# AffStackDev Image Manager — Master Technical Reference

Version 1.7.2 · AffStackDev · Current source contract

This reference describes the complete installed product: lifecycle, native UI, permissions, source ownership, compression and publication, all media workflows, portable recovery, remote transport, licensing and protected updates, the reviewed action provider, and its exact typed parameters. The [Complete Customer Reference](CUSTOMER-GUIDE.md) gives the corresponding operational procedures and control meanings.


## Releases since 1.7.0.4a — through 1.7.2

This reference describes release 1.7.2. The contracts below were written for 1.7.0.4a and are unchanged by the releases after it: 1.7.0.4b (Plugin Check compliance: escaping, translation and readme headers, no behaviour change), 1.7.0.4c (`Reviewed_Inputs::handle()` and `render()` answer a failed `Media_Actions::authorize()` with a plain 403 refusal instead of an uncaught exception), 1.7.0.5 (launch release, consolidates 1.7.0.4a to 1.7.0.4c), 1.7.0.5a (the bundled release signing key), 1.7.0.5b (the built-in customer guide describes the current release) 1.7.1 (the version number has three parts; no other change) and 1.7.2 (the customer guide and this reference use the names the screens show; no other change). `CHANGELOG.md` has each entry.

## Busy owner-lock handling — 1.7.0.4a

Issue fork of 1.7.0.4 (native update version `1.7.0.4.1`; `VERSION` is the numeric update version and `RELEASE_LABEL` is `1.7.0.4a`). Schema 4, Foundation contract 1.4, the 74 reviewed actions, licensing bytes, signing trust and the mutual exclusion of `Reviewed_Store` are unchanged.

**Defect corrected.** `Reviewed_Store::enter()` takes `GET_LOCK(name, 0)` and throws `RuntimeException('worker_busy')` when another connection holds the owner lock. The 1.7.0.4 instrumentation placed that call at the top of `Scheduler::ensure()`, which runs on every request through `init` (priority 20). No caller handled the exception. During a background batch (4–6 s deadline), a backup step, a reviewed execution, a license bridge hold, or another request's brief hold, every concurrent front-end, admin, AJAX, cron and WP-CLI request ended in a PHP fatal error. That included the plugin update screen. The release workflow reproduced it on MySQL 8.0: all ten probed pages returned HTTP 500 while the lock was held from a second connection.

**Contract now.** No request fails because the owner is busy. Mutual exclusion is unchanged: every path below either holds the lock or makes no Image Manager write.

| Entry point | Busy outcome |
|---|---|
| `init` → `Engine::ensure()` → `Scheduler::ensure()` | Read-only `wanted()` test first (not dispatching, single site, schema 4, `afsd_im_background_needed`, not paused); an idle site never takes the lock on a page view. If work is wanted and the lock is busy, `Reviewed_Store::housekeeping()` skips this view; the running worker reconciles via `Scheduler::reconcile()` and the two-minute recurring rescue remains. |
| `plugins_loaded` boot: `Repository::install()` on schema mismatch, `Upgrade::initialize()` on version change | Skipped for this request and retried on the next eligible administrator/WP-CLI request. |
| Runners `afsd_im_tick`, `afsd_im_wake`, `afsd_im_backup_continue`, `afsd_im_remote_backup_continue` | End quietly. Active backup/transfer jobs are rescheduled by their `init` ensure routines. |
| `afsd_im_probe` | Re-queued 30 s later with the same token/backend, so a busy moment is not reported as a host scheduler fault. |
| `afsd_im_remote_backup_scheduled` / `_schedule_retry` | Queues `afsd_im_remote_backup_schedule_retry` in 900 s, matching the existing `remote_schedule_busy` behavior. |
| Save observers (`add_attachment`, `edit_attachment`, `delete_attachment`, post-meta, `save_post`, product, comment) | Post-meta events other than `_wp_attached_file`, `_wp_attachment_metadata`, `_thumbnail_id` and `_product_image_gallery` return before the lock. Attachment save/delete and image-meta events wait at most 8 s (`enter(8)`); all other observers keep `enter(0)`. A still-busy observer keeps the 1.7.0.4 fail-safe path, which never fails the native save. |
| `attachment_fields_to_save` (`Library::save_fields`) | Waits at most 8 s, then returns the native post with a field error on `afsd_im_folder`; folder/collection fields are not applied. |
| `delete_attachment` (`Editor::attachment_deleted`) | Waits at most 8 s, then queues `afsd_im_retire_draft` with the draft record (validated again by `draft_path()`); `Editor::retire_deferred()` retries with back-off up to 12 attempts. Uninstall unschedules the hook. |
| `admin_post_afsd_im_google_callback` | Redirects to Backups with a "finishing background work" notice; no OAuth state or code is consumed. |
| Activation / deactivation | Wait at most 15 s. Activation then stops with a `wp_die` message. Deactivation then clears Image Manager cron and Action Scheduler work and completes without rewriting settings. |
| Licensing entry points | See below. |

**Licensing.** The licensing files are unchanged. Because the IM-owned option/HTTP bridges join the owner lock, a licensing step can stop with `worker_busy`. `Reviewed_Store::busy_safe_licensing()` runs right after `Licensing\Client::boot()`. It re-registers these callbacks at their original priorities inside a busy-only boundary: `init` schedule, the license cron, `admin_init` activity validation, the storefront shutdown validation queued at `template_redirect`, `admin_post_afsd_im_license` (notice reference `im_license_worker_busy`), `update_plugins_affstackdev.com` and `plugins_api` (previous value), and `upgrader_pre_download`, `upgrader_pre_install` and `upgrader_source_selection` (`WP_Error` `im_update_busy`). The aborted licensing operation behaves as before; only the uncaught exception is replaced. Every AffStackDev product uses the same License Server URL, so the HTTP bridge now joins the owner only for requests whose JSON `product_code` is `affstackdev-image-manager`, or that carry no product code. Another product's license request is never stopped by Image Manager.

**Not changed (follow-up).** A save observer that stays busy past its wait still loses that one tracking event, as in 1.7.0.4. A durable retry queue is tracked separately. WordPress has no `pre_add_option_{option}` filter, so the existing `pre_add_option_` bridge registrations never run. Licensing `add_option()` writes (for example `State::lock()`) are therefore not joined to the owner; this is unchanged and recorded.

**Verification.** `qa/staging/probes/owner_locks.py` holds the owner lock from a second MySQL connection. While it is held, the probe loads guest/admin/media/license/cron pages and runs WP-CLI drills: boot, runners, ordinary and image saves, media field save, media deletion, license bridge scope, protected download, deactivation and activation. It then reactivates the plugin after the lock is released.

## Automatic organization and protected provider — 1.7.0.4

`Auto_Organization::hooks()` observes native add_attachment/edit_attachment, generic post updates and `_wp_attached_file` / `_wp_attachment_metadata`. It only automatically categorizes image MIME attachments. No new database tables or media schema increment are introduced. Folder writes use the existing Image Manager owner lock and current execution guard; reviewed upload effects disclose the normal folder hooks. The 74 reviewed action IDs and strict input schemas are preserved.

`affstackdev_image_manager_organize_attachment(int $attachment_id, array $folder_paths)` is the owning importer interface. It requires current `upload_files` and `edit_post` permission and returns `WP_Error` or attachment/folder/path descriptors. Paths contain one to four plain labels, at most eight paths, each label at most 120 bytes. Hierarchical terms use deterministic parent/label identities. New paths replace only the plugin's owned automatic terms; manually assigned terms are retained. `_afsd_im_automatic_folders` records ownership; `_afsd_im_organization_paths` retains importer context. Native observers are internal trusted callbacks and do not grant a callable anonymous mutation route. The API does not accept filesystem paths, copy files, change image bytes, enable optimization or authorize public delivery.

`Protected_Library::listing($before, $folder)` is a read-through provider for Community >= 0.1.0.12. It requires current site-management and upload capabilities plus Community read access. It reads at most 100 metadata rows in descending-ID order, resolves each entry/profile through the Community service, and emits at most 24 currently authorized descriptors. Cursor pagination advances over inaccessible rows. Filter enum: all, posts, growoffs, groups, avatars, covers. Post hydration and profile-pointer authorization remain with Community. Protected binary URLs recheck access at delivery. Nothing is mirrored into `wp_posts`, attachment taxonomies or the public optimization index. There is no background private-image sync and no permission expansion.

Site-specific migration integrations are separate packages. No site content, learner records, products or account mappings are included in this generic Image Manager release. Context labels have no privacy meaning; authorization remains with each owning service. Native/AI folder choices and subsequent owning-provider changes are independent of image bytes.



## Product identity and runtime

| Identity | Current value |
|---|---|
| Product code / plugin slug | `affstackdev-image-manager` |
| Main plugin file | `affstackdev-image-manager/affstackdev-image-manager.php` |
| Plugin and release version | `1.7.2` |
| Immediate source parent | `1.7.0.4` |
| Update channel | `stable` |
| PHP namespace | `AffStackDev\ImageManager` |
| Database schema | `4` |
| Free foundation contract | `1.4`, edition `free` |
| Record, progress and delivery descriptors | Version `1` |
| Compression recipe policy | `compression-v2` |
| Optional display-size policy | `display-sizes-v1` |
| Portable archive namespace / version | `affstackdev-image-manager/media`, version `1` |
| Reviewed consumer contract | `afsd-reviewed-actions-v1`, registration schema `1` |
| Reviewed provider / revision | `image_manager` / `image-manager-actions-1` |
| Passive documentation manifest | `afsd-ai-capabilities.json`, schema version `1` |
| Installed technical / customer manuals | `docs/MASTER-TECHNICAL-REFERENCE.md`, `docs/CUSTOMER-GUIDE.md` |
| Minimum WordPress / PHP | `6.5` / `8.1`, single site |

The root plugin declares its release version, requirements, text domain and directory constants, loads its fixed service modules and public API, loads the protected-update owner, and registers lifecycle boot/activation/deactivation. Runtime services are available after successful supported-site boot and schema readiness. Network activation and multisite are refused. The readme's existing Tested up to metadata is 7.1; it is separate from the minimum requirement and the source's supported single-site guard.

The Free media foundation has no commercial entitlement, vendor account or Suite dependency. Host codecs, native WordPress capabilities and public eligibility constrain particular operations. Licensing manages the optional protected software-update credential and does not gate Free library organization, editing, optimization or portable recovery.

Activation creates/checks six indexed owner tables and initializes saved defaults and upgrade records. It does not authorize scanning, conversion or public delivery. `Upgrade::initialize` reconciles release health and existing legacy copy/progress records under the current schema; it preserves active or paused saved runs and per-image policy instead of applying a new compression intent to all media.

## Ownership and call boundaries

WordPress owns attachment records, uploads, native image metadata, thumbnail sizes, MIME validation, post/product/comment associations, taxonomy persistence, capability checks and software installation. The active theme or rendering component owns layout and crop/size requests. WooCommerce owns catalog state, gallery/variation interactions and native zoom/lightbox URLs. Image Manager owns only its declared image index, recipes, manifests, managed alternatives, observed public mappings, virtual organization, native media drafts, recovery snapshots and remote coordination.

Private drafts and backup archives are outside the public web root. Managed image alternatives are public upload assets and are published only for current eligible public sources. A path belonging to uploads is not by itself a public-content authorization. Unknown offload, unmapped direct URLs, unsupported markup and restricted source associations retain native output.

Inspection and preparation use fixed source-owned readers and serializers. Execution chooses one trusted catalog operation and passes normalized values to its native service. Parameters never select arbitrary PHP callbacks, SQL statements, option names, filesystem paths, REST routes, nonce values, cron hooks or service URLs. Raw secret values and arbitrary model-provided file URLs are not executable parameters.

## Native administration, permissions and forms

The standalone workspace is a Media submenu; a compatible Suite product renderer can supply shared product navigation. Optimize, Images, Backups, Settings and Tools are the owning screens. Images offers media-library Grid/List browsing, attachment details and indexed optimization results. Suite's global PHP mode overrides the local enhanced-interface preference while ordinary forms and schedules remain usable.

The Image Manager mutation handler uses `admin_post_afsd_im_action` and its authenticated AJAX counterpart. Requests select a fixed `operation`, require POST, verify nonce `afsd_im_action`, require `manage_options` plus `upload_files`, and check each target through its owning media/source permission routine. GET workspace filters only select read views. Download and external-consent branches use their fixed authenticated handlers; they are not ordinary JSON-returning mutation responses.

Native operations include start, step/tick, pause, resume, cancel, settings, codec/background checks, comparison prepare/apply/discard, bulk run, selected source changes, library upload/create/term/bulk, edit prepare/save/discard, PDF prepare/save, replacement prepare/apply/undo/recover, media-draft discard, local backup start/tick/status/pause/resume/cancel/download/delete/import/restore, remote settings/Google connect/disconnect/S3 test/upload/tick/status/pause/resume/cancel/download/fetch/delete, delivery check/browser result, and the fixed Tools downloads. Their complete reviewed equivalents and explicit human-only boundaries are listed in the action and field coverage files accompanying this reference.

Native licenses have their separate protected owner nonce and capability checks. Update queries additionally require `update_plugins`. The reviewed provider consistently requires the connected current administrator's `manage_options` and `upload_files`, and independently checks `update_plugins` for `license_updates`.

Editor and media-draft previews are nonce-protected private binary responses bound to the permitted attachment/draft. Browser inspection uses a signed-in native inspection route bound to a source signature and accepts bounded real observations through its own native handler. Usage inspection has a per-actor run/cursor and nonce. Google OAuth consent uses a bounded native redirect/callback and cannot be replaced by model-provided credentials or callback URLs.

## Settings and defaults

`afsd_im_settings` is a non-autoloaded owner option. `Settings::get` merges defaults; worker/control paths use fresh option reads. `Settings::patch` serializes through the native owner mutex and the existing settings lease. A supplied publication generation can only advance; stale forms cannot lower or reuse it. Deactivation and pause use the same owner.

| Field | Initial value | Current meaning |
|---|---|---|
| `public_policy` | `false` | Explicit native public-image authorization prerequisite |
| `delivery` | `false` | Global supported public markup substitution |
| `uploads` | `false` | Future upload processing after public association |
| `auto_discovery` | `false` | Deferred rechecks of known public pages |
| `local_cdn` | `false` | Exact supported Jetpack mapping may use local alternatives |
| `theme_images` | `true` | Include observed supported active-theme assets in scans |
| `catalog` | `true` | Include public visible WooCommerce product associations |
| `comments` | `true` | Include approved comments/reviews on eligible public content |
| `enhanced_ui` | `true` | Interactive interface, subordinate to Suite's PHP mode |
| `paused` | `false` | Worker pause, changed through workflow owners |
| `pause_reason` | Empty | Saved native reason, not a model-controlled free setter |
| `max_pixels` | `2000000` | Ordinary compression-source pixel bound |
| `max_bytes` | `12582912` | Ordinary compression-source byte bound |
| `min_free` | `134217728` | Minimum-free-space threshold |
| `min_saving` | `5` | Percent minimum useful saving |
| `generation` | `1` | Monotonic publication fence |
| `compression.mode` | `lossless` | `lossless`, `high`, `maximum` |
| `compression.content` | `auto` | `auto`, `photo`, `graphics` |
| `compression.effort` | `balanced` | `fast`, `balanced` |
| `compression.formats` | `auto` | `auto`, `native`, `webp`, `avif` |
| `compression.metadata` | `preserve` | `preserve`, `remove_gps` |

Only the nine exposed setting booleans and five compression recipe fields are accepted by `settings_update`. Pause is a workflow action. Resource bounds, pause reason and generation are internal owner state. An empty settings patch is rejected. Omitted fields are preserved; a partial compression object is merged into the current normalized recipe. Delivery, uploads or automatic discovery require a resulting true public-policy choice.

The ordinary native Settings form supplies the complete checkbox set and recipe, with the public and photographic acknowledgements. Source choices govern later scans and do not delete prepared copies. New defaults govern newly queued unprepared work; changing defaults does not relabel old verified alternatives.

## Index, mappings and public eligibility

`Repository` owns six tables under the current WordPress prefix. Source identity is a SHA-256 `source_key` and site-local source ID; attachments retain their native IDs. Revision, requested/excluded/delivery switches, state, priority, lane, retry due time, details and manifest are owner-controlled. Source rows group their native full/thumbnail families rather than creating unrelated logical sources for every output file.

Owner associations connect source IDs to permitted post/product/comment owners. Public posts must have a supported public post type/status and no password/private parent condition. Catalog associations use published visible WooCommerce products and their native gallery/variation relationships. Approved-comment eligibility also requires public eligible parent content. The public logo and theme source require observed owner mappings. Native visibility/deletion/meta observers invalidate stale public alternatives and update association bookkeeping.

`Sources::row_files` resolves safe real local native files and hashes their current bytes. Uploads mapping rejects paths escaping the uploads root, symlinks and unsupported offload sources. Theme mapping is restricted to observed JPEG/PNG/WebP assets belonging to the active parent or child theme, with theme identity and bytes in the source signature. Source/privacy filters can veto current publication. Arbitrary scanning of all theme files is not part of this owner.

`Urls::media` accepts recognized native uploads and bounded Jetpack `i0.wp.com`, `i1.wp.com`, `i2.wp.com` forms. CDN transforms must map exactly to supported native dimensions; crop/fit/quality or unknown transforms retain native output when ownership cannot be established. Existing managed-image URLs are not recursively treated as originals. Restricted `srcset` grammar accepts width descriptors, up to 32 candidates and 16 KiB, rejecting data/ambiguous URLs.

## Public page scanning and deferred discovery

`Scanner::start` saves a page-fetch budget of 30 and roots Home/Shop. Only depth 0/1 is queued. Catalog reads use five published visible products per batch; approved-comment reads use ten IDs per batch. The parser inspects public HTML, links, IMG/source candidates and supported native association metadata. Parsing is bounded; reaching a bound records incomplete coverage rather than asserting that every client-side image was found.

