Cairnstone: block-builder foundation plan.

2026-06-18 · self-adapting layout primitives + a per-device responsive system with owner-set breakpoints + a Layout wizard · v2.3.317 → v2.3.332

Layout primitives: self-adapting Columns / Grid / Container, then a full per-device responsive system

The layout blocks were rebuilt around a self-adapting responsive model (no fixed device list): Columns wrap and stack by the space available, the new free Grid block auto-fits as many equal items per row as the space allows (no count cap), and Container gained a free section-width control (Normal / Wide / Full / custom, including beyond-100% bleed with no horizontal page scroll). A first-run Layout wizard drops the right primitive from a recipe gallery and replaces itself. Vertical alignment, a gap-aware column basis, and RTL-correct drag handles landed alongside.

On top of that simple default sits an opt-in per-device tier, under the standing rule “default simple, advanced always available.” Each column can carry a different width per device (Desktop / Tablet / Phone, set from the column’s own panel); each Grid can carry a fixed items-per-row count per device (for example 4 / 2 / 1). Crucially, where the devices switch is the site owner’s choice: two Responsive breakpoints numbers under Settings → Site defaults (default desktop above 1024px, phone at or below 600px). Because a CSS media query cannot read a custom property, the per-device viewport bands are generated server-side from those two numbers and attached inline to the frontend stylesheet. A content-width block is the same pixel width on a tablet and a desktop, so the device split must be a viewport query, while the “too narrow, stack” safety net stays a container query (correct for nested rows). The whole arc is floor-verified at real viewport widths and pinned by source-assertion contract tests.

2026-06-16 · text fields to canvas + inline-formatting law corrected + regression pin + Node managed-link contract · v2.3.298 → v2.3.310

In-canvas text editing: the full WordPress toolbar on every content field

Five library blocks had their text fields moved from sidebar inputs to in-canvas authoring in v2.3.298–305: FAQ (canvas Q/A + per-row controls + “Add question” button), Author Bio (name, title, bio), Testimonial (quote, name, role), Affiliate Disclosure (disclosure body), Section Divider (label). Images on these blocks moved back to the sidebar per the design law; typography support landed on all five at the same time.

The first cut used a curated allowedFormats list (bold, italic, link) that hid underline, strikethrough, code, and any third-party or cross-plugin format button. The law was corrected: where a function matches WordPress, it should be WordPress. Every in-canvas text field now omits allowedFormats entirely (full vanilla WP toolbar, including third-party and Node-plugin formats), renders through wp_kses_post on save, and strips to plain text via wp_strip_all_tags wherever the value feeds JSON-LD. v2.3.306–309 applied the corrected law to all migrated blocks and to every schema-feeding field already in the canvas (FAQ question, How-to heading / step title / instructions, Hero heading / subheading, Image caption). Hero CTA labels keep an empty format list by design: a button label cannot host a nested link. InCanvasToolbarContractTest (v2.3.310) guards against three regression classes: format re-restriction, a render reverting to esc_html, and a schema field dropping its strip pass. The cross-plugin contract is settled: Gillish Node surfaces its managed-link button as a standard RichTextToolbarButton; the full toolbar covers it automatically with no Cairnstone registration required.

2026-06-07 · verified against Kadence Blocks 3.7.5, GenerateBlocks 2.2.1, Stackable 3.19.9 on the floor · no code change

Phase 17 verified: Cairnstone’s universal capabilities work on third-party blocks

Conditional Content, Look/Style, and the inspector panels were confirmed on one representative block per plugin (kadence/advancedheading, generateblocks/text, stackable/card). In the editor the Visibility + Interactions + Schema panels attach after each plugin’s own panels (the editor.BlockEdit HOC hooks at the registration layer, not per block-type); on the frontend render_block gates a logged_in rule (the hidden instance is removed from the page entirely) and StyleAttribute::style_block merges gcStyle inline into each block’s root element. The only console output was third-party / Gutenberg-dev-build noise, none Cairnstone-caused.

