<?php
/**
 * Upgrade Verification: after anything about the running site changes, check that the site
 * still works and say so.
 *
 * WHY THIS EXISTS
 * ---------------
 * The critical PHP release of 2026-10-21 14:00 UTC meant an image rebuild on QA, prod and the
 * standby. Nothing here said afterwards whether the rebuilt site was healthy: the activity log
 * records an upgrade, the monitor records a fatal, integrity verifies core files, but no one
 * asked all of them "is the site still up?" at the moment the answer matters. The contract is
 * docs/plan-upgrade-verification.md.
 *
 * WHAT TRIGGERS A RUN
 * -------------------
 * A fingerprint, not just the upgrader hook: deploys here are rsync and compose, which core never
 * sees. The fingerprint is the core version, the web server's PHP version (CSDT_Php_Advisory::
 * runtime(), never PHP_VERSION of the cron process), the active theme and its parent, and every
 * active plugin as file@version, sorted and hashed. A five-minute tick compares it (one option
 * read, no write unless it changed). A change stores the before/after diff and books one run two
 * minutes later, so caches and OPcache settle first. upgrader_process_complete books one too.
 * Only one run is ever pending; a second change while one is pending is merged into it. The first
 * tick on a site stores the fingerprint silently.
 *
 * WHAT A RUN DOES
 * ---------------
 * Eight checks, each pass, warn, fail or skip with a one-line reason and its time: the front page,
 * the login page (its hidden address when Hide Login is on), the REST index, admin-ajax.php, PHP
 * fatals logged since the change, that each changed component reports the version the diff says,
 * core files against WordPress's checksums when core changed and integrity is switched on, and
 * that this plugin's scheduled tasks still run. Loopback requests go through wp_remote_*(), which
 * CSDT_Auto_Block signs as the site's own, carry the plugin's user agent and a marker header, and
 * never touch wp-login.php while it is hidden (a hit there is recorded as a login probe).
 *
 * Report only: nothing here rolls back, deactivates or changes the site. The last 20 runs are kept
 * (autoload off), written by cron or the Verify now button only, never on a front-end request. An
 * alert goes out when a run fails, and on a pass only when the owner asked for that. Never on a
 * standby. Fails open: every check and every callback catches Throwable and logs it.
 *
 * @package CloudScale_Cyber_DevTools
 */

defined( 'ABSPATH' ) || exit;

/**
 * Detects changes to the running site and verifies the site after each one.
 */
class CSDT_Upgrade_Verify {

	/** The five-minute fingerprint tick. On the plugin's own csdt_every_5min interval. */
	const CRON_HOOK = 'csdt_upgrade_verify_tick';

	/** The one pending verification, booked SETTLE_DELAY after a change. */
	const RUN_HOOK = 'csdt_upgrade_verify_run';

	/** '1' detects and verifies. Declared in CSDT_Options::DEFAULTS as '1'. */
	const OPTION_ENABLED = 'csdt_upgrade_verify_enabled';

	/** '1' also alerts on a passing run. Declared '0'. */
	const OPTION_NOTIFY_PASS = 'csdt_upgrade_verify_notify_pass';

	/** {hash, components, at, changed_at, diff}: the last fingerprint seen. */
	const OPTION_FINGERPRINT = 'csdt_upgrade_verify_fingerprint';

	/** {trigger, diff, detected_at}: what the pending run will verify. */
	const OPTION_PENDING = 'csdt_upgrade_verify_pending';

	/** The last MAX_RUNS runs, newest first. Autoload off. */
	const OPTION_RUNS = 'csdt_upgrade_verify_runs';

	/** Seconds between a change being seen and its verification. */
	const SETTLE_DELAY = 2 * MINUTE_IN_SECONDS;

	/** Runs kept. */
	const MAX_RUNS = 20;

	/** Timeout of each loopback request, seconds. */
	const HTTP_TIMEOUT = 15;

	/** A front page slower than this many times its baseline warns. */
	const SLOW_FACTOR = 3;

	/** The baseline is the median of the front page time in this many recent passing runs. */
	const BASELINE_RUNS = 5;

	/** A csdt_ event this late means cron has stopped running them. */
	const CRON_OVERDUE = 30 * MINUTE_IN_SECONDS;

	/** Seconds the core checksum pass may take. */
	const CORE_BUDGET = 20;

	/** Verify now looks for fatals since the last change, but no further back than this. */
	const MANUAL_WINDOW = HOUR_IN_SECONDS;

	/** Marker header on every loopback request, for whoever reads the access log. */
	const PROBE_HEADER = 'X-CSDT-Upgrade-Verify';

	/** The admin-ajax.php action no plugin registers, so core answers 400 "0". */
	const UNKNOWN_ACTION = 'csdt_upgrade_verify_no_such_action';

	/** Core's wp_die() text for a fatal on a served page. */
	const CRITICAL_ERROR = 'There has been a critical error';

	/** Check results. */
	const PASS = 'pass';
	const WARN = 'warn';
	const FAIL = 'fail';
	const SKIP = 'skip';

	/**
	 * Test-only clock. Null in production.
	 *
	 * @var int|null
	 */
	public static $now_override = null;

	/** Current time. */
	private static function now(): int {
		return null !== self::$now_override ? self::$now_override : time();
	}

	/** Whether detection and verification are on. */
	public static function is_enabled(): bool {
		return '1' === (string) CSDT_Options::get( 'csdt_upgrade_verify_enabled' );
	}

	/** Whether a passing run alerts too. */
	public static function notify_pass(): bool {
		return '1' === (string) CSDT_Options::get( 'csdt_upgrade_verify_notify_pass' );
	}

	/** Whether this site is a standby copy, which never verifies or alerts. */
	public static function is_standby(): bool {
		return class_exists( 'CSDT_Site_Role' ) && CSDT_Site_Role::is_standby();
	}

	/** Whether this is a cron or WP-CLI process: the only places a scheduled run may write. */
	private static function in_background(): bool {
		return ( function_exists( 'wp_doing_cron' ) && wp_doing_cron() ) || ( defined( 'WP_CLI' ) && WP_CLI );
	}

	/** Whether this is a visitor's request: not admin, not cron, not WP-CLI. Nothing is written then. */
	private static function is_front_end(): bool {
		return ! ( function_exists( 'is_admin' ) && is_admin() ) && ! self::in_background();
	}

	/**
	 * Keeps the tick scheduled while on (and not a standby), and removes it when off. Called on
	 * every load, but does nothing on a front-end request: the schedule is put right on the next
	 * admin page, cron run or WP-CLI command instead.
	 *
	 * @return void
	 */
	public static function sync_schedule(): void {
		if ( ! function_exists( 'wp_next_scheduled' ) || self::is_front_end() ) {
			return;
		}
		$scheduled = wp_next_scheduled( self::CRON_HOOK );
		if ( self::is_enabled() ) {
			if ( ! $scheduled && ! self::is_standby() ) {
				wp_schedule_event( time() + 60, 'csdt_every_5min', 'csdt_upgrade_verify_tick' );
			}
			return;
		}
		if ( $scheduled ) {
			wp_clear_scheduled_hook( self::CRON_HOOK );
		}
		if ( wp_next_scheduled( self::RUN_HOOK ) ) {
			wp_clear_scheduled_hook( self::RUN_HOOK );
		}
	}