The same-origin page policy accepts HTTP/HTTPS site paths on ports 80/443, no credentials, traversal or unsafe encoding. It excludes administrative, login, API, cron, cart, checkout, account, member/private, subscription and verification routes, including actual WooCommerce role paths. Query keys are restricted to positive bounded numeric `p`, `page_id`, `paged`, `product-page`; duplicate/ambiguous or side-effect queries are rejected. The associated post is rechecked for public status, and a public-page filter can veto it.

Every network destination must resolve only to public allowed IPs. Private/reserved addresses, carrier-grade/multicast ranges and restricted IPv6 forms are rejected. Anonymous `wp_safe_remote_get` uses no cookies, an empty Authorization header, TLS verification, a 10-second timeout, a 2 MiB HTML bound and manual redirect checks with at most three redirects. Only HTTP 200 HTML/XHTML is accepted. Scanning does not execute a browser, CSS or JavaScript.

Transient DNS/blocked-request/408/429/500/502/503/504 failures retry only within the attempt bound. The attempt reservation is persisted before a fetch; source processing and public checks remain distinct from scanning.

`Auto_Discovery` is optional and stores up to 64 known-page jobs in `afsd_im_auto_discovery`, with notice state in `afsd_im_auto_discovery_notice`. Relevant native saves and active-theme events queue/debounce a known public page for 60 seconds. Enabling also queues current known roots/linked pages. The image worker yields to explicit runs and pending scanner work before taking one due recheck. Each job reserves its attempt before HTTP and rechecks eligibility after the response.

Rechecks can queue newly eligible Discovered/Held sources with delivery enabled and no exclusion or comparison draft. They do not reset already-ready, failed, excluded or per-image-original choices. Three bounded attempts use exponential 60-second native reservation timing; recent issues and cap/full notices persist separately so one later successful page does not erase another failure. Direct SQL, FTP, arbitrary builder fields and CSS edits do not substitute for supported owner events.

## Compression, codec verification and file publication

`Policy::clean` accepts only the five recipe allowlists. Lossless plus explicit AVIF is rejected. Auto content selects Graphics for alpha, PNG and conservative filename hints; otherwise Photo. Graphics/alpha force lossless fidelity. The recipe key hashes the normalized recipe and `compression-v2`, separating an older copy's policy from a current request.

Photographic High Quality uses JPEG 92, WebP 90 or AVIF 75; Maximum Savings uses JPEG 82, WebP 78 or AVIF 58. These are encoder-specific scales. Native PNG can verify decompressed scanlines; supported lossless paths require exact decoded pixel/alpha checks; native JPEG coefficient-preserving transforms additionally require a safe jpegtran path and decoded-pixel verification. Lossy candidates require their sampled SSIM/color-error gate. Unsupported metadata structures, profiles, alpha changes, unsafe native encoder behavior, time/output limits or failed metadata round trip retain the native source.

Host capabilities are measured through actual native sample encoding/verification and stored by `Compression`, separately from extension existence. GD, Imagick, native tools and their supported recipe paths are chosen by the owner. Existing WebP source handling and unsupported input formats retain the owner-defined original behavior. Input parsing checks MIME/structure, size, pixel count, alpha/color and metadata before an encoder can publish a candidate.

Compression retains a candidate only when its verified byte size meets the native minimum-saving policy. Per-size outcome state explains No saving, Held, Unsupported or Failed. Managed filenames bind source identity, policy, dimensions and output hash. Temporary output is validated before atomic native rename into `uploads/affstackdev-image-manager`; existing colliding filenames are accepted only if exact output hash matches. Symlinks, unsafe roots, stale source/revision/generation, revoked eligibility or lost worker leases cannot publish new alternatives.

The manifest contains schema/revision, recipe, per-native-size variants, optional responsive alternatives, comparison draft, pending publication journal and retained former copies. The owner records copy count, copy bytes and saved bytes; those counters describe generated alternatives, not disk reclamation or browser timing.

## Display-size generation, comparisons and bulk selection

`Responsive` adds optional separately identified display derivatives. GD resampling is required. It preserves the master aspect ratio, does not crop or upscale, compares native family gaps and considers 320/480/640/960/1280/1600 widths with at most four additions. Resized reference files receive the normal same-size compression verification. Unsupported alpha/metadata/format or incomplete useful families are held. Publication repeats the source/recipe/revision/lease/generation checks.

`Preview::start` queues a new comparison draft only for a permitted eligible public nonexcluded source with no conflicting requested work. A recipe and public acknowledgement are explicit. Current delivered copies remain the published family until apply. `Preview::assert_ready` is shared by native and reviewed preparation/application: completed draft, no unfinished request, nonempty accepted variants, unchanged source hash/metadata/revision and verified output files are required. Apply adopts the draft's policy, copies and publication state; discard removes that active draft. Retired copies are retained within the native history bound for cached URLs, and managed cleanup is a separate explicit operation.

`Batch` accepts Optimize, Retry, Original, Optimized, Exclude, Include or Check. Selection is Checked IDs (native maximum 1000), This page (20) or All matching results. A strict reviewed explicit selection accepts at most 100 natural source references. Filter/search select the same owner query; All matching includes the whole saved set. A single insertion freezes IDs in `afsd_im_batch`; later discoveries never silently join it.

Optimization choices are Apply versus Review, Existing versus Balanced display sizes, and All/Missing/Verify target. The saved job owns the recipe, selection, actor, acknowledgements and delivery choice. Permission or eligibility changes skip the individual member. Native states Waiting, Working, Checking, Complete, Review, Skipped and Failed record selection outcome. Selected source controls and reviewed actions use the same `Reviewed_Owner::source_change` dispatch to Repository, Engine and cleanup rather than a separate generic option writer.

## Worker coordination and progress

`Workflow` owns the image job, explicit scan/bulk run lifecycle and bounded batch control. Browser-assisted work has a six-second soft budget and up to eight units; background work has a four-second budget and up to four units. Local CLI Work permits 1–20 bounded batches and respects Pause. A soft batch limit does not terminate a native operation already in progress.

`Repository` uses expiring compare-and-set lease tokens, including the worker and settings/publication leases. Publication checks the token and current row revision. `Scheduler` uses a complete compatible Action Scheduler API when available, otherwise WordPress cron. Its two-minute recurring rescue and near-term wakeups are coordination, not a public remote worker endpoint. Independent health probes carry a token/backend and can be marked executed only by their own scheduled callback.

`Progress` binds its record to the native run identity/start time and stores the last durable stage/checkpoint/activity and current-run outcomes. `Activity` is a bounded owner history. Inventory counts, run counts, background probe, browser assistance and verification results retain their separate meanings. A slow-stage observation does not auto-restart the job or rewrite its result.

Pause advances generation and saves a reason; resume uses the current saved state; cancel marks remaining nonterminal batch members skipped and retains files/history. Native observation callbacks catch bookkeeping failures so a normal WordPress media/content save can complete, while attempting to pause unsafe delivery/automatic work with an actionable saved tracking reason.

## Front-end delivery and WooCommerce

`Delivery` processes already-generated permitted IMG/native markup through `WP_HTML_Tag_Processor`. It requires global delivery, source delivery, current public eligibility, native size/hash/metadata mapping and a valid verified manifest. It preserves owner layout, native dimensions, crop/zoom/lightbox metadata and unsupported constructs. It does not encode, scan or schedule new work in a visitor's render request.

Existing picture elements, scripted/lazy markup, unsupported custom attributes or offload mappings preserve the native fragment. Safe responsive candidates are substituted only within a supported native family and aspect ratio. Optional local-CDN delivery is restricted to exactly matched Jetpack request forms and known local native dimensions.

Simple WooCommerce galleries can use managed display files while zoom/lightbox sources remain native. Classic variable-product output uses `Woo_Delivery` and `woo-delivery.js` to coordinate the existing variation attributes and switches, returning unknown custom swaps to native behavior. Blocks and custom galleries remain native unless their rendering owner invokes the public helper on a supported fragment. The plugin does not rewrite variation relationships or force a gallery layout.

## Delivery verification and usage inspection

`Verification::signature` binds a current source/manifest/delivery state. Public HTML check uses the allowed anonymous page fetch and records matches/kind/status/time under source details. It describes offered markup. Signed-in browser inspection observes actual IMG `currentSrc`, dimensions/DPR and selected file evidence and submits a bounded native result up to 128 KiB. Old signatures are rejected. There is no reviewed action accepting arbitrary browser-observation data; `delivery_check` invokes only the native public-page owner.

`Media_Usage` has one per-actor report per selected attachment in the expiring `afsd_im_usage_<actor>` transient. It freezes an upper content ID, saves run/cursor and reads at most 40 items per 1.5-second soft batch. Content/excerpt is bounded to 256 KiB, checked metadata to 16 KiB and findings to 100. Native featured image, product gallery/variation, supported block/gallery-shortcode/content URL, embedded and PDF-preview associations are examined only for currently permitted owners. The native report stores More/Done/Limit. Enhanced JS continues bounded requests while visible; PHP exposes explicit continuation. No arbitrary shortcode, block, theme or builder execution occurs during inspection.

## Virtual media organization and text metadata

`Library` registers attachment taxonomies `afsd_im_folder` (hierarchical) and `afsd_im_collection` (flat). Native IDs remain local. Create/rename/delete use WordPress term APIs with cleaned nonempty names up to 120 bytes. Folder create accepts an existing parent; collection create has no parent. Native taxonomy deletion changes relationships and child taxonomy handling, never attached files.

Membership Add appends the resolved set, Remove detaches the resolved set, Set replaces it including explicit empty clearing. The assignment APIs validate the taxonomy and permitted IDs. WordPress's native attachment form exposes one Folder selector and the collection checkbox set; Image Manager's bulk form supports the broader native memberships. Media-modal hooks add these organization controls to native details without taking over other query owners.

Bulk text metadata uses separate native Set flags. Title and alt are sanitized single-line plain text; caption is multiline plain text. Explicit selected empty values clear the field. Omitted/unchecked fields remain unchanged. Nonimage alt is ignored. The reviewed field object contains only supplied title/caption/alt values, translated to the same native set flags. Attachment description is inherited by copy-first editing and portable recovery but is not a new generic model-controlled text setter.

`Media_Display` reads saved MIME types, supplies the complete type/sort filters and scopes its temporary order filter to its own `WP_Query`. Library pagination is 30; results pagination is 20. PDF browsing reuses only safe existing saved raster previews with bounded dimensions/extension and does not render a page or download the PDF into an IMG.

## Editor, PDF and replacement services

`Editor` accepts safe local JPEG/PNG/WebP/AVIF, maximum 64 MiB, 24 million pixels and edge 16384. It uses WordPress's native image-editor backend. Cleaned recipe applies rotation, flip, crop then bounded downsize, with no upscale and no no-op draft. Preset crops are 1:1, 4:3, 3:2, 16:9; custom coordinates must fit after rotation. Output lives in a private `edit-<32hex>.<allowed extension>` file and its attachment draft records actor/source identity/recipe/dimensions/MIME/hash/time.

Save verifies the current source and draft, publishes the copy through native attachment APIs, generates WordPress metadata, inherits source title-derived naming/caption/description/alt/parent/organization, and writes `_afsd_im_edit_source`, `_afsd_im_edit_recipe` and bounded source history. It leaves source assignments unchanged. Discard removes only that private draft. Editor drafts expire after 24 hours; actor/attachment/nonce protect preview streaming.

`PDF` converts one existing page from 1–500 at 144 DPI to sRGB stripped white-flattened PNG with output edge 320–2560. It requires working Imagick/Ghostscript PDF policy and enforces native image resource constraints (memory/map 128 MiB, disk 256 MiB, 24-million-pixel area, one thread, 20-second render and bounded image-list/edge resources). `Media_Draft` binds its private convert draft to actor, source and output hash. Save creates a new PNG attachment, native sizes, caption/organization and source/recipe lineage. The PDF and page usage remain owned by WordPress.

`Media_Replacement` prepares one same-MIME uploaded image through `Media_Actions` and records a private replacement draft. Apply holds the per-attachment OS lock, verifies unchanged source, limits old family to 128 files/512 MiB, creates and verifies the old family's recovery ZIP, and journals applying before publishing new file metadata. New family is bounded to 64 files. The attachment ID is stable, the new files/URLs are different and old files remain. The journal includes revision, old/new family and fields, safety snapshot and state.

Undo accepts only the latest applied matching revision with verified retained old files/current new fields, journals undoing, then restores former file metadata. Recover accepts interrupted applying/undoing only when mixed current fields match recorded old/new values; unrelated third-party edits are not overwritten. Final states are Applied, Undone or Recovered. The replacement workflow's fixed native lock/filesystem service is shared with reviewed actions; private drafts and safety snapshots are not model-generated paths.

## Portable recovery format and local job

`Backup` owns site identity, snapshot index, local job, private storage, validators, archive import/export and selective restore. FORMAT is `affstackdev-image-manager/media`; FORMAT_VERSION is 1. Essential includes originals, text/native metadata, organization and supported edit/optimizer preferences. Published additionally includes available native sizes and managed files. Neither profile includes site code/configuration, keys, customers/orders or content relationship reassignment.

The archive layout includes `README`, `manifest.json`, `media.ndjson`, `checksums.sha256` and files beneath `media/<portable-id>/`. Portable IDs are 64-character SHA-256 identities; native attachment IDs are historical same-site references, not cross-site insertion IDs. Records describe original name/MIME/size/hash, title/caption/description/alt, timestamps, supported native metadata, folders/collections, edit recipe/source data and optimization preferences. File roles distinguish Original, Native size and Managed alternatives; checksums identify exact entry bytes.

Snapshot scopes are All, Folder or Collection for the current actor. Selection freezes the maximum attachment ID; subsequent attachments are outside that intent. Local job stages Selecting, Packaging, Finalizing, Complete, Cancelled/Failed have their native counters and last error. Image processing receives its native priority. Export checks source hashes before/after copy and packaged bytes before completion. Bounds include 1 GiB/file, 2 GiB/family, 100000 records, 500000 ZIP entries and bounded error history.

`Private_Storage` accepts canonical local directories outside uploads/webroot, verifies ownership/mode/symlink conditions and refuses unsupported private Windows ACL assumptions. `AFSD_IM_BACKUP_DIR` selects the native private root; otherwise native temporary storage is used. Private archive names/index paths are generated by the owner. Download checks the archive checksum and streams through authenticated native controls. Delete removes the selected snapshot and its sidecars, not media attachments.

ZIP encryption is separate from ordinary ZipArchive readiness. A real native AES capability check is required; passwords must have at least eight characters and matching confirmation. Saved automatic-job credentials are wrapped with site secrets. Passwords are absent from portable metadata and reviewed project parameters.

Import validates the strict format/header/records/checksum relationship; bounded duplicate or case-colliding paths, traversal, symlink/special entries and unexpected unsafe names are rejected. Extraction addresses validated entries into generated native private paths. Selective Restore as new creates destination-native IDs and metadata. In-place restore requires matching backup site UUID, existing permitted ID and MIME, and a verified safety snapshot. Original files are restored; WordPress rebuilds native metadata and taxonomy names/hierarchy are mapped or created. Supported recipe/exclusion/delivery preferences are restored through the owner, and old derived files are not blindly promoted as current output. Pages/products are not reassigned automatically.

## Remote settings, authentication and transfer state

`Remote_Backup` stores one current provider configuration and separate native transfer/index/wait coordination. Defaults are None, Manual, Essential, All, retention 3, keep local true, scheduled encryption false. Daily/Weekly schedules create their selected native snapshot, then upload it. First scheduled trigger is delayed by 300 seconds; busy native work can defer by 900 seconds. Automatic execution depends on actual host cron callbacks.

Configuration normalization preserves omitted reviewed booleans and existing secret fields. Native blank credentials retain existing encrypted values. Google client identity/secret changes invalidate refresh token/folder; S3 destination/key identity changes invalidate its verified readiness signature. Retention is 1–30. Folder/collection scope resolves an existing native term; All resets scope ID to zero.

Remote secrets use authenticated AES-256-GCM wrapping bound to WordPress site secrets. Supported server constants are `AFSD_IM_GOOGLE_CLIENT_ID`, `AFSD_IM_GOOGLE_CLIENT_SECRET`, `AFSD_IM_S3_ACCESS_KEY`, `AFSD_IM_S3_SECRET_KEY`. The UI and read-only inspection return readiness, not secret content. An unreadable value after a salts change requires re-entry through the native credential owner.

Google uses user-supplied OAuth web-app identity, `drive.file` consent, a site/admin-bound state expiring in ten minutes, the site's fixed admin-post callback, protected refresh token and an owner-created folder. Allowed Google OAuth/API and resumable hosts are checked. Disconnect removes local refresh/folder identity and leaves remote archive objects and Google's independent account-level consent unchanged.

S3 endpoint is normalized to HTTPS hostname plus permitted port, no user/password/path/query/fragment or literal IP/localhost. Bucket uses native bounded lowercase syntax; region defaults to `us-east-1` when invalid. Prefix is at most twelve safe segments, each at most 80 bytes, with a trailing slash. Signature V4 uses the current exact bucket/key/prefix/path-style choice. Connection test requires PUT, verified HEAD and confirmed DELETE of its bounded probe; failed probe cleanup does not mark readiness.

Both providers transfer in 5 MiB chunks. Google resumable uploads reconcile confirmed offsets after 308/ambiguous responses and verify final size/MD5. S3 stores multipart upload identity, accepted part ETags, completes it, verifies HEAD length/SHA metadata, then downloads the full private archive for length/SHA-256 confirmation. Complete remote history is recorded only after those owner checks. Retries use bounded native 60/300/900-second delays for transient cases. Pause retains session; resume advances the saved session. Cancel aborts an existing S3 multipart upload and records Confirmed/Unconfirmed/Not required separately from local Cancelled.

