SLACOFI-14.)

vuer_css — fully green

Gate	Result
lint	PASS
test:unit	120 suites / 1083 passed / 0 failed
build	PASS
depcheck	PASS
improved-yarn-audit --min-severity critical	0 vulnerabilities — PASS

Base (pre-merge) was 115 suites / 1043 passed / 0 failed ⇒ devel’s 5 new suites all pass against Generali customization.

vuer_oss — green except a pre-existing audit failure

Gate	Result
lint	PASS
build	PASS
depcheck	PASS
test:unit	4 failed / 3545 passed — all pre-existing
audit	FAIL — 1 CRITICAL, pre-existing

Unit failures classified against a base-commit worktree (see devel-update-verification-recipe):

	Failing suites
Base commit	10 failed — converter, self-service-v2, sms-report-service, vuer-cv-service
Merged	4 failed — converter, self-service-v2, vuer-cv-service

⇒ none merge-caused; the merge NET-FIXES sms-report-service. Deterministic across 3 runs each when the suites are run isolated; full-suite runs vary because of test ordering.

The audit gate — known, and it blocks build

vuer_oss audit is RED on 1 CRITICAL — and that also blocks the build job

sequelize GHSA-v8fg-2rw7-q452 via sequelize@npm:@techteamer/sequelize 6.32.2. Pre-existing: byte-identical resolution on the base commit, which fails the same gate. This is the FKITDEV-8279 fork problem.

It matters for the PR because build has needs: [lint, test, audit, sonar] — a red audit also blocks build. The prior Generali round (FKITDEV-9073) hit exactly the same thing.

CI expectations — the pipeline-inheritance trap did NOT apply here

Both Generali branches already carried devel’s full 6-job pipeline, so the “legacy 1-job partner branch suddenly inherits devel’s 6 jobs” trap — which cost Cofidis 5 failure clusters in FKITDEV-9059 — did not apply. See customization-branch-ci-pipeline-inheritance.

vuer_oss also gained a scheduled long-lived-branches.yaml, but its branch matrix lists only devel / mbh / raiffeisen / kh / unicredit. Generali is not in it ⇒ no new scheduled load on this branch.

Release-ticket collection for 1.9.11.19

Produced with /Users/levander/coding/facekom/.claude/scripts/release_tickets.py against baseline tag generali-atvilagitas-1.9.11.18 — the reusable Phase 3 of devel-update-and-release-flow:

python3 .claude/scripts/release_tickets.py generali-atvilagitas- \
  ./vuer_oss-FKITDEV-9194 ./vuer_css-FKITDEV-9194

Landed directly on customization/generali-atvilagitas (partner-specific — always a TjK entry):

Ticket	Summary	State	Assignee	Repo	Commit author	PR
FKITDEV-8567	Generali - reduceRight átírás	Done	Ferenc Jurkiewicz	vuer_oss	Szecsődi Imre	#7811
FKITDEV-9194	devel-update fix (this round)	Open	andras.lederer	vuer_css	andras.lederer	—

Came via devel but modified customization/ (partner surface changed — usually a TjK entry):

Ticket	Summary	State	Assignee	Repo	PR
FKITDEV-9119	EnvData supportedSteps törlése	Done	Márton Szvetkó	vuer_oss	#8083
FKITDEV-9080	WebSDK - AI ACT	Pending	Krisztián Makkai	vuer_oss	#8054

Two things to fix up by hand

• FKITDEV-9080 is Pending and ships anyway — the code is merged onto the branch, so ticket state does not scope it out. Flag it to the release owner.
• The headline item is in neither bucket. ASSGRALI-63 / FKITDEV-8887 (6bdf66d16, iOS audio) is a pure-core commit that never touched customization/, so the tool cannot see it. Cross-check the parent ASS* release ticket’s changelog.
• Assignee ≠ author — 8567 is assigned to Jurkiewicz but was written by Szecsődi. Contact whichever fits the question.

Config break to carry into the changelog

Devel restructured browsers.showOldBrowserWarning → browsers.oldBrowserWarning.{show,delay}, and server/web/Template.js:123 now reads the new path. Any Generali production config still on the old key silently loses the old-browser warning — no error, no log line. docs/config/ was not updated to match, so the schema does not warn either.

Also new in this range but default-off: sftp, dataCleanupCron, transferRoomCron, documentRecognitionVersion, roomExportFilesExtendedName.

Near-miss #2 — an upstream fix landed while I was fixing the same bug

Re-check devel immediately before pushing, not just before merging

I diagnosed a devel regression (FKITDEV-9199 — dataset.socketToken never resolving because the twigs emitted camelCase data-socketToken), wrote a reader-side fix and pushed it — while the upstream fix cda6c80b97 had already landed ~2 hours earlier, taking the opposite approach (kebab-casing the twigs). Merging mine on top would have re-broken it.

Why 1083 green tests missed the original regression: vuer_css jest runs in the node environment with no jsdom, so all DOM behaviour is hand-mocked and nothing parses a real HTML attribute. To verify DOM-coupled behaviour, render the real twig with the real twig engine (autoescape: true, matching server/web/WebServer.js:257) and parse it with a real HTML parser.

Open questions

Which ticket should a devel update live on?

Prior rounds used a dedicated devel-update ticket (FKITDEV-9073, Generali update 2026-07-15). This round was folded into the release-prep ticket FKITDEV-9194 instead. No note exists for FKITDEV-9073 either — the whole Generali devel-update line was undocumented before this note. Worth settling the convention before the next round.

Related

• devel-update-and-release-flow — the reusable end-to-end procedure extracted from this round: preconditions → merge + semantic sweep → validation → release-ticket collection → release gates → pre-push devel re-check. Start here next time.
• narrowed-fetch-refspec-stale-devel-merge — the headline gotcha, generalised; read this before any merge in a narrowed clone.
• devel-update-verification-recipe — superseded stub, kept for inbound links.
• customization-branch-ci-pipeline-inheritance — the pipeline trap that did not fire here, and why.
• FKITDEV-9059 — Cofidis devel update; the round where that trap did fire, with the full failure inventory.
• FKITDEV-8279 — the @techteamer/sequelize fork behind the red audit gate.
• FKITDEV-8887 — the iOS-Safari WebRTC audio recovery fix (6bdf66d16) that the stale merge would have dropped.
• ASSGRALI-63 — the customer-facing ticket for that fix; the headline item of release 1.9.11.19.
• nusz-devel-update-2026-06-16-lint-merge-fix — same class of break (core rename vs customization require).
• customization-branches — branch fleet, incl. generali-atvilagitas vs dead generali-kar.
• client-registry — Generali name glue (GRALI / GRALIA → generali-atvilagitas).
• vuer_oss · vuer_css