🐛 Correct "activation is not a boot" — the receipt was a WP-CLI artifact

[courtneyr-dev]

Adam Silverstein retracted the eps-301-redirects finding on PR #13198. Installed by hand through wp-admin the plugin is healthy — front page 200, wp-login.php 200, /wp-admin/ 302, no debug.log. Only the WP-CLI boot failed.

The mechanism is WP-CLI's, not WordPress's. WP-CLI requires wp-settings.php from inside WP_CLI\\Runner->load_wordpress(), and PHP executes an included file in the including scope. A plugin's file-scope $Var = new Thing() becomes a local of that method rather than a global; code reading it back with global $Var on init gets null and calls a method on it. It only fires when permalink_structure is empty — exactly what a fresh wp core install leaves behind, so CI hits it and real sites don't.

Verified independently here, in plain PHP with no WordPress involved:

included at global scope:    global is VISIBLE
included inside a method:    global is MISSING

The rule survives, sharper. Activation is still not a boot — but the boot must be an HTTP request, not wp eval, and a CLI-only fatal is a note, not a failure. Corrected in the learning loop's accepted controls, the ecosystem lane, both prompt fences, the plugin-author CI drop-in, and fleet-operators §4.

And it lands on us. scripts/core-preflight-probe.sh — merged to main this morning — boots the target through wp eval and has no HTTP check, so its exit 3 means "fataled under WP-CLI", a strictly larger set than "this release breaks this site." Documented in the script header and emitted in its output. Both controls still pass, but only because the fixture plugins happen not to use file-scope globals. Adding the HTTP half is now the priority on that page rather than a nicety.

What the 200-plugin run demonstrated is smaller than reported: its one failure wasn't real, so zero confirmed core-related plugin fatals out of 200, with instagram-feed the only remaining candidate and unverified here.

Original kept beside the correction rather than rewritten away, per refuted claims are assets. Draft comment revised again, still unfiled.

python3 scripts/check-repo.py passes clean.

[cursor]

Approved. Cursor Bugbot was not present after the first check poll, so that signal was skipped; no approval policy required human review and there were no existing findings. Reviewers were not assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}