Implementation/package version: 0.4.0-alpha.1. Wire: V4. This is an unpublished development component paired to candidate discussionbridge-v4-core-20261029-r7; release version is null. This pairing has no independent adapter review or installed-native qualification disposition yet. Dated earlier development sections describe their original batches, not current acceptance.
Operators install the ordinary WordPress ZIP. Its private PHP runtime includes the exact shared codec, schema, URL/IDNA dependencies, autoloader and license files; no server-side Composer install or additional PHP extension is needed for that runtime. The adapter's existing PHP 8.1 minimum and JSON, OpenSSL and DOM requirements remain unchanged. src/private/cms-v4/PROVENANCE.json identifies the frozen shared commit and every bundled member. Those facts do not grant native-post ownership or migrate retained publication state.
Maintainers refresh only from the reviewed shared checkout at 09d77c0209835c2d996aad294d161f167c7bd838:
node scripts/refresh-contract.mjs /path/to/reviewed/adapter-contract
npm ci
npm run check
npm run build
npm run test:browser
npm run test:browser:real
node --test tests/browser-build-ownership.test.mjs tests/maintainer-guards.test.mjs
php tests/run.php
php tests/integration.php
php tests/source-url-proof.php
php tests/contract-runtime.php
php -n tests/contract-runtime.php
node --test tests/contract-integrity.test.mjsThe real-browser test uses installed Chrome, or the explicit DISCUSSIONBRIDGE_BROWSER_EXECUTABLE path, in a fresh headless context. It does not use an operator's browser profile. The normal renderer build bundles local fonts and third-party notices. It stages output until actual license sources and managed destinations have passed preflight; an unavailable required license is an error, not a metadata-only permission notice. It removes only obsolete generated notices whose names and bytes still match the previous generated ledger; modified or unrecognized files are not swept away. File/directory link tests run on Linux CI; Windows reports explicit file-link privilege skips where necessary.
Build and check the normal ZIP with PowerShell 7. Use a new output name for each build; the builder refuses to overwrite an existing artifact:
$package = ./scripts/build-release.ps1 -OutputName 'wordpress-v4-candidate.zip' | ConvertFrom-Json
./scripts/verify-release.ps1 -Path $package.path
./scripts/test-package.ps1 -Path $package.path -PhpBinary /path/to/phpVerification checks every packaged byte against its source ledger, the complete private dependency closure, browser inputs/outputs and notices. The extracted-package check runs the actual shipped runtime with optional PHP extensions disabled. CI separately checks PHP 8.1/8.3/8.5, Node 22/24, renderer freshness, and identical ZIP bytes from two clean checkouts. These are package and fixture checks, not evidence of an installed WordPress/MySQL/cron workflow.
The forum owns explicit individual/selected-bulk attention checks and retry authorization. The adapter probes attention-recovery-1 before using V4-32–36. Check uses actual owned post/meta/taxonomy revision, complete native resource/topic census, private create/receipt/fence evidence and selected native metadata availability under the shared writer. It never invokes native apply/save/render hooks, repairs content or releases attention. Dynamic Check omits optional public proof; normal new-lease synchronization still performs its required anonymous public verification. Missing/foreign/uncertain native evidence stays blocked. A positively known committed create before a lost receiver acknowledgement retains that exact private native ID; a resource tag alone does not authorize adoption.
Diagnostic reports have their own exact durable pending request, separate from publication pending state. Bounded inspection/recovery pages are retained before cursors advance. Positive successor events are consumed even with unchanged source revision/empty source feed. Old attention jobs and history remain protected; fresh jobs target the exact recovery Work/cycle with V4-36, fresh lease and increasing fence. An empty targeted claim retains/observes nonterminal known Work instead of assuming it disappeared. Publication retries do not transplant old success/lease/count state. Exactly known r5 From journal descriptors migrate with artifact history and unchanged pending bytes; unknown descriptors stay reconciliation-only. Existing To02, To29, preservation behavior and WordPress discussion-mode override are unchanged.
