fix(spec): gate-46 — four tags named a Scenario as a Requirement, one named a change dir that never existed

[rubenvdlinde]

gate-46 (spec-anchor-existence) reported 5 unresolved findings from 4 distinct targets on the full-scope dispatch (run 31416892690). They are two different mistakes, not one.

Four of them: a Scenario addressed as a Requirement

SbomRegisterShapeTest carried these anchors:

#requirement-a-successful-import-records-provenance-on-the-version   (x2)
#requirement-existing-versions-are-unaffected-by-the-schema-addition
#requirement-a-parsed-component-persists-with-its-moduleversie-relation

Every one of those strings is a real heading in openspec/specs/sbom-import/spec.md — but it is a #### Scenario: heading, kebab-cased and then prefixed with requirement-. No requirement of that name exists. The scenario is the more precise target anyway: each of these four test methods verifies exactly one scenario. The tags now say #scenario-….

The fifth: a target with no home

RegisterFragmentMergeTest pointed at

openspec/changes/modular-register-manifest-fragments/specs/modular-config/spec.md

This is not a stale-but-archived path. It is absent from openspec/changes/, from openspec/changes/archive/, and from openspec/specs/ under any capability name — and modular-config is not a capability this repo has ever had. gate-46 resolves change-dir targets through both the archive index and the capability index before reporting, so it had already tried every legitimate redirection.

Repointing the tag at some nearby requirement would have turned the gate green while leaving the asserted behaviour unspecified. Instead the behaviour is now written down where it belongs: REQ-007 in openspec/specs/settings-service, the spec that owns SettingsService, covering the ADR-037 fragment deep-merge contract (disjoint fragments union, lists concatenate, scalars overwrite) with one scenario per test method. It explicitly defers to catalog-ratings for the authorization replace-on-merge carve-out rather than restating or overriding it.

Both directions, measured with the gate's own checker

	result
before	1 × @spec target file not found + 4 × @spec anchor not found
after	exit 0, empty findings log
gate	[gate-46] spec-anchor-existence: FAIL — 5 … → PASS

No gate got worse

Adding two scenarios added zero gate-19 debt — settings-service carries a file-level @e2e exclude (PHP backend, no UI surface). The gate-19 finding list is byte-identical before and after (291 both times, diff empty). Gates 13/25/26 unchanged.

phpcs scans lib/ only, so the tests/ docblocks are out of scope; the spec change is markdown. PHPUnit on the two affected classes: 6/6 pass, 37 assertions.

[github-actions]

Quality Report — ConductionNL/softwarecatalog @ e5960ef

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
composer			✅	✅ 128/128
npm			✅	✅ 718/718
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-10 20:32 UTC

Download the full PDF report from the workflow artifacts.