refactor: clear the phpmd violations every open PR inherits from development

[WilcoLouwerse]

Why

quality / PHP Quality (phpmd) has been red on every open PR into development since #1250 and #1253 landed (for example #1243, #1364, #1366, #1391 to #1397). phpmd scans all of lib/, not only the PR diff, so each PR inherits the failure, and the Quality Report that sums up the checks goes red with it. phpmd is not a required check, so the PRs could still merge while red, and that is how the debt got onto development.

The violations, all in code from those PRs:

File	Rule	Value	Limit
SessionController	ExcessiveClassLength	1087 lines	1000
SessionController	TooManyMethods	26	25
SessionController::exampleResidentUser()	CyclomaticComplexity / NPathComplexity	13 / 200	10 / 200
PortalShell	ExcessiveClassComplexity	59 (53 before #1394)	50
PortalShell::residentMenu()	CyclomaticComplexity / NPathComplexity	11 / 200 (split by #1394)	10 / 200

What

• The one-click demo sign-in gets its own controller. GET /portal/api/session/example-resident keeps its URL and its attributes (#[PublicPage], #[NoCSRFRequired], #[AnonRateLimit(10/60)], #[BruteForceProtection]), so the frontend is unchanged. It now maps to ExampleResidentController::signIn (exampleResident#signIn).
  • The switch, declaration and install-record checks move into ExampleResidentSignIn (open(), userFor()). That service already reads the same switch for the site's demo card.
  • The controller keeps the portal check: the portal must be the named one and offer the nextcloud mode.
  • Every refusal is still a throttled 404.
• The resident menu projection moves into PortalResidentMenu: card label, groups and items, and the leave-out list that feat(site): a portal may leave items out of the resident menu (resident-menu-leave-out) #1394 added. It works the same way PortalSignInText owns the sign-in text. The output of PortalShell::project() is unchanged, and feat(site): a portal may leave items out of the resident menu (resident-menu-leave-out) #1394's leave-out test passes through the new class.
• The demo sign-in tests move to ExampleResidentControllerTest and are tightened.
  • The refusal tests used to give the resident no portal account, so a missing-account 404 hid every guard: removing the switch check or the portal check left them green.
  • The shared parts now include an active account.
  • New cases: a portal without the nextcloud mode, a lookup that answers with the resident's portal for another portal the caller named, and no portal lookup while the switch is off.
• Coverage for the new branches, for the PHPUnit coverage guard: the 503 when no session can be issued, the refusal when the portal lookup throws, and new ExampleResidentSignInTest and PortalResidentMenuTest for the service's early refusals, the menu limits and non-text values.

No suppressions were added. The existing @SuppressWarnings on SessionController (coupling, class complexity, parameter list) are untouched.

Test

• phpmd lib text phpmd.xml and the unused-params ruleset → exit 0 (before: 7 violations).
• run-hydra-gates.sh --scope-to-diff --base origin/development → exit 0, 45 of 45 applicable gates ran.
• phpstan on the changed files → no errors. phpcs → the new files are clean; the findings in appinfo/routes.php exist on development too.
• Each of the six demo sign-in guards was removed in turn (switch, open(), nextcloud mode, portal slug, declaration, declared portal), and every removal fails a test in ExampleResidentControllerTest.
• PHPUnit phpunit-unit.xml: 2969 tests, 62 errors, the same counts as development before the merge. Those errors need a running Nextcloud (Class "OC" not found). SessionControllerTest (56), ExampleResidentControllerTest (7), ExampleResidentSignInTest (2), PortalResidentMenuTest (2), PortalShellTest (13), PortalRuntimeConfigResolverTest (25) and PortaliqRegisterConfigTest (26) all pass.
• psalm could not run locally: psalm 5.26 crashes on this PHP version before it analyses anything. CI runs it.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/portaliq @ 163eab6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-reuse		✅
composer			✅	✅ 108/108
npm			✅	✅ 984/984
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					❌
Newman					✅
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-08 12:52 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/portaliq @ e5d19c5

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-reuse		✅
composer			✅	✅ 108/108
npm			✅	✅ 984/984
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 2983/2983 · 1 skipped
Newman					✅ 1/1
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-08 14:24 UTC

Download the full PDF report from the workflow artifacts.