Cross-charter intelligence — desktop-mode 2026-05-06T13-23-40_desktop-mode

Bug pattern digest

• Lifecycle cleanup absent across all resource types: No uninstall.php and no register_deactivation_hook for cron/data cleanup. Plugin creates user meta (desktop_mode_mode, desktop_mode_os_settings), a presence option (_desktop_mode_presence), and a daily cron event (desktop_mode_presence_daily_prune) on activation — none are cleaned up on deactivation or deletion. Confirmed in: lifecycle-cluster (H7, H8). Confidence: high.

• Recycle Bin REST layer has compounding defects — not just one bug: (1) List endpoint returns empty items despite items in DB (filtering bug — root cause unknown but likely query/capability guard issue); (2) per_page has no upper-bound cap, accepting arbitrary values including 99999 (OOM vector); (3) Empty operation hardcoded at 200 items per batch with no pagination loop (silent truncation). Each defect is independent; fixing one doesn't fix the others. Confirmed in: recycle-bin-andlist, scale-presence-cluster. Confidence: high.

• Unbounded scale patterns repeat across two independent subsystems: Presence heartbeat reads/writes the entire _desktop_mode_presence option on every tick (~67 bytes/admin/heartbeat); recycle bin per_page is absint() without a maximum cap. Both follow the same pattern: absint() sanitization assumed to be sufficient for server-side protection. Confirmed in: scale-presence-cluster. Confidence: high.

• AI key discarded silently on OS Settings REST POST: Despite apiKey field being present in POST payload, it is dropped during save/sanitization (os-settings.php). User sees no error; subsequent GET returns empty apiKey. Confirmed in: os-settings-save. Confidence: high (empirically observed empty return post-POST).

• i18n JS filename mismatch breaks all locale JS translations: wp_set_script_translations('desktop-mode', ...) generates expected filename desktop-mode-{locale}-desktop-mode.json; actual shipped file is desktop-mode-es_ES-wp-desktop.json. Every locale's JS translations are silently un-loaded. Separate issue: POT file is version 0.4.0 while plugin is 0.7.1 — Recycle Bin, virtual desktop, and presence strings have no translatable template. Confirmed in: i18n-admin. Confidence: high.

High-density areas

• Recycle Bin: 4 Problems (all major), root cause in REST layer. Worst bug class: items not visible = feature non-functional. Every probe found a new issue; very high remaining defect density.
• Scale / Presence: 2 major Problems from source-pattern analysis. Production impact proportional to admin user count and trash size; benign on small sites.

Clean areas

• Portal entry + redirect stability: CSRF defense correct (Sec-Fetch-Site + Referer), no redirect loops, no flag duplication. Multiple consecutive portal visits all clean.
• Window manager core (drag, resize, minimize, maximize, singleton focus): No defects found, JS errors absent.
• REST capability gating: manage_options and current_user_can('read') checks enforced correctly on all tested endpoints.
• OS Settings persistence mechanism (except API key field): wallpaper/accent round-trip verified correct.

Surprises not in recon

• API key silently discarded on REST POST — recon noted AI Copilot exists (S7) but didn't flag the save handler; empirical probe in os-settings-save revealed silent data loss.
• No uninstall.php anywhere in plugin — recon's source inspection flagged AI Copilot and Recycle Bin as terrain but didn't audit lifecycle hooks explicitly.