	// ── The fingerprint (pure parts) ───────────────────────────────────

	/**
	 * What the site is running now: key => version. Keys: core, php, php_cli, theme:<slug>, plugin:<file>.
	 *
	 * @return array<string,string>
	 */
	public static function components(): array {
		$c       = array( 'core' => (string) get_bloginfo( 'version' ) );
		$runtime = class_exists( 'CSDT_Php_Advisory' ) ? CSDT_Php_Advisory::runtime() : null;
		$c['php'] = null === $runtime ? '' : (string) $runtime['version'];
		// The PHP running this tick as well. It is not the web server's (that is 'php' above), but
		// an image rebuild changes both, and this one is seen on the next tick rather than only
		// after an administrator next opens an admin page. On a host where they differ it is just
		// a second, stable value.
		$c['php_cli'] = PHP_VERSION;

		$theme = wp_get_theme();
		if ( is_object( $theme ) ) {
			$c[ 'theme:' . $theme->get_stylesheet() ] = (string) $theme->get( 'Version' );
			$parent                                    = $theme->parent();
			if ( is_object( $parent ) ) {
				$c[ 'theme:' . $parent->get_stylesheet() ] = (string) $parent->get( 'Version' );
			}
		}

		if ( ! function_exists( 'get_plugins' ) && is_readable( CSDT_Paths::root_file( 'wp-admin/includes/plugin.php' ) ) ) {
			require_once ABSPATH . 'wp-admin/includes/plugin.php';
		}
		$all = function_exists( 'get_plugins' ) ? (array) get_plugins() : array();
		foreach ( self::active_plugin_files() as $file ) {
			$c[ 'plugin:' . $file ] = (string) ( $all[ $file ]['Version'] ?? '' );
		}
		return $c;
	}

	/**
	 * Active plugin files, network-activated ones included.
	 *
	 * @return array<int,string>
	 */
	private static function active_plugin_files(): array {
		$files = array_map( 'strval', (array) get_option( 'active_plugins', array() ) );
		if ( function_exists( 'is_multisite' ) && is_multisite() ) {
			$files = array_merge( $files, array_map( 'strval', array_keys( (array) get_site_option( 'active_sitewide_plugins', array() ) ) ) );
		}
		$files = array_values( array_unique( array_filter( $files ) ) );
		sort( $files, SORT_STRING );
		return $files;
	}

	/**
	 * sha256 over the sorted "key=version" lines. Order of the input does not matter.
	 *
	 * @param array<string,string> $components components().
	 * @return string
	 */
	public static function fingerprint( array $components ): string {
		ksort( $components, SORT_STRING );
		$lines = array();
		foreach ( $components as $k => $v ) {
			$lines[] = $k . '=' . $v;
		}
		return hash( 'sha256', implode( "\n", $lines ) );
	}

	/**
	 * What changed between two component maps: rows of {key, from, to}, '' meaning absent.
	 *
	 * The web server's PHP version going from unknown to known is not a change: it is the first
	 * admin page load after install recording it.
	 *
	 * @param array<string,string> $old Before.
	 * @param array<string,string> $new After.
	 * @return array<int,array{key:string,from:string,to:string}>
	 */
	public static function diff( array $old, array $new ): array {
		$keys = array_unique( array_merge( array_keys( $old ), array_keys( $new ) ) );
		sort( $keys, SORT_STRING );
		$rows = array();
		foreach ( $keys as $k ) {
			$from = (string) ( $old[ $k ] ?? '' );
			$to   = (string) ( $new[ $k ] ?? '' );
			if ( $from === $to || ( 'php' === $k && '' === $from ) ) {
				continue;
			}
			$rows[] = array(
				'key'  => (string) $k,
				'from' => $from,
				'to'   => $to,
			);
		}
		return $rows;
	}

	/**
	 * Two diffs as one: the earliest "from" and the latest "to" per component; a component that
	 * went back to where it started drops out.
	 *
	 * @param array $first  Older diff.
	 * @param array $second Newer diff.
	 * @return array<int,array{key:string,from:string,to:string}>
	 */
	public static function merge_diff( array $first, array $second ): array {
		$by = array();
		foreach ( array_merge( $first, $second ) as $row ) {
			if ( ! is_array( $row ) || ! isset( $row['key'] ) ) {
				continue;
			}
			$k = (string) $row['key'];
			if ( ! isset( $by[ $k ] ) ) {
				$by[ $k ] = array(
					'key'  => $k,
					'from' => (string) ( $row['from'] ?? '' ),
					'to'   => (string) ( $row['to'] ?? '' ),
				);
				continue;
			}
			$by[ $k ]['to'] = (string) ( $row['to'] ?? '' );
		}
		ksort( $by, SORT_STRING );
		return array_values(
			array_filter(
				$by,
				static function ( array $r ): bool {
					return $r['from'] !== $r['to'];
				}
			)
		);
	}

	/**
	 * A component's name, from its key.
	 *
	 * @param string $key core, php, php_cli, plugin:<file> or theme:<slug>.
	 * @return string
	 */
	public static function component_label( string $key ): string {
		if ( 'core' === $key ) {
			return 'WordPress core';
		}
		if ( 'php' === $key ) {
			return 'PHP (web server)';
		}
		if ( 'php_cli' === $key ) {
			return 'PHP (scheduled tasks)';
		}
		if ( 0 === strpos( $key, 'plugin:' ) ) {
			return 'Plugin ' . substr( $key, 7 );
		}
		if ( 0 === strpos( $key, 'theme:' ) ) {
			return 'Theme ' . substr( $key, 6 );
		}
		return $key;
	}

	/**
	 * One changed component, in words.
	 *
	 * @param array $row A diff row.
	 * @return string
	 */
	public static function describe_change( array $row ): string {
		$name = self::component_label( (string) ( $row['key'] ?? '' ) );
		$from = (string) ( $row['from'] ?? '' );
		$to   = (string) ( $row['to'] ?? '' );
		if ( '' === $from ) {
			return $name . ' added (' . ( '' === $to ? 'no version' : $to ) . ')';
		}
		if ( '' === $to ) {
			return $name . ' removed or deactivated (was ' . $from . ')';
		}
		return $name . ' ' . $from . ' to ' . $to;
	}

	// ── Detection ──────────────────────────────────────────────────────

	/** The stored fingerprint record, or array(). */
	public static function stored(): array {
		$s = get_option( self::OPTION_FINGERPRINT, array() );
		return is_array( $s ) ? $s : array();
	}

	/** The pending run's record, or array(). */
	public static function pending(): array {
		$p = get_option( self::OPTION_PENDING, array() );
		return is_array( $p ) ? $p : array();
	}