2026-06-07 · the shared image engine + the Image block + six consumers + an audit pass · v2.3.150 → v2.3.171

Phase 16 progress: the shared image engine, the Image block, and the in-canvas editing migration

A run of Phase 16 library work: the How-to block (v2.3.150) and the in-canvas editing pilot (v2.3.151); the shared image engine: Shared\Image::render() + render_set() (engine-owned lightbox grouping), Shared\Lightbox (a “Classic” overlay with a Settings kill-switch + Pro seam), and Shared\ImageSizes (v2.3.152–167); the new Image library block (v2.3.161, the fourteenth block); and the migration of How-to, Hero, Trust Badges, Testimonial, and Author Bio onto the engine so every block loads the right registered size with srcset + intrinsic dimensions for CLS (v2.3.153–169). A the-fool red-team plus an /impeccable audit on the completed engine drove three follow-up fixes (a sizes arg for fixed-box photos, a linked-badge accessible-name fallback, and a dead-CSS sweep) at v2.3.171, all visual-verified on the floor across landscape / square / portrait / real-face content. The rest of Phase 16 (six interaction blocks, Video embed Pro, the remaining sidebar transplants) is still open.

2026-05-31 · server-side preview-as + dry-run on every mutation + the cairnstone/batch multi-op ability + a contract-parity harden · v2.3.110 → v2.3.111

Phase 15 closed: AI preview rendering + batch (the AI-integration arc, Phases 13–15, is done)

cairnstone/preview-block renders a saved block as a chosen visitor profile would see it, with a per-block show/hide trace that names the deciding signal and flags a signal a fixture cannot set. create-block / update-block / import-block gained dry_run: true (run every check, return the resolved artifact marked committed: false, write nothing), reachable over the wire after a schema fix declared the flag under the schemas’ additionalProperties: false. cairnstone/batch applies an ordered list of mixed create / update / delete / import in one call, partial-success by default with an atomic all-or-nothing mode (validate-all-dry first, compensating rollback as a backstop) and a max_items cap of 100; a follow-on harden brought it to contract parity with the single ops (dry_run, an always-present committed, failed_indexes on an atomic failure, an empty-batch rejection). Every ability was runtime-verified over the wire against the floor install via the Abilities REST endpoint.

2026-05-30 · seven versions: semantic tags + validate-composition A1–A3 + style catalogue + pre-save gate + human refusal messages · v2.3.102 → v2.3.108

Phase 14 closed: richer AI introspection (semantic tags, the dry-run validator, the style catalogue)

cairnstone/list-library-blocks now returns a semanticType tag per block; cairnstone/validate-composition dry-runs a proposed tree through manifest-attribute, parent/child nesting, and Conditional-Content checks (plus a content_stripped warning), returning a structured { valid, findings } report with a precise path per finding; and cairnstone/list-style-controls exposes the universal gcStyle catalogue, the honest form of per-block style introspection, since the styles are universal by design. Two follow-on hardenings then ran the validator before every AI save, so a block that cannot work is refused before it reaches the draft list, and made the refusal name the block as a designer sees it: The “Column” block (gillish-cairnstone/column) can only be placed directly inside the “Columns” block (gillish-cairnstone/columns). The cairnstone/* surface is now twelve abilities, re-run end-to-end against the floor install and pinned as a runtime baseline.

2026-05-30 · four-slice close, then a post-close runtime-audit hardening sweep · v2.3.90 → v2.3.93, then v2.3.99 → v2.3.101

Phase 13 closed: the cairnstone/* Abilities API base surface (discovery + mutation + provenance)

Cairnstone registers WordPress Abilities API capabilities under cairnstone/* so any MCP-speaking AI assistant can introspect and build blocks. Three slices: 13a discovery (five read-only abilities + list-node-links when Gillish Node is active), 13b mutation (create / update / delete / import, draft-only, behind an “AI assistants” Settings opt-in, with five security mitigations), and 13c provenance (the AI activity 30-day audit page + the “AI draft” list marker). The planned Free quota + per-hour rate limit (13b.2) were dropped as wp.org trialware with no real abuse vector to close. A consolidated Chrome-MCP run after the close found four defects PHPUnit could not reach, all fixed in v2.3.99–v2.3.101: AI blocks were editor-invisible (create-block left post_content empty), GC_NODE_ACTIVE froze false in WordPress’s default plugin-load order so list-node-links never registered, and two error-contract gaps (the import payload docs + a publish-refusal message).