Remote index entries carry current-destination fingerprint, provider object reference, snapshot ID, name, size, SHA-256, uploaded time and integrity/encryption. Only matching current destination entries are manageable. Fetch downloads privately, verifies and imports the portable archive. Delete requires an accepted provider removal/already-absent result before index removal. Retention prunes only older verified matching destination entries after a newly verified upload. Keep local false permits deletion of the completed local archive only after remote verification. Downloads and Google account consent remain native authenticated human flows.

## Protected licensing and software update contract

The ten files under `includes/licensing/` are the existing product owner. The pinned server is `https://affstackdev.com/wp-json/affstackdev-license-server/v1/`; product code, slug and plugin file match the identity table. The stable signing key ID is `affstackdev-release-2026-10` and trusted public key is `lZ5BHKXIvHTzPDQ5Si1LTVXRCqwQ8F/+dW3Xz2dyR+s=`.

`State` records installation UUID, canonical site URL, environment and activation type. Activation exchanges a root key for the identity-bound installation token. `Vault` stores active/pending tokens protected by the site's crypto owner and enforces token syntax. A request UUID and pending credential are saved before material HTTP; ambiguous activation recovery validates the same pending identity and promotes only an accepted matching response. Normal validation sends the installation token, not the root key.

The API-v1 response validator requires exact product, installation, site, environment, activation type, supported license status, term/grace boundaries and advertised features. Accepted cache state is MAC-protected. Active or server-issued Grace remains effective only until its accepted deadline. Normal validation uses the native approximately twelve-hour interval/jitter bounded by the earlier term/grace deadline; transient failures use the native short retries without extending that deadline or inventing offline grace. Automatic background/admin-activity validation is bounded and yields away from checkout/account/API/AJAX/mutation contexts; compatible sibling owners coordinate operation volume per PHP request.

`Client` owns activate, validate and remote deactivate. Forget current site clears local credential/state while retaining installation identity and does not release the remote activation. New-site identity is allowed for an identity mismatch/copied-site condition, replacing the copied local identity without touching the original remote activation. Native plugin deactivation cancels validation schedules and retains credential/remote activation. Free media availability is independent of update authorization.

`Updater` requires the advertised installation-token update feature. It validates bounded protected catalog/download grants, persists request identity for ambiguous retries and checks release version ordering. It verifies Ed25519 over exact manifest bytes, known signing key, archive size/SHA, product/slug/plugin-file/channel/requirements and exact runtime inventory. Two proof files are the manifest and detached signature; unsafe paths, duplicate/case-colliding entries, symlinks/special files, extra/missing runtime files and tampering are refused. Unpacked runtime verification repeats before replacement. Modified signed installations block silent overwrite; an unsigned prior install can take its first correctly signed update. WordPress remains owner of installation/automatic-update opt-in.

## Complete reviewed native provider

`Reviewed_Actions::boot` subscribes to `afsd_connector_register_actions`. The trusted PHP hook registers the fixed catalog once per lazy shared-registry load. Each definition includes exact provider/plugin identity, title, material-effect description, contract revision, strict JSON schema and native callbacks: availability, permission, inspect, prepare, assert_current, execute and reconcile. No passive JSON/manual content supplies executable callbacks.

The plugin identity is `plugin:affstackdev-image-manager/affstackdev-image-manager.php`. Availability requires the Free foundation 1.4 and supported MySQL/MariaDB InnoDB owner tables. The shared consumer also enforces plugin inclusion, active installation, registered schema identity, actor/site, authenticated scopes and project revision. Current native admin permissions and per-attachment rights are rechecked rather than inherited permanently from token creation.

All 74 action schemas reject additional properties. Primitive types are strict; strings do not coerce to booleans or integers. Root parameters are a JSON object of at most 16 KiB in the shared consumer. Object/array/field bounds are explicit in the action appendix; empty objects are real objects at registry exposure. Trusted definitions fit the unchanged consumer's bounded schema vocabulary.

Natural attachment lookup resolves exact native ID, title or stored filename, then bounded permitted title matches. Source lookup resolves source ID or permitted title/details. Folder/collection names use their actual taxonomy; same-name labels can be ambiguous across folder parents. Snapshot names/IDs resolve current local index entries. More than one permitted match is a blocker, with bounded candidates, not an inferred selection. Model-supplied direct paths/SQL selectors are absent.

### Read-only inspection and preparation

The `inspect` sections are Settings, Workflow, Sources, Library, Drafts, Backups, Remote, Licensing, Health, Inputs and Intent. Lists use offset/limit, at most 20 per requested page, and the native response ceiling. Library pagination includes organization labels even after attachment rows are exhausted. Backups can inspect a selected snapshot's portable records. Draft inspection resolves one permitted attachment. Intent inspection is bound to the actor/site/marker. Secrets, root keys, installation tokens and private file paths are not returned as model authority.

Other action inspections run the same read-only plan used for prepare and return resolved targets, before values, normalized expected result and native secure-input location. Inspection and prepare never call Settings save, file publication, mutation, enqueue, native HTTP writers or speculative license initialization. Host readiness is read from saved state and read-only host capability checks.

A plan binds full selected attachment metadata/org/file hash, source row/files/revision/public eligibility, exact native term IDs/names/parents, settings, full relevant image/backup/remote jobs, snapshot/record identity, private draft/input hash and environment identity. Environment includes WordPress, PHP, active plugin versions read fresh from headers, MU plugins, active theme identity/version, schema and site. Bulk All/Page selection binds count, whole frozen query digest and first-page identities, and permits further bounded inspection pages.

Prepare returns stable state, nonempty expected-after, complete plain-text review rows and material effects. Supplied and normalized fields and before values appear in the review. HTML/control values are represented with visible JSON escapes. Long text is split into complete bounded UTF-8 chunks rather than silently shortened. The shared limit is 50 change rows, 20 effects/notices and 32 KiB each state/expected result. A proposal exceeding the bounds is rejected for a smaller separately reviewed group. Omitted editable fields remain retained; explicit false/empty values have their native clear meaning.

### Approval, atomic native ownership and receipts

Project creation, native human review and explicit Apply belong to AffStackDev AI. A prepared project alone cannot execute. The provider receives the exact prepared snapshot/proposed object plus execution context containing project ID, marker and live guard. The marker format is `afsd-connector:<64 lowercase hex>`; project IDs have the shared `project_<UUID>` form. Identity is actor/site/project/marker/hash of the exact prepared object; identical parameter sets in different approved projects remain different operations.

`Reviewed_Store` holds a reentrant connection-owned MySQL mutex named from site prefix and installation path. Native Image Manager settings, repository, library, workflow, scheduler, editors, PDF/replacement, backup, remote, observation and binary/SQL/file writers use that owner. Licensing option/HTTP bridges join the same owner without modifying licensing implementation bytes; the HTTP bridge applies only to Image Manager's own (or unidentified) License Server requests. A competing native Image Manager writer fails busy, and a reviewed apply cannot bypass it. Since 1.7.0.4a, page loads, runners, boot maintenance, licensing entry points and native saves handle busy without a PHP fatal (see the 1.7.0.4a section); `enter(int $wait = 0)` accepts a wait of at most 15 s for human media saves and lifecycle actions only.

Reviewed availability verifies InnoDB for WordPress options/posts/postmeta/terms/term taxonomy/relationships and all six Image Manager tables. Before business effects, the store persists an exact execution receipt and target reservations. It then starts a repeatable-read transaction and locks target posts/meta/relationships, organization rows/gaps when applicable, and owned option rows. Fresh authoritative state is rechecked under those locks. Guards run before native database/options/meta, scheduling, HTTP and file mutations and throughout multi-target/batch owner loops. The executing owner recognizes its own serialized intermediate changes while still checking current actor/target rights and environment.

File and remote effects cannot be honestly rolled back by a database rollback. The owner retains actual partial state and an Unknown durable receipt after interruption. It never automatically repeats an unknown write. Target reservations prevent a second distinct business operation from hiding an unresolved outcome. Native explicit recovery/cancellation/discard/credential controls can operate through their declared reviewed recovery paths.

On native return, the store saves authoritative evidence and an owner-returned flag, reads the saved native outcome, checks the stable expected subset and writes a Complete receipt. A queued job receipt confirms native queue state, not finished encoding or downloaded browser bytes. Metadata/membership/settings use their exact readback; new files use native attachment lineage/dimensions/hashes; replacement uses state/hash/recovery snapshot; snapshots use archive hash/index; remote results use native provider acceptance/integrity; licenses use accepted owner state hashes. Replaying the same marker returns its evidence and does not create a duplicate attachment, job or provider request.

### Read-only reconciliation and explicit recovery

Reconcile checks the exact receipt binding and current permission. A Complete record returns the historical saved result without rewriting it after later native edits. A returned native owner with an interrupted completion receipt can be reread and verified against its exact expected result. The provider does not mutate owner options, files, queues, secrets or provider objects during reconciliation. The shared review engine can record its own newly verified receipt. A Core-applied matching project proves completion for reservation checks even when the owner receipt itself remained Unknown during read-only reconciliation.

If authoritative evidence is missing or mismatched, the result remains Unknown. Inspection explains saved native state. `intent_release` is a separate approved owner action for an already-Unknown consumer project and same actor/site; it marks its prior reservation released, retaining the prior status/evidence and adding release identity/time. It neither confirms, repeats nor undoes the business effects. It cannot release a currently Executing shared project. Later business actions require a new exact review and guard.

### Secure native input references

`Reviewed_Inputs` supplies a nonce-protected native POST form for Media upload, Replacement, Backup import, Backup password, Remote credentials and License root key. Uploaded files require actual PHP `is_uploaded_file`, allowed native MIME, nonlink local temporary bytes and host limits. Media permits 1–8 files; replacement/import one; staging file bounds are 64 MiB or 2 GiB for ZIP, also constrained by WordPress upload size. Replacement also validates native image MIME/structure; ZIP staging verifies a consistent ZIP before the portable importer later validates the format.

Private file storage uses a generated outside-webroot directory with 0700 owner permissions and files 0600. References are random 32 lowercase hex, actor/site/purpose/expiry-bound. File identity includes name, byte count, MIME and SHA-256; secret identity reveals only readiness. Secrets are AES-256-GCM wrapped with a key derived from WordPress auth salts, 12-byte IV and 16-byte tag. Root key bound is 128 bytes; passwords/cloud fields are bounded to 1024; backup/scheduled passwords need at least eight bytes and exact confirmation.

File references expire in 24 hours; secrets in ten minutes. They become consumed by the exact approved marker before native use. Only that currently executing marker can continue using a consumed reference. New projects cannot use it again. Hourly bounded cleanup removes expired staging records/files; deactivation/uninstall clears that callback. Native sideload uses the real WordPress media service after human staging. Google consent, raw secret entry, binary downloads and actual browser measurements remain explicit native human boundaries.

## Public PHP API and extension ownership

```php
affstackdev_image_manager_is_available(string $minimum = '1.0'): bool
affstackdev_image_manager_contract(): array
affstackdev_image_manager_render_image_html($html, $attachment_id = 0): string
affstackdev_image_manager_delivery_contract(): array
```

Availability accepts numeric two- or three-component foundation minimums and requires successful boot; two components normalize to a three-component comparison. Contract is the stable read-only Free descriptor: product/release/edition/readiness/schema, feature choices, ownership, record contract, public safety, export format and integration matrix. It includes no site/customer data, filenames, filesystem paths, license keys or credentials. `afsd_im_ready` fires once per successful boot with that descriptor and conveys notification rather than mutable authority.

Render image HTML receives an existing native fragment and optional known attachment ID, returns current safe delivery markup, and performs no encoding/settings mutation. A nonstring input produces the owner-defined empty result. Delivery contract identifies this function, layout/derivative ownership, current integration matrix and browser proof requirements. A compatible rendering owner must preserve its own layout/gallery semantics and permit native fallback rather than asserting unsupported output was optimized.

The source hook appendix below lists all fixed actions and filters, their source locations and argument expressions. Public privacy filters are veto points, not commercial entitlement selectors. The descriptor cannot be replaced by a model manifest or a caller-provided arbitrary implementation.

## Assets and request behavior

`admin.js` manages bounded workspace navigation, progress polling, native action submission, bulk checks and operation-specific status refresh. PHP fallback forms supply the same owning operations. `admin.css` styles only the workspace. `media-modal.js` coordinates native attachment organization fields. `media-usage.js` continues saved usage batches while the view is visible. `inspector.js` captures real browser image observations for the explicit native inspection. `woo-delivery.js` coordinates the supported classic variation gallery with its native data; unknown gallery behavior remains native.

Assets are versioned by the current release and loaded only on their relevant owner surfaces. The plugin does not expose a public unauthenticated file mutation endpoint or run encoder/file writes during a normal front-end image rendering request.

## Release package, signing and update ordering

The installer is the exact current source folder plus passive manifest and the two canonical Markdown manuals. Companion DOCX/PDF editions carry the same manuscript text. The developer pack contains the exact action catalog, native control/action/field coverage, source/hook/method/register inventories and the receiving first-pass contract. The installed manuals describe only current behavior; release process records and native validation evidence live separately.

The preserved release recipe identifies product/slug/plugin file/stable channel and existing Ed25519 public pin. Production signing uses the existing owner's workstation toolkit and private key at its established private path. `sign-release.py` validates installer checksum/version/runtime inventory, trusted recipe/public key and exact toolkit bytes before signing, verifies every signed runtime file and detached proof, and refuses conflicting existing output. Its handoff function carries all manual editions and integration material with the signed artifact.

The substantial phase is 1.7.0.4 after 1.7.0.2, with native increasing update ordering; 1.7.0.4a is its issue fork with native update version 1.7.0.4.1. The universal rule retains each product's baseline; main phases use `x.x.x.P`, issue forks `Pa`–`Pz`, nested forks `Pa1`–`Pa99`, with separate numeric update ordering if a native platform would interpret a suffix as an earlier alpha. Never rewrite a signed package to change its version. Product identity, protected licensing and signing trust are stable ownership contracts.

Deactivation clears workers/license/backup/remote/input cleanup and disables delivery/uploads/discovery while retaining media and credentials. If the owner is still busy after 15 s, it clears the scheduled work only and leaves settings unchanged. Uninstall clears callbacks and retains source files, tables, organization, settings, generated copies and recovery records. Explicit managed cleanup requires global delivery off and cache-owner handling; native attachment deletion and remote license deactivation remain separate actions.

## Complete action and input reference

Every action below uses the same current actor/site, availability, strict schema, native review, live guard and exact-marker receipt contract. Required means required by that JSON object; conditional native prerequisites still apply. Optional parameters are retained/defaulted by the named owner as described in the operation chapters. Additional properties are forbidden at every object level. Array entries and nested properties are listed explicitly so a training consumer can distinguish each control.

Read-only `inspect` requires only the Read scope when invoked through inspection. Executable projects use Propose, native human approval and Apply. Owner services and effect descriptions are fixed trusted source data. Empty-parameter operations accept `{}`. `input_reference` and `secret_reference` contain only an unexpired native staging identifier, never the file bytes or secret.

### 1. Read Image Manager state

`image_manager.inspect` · Native screen: All screens · Owner: `Reviewed_Owner::inspect`

Read current permitted state and readiness. No media, settings or job changes.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `section` | string | Required | Choices: `settings`, `workflow`, `sources`, `library`, `drafts`, `backups`, `remote`, `licensing`, `health`, `inputs`, `intent`; Maximum length: `9`; Choose the current read-only settings/jobs/media/draft/backup/remote/license/health/input/intent reader. |
| `query` | string | Optional | Maximum length: `160`; Optional bounded source/library search; omitted means unfiltered current page. |
| `attachment` | string | Optional | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `source` | string | Optional | Maximum length: `160`; Resolve one eligible site-local indexed source. source:ID or permitted natural name; ambiguity blocks. |
| `snapshot` | string | Optional | Maximum length: `160`; Existing local snapshot ID or exact scope label; ambiguous labels require its actual ID. |
| `marker` | string | Optional | Maximum length: `100`; Exact prior actor/site-bound execution marker, used for readonly intent inspection or explicit unknown reservation recovery. |
| `offset` | integer | Optional | Minimum: `0`; Maximum: `100000`; Read pagination offset, default 0; no hidden write or processing is triggered. |
| `limit` | integer | Optional | Minimum: `1`; Maximum: `20`; Requested bounded read page size, default 10; smaller pages can fit the shared response limit. |


### 2. Change image settings

`image_manager.settings_update` · Native screen: Settings · Owner: `Settings::patch`

Save the exact changed settings; advance publication generation. Delivery can change newly rendered public output; automatic processing can schedule future work.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `settings` | object | Required | Only declared properties; Partial saved image configuration. At least one field is required by the native plan; omissions retain current values. |
| `settings.public_policy` | boolean | Optional within supplied object | Strict boolean; Optional saved public_policy patch; omitted retains current. Explicit false disables the switch. |
| `settings.delivery` | boolean | Optional within supplied object | Strict boolean; Optional saved delivery patch; omitted retains current. Explicit false disables the switch. |
| `settings.uploads` | boolean | Optional within supplied object | Strict boolean; Optional saved uploads patch; omitted retains current. Explicit false disables the switch. |
| `settings.auto_discovery` | boolean | Optional within supplied object | Strict boolean; Optional saved auto_discovery patch; omitted retains current. Explicit false disables the switch. |
| `settings.local_cdn` | boolean | Optional within supplied object | Strict boolean; Optional saved local_cdn patch; omitted retains current. Explicit false disables the switch. |
| `settings.theme_images` | boolean | Optional within supplied object | Strict boolean; Optional saved theme_images patch; omitted retains current. Explicit false disables the switch. |
| `settings.catalog` | boolean | Optional within supplied object | Strict boolean; Optional saved catalog patch; omitted retains current. Explicit false disables the switch. |
| `settings.comments` | boolean | Optional within supplied object | Strict boolean; Optional saved comments patch; omitted retains current. Explicit false disables the switch. |
| `settings.enhanced_ui` | boolean | Optional within supplied object | Strict boolean; Optional saved enhanced_ui patch; omitted retains current. Explicit false disables the switch. |
| `settings.compression` | object | Optional within supplied object | Only declared properties; Optional normalized compression choice; omitted retains the current recipe field. |
| `settings.compression.mode` | string | Optional within supplied object | Choices: `lossless`, `high`, `maximum`; Maximum length: `8`; Optional normalized compression choice; omitted retains the current recipe field. |
| `settings.compression.content` | string | Optional within supplied object | Choices: `auto`, `photo`, `graphics`; Maximum length: `8`; Optional normalized compression choice; omitted retains the current recipe field. |
| `settings.compression.effort` | string | Optional within supplied object | Choices: `fast`, `balanced`; Maximum length: `8`; Optional normalized compression choice; omitted retains the current recipe field. |
| `settings.compression.formats` | string | Optional within supplied object | Choices: `auto`, `native`, `webp`, `avif`; Maximum length: `6`; Optional normalized compression choice; omitted retains the current recipe field. |
| `settings.compression.metadata` | string | Optional within supplied object | Choices: `preserve`, `remove_gps`; Maximum length: `10`; Optional normalized compression choice; omitted retains the current recipe field. |


### 3. Scan public image sources

`image_manager.scan_start` · Native screen: Optimize · Owner: `Workflow::start`

Start a bounded public site scan and save progress. Public page HTTP requests and local source indexing follow; scan-only leaves delivery switches unchanged.