	/**
	 * Compares the running site with the stored fingerprint, and stores the new one when it
	 * differs (or when none was stored yet). Writes nothing when nothing changed.
	 *
	 * @return array{state:string,diff:array} state: baseline (first sight), same, or changed.
	 */
	public static function detect(): array {
		$comps  = self::components();
		$hash   = self::fingerprint( $comps );
		$stored = self::stored();
		if ( '' === (string) ( $stored['hash'] ?? '' ) ) {
			self::store_fingerprint( $hash, $comps, self::now(), array() );
			return array(
				'state' => 'baseline',
				'diff'  => array(),
			);
		}
		if ( hash_equals( (string) $stored['hash'], $hash ) ) {
			return array(
				'state' => 'same',
				'diff'  => array(),
			);
		}
		$diff = self::diff( is_array( $stored['components'] ?? null ) ? $stored['components'] : array(), $comps );
		if ( array() === $diff ) {
			// Only the PHP version became known: recorded, not verified.
			self::store_fingerprint( $hash, $comps, (int) ( $stored['changed_at'] ?? 0 ), is_array( $stored['diff'] ?? null ) ? $stored['diff'] : array() );
			return array(
				'state' => 'baseline',
				'diff'  => array(),
			);
		}
		self::store_fingerprint( $hash, $comps, self::now(), $diff );
		return array(
			'state' => 'changed',
			'diff'  => $diff,
		);
	}

	/** Writes the fingerprint record. */
	private static function store_fingerprint( string $hash, array $comps, int $changed_at, array $diff ): void {
		update_option(
			self::OPTION_FINGERPRINT,
			array(
				'hash'       => $hash,
				'components' => $comps,
				'at'         => self::now(),
				'changed_at' => $changed_at,
				'diff'       => $diff,
			),
			false
		);
	}

	/**
	 * Books one verification SETTLE_DELAY from now, or merges into the one already pending.
	 *
	 * @param string $trigger change, upgrader.
	 * @param array  $diff    What changed, possibly empty (the upgrader hook does not say).
	 * @return bool Whether a new run was booked (false: merged into the pending one).
	 */
	public static function request_run( string $trigger, array $diff ): bool {
		$pending = self::pending();
		if ( array() !== $pending && wp_next_scheduled( self::RUN_HOOK ) ) {
			$pending['diff'] = self::merge_diff( is_array( $pending['diff'] ?? null ) ? $pending['diff'] : array(), $diff );
			if ( false === strpos( (string) ( $pending['trigger'] ?? '' ), $trigger ) ) {
				$pending['trigger'] = trim( (string) ( $pending['trigger'] ?? '' ) . '+' . $trigger, '+' );
			}
			update_option( self::OPTION_PENDING, $pending, false );
			return false;
		}
		update_option(
			self::OPTION_PENDING,
			array(
				'trigger'     => $trigger,
				'diff'        => $diff,
				'detected_at' => self::now(),
			),
			false
		);
		wp_schedule_single_event( self::now() + self::SETTLE_DELAY, 'csdt_upgrade_verify_run' );
		return true;
	}

	/**
	 * WP-Cron callback, every five minutes: one option read, and a write only on a change.
	 *
	 * @return string What happened: off, standby, baseline, same, changed, error.
	 */
	public static function tick(): string {
		try {
			if ( ! self::is_enabled() || ! self::in_background() ) {
				return 'off';
			}
			if ( self::is_standby() ) {
				return 'standby';
			}
			$d = self::detect();
			if ( 'changed' === $d['state'] ) {
				self::request_run( 'change', $d['diff'] );
			}
			return $d['state'];
		} catch ( \Throwable $e ) {
			CSDT_Monitor::log_exception( $e, __METHOD__ );
			return 'error';
		}
	}

	/**
	 * Hooked to upgrader_process_complete with accepted_args 0. Books a run; the run itself
	 * works out what changed, because the upgrader's own request may still hold stale versions.
	 *
	 * @return void
	 */
	public static function on_upgrade(): void {
		try {
			if ( ! self::is_enabled() || self::is_front_end() || self::is_standby() ) {
				return;
			}
			self::request_run( 'upgrader', array() );
		} catch ( \Throwable $e ) {
			CSDT_Monitor::log_exception( $e, __METHOD__ );
		}
	}

	/**
	 * WP-Cron callback for the pending run.
	 *
	 * @return void
	 */
	public static function run_scheduled(): void {
		try {
			if ( ! self::is_enabled() || ! self::in_background() || self::is_standby() ) {
				return;
			}
			$pending = self::pending();
			delete_option( self::OPTION_PENDING );
			$d    = self::detect();
			$diff = self::merge_diff( is_array( $pending['diff'] ?? null ) ? $pending['diff'] : array(), $d['diff'] );
			self::run( (string) ( $pending['trigger'] ?? 'change' ), $diff, (int) ( $pending['detected_at'] ?? self::now() ) );
		} catch ( \Throwable $e ) {
			CSDT_Monitor::log_exception( $e, __METHOD__ );
		}
	}

	// ── A run ──────────────────────────────────────────────────────────

	/**
	 * Runs every check, stores the run, alerts when owed.
	 *
	 * @param string $trigger change, upgrader, manual.
	 * @param array  $diff    What changed.
	 * @param int    $since   When the change was detected; fatals before this are not counted.
	 * @return array The run record.
	 */
	public static function run( string $trigger, array $diff, int $since ): array {
		$checks = self::run_checks( $diff, $since );
		$record = array(
			'ts'      => self::now(),
			'trigger' => $trigger,
			'diff'    => $diff,
			'checks'  => $checks,
			'verdict' => self::verdict( $checks ),
			'alerted' => false,
		);
		// Verify now is answered on screen, so it never alerts: the person who clicked is reading
		// the result, and a test session's click must not page the owner (it did, 2026-10-21).
		$record['alerted'] = 'manual' === $trigger ? false : self::maybe_alert( $record );
		self::store_run( $record );
		return $record;
	}

	/** The stored runs, newest first. */
	public static function runs(): array {
		$r = get_option( self::OPTION_RUNS, array() );
		return is_array( $r ) ? array_values( array_filter( $r, 'is_array' ) ) : array();
	}

	/** Prepends a run and keeps MAX_RUNS. */
	private static function store_run( array $record ): void {
		$runs = self::runs();
		array_unshift( $runs, $record );
		update_option( self::OPTION_RUNS, array_slice( $runs, 0, self::MAX_RUNS ), false );
	}

	/**
	 * The worst result: fail, then warn, else pass. Skips do not count.
	 *
	 * @param array $checks Check results.
	 * @return string
	 */
	public static function verdict( array $checks ): string {
		$statuses = array_column( $checks, 'status' );
		if ( in_array( self::FAIL, $statuses, true ) ) {
			return self::FAIL;
		}
		return in_array( self::WARN, $statuses, true ) ? self::WARN : self::PASS;
	}