Local polling is separate from receiver Work attention. Transient read/transport failures continue after60/120/300seconds (300capped), with one deduplicated continuation, current scope/epoch, last attempt/success/next due and truthful local/overdue status. Healthy idle remains300seconds; active continuation60seconds. Native settings provide nonce/capability protected Retry synchronization, which only coalesces a local wake. It cannot reset Work attempts, clear protected jobs/history/local limitations or release an attention/cancelled-intent hold. WP-Cron still requires an actual invocation; no host cron, external service or deployment is installed by this change.
Earlier execution counts and statements that attention mechanisms are unimplemented below are historical. Current batch evidence and exact local-runtime limits are in planning/v4-attention-recovery-fixes-20261025/WORDPRESS_REPORT.md; installed WordPress/MySQL/cron/browser qualification remains separate.
The current To receiver can return the strictly typed six-field content_preservation_unavailable Error for unavailable rendered-article evidence or actual content/function/data loss. This is HTTP422, permanent, with no automatic retry. It describes a Bridge limitation. The publisher seals the exact response, route/status, request identity and SDK provenance inside the existing pending journal before its terminal marker. Later native save hooks, restart and the existing manual queue cannot retransmit that rejected request. Its complete capture, accepted predecessor and history remain intact. A genuinely changed current native snapshot may enter the ordinary source path: an established binding requires scoped current Record04 equality to the known accepted predecessor before CAS; a new unbound source repeats its actual inventory/collision checks. The rejected tree and capture remain unchanged in rejection history. Identical input after receiver-only repair has no declared readiness action; a timer, version change or status read is not permission to resend it. Malformed responses and uncertain transport retain the existing exact-request recovery distinction. If response storage itself fails, the failure is reported and no automatic retry is scheduled; durable knowledge of the lost response is not claimed. Artifact-mismatched old journals remain reconciliation-only and are never silently retagged.
This new response is confined to To02/29. It is not a From Failure or Work attention code. The actual WordPress source-URL/public-proof operation remains a plan; this change implements no29 caller.
The current development plugin wires one typed SDK to native To/From delivery, catalog uploads, source hooks and presentation. Its private pair is pinned in src/private/cms-v4/PROVENANCE.json. It has no earlier Bridge transport selector, initialization/adoption path or alternate active schema. Remaining native proof and local issue recovery limits below prevent a complete qualification claim.
NativeWriter shares one site-scoped MySQL named lock. NativeLock binds the original WordPress database object and physical connection identity. Reconnection loses authority; it never proves a commit or rollback. ProtectedJournal encrypts native state with authenticated context and checks persisted bytes under that writer.
NativeContent preserves the existing block-rendering then native post-KSES order. NativeSourceSnapshot captures the original article and its native source article URL together before preparation, then checks the persisted row and URL again. Native originals stay intact. WordPress's HTML Tag Processor and bundled Requests IRI resolver preserve copied relative link/media targets against that captured URL, including supported srcset URL tokens. Complete To byte count/hash cover the entire prepared article before excerpt selection. Plain text and image-only content qualify without a prose/markup eligibility judgment. These are internal observations; exact SDK types govern wire records. The prefix helper does not define a transport cap, generated marker or Read More policy.
New protected pending/accepted/current/history captures retain the original article, captured article URL and native row proof. Existing requests and historical bodies are never retrofitted. The existing content-derived source revision includes complete prepared SHA/count independently of actual nullable source dates: a truthful newly prepared published snapshot can use the normal accepted-predecessor CAS without inventing a native edit/date/UUID. A candidate/config/marker-only change with identical complete snapshot cannot manufacture an edition. Changed pending sources remain query-only. Canonical-only moves retain accepted article bytes/targets and the existing owned Read More boundary; current native source-move guards and missing actual public proof remain in force.
