[ahegyes]

Summary. Fifteen commits from the v2 re-audit, each standing alone:

• the migration runner looped inside Action Scheduler's runners and churned its lock while a batched step was pending;

• attachment meta boxes discarded every save;

• a network notice dismissed on one network hid the same notice on every network;

• the updater offered tags that version_compare() misorders;

• the package split could race and force-push from any branch;

• the changelog directory vanished after a release;

• three record claims had no test;

• the scheduler backends carried an unused parameter;

• three npm scripts downloaded @wordpress/scripts at run time;

• several docs had drifted from the code;

• the core persona taught an anatomy the conventions reject;

• the workflows and locks pinned wordpress-configs several merges behind its trunk.

• Migration runner:

  • inside its own hook, a spent budget schedules the continuation a second ahead instead of now, so wp action-scheduler run and the async runner end instead of claiming it again at once;
  • outside the hook, run() reads the step at the cached revision first, and enqueues a pending batched step without taking the lock, where it had cost nine queries a request;
  • limitation 2 says what such a request costs.

• Attachments: wp_insert_post() fires edit_attachment instead of save_post for an attachment, so a PostMetaBox whose types include attachment also saves there. The form's nonce check still turns away updates that post no form.

• Network notices: a viewer's state for network notices lives in installation-wide user meta, and it is now keyed network:{network_id}:{id}.

• Updater: tag suffixes are limited to -dev, -alpha, -beta or -rc, in any case and optionally numbered, as Shared's Version accepts. A prerelease-channel site had been offered 2.1.0-pre.1 over 2.1.0.

• CI:

  • Split Packages takes one concurrency group per ref without cancelling a run in progress, and runs only for trunk and v* tags;
  • changelog/.gitkeep keeps the directory after changelog:write empties it;
  • Quality runs changelog:validate.

• Tests: new rows for record claims that had none:

  • serialized-looking strings round-trip as strings through every cache kind and through OptionRows;
  • without WP_DEBUG, the logger's default threshold is warning;
  • a kernel's second boot adds disjoint roots and throws, before registering anything, for a class already walked.

• Scheduler backends: BackendInterface::enqueue() drops bool $unique, which its one caller always set and the WP-Cron backend ignored.

• Tooling: @wordpress/scripts is a locked devDependency, and packages-update:wp, check:engines and check:licenses call its binary instead of npx --yes @wordpress/scripts@latest.

• Docs:

  • SettingsTab, SettingsSection, Fields::is_drawn_by_forms() and limitation 4 say that a settings field's render callable needs a type WooCommerce does not draw;
  • limitation 3 adds a single site with many rows to what can outlast a web uninstall's time limit, and limitation 5 names the migration notices beside the boot notices;
  • OptionRows says it writes rows without autoload, and OrderMetaBox says where WooCommerce fires its save hook;
  • the layout tree names floors by key, and the audit command says what npm's half covers.

• Core persona: its migration steps are prefixed functions in includes/migrations.php, and its root keeps the runner in a protected(set) property, as consumer-a and the template do. The core README excerpt follows.

• Configs pins: every workflow ref and lock moves from 88710a7 to configs 3cbd985. The reusables the framework calls change only their action pins and comments, with no input changes, and each lock changes only its configs entry.

Production code +83 −32 (13 files), tests +161 −9 (11 files), fixtures +60 −63 (6 files), docs +15 −14 (3 files), workflows +8 −1 (2 files), changelog/.gitkeep, the configs pins in six workflows and eight locks, and the npm manifest and lock for @wordpress/scripts (+21,704 −3,074, nearly all lock).

Review points.

• Full npm audit: the full-tree npm audit behind npm run audit now reports @wordpress/scripts' development advisories (13, one high), as the template's and configs' trees do. CI's npm audit --omit=dev passes, since the framework has no runtime npm packages.
• Internal signature: BackendInterface sits in core's internal Scheduling\Backends\ namespace, so dropping its parameter changes no contract.
• Unreleased changes: a network-notice dismissal stored under the old key is no longer read, and a tag with another suffix, such as -pre.1 or -patch, is no longer offered. Nothing is released, so @version stays 2.0.0 and no migration or changelog fragment ships.

Testing.

• composer quality-check passes: validate, changelog validation, PHPCS on both profiles, the PHPStan profiles and every fixture's, Unit 192 and Integration 1345.
• composer test:integration:multisite passes (41), and so does composer test:integration:php74 (2).
• actionlint, zizmor, npm run check:engines, npm run check:licenses and a PHP 7.4 php -l of packages/bootstrap are clean.
• Before the fixes: the runner, attachment, network-notice and updater rows failed on trunk. The rows that pin existing behavior fail under mutants: OptionRows skipping serialization for strings, and the persona discarding its runner.