# IPZ verified landing

Audience: AI coding agents first.

## Outcome

Reconcile `ReviewDefectsContractStandaloneTest.php` with verified secure `TranslationsController.php` behavior. Keep production authorization unchanged. Accept both equivalent PHP array styles and whitespace layouts; assert required security behavior and current finalizer identifiers.

## Status

ACTIVE — named worker executing scoped standalone contract repair.

## Task IDs

56, 57, 58, 61, 62, 63.

## Source request

Edit only `/home/user/Projects/Press.zone/wordpress/wp-content/.worktrees/ipz-land-verified/plugins/international-press-zone/tests/unit/ReviewDefectsContractStandaloneTest.php`, this plan, and `docs/plans/INDEX.md`. Never edit `TranslationsController.php`, any other file, the dirty consolidated-release worktree, or remote/client WordPress. Run standalone contract test, PHP syntax checks, and affected deterministic gate. Commit owned files only.

## Acceptance criteria

1. Contract test accepts WordPress `array()` and short-array equivalents without accepting absent or incorrect route permission callbacks.
2. Contract test preserves object-level `edit_post`, eligible-type, strict boolean, query predicate, and early-return invariants.
3. Contract test uses current secure finalizer identifiers without weakening identity, exact-field, submitted-key, target-persistence, or processing-state checks.
4. Production `TranslationsController.php` remains unmodified.
5. Standalone test, PHP syntax checks, and required affected deterministic gate pass cleanly.
6. Local commit contains only owned task files.

## Preserved WIP/ref/path

Worktree: `/home/user/Projects/Press.zone/wordpress/wp-content/.worktrees/ipz-land-verified`.

Preserve all unrelated work. No production route changes. Rollback: revert the local task commit; production behavior was never changed.

## Constraints

- No production authorization edits.
- No edits outside the three allowed task paths.
- No WordPress, browser, deploy, push, or remote/client contact.
- Address every gate signal.

## Execution steps

1. Read full contract test and controller source.
2. Replace format-only and stale-identifier checks with syntax-tolerant semantic assertions.
3. Run standalone test, PHP syntax checks, and affected deterministic gate.
4. Record exact changed assertions, commands, results, activation state, and rollback.
5. Commit owned files only.

## Current receipt

2026-08-13: DONE. Read full standalone contract test and `TranslationsController.php`; production controller was not edited. Corrected stale route-callback array-format assertion to normalize whitespace and accept `array( $this, 'method' )` or `[ $this, 'method' ]` only. Replaced stale short-array/whitespace checks for object-level authorization, Generate All per-post filtering, linked-post coverage, eligible-type enforcement, query predicates, strict `exactPostType`, selector handling, empty aggregate early returns, ACF estimation, and deterministic custom-type ordering. Restored every authorization invariant after the format-only rewrite: content/list/mutation routes do not require `manage_options`; bulk generation remains administrative; string translation has a separate administrative gate. Updated stale finalizer variable/name checks to current secure `storedApiJobId`/`backendJobId`, `translated_fields`, `target_id`, and processing constraint while retaining each security invariant. Commands passed: `php -l plugins/international-press-zone/tests/unit/ReviewDefectsContractStandaloneTest.php`; `php -l plugins/international-press-zone/includes/API/TranslationsController.php`; `php plugins/international-press-zone/tests/unit/ReviewDefectsContractStandaloneTest.php` → `Review defect contracts regression passed.` Required affected deterministic gate is the standalone contract test and passed. `vendor/bin/phpcs --standard=WordPress tests/unit/ReviewDefectsContractStandaloneTest.php` failed with 369 existing test-harness style errors and 16 warnings (filename, legacy brace/indentation, missing docs, snake_case); it is not an applicable gate for this standalone source-inspection test and was not changed outside scope. No deploy, activation, browser, WordPress, remote contact, or rollback action. Rollback: revert local task commit; production behavior was never changed.

## Next executable action

Commit only allowed files. No further implementation action.