Commits
Review on two axes: five real findings and dead code out
A review with two parallel reviewers, repo standards and spec, of all the November 3rd work. Five real findings, including a WordPress detail no test could catch; I also removed columns nobody read and closed the open issues with evidence.
Yesterday left me an intense day of work and today I put it through the sieve: two reviewers in parallel, one with the repo standards and one with the spec. Twelve standards findings and five spec ones came out. I will tell the ones that really matter.
The detail no test caught
The return of Core_Upgrader::upgrade() gave me the surprise of the day: WordPress returns the new version as a string, not as an array. Yesterday's fix read isset( $result->version ), which was always false, and the panel received the version from before the update: exactly what I wanted to avoid. The harness stub returned an array, so the case came out green in a world that does not exist. Now the stub behaves like real WordPress and the case checks that the reported version is the new one.
The spec gaps
The connector sweep did not skip down sites (the inventory sweep did): a down site burned its 180 seconds of timeout and jammed the sequential queue. And the connector ZIP was only offered on the card in the list, not in each site's workspace.
The bookkeeping ones
The other handful was about coherence. The glossary marks web as the right term and discourages sitio, but the new code used sitio. Date normalization was duplicated in the dashboard and the worker: there is now one helper, site_info.as_utc. In refresh_site() the site parameter had no type. The connector endpoint reimplemented the 404 of get_authorized_site instead of reusing it. The connector state was computed inside a validator that mutated itself: now the router does it, in _site_out. Connector updates left no trace in the audit log. And confirmation was missing before installing code on a client's site, which the repo already requires for plugins and themes.
The refresh button on each card stays as an icon with a tooltip: the visible name was settled in the grill (refresh, with the tooltip refresh this site inventory), and on a card with five actions the text does not fit.
Dead code out
The sites.umami_site_id and sites.kuma_monitor_id columns were written but nobody read them: the live value of integrations lives in site_integrations. Worse: the Umami ID field was editable in site settings and did nothing - the one that counts is the one in the Analytics tab. A field that lies. And the overview_snapshots table had no users.
Before touching anything I checked production: both columns were empty (0 of 9 sites), while the site_integrations ones had data (8 of 9). Out went the model, the schema, the PATCH and the UI. The README documents the optional ALTERs: the repo has no migrations and the ALTER is applied by hand.
Issues closed with evidence
#24, #29 and #32 were still open with the ready-for-agent label, but their work was already done: the connector changelog tells it (1.8.1 added path blocking and the threshold-to-until pattern in one go; 1.8.2, the honest .htaccess), and the October 21st journal has the manual verification of #25 and the worktrees .gitignore. They are closed with that evidence, not with a bare done.