Parameters: `{}`. All properties are forbidden.


### 4. Start an optimization run

`image_manager.optimization_start` · Native screen: Optimize · Owner: `Batch::start`

Scan the enabled public sources, freeze the selected images and queue the exact compression/size recipe. Apply mode publishes validated copies; review mode leaves comparisons for later approval. Originals remain unchanged.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `compression` | object | Optional | Only declared properties; Partial normalized recipe; omissions merge current recipe; invalid combinations are rejected. |
| `compression.mode` | string | Optional within supplied object | Choices: `lossless`, `high`, `maximum`; Maximum length: `8`; Optional mode compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.content` | string | Optional within supplied object | Choices: `auto`, `photo`, `graphics`; Maximum length: `8`; Optional content compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.effort` | string | Optional within supplied object | Choices: `fast`, `balanced`; Maximum length: `8`; Optional effort compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.formats` | string | Optional within supplied object | Choices: `auto`, `native`, `webp`, `avif`; Maximum length: `6`; Optional formats compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.metadata` | string | Optional within supplied object | Choices: `preserve`, `remove_gps`; Maximum length: `10`; Optional metadata compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `bulk_intent` | string | Optional | Choices: `apply`, `review`; Maximum length: `6`; Omitted apply. apply publishes accepted results; review prepares comparison drafts for separate adoption. |
| `sizing` | string | Optional | Choices: `existing`, `balanced`; Maximum length: `8`; Omitted existing. balanced permits separately identified useful missing display widths with no crop/upscale. |
| `target` | string | Optional | Choices: `all`, `missing`; Maximum length: `7`; Omitted all. all requests the selection; missing retains existing ready output; verify checks native saved/delivery evidence. |
| `public_policy` | boolean | Optional | Strict boolean; Explicit resulting public-use authorization prerequisite for publication/automatic processing; false clears it only when dependent switches permit. |
| `delivery` | boolean | Optional | Strict boolean; Optional desired delivery choice; omitted retains current native global choice for a run. Settings false restores newly rendered native markup. |
| `verify_after_apply` | boolean | Optional | Strict boolean; Omitted false; schedules the native post-apply delivery verification within the batch workflow. |


### 5. Pause image work

`image_manager.workflow_pause` · Native screen: Optimize / Tools · Owner: `Workflow::pause`

Pause before the next image operation and invalidate stale publication; prepared copies remain.

Parameters: `{}`. All properties are forbidden.


### 6. Resume image work

`image_manager.workflow_resume` · Native screen: Optimize / Tools · Owner: `Workflow::resume`

Resume saved image work and scheduling.

Parameters: `{}`. All properties are forbidden.


### 7. Stop image run

`image_manager.workflow_cancel` · Native screen: Optimize / Tools · Owner: `Workflow::cancel`

Cancel the saved run and hold queued work; prepared copies and original files remain.

Parameters: `{}`. All properties are forbidden.


### 8. Process image work here

`image_manager.workflow_advance` · Native screen: Optimize / Tools · Owner: `Workflow::run_batch`

Perform one native bounded batch; local files, indexing and public page checks can advance. Saved work and pause state govern eligibility.

Parameters: `{}`. All properties are forbidden.


### 9. Check background scheduling

`image_manager.background_check` · Native screen: Tools · Owner: `Scheduler::check`

Queue an independent native scheduling probe. Queued is distinct from independently executed.

Parameters: `{}`. All properties are forbidden.


### 10. Check local encoders

`image_manager.codec_check` · Native screen: Tools · Owner: `Compression::capabilities`

Run native local encoder self-checks and save host capability results.

Parameters: `{}`. All properties are forbidden.


### 11. Queue a compression comparison

`image_manager.comparison_prepare` · Native screen: Images / Compare compression · Owner: `Preview::start`

Queue comparison files without changing delivery.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `source` | string | Required | Maximum length: `160`; Resolve one eligible site-local indexed source. source:ID or permitted natural name; ambiguity blocks. |
| `compression` | object | Required | Only declared properties; Partial normalized recipe; omissions merge current recipe; invalid combinations are rejected. |
| `compression.mode` | string | Optional within supplied object | Choices: `lossless`, `high`, `maximum`; Maximum length: `8`; Optional mode compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.content` | string | Optional within supplied object | Choices: `auto`, `photo`, `graphics`; Maximum length: `8`; Optional content compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.effort` | string | Optional within supplied object | Choices: `fast`, `balanced`; Maximum length: `8`; Optional effort compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.formats` | string | Optional within supplied object | Choices: `auto`, `native`, `webp`, `avif`; Maximum length: `6`; Optional formats compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.metadata` | string | Optional within supplied object | Choices: `preserve`, `remove_gps`; Maximum length: `10`; Optional metadata compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |


### 12. Approve prepared compression copies

`image_manager.comparison_apply` · Native screen: Images / Compare compression · Owner: `Preview::apply`

Publish the exact ready copies after source and output checksum validation; delivery switches remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `source` | string | Required | Maximum length: `160`; Resolve one eligible site-local indexed source. source:ID or permitted natural name; ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 13. Discard compression comparison

`image_manager.comparison_discard` · Native screen: Images / Compare compression · Owner: `Preview::discard`

Retire the selected candidate files while retaining approved copies and originals.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `source` | string | Required | Maximum length: `160`; Resolve one eligible site-local indexed source. source:ID or permitted natural name; ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 14. Queue image optimization

`image_manager.source_optimize` · Native screen: Images / selected actions · Owner: `Reviewed_Owner::source_change`

Queue image optimization through the source repository; originals are retained.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `sources` | array | Required | Minimum items: `1`; Maximum items: `20`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |
| `sources[]` | string | Required | Maximum length: `160`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |


### 15. Retry saved image policy

`image_manager.source_retry` · Native screen: Images / selected actions · Owner: `Reviewed_Owner::source_change`

Retry saved image policy through the source repository; originals are retained.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `sources` | array | Required | Minimum items: `1`; Maximum items: `20`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |
| `sources[]` | string | Required | Maximum length: `160`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |


### 16. Exclude images

`image_manager.source_exclude` · Native screen: Images / selected actions · Owner: `Reviewed_Owner::source_change`

Exclude images through the source repository; originals are retained.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `sources` | array | Required | Minimum items: `1`; Maximum items: `20`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |
| `sources[]` | string | Required | Maximum length: `160`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |


### 17. Include images again

`image_manager.source_include` · Native screen: Images / selected actions · Owner: `Reviewed_Owner::source_change`

Include images again through the source repository; originals are retained.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `sources` | array | Required | Minimum items: `1`; Maximum items: `20`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |
| `sources[]` | string | Required | Maximum length: `160`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |


### 18. Use original delivery

`image_manager.source_original` · Native screen: Images / selected actions · Owner: `Reviewed_Owner::source_change`

Disable each selected source delivery switch. Cached pages retain their prior output until cleared.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `sources` | array | Required | Minimum items: `1`; Maximum items: `20`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |
| `sources[]` | string | Required | Maximum length: `160`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |


### 19. Allow optimized delivery

`image_manager.source_optimized` · Native screen: Images / selected actions · Owner: `Reviewed_Owner::source_change`

Enable each source delivery switch; global delivery and public eligibility still govern output.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `sources` | array | Required | Minimum items: `1`; Maximum items: `20`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |
| `sources[]` | string | Required | Maximum length: `160`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |


### 20. Remove managed copies

`image_manager.source_cleanup` · Native screen: Images / selected actions · Owner: `Reviewed_Owner::source_change`

Delete managed alternatives only with global delivery disabled. Clear page/CDN caches before removing files; originals are retained.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `sources` | array | Required | Minimum items: `1`; Maximum items: `20`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |
| `sources[]` | string | Required | Maximum length: `160`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |


### 21. Run a frozen image bulk selection

`image_manager.bulk_run` · Native screen: Images / Bulk editor · Owner: `Batch::start`

Freeze the native selected/page/all-matching source set and queue the chosen operation. The approved selection fingerprint is checked again under the owner lock; later discoveries are not silently added.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `bulk` | string | Required | Choices: `optimize`, `retry`, `original`, `optimized`, `exclude`, `include`, `check`; Maximum length: `9`; One fixed bulk source transition; normal hooks, permissions and source processing rules apply. |
| `scope` | string | Required | Choices: `selected`, `page`, `matching`; Maximum length: `8`; Bulk selected/page/matching scopes freeze source IDs. Backup/remote all/folder/collection scopes resolve native organization. |
| `sources` | array | Optional | Minimum items: `0`; Maximum items: `100`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |
| `sources[]` | string | Required | Maximum length: `160`; Resolve the exact selected indexed source set. Deduplicate and bind each source revision/file/public state. |
| `filter` | string | Optional | Choices: ``, `ready`, `queued`, `waiting`, `no_saving`, `held`, `unsupported`, `kept`, `failed`, `excluded`; Maximum length: `11`; Exact owner result filter for the frozen selection; omitted empty/all. |
| `search` | string | Optional | Maximum length: `100`; Exact bounded search text for a frozen bulk selection; omitted empty. |
| `page` | integer | Optional | Minimum: `1`; Maximum: `100000`; PDF page is required; bulk selection page defaults to 1. Native page and actual PDF existence are checked. |
| `compression` | object | Optional | Only declared properties; Partial normalized recipe; omissions merge current recipe; invalid combinations are rejected. |
| `compression.mode` | string | Optional within supplied object | Choices: `lossless`, `high`, `maximum`; Maximum length: `8`; Optional mode compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.content` | string | Optional within supplied object | Choices: `auto`, `photo`, `graphics`; Maximum length: `8`; Optional content compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.effort` | string | Optional within supplied object | Choices: `fast`, `balanced`; Maximum length: `8`; Optional effort compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.formats` | string | Optional within supplied object | Choices: `auto`, `native`, `webp`, `avif`; Maximum length: `6`; Optional formats compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `compression.metadata` | string | Optional within supplied object | Choices: `preserve`, `remove_gps`; Maximum length: `10`; Optional metadata compression choice; omission merges current per-source/run policy; actual host capability and fidelity rules apply. |
| `bulk_intent` | string | Optional | Choices: `apply`, `review`; Maximum length: `6`; Omitted apply. apply publishes accepted results; review prepares comparison drafts for separate adoption. |
| `sizing` | string | Optional | Choices: `existing`, `balanced`; Maximum length: `8`; Omitted existing. balanced permits separately identified useful missing display widths with no crop/upscale. |
| `target` | string | Optional | Choices: `all`, `missing`; Maximum length: `7`; Omitted all. all requests the selection; missing retains existing ready output; verify checks native saved/delivery evidence. |
| `public_policy` | boolean | Optional | Strict boolean; Explicit resulting public-use authorization prerequisite for publication/automatic processing; false clears it only when dependent switches permit. |
| `delivery` | boolean | Optional | Strict boolean; Optional desired delivery choice; omitted retains current native global choice for a run. Settings false restores newly rendered native markup. |
| `verify_after_apply` | boolean | Optional | Strict boolean; Omitted false; schedules the native post-apply delivery verification within the batch workflow. |


### 22. Create a folder

`image_manager.folder_create` · Native screen: Media / Organization · Owner: `Library::create_term`

Create a virtual organization label. File paths, URLs and media IDs remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `name` | string | Required | Minimum length: `1`; Maximum length: `120`; Nonempty organization name, cleaned by the native term owner; rename changes only the label. |
| `parent` | string | Optional | Maximum length: `160`; Existing parent folder; omitted or empty chooses the top level for create. |


### 23. Rename a folder

`image_manager.folder_rename` · Native screen: Media / Organization · Owner: `Library::change_term`

Rename a virtual label.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `term` | string | Required | Maximum length: `160`; Existing exact folder/collection name or #ID for the operation taxonomy; folder names can be ambiguous across parents. |
| `name` | string | Required | Minimum length: `1`; Maximum length: `120`; Nonempty organization name, cleaned by the native term owner; rename changes only the label. |


### 24. Delete a folder

`image_manager.folder_delete` · Native screen: Media / Organization · Owner: `Library::change_term`

Delete the organization label and its relationships; attachments and files remain. Child folders follow native WordPress term deletion behavior.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `term` | string | Required | Maximum length: `160`; Existing exact folder/collection name or #ID for the operation taxonomy; folder names can be ambiguous across parents. |


### 25. Add media folder membership

`image_manager.folder_add` · Native screen: Media / selection and native attachment fields · Owner: `Library::assign / detach`

Change the exact virtual membership; set replaces the selected taxonomy memberships and an empty set clears them. Paths and attachment IDs remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachments` | array | Required | Minimum items: `1`; Maximum items: `100`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `attachments[]` | string | Required | Maximum length: `160`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `terms` | array | Required | Minimum items: `0`; Maximum items: `20`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |
| `terms[]` | string | Required | Maximum length: `160`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |


### 26. Remove media folder membership

`image_manager.folder_remove` · Native screen: Media / selection and native attachment fields · Owner: `Library::assign / detach`

Change the exact virtual membership; set replaces the selected taxonomy memberships and an empty set clears them. Paths and attachment IDs remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachments` | array | Required | Minimum items: `1`; Maximum items: `100`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `attachments[]` | string | Required | Maximum length: `160`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `terms` | array | Required | Minimum items: `0`; Maximum items: `20`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |
| `terms[]` | string | Required | Maximum length: `160`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |


### 27. Set media folder membership

`image_manager.folder_set` · Native screen: Media / selection and native attachment fields · Owner: `Library::assign / detach`

Change the exact virtual membership; set replaces the selected taxonomy memberships and an empty set clears them. Paths and attachment IDs remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachments` | array | Required | Minimum items: `1`; Maximum items: `100`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `attachments[]` | string | Required | Maximum length: `160`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `terms` | array | Required | Minimum items: `0`; Maximum items: `20`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |
| `terms[]` | string | Required | Maximum length: `160`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |


### 28. Create a collection

`image_manager.collection_create` · Native screen: Media / Organization · Owner: `Library::create_term`

Create a virtual organization label. File paths, URLs and media IDs remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `name` | string | Required | Minimum length: `1`; Maximum length: `120`; Nonempty organization name, cleaned by the native term owner; rename changes only the label. |


### 29. Rename a collection

`image_manager.collection_rename` · Native screen: Media / Organization · Owner: `Library::change_term`

Rename a virtual label.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `term` | string | Required | Maximum length: `160`; Existing exact folder/collection name or #ID for the operation taxonomy; folder names can be ambiguous across parents. |
| `name` | string | Required | Minimum length: `1`; Maximum length: `120`; Nonempty organization name, cleaned by the native term owner; rename changes only the label. |


### 30. Delete a collection

`image_manager.collection_delete` · Native screen: Media / Organization · Owner: `Library::change_term`

Delete the organization label and its relationships; attachments and files remain. Child folders follow native WordPress term deletion behavior.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `term` | string | Required | Maximum length: `160`; Existing exact folder/collection name or #ID for the operation taxonomy; folder names can be ambiguous across parents. |


### 31. Add media collection membership

`image_manager.collection_add` · Native screen: Media / selection and native attachment fields · Owner: `Library::assign / detach`

Change the exact virtual membership; set replaces the selected taxonomy memberships and an empty set clears them. Paths and attachment IDs remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachments` | array | Required | Minimum items: `1`; Maximum items: `100`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `attachments[]` | string | Required | Maximum length: `160`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `terms` | array | Required | Minimum items: `0`; Maximum items: `20`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |
| `terms[]` | string | Required | Maximum length: `160`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |


### 32. Remove media collection membership

`image_manager.collection_remove` · Native screen: Media / selection and native attachment fields · Owner: `Library::assign / detach`

Change the exact virtual membership; set replaces the selected taxonomy memberships and an empty set clears them. Paths and attachment IDs remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachments` | array | Required | Minimum items: `1`; Maximum items: `100`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `attachments[]` | string | Required | Maximum length: `160`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `terms` | array | Required | Minimum items: `0`; Maximum items: `20`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |
| `terms[]` | string | Required | Maximum length: `160`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |


