Name conflicting assignee labels in import errors

[Chris0Jeky]

Purpose

Make the existing one-label-per-source-key import rejection actionable. A large board import can currently fail with only a generic rule description, leaving the user unable to locate the offending source identity.

The intended error identifies:

• the conflicting sourceKey;
• the first recorded display label;
• the later conflicting display label.

The values are already bounded by the import DTO contract and are returned only to the authenticated caller who submitted the payload.

TDD checkpoint

The first commit is regression-only. It drives the real BoardJsonExportImportService.PreviewBoardAsync path with source-person, Source Alex, and Someone else, then requires all three values in the validation message. Current production emits only Each source assignee key must have one consistent display name across the import., so the exact-head application test lane is intentionally expected to fail before implementation.

Scope

• Validation copy only; rejection precedence and ordinal/case-sensitive identity semantics remain unchanged.
• No import mapping, authorization, transaction, board/card creation, schema, endpoint, or frontend behavior changes.
• Existing broad consistency tests may retain their stable consistent display name substring assertion.

Closes #3035

Final current-base qualification

Head 404ac8e2955e5c318c5f1c47716f9d57db76f87d is merged onto base ce97301bd7436008941950c010c2ade48dea2c41. Preview, typed Apply, and raw JSON Apply regression tests pass 3/3; the broader assignee consistency set passes 18/18; the full Application suite passes 4,612/4,612; and git diff --check is clean. A fresh independent review found no CRITICAL/HIGH defect.

[Chris0Jeky]

Fresh-context review of the regression-only head: the test is well targeted and reproduces the actual usability defect, but this branch still contains no production implementation and must remain draft.

The fix should stay at the existing whole-payload validation seam in BoardJsonExportImportService.ImportBoardCoreAsync, where the first label is already retained in sourceNames. On conflict, capture that retained value and report all three bounded values without changing ordinal identity or validation precedence, for example:

if (!sourceNames.TryAdd(source.SourceKey, source.DisplayName) &&
    !string.Equals(sourceNames[source.SourceKey], source.DisplayName, StringComparison.Ordinal))
{
    var firstDisplayName = sourceNames[source.SourceKey];
    throw new DomainException(
        ErrorCodes.ValidationError,
        $"Source assignee key '{source.SourceKey}' uses conflicting display names '{firstDisplayName}' and '{source.DisplayName}'. Each source key must have one consistent display name across the import.");
}

Please preserve the existing bounded-field validation before interpolation and retain the broad tests' stable consistent display name phrase. The new focused test correctly proves no board write is attempted. No additional correctness blocker was found in this narrow intended change.

[Chris0Jeky]

Fresh-context independent review of exact base ce97301bd7436008941950c010c2ade48dea2c41 and head 404ac8e2955e5c318c5f1c47716f9d57db76f87d: CLEAN ? no CRITICAL/HIGH finding.

The message preserves the compatibility phrase and adds the bounded source key and both labels. Preview, typed Apply, and raw JSON Apply reject before repository writes; focused tests pass 21/21, the full Application suite passes 4,612/4,612, and diff check is clean. The historical analysis note's exact old wording is declined as non-blocking documentation drift for this bounded pipeline.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T19:39:23.408048Z	404ac8e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.