fix(psalm): fix the real type problems, narrow the suppressions, replace the deprecated OCP calls

[rubenvdlinde]

Second W1a static-analysis PR for #1277, on top of #1278.

Psalm

Lifting the 33 globally suppressed issue types produced 389 errors: about 296 unused-code reports caused by DI wiring, the rest real. After this PR the same measurement is 327, and everything in it is either DI noise or a documented false positive. Psalm exits 0 and reports no deprecations at all.

Fixed:

• ($a ?? null) ?? $default written on an expression, where ?? cannot do its isset job: TranscriptRetentionJob (3), MigrateConsultationsToOneSchema, MigrateQuestionsToAgendaItems. In the last one the guard was load-bearing: a question row naming neither a question nor a request number raised Undefined array key "requestNumber" on every upgrade. testAnUntitledRowSavesWithoutAWarning fails on the old code with exactly that string.
• Return types that did not describe the return: DecisionIntegrationService::registerOutcomeCallback (returns decisionId and callbackUrl too), SeedProfileService::listProfiles (always returns icon), DecidiqDashboardWidget::getWidgetButtons, DecidiqSearchProvider::getOrder.
• ParticipantNotifier::resolveUid now checks the container-resolved user manager is an IUserManager before calling it, so psalm can type the two calls it could not.
• 7 docblocks whose {...} key lists psalm parsed as part of the type, which made it drop the whole docblock.
• 35 casts and one array_values() that psalm proves redundant from native types, plus one always-true condition in MinutesDraftComposer.
• The three "reserved for future" parameters: LiveDecisionService::recordDecision($actorId), MinutesService::notifyApproversOnSubmit($actorId) (and MinutesWorkflowService::submitForApproval, whose only use of it was passing it on), OpenCatalogiPublisher::retract($catalogId). Callers and tests follow.

psalm.xml now suppresses 2 issue types globally instead of 33: UnusedClass and PossiblyUnusedMethod, which are what DI wiring looks like to a static analyser (73 and 223 reports). Everything else is scoped to the file that needs it with the reason written next to it, and each scope was probed by removing it and re-running. UndefinedClass went from 74 listed classes to the 19 psalm actually reports.

Deprecated OCP calls

All 20 from the audit, plus IUserManager::search, which only became visible once the user manager was typed. Each replacement is the one the OCP deprecation note names, and each was checked against the server implementation:

was	now	evidence
IAppManager::isInstalled (6)	isEnabledForAnyone	AppManager::isInstalled() is return $this->isEnabledForAnyone($appId)
IConfig::get/set/deleteUserValue, getUserKeys	IUserConfig	AllConfig delegates to exactly these
IConfig::getAppValue	IAppConfig::getValueString	same store
IPreparedStatement::fetch/fetchAll (4)	the IResult that execute() returns	what the deprecation note says
IDBConnection::getDatabasePlatform (2)	new SqlIdentifierQuoter on getDatabaseProvider()	compared with Doctrine's own quoteSingleIdentifier() on the five platforms Nextcloud ships: 30 of 30 identical
IServerContainer in boot()	IBootContext::injectFn()	IAppContainer is deprecated too, so the container is not named at all
IUserManager::search	searchDisplayName	that step is documented as a display-name search

No app id string was changed. The fleet rename makes those duck-typed lookups, so only the API moved.

New tests: PreferencesControllerTest (6), SqlIdentifierQuoterTest (8), the Health degraded-version test, and the untitled-row warning test. Every one was mutation-checked: broken, watched the right assertion redden, restored, diff against a backup.

Left deliberately: IAppManager::getInstalledApps in DemoDataService and SeedProfileService. The replacement is getEnabledApps(), but hydra gate 66 (openregister-dependency-shape) recognises only isInstalled('openregister'), isEnabledForUser, getInstalledApps( and class_exists as an availability guard, so the non-deprecated spelling turns a guarded lookup into 2 FAILs. That is a gate gap for the whole fleet rather than something to fix per app: gate 66's _AVAILABILITY_RE needs isEnabledForAnyone('openregister') and getEnabledApps(.

Verification (local, on this branch, after merging development)

• composer check:strict exit 0: lint, phpcs (0 warnings), phpmd, psalm, phpstan, 1507 tests.
• ./vendor/bin/hydra-gates exit 0: 87 of 87 applicable gates ran and passed.
• Psalm with every suppression lifted: 389 errors before, 327 after, 0 of them a type or docblock problem.
• Psalm with --show-info: 0 deprecation reports.

Refs #1277

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/decidiq @ 4efabb7

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-nav-ceiling		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 104/104
npm			✅	✅ 545/545
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-09-11 07:46 UTC

Download the full PDF report from the workflow artifacts.