```yaml
id: UJ-007
title: Reset plugin settings
actors: [administrator]
surface: admin-spa
goal: Administrator restores supported settings to canonical defaults and fresh state matches them.
trigger: Activate Reset to Defaults at /wp-admin/admin.php?page=international-press-zone#/settings and confirm.
fixtures: [authenticated-admin, nondefault-settings-snapshot]
success_state:
  visible: "Settings reset to defaults" renders and controls show defaults.
  durable: Supported ipz_* WordPress options equal controller defaults.
  persistence: Fresh GET /wp-json/international-press-zone/v1/settings returns defaults.
source_specs: [admin/src/pages/settings.js, includes/API/SettingsController.php]
readiness: draft
canonical: false
blockers: []
```

## Path

| Hop | Evidence |
|---|---|
| UI trigger | `admin/src/pages/settings.js:803` |
| Request construction | `admin/src/pages/settings.js:830` |
| Endpoint auth and parse | `includes/API/SettingsController.php:122` |
| Authoritative write | `includes/API/SettingsController.php:510` |
| Response | `includes/API/SettingsController.php:524` |
| Terminal render | `admin/src/pages/settings.js:834` |

## Happy path

### H1
- Setup: Administrator authenticated; at least one supported option differs from default; snapshot recorded for cleanup.
- Action: Activate `Reset to Defaults` and confirm destructive dialog.
- Request: `POST /wp-json/international-press-zone/v1/settings/reset`.
- Response: `200` with `{success:true,data:<default-settings>,message:"Settings reset to defaults successfully"}`.
- Visible: `Settings reset to defaults` renders; controls rerender with returned defaults.
- Durable: Every resettable `ipz_*` option equals controller default.
- Fresh read: `GET /wp-json/international-press-zone/v1/settings` returns `200` with exact default values.
- Forbidden: License, language, content, translation, and API-key state outside reset map remain unchanged.
- Evidence:
  - Setup: `includes/API/SettingsController.php:487`
  - Action: `admin/src/pages/settings.js:803`
  - Request: `admin/src/pages/settings.js:830`
  - Response: `includes/API/SettingsController.php:524`
  - Visible: `admin/src/pages/settings.js:834`
  - Durable: `includes/API/SettingsController.php:510`
  - Fresh read: `includes/API/SettingsController.php:158`
  - Forbidden: `includes/API/SettingsController.php:487`

## Alternate and failure paths

### A1
- Setup: Administrator authenticated; settings already equal defaults.
- Action: Activate `Reset to Defaults` twice, confirming each time.
- Request: `POST /wp-json/international-press-zone/v1/settings/reset`.
- Response: `200` with `{success:true,data:<default-settings>,message:"Settings reset to defaults successfully"}`.
- Visible: `Settings reset to defaults` renders after each request; controls remain at defaults.
- Durable: Default option projection after second request exactly equals projection after first.
- Fresh read: `GET /wp-json/international-press-zone/v1/settings` returns `200` with one canonical default projection.
- Forbidden: Duplicate reset creates no extra rows or secondary effects.
- Evidence:
  - Setup: `includes/API/SettingsController.php:487`
  - Action: `admin/src/pages/settings.js:803`
  - Request: `admin/src/pages/settings.js:830`
  - Response: `includes/API/SettingsController.php:524`
  - Visible: `admin/src/pages/settings.js:834`
  - Durable: `includes/API/SettingsController.php:510`
  - Fresh read: `includes/API/SettingsController.php:158`
  - Forbidden: `includes/API/SettingsController.php:510`

## Permissions and boundaries

### P1
- Setup: Actor lacks `manage_options`.
- Action: Submit confirmed reset request.
- Request: `POST /wp-json/international-press-zone/v1/settings/reset`.
- Response: `403` with `{code:"rest_forbidden",message:"You do not have permission to manage settings.",data:{status:403}}`.
- Visible: REST denial exposes no settings or secrets.
- Durable: All plugin options remain unchanged.
- Fresh read: Protected settings GET returns the same `403` denial.
- Forbidden: No option changes; API key value is not disclosed.
- Evidence:
  - Setup: `includes/API/SettingsController.php:580`
  - Action: `includes/API/SettingsController.php:128`
  - Request: `includes/API/SettingsController.php:122`
  - Response: `includes/API/SettingsController.php:581`
  - Visible: `includes/API/SettingsController.php:581`
  - Durable: `includes/API/SettingsController.php:580`
  - Fresh read: `includes/API/SettingsController.php:66`
  - Forbidden: `includes/API/SettingsController.php:580`

## Source specs

- `admin/src/pages/settings.js`
- `includes/API/SettingsController.php`