Relative CSS references/escaped CSS, rewritten multi-URL native attributes, nested base/srcdoc, backslash references and incomplete native HTML tokens have specific current preparation limits. They retain a private issue before mutation rather than silently change targets or classify a content type as invalid. This does not select a URI/provider/execution policy, replacement renderer, fallback or true-absence algorithm. Registered custom URL attributes still depend on the existing native URI-attribute integration. The exact native APIs and test-only source identities/licenses are recorded in tests/fixtures/native-wordpress-6.6/README.md and its manifest.
NativeDeletion uses the supported pre_delete_post veto before WordPress removes metadata. An owned source requires an exclusive held writer and durable capture. Actual native completion is separate from capture and from uncertain protected confirmation. SQL failure, connection loss or failed confirmation retains reconciliation state; it does not authorize recreating a native post. V4 source withdrawal callbacks retain the accepted revision and exact mutation before deletion, and dispatch only after the actual completion event. Unrelated posts and earlier native filter overrides pass through.
To withdrawal uses the existing native lifecycle: transition_post_status captures published-to-nonpublished; wp_after_insert_post captures a saved source that loses configured post-type eligibility; the protected existing per-post checkbox1→0 captures policy_excluded. The accepted resource/revision and exact V4-05 mutation are retained before HTTP. Current To connection/direction/lane/origin/ownership checks apply; the separate From publication Policy does not enable or disable To02/05. No automatic resolve/resume follows withdrawal.
Every To journal is registered durably before writing its protected tree. Existing native init performs one positive sealed-option discovery and one indexed native observation under the same site writer, then uses the existing delivery scheduling path. Confirmed captured withdrawals remain discoverable after native deletion, missing Cron scheduling or restart. Current persisted native row/post/meta observations recover failed post-change unpublish/ineligible captures. The existing protected checkbox records a signed local owner fact before removing enable metadata, so recovery never infers deliberate opt-out from missing metadata alone. Recovery observes positively known journals, never absence from a partial scan; direct SQL/external disappearance without a captured native delete leaves reconciliation, not fabricated source_deleted. Scope/configuration changes require reconciliation. Progress depends on normal native init/Cron execution; no new polling cadence or publication engine is introduced.
If accepted editionA has an uncertain pending publicationB when native closure occurs, current scoped Record04(A) and the actual closure permit a separate exact05(A) journal. The original pending02(B), full capture and history remain untouched and unreplayed. Record04(B) cannot promote B; CAS conflict retains reconciliation. Unknown binding creation without acceptedA remains deletion-vetoed. A later confirmed native deletion supplies its own closure fact without changing an already frozen05 request. Native API bypass cannot provide a pre-delete capture, and unrelated plugin side effects/physical concurrency remain installed qualification limits.
Run php tests/run.php and php tests/integration.php. Latest executions: 12 foundation cases and 65 V4 integration cases, no failures, on task-local PHP8.3.12 with the exact r3 pair. Five unchanged Node VM renderer cases retain their prior result; no new browser execution is claimed. These model native API order, transactions, connection failures and HTTP responses, with real PHP/DOM processing and hash-pinned unmodified WordPress6.6 HTML/IRI API source fixtures. KSES/native escaping/storage/HTTP remain modeled. The selected source-time query fixture requires SQLite3 for isolated SQL execution and supplies only MySQL's date primitive through a compatibility function; it does not qualify the installed MySQL/WP_Query path. Native block/shortcode/modes/comments/enqueue behavior has focused PHP coverage. Installed WordPress/MySQL engines, editor/REST contention, browser/public rendering, interactive playback and live provider support remain unrun.
Source/media preservation is approved. Exact sanitizer/provider/URI/nonblank/rich-default choices remain under discussion. Stock native post-KSES can remove iframe and multi-source elements; block rendering alone does not run the complete frontend oEmbed/content-filter pipeline. An actual removed media element during To preparation now leaves a protected local issue and the original native source intact, with no resolve mutation. A faithful native preparation clears that specific issue; this does not grant a new provider allowlist or claim every URI/attribute/provider is preserved. Existing math/Mermaid source, bundle, local fonts/notices and source-preserving render failure behavior are carried. The previous preserve setting remains existing behavior pending the explicit default decision.