2026-05-27 · twenty-four versions across Pass A → Pass D-3 + harden + polish + reload fix · commits 695c281 → 732a35d (v2.3.29 → v2.3.52)

Phase 12 closed: import / export end-to-end across REST + CLI + sidebar slot + list-view chrome + Import modal

Phase 12 (import / export of built blocks) is fully shipped. Twenty-four versions across one calendar day, with three /impeccable critique cycles green and a wp.org-submission-bound harden sweep folded into the closure. The shape brief plans/CANVAS-PHASE-12-SHAPE.md is retired into plans/DONE-WORK.md on the same closure-routine pattern Phase 11 used.

Pass A (v2.3.29): wire format. Modules/CanvasBlock/ImportExportService carries the canonical .gcblock.json contract: six top-level fields (formatVersion, slug, title, composition, panelConfig, schemaVersion) per brief §10 item 8. export_block() builds the export shape; validate_payload() returns the per-file row the import modal renders (new / renamed / rejected_newer_format / rejected_invalid / migrating); import_payload() commits as a gc_cairnstone_block draft via wp_insert_post; export_blocks_zip() (v2.3.41) bundles N CPT posts into a single ZipArchive with one entry per slug. Slug collisions resolve through WP-canonical wp_unique_post_slug; the v2.3.48 fix changed the third arg from 'draft' to 'publish' to force the SQL collision lookup that the early-return path was skipping (Chrome MCP smoke confirmed RENAMED pill + sub-line render for existing slug).

Pass B (v2.3.30 + v2.3.38 + v2.3.41): REST controller. Four routes under /wp-json/gillish/cairnstone/v1/blocks/*: GET /<slug>/export (single-block download, pretty-printed JSON on the wire via rest_pre_serve_request), POST /preview (multi-file validation, no DB writes, partial-imports-land contract per §6 state d2), POST /import (commit step), POST /export-bulk (zip stream with Content-Disposition filename <host>-cairnstone-blocks-YYYY-MM-DD.zip). All four cap-gated on manage_options per §10 item 10 (the v2.3.38 cap-callback split was reverted in v2.3.40 after live verify revealed the CPT’s capabilities override already remapped every edit_* cap to manage_options, making the split structurally a no-op). Multi-file shape detection in file_params() handles four $_FILES shapes (flat-single, fan-out, field-wrapped fan-out, pre-normalised dict-list); the shape-2.5 detector landed in v2.3.47 after a Chrome MCP smoke caught a “No files attached” 400 that PHPUnit hadn’t exercised.

Pass C (v2.3.32): WP-CLI surface. Four subcommands under the gillish-cairnstone namespace: list-blocks [--format=...] (table / json / csv / yaml / count / ids via WP_CLI\Utils\format_items), export-block <slug> (canonical JSON to stdout, composable with | jq / > redirect), import-block [--from=<file>] (reads --from=<path> or stdin), wipe-blocks --yes (trashes every CPT post, recoverable from trash, requires explicit --yes flag per brief §6 state q).

Pass D-1 (v2.3.35 + v2.3.36 + v2.3.37 + v2.3.39 + v2.3.40): sidebar slot. Block export PluginPostStatusInfo slot between Phase 11’s “Block content” and the standard Permalink panel on the CPT editor. One quiet ghost button reading “Export this block (.gcblock.json)”; the click flows through window.location.href with the wp_rest nonce appended as ?_wpnonce=<nonce> (v2.3.39 closed the F3 P0: top-level browser navigation cannot set X-WP-Nonce header, so the cookie-auth REST request would have authenticated as anonymous and 403’d every export click on plain-permalink installs, broken since v2.3.35 ship). The v2.3.36 polish slice closed five post-D-1 critique findings (single-tag button-swap on draft → publish transition so keyboard focus survives, title typography against Gutenberg’s panel-header cascade, REST trash-status whitelist, redundant aria-label, .gcblock.json in helper line not button label). The v2.3.37 cascade-fix slice closed the two-class selector vs Gutenberg’s .interface-complementary-area h3 rule for both Phase 11 + Phase 12 sidebar slot titles.

