# Dormant persisted Site Content attempt authority

Audience: AI coding agents first.

- **Plan ID:** `IPZ-SITE-CONTENT-ATTEMPT-AUTHORITY-2026-08-14`
- **Task:** `#87 / SC-ATTEMPT-01`
- **Status:** IDLE
- **Outcome:** Add dormant, persisted, compare-and-swap attempt authority to Site Content translations without activating any runtime path.
- **Source request:** Implement and verify Task #87 against current `origin/master`, preserving Task #84 draft work and the published Task #85 contract.
- **Preserved WIP/ref/path:** Preserve the Task #84 draft worktree at `plugins/international-press-zone` worktree `ipz-site-content-resource-handler`; do not modify, reset, delete, or depend on its unpublished contents. This implementation runs only in `/home/user/Projects/Press.zone/wordpress/wp-content/.claude/worktrees/agent-ac155838501e87524`, based on current `origin/master` containing `1610bbf0406850a65f0b37fb96028b5b42d0ad96`.
- **Allowed paths:**
  - `plugins/international-press-zone/includes/Core/Database.php`
  - `plugins/international-press-zone/includes/Migrations/Migration009SiteContentAttemptAuthority.php`
  - `plugins/international-press-zone/includes/SiteContent/class-sitecontentrepository.php`
  - `plugins/international-press-zone/tests/Unit/SiteContent/SiteContentStorageSchemaTest.php`
  - `plugins/international-press-zone/tests/Unit/SiteContent/SiteContentRepositoryTest.php`
  - `plugins/international-press-zone/tests/Fixtures/SiteContentRepository/class-sitecontentrepositorywpdbstub.php` only if deterministic sequencing requires it
  - this plan and both plan indexes
- **Acceptance criteria:**
  1. Expand-only database version `1.2.5`, nullable `attempt_hash CHAR(64) DEFAULT NULL` after `translation_revision`, schema verification, and no index, data removal, or schema removal.
  2. Migration `Migration009SiteContentAttemptAuthority` version `20260814000000` uses canonical table creation and both schema verifiers before recording application; rollback removes only its applied marker.
  3. `begin_attempt()` validates a lowercase 64-hex token before SQL, stores only its SHA-256 hash, performs one exact eligible-state compare-and-swap, and returns the exact incremented revision.
  4. `save_review()` requires an attempt token before segments and completes only the exact translating revision/source/hash authority in one atomic update.
  5. `mark_failed()` uses the same authority predicates, bounded error storage, clears authority, and increments revision atomically.
  6. Stored attempt hashes validate as null or exact lowercase 64-hex. Creation and every specified invalidation path clear authority; deactivation of translating state becomes inactive missing and reactivation cannot restore authority.
  7. Plaintext tokens never appear in SQL values, rows, errors, logs, plans, or tests. No unsafe compatibility wrapper or published production consumer remains.
  8. The implementation remains dormant: no handler, dispatcher, callback, route, hook, job, UI, feature activation, live post behavior, or WordPress request.
  9. Failure-first coverage proves schema/no-index, begin/completion/failure predicates, stale and malformed inputs, replacement callbacks, retry after failure, and all invalidation paths while preserving existing tests.
  10. All requested focused PHPUnit, syntax, PHPCS, baseline, PHPStan, diff, and dormant-consumer checks pass cleanly.
- **Constraints:** Surgical changes only in allowed paths; expand-only migration; no config, baseline, tooling, dependency, DTO, adapter, handler, bootstrap, or unrelated edits; no external model or application/WordPress network access; no commit or publication.
- **Dormancy:** Persistence and repository methods have no production caller or registration and must remain unreachable from live request handling.
- **Rollback:** Revert the allowed source/test changes. Migration rollback may remove only migration application metadata; it must retain the column and all data.
- **Blocker limit:** Stop after one complete implementation/review cycle or 45 minutes, whichever comes first, and record the exact blocker and remaining action.
- **Execution steps:** Add plan registry entries; inspect current schema/repository/migration/test patterns and production consumers; add failure-first tests; implement schema, migration, and repository authority; run every requested gate; review the bounded diff; update this receipt.
- **Current receipt:** ACTIVE finalization after independent security APPROVED and independent correctness APPROVED following both UTF-8 repairs. Repository PHPUnit passes `16 tests, 93 assertions`; storage-schema PHPUnit passes `5 tests, 5 assertions`; resource-contract PHPUnit passes `20 tests, 59 assertions`; syntax is clean on all five changed PHP files; direct PHPCS is clean on every clean/new changed file; legacy `Database.php` still reports the same `377 errors and 14 warnings` present on `origin/master`; candidate-aware PHPCS passes every changed PHP file and proves Task #87 adds no coding-standard violation; focused PHPStan is clean on all three production files; and `git diff --check` is clean. Whole-file `Database.php` normalization is intentionally excluded because those violations are pre-existing unrelated debt, normalization would breach the frozen surgical scope, and the candidate-aware gate proves this task introduces none. The implementation remains dormant with no handler, dispatcher, callback, route, hook, job, UI, feature activation, live WordPress request, production consumer, or registration. No WordPress or application network target was contacted.
- **Next executable action:** Controller immediately publishes the verified local implementation commit; no further implementation action remains in this worktree.