fix: third round of review fixes for the beta promotion (#2643)

[WilcoLouwerse]

Third round of fixes for the development → beta promotion #2643. These are the follow-ups #2692 left until #2686 was merged.

What this fixes

Finding	Commit	Change
🟡 The creeerZaak/actualiseerZaak integriq sends is not the shape integriq's own receiver reads (creeerZaak)	0a0c2c55f	The zakLk01 creeerZaak now carries parameters/mutatiesoort T with indicatorOvername V, the zaaktype under isVan/gerelateerde (ZAKZKT/ZKT) and each person under <role>/gerelateerde/natuurlijkPersoon. A round-trip test feeds the built message to StufProviderOperationMapper::caseOperation() and gets the create, title, start date, zaaktype and initiator back.
#2692 review note: the log line of a refusal is not asserted	21f0ff26c	testARefusedWriteSendsTheRefusalOutAsOneLine asserts the logger's reason is the bounded outward line.
#2686 heads-up: the legacy HMAC bridge reads its body unbounded	ba01cdae1	StufZknController::inbound reads through StufZknRequestBody (at most 2 MiB plus one byte) and answers 413 for a larger body before the signature or the XML is looked at.

Still open

• The actualiseerZaak half of the same thread: whether ZDS 1.2 updates a case with a zakLk01 old/new pair rather than the zakLk02 the builder sends needs a check against the ZDS 1.2 XSD, which is not in this repository. Until then caseUpdate() is unchanged.
• The Symfony 6.4 thread (lower the constraints or add a CI job), iq-f5 (BRP relations, together with dossiq), sourceApp as configuration.owningApp, the BSN-roster unsubscribe flow, and fix(review): #2643 review findings, round 1 #2686's remaining items (aud-f3, the iq-f3 Microsoft 365 binding, the iq-f6 residue) are with the author.

Checks run on this branch

• bash hydra/scripts/run-hydra-gates.sh --scope-to-diff --base origin/development → exit 0, COVERAGE 46 of 46 applicable gates ran (51 not applicable).
• phpcs, phpstan and phpmd on the two changed lib/ files → clean.
• vendor/bin/phpunit -c phpunit-unit.xml: 5578 tests, 11 errors and 1 failure: the tests/Unit/AppInfo/Application*Test container errors and EndoflifeDateLiveSyncTest (needs the live endpoint), which fail the same way on development.
• Each new or changed assertion fails with its fix reverted (round-trip test, log reason, 413).
• Not run: psalm (crashes in this environment while loading the autoloader files; CI runs it).

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/integriq @ 854e2eb

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 143/143
npm			✅	✅ 646/646
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 5557/5557 · 1 skipped
Newman					✅ 130/130
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅
Hydra gates (axe)					✅

---

Quality workflow — 2026-10-16 14:42 UTC

Download the full PDF report from the workflow artifacts.