	/**
	 * The front page's usual time: the median of its time in the last BASELINE_RUNS passing runs.
	 *
	 * @param array $runs runs(), newest first.
	 * @return int Milliseconds, 0 when there is no passing run yet.
	 */
	public static function front_baseline( array $runs ): int {
		$times = array();
		foreach ( $runs as $run ) {
			foreach ( (array) ( $run['checks'] ?? array() ) as $c ) {
				if ( 'front' === ( $c['id'] ?? '' ) && self::PASS === ( $c['status'] ?? '' ) && (int) ( $c['ms'] ?? 0 ) > 0 ) {
					$times[] = (int) $c['ms'];
				}
			}
			if ( count( $times ) >= self::BASELINE_RUNS ) {
				break;
			}
		}
		if ( array() === $times ) {
			return 0;
		}
		sort( $times, SORT_NUMERIC );
		$n   = count( $times );
		$mid = intdiv( $n, 2 );
		return 0 === $n % 2 ? (int) round( ( $times[ $mid - 1 ] + $times[ $mid ] ) / 2 ) : $times[ $mid ];
	}

	/**
	 * A passing front page that took more than SLOW_FACTOR times its baseline becomes a warning.
	 *
	 * @param array $check    The front page result.
	 * @param int   $baseline front_baseline().
	 * @return array
	 */
	public static function apply_baseline( array $check, int $baseline ): array {
		if ( self::PASS === $check['status'] && $baseline > 0 && (int) $check['ms'] > self::SLOW_FACTOR * $baseline ) {
			$check['status'] = self::WARN;
			$check['reason'] = sprintf( 'Answered, but in %d ms, more than %d times its usual %d ms.', (int) $check['ms'], self::SLOW_FACTOR, $baseline );
		}
		return $check;
	}

	/**
	 * Runs one check, timed. A check that throws is a warning that it could not run, never a pass.
	 *
	 * @param string   $id    Check id.
	 * @param string   $label What it is called.
	 * @param callable $fn    Returns array( status, reason ).
	 * @return array{id:string,label:string,status:string,reason:string,ms:int}
	 */
	private static function timed( string $id, string $label, callable $fn ): array {
		$t0 = microtime( true );
		try {
			list( $status, $reason ) = $fn();
		} catch ( \Throwable $e ) {
			CSDT_Monitor::log_exception( $e, __METHOD__ . ' ' . $id );
			$status = self::WARN;
			$reason = 'The check could not run: ' . substr( $e->getMessage(), 0, 160 );
		}
		return array(
			'id'     => $id,
			'label'  => $label,
			'status' => (string) $status,
			'reason' => (string) $reason,
			'ms'     => (int) round( ( microtime( true ) - $t0 ) * 1000 ),
		);
	}

	/**
	 * Every check, in order.
	 *
	 * @param array $diff  What changed.
	 * @param int   $since When the change was detected.
	 * @return array<int,array>
	 */
	public static function run_checks( array $diff, int $since ): array {
		$baseline = self::front_baseline( self::runs() );
		$out      = array();
		$out[]    = self::apply_baseline(
			self::timed(
				'front',
				'Front page',
				static function (): array {
					return self::check_front_page();
				}
			),
			$baseline
		);
		$out[] = self::timed(
			'login',
			'Login page',
			static function (): array {
				return self::check_login();
			}
		);
		$out[] = self::timed(
			'rest',
			'REST API',
			static function (): array {
				return self::check_rest();
			}
		);
		$out[] = self::timed(
			'ajax',
			'Admin AJAX',
			static function (): array {
				return self::check_ajax();
			}
		);
		$out[] = self::timed(
			'fatals',
			'PHP fatals',
			static function () use ( $since ): array {
				return self::check_fatals( $since );
			}
		);
		$out[] = self::timed(
			'versions',
			'Versions landed',
			static function () use ( $diff ): array {
				return self::check_versions( $diff );
			}
		);
		$out[] = self::timed(
			'core',
			'Core files',
			static function () use ( $diff ): array {
				return self::check_core( $diff );
			}
		);
		$out[] = self::timed(
			'cron',
			'Scheduled tasks',
			static function (): array {
				return self::check_cron();
			}
		);
		return $out;
	}

	// ── The checks ─────────────────────────────────────────────────────

	/**
	 * Arguments for a loopback request: the plugin's user agent, the marker header, the site's
	 * own TLS rule. CSDT_Auto_Block::sign_self_request() adds the self-signature on the way out.
	 *
	 * @param array $extra More arguments.
	 * @return array
	 */
	private static function probe_args( array $extra = array() ): array {
		return array_merge(
			array(
				'timeout'     => self::HTTP_TIMEOUT,
				'redirection' => 3,
				'user-agent'  => CSDT_DevTools::USER_AGENT,
				'headers'     => array(
					self::PROBE_HEADER => '1',
					'Cache-Control'    => 'no-cache',
				),
				'sslverify'   => csdt_loopback_ssl_verify(),
			),
			$extra
		);
	}

	/**
	 * Why a loopback page is not a working page, or '' when it is.
	 *
	 * @param array $h      CSDT_Http::json() result.
	 * @param bool  $is_html Whether the page must end with </html>.
	 * @return string
	 */
	public static function page_problem( array $h, bool $is_html ): string {
		if ( 0 === (int) $h['code'] ) {
			return 'No answer: ' . substr( (string) $h['error'], 0, 160 );
		}
		if ( false !== stripos( (string) $h['body'], self::CRITICAL_ERROR ) ) {
			return 'WordPress showed its critical error page (HTTP ' . (int) $h['code'] . ').';
		}
		if ( (int) $h['code'] < 200 || (int) $h['code'] >= 300 ) {
			return 'HTTP ' . (int) $h['code'] . '.';
		}
		if ( $is_html && false === stripos( (string) $h['body'], '</html>' ) ) {
			return 'The page stopped before </html>: something cut it short.';
		}
		return '';
	}

	/** 1. The front page, past any page cache. */
	public static function check_front_page(): array {
		$url  = add_query_arg( 'csdt_uv', (string) self::now(), home_url( '/' ) );
		$args = self::probe_args();
		$h    = CSDT_Http::json( wp_remote_get( $url, $args ), 1 );
		$why = self::page_problem( $h, true );
		if ( '' !== $why ) {
			return array( self::FAIL, $why );
		}
		return array( self::PASS, 'HTTP ' . (int) $h['code'] . ', a complete page.' );
	}

	/** Whether Hide Login is on with a slug, so the login page lives at that address. */
	public static function login_hidden(): bool {
		return '1' === (string) CSDT_Options::get( 'csdt_devtools_login_hide_enabled' )
			&& '' !== trim( (string) CSDT_Options::get( 'csdt_devtools_login_slug' ), '/ ' );
	}

	/**
	 * 2. The login page, at its real address. While Hide Login is on that is the slug: a request
	 * for wp-login.php would be refused by design and recorded as a login probe from this site.
	 * The address is never put in the reason, which reaches the alert channel.
	 */
	public static function check_login(): array {
		$hidden = self::login_hidden();
		$url    = $hidden ? home_url( '/' . trim( (string) CSDT_Options::get( 'csdt_devtools_login_slug' ), '/ ' ) . '/' ) : wp_login_url();
		$args   = self::probe_args();
		$h      = CSDT_Http::json( wp_remote_get( $url, $args ), 1 );
		$what   = $hidden ? 'The hidden login page' : 'The login page';
		$why    = self::page_problem( $h, false );
		if ( '' !== $why ) {
			return array( self::FAIL, $what . ': ' . $why );
		}
		if ( 200 !== (int) $h['code'] ) {
			return array( self::FAIL, $what . ' answered HTTP ' . (int) $h['code'] . ' where 200 was expected.' );
		}
		return array( self::PASS, $what . ' answered HTTP 200.' );
	}

