quality: 12 hydra-gate failures — 4 were invisible while the gate runner aborted at gate-49

[rubenvdlinde]

The hydra gate runner aborted at gate-49 outside CI (set -u + unguarded HYDRA_GATE_PR_BODY), so gates 49–57 never executed and the run read as green. Fixed in ConductionNL/hydra#377; running the full set on softwarecatalog now reports 12 failures.

Newly visible (gates 49+, previously never run)

• gate-57 orphaned-write-capability (2) — the most severe class: a write capability nothing calls.
  • lib/Service/Federation/FederationService.php:240 publishEntryForFederation
  • lib/Service/SoftwareCatalogueService.php:850 createUserForContactIfNotExists
• gate-49 controller-exception-translation (5) — all in ContactpersonenController (getContactpersonen, convertToUser, getContactPersonsWithUserDetailsForOrganization, getUserInfo, enrichMeWithContactpersoonData): call a service method that may throw a tracked exception with no try/catch and no @throws. Same class as the SBOM 500-instead-of-404 fixed in fix: four production defects found by live testing the market-gap wave #392.
• gate-50 security-config-fail-mode (23) — security-relevant config reads without a fail-mode guard, concentrated in ArchiMateImportService (amef_register, amef_model_schema, …).
• gate-54 relation-dialect (4) — non-canonical relation dialect usages.

Already visible (gates <49)

gate-4 composer-audit · gate-32 semantic-controls (3) · gate-38 skip-link (2) · gate-39 button-name (2) · gate-40 form-label-association (49) · gate-43 table-headers (17) · gate-45 prefers-reduced-motion (10) · gate-46 spec-anchor-existence (9, tracked in #402).

Suggested order

1. gate-57 — orphaned write capability is the "feature looks done but nothing calls it" class; verify whether federation publish and contact→user creation are genuinely reachable.
2. gate-49 — mechanical and low-risk; mirrors the fix already applied to SbomController.
3. gate-50 — largest count but mostly one service; needs a judgement call on which reads are genuinely security-relevant.
4. Accessibility cluster (32/38/39/40/43/45) — worth one dedicated a11y PR; gate-40's 49 findings dominate.

Note gate-46 (9) overlaps #402.