ADR-015: the site-literal check was matching nothing, and had been all along

The patterns are assembled from fragments so the published script does not
contain the strings it greps for. They used the apostrophe-escape form
('a'\''b'), which EMBEDS a literal apostrophe, instead of the concatenation form
('a''b'), which joins them. Every pattern therefore carried a stray quote in the
middle and could never match a line of real code, so the check passed everything
from the day it was written.

Verified the only way that means anything: plant a violation, watch it fail,
revert. Fixed, it immediately found 25 real hits.

Among them, in seven places, the default ServiceNow URLs - one organisation's QA
tenant, shipped with the integration ENABLED. Any site that had not configured
ServiceNow still rendered ticket links, pointing its technicians at a tenant
they cannot reach; an adopting site would have been pointed into somebody else's
instance entirely. There is no sensible cross-site default for "which ServiceNow
is yours", so the URLs ship blank and the integration ships off, matching the
Zabbix block that got this right.

A named SaaS tenant is as site-specific as a hostname, so it joins the patterns.
Colocated .spec.js files are excluded the same way tests/ already is: sample data
naming a facility is not a shipped literal.

frontend/src/composables/pageTitle.js

@@ -1,7 +1,7 @@
 // The browser tab title, including WHICH record is open.
 //
 // The router can only name the KIND of page, because it runs before the view
-// has fetched anything: every application read "West Jefferson ShopDB -
+// has fetched anything: every application read "<facility> ShopDB -
 // Application", so two tabs on two different machines were indistinguishable,
 // and a shared link previewed as the section rather than the thing.
 //
@@ -51,7 +51,7 @@ export async function applyGenericTitle(key, page) {
   if (key !== activeKey) return      // navigated on while we awaited
   // A view that named the record before the facility name arrived composed its
   // title against the placeholder prefix, so rewrite it rather than leaving
-  // 'ShopDB - CSF16' on a site called West Jefferson.
+  // 'ShopDB - CSF16' without the facility name in front of it.
   document.title = compose(recordTitle !== null ? recordTitle : page)
 }
 

frontend/src/utils/siteSettings.js

@@ -98,22 +98,20 @@ function darkenHexColor(hex, fraction) {
 
 // ServiceNow ticket-link config. Returns the enabled flag, incident/change URL
 // templates, and the global-search URL template (all with a {ticket}
-// placeholder). Defaults mirror the previously-hardcoded GE ServiceNow URLs.
+// placeholder).
+//
+// The defaults are BLANK and the integration ships OFF, matching the server.
+// They used to be one organisation's QA ServiceNow tenant, so any site that had
+// not configured ServiceNow still rendered ticket links - pointing its
+// technicians at a tenant they cannot reach and, for an adopting site, at
+// somebody else's. A blank URL renders tickets as plain text, which is the
+// correct behaviour for "not configured".
 export async function getServicenowUrls() {
-  const enabledRaw = await getSetting('servicenow_enabled', 'true')
+  const enabledRaw = await getSetting('servicenow_enabled', 'false')
   const enabled = enabledRaw !== 'false' && enabledRaw !== '0' && enabledRaw !== false
-  const incidentUrl = await getSetting(
-    'servicenow_incident_url',
-    'https://geaerospaceqa.service-now.com/now/nav/ui/search/0f8b85d0c7922010099a308dc7c2606a/params/search-term/{ticket}/global-search-data-config-id/c861cea2c7022010099a308dc7c26041/'
-  )
-  const changeUrl = await getSetting(
-    'servicenow_change_url',
-    'https://geaerospaceqa.service-now.com/now/nav/ui/search/0f8b85d0c7922010099a308dc7c2606a/params/search-term/{ticket}/global-search-data-config-id/c861cea2c7022010099a308dc7c26041/'
-  )
-  const searchUrl = await getSetting(
-    'servicenow_search_url',
-    'https://geaerospaceqa.service-now.com/now/nav/ui/search/0f8b85d0c7922010099a308dc7c2606a/params/search-term/{ticket}/global-search-data-config-id/c861cea2c7022010099a308dc7c26041/'
-  )
+  const incidentUrl = await getSetting('servicenow_incident_url', '')
+  const changeUrl = await getSetting('servicenow_change_url', '')
+  const searchUrl = await getSetting('servicenow_search_url', '')
   return { enabled, incidentUrl, changeUrl, searchUrl }
 }
 

frontend/src/views/settings/ServiceNowSettings.vue

@@ -34,7 +34,7 @@
               <input
                 type="url"
                 v-model="settings.servicenow_search_url"
-                placeholder="https://geaerospaceqa.service-now.com/now/nav/ui/search/.../{ticket}/..."
+                placeholder="https://yourtenant.service-now.com/now/nav/ui/search/.../{ticket}/..."
                 @blur="saveSetting('servicenow_search_url', settings.servicenow_search_url)"
                 :disabled="saving"
               >