Approved active function uses an existing supported native component/embed where possible. Specific parsed loss of classic/module script constructs or known native event handlers now leaves the existing private local issue before To dispatch; a final owned From body veto includes the same specific loss observation before SQL. Escaped displayed code, comments and non-executable data script types are not classified as executable-function loss. Actual removal of nonempty inert script data, including alongside retained prose, instead reports specific DATA loss with its parsed type/count/bytes/hash through the same local limitation. It is never silently accepted as an equivalent copy or converted to a code block by inference. A nonempty native rendering removed entirely during preparation is a Bridge limitation, not invalid source. Native details/summary and retained media/math/Mermaid rendering continue through current supported paths. This detector does not prove every interaction/dependency/provider works. Where function cannot be preserved, the operator must decide how to proceed; intact originals alone do not make a broken copy equivalent. No new execution permission/ban, allowlist, UI, fallback or receiver Failure is introduced.
From writes require the actual same MySQL connection, named writer lock, savepoint witness and InnoDB post/meta/options/term tables. Owned editor/REST saves use a captured protected revision token; unversioned direct native post updates fail safely. Connection loss or unknown create retains reconciliation evidence; no second create or assumed rollback. Cache is invalidated after rollback/uncertainty. Unrelated plugin side effects are not proven transactional.
From normally retains and verifies the entire immutable cooked Source byte count/SHA/UTF8 before native conversion. Its retained Source.topic_url is fixed to that revision and supplies the copied article base; a later current/canonical/destination URL is never substituted. The private job retains the exact Source plus prepared native article/body bytes and separate hashes before the same leased native write. Source integrity evidence remains unchanged. Synchronized native save is separate from anonymous canonical rendered-fragment verification and its actual observation time/hash. A source marker or delivery timestamp is insufficient. Scoped owned create/update preparation compares the complete prepared body at wp_insert_post_data before native SQL; a mismatch vetoes that write and retains an encrypted private issue, complete source, exact Work/action/revision/policy/cycle/lease and prior native receipts. Actual rollback uncertainty remains uncertainty. No receiver Failure or attention is fabricated.
Known local limitations remain waiting observations, separate from runnable jobs and the generic error ceiling. Each invocation stages the current source feed and observes one known Work/current mapping/native receipt, without replaying arbitrary native callbacks or resetting attempt/cycle/time. Claims name positively identified unrelated mappings only. A genuine new source intent can supersede the refused Work; actual supersession/cancellation or owned withdrawal is reconciled through receiver status. There is no global or permanent mapping exclusion. The current claim route cannot select/exclude an exact Work/action/revision/cycle within one mapping; unobserved same-mapping work cannot be guessed. Faithful repair proof remains unresolved where final hooks depend on a new native ID, external effects or cannot be reproduced safely without a write. No trial claim/write is a repair test. Actual installed hook ordering, physical storage/concurrency and plugin side effects remain qualification limits; post-save complete-body equality and rollback checks remain in place.
Source URL moves implement protected28/29/30/31 through the existing publisher and writer: prospective complete prepared snapshot, distinct signed To ownership, supported same-post slug operation, actual normal full native article expectation, independent anonymous new-URL verification, exact replay/truthful abort and real URL-commit revision continuity. The component profile and native inputs define the required actual theme integration and remaining installed qualification. Native administrator attention retry/reconciliation, notification and paid support/access mechanisms remain specific implementation boundaries. Native theme duplicate repairs and genuine1000-record/public/database rollback qualification remain installation-specific work.
The clean baseline has no earlier Bridge protocol defaults, selectors, legacy initialization, adoption, dual SDKs or profile transitions. Native WordPress/PHP/Core API versions remain platform dependencies. Upgrades and recovery apply from the new V4 baseline onward.
Protected native backup and restore procedure covers matched files/database/config/key material, sealed journals/index, native schema/identity and receiver reconciliation for1097–1100. It contains target substitutions and command templates; no native backup or restore has been executed. Selected native roots/database/engines/key provider/protected storage/service/cache controls and an isolated restore target are required execution inputs.