### 33. Set media collection membership

`image_manager.collection_set` · Native screen: Media / selection and native attachment fields · Owner: `Library::assign / detach`

Change the exact virtual membership; set replaces the selected taxonomy memberships and an empty set clears them. Paths and attachment IDs remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachments` | array | Required | Minimum items: `1`; Maximum items: `100`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `attachments[]` | string | Required | Maximum length: `160`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `terms` | array | Required | Minimum items: `0`; Maximum items: `20`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |
| `terms[]` | string | Required | Maximum length: `160`; Exact membership set for the current taxonomy; Add/Remove affect selected labels; Set replaces and can explicitly clear with an empty list. |


### 34. Change media metadata

`image_manager.metadata_update` · Native screen: Media / Edit selected details · Owner: `Library::update_metadata`

Save supplied title, caption and image alternative text, including explicit empty values. Omitted fields remain. Existing page-specific alternative text is not rewritten; native WordPress hooks run.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachments` | array | Required | Minimum items: `1`; Maximum items: `100`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `attachments[]` | string | Required | Maximum length: `160`; Resolve the whole selected permitted media set; preserve independent native IDs; deduplicate before execution. |
| `fields` | object | Required | Only declared properties; Only explicitly changed native title/caption/alt; a nonempty field object is required. Explicit empty clears; omitted retains. |
| `fields.title` | string | Optional within supplied object | Maximum length: `1000`; Explicit empty clears this native title; omitted retains. Native plain-text sanitization applies. |
| `fields.caption` | string | Optional within supplied object | Maximum length: `8000`; Explicit empty clears this native caption; omitted retains. Native plain-text sanitization applies. |
| `fields.alt` | string | Optional within supplied object | Maximum length: `4000`; Explicit empty clears this native alt; omitted retains. Image-only; nonimage targets ignore alt. |


### 35. Upload securely staged media

`image_manager.media_upload` · Native screen: Media / Upload to this folder · Owner: `Reviewed_Inputs::upload`

Create WordPress attachments from one to eight human-staged files, generate native metadata and assign the approved folder. Normal upload hooks and enabled future-upload processing may run. New images without an explicit folder receive their automatic Website images category. Explicitly approved folders take precedence.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `input_reference` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; 32-hex actor/site/purpose-bound human file staging reference; consumed by one approved marker. |
| `folder` | string | Optional | Maximum length: `160`; Existing folder for a new native upload; omitted/empty means no folder assignment. |


### 36. Prepare a private image edit

`image_manager.edit_prepare` · Native screen: Media / Editor · Owner: `Editor::prepare`

Render a private draft using rotation, flip, crop then bounded downsize. Replace the prior draft; the original and public uses remain unchanged.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `editor` | object | Required | Only declared properties; Partial native editor recipe, completed with its defaults; at least one effective operation and no upscale. |
| `editor.crop` | string | Optional within supplied object | Choices: `none`, `1x1`, `4x3`, `3x2`, `16x9`, `custom`; Maximum length: `6`; Omitted none; presets or custom crop fit the transformed source. |
| `editor.rotate` | string | Optional within supplied object | Choices: `none`, `cw90`, `ccw90`, `180`; Maximum length: `5`; Omitted none; rotation precedes flip/crop/resize. |
| `editor.flip` | string | Optional within supplied object | Choices: `none`, `horizontal`, `vertical`; Maximum length: `10`; Omitted none; flip follows rotation. |
| `editor.crop_x` | integer | Optional within supplied object | Minimum: `0`; Maximum: `16384`; Native editor recipe field; conditional crop/resize validation applies. |
| `editor.crop_y` | integer | Optional within supplied object | Minimum: `0`; Maximum: `16384`; Native editor recipe field; conditional crop/resize validation applies. |
| `editor.crop_width` | integer | Optional within supplied object | Minimum: `0`; Maximum: `16384`; Native editor recipe field; conditional crop/resize validation applies. |
| `editor.crop_height` | integer | Optional within supplied object | Minimum: `0`; Maximum: `16384`; Native editor recipe field; conditional crop/resize validation applies. |
| `editor.resize_width` | integer | Optional within supplied object | Minimum: `0`; Maximum: `16384`; Omitted 0; zero unsets this resize constraint, positive values cannot upscale. |
| `editor.resize_height` | integer | Optional within supplied object | Minimum: `0`; Maximum: `16384`; Omitted 0; zero unsets this resize constraint, positive values cannot upscale. |


### 37. Save edited copy

`image_manager.edit_save` · Native screen: Media / Editor · Owner: `Editor::save_copy`

Create a separate attachment with inherited text and organization, native sizes and edit lineage; remove the private draft.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 38. Discard image edit

`image_manager.edit_discard` · Native screen: Media / Editor · Owner: `Editor::discard`

Delete only the selected private edit draft.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 39. Prepare a PDF page image

`image_manager.pdf_prepare` · Native screen: Media / Convert · Owner: `PDF::prepare`

Render one selected PDF page locally to a private white-background PNG draft. Host Imagick/PDF policy governs readiness; PDF remains unchanged.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `page` | integer | Required | Minimum: `1`; Maximum: `500`; PDF page is required; bulk selection page defaults to 1. Native page and actual PDF existence are checked. |
| `maximum_edge` | integer | Required | Minimum: `320`; Maximum: `2560`; PDF output longest edge; required bounded native render parameter. |


### 40. Save a converted PDF page

`image_manager.pdf_save` · Native screen: Media / Convert · Owner: `PDF::save`

Create one PNG attachment with native sizes and organization from the exact draft; the source PDF remains unchanged.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 41. Discard PDF page preview

`image_manager.pdf_discard` · Native screen: Media / Convert · Owner: `Media_Draft::discard`

Delete the private page conversion preview.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 42. Prepare a replacement preview

`image_manager.replace_prepare` · Native screen: Media / Replace · Owner: `Reviewed_Inputs::replacement`

Stage the human-supplied same-type image as a private replacement draft after source validation; the live attachment remains unchanged.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `input_reference` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; 32-hex actor/site/purpose-bound human file staging reference; consumed by one approved marker. |


### 43. Apply media replacement

`image_manager.replace_apply` · Native screen: Media / Replace · Owner: `Media_Replacement::apply`

Create a verified recovery ZIP and new native file family, then point the same attachment ID at the new files. New URLs affect attachment-based uses; hardcoded URLs and caches require separate review.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 44. Undo media replacement

`image_manager.replace_undo` · Native screen: Media / Replace · Owner: `Media_Replacement::undo`

Restore the latest verified previous file family and metadata. The replacement files are retained; hardcoded content URLs are not rewritten.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 45. Recover media replacement

`image_manager.replace_recover` · Native screen: Media / Replace · Owner: `Media_Replacement::undo`

Explicitly recover a partially applied replacement to the verified before family. This is a new reviewed compensating intent; automatic reconciliation never invokes it.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 46. Discard media replacement

`image_manager.replace_discard` · Native screen: Media / Replace · Owner: `Media_Draft::discard`

Delete only the selected private replacement draft; applying drafts cannot be discarded.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |
| `draft` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; Exact current edit/comparison/convert/replacement draft or replacement journal token, not a new token supplied by a model. |


### 47. Create a portable media backup

`image_manager.backup_start` · Native screen: Backups / Create · Owner: `Backup::start / Remote_Backup::start_backup`

Freeze eligible attachment IDs and package portable media, text, organization and checksums. Published profile includes approved derivative files. Remote destination queues a transfer after verification; retention and local-copy settings can remove older backup copies.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `profile` | string | Optional | Choices: `essential`, `published`; Maximum length: `9`; Local backup default essential; published includes available native sizes/managed files. Remote omission preserves current saved profile. |
| `scope` | string | Optional | Choices: `all`, `folder`, `collection`; Maximum length: `10`; Bulk selected/page/matching scopes freeze source IDs. Backup/remote all/folder/collection scopes resolve native organization. |
| `term` | string | Optional | Maximum length: `160`; Existing exact folder/collection name or #ID for the operation taxonomy; folder names can be ambiguous across parents. |
| `destination` | string | Optional | Choices: `local`, `remote`; Maximum length: `6`; Omitted local. remote requires a ready current connection and saves local-to-remote coordination. |
| `encrypted` | boolean | Optional | Strict boolean; Omitted false; true requires native AES ZIP capability and secure matching password reference. |
| `secret_reference` | string | Optional | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; 32-hex actor/site/purpose-bound human secret staging reference; no plaintext secret is accepted here. |


### 48. Pause local backup

`image_manager.backup_pause` · Native screen: Backups · Owner: `Backup::pause`

Pause the current backup while retaining saved staging.

Parameters: `{}`. All properties are forbidden.


### 49. Resume local backup

`image_manager.backup_resume` · Native screen: Backups · Owner: `Backup::resume`

Resume the saved backup.

Parameters: `{}`. All properties are forbidden.


### 50. Cancel local backup

`image_manager.backup_cancel` · Native screen: Backups · Owner: `Backup::cancel`

Stop the incomplete job and remove its staging; existing media and completed snapshots remain.

Parameters: `{}`. All properties are forbidden.


### 51. Advance local backup

`image_manager.backup_advance` · Native screen: Backups · Owner: `Backup::work`

Perform one bounded native backup batch and verify completed archive entries; completion may queue the configured remote transfer.

Parameters: `{}`. All properties are forbidden.


### 52. Delete a local snapshot

`image_manager.backup_delete` · Native screen: Backups / Local history · Owner: `Backup::delete_snapshot`

Delete that local archive and sidecars plus its index record; attachments remain.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `snapshot` | string | Required | Maximum length: `160`; Existing local snapshot ID or exact scope label; ambiguous labels require its actual ID. |


### 53. Selectively restore media

`image_manager.backup_restore` · Native screen: Backups / Inspect and restore · Owner: `Backup::restore`

Restore the exact verified original, native metadata and organization. New mode allocates a new attachment; same-site in-place creates a safety recovery point before changing the editable existing attachment. Page/product relationships are not rewritten.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `snapshot` | string | Required | Maximum length: `160`; Existing local snapshot ID or exact scope label; ambiguous labels require its actual ID. |
| `portable_id` | string | Required | Minimum length: `64`; Maximum length: `64`; Exact 64-hex portable media record inside the selected validated snapshot; not a destination-native attachment ID. |
| `mode` | string | Required | Choices: `new`, `in_place`; Maximum length: `8`; Compression mode chooses lossless/high/maximum. Restore mode new creates native IDs; in_place requires matching site/attachment and safety snapshot. |
| `secret_reference` | string | Optional | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; 32-hex actor/site/purpose-bound human secret staging reference; no plaintext secret is accepted here. |


### 54. Import a human-staged portable ZIP

`image_manager.backup_import` · Native screen: Backups / Bring in a backup · Owner: `Backup::import_file_path`

Validate archive names, manifest, counts and checksums, then add a private local snapshot for inspection. This action does not restore attachments.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `input_reference` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; 32-hex actor/site/purpose-bound human file staging reference; consumed by one approved marker. |
| `secret_reference` | string | Optional | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; 32-hex actor/site/purpose-bound human secret staging reference; no plaintext secret is accepted here. |


### 55. Change backup destination settings

`image_manager.remote_settings_update` · Native screen: Backups / Backup destination · Owner: `Remote_Backup::save_settings`

Preserve omitted settings and credentials; save supplied fields and reschedule. Changing Google app identity invalidates its saved connection; changing S3 identity invalidates its verification. Retention prunes older destination copies after future verified uploads; keep-local false removes completed local copies after verified transfers.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `provider` | string | Optional | Choices: `none`, `google`, `s3`; Maximum length: `6`; Optional current destination none/google/s3; omission preserves it. Changing identity can invalidate readiness. |
| `schedule` | string | Optional | Choices: `manual`, `daily`, `weekly`; Maximum length: `6`; Optional manual/daily/weekly; omission preserves saved schedule; host scheduled callbacks run the job. |
| `profile` | string | Optional | Choices: `essential`, `published`; Maximum length: `9`; Local backup default essential; published includes available native sizes/managed files. Remote omission preserves current saved profile. |
| `scope` | string | Optional | Choices: `all`, `folder`, `collection`; Maximum length: `10`; Bulk selected/page/matching scopes freeze source IDs. Backup/remote all/folder/collection scopes resolve native organization. |
| `term` | string | Optional | Maximum length: `160`; Existing exact folder/collection name or #ID for the operation taxonomy; folder names can be ambiguous across parents. |
| `retention` | integer | Optional | Minimum: `1`; Maximum: `30`; Optional 1–30 count; omission preserves current value; prunes only matching verified copies after a new verified upload. |
| `keep_local` | boolean | Optional | Strict boolean; Omission preserves current value; false permits completed local snapshot removal only after remote verification. |
| `schedule_encrypt` | boolean | Optional | Strict boolean; Omission preserves current choice; enabling needs native AES ZIP support and a protected saved password. |
| `google_client_id` | string | Optional | Maximum length: `255`; Optional nonsecret client ID; empty explicitly clears; owner cleans/bounds it and invalidates old consent identity when changed. |
| `s3_endpoint` | string | Optional | Maximum length: `2048`; Optional nonsecret HTTPS hostname/port endpoint; no credentials/path/query/fragment/IP/localhost; empty selects native default endpoint. |
| `s3_region` | string | Optional | Maximum length: `32`; Optional native region string; invalid is normalized to us-east-1; omission preserves current. |
| `s3_bucket` | string | Optional | Maximum length: `63`; Optional bounded native bucket; empty clears configuration; omission retains current. |
| `s3_prefix` | string | Optional | Maximum length: `1024`; Optional prefix normalized to safe bounded segments/trailing slash; empty selects owner default. |
| `s3_path_style` | boolean | Optional | Strict boolean; Optional addressing choice; false selects virtual-hosted mode; omission retains current. |
| `secret_reference` | string | Optional | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; 32-hex actor/site/purpose-bound human secret staging reference; no plaintext secret is accepted here. |


### 56. Disconnect Google Drive

`image_manager.remote_google_disconnect` · Native screen: Backups / Google Drive · Owner: `Remote_Backup::disconnect_google`

Clear the local Drive refresh token, folder identity and connection time; remote files remain.

Parameters: `{}`. All properties are forbidden.


### 57. Test the S3 destination

`image_manager.remote_s3_test` · Native screen: Backups / S3 connection · Owner: `Remote_Backup::test_s3`

PUT a temporary private object, HEAD its size/checksum and attempt its deletion. Record readiness only after the owner check; report incomplete cleanup instead of verified success.

Parameters: `{}`. All properties are forbidden.


### 58. Queue a local snapshot transfer

`image_manager.remote_upload` · Native screen: Backups / Local history · Owner: `Remote_Backup::queue_existing`

Queue a transfer of the verified local ZIP to the current ready destination. Transfer completion, retention pruning and configured local-copy removal happen through the native worker.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `snapshot` | string | Required | Maximum length: `160`; Existing local snapshot ID or exact scope label; ambiguous labels require its actual ID. |


### 59. Pause remote transfer

`image_manager.remote_pause` · Native screen: Backups / Remote transfer · Owner: `Remote_Backup::pause`

Pause saved transfer progress.

Parameters: `{}`. All properties are forbidden.


### 60. Resume remote transfer

`image_manager.remote_resume` · Native screen: Backups / Remote transfer · Owner: `Remote_Backup::resume`

Resume the saved transfer and schedule.

Parameters: `{}`. All properties are forbidden.


### 61. Cancel remote transfer

`image_manager.remote_cancel` · Native screen: Backups / Remote transfer · Owner: `Remote_Backup::cancel`

Cancel the transfer and attempt S3 multipart abort when relevant; local media and verified remote snapshots remain.

Parameters: `{}`. All properties are forbidden.


### 62. Advance remote transfer

`image_manager.remote_advance` · Native screen: Backups / Remote transfer · Owner: `Remote_Backup::work`

Perform the native bounded transfer batch; can upload chunks, verify the remote object, prune retention and delete the local copy when configured.

Parameters: `{}`. All properties are forbidden.


### 63. Fetch remote backup to local recovery

`image_manager.remote_fetch` · Native screen: Backups / Remote history · Owner: `Remote_Backup::fetch_local`

Download and checksum-verify the same destination object before importing it privately for local inspection; no attachment restore.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `remote_id` | string | Required | Minimum length: `32`; Maximum length: `32`; Exact saved remote index ID manageable under the current destination fingerprint. |
| `secret_reference` | string | Optional | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; 32-hex actor/site/purpose-bound human secret staging reference; no plaintext secret is accepted here. |


### 64. Delete a remote backup

`image_manager.remote_delete` · Native screen: Backups / Remote history · Owner: `Remote_Backup::delete_remote`

Delete the exact current-destination backup object and remove its native index record after provider acceptance.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `remote_id` | string | Required | Minimum length: `32`; Maximum length: `32`; Exact saved remote index ID manageable under the current destination fingerprint. |


### 65. Start media usage check

`image_manager.usage_start` · Native screen: Media / Where is this used · Owner: `Media_Usage::step`

Check at most 40 saved content items and save the per-actor report. Supported references only, up to 100 findings; native content permissions apply.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |


### 66. Continue media usage check

`image_manager.usage_continue` · Native screen: Media / Where is this used · Owner: `Media_Usage::step`

Check at most 40 saved content items and save the per-actor report. Supported references only, up to 100 findings; native content permissions apply.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `attachment` | string | Required | Maximum length: `160`; Resolve one currently permitted WordPress media item; native ID, exact title/filename, then bounded name lookup. Ambiguity blocks. |


### 67. Check saved public-page markup

`image_manager.delivery_check` · Native screen: Images / Compare / Delivery · Owner: `Verification::check_row`

Fetch mapped public page HTML and record the native signature-bound delivery result. HTML matches do not prove the browser downloaded a derivative.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `source` | string | Required | Maximum length: `160`; Resolve one eligible site-local indexed source. source:ID or permitted natural name; ambiguity blocks. |


### 68. Connect an Image Manager update key

`image_manager.license_activate` · Native screen: License & Updates · Owner: `Licensing::Client::activate`

Submit the securely staged Image Manager key and installation identity to the pinned license server; store only encrypted installation credentials on accepted activation.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `secret_reference` | string | Required | Minimum length: `32`; Maximum length: `32`; Pattern: `^[a-f0-9]{32}$`; 32-hex actor/site/purpose-bound human secret staging reference; no plaintext secret is accepted here. |


### 69. Check or recover update connection

`image_manager.license_validate` · Native screen: License & Updates · Owner: `Licensing::Client::validate`

Perform the native authenticated validation or pending-request recovery against the pinned license server; cache deadlines govern protected updates.

