[rubenvdlinde]

REVIEW (organisation ownership and membership). Held. This PR is stacked on #1404 and #1405. Their commits leave this diff as soon as they merge.

1. StackiqService's organisation sync and creation are deleted (no production caller)

RW118 found that the changed StackiqService methods have no production caller. I confirmed it:

• The background job creates organisations through OrganisatieService::createOrganisationInOpenRegister(), called from OrganizationSyncService.
• handleNewOrganization and handleOrganizationUpdate exist on Stackiq\OrganizationHandler, which is the class that is used.
• No class in lib/, src/ or appinfo/ references StackiqService at all. Only comments name it.

So instead of fixing a path nothing runs, this PR deletes it:

• the entry points handleNewOrganization, handleOrganizationUpdate, syncOrganizationWithOpenRegister and createOrganisationInOpenRegister, plus the 16 private methods only those reach (1,800 lines, computed as the closure of callers);
• the five constructor dependencies that were never read afterwards (OrganizationHandler, SymfonyEmailService, IUserSession, IUserManager, IGroupManager).

This removes the problem RW118 found: the first version of this PR called OpenRegister's createOrganisation() without checking the slug, and on a slug collision OrganisationMapper::save() updates the existing organisation, which would have handed it to the caller. It also removes the original bugs (createWithUuid does not exist, getUID() on null). RW118's low items (a non-string contact e-mail, an empty e-mail added as a member, the golden double that ignored the organization filter) were all in the deleted code and its golden.

The golden test of the deleted path (StackiqServiceOrganisationSyncGoldenTest), the stub additions it needed, and the stale tests/OrganizationSyncTest.php go too. That file sits outside every test suite and uses the old constructor.

What stays in StackiqService (contact person processing, user groups, hierarchy) is unchanged. Its remaining tests pass: StackiqServiceDecompositionTest and StackiqServiceOrganisationMapperTest.

Not in this PR, for a decision: the whole StackiqService class (1,406 lines left) is unreferenced. Deleting it is a separate, larger PR.

Related, production path: OrganizationSyncService deliberately adopts an existing entity with the same slug (adoptOrganisationEntityBySlug). ORX8 is fixing the slug overwrite in OpenRegister itself.

2. ContactpersoonService backup entity (inherited, the same on both trees)

ensureOrganisationEntityPublic(orgObject: ...) used a named parameter that does not exist (the parameter is organisationObject). The Error escaped catch (\Exception), so creating the backup entity for a new contact person of an active organisation without an entity always failed. The fix renames the argument. sendEmails keeps its default (true), as in the other two backup paths in OrganizationSyncService.

• ContactpersoonBackupEntityTest failed on the old code with Error: Unknown named parameter $orgObject.
• Mutants 2 of 2 killed (the old argument name, the status check dropped).

3. RW93 follow-ups for #1404 and #1405

• refactor(aangeboden-gebruik): split the koppelingen lookup by uuid into access, query and search steps #1404, koppelingen lookup golden. New cases: a forged organisation filter that names the owner, owner lookalikes (other case, trailing space), forged @self and isAmbtenaar in the options, and a forged @self for the owner. The buildSearchQuery double carries @self through like OpenRegister does. The old cases are unchanged. Mutants 5 of 5 killed.
• refactor(organization-sync): split the related contact and organisation entity sync, drop unused organisation service parameters #1405. testTheBackfillSendsNoMail (performOrganizationsSync creates the entity and sends no mail) and testProcessSpecificOrganizationMailsOnCreate. Mutants 2 of 2 killed (the backfill mails; processSpecificOrganization stays silent).
• The Organisation stub follow-up from refactor(organization-sync): split the related contact and organisation entity sync, drop unused organisation service parameters #1405 (anonymous cases reaching the save) is moot, because that code and its golden are deleted.

Numbers (PHP, lizard, against development plus #1404 and #1405)

	base	this PR
unit LOC	41,149	39,432
size > 60	32.53%	30.02%
McCabe > 10	16.85%	16.06%
params >= 3	14.97%	15.60%
params >= 5	3.13%	3.25%

The parameter shares rise only because 1,717 mostly small-parameter lines leave the denominator. No unit gained parameters. #1413 (listener) takes params >= 3 down by about 1.1 points.

Verified locally

• Diff-scoped checks on the touched lib files: php -l, phpcs, phpstan, psalm and phpmd are clean.
• The touched and affected tests pass, including StackiqService's remaining tests, the organisation sync goldens and the koppelingen golden.
• development (ea0dcc2) is merged in, without a rebase.
• The full unit suite ran on the previous head of this branch: exit 0, 1645 tests. A re-run on the deletion and the hydra gates are queued, and their results follow in a comment.

Assisted-by: ClaudeCode:claude-opus-5-5

[rubenvdlinde]

Rerun on the deletion head (37745e8): full unit suite (phpunit-unit.xml, pcov, --fail-on-risky) exit 0, 1630 tests, 0 failures, 0 risky, 59 skipped. Hydra gates --scope-to-diff --base origin/development: 37 of 37 applicable gates ran, 0 FAIL.

[github-actions]

Quality Report — ConductionNL/stackiq @ 55b1d50

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		❌
check-l10n-js		✅
composer			✅	✅ 127/127
npm			❌	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1610/1610 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-11-04 00:54 UTC

Download the full PDF report from the workflow artifacts.