From afc61308c76ca5fdb9ec8fe5f7b9cdef88f5c8da Mon Sep 17 00:00:00 2001
From: Edmond Gebara <edmond@gebara.net>
Date: Wed, 8 Jul 2026 13:52:11 +0200
Subject: [PATCH] changed: Soll-/IST-Profile

---
 CLAUDE.md                       | 13 +++++++++++++
 Process-ADObjects-Work-R125.ps1 |  4 +++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 27c78d4..4d4007a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -103,6 +103,19 @@ per institute (down from 10 h; do not regress this).
 - **Out vs Neu list Add targets:** adding a line to the wrong collection
   duplicated every FS creation row. The Neu list is derived now, but the same
   copy-paste class applies to the four remaining lists.
+- **Verify ALL FOUR outputs after any Work-file change — not just one.** A sorted
+  multiset compare of a single output (e.g. Ist-MitarbeiterProfile) can be
+  byte-identical while a sibling (Soll-Profile) silently diverges. Seen: the
+  AppAccess `ProfilName` flipped from `"Anwendungszugriff <name>"` to the AD
+  description because a source-column read changed `$item.'Beschreibung'` (a
+  column that does NOT exist in `*_Anwendungen.csv` → always `$null` → empty →
+  fell through to the intended default) to `$item.'Beschreibung (256 Zeichen)'`
+  (the real, populated column). Ist / GruppenAnlegen / Gruppenverwaltung matched
+  exactly; only Soll-Profile differed — cols 3+6 of the 638 AppAccess rows.
+  Corollary: **a read of an absent column is load-bearing "always-empty"
+  behavior.** Do not "fix" a phantom column name to the real one without checking
+  the downstream `if (-not $x)` default it feeds; set the value to `""` explicitly
+  instead so a future rename can't resurrect the bug.
 - **Prefix filter (Anwenderrollen):** `R125GUX*`/`<SPKID>GUX*` objects fall
   THROUGH (original cascade had an empty first branch). The explicit
   `StartsWith` check preserves this regardless of the prefix CSV content.
diff --git a/Process-ADObjects-Work-R125.ps1 b/Process-ADObjects-Work-R125.ps1
index ee5d044..ba2ce9f 100644
--- a/Process-ADObjects-Work-R125.ps1
+++ b/Process-ADObjects-Work-R125.ps1
@@ -979,7 +979,9 @@ function ProcessADObjects
             $nummer_array[$MyKey[1]] = $item.'Nr.'
             $verantwortlicher_array[$MyKey[1]] = $Verantwortlicher
             $kz_array[$MyKey[1]] = $item.'AWK'
-            $beschreibung_array[$MyKey[1]] = $item.'Beschreibung (256 Zeichen)'
+            # ProfilName must stay "Anwendungszugriff <name>": keep the description empty so the
+            # else branch below does not override it with the AD description column.
+            $beschreibung_array[$MyKey[1]] = ""
           }
         }
       }