Parameters: `{}`. All properties are forbidden.


### 70. Release remote update activation

`image_manager.license_deactivate` · Native screen: License & Updates · Owner: `Licensing::Client::deactivate`

Request release of the remote update activation and clear credentials only after accepted native response. Media features remain free.

Parameters: `{}`. All properties are forbidden.


### 71. Clear local update credentials

`image_manager.license_forget` · Native screen: License & Updates · Owner: `Licensing::State::reset`

Clear local credentials and accepted update state while retaining the installation ID; this does not release a remote activation.

Parameters: `{}`. All properties are forbidden.


### 72. Start a separate update identity

`image_manager.license_new_site` · Native screen: License & Updates · Owner: `Licensing::State::reset`

Clear copied credentials and establish a new site/environment installation identity; original remote activation remains.

Parameters: `{}`. All properties are forbidden.


### 73. Check signed plugin updates

`image_manager.license_updates` · Native screen: License & Updates · Owner: `Licensing::Updater::check`

Request the signed release catalog using the native installation credential and WordPress update checks; this does not install a release.

Parameters: `{}`. All properties are forbidden.


### 74. Release an uncertain target reservation

`image_manager.intent_release` · Native screen: AffStackDev AI / Native recovery review · Owner: `Reviewed_Store::release_intent`

Release this exact uncertain operation’s owner reservations after inspecting its native evidence. The prior outcome remains unknown; this never replays, undoes or confirms its business effects. Future changes need a fresh separate approved project. An executing consumer project cannot be released.

| Parameter path | Type | Presence | Bounds and native meaning |
| --- | --- | --- | --- |
| `marker` | string | Required | Minimum length: `79`; Maximum length: `79`; Pattern: `^afsd-connector:[a-f0-9]{64}$`; Exact prior actor/site-bound execution marker, used for readonly intent inspection or explicit unknown reservation recovery. |


## Source service register

The following register maps every runtime PHP module to its source-owned purpose. Exact method names/visibility and fixed hook locations are included in the accompanying source registers. Private helpers remain implementation-owned and cannot be selected through action parameters.

| Source file / class | Source-owned responsibility |
| --- | --- |
| `affstackdev-image-manager.php` — `(procedural API)` | Plugin Name: AffStackDev Image Manager Description: Optimize, organize, and safely edit WordPress media while preserving source images and reversible delivery. Version: 1.7.0.4.1 Requires at least: 6.5 Requires PHP: 8.1 Author: AffStackDev License: GPL-2.0-or-later License URI: https://www.gnu.org/licenses/gpl-2.0.html Update URI: https://affstackdev.com/plugins/affstackdev-image-manager/ Text Domain: affstackdev-image-manager |
| `includes/class-activity.php` — `Activity` | Small, site-local activity history. Never stores filenames, URLs, keys or raw exceptions. |
| `includes/class-admin-layout.php` — `Admin_Layout` | Shared AffStackDev presentation for standalone and Suite-hosted screens. |
| `includes/class-admin.php` — `Admin` | PHP-first controls with an optional, Suite-aware enhanced interface. |
| `includes/class-auto-discovery.php` — `Auto_Discovery` | Deferred rechecks of known public pages. Never runs a scan inside a native save. |
| `includes/class-auto-organization.php` — `Auto_Organization` | Automatic virtual folders. Source bytes, delivery policy and manually chosen folders stay unchanged. |
| `includes/class-backup.php` — `Backup` | Portable Free media backup/export and selective recovery. |
| `includes/class-batch.php` — `Batch` | Server-snapshotted bulk actions. One saved actor, explicit policy, one worker, no destructive bulk cleanup. |
| `includes/class-codec.php` — `Codec` | Verified same-dimension lossless codec. No shell, resizing, or original writes. |
| `includes/class-commands.php` — `Commands` | Optional local WP-CLI controls. No remote/public worker endpoint. |
| `includes/class-compression.php` — `Compression` | Select qualifying codec candidates; no original writes, remote service, or visitor conversion. |
| `includes/class-delivery.php` — `Delivery` | Native attachment/content delivery with original fallback; no frontend conversion. |
| `includes/class-editor.php` — `Editor` | Non-destructive Free image editor. Drafts stay private; approved edits become new WordPress attachments. |
| `includes/class-encoders.php` — `PngEncoder` | Encoder adapters. All writes are temporary; publication belongs to Engine. |
| `includes/class-engine.php` — `Engine` | Paced one-variant worker, explicit publication, invalidation, and safe retirement. |
| `includes/class-foundation.php` — `Foundation` | Public, read-only Free contract. No entitlements, customer data, or vendor calls. |
| `includes/class-image-input.php` — `ImageInput` | Bounded format/metadata inspection before image libraries see a source. |
| `includes/class-integrations.php` — `Integrations` | Focused frontend integration decisions. Unknown/dynamic surfaces keep native output. |
| `includes/class-library.php` — `Library` | Virtual media organization and safe attachment metadata helpers. |
| `includes/class-media-actions.php` — `Media_Actions` | Explicit media operations. No work runs while rendering the library. |
| `includes/class-media-details.php` — `Media_Details` | On-demand, read-only attachment information. |
| `includes/class-media-display.php` — `Media_Display` | Bounded media browsing and existing document previews. |
| `includes/class-media-draft.php` — `Media_Draft` | Private, per-administrator previews for explicit media changes. |
| `includes/class-media-replacement.php` — `Media_Replacement` | Same-ID replacement through new files, with guarded undo. |
| `includes/class-media-usage.php` — `Media_Usage` | Bounded, on-demand discovery of saved attachment references. |
| `includes/class-media-workspace.php` — `Media_Workspace` | Explicit conversion and replacement screens, including PHP-only controls. |
| `includes/class-pdf.php` — `PDF` | Render one selected PDF page locally, then save a separate image. |
| `includes/class-pixel-check.php` — `PixelCheck` | Bounded, full-resolution sample quality gate. Not a claim of perceptual equivalence. |
| `includes/class-plugin.php` — `Plugin` | Lifecycle observation and standalone bootstrap. |
| `includes/class-policy.php` — `Policy` | Explicit compression recipes. Resizing and editing are not compression. |
| `includes/class-preview.php` — `Preview` | Explicit per-image comparison and approval; generation alone never replaces live manifests. |
| `includes/class-private-storage.php` — `Private_Storage` | Verified private local directories for media drafts and recovery. |
| `includes/class-progress.php` — `Progress` | Read-only run presentation plus one bounded durable checkpoint. Not visitor telemetry. |
| `includes/class-protected-library.php` — `Protected_Library` | Read-through organization of Community's private images. Never copies an image or grants access. |
| `includes/class-release-health.php` — `Release_Health` | Release-readiness and environment report. Read-only: never changes media or settings. |
| `includes/class-remote-backup.php` — `Remote_Backup` | Customer-owned remote media backup destinations. |
| `includes/class-repository.php` — `Repository` | Indexed, site-local records; queues are not stored in autoloaded options. |
| `includes/class-responsive.php` — `Responsive` | Optional bounded display derivatives. Resampling is explicitly separate from lossless compression. |
| `includes/class-results.php` — `Results` | Human-readable outcomes; prepared copies are not browser-delivery measurements. |
| `includes/class-reviewed-actions.php` — `Reviewed_Actions` | Trusted registrations for the unchanged afsd-reviewed-actions-v1 consumer contract. |
| `includes/class-reviewed-inputs.php` — `Reviewed_Inputs` | Secure human entry for bounded files and secrets; models receive opaque references only. |
| `includes/class-reviewed-owner.php` — `Reviewed_Owner` | Explicit, source-owned plans, service calls and authoritative readback for Image Manager. |
| `includes/class-reviewed-store.php` — `Reviewed_Store` | Native owner serialization and durable exact-approved-operation evidence. |
| `includes/class-scanner.php` — `Scanner` | Bounded anonymous Home/Shop + one-hop discovery, plus separately labelled inventories. |
| `includes/class-scheduler.php` — `Scheduler` | Paced background dispatch and an independently executed health probe. |
| `includes/class-settings.php` — `Settings` | Settings and resource boundaries. |
| `includes/class-sources.php` — `Sources` | Attachment mapping and supported publication relationships. |
| `includes/class-suite.php` — `Suite` | Optional Suite presentation adapter. |
| `includes/class-theme.php` — `Theme` | Known active-theme images only: no directory crawl or theme-file writes. |
| `includes/class-upgrade.php` — `Upgrade` | Additive migration from BOTH separately released 0.2.0 artifacts. |
| `includes/class-urls.php` — `Urls` | Read-only public URL policy; no authentication or side-effect requests. |
| `includes/class-variants.php` — `Variants` | Small manifest helpers. Never mix file-savings totals with actual browser traffic. |
| `includes/class-verification.php` — `Verification` | Explicit read-only public markup and signed-in browser diagnostics; no permanent visitor probe. |
| `includes/class-woo-delivery.php` — `Woo_Delivery` | Coordinate verified display sources with the classic WooCommerce variation gallery. |
| `includes/class-workflow.php` — `Workflow` | Durable coordination. Pauses, source revisions and pending work survive request boundaries. |
| `includes/licensing/bootstrap.php` — `(procedural API)` | Product-owned optional protected updates. No media feature requires an entitlement. |
| `includes/licensing/class-admin.php` — `Admin` | Native PHP connection and recovery controls, available with or without Suite. |
| `includes/licensing/class-artifact-inspector.php` — `Artifact_Inspector` | Exact signed ZIP inspection. |
| `includes/licensing/class-client.php` — `Client` | HTTPS lifecycle client. Complete keys exist only in explicit activation requests. |
| `includes/licensing/class-license-vault.php` — `Vault` | AffStackDev Image Manager encrypted installation-token storage. |
| `includes/licensing/class-protected-updater.php` — `Updater` | Image Manager-owned WordPress private updater. No product-wide credential or forced auto-update. |
| `includes/licensing/class-readiness.php` — `Readiness` | Read-only update readiness, independent of all media features and Suite licensing. |
| `includes/licensing/class-release-manifest.php` — `Release_Manifest` | Signed release-manifest validation. |
| `includes/licensing/class-state.php` — `State` | Persisted installation identity and authenticated, bounded entitlement cache. |
| `includes/licensing/release-public-keys.php` — `(procedural API)` | Trusted public release keys. Private keys never belong in this plugin. |
| `includes/public-api.php` — `(procedural API)` | Public read-only availability/contract helpers; no data mutation or remote access. |
| `uninstall.php` — `(procedural API)` | Deliberately non-destructive uninstall: cached HTML can reference static copies. |


## Fixed hook reference

Hooks below are declared in current source. Standard WordPress hooks retain their native owner. Notification and veto hooks cannot substitute for native review approval. Dynamic per-option licensing guards and event observer wrappers use the explicit names described in the owner chapters.

| Hook | Registration or use / source |
| --- | --- |
| `plugins_loaded` | add_action in `affstackdev-image-manager.php` |
| `affstackdev_suite_register` | add_action in `affstackdev-image-manager.php` |
| `admin_menu` | add_action in `includes/class-admin.php` |
| `admin_enqueue_scripts` | add_action in `includes/class-admin.php` |
| `admin_post_afsd_im_action` | add_action in `includes/class-admin.php` |
| `wp_ajax_afsd_im_control` | add_action in `includes/class-admin.php` |
| `wp_ajax_afsd_im_media_details` | add_action in `includes/class-admin.php` |
| `wp_after_insert_post` | add_action in `includes/class-auto-discovery.php` |
| `upgrader_process_complete` | add_action in `includes/class-auto-discovery.php` |
| `after_switch_theme` | add_action in `includes/class-auto-discovery.php` |
| `add_attachment` | add_action in `includes/class-auto-organization.php` |
| `edit_attachment` | add_action in `includes/class-auto-organization.php` |
| `wp_after_insert_post` | add_action in `includes/class-auto-organization.php` |
| `afsd_im_organize_attachment` | add_action in `includes/class-auto-organization.php` |
| `admin_notices` | add_action in `includes/class-auto-organization.php` |
| `init` | add_action in `includes/class-backup.php` |
| `afsd_im_backup_completed` | do_action in `includes/class-backup.php` |
| `wp_enqueue_scripts` | add_action in `includes/class-delivery.php` |
| `template_redirect` | add_action in `includes/class-delivery.php` |
| `wp_kses_allowed_html` | add_filter in `includes/class-delivery.php` |
| `wp_get_attachment_image` | add_filter in `includes/class-delivery.php` |
| `the_content` | add_filter in `includes/class-delivery.php` |
| `the_content` | add_filter in `includes/class-delivery.php` |
| `the_content` | add_filter in `includes/class-delivery.php` |
| `wp_content_img_tag` | add_filter in `includes/class-delivery.php` |
| `comment_text` | add_filter in `includes/class-delivery.php` |
| `jetpack_photon_skip_image` | add_filter in `includes/class-delivery.php` |
| `jetpack_photon_skip_for_url` | add_filter in `includes/class-delivery.php` |
| `admin_post_afsd_im_editor_asset` | add_action in `includes/class-editor.php` |
| `delete_attachment` | add_action in `includes/class-editor.php` |
| `afsd_im_ready` | do_action in `includes/class-foundation.php` |
| `init` | add_action in `includes/class-library.php` |
| `attachment_fields_to_edit` | add_filter in `includes/class-library.php` |
| `attachment_fields_to_save` | add_filter in `includes/class-library.php` |
| `ajax_query_attachments_args` | add_filter in `includes/class-library.php` |
| `admin_enqueue_scripts` | add_action in `includes/class-library.php` |
| `posts_orderby` | add_filter in `includes/class-media-display.php` |
| `admin_post_afsd_im_media_asset` | add_action in `includes/class-media-draft.php` |
| `intermediate_image_sizes_advanced` | apply_filters in `includes/class-media-replacement.php` |
| `wp_ajax_afsd_im_media_usage` | add_action in `includes/class-media-usage.php` |
| `admin_post_afsd_im_media_usage` | add_action in `includes/class-media-usage.php` |
| `admin_notices` | add_action in `includes/class-plugin.php` |
| `admin_notices` | add_action in `includes/class-plugin.php` |
| `cron_schedules` | add_filter in `includes/class-plugin.php` |
| `init` | add_action in `includes/class-plugin.php` |
| `admin_post_afsd_im_preview_media` | add_action in `includes/class-preview.php` |
| `afsd_im_backup_completed` | add_action in `includes/class-remote-backup.php` |
| `admin_post_afsd_im_google_callback` | add_action in `includes/class-remote-backup.php` |
| `init` | add_action in `includes/class-remote-backup.php` |
| `init` | add_action in `includes/class-remote-backup.php` |
| `afsd_connector_register_actions` | add_action in `includes/class-reviewed-actions.php` |
| `admin_menu` | add_action in `includes/class-reviewed-inputs.php` |
| `admin_post_afsd_im_reviewed_input` | add_action in `includes/class-reviewed-inputs.php` |
| `afsd_im_reviewed_input_cleanup` | add_action in `includes/class-reviewed-inputs.php` |
| `pre_add_option_` | add_filter in `includes/class-reviewed-store.php` |
| `pre_update_option_` | add_filter in `includes/class-reviewed-store.php` |
| `delete_option` | add_action in `includes/class-reviewed-store.php` |
| `pre_http_request` | add_filter in `includes/class-reviewed-store.php` |
| `shutdown` | add_action in `includes/class-reviewed-store.php` |
| `template_redirect` | add_action in `includes/class-reviewed-store.php` |
| `afsd_im_public_owner_allowed` | apply_filters in `includes/class-sources.php` |
| `afsd_im_public_logo_allowed` | apply_filters in `includes/class-sources.php` |
| `afsd_im_public_theme_image_allowed` | apply_filters in `includes/class-theme.php` |
| `afsd_im_theme_source_allowed` | apply_filters in `includes/class-theme.php` |
| `afsd_im_allow_public_page` | apply_filters in `includes/class-urls.php` |
| `admin_post_afsd_im_inspect` | add_action in `includes/class-verification.php` |
| `wp_enqueue_scripts` | add_action in `includes/class-woo-delivery.php` |
| `woocommerce_available_variation` | add_filter in `includes/class-woo-delivery.php` |
| `admin_menu` | add_action in `includes/licensing/class-admin.php` |
| `admin_post_afsd_im_license` | add_action in `includes/licensing/class-admin.php` |
| `plugin_action_links_` | add_filter in `includes/licensing/class-admin.php` |
| `init` | add_action in `includes/licensing/class-client.php` |
| `admin_init` | add_action in `includes/licensing/class-client.php` |
| `template_redirect` | add_action in `includes/licensing/class-client.php` |
| `shutdown` | add_action in `includes/licensing/class-client.php` |
| `update_plugins_affstackdev.com` | add_filter in `includes/licensing/class-protected-updater.php` |
| `plugins_api` | add_filter in `includes/licensing/class-protected-updater.php` |
| `upgrader_pre_download` | add_filter in `includes/licensing/class-protected-updater.php` |
| `upgrader_pre_install` | add_filter in `includes/licensing/class-protected-updater.php` |
| `upgrader_source_selection` | add_filter in `includes/licensing/class-protected-updater.php` |
| `upgrader_process_complete` | add_action in `includes/licensing/class-protected-updater.php` |
| `shutdown` | add_action in `includes/licensing/class-protected-updater.php` |
| `affstackdev_image_manager_release_public_keys` | apply_filters in `includes/licensing/class-readiness.php` |


## Complete database column reference

Each table name uses the current site prefix followed by `afsd_im_` and the suffix below. Serialized source details/manifest are JSON owned by the named service, not arbitrary model-controlled SQL. Primary and indexed keys are retained in the exact schema definitions.