	/** 3. The REST index answers JSON with its namespaces. */
	public static function check_rest(): array {
		$args = self::probe_args();
		$h    = CSDT_Http::json( wp_remote_get( rest_url(), $args ), 2097152 );
		if ( 0 === (int) $h['code'] ) {
			return array( self::FAIL, 'No answer: ' . substr( (string) $h['error'], 0, 160 ) );
		}
		if ( 200 !== (int) $h['code'] ) {
			return array( self::FAIL, 'HTTP ' . (int) $h['code'] . ' from the REST index.' );
		}
		if ( ! is_array( $h['data'] ) ) {
			return array( self::FAIL, 'HTTP 200, but not JSON: something other than WordPress answered, or PHP printed an error first.' );
		}
		if ( ! isset( $h['data']['namespaces'] ) || ! is_array( $h['data']['namespaces'] ) ) {
			return array( self::FAIL, 'JSON, but without the namespaces list the REST index always has.' );
		}
		return array( self::PASS, sprintf( 'JSON with %d namespaces.', count( $h['data']['namespaces'] ) ) );
	}

	/** 4. admin-ajax.php with an action nobody registered: core answers 400 "0" once admin has loaded. */
	public static function check_ajax(): array {
		$args = self::probe_args( array( 'body' => array( 'action' => self::UNKNOWN_ACTION ) ) );
		$h    = CSDT_Http::json( wp_remote_post( admin_url( 'admin-ajax.php' ), $args ), 1 );
		if ( 0 === (int) $h['code'] ) {
			return array( self::FAIL, 'No answer: ' . substr( (string) $h['error'], 0, 160 ) );
		}
		if ( false !== stripos( (string) $h['body'], self::CRITICAL_ERROR ) || (int) $h['code'] >= 500 ) {
			return array( self::FAIL, 'admin-ajax.php failed to load (HTTP ' . (int) $h['code'] . '): a plugin or theme fatals while admin starts.' );
		}
		// Core prints "0"; some stacks strip that one byte (seen on prod, 2026-10-21: 400 with an
		// empty body). Either way the 400 itself is core's own answer, which needs admin loaded.
		if ( 400 === (int) $h['code'] && in_array( trim( (string) $h['body'] ), array( '0', '' ), true ) ) {
			return array( self::PASS, 'HTTP 400, as core answers an unknown action: admin loads without errors.' );
		}
		return array( self::FAIL, sprintf( 'HTTP %d "%s" where core answers 400 "0".', (int) $h['code'], substr( sanitize_text_field( (string) $h['body'] ), 0, 40 ) ) );
	}

	/**
	 * 5. No PHP fatal since the change was detected: from the PHP log when it is readable, and from
	 * the shutdown handler's fatal store (CSDT_Monitor::FATAL_STORE_OPTION) either way.
	 *
	 * @param int $since When the change was detected.
	 */
	public static function check_fatals( int $since ): array {
		$f     = CSDT_Monitor::fatals_since( $since );
		$store = ! empty( $f['store'] );
		if ( 0 === (int) $f['readable'] && ! $store ) {
			return array( self::SKIP, 'No PHP error log is readable here and the fatal recorder is not running, so fatals cannot be counted.' );
		}
		if ( (int) $f['count'] > 0 ) {
			return array( self::FAIL, sprintf( '%d PHP fatal error(s) since the change. Newest: %s', (int) $f['count'], substr( (string) $f['latest'], 0, 160 ) ) );
		}
		if ( 0 === (int) $f['readable'] ) {
			return array( self::PASS, '0 fatals since the change, counted by the plugin\'s fatal recorder (the PHP log is not a readable file here).' );
		}
		return array( self::PASS, '0 fatals since the change.' );
	}

	/**
	 * The version a component reports now, read from disk rather than from this process's caches,
	 * or '' when it is not there.
	 *
	 * @param string $key A component key.
	 * @return string
	 */
	public static function landed( string $key ): string {
		if ( 'core' === $key ) {
			$file = CSDT_Paths::root_file( 'wp-includes/version.php' );
			// phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- a local core file, read for its version line; never a URL
			$src = is_readable( $file ) ? (string) file_get_contents( $file, false, null, 0, 8192 ) : '';
			return preg_match( '/\$wp_version\s*=\s*[\'"]([^\'"]+)[\'"]/', $src, $m ) ? $m[1] : '';
		}
		if ( 'php' === $key ) {
			$rt = class_exists( 'CSDT_Php_Advisory' ) ? CSDT_Php_Advisory::runtime() : null;
			return null === $rt ? '' : (string) $rt['version'];
		}
		if ( 'php_cli' === $key ) {
			return PHP_VERSION;
		}
		if ( 0 === strpos( $key, 'plugin:' ) ) {
			$file = substr( $key, 7 );
			if ( ! in_array( $file, self::active_plugin_files(), true ) ) {
				return '';
			}
			$path = CSDT_Paths::plugins_dir() . '/' . $file;
			return is_readable( $path ) ? (string) ( get_file_data( $path, array( 'Version' => 'Version' ) )['Version'] ?? '' ) : '';
		}
		if ( 0 === strpos( $key, 'theme:' ) ) {
			$slug  = substr( $key, 6 );
			$theme = wp_get_theme();
			$live  = array( $theme->get_stylesheet() );
			if ( is_object( $theme->parent() ) ) {
				$live[] = $theme->parent()->get_stylesheet();
			}
			if ( ! in_array( $slug, $live, true ) ) {
				return '';
			}
			$path = get_theme_root( $slug ) . '/' . $slug . '/style.css';
			return is_readable( $path ) ? (string) ( get_file_data( $path, array( 'Version' => 'Version' ) )['Version'] ?? '' ) : '';
		}
		return '';
	}

	/**
	 * 6. Every changed component reports the version the diff says. A half-applied update, or
	 * this plugin's new files with its old code still loaded, fails here.
	 *
	 * @param array $diff What changed.
	 */
	public static function check_versions( array $diff ): array {
		if ( array() === $diff ) {
			return array( self::SKIP, 'No component change was recorded for this run.' );
		}
		$bad  = array();
		$self = function_exists( 'plugin_basename' ) ? 'plugin:' . plugin_basename( CSDT_PLUGIN_FILE ) : '';
		foreach ( $diff as $row ) {
			$key  = (string) ( $row['key'] ?? '' );
			$want = (string) ( $row['to'] ?? '' );
			$have = self::landed( $key );
			if ( $have !== $want ) {
				$bad[] = sprintf( '%s reports %s, expected %s', self::component_label( $key ), '' === $have ? 'nothing' : $have, '' === $want ? 'nothing' : $want );
			} elseif ( $key === $self && '' !== $want && CSDT_DevTools::VERSION !== $want ) {
				$bad[] = sprintf( 'this plugin\'s files are %s but the code running is %s (OPcache or a stale copy)', $want, CSDT_DevTools::VERSION );
			}
		}
		if ( array() !== $bad ) {
			return array( self::FAIL, 'Half applied: ' . implode( '; ', array_slice( $bad, 0, 4 ) ) . ( count( $bad ) > 4 ? sprintf( '; and %d more', count( $bad ) - 4 ) : '' ) . '.' );
		}
		return array( self::PASS, sprintf( '%d changed component(s), each at the version recorded.', count( $diff ) ) );
	}