Pass D-2 (v2.3.41 + v2.3.42 + v2.3.43 + v2.3.44 + v2.3.49): list-view chrome. Three filter callbacks on the gc_cairnstone_block CPT list table (post_row_actions per-row Export link, bulk_actions-edit-... Export selected dropdown entry, handle_bulk_actions-edit-... stream-and-exit dispatcher) plus a JS chrome layer (Import peer button + drop-target overlay + gc:cairnstone:import-files-ready CustomEvent the D-3 modal subscribes to). v2.3.44 polish cycle closed four P1 + one P2 from the v2 critique (JS ? vs & separator pick for plain-permalink installs, rest_pre_serve_request closure self-removes, register_shutdown_function temp-zip cleanup on client abort, handle_bulk_actions try/catch + defensive return, build_bulk_export_filename consolidated into the service). v2.3.49 added the top-row Export all button next to Import that mirrors the Import peer button position and downloads every block with a valid slug as a single .zip via a cap- + nonce-gated admin-post handler reusing the existing process_bulk_export_selected + stream_and_exit service pair.

Pass D-3 (v2.3.46 + v2.3.47 + v2.3.48 + v2.3.51 + v2.3.52): Import modal. Three sub-slices closed the modal surface: D-3.1 scaffold (wp.components.Modal at 560px max-width mounted into a body-level container via wp.element.createRoot, subscribes to the gc:cairnstone:import-files-ready CustomEvent), D-3.2 per-file preview rows with status pills (STATUS_PILL_MAP keyed on the locked five statuses, INVALID pill click-to-expand to field: reason, AbortController on the in-flight preview POST so Esc / Cancel mid-flight aborts), D-3.3 commit flow (Import button POSTs FormData to /blocks/import, dispatches a core/notices Snackbar reading “Imported N blocks as drafts.” with optional “(M files skipped)” suffix on partial imports, modal-internal drop-target re-dispatches the IMPORT_EVENT for symmetric append-on-open behaviour, in-flight commit guarded so Cancel disables and Esc / scrim-click refuse to close). v2.3.52 closed the post-D-3.3 user-feedback gap: the list table behind the modal stayed on its pre-import row count because WP-admin’s list table doesn’t subscribe to a data source for REST create-post events; the modal now schedules window.location.reload() 1500ms after the Snackbar dispatches so the user sees the confirmation, then the table refreshes with the new rows. v2.3.48 closed four P1 findings from the v3 critique (RENAMED-vs-NEW wp_unique_post_slug argument, modal close+reopen race, docblock typo, shape-2.5 PHPUnit regression-pin).

Harden sweep (v2.3.45): wp.org submission. Closed the carried-over P0/P1 findings the critique chain accumulated: zip-bomb pre-extract count via ZipArchive::numFiles + per-entry size check BEFORE unzip_file writes anything (caps at 100 entries, 5 MB per entry), Windows zip-slip via the two-layer pre-flight slash/backslash check + post-extraction realpath boundary (closes the gap validate_file leaves on backslash paths), sanitize_file_name on both Content-Disposition filename constructions, single-export pretty-print on the wire via rest_pre_serve_request (the v2.3.30 set_data path silently discarded the pretty-print intent), slug regex relaxed to [a-z0-9][a-z0-9-]* for digit-leading slugs, error-code prefix sweep on invalid_slug + json_encode_failed to the gillish_cairnstone_ namespace.

v3 critique deferred-12 polish (v2.3.50): Phase 12 reviewer-perfect close-out. Twelve P2/P3 findings carried forward to one polish cycle: rest_pre_serve_request single-export closure match narrowed (full payload-shape check, not just slug), HTML-fatal-as-SyntaxError diagnostic in modal preview fetch, error-state Try-again button, UNKNOWN pill fallback enum exposure with console.warn, INVALID pill aria-controls reference, long-slug row-head flex-wrap: nowrap, drop-overlay reset on window blur + Escape + dragend, bulk-action Apply is-busy state for the stream-and-exit window, helper-text #757575 → #50575e WCAG AA sweep, trash-list row-action skip (REST whitelist already rejected trash with 404), dual style handle consolidation (one STYLE_HANDLE shared with DocumentPanelAssets), dead-code triple-background declarations collapsed.