### sources table

| Column or key | Native SQL declaration |
| --- | --- |
| `id` | bigint(20) unsigned NOT NULL AUTO_INCREMENT |
| `source_key` | char(64) NOT NULL |
| `attachment_id` | bigint(20) unsigned NOT NULL DEFAULT 0 |
| `priority` | tinyint unsigned NOT NULL DEFAULT 2 |
| `state` | varchar(24) NOT NULL DEFAULT 'discovered' |
| `lane` | varchar(12) NOT NULL DEFAULT 'backlog' |
| `revision` | bigint(20) unsigned NOT NULL DEFAULT 1 |
| `requested` | tinyint unsigned NOT NULL DEFAULT 0 |
| `excluded` | tinyint unsigned NOT NULL DEFAULT 0 |
| `delivery` | tinyint unsigned NOT NULL DEFAULT 1 |
| `attempts` | tinyint unsigned NOT NULL DEFAULT 0 |
| `available_at` | bigint(20) unsigned NOT NULL DEFAULT 0 |
| `updated_at` | bigint(20) unsigned NOT NULL DEFAULT 0 |
| `details` | longtext NOT NULL |
| `manifest` | longtext NOT NULL |
| `reason` | varchar(190) NOT NULL DEFAULT '' |
| `saved_bytes` | bigint(20) unsigned NOT NULL DEFAULT 0 |
| `copy_bytes` | bigint(20) unsigned NOT NULL DEFAULT 0 |
| `copy_count` | int unsigned NOT NULL DEFAULT 0 |
| `PRIMARY` | KEY  (id) |
| `UNIQUE` | KEY source_key (source_key) |
| `KEY` | attachment (attachment_id) |
| `KEY` | work (state,available_at,lane,priority) |
| `KEY` | display_order (priority,id) |

### pages table

| Column or key | Native SQL declaration |
| --- | --- |
| `id` | bigint(20) unsigned NOT NULL AUTO_INCREMENT |
| `url_key` | char(64) NOT NULL |
| `url` | text NOT NULL |
| `depth` | tinyint unsigned NOT NULL DEFAULT 1 |
| `roots` | tinyint unsigned NOT NULL DEFAULT 0 |
| `state` | varchar(24) NOT NULL DEFAULT 'waiting' |
| `reason` | varchar(190) NOT NULL DEFAULT '' |
| `images` | int unsigned NOT NULL DEFAULT 0 |
| `attempts` | tinyint unsigned NOT NULL DEFAULT 0 |
| `available_at` | bigint(20) unsigned NOT NULL DEFAULT 0 |
| `PRIMARY` | KEY  (id) |
| `UNIQUE` | KEY url_key (url_key) |
| `KEY` | pending (state,depth,id) |

### owners table

| Column or key | Native SQL declaration |
| --- | --- |
| `id` | bigint(20) unsigned NOT NULL AUTO_INCREMENT |
| `source_id` | bigint(20) unsigned NOT NULL |
| `owner_type` | varchar(12) NOT NULL |
| `owner_id` | bigint(20) unsigned NOT NULL |
| `PRIMARY` | KEY  (id) |
| `UNIQUE` | KEY relation (source_id,owner_type,owner_id) |
| `KEY` | reverse_owner (owner_type,owner_id) |

### locks table

| Column or key | Native SQL declaration |
| --- | --- |
| `name` | varchar(32) NOT NULL |
| `token` | varchar(64) NOT NULL |
| `expires` | bigint(20) unsigned NOT NULL DEFAULT 0 |
| `PRIMARY` | KEY  (name) |

### urls table

| Column or key | Native SQL declaration |
| --- | --- |
| `url_key` | char(64) NOT NULL |
| `attachment_id` | bigint(20) unsigned NOT NULL |
| `source_id` | bigint(20) unsigned NOT NULL |
| `PRIMARY` | KEY  (url_key) |
| `KEY` | source (source_id) |

### batch table

| Column or key | Native SQL declaration |
| --- | --- |
| `batch_id` | char(32) NOT NULL |
| `source_id` | bigint(20) unsigned NOT NULL |
| `state` | varchar(20) NOT NULL DEFAULT 'waiting' |
| `draft_id` | char(32) NOT NULL DEFAULT '' |
| `reason` | varchar(190) NOT NULL DEFAULT '' |
| `PRIMARY` | KEY  (batch_id,source_id) |
| `KEY` | work (batch_id,state,source_id) |


## Native result and error reference

The current service dictionaries below define operation outcomes and actionable reasons. They are current owner messages; transport/authentication and ordinary WordPress errors retain their own native owner. A reason does not silently change the requested operation or its stored state.

### Optimization, editor, comparison and delivery reasons

| Code | Owner meaning |
| --- | --- |
| `editor_access_denied` | You do not have permission to edit this image. |
| `editor_invalid_request` | Choose a supported image and valid edit settings. |
| `editor_confirmation_required` | Confirm that you want to prepare this edit. The source will remain unchanged. |
| `editor_save_confirmation_required` | Confirm that you want to save this prepared edit as a new Media Library image. |
| `editor_no_changes` | Choose at least one crop, rotate, flip or resize change. |
| `editor_invalid_crop` | The custom crop rectangle must stay inside the current image. |
| `editor_no_upscale` | Free editing does not upscale images. Choose dimensions no larger than the edited source. |
| `editor_backend_unavailable` | WordPress does not have a working image editor for this file on this host. |
| `editor_operation_failed` | The image editor could not complete that operation. The source is unchanged. |
| `editor_save_failed` | The edited preview could not be validated or saved. The source is unchanged. |
| `editor_draft_missing` | This edit draft is no longer available. Prepare a fresh preview. |
| `editor_source_changed` | The source image changed after this preview was prepared. Discard it and prepare a fresh edit. |
| `editor_storage_unavailable` | Private temporary edit storage is unavailable on this host. The source is unchanged. |
| `editor_upload_unavailable` | WordPress upload storage is unavailable for the edited copy. The source is unchanged. |
| `editor_attachment_failed` | WordPress could not create the edited Media Library item. The source is unchanged. |
| `editor_source_invalid` | This image cannot be safely opened by the Free editor. |
| `editor_source_too_large` | This source exceeds the editor safety limit. The source is unchanged. |
| `batch_access_changed` | Skipped: your permission to manage this image is no longer available. |
| `batch_invalid_action` | Choose a supported bulk action. |
| `batch_invalid_selection` | Choose checked images, this page, or all matching results. |
| `batch_invalid_sizing` | Choose existing sizes or useful missing display sizes. |
| `batch_confirmation_required` | Confirm the action and selection scope before starting. |
| `batch_resize_confirmation` | Confirm that this run may create resized display copies. Originals stay unchanged. |
| `batch_selection_limit` | Use All matching results for selections larger than 1,000 images. |
| `resize_backend_unavailable` | Additional widths need the supported GD resampling functions. Existing-size compression remains available. |
| `resize_format_held` | Additional widths are not enabled for this format choice; existing-size compression still runs. |
| `resize_metadata_or_alpha_held` | Color, metadata or transparency needs a supported resizing path. Existing sizes are retained. |
| `resize_no_complete_family` | No worthwhile additional width could be offered with a complete supported image family. Existing files stay in use. |
| `resize_no_saving` | The extra width did not reduce the existing parent file enough; no additional file was kept. |
| `resize_failed` | This display size could not be validated. Native dimensions and files are unchanged. |
| `delivery_no_page` | No known public page is available for this image. Run Scan only to refresh discovery. |
| `delivery_invalid_result` | The browser-check result was invalid; no delivery claim was recorded. |
| `delivery_check_stale` | These files or delivery choices changed. Reopen the browser check for a fresh result. |
| `invalid_compression_policy` | Choose valid compression settings. |
| `lossless_avif_not_supported` | AVIF is available only for photographic lossy modes. Choose Lossless with Auto, Native or WebP. |
| `compression_confirmation_required` | Confirm that photographic compression may change pixels before selecting a lossy policy. |
| `image_access_denied` | You do not have permission to manage this image. |
| `preview_public_required` | A supported public image and public-image approval are required. Private or excluded media stays unchanged. |
| `preview_work_pending` | This image already has work queued. Wait for it to finish, or discard the existing comparison first. |
| `preview_expired` | This comparison has changed or expired. Reopen it from Images. |
| `preview_approval_required` | Review the comparison and select the approval checkbox before applying these copies. |
| `preview_not_ready` | The comparison is not ready or has no qualifying smaller copy. Existing published files are retained. |
| `preview_source_changed` | The source or its prepared files changed. Discard this comparison and prepare a fresh one. |
| `preview_history_limit` | Too many retained comparison files. Disable delivery and retire cached copies through the existing cleanup workflow before continuing. |
| `requested_encoder_unavailable` | No verified encoder can produce this policy on this host. Review Tools or select another format. |
| `metadata_preserved_native_only` | This metadata requires a native-format optimizer or a tested profile-preserving path. Other formats were not used. |
| `metadata_roundtrip_failed` | Metadata did not round-trip unchanged. The candidate was rejected. |
| `metadata_needs_review` | The metadata structure could not be safely interpreted. The original is retained. |
| `gps_xmp_requires_review` | This image has text/XMP metadata that requires review before GPS removal. No ambiguous privacy claim is made. |
| `quality_gate_failed` | The candidate failed the sampled quality threshold. Select a higher-fidelity policy or keep the original. |
| `alpha_changed` | The candidate did not preserve the required transparency. |
| `unsupported_lossless_target` | This encoder cannot guarantee lossless output in the selected format. |
| `unsupported_png_chunk` | This PNG contains unsupported structural data and was not changed. |
| `jpeg_verifier_unavailable` | Native JPEG optimization needs both a safe jpegtran installation and a decoded-pixel verifier. |
| `encoder_timeout` | The native compression process reached its time limit. No partial output was used. |
| `encoder_output_limit` | The native compression process exceeded its output limit. No partial output was used. |
| `exact_png_scanlines` | Lossless PNG: decompressed native image data matched exactly. |
| `exact_decoded_pixels` | Lossless: every decoded pixel matched in this encoder path. |
| `coefficient_preserving_exact_pixels` | Native JPEG: coefficient-preserving transform with an exact decoded-pixel check. |
| `sampled_ssim_color_gate` | Photographic output passed sampled SSIM and color-error checks. Inspect fine detail before approving. |
| `pixel_limit` | This size exceeds the conservative pixel limit. Its original is retained. |
| `source_byte_limit` | This source exceeds the processing file-size limit. Its original is retained. |
| `memory_limit` | There is not enough safe processing memory for this size. |
| `existing_webp_kept` | Already WebP. This release leaves the existing file unchanged. |
| `unsupported_format` | This format is not supported by the current compression pipeline. |
| `lossless_encoder_unavailable` | No verified lossless encoder is available on this server. |
| `alpha_requires_exact_imagick` | This transparency needs an exact-alpha-capable encoder. The original is retained. |
| `profile_or_color_metadata_held` | This image needs color-profile handling outside the current verified pipeline. |
| `jpeg_profile_or_orientation_held` | Color or orientation information requires the original to be kept. |
| `orientation_held` | The original orientation is being preserved. |
| `animated_image_held` | Animation is not supported by this pipeline. All original frames are preserved. |
| `unsupported_color_or_frames` | The color model or frame structure is not supported. |
| `unsupported_precision` | This image precision is not supported by the current encoder. |
| `unsupported_precision_or_cmyk` | This JPEG precision or color model is not supported. |
| `source_metadata_dimensions_mismatch` | The file and saved dimensions disagree. Review the source before retrying. |
| `pixel_or_source_mismatch` | Exact-image verification did not pass. The candidate was not used. |
| `not_verified_lossless_webp` | The candidate did not pass the required lossless-format validation. |
| `candidate_dimensions_or_mime` | The candidate has unexpected dimensions or file type and was not used. |
| `invalid_image` | The source could not be validated as an image. |
| `invalid_png` | The PNG source could not be validated. |
| `truncated_png` | The PNG source is incomplete. |
| `invalid_png_crc` | The PNG source failed its integrity check. |
| `truncated_jpeg` | The JPEG source is incomplete. |
| `codec_warning` | The image library reported a problem. The original is retained. |
| `http_status_404` | This page was not found (404). Its images were not scanned. |
| `http_status_503` | This page is temporarily unavailable (503). |
| `http_status_429` | The site limited these scan requests (429). |
| `http_request_blocked` | The anonymous page request could not complete. |
| `dns_unavailable` | The public hostname could not be resolved for scanning. |
| `metadata_wait` | The source file or complete saved metadata is not available yet. |
| `worker_interrupted` | The last worker was interrupted. Its saved work will be retried safely. |
| `temporary_failure` | A temporary processing problem occurred. |
| `retry_limit` | Three attempts could not finish this task. Review the reason and use Retry when the cause is fixed. |
| `public_policy_required` | Public-image approval is required before a copy can be made. |
| `public_association_required` | No supported public association is confirmed. No new public copy is generated. |
| `storage_unavailable` | Processing storage is unavailable. Originals are unchanged. |
| `space_low` | There is not enough verified free disk space for safe processing. |
| `legacy_review` | An earlier theme-image record needs a new scan before optimization. Existing copies are retained. |
| `cancelled` | This run was stopped. Existing files were not deleted. |

### Portable recovery reasons

| Code | Owner meaning |
| --- | --- |
| `backup_job_active` | A media backup is already running. Finish, pause, or stop it before starting another. |
| `backup_confirmation_required` | Confirm the portable media backup before starting it. |
| `backup_delete_confirmation_required` | Confirm before deleting this local snapshot copy. Media Library files are not deleted by this action. |
| `backup_zip_unavailable` | This host does not provide ZIP support required for portable media backups. |
| `backup_storage_unavailable` | Private backup storage is unavailable. Ask your host for a writable folder outside your public website with verified owner-only access. An existing private backup folder can be configured with AFSD_IM_BACKUP_DIR. |
| `backup_invalid_profile` | Choose Essential recovery or Published media recovery. |
| `backup_invalid_scope` | Choose all media, a folder, or a collection. |
| `backup_scope_missing` | The selected folder or collection no longer exists. |
| `backup_encryption_unavailable` | Password-encrypted ZIP backups are unavailable on this host. Unencrypted private snapshots and downloads can still be used when private storage is available. |
| `backup_password_invalid` | Use matching backup passwords with at least eight characters. |
| `backup_archive_create_failed` | The backup archive could not be created in private storage. |
| `backup_archive_open_failed` | The backup archive could not be opened. |
| `backup_archive_write_failed` | The backup archive could not be updated. Existing media is unchanged. |
| `backup_source_missing` | A selected attachment does not have a readable local source file. |
| `backup_source_changed` | A media file changed while it was being copied. That item was skipped so the snapshot does not mix revisions. |
| `backup_source_too_large` | A selected source exceeded the per-file safety limit for this backup run. |
| `backup_attachment_too_large` | One attachment family exceeded the bounded per-item backup safety limit. |
| `backup_copy_failed` | A media file could not be copied to private staging. |
| `backup_verify_failed` | A newly written archive entry did not match its source checksum. |
| `backup_manifest_record_too_large` | One media record exceeded the portable-manifest safety limit. |
| `backup_manifest_too_large` | The portable manifest exceeded the current safety limit. |
| `backup_finalize_failed` | The completed archive could not be finalized safely. |
| `backup_actor_access_changed` | The user who started this backup no longer has permission to continue it. |
| `backup_snapshot_missing` | That backup snapshot is unavailable in this installation. |
| `backup_archive_changed` | The stored archive no longer matches the checksum recorded when it was completed. |
| `backup_password_required` | Enter the password used for this encrypted backup. |
| `backup_password_wrong_or_file_missing` | The backup password is incorrect or the selected media entry cannot be read. |
| `backup_restore_read_failed` | The selected media could not be read from the backup. |
| `backup_restore_integrity_failed` | The selected media did not match the checksum stored in the backup. Nothing was restored. |
| `backup_restore_destination_unavailable` | WordPress could not provide a writable Media Library destination. |
| `backup_restore_write_failed` | The restored file could not be written safely. Existing media was retained. |
| `backup_restore_attachment_failed` | WordPress could not create the restored Media Library attachment. |
| `backup_safety_snapshot_unavailable` | A pre-restore recovery point could not be created, so in-place restore was refused. |
| `backup_cross_site_in_place_forbidden` | In-place restore is available only for a snapshot created by this same site. Restore as a new Media Library item instead. |
| `backup_restore_target_missing` | The original same-site attachment is missing or you can no longer edit it. |
| `backup_restore_mime_mismatch` | The current attachment type no longer matches this backup revision. Restore it as a new item instead. |
| `backup_restore_confirmation_required` | Confirm the selective restore before changing or creating media. |
| `backup_record_missing` | The selected media record is not present in this snapshot. |
| `backup_restore_mode_invalid` | Choose restore as new media or same-site in-place restore. |
| `backup_import_upload_failed` | The portable backup upload could not be received safely. |
| `backup_password_required_or_wrong` | The archive manifest could not be opened. Enter the correct password if this backup is encrypted. |
| `backup_manifest_invalid` | This archive is not a valid supported AffStackDev Image Manager media backup. |