	/**
	 * 7. Core files against WordPress's checksums, when core changed. Skipped while file integrity
	 * is off, so a default install makes no request it did not make before.
	 *
	 * @param array $diff What changed.
	 */
	public static function check_core( array $diff ): array {
		if ( ! in_array( 'core', array_column( $diff, 'key' ), true ) ) {
			return array( self::SKIP, 'WordPress core did not change.' );
		}
		if ( ! class_exists( 'CSDT_Integrity' ) || ! CSDT_Integrity::is_enabled() ) {
			return array( self::SKIP, 'Core file integrity is off, so WordPress.org\'s checksums are not fetched.' );
		}
		$r = CSDT_Integrity::verify_core_now( self::CORE_BUDGET );
		if ( false === $r['ok'] ) {
			return array( self::FAIL, sprintf( '%d core file(s) differ from WordPress\'s checksums: %s', count( $r['modified'] ), implode( ', ', array_slice( $r['modified'], 0, 5 ) ) ) );
		}
		if ( null === $r['ok'] && 'time-budget' === $r['reason'] ) {
			return array( self::WARN, sprintf( 'Not finished in %d seconds; %d files checked, none differ.', self::CORE_BUDGET, (int) $r['checked'] ) );
		}
		if ( null === $r['ok'] ) {
			return array( self::SKIP, 'WordPress.org\'s checksums could not be fetched, so core files were not verified.' );
		}
		return array( self::PASS, sprintf( '%d core files match WordPress\'s checksums.', (int) $r['checked'] ) );
	}

	/** 8. No csdt_ event overdue by more than CRON_OVERDUE: cron still runs. */
	public static function check_cron(): array {
		if ( ! function_exists( '_get_cron_array' ) ) {
			return array( self::SKIP, 'The schedule cannot be read here.' );
		}
		$late = array();
		$cut  = self::now() - self::CRON_OVERDUE;
		foreach ( (array) _get_cron_array() as $ts => $hooks ) {
			if ( (int) $ts >= $cut || ! is_array( $hooks ) ) {
				continue;
			}
			foreach ( array_keys( $hooks ) as $hook ) {
				if ( 0 === strpos( (string) $hook, 'csdt_' ) ) {
					$late[ (string) $hook ] = max( (int) ( $late[ (string) $hook ] ?? 0 ), self::now() - (int) $ts );
				}
			}
		}
		if ( array() !== $late ) {
			arsort( $late );
			$names = array();
			foreach ( array_slice( $late, 0, 4, true ) as $hook => $secs ) {
				$names[] = sprintf( '%s (%d min late)', $hook, (int) floor( $secs / 60 ) );
			}
			return array( self::FAIL, sprintf( '%d scheduled task(s) overdue by more than %d minutes: %s. WP-Cron has stopped running them.', count( $late ), (int) ( self::CRON_OVERDUE / 60 ), implode( ', ', $names ) ) );
		}
		return array( self::PASS, sprintf( 'No CloudScale task is more than %d minutes overdue.', (int) ( self::CRON_OVERDUE / 60 ) ) );
	}

	// ── Alerts ─────────────────────────────────────────────────────────

	/**
	 * The alert for a run: subject, body and level. Pure.
	 *
	 * @param array  $run  A run record.
	 * @param string $site Site name.
	 * @param string $url  The panel's address.
	 * @return array{subject:string,body:string,level:string}
	 */
	public static function alert_text( array $run, string $site, string $url ): array {
		$verdict = (string) ( $run['verdict'] ?? self::PASS );
		$words   = array(
			self::FAIL => 'FAILED',
			self::WARN => 'passed with warnings',
			self::PASS => 'passed',
		);
		$lines   = array();
		$diff    = (array) ( $run['diff'] ?? array() );
		$lines[] = array() === $diff ? 'What changed: nothing recorded (' . (string) ( $run['trigger'] ?? '' ) . ').' : 'What changed:';
		foreach ( $diff as $row ) {
			$lines[] = '- ' . self::describe_change( (array) $row );
		}
		$flag = array();
		foreach ( (array) ( $run['checks'] ?? array() ) as $c ) {
			if ( in_array( $c['status'] ?? '', array( self::FAIL, self::WARN ), true ) ) {
				$flag[] = '- ' . ( self::FAIL === $c['status'] ? 'FAIL ' : 'WARN ' ) . $c['label'] . ': ' . $c['reason'];
			}
		}
		if ( array() !== $flag ) {
			$lines[] = '';
			$lines[] = self::FAIL === $verdict ? 'Failing checks:' : 'Warnings:';
			$lines   = array_merge( $lines, $flag );
		} else {
			$lines[] = '';
			$lines[] = 'Every check passed.';
		}
		$lines[] = '';
		$lines[] = 'Nothing was rolled back or changed: this is a report.';
		$lines[] = 'Upgrade Verification: ' . $url;
		return array(
			'subject' => sprintf( 'CSDT: Upgrade verification %s (%s)', $words[ $verdict ] ?? $verdict, $site ),
			'body'    => implode( "\n", $lines ),
			'level'   => self::FAIL === $verdict ? 'error' : ( self::WARN === $verdict ? 'warning' : 'info' ),
		);
	}

	/**
	 * Sends the run's alert when one is owed: always on a failure, otherwise only when the owner
	 * asked to hear about passes. Telegram when set up, else the admin email.
	 *
	 * @param array $run A run record.
	 * @return bool Whether an alert was delivered.
	 */
	public static function maybe_alert( array $run ): bool {
		if ( self::FAIL !== ( $run['verdict'] ?? '' ) && ! self::notify_pass() ) {
			return false;
		}
		try {
			$site = wp_specialchars_decode( (string) ( get_bloginfo( 'name' ) ?: home_url() ), ENT_QUOTES );
			$url  = admin_url( 'admin.php?page=' . CSDT_DevTools::TOOLS_SLUG . '&tab=activity' ) . '#cs-panel-upgrade-verify';
			$a    = self::alert_text( $run, $site, $url );
			$tg   = class_exists( 'CSDT_Alert_Events' )
				&& CSDT_Alert_Events::send( CSDT_Alert_Events::GENERAL, $a['subject'] . "\n\n" . $a['body'], 'Upgrade Verification', $a['level'] );
			if ( $tg ) {
				return true;
			}
			return is_callable( array( 'CSDT_Threat_Monitor', 'send_alert_email' ) )
				&& CSDT_Threat_Monitor::send_alert_email( (string) get_option( 'admin_email' ), $a['subject'], $a['body'] );
		} catch ( \Throwable $e ) {
			CSDT_Monitor::log_exception( $e, __METHOD__ );
			return false;
		}
	}

