[rubenvdlinde]

What

FederationMerger::plan took the peer's url, organisation and sync moment as three of its five parameters. They now travel as one $peer array (url, organisation, syncedAt); plan() reads them into the same local variables at its top, so the reconciliation (create, update, withdraw; the ownership guard that keeps locally-owned entries out; the no-op-equal check) is untouched. Its one caller, FederationService::pullPeer, passes the same values in the new shape, and the 7 calls in FederationMergerTest are rewritten to it.

testPullPeerMergesNewEntries now also checks the organisation and the sync moment on the stored mirror: a mutant that dropped the sync moment at the call site survived the existing tests, on the old code as well.

SIG (gate 122 reader, lizard 1.24.3), php

php	development (with #1374)	this PR	with #1351, #1375 and #1376	4-star	5-star
params >=3	19.77%	19.77%	18.64%	15.0%	7.5%
params >=5	4.40%	4.27%	3.28%	3.3%	1.65%
params >=7	0.75%	0.75%	0.76%	0.9%	0.45%

plan() moves from 5 to 3 parameters (54 to 51 lines, McCabe 11 as before); pullPeer stays at 53 lines. With the REVIEW PR #1375, the facet PR #1376 and the scope file #1351 together, php params >=5 reaches 3.28%, under the 3.3% 4-star limit; the margin is small (6 unit lines).

Verified

• FederationMergerTest and FederationServiceTest (23 tests) pass on the new code; FederationServiceTest with the added assertions passes on the old code too (14 tests, 59 assertions on both).
• Capped mutants: 8 of 8 killed over two rounds (url and organisation swapped, sync moment dropped in the merger and at the call site, url dropped, local mirrors dropped), the no-op control survived.
• phpcs (0 errors on the lib files; the test files carry 160 inherited style findings, none on changed lines), phpstan, psalm, phpmd on the changed files; gate 122 ratchet 0 findings; diff-check phpcs and phpstan 0 new, gates PASS.
• Full unit suite once under pcov with --fail-on-risky: 1,506 tests, the same 20 errors as development (Doctrine\DBAL\ParameterType missing locally), 0 risky.
• development merged in before the push.

AI disclosure: prepared with Claude Code (claude-opus-5-5) and reviewed by the lane before opening.

[github-actions]

Quality Report — ConductionNL/stackiq @ c07e92d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		❌
check-schema-l10n		❌
check-l10n-js		✅
composer			❌	✅ 127/127
npm			❌	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1486/1486 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-11-02 21:38 UTC

Download the full PDF report from the workflow artifacts.