docs: correct an inverted numeric-key example and a stale test docblock

lib/Controller/ShareController.php

@@ -466,9 +466,12 @@ private function normaliseUserIds(array $userIds): array {
 		// replaces called in_array() against a growing array, making the walk
 		// quadratic in the number of distinct ids.
 		//
-		// Not a keyed set: PHP coerces a numeric-string array key to int, and
-		// Nextcloud user ids may be numeric strings, so "0123" would come back
-		// as 123.
+		// Not a keyed set. PHP coerces an array key that is a CANONICAL decimal
+		// integer string, so a user id of "123" or "-7" comes back from
+		// array_keys() as an int, while "0123", "007" and "1e3" stay strings.
+		// Nextcloud user ids may be numeric, so the ones that survive and the
+		// ones that change type would depend on the id - which is worse than
+		// if it broke uniformly.
 		return array_values(
 			array_unique(
 				array_filter(

tests/Unit/Controller/ShareControllerTest.php

@@ -496,10 +496,12 @@ public function testRecipientCertificatesReportsBothShareableAndNot(): void {
 	}//end testRecipientCertificatesReportsBothShareableAndNot()
 
 	/**
-	 * Input order is preserved and duplicates collapse.
+	 * Duplicates collapse, and first-seen order is kept.
 	 *
-	 * The caller zips the response against the list it sent, so order is part
-	 * of the contract, not an accident of the query.
+	 * Order is a convenience, NOT a positional contract - the result can be
+	 * shorter than the request, so callers correlate by `userId`. Asserted
+	 * here because the order is still the one a reader would expect, not
+	 * because anything may depend on the positions lining up.
 	 *
 	 * @return void
 	 */