	// ── Admin ──────────────────────────────────────────────────────────

	/** Pill colours for a verdict: background, text. */
	private static function colours( string $status ): array {
		$map = array(
			self::PASS => array( '#dcfce7', '#166534' ),
			self::WARN => array( '#fef3c7', '#92400e' ),
			self::FAIL => array( '#fee2e2', '#991b1b' ),
		);
		return $map[ $status ] ?? array( '#f1f5f9', '#334155' );
	}

	/** A timestamp in the site's timezone. */
	private static function when( int $ts ): string {
		return function_exists( 'wp_date' ) ? (string) wp_date( 'Y-m-d H:i T', $ts ) : gmdate( 'Y-m-d H:i', $ts ) . ' UTC';
	}

	/**
	 * One run's table of checks, escaped.
	 *
	 * @param array $run A run record.
	 * @return string
	 */
	private static function run_table( array $run ): string {
		$h    = '';
		$diff = (array) ( $run['diff'] ?? array() );
		if ( array() !== $diff ) {
			$items = array();
			foreach ( $diff as $row ) {
				$items[] = esc_html( self::describe_change( (array) $row ) );
			}
			$h .= '<p style="margin:6px 0;font-size:12px;color:#334155;"><strong>' . esc_html__( 'What changed:', 'cloudscale-cyber-devtools' ) . '</strong> ' . implode( '; ', $items ) . '</p>';
		}
		$h .= '<table class="widefat striped" style="font-size:12px;margin:6px 0 0;"><tbody>';
		foreach ( (array) ( $run['checks'] ?? array() ) as $c ) {
			$col = self::colours( (string) ( $c['status'] ?? '' ) );
			$h  .= '<tr><th scope="row" style="width:150px;">' . esc_html( (string) ( $c['label'] ?? '' ) ) . '</th>'
				. '<td style="width:60px;"><span class="cs-hs-pill" style="background:' . esc_attr( $col[0] ) . ';color:' . esc_attr( $col[1] ) . '">' . esc_html( strtoupper( (string) ( $c['status'] ?? '' ) ) ) . '</span></td>'
				. '<td>' . esc_html( (string) ( $c['reason'] ?? '' ) ) . '</td>'
				. '<td style="width:70px;text-align:right;color:#475569;">' . esc_html( (int) ( $c['ms'] ?? 0 ) . ' ms' ) . '</td></tr>';
		}
		return $h . '</tbody></table>';
	}

	/**
	 * The status block and run history, escaped. Rendered on page load and returned after every action.
	 *
	 * @return string
	 */
	public static function status_html(): string {
		$runs    = self::runs();
		$stored  = self::stored();
		$pending = self::pending();
		if ( self::is_standby() ) {
			$pill = array( 'Standby copy: never runs', '#fef3c7', '#92400e' );
		} elseif ( ! self::is_enabled() ) {
			$pill = array( 'Off', '#f1f5f9', '#334155' );
		} elseif ( array() === $runs ) {
			$pill = array( 'On: no run yet', '#f1f5f9', '#334155' );
		} else {
			$v     = (string) ( $runs[0]['verdict'] ?? '' );
			$words = array(
				self::PASS => 'Last run passed',
				self::WARN => 'Last run passed with warnings',
				self::FAIL => 'Last run FAILED',
			);
			$col   = self::colours( $v );
			$pill  = array( $words[ $v ] ?? $v, $col[0], $col[1] );
		}
		$rows   = array();
		$rows[] = array( 'Last run', array() === $runs ? 'None yet. One runs two minutes after a change is detected, or click Verify now.' : self::when( (int) ( $runs[0]['ts'] ?? 0 ) ) . ' (' . (string) ( $runs[0]['trigger'] ?? '' ) . ')' );
		$rows[] = array( 'Fingerprint', '' === (string) ( $stored['hash'] ?? '' ) ? 'Not taken yet: the first check takes it within 5 minutes.' : substr( (string) $stored['hash'], 0, 16 ) . ', taken ' . self::when( (int) ( $stored['at'] ?? 0 ) ) . ', ' . count( (array) ( $stored['components'] ?? array() ) ) . ' components' );
		$rows[] = array( 'Last change seen', (int) ( $stored['changed_at'] ?? 0 ) > 0 && array() !== (array) ( $stored['diff'] ?? array() ) ? self::when( (int) $stored['changed_at'] ) : 'None since the fingerprint was first taken.' );
		if ( array() !== $pending ) {
			$rows[] = array( 'Pending', 'A verification is booked for ' . self::when( (int) ( $pending['detected_at'] ?? 0 ) + self::SETTLE_DELAY ) . '.' );
		}
		$rows[] = array( 'Alerts', self::notify_pass() ? 'On every run (failures and passes).' : 'On failures only.' );

		$h  = '<span class="cs-hs-pill" style="background:' . esc_attr( $pill[1] ) . ';color:' . esc_attr( $pill[2] ) . '">' . esc_html( $pill[0] ) . '</span>';
		$h .= '<table class="widefat striped" style="font-size:12px;margin:8px 0 0;"><tbody>';
		foreach ( $rows as $r ) {
			$h .= '<tr><th scope="row" style="width:180px;">' . esc_html( $r[0] ) . '</th><td>' . esc_html( $r[1] ) . '</td></tr>';
		}
		$h .= '</tbody></table>';
		if ( array() !== $runs ) {
			$h .= '<div style="margin-top:10px;">' . self::run_table( $runs[0] ) . '</div>';
		}
		if ( count( $runs ) > 0 ) {
			$h .= '<details style="margin-top:10px;font-size:12px;"><summary style="cursor:pointer;color:#1e293b;">' . esc_html( sprintf( 'Run history (%d of the last %d kept)', count( $runs ), self::MAX_RUNS ) ) . '</summary>';
			foreach ( $runs as $i => $run ) {
				$col = self::colours( (string) ( $run['verdict'] ?? '' ) );
				$h  .= '<details class="cs-uv-run" style="margin:6px 0 0 12px;"><summary style="cursor:pointer;color:#1e293b;">'
					. '<span class="cs-hs-pill" style="background:' . esc_attr( $col[0] ) . ';color:' . esc_attr( $col[1] ) . '">' . esc_html( strtoupper( (string) ( $run['verdict'] ?? '' ) ) ) . '</span> '
					. esc_html( self::when( (int) ( $run['ts'] ?? 0 ) ) . ', ' . (string) ( $run['trigger'] ?? '' ) . ( ! empty( $run['alerted'] ) ? ', alert sent' : '' ) )
					. '</summary>' . self::run_table( $run ) . '</details>';
			}
			$h .= '</details>';
		}
		return $h;
	}

	/** One AJAX answer: a message and the fresh status block. */
	private static function reply( bool $ok, string $msg, array $extra = array() ): void {
		$data = array_merge(
			array(
				'ok'   => $ok,
				'msg'  => $msg,
				'html' => self::status_html(),
			),
			$extra
		);
		if ( $ok ) {
			wp_send_json_success( $data );
		}
		wp_send_json_error( $data );
	}

