```yaml
id: UJ-004
title: Set the default language
actors: [administrator]
surface: admin-spa
goal: Administrator selects one active language as sole default and fresh state preserves it.
trigger: Activate Set Default for an active language at /wp-admin/admin.php?page=international-press-zone#/languages and confirm.
fixtures: [authenticated-admin, active-nondefault-language]
success_state:
  visible: "Default language updated" renders and Default badge moves.
  durable: Exactly one wp_ipz_languages row has is_default=1 and it is target.
  persistence: Fresh GET /wp-json/international-press-zone/v1/languages returns target as sole default.
source_specs: [admin/src/pages/languages.js, includes/API/LanguagesRestController.php, includes/Core/LanguageManager.php]
readiness: draft
canonical: false
blockers: []
```

## Path

| Hop | Evidence |
|---|---|
| UI trigger | `admin/src/pages/languages.js:211` |
| Request construction | `admin/src/pages/languages.js:720` |
| Endpoint auth and parse | `includes/API/LanguagesRestController.php:274` |
| Authoritative write | `includes/Core/LanguageManager.php:773` |
| Response | `includes/API/LanguagesRestController.php:653` |
| Terminal render | `admin/src/pages/languages.js:722` |

## Happy path

### H1
- Setup: Administrator authenticated; active non-default target and a different current default exist.
- Action: Activate target `Set Default` and confirm.
- Request: `POST /wp-json/international-press-zone/v1/languages/{code}/set-default`.
- Response: `200` with `{success:true,message:"Default language updated successfully."}`.
- Visible: `Default language updated` renders; target row gains `Default`; prior row loses it.
- Durable: Target row has `is_default=1`; all other `wp_ipz_languages` rows have `is_default=0`.
- Fresh read: `GET /wp-json/international-press-zone/v1/languages` returns `200` with target as sole default.
- Forbidden: No language is deleted or deactivated; no translation row changes.
- Evidence:
  - Setup: `includes/Core/LanguageManager.php:755`
  - Action: `admin/src/pages/languages.js:211`
  - Request: `admin/src/pages/languages.js:720`
  - Response: `includes/API/LanguagesRestController.php:653`
  - Visible: `admin/src/pages/languages.js:722`
  - Durable: `includes/Core/LanguageManager.php:773`
  - Fresh read: `admin/src/pages/languages.js:85`
  - Forbidden: `includes/Core/LanguageManager.php:773`

## Alternate and failure paths

### A1
- Setup: Administrator authenticated; target language is inactive.
- Action: Submit set-default request for inactive target.
- Request: `POST /wp-json/international-press-zone/v1/languages/{code}/set-default`.
- Response: `500` with `{code:"set_default_failed",message:"Cannot set inactive language as default. Activate it first.",data:{status:500}}`.
- Visible: Inactive-language error renders; Default badge remains unchanged.
- Durable: Existing default remains sole `is_default=1` row.
- Fresh read: `GET /wp-json/international-press-zone/v1/languages` returns `200` with original default.
- Forbidden: No default or active flag changes.
- Evidence:
  - Setup: `includes/Core/LanguageManager.php:760`
  - Action: `admin/src/pages/languages.js:211`
  - Request: `admin/src/pages/languages.js:720`
  - Response: `includes/API/LanguagesRestController.php:658`
  - Visible: `admin/src/pages/languages.js:725`
  - Durable: `includes/Core/LanguageManager.php:760`
  - Fresh read: `admin/src/pages/languages.js:85`
  - Forbidden: `includes/Core/LanguageManager.php:760`

## Permissions and boundaries

### P1
- Setup: No authenticated WordPress session.
- Action: Submit set-default request.
- Request: `POST /wp-json/international-press-zone/v1/languages/{code}/set-default`.
- Response: `401` with `{code:"rest_forbidden",message:"Sorry, you are not allowed to do that.",data:{status:401}}`.
- Visible: REST denial exposes no language data.
- Durable: Default flags remain unchanged.
- Fresh read: Anonymous mutation retry returns the same `401` denial.
- Forbidden: No default flag changes; no administrator nonce is disclosed.
- Evidence:
  - Setup: `includes/API/LanguagesRestController.php:736`
  - Action: `includes/API/LanguagesRestController.php:279`
  - Request: `includes/API/LanguagesRestController.php:274`
  - Response: `includes/API/LanguagesRestController.php:736`
  - Visible: `includes/API/LanguagesRestController.php:736`
  - Durable: `includes/API/LanguagesRestController.php:736`
  - Fresh read: `includes/API/LanguagesRestController.php:736`
  - Forbidden: `includes/API/LanguagesRestController.php:736`

## Source specs

- `admin/src/pages/languages.js`
- `includes/API/LanguagesRestController.php`
- `includes/Core/LanguageManager.php`