[rubenvdlinde]

Method-decomposition slice 8i, by measured complexity. Stacked on #3921 (Q-dossiq-L11-2; it shares .debt-baseline.json and the decomposition tasks with #3858): land after it.

What moves

ZtcController carried two class suppressions: 12 public methods against 10, and complexity 79 against 50 (measured on development without the suppressions).

• The three publish routes go to their own controller, ZtcPublishController, with handlePublish() and publishedCopy(). Same URLs, verbs, rate limits and auth attributes; only the route names change (ztc#publish* to ztcPublish#publish* in appinfo/routes.php). It extends ZgwController, so the ZGW auth middleware still applies.
• Zgw/ValidityDateFilter: the datumGeldigheid filter of a Catalogi list.
• Zgw/ZtcTypeNameResolver: ztc-010m, an informatieobjecttype named by its omschrijving becomes its uuid.

Bodies are moved unchanged. After: 9 public methods, complexity under 50, both suppressions gone. phpmd.suppressWarnings 180 to 178 on top of #3858.

Tests

• The publish contract test existed and moves with the routes (ZtcPublishControllerContractTest, 6 tests). ZgwRateLimitTest and ZgwAuthMiddlewareTest list the new controller, so its rate limits and its place under the middleware stay pinned.
• New: ValidityDateFilterTest (both bounds inclusive, open bounds, re-indexed) and ZtcTypeNameResolverTest (name, then full text, outside the caller's access; and every case that leaves the body alone).

Seen, not changed

The ZTC publish routes run no business rule: the CT-02b publish guard (ZgwBusinessRulesService::guardCaseTypePublish, status types, a final status and a valid-from date) does not run on them, and they check no ZGW scope (the contract test documents the scope part). A zaaktype can therefore be published through /zaaktypen/{uuid}/publish without what the guard demands. Asked as Q-dossiq-L11-5; not a decomposition change.

Verified (once, on the stack top 3bfc0b4, which holds #3858 and the four PRs above it)

Every composer check:strict stage once, one at a time in the lane's check worktree (exit codes in dq-l11-logs/r7/s31.rc):

• lint 0, refusal-grounds snapshot 0, phpcs 0, psalm 0, phpstan 0.
• phpmd 2: only the two BooleanArgumentFlag findings in lib/Service/Termijn/TermLetters.php (401, 425) that development carries since fix(letters): every date in a letter to the applicant reads the same way #3884/fix(portal): the Woo request form reads Dutch dates and names refused fields in Dutch #3895. Inherited.
• PHPUnit --no-coverage: 8,676 tests, exit 0 (7 skipped, 1 warning). A first run found 3 reds of this stack (BrcCrossRegisterSyncTest still read the old warning lines), fixed in 28e4ad6, then the run above.
• Mutations: the catch in ZgwBusinessRulesService, the throw in findBySchemaKey, the throw in fieldPairExists, the not-found branch, the not-allowed branch and the null check in handleDestroy each turn their tests red.
• Not run locally: the touched test classes under pcov with fail-on-risky. The pcov image is gone and docker cannot pull, so the @covers/@uses of every touched test were checked by hand (each class a test can now execute is listed). CI is the check for that.
• eslint and prettier on the 17 JS/Vue files the citation PR touches: 0. Vitest not run: comments only.
• Hydra gates against refactor(transitions): the status engine asks two facades instead of fourteen collaborators #3858's head: 80 of 80 applicable ran, 8 failed, all inherited (22 and 53 on src/manifest.json, which this stack does not touch; 23, 43, 51, 55, 104, 107). Gates 5, 13, 16, 25 and 46 pass.
• openspec validate guards-refuse-when-unsure and method-decomposition: valid.
• Inherited: the debt ratchet reads red on development itself (phpmd.suppressWarnings 187 measured against 182) and eslint.inlineDisables 15 against 14.

No register change, so no info.version bump.