	/**
	 * Verify now: runs every check immediately. Allowed for the test session: it changes nothing
	 * on the site, it only adds a run to the history (and alerts on a failure, as any run does).
	 */
	public static function ajax_verify(): void {
		check_ajax_referer( CSDT_DevTools::SECURITY_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		if ( self::is_standby() ) {
			self::reply( false, __( 'This site is a standby copy, which never verifies or alerts.', 'cloudscale-cyber-devtools' ) );
			return;
		}
		try {
			$stored  = self::stored();
			$pending = self::pending();
			$diff    = array() !== $pending
				? (array) ( $pending['diff'] ?? array() )
				: (array) ( $stored['diff'] ?? array() );
			$since   = max( (int) ( $stored['changed_at'] ?? 0 ), self::now() - self::MANUAL_WINDOW );
			$run     = self::run( 'manual', $diff, $since );
		} catch ( \Throwable $e ) {
			CSDT_Monitor::log_exception( $e, __METHOD__ );
			self::reply( false, __( 'The verification could not run. The error is in the PHP log.', 'cloudscale-cyber-devtools' ) );
			return;
		}
		$words = array(
			self::PASS => __( 'Verified: every check passed.', 'cloudscale-cyber-devtools' ),
			self::WARN => __( 'Verified with warnings: see the checks below.', 'cloudscale-cyber-devtools' ),
			self::FAIL => __( 'Verification FAILED: see the checks below.', 'cloudscale-cyber-devtools' ),
		);
		self::reply( true, $words[ $run['verdict'] ] ?? '', array( 'run' => $run ) );
	}

	/** Saves the switch and the pass-alert choice. Registered with refuse_test_session. */
	public static function ajax_save(): void {
		check_ajax_referer( CSDT_DevTools::SECURITY_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		$on   = '1' === sanitize_text_field( wp_unslash( $_POST['enabled'] ?? '0' ) );
		$pass = '1' === sanitize_text_field( wp_unslash( $_POST['notify_pass'] ?? '0' ) );
		update_option( self::OPTION_ENABLED, $on ? '1' : '0' );
		update_option( self::OPTION_NOTIFY_PASS, $pass ? '1' : '0' );
		if ( ! $on ) {
			// Switched back on later, the first check starts from a fresh fingerprint instead of
			// verifying everything that changed while it was off.
			delete_option( self::OPTION_FINGERPRINT );
			delete_option( self::OPTION_PENDING );
		}
		self::sync_schedule();
		self::reply(
			true,
			$on
				? __( 'Saved. Changes to core, PHP, the theme and plugins are checked every 5 minutes.', 'cloudscale-cyber-devtools' )
				: __( 'Saved. Upgrade verification is off: nothing is checked or sent.', 'cloudscale-cyber-devtools' )
		);
	}

	/** The panel, on the Activity tab after the Out of Band Heartbeat. */
	public static function render_panel(): void {
		?>
		<div class="cs-panel" id="cs-panel-upgrade-verify">
			<div class="cs-section-header" style="background:linear-gradient(90deg,#1e3a8a 0%,#2563eb 100%);border-left:3px solid #93c5fd;">
				<span>&#9989; <?php esc_html_e( 'Upgrade Verification', 'cloudscale-cyber-devtools' ); ?></span>
				<span class="cs-header-hint"><?php esc_html_e( 'After core, PHP, a theme or a plugin changes: is the site still working?', 'cloudscale-cyber-devtools' ); ?></span>
				<?php
				CSDT_DevTools::render_explain_btn(
					'upgrade-verify',
					'Upgrade Verification',
					array(
						array(
							'name' => 'What it does',
							'rec'  => 'Read this first',
							'html' => '<p>Every 5 minutes this site compares a fingerprint of what it runs: the WordPress version, the PHP version the web server uses, the active theme and every active plugin with their versions. When any of them changes, by an update in WordPress, a file copy or a rebuilt server image, it waits 2 minutes for caches to settle and then checks that the site still works.</p><p>It is a report only. It never rolls anything back, deactivates a plugin or changes a setting.</p>',
						),
						array(
							'name' => 'The checks',
							'rec'  => 'Info',
							'html' => '<p><strong>Front page</strong>: a complete page, with no critical error, and a warning when it is more than 3 times slower than usual (the middle of the last 5 passing runs). <strong>Login page</strong>: answers 200, at its hidden address when Hide Login is on. <strong>REST API</strong>: the index answers JSON. <strong>Admin AJAX</strong>: admin starts without a fatal error. <strong>PHP fatals</strong>: none logged since the change. <strong>Versions landed</strong>: every changed part reports the version it changed to, so a half-applied update fails. <strong>Core files</strong>: after a WordPress update, the files match WordPress\'s checksums (only while file integrity is on). <strong>Scheduled tasks</strong>: none of this plugin\'s tasks is more than 30 minutes late.</p><p>The requests go from this server to its own address, marked as the site\'s own, and never to the default login page while it is hidden.</p>',
						),
						array(
							'name' => 'Alerts',
							'rec'  => 'Failures only by default',
							'html' => '<p>A failed run sends one alert, to Telegram when it is set up, otherwise to the site admin email, listing what changed and each failing check. Tick <strong>Also tell me when it passes</strong> to hear about every run. Nothing is sent to anyone else: the checks contact only this site (and WordPress.org\'s checksum list, which file integrity already uses, only when that is on).</p>',
						),
						array(
							'name' => 'Verify now and the switch',
							'rec'  => 'Safe',
							'html' => '<p><strong>Verify now</strong> runs every check immediately and adds the result to the history; it changes nothing on the site. The last 20 runs are kept. Untick <strong>Check after every change</strong> and save to stop it entirely. A standby copy of this site never runs it.</p>',
						),
					)
				);
				?>
			</div>
			<div class="cs-panel-body">
				<div id="cs-uv-status"><?php echo wp_kses_post( self::status_html() ); ?></div>
				<div style="display:flex;align-items:center;gap:16px;flex-wrap:wrap;margin:12px 0;font-size:13px;color:#1e293b;">
					<label><input type="checkbox" id="cs-uv-enabled" value="1" <?php checked( self::is_enabled() ); ?> /> <?php esc_html_e( 'Check after every change', 'cloudscale-cyber-devtools' ); ?></label>
					<label><input type="checkbox" id="cs-uv-notify-pass" value="1" <?php checked( self::notify_pass() ); ?> /> <?php esc_html_e( 'Also tell me when it passes', 'cloudscale-cyber-devtools' ); ?></label>
				</div>
				<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap;">
					<button type="button" id="cs-uv-verify" class="cs-btn-primary"><?php esc_html_e( 'Verify now', 'cloudscale-cyber-devtools' ); ?></button>
					<button type="button" id="cs-uv-save" class="cs-btn-secondary">&#128190; <?php esc_html_e( 'Save', 'cloudscale-cyber-devtools' ); ?></button>
					<span id="cs-uv-msg" class="cs-vuln-inline-msg"></span>
				</div>
			</div>
		</div>
		<?php
	}
}