# Task #83 — Site Content context language validation

## Outcome
Fail closed when Site Content request contexts receive a language that is not already lowercase and syntactically valid, while preserving valid lowercase language behavior. This is dormant library-only work; no runtime wiring or activation is included.

## Status
ACTIVE — the canonical language grammar correction and independent security review are complete. Publication through the repository delivery controller is executing. This remains dormant library-only work with no runtime wiring or activation.

## Source request
Recover and complete Task #83. Preserve valid lowercase behavior. Reject malformed, transformed, uppercase, empty, whitespace, and punctuation language inputs according to the established constructor contract. Do not add runtime wiring.

## Acceptance criteria
- `SiteContentRequestContext` accepts only the already-published canonical Site Content language contract: maximum 10 characters matching `^[a-z]{2,3}(?:-[a-z0-9]{2,6})?$`.
- Uppercase, transformed, empty, whitespace, punctuation, and malformed language input produces a context that does not permit an overlay.
- Existing valid lowercase classifications and explicit public frontend contexts retain their behavior.
- Focused PHPUnit tests, uncached candidate-aware PHPCS, PHPStan, diff check, and dormancy search pass without warnings.
- Only the declared Task #83 paths are committed.

## Preserved WIP
No Task #83 changes were present in the owned paths at recovery. Existing unrelated worktree changes remain untouched.

## Constraints
- Owned paths only: request-context implementation, its focused unit tests/fixtures, this plan, plugin plan index, and root plan index.
- No runtime wiring, external services, WordPress contact, delegation, skills, or external models.
- Blocker investigation limit: one focused inspection of the relevant command/configuration per failed required gate; a shared hook failure after focused gates is an external blocker and must stop the task with its exact output.

## Execution steps
1. Register this durable plan and inspect the established request-context constructor and focused tests.
2. Enforce strict language acceptance without changing valid lowercase behavior.
3. Add focused test coverage for rejected inputs and preserved valid inputs.
4. Run required focused validation gates and investigate any warning or failure within the stated limit.
5. Update this receipt, inspect the hook contract, and commit only owned paths from this worktree if all gates are clean.

## Current receipt
Request contexts now enforce the already-published repository canonical language contract exactly: maximum length 10 and `^[a-z]{2,3}(?:-[a-z0-9]{2,6})?$`. Focused coverage verifies underscores, numeric-only input, malformed and leading/trailing hyphens, overlong values, valid two- and three-letter codes, bounded hyphen variants, and consistent fail-closed behavior in both `public_frontend()` and `from_language_context()` for values unchanged by the upstream language-context sanitizer. Direct uncached focused WPCS and candidate-aware baselined PHPCS are clean. Syntax is clean for the implementation, focused test, and fixture. Focused uncached PHPUnit passed: 40 tests, 139 assertions. Targeted PHPStan passed with no errors. `git diff --check` is clean. Dormancy search found the context only in its declaration and focused test. No runtime wiring was added. Independent security review approved commit `48db814a6e9178151d7c30b53081e76f5a340d65`: the grammar and maximum match the repository contract; malformed forms fail closed; valid canonical forms remain compatible; no cache-key, exception, classification, activation, or security blocker remains.

## Next executable action

Publish the amended candidate through the repository delivery controller, verify reachability from `origin/master`, and record the publication receipt.