### Remote backup reasons

| Code | Owner meaning |
| --- | --- |
| `remote_provider_invalid` | Choose Local only, Google Drive, or S3-compatible storage. |
| `remote_schedule_invalid` | Choose Manual, Daily, or Weekly scheduling. |
| `remote_secret_storage_unavailable` | This host cannot safely store remote credentials in WordPress. Use server configuration constants or enable OpenSSL support. |
| `remote_google_credentials_missing` | Save a Google OAuth client ID and client secret before connecting Drive. |
| `remote_google_not_connected` | Google Drive is not connected. |
| `remote_google_token_missing` | Google did not provide the refresh credentials required for scheduled backups. Reconnect and grant access. |
| `remote_google_token_failed` | Google Drive authorization could not be refreshed. Reconnect the destination. |
| `remote_google_folder_failed` | Image Manager could not create its dedicated Google Drive backup folder. |
| `remote_google_upload_failed` | The Google Drive upload could not continue. Saved local backup data is unchanged. |
| `remote_google_session_invalid` | Google Drive returned an unexpected upload session address, so the transfer was refused. |
| `remote_s3_credentials_missing` | Enter the S3 endpoint, bucket, access key, and secret key, then test the connection. |
| `remote_s3_bucket_invalid` | The S3 bucket name is invalid. |
| `remote_endpoint_invalid` | Use a public HTTPS S3-compatible endpoint with no embedded credentials, path, query, or local IP address. |
| `remote_s3_multipart_failed` | The S3-compatible multipart upload could not continue. |
| `remote_not_ready` | Connect and verify a remote destination before sending a backup. |
| `remote_job_active` | A backup or remote transfer is already active. Finish or pause it first. |
| `remote_network_error` | The remote provider could not be reached. Saved progress is retained for retry. |
| `remote_transient_http` | The remote provider returned a temporary error. Saved progress will retry with backoff. |
| `remote_auth_failed` | The remote provider rejected the saved credentials. Reconnect or update them. |
| `remote_http_failed` | The remote provider returned an unexpected response. Existing local backups remain intact. |
| `remote_integrity_failed` | The remote copy did not pass the recorded size/checksum verification. The local backup remains available. |
| `remote_local_archive_missing` | The local portable snapshot needed for this upload is unavailable or changed. |
| `remote_delete_confirmation_required` | Confirm before deleting the remote backup copy. Local media and other backups are not deleted. |
| `remote_delete_failed` | The remote provider did not confirm deletion. The backup remains listed for review. |
| `remote_record_missing` | That remote backup record is unavailable. |
| `remote_destination_mismatch` | Reconnect the same remote destination that owns this backup before downloading, restoring, or deleting it through Image Manager. |
| `remote_download_failed` | The remote backup could not be downloaded to private staging. |
| `remote_schedule_password_required` | Enter and confirm the scheduled-backup password, or turn scheduled archive encryption off. |
| `remote_schedule_password_unavailable` | The saved scheduled-backup password can no longer be opened with this site’s current secrets. Set the password again. |
| `remote_schedule_busy` | The scheduled backup waited because another Image Manager media job was active; a retry is scheduled. |

### Media operations reasons

| Code | Owner meaning |
| --- | --- |
| `media_action_access` | You do not have permission to change this media item. |
| `media_action_storage` | This operation needs a private temporary folder outside your public website with verified owner-only access. Ask your host to check its location and permissions. |
| `media_action_source` | A readable local source with a matching file type is required. Remote and indirect paths cannot be changed here. |
| `media_action_image` | Use a valid JPEG, PNG, WebP or AVIF up to 64 MiB, 24 megapixels and 16,384 pixels per side. |
| `media_action_changed` | The source or its metadata changed after the preview. Prepare a new preview before continuing. |
| `media_action_folder` | That folder no longer exists. Choose an existing folder and try again. |
| `media_action_upload` | Choose one to eight files within your site’s upload limit, then submit the upload form again. |


## Glossary

| Term | Exact contract meaning |
| --- | --- |
| Source identity | Site-local source key, attachment association and revision |
| Expected-after | Stable native outcome subset required for a verified action result |
| Execution marker | Exact approved actor/site/project operation identity; not a parameter deduplication key |
| Owner-returned evidence | Native callback completed and its saved evidence can be read without replay |
| Reservation release | Separately reviewed coordination change; prior business outcome stays unconfirmed |
| Public eligibility | Current supported native public ownership, independently of administrator visibility |
| Portable ID | Backup record identity mapped to a destination-native attachment ID |
| Native fallback | Keep existing owner-generated image behavior when mapping/policy cannot support substitution |


## Complete native field-to-action mapping

Native field names below are fixed form controls or view context. They are not accepted verbatim as arbitrary reviewed parameters. Use the indicated trusted schema or the explicit secure human step. Confirmation, nonce and dispatcher fields remain native authority; schema omissions do not eliminate the human owner boundary.

| Native field / label | Current mapping and owner behavior |
| --- | --- |
| `action` — action | `fixed WordPress admin-post/AJAX route identity`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php; includes/class-reviewed-inputs.php; includes/licensing/class-admin.php` |
| `auto_discovery` — Automatically recheck changed public pages and theme updates | `settings_update.settings.auto_discovery`; Saved checkbox; false disables, omitted reviewed field retains. See current default/prerequisite table. Source: `includes/class-admin.php` |
| `backup_collection_id` — backup_collection_id | `backup_start.term`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `backup_confirm` — Create this portable media snapshot. Existing media and website output will not be changed. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `backup_delete_confirm` — Delete this local snapshot copy | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `backup_destination` — backup_destination | `backup_start.destination`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `backup_encrypt` — Encrypt archive entries with a password | `backup_start.encrypted`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `backup_file` — backup_file | `backup_import.input_reference`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `backup_folder_id` — backup_folder_id | `backup_start.term`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `backup_password` — backup_password | `backup_password secure native reference`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/class-admin.php` |
| `backup_password_confirm` — backup_password_confirm | `backup_password secure native matching confirmation`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/class-admin.php` |
| `backup_profile` — backup_profile | `backup_start.profile`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `backup_scope` — backup_scope | `backup_start.scope`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `bulk` — bulk | `bulk_run.bulk`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `bulk_confirm` — Apply the selected action to this scope. Original files will not be deleted. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `bulk_intent` — bulk_intent | `bulk_run.bulk_intent`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `catalog` — Include public product images | `settings_update.settings.catalog`; Saved checkbox; false disables, omitted reviewed field retains. See current default/prerequisite table. Source: `includes/class-admin.php` |
| `cleanup_confirm` — Optimized delivery is off and cached pages no longer reference this image’s copies. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `collection_id` — collection_id | `collection membership.terms`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `comments` — Include local images in approved comments and reviews | `settings_update.settings.comments`; Saved checkbox; false disables, omitted reviewed field retains. See current default/prerequisite table. Source: `includes/class-admin.php` |
| `compression[content]` — compression[content] | `compression.content`; One exact compression recipe choice; current recipe merge and fidelity rules apply. Source: `includes/class-admin.php` |
| `compression[effort]` — compression[effort] | `compression.effort`; One exact compression recipe choice; current recipe merge and fidelity rules apply. Source: `includes/class-admin.php` |
| `compression[formats]` — compression[formats] | `compression.formats`; One exact compression recipe choice; current recipe merge and fidelity rules apply. Source: `includes/class-admin.php` |
| `compression[metadata]` — compression[metadata] | `compression.metadata`; One exact compression recipe choice; current recipe merge and fidelity rules apply. Source: `includes/class-admin.php` |
| `compression[mode]` — compression[mode] | `compression.mode`; One exact compression recipe choice; current recipe merge and fidelity rules apply. Source: `includes/class-admin.php` |
| `compression_confirm` — I understand that photographic High Quality / Maximum Savings can change pixels. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `confirm` — confirm | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/licensing/class-admin.php` |
| `delivery` — Offer optimized images on supported website output | `settings_update.settings.delivery`; Saved checkbox; false disables, omitted reviewed field retains. See current default/prerequisite table. Source: `includes/class-admin.php` |
| `draft` — draft | `comparison_apply/discard.draft`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `editor[crop]` — editor[crop] | `edit_prepare.editor.crop`; Native rotate/flip/crop/resize recipe; no upscale and conditional crop bounds. Source: `includes/class-admin.php` |
| `editor[crop_height]` — editor[crop_height] | `edit_prepare.editor.crop_height`; Native rotate/flip/crop/resize recipe; no upscale and conditional crop bounds. Source: `includes/class-admin.php` |
| `editor[crop_width]` — editor[crop_width] | `edit_prepare.editor.crop_width`; Native rotate/flip/crop/resize recipe; no upscale and conditional crop bounds. Source: `includes/class-admin.php` |
| `editor[crop_x]` — editor[crop_x] | `edit_prepare.editor.crop_x`; Native rotate/flip/crop/resize recipe; no upscale and conditional crop bounds. Source: `includes/class-admin.php` |
| `editor[crop_y]` — editor[crop_y] | `edit_prepare.editor.crop_y`; Native rotate/flip/crop/resize recipe; no upscale and conditional crop bounds. Source: `includes/class-admin.php` |
| `editor[flip]` — editor[flip] | `edit_prepare.editor.flip`; Native rotate/flip/crop/resize recipe; no upscale and conditional crop bounds. Source: `includes/class-admin.php` |
| `editor[resize_height]` — editor[resize_height] | `edit_prepare.editor.resize_height`; Native rotate/flip/crop/resize recipe; no upscale and conditional crop bounds. Source: `includes/class-admin.php` |
| `editor[resize_width]` — editor[resize_width] | `edit_prepare.editor.resize_width`; Native rotate/flip/crop/resize recipe; no upscale and conditional crop bounds. Source: `includes/class-admin.php` |
| `editor[rotate]` — editor[rotate] | `edit_prepare.editor.rotate`; Native rotate/flip/crop/resize recipe; no upscale and conditional crop bounds. Source: `includes/class-admin.php` |
| `editor_confirm` — Prepare this edit for review. This does not change the source attachment or website output. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `editor_draft` — editor_draft | `edit_save/discard.draft`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `editor_save_confirm` — Create this edited version as a new Media Library image. Existing pages/products will keep using the current source until I deliberately choose the new image. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `enhanced_ui` — Enable enhanced interface and live progress | `settings_update.settings.enhanced_ui`; Saved checkbox; false disables, omitted reviewed field retains. See current default/prerequisite table. Source: `includes/class-admin.php` |
| `folder_id` — folder_id | `folder membership.terms`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `google_client_id` — google_client_id | `Fixed native owning operation / corresponding catalog schema`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `google_client_secret` — google_client_secret | `remote_settings_update.secret_reference native staging`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/class-admin.php; includes/class-reviewed-inputs.php` |
| `ids[]` — ids[] | `source actions.sources / folder/collection/metadata.attachments`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `im_backup` — im_backup | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_backup_page` — im_backup_page | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_filter` — im_filter | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_format` — im_format | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_image` — im_image | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_media_collection` — im_media_collection | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_media_folder` — im_media_folder | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_media_id` — im_media_id | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_media_layout` — im_media_layout | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_media_sort` — im_media_sort | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_media_type` — im_media_type | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_media_view` — im_media_view | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_page` — im_page | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_search` — im_search | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_size` — im_size | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `im_tab` — im_tab | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `input_files[]` — input_files[] | `secure native file stage`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-reviewed-inputs.php` |
| `kind` — kind | `secure native input purpose`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-reviewed-inputs.php` |
| `license_key` — license_key | `license_activate.secret_reference native staging`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/licensing/class-admin.php` |
| `local_cdn` — Allow local copies for exactly matched Jetpack image sizes | `settings_update.settings.local_cdn`; Saved checkbox; false disables, omitted reviewed field retains. See current default/prerequisite table. Source: `includes/class-admin.php` |
| `media_action` — media_action | `fixed native library bulk owner action`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `media_alt` — media_alt | `metadata_update.fields.alt`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `media_caption` — media_caption | `metadata_update.fields.caption`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `media_confirm` — Apply this media-library action to the checked items. Files and URLs will not move. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `media_draft` — media_draft | `pdf_save/discard/replace_apply/discard.draft`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-media-workspace.php` |
| `media_files[]` — media_files[] | `media_upload.input_reference native staging`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `media_operation_confirm` — media_operation_confirm | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-media-workspace.php` |
| `media_title` — media_title | `metadata_update.fields.title`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `mode` — mode | `native usage start/continue control`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-media-usage.php` |
| `operation` — operation | `fixed trusted native operation dispatch`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php; includes/licensing/class-admin.php` |
| `organization_term` — organization_term | `folder/collection action.term`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `page` — page | `image_manager.inspect / frozen native selection context`; Read/view or saved page/filter context; does not authorize a generic setter or choose a callback. Source: `includes/class-admin.php` |
| `parent` — parent | `folder_create.parent`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `pdf_edge` — pdf_edge | `pdf_prepare.maximum_edge`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-media-workspace.php` |
| `pdf_page` — pdf_page | `pdf_prepare.page`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-media-workspace.php` |
| `portable_id` — portable_id | `backup_restore.portable_id`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `preview_confirm` — I have reviewed these sizes and approve the new prepared copies. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `public_policy` — I have checked that selected images are public, not private or member-only media. | `settings_update.settings.public_policy`; Saved checkbox; false disables, omitted reviewed field retains. See current default/prerequisite table. Source: `includes/class-admin.php` |
| `remote_delete_confirm` — Delete this remote backup copy | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `remote_id` — remote_id | `remote_fetch/delete.remote_id`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `remote_keep_local` — Keep a local snapshot after remote upload | `remote_settings_update.keep_local`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `remote_profile` — remote_profile | `remote_settings_update.profile`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `remote_provider` — remote_provider | `remote_settings_update.provider`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `remote_retention` — remote_retention | `remote_settings_update.retention`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `remote_schedule` — remote_schedule | `remote_settings_update.schedule`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `remote_schedule_encrypt` — Password-encrypt scheduled backup archives | `remote_settings_update.schedule_encrypt`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `remote_schedule_password` — remote_schedule_password | `remote_settings_update.secret_reference native staging`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/class-admin.php; includes/class-reviewed-inputs.php` |
| `remote_schedule_password_confirm` — remote_schedule_password_confirm | `remote_settings_update.secret_reference native staging`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/class-admin.php; includes/class-reviewed-inputs.php` |
| `remote_scope_choice` — remote_scope_choice | `remote_settings_update.scope + term`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `replacement_file` — replacement_file | `replace_prepare.input_reference native staging`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-media-workspace.php` |
| `resize_confirm` — Allow additional smaller display sizes when selected above. This resizes copies, not originals. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `restore_confirm` — I understand this restores media data. In-place restore creates a safety snapshot first. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `restore_mode` — restore_mode | `backup_restore.mode`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `s3_access_key` — s3_access_key | `remote_settings_update.secret_reference native staging`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/class-admin.php; includes/class-reviewed-inputs.php` |
| `s3_bucket` — s3_bucket | `Fixed native owning operation / corresponding catalog schema`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `s3_endpoint` — s3_endpoint | `Fixed native owning operation / corresponding catalog schema`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `s3_prefix` — s3_prefix | `Fixed native owning operation / corresponding catalog schema`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `s3_region` — s3_region | `Fixed native owning operation / corresponding catalog schema`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `s3_secret_key` — s3_secret_key | `remote_settings_update.secret_reference native staging`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/class-admin.php; includes/class-reviewed-inputs.php` |
| `scan_only` — scan_only | `scan_start action`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `scope` — scope | `bulk_run.scope`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `secret_confirm` — secret_confirm | `secure native password confirmation`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/class-reviewed-inputs.php` |
| `secret_value` — secret_value | `secure native backup password / license entry`; Secure native human field. Blank saved cloud credential retains; other purposes require matching nonempty bounded secret. Never a raw model parameter. Source: `includes/class-reviewed-inputs.php` |
| `set_alt` — Set image alt-text default | `Fixed native owning operation / corresponding catalog schema`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `set_caption` — Set attachment caption | `Fixed native owning operation / corresponding catalog schema`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `set_title` — Set attachment title | `Fixed native owning operation / corresponding catalog schema`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `sizing` — sizing | `bulk_run.sizing`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `snapshot_id` — snapshot_id | `backup_delete/restore/remote_upload.snapshot`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `source_id` — source_id | `delivery_check.source`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `target` — target | `bulk_run.target`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `taxonomy` — taxonomy | `fixed folder/collection action identity`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `term_action` — term_action | `fixed rename/delete action identity`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `term_confirm` — Apply this change. Deleting an organization label never deletes media files. | `Exact shared native human approval`; Explicit native confirmation for this material effect; reviewed projects require native approval of the exact resolved change. Source: `includes/class-admin.php` |
| `term_name` — term_name | `folder/collection create/rename.name`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `theme_images` — Include images supplied by the active theme | `settings_update.settings.theme_images`; Saved checkbox; false disables, omitted reviewed field retains. See current default/prerequisite table. Source: `includes/class-admin.php` |
| `upload_folder` — upload_folder | `media_upload.folder`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `upload_request` — upload_request | `native upload replay identity`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `uploads` — Automatically optimize eligible future uploads | `settings_update.settings.uploads`; Saved checkbox; false disables, omitted reviewed field retains. See current default/prerequisite table. Source: `includes/class-admin.php` |
| `verify_after_apply` — After automatic approval, check what a known public page offers. | `bulk_run.verify_after_apply`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-admin.php` |
| `viewport` — viewport | `human browser inspector view`; Validated by the named native handler; exact effect, target and clear/retention behavior appear in its workflow/action chapter. Source: `includes/class-verification.php` |