WRDP

5 min read

Post-W10 Execution and Verification

Historical record — 2026-08-16

Preserved as observed. Current truth: Program Masterplan.

Release boundary: releaseEligible: false. These are bench-local installed-source changes and observations. They are not a canonical patch, locked build, signed package, or authorization to ship.

Result

  • status: pass on the WRDP bench
  • handoff boundary: frozen before this work in W10 Canonical-Handoff Evidence Packet
  • installed-byte integrity:
    • historical W10 manifest preserved unchanged
    • final 11-path installed manifest verifies
    • expected post-freeze drift: 7 unchanged, 4 approved overlaps; exact hashes in evidence/2026-08-16-w10-handoff/post-w10-drift.json
  • executable contracts:
    • ./scripts/quizwizz-probe.sh --wave 5: portability 12/12; user surfaces 7/7
    • ./scripts/quizwizz-probe.sh --wave all: TAP 1..32; assertions 32; failures 0
  • runtime:
    • plugin: active, version 1.10.0
    • debug log: 38,411 → 38,411 lines
    • final anonymous Library smoke: two libraries; 12 + 6 visible cards; 390/390 document width; no console or page errors
  • evidence authority: evidence/2026-08-16-post-w10/verify.json

Installed-source scope

Portability and user surfaces

  • Wave 5 extends the standing probe harness with exact portability REST/job contracts and owner-scoped quiz unpublish/delete contracts.
  • The completed all-wave run proves the temporary jobs, files, chunks, schedules, posts, and option mutations are removed.

Settings trust

  • paths:
    • assets/js/qwizz-admin-settings.js
    • assets/css/qwizz-admin-settings-layout.css
    • assets/css/qwizz-admin-settings-workspace.css
    • includes/Admin/SettingsPage.php
    • includes/Admin/views/settings-page.php
  • contracts:
    • one active section destination with explicit-jump suppression
    • truthful dirty, saving, saved, error, conflict, and unload states
    • category hierarchy and Surprise-me policy match the source settings contract
    • sound-off start payload clamps the final cue without erasing the stored choice
    • mobile save-state clipping applies only to the quiet saved state; error and conflict copy remains visible
  • browser evidence: evidence/2026-08-16-settings/verify.json

Authoring and retrieval

  • paths:
    • assets/js/qwizz-admin-editor.js
    • assets/css/qwizz-admin-editor.css
    • includes/Admin/MetaBoxes.php
    • includes/Admin/ListTables.php
    • includes/Admin/views/quiz-question-row.php
    • includes/Admin/views/quiz-editor.php
    • includes/Admin/views/question-choice-row.php
    • assets/css/qwizz-tokens.css
    • assets/css/qwizz-admin-shell.css
    • assets/css/qwizz-admin-subjects.css
  • contracts:
    • roving question-row action toolbar and reversible removal with live Undo
    • teachable zero-question state and keyboard addition
    • correct-choice movement preserves the selected radio through reindexing
    • native invalid submission focuses the first invalid input, select, or textarea, never an invalid fieldset
    • server semantic errors map to actionable fields; live qw_duplicate_choices focused the second normalized duplicate (#qw_choice_2), and qw_invalid_explanation focused #qw_explanation
    • quiz and question list tables share a retained Subject filter
    • status text contrast and owned-control mobile targets meet the measured thresholds
  • browser evidence: evidence/2026-08-16-authoring-retrieval/verify.json

Access and continuity

  • paths:
    • assets/js/qwizz-player.js
    • assets/js/qwizz-block-editor-enhance.js
    • includes/QuizAccess.php
    • includes/Frontend/QuizEmbed.php
    • includes/Frontend/QuizQueryViewer.php
    • includes/AttemptService.php
    • includes/Rest/QuizController.php
    • templates/single-qw_quiz.php
  • contracts:
    • active attempts resume from the authoritative server snapshot without creating a second row
    • an identical answer retry is idempotent; a different answer remains 409 qw_already_answered
    • the client retries one transport failure with no HTTP status
    • a Library play route for a published password quiz redirects to the dedicated permalink and native WordPress password form
    • a draft/private password value does not expose a dead password-required call to action
    • block-canvas quiz selection persists without starting an attempt
  • exact Gate 13 evidence:
    • fixture quiz: ID 77, exactly 10 questions
    • reload after three accepted answers: Resume question 4 of 10; resume at Question 4 of 10; same token; attempt rows 9 → 10, not 11
    • accepted-response loss: the first answer response reached status 200 and was aborted at the CDP response stage; the automatic retry produced a second answer response and advanced to Frage 2 von 10; no already-answered message or protocol error
    • cleanup restored quiz 77 to 9 attempt rows
  • browser and contract evidence: evidence/2026-08-16-access-continuity/verify.json

Dedicated resume localization

The resume controls do not infer semantics from unrelated translated strings.

  • keys:
    • resumeQuestion: Resume question %1$d of %2$d
    • startOver: Start over
  • German:
    • Mit Frage %1$d von %2$d fortfahren
    • Neu beginnen
  • client formatting: wp.i18n.sprintf
  • live browser:
    • German: Mit Frage 2 von 10 fortfahren; Neu beginnen
    • forced English: Resume question 2 of 10; Start over
    • interface choice restored to auto
  • catalogs:
    • human-readable PO and POT updated
    • canonical hashed player JSON and handle-named player JSON updated
    • MO regenerated with WP-CLI 2.12.0
    • independent MO rebuild SHA-256: edef894ed874e8e25af7ba3974bc28d2a53bf70f4a62f520bb17dfd1fafe2db8
    • installed and independent rebuild bytes: identical
  • authorization remainder: reproducibility is proved; the catalog and every other bench-local change still require canonical-owner review and locked-pipeline regeneration before release.

Reviewer remediation

The independent source review reported no blocker or high-severity issue and five medium issues. All five were repaired and browser-checked:

  1. mobile error/conflict save text remains visible
  2. invalid focus targets the offending form control
  3. resume and start-over controls use dedicated localization keys
  4. protected Library play reaches the native password form
  5. password-required detection rejects unpublished posts

The duplicate-choice route is server-authoritative rather than a parallel JavaScript normalizer: QuestionValidator records the rejected choice index, QuestionService preserves it while adding the HTTP status, and the editor focuses that indexed control. A live case-fold parity postback with Straße / STRASSE returned qw_duplicate_choices, carried index 2, and focused #qw_choice_2.

The focused installed-source re-review returned PASS with no remaining blocker, high, or medium finding. Its two cosmetic P3 observations were also removed: dead conflict-state selectors no longer duplicate active error rules, and invalid-correct focus explicitly prefers the checked radio.

Cleanup and retained fixtures

  • removed:
    • temporary verification users 401, 408, 415
    • temporary password fixtures 1352, 1353
    • temporary validation fixtures 1370, 1386
    • exact verification attempt by token hash
    • browser attempt storage for quiz 77
  • restored:
    • qw_exposure_settings.iface_lang=auto
    • quiz 77 attempt count 9
  • retained by design:
    • durable Library contract fixtures 1284–1289
  • untouched protected trees:
    • build/
    • vendor/
    • provenance/

Canonical handoff remainder

No patch was emitted: /home/loca/dev/wrdp has no .git directory or authentic canonical baseline. The release owner must port reviewed source changes from an authenticated immutable commit, regenerate translation and compiled artifacts through the locked toolchain, execute canonical PHP/JS/compatibility gates, and produce authorized provenance and signing evidence. The bench result must not be relabeled release-ready.