Verification trajectory: PHPStan level 9 = 0 errors at every commit. PHPUnit 596 tests / 1609 assertions green at v2.3.52 (a step up from 516 / 1339 at the Phase 11 closure as the service, the four REST routes, the CLI surface, the bulk-action handlers, and the Export-all admin-post handler all landed contract-test coverage). composer audit: 0 advisories at every push. a11y AA: 0 violations on every audit-gate run. Chrome MCP runtime-verify smokes caught four runtime defects PHPUnit + a11y structurally couldn’t see (F3 D-1 anonymous-REST 403, shape-2.5 fan-out detector, multi-permalink-shape ? separator, RENAMED-vs-NEW wp_unique_post_slug argument). The v2.3.40 procedural gate (Chrome MCP smoke required before any Pass D-N closes) is now part of the studio’s slice-closure ritual.

User documentation refreshed in the same session per the “designer / forfatter-visible features ship with docs” rule: new #import-export section in cairnstone/documentation/index.html walks through all five user-facing surfaces (sidebar Export slot, per-row Export, bulk Export selected, top-row Export all, Import modal with status-pill taxonomy + modal-internal drop + Snackbar) plus a CLI subsection covering the four wp gillish-cairnstone subcommands.

2026-05-27 · ten craft / harden / polish / clarify commits closing §5(c) + §5(d) + three critique-cycle defect classes · commits ed4fc2a → 1d55615 (v2.3.19 → v2.3.28 + DESIGN.md alignment)

Phase 11 closed: four-surface UI complete, set-property runtime bridge live, three critique cycles green

Phase 11 (Block Bindings integration) is fully shipped. The two entries below this one track the source-registration layer (v2.3.2 → v2.3.12) and the first three UI surfaces (v2.3.13 → v2.3.18); this entry tracks the closure work that landed §5(c) author-context Block content form, §5(d) Phase 9 set-property un-dim + runtime bridge, and the three critique cycles that hardened the surface to ship-ready. The shape brief plans/CANVAS-PHASE-11-SHAPE.md was retired into plans/DONE-WORK.md and deleted per the planning-documents close-out routine.

v2.3.19, manifest cross-check closes the post-critique footgun. /impeccable critique after §5(b) flagged the bindableAttributes + defaultBindings cross-check gap: a manifest could declare a default binding for an attribute it hadn’t opted into the bindable list, the seeding pipeline would silently write a binding that the editor inspector then couldn’t surface. The cross-validator landed in ManifestSchema: every defaultBindings key must appear in bindableAttributes on the same manifest, or the registry rejects the manifest at boot with a developer-targeted message naming the orphan attribute.

v2.3.20: §5(b) marker-pill tooltip prose clarify. The hover tooltip prose was generic (“From Source”); the source-aware prose now reads “From Cairnstone post meta · gc_price” / “From Post Data · title” / etc. with the source label routed through the same attributeLabels + source-label registry the inspector section uses, so the toolbar pill and the inspector header agree on naming by construction.

v2.3.21: §5(c) author-context Block content form. A new editor module assets/js/gc-block-content-panel.js mounts at Gutenberg’s PluginPostStatusInfo slot (the document-sidebar surface, narrowed by design to block.name.indexOf('gillish-cairnstone/') === 0 so third-party blocks don’t pollute the form). For every Cairnstone library block on the post, a row per bound attribute renders with the plain-language attribute label, a native input matched to the source’s key-name heuristic (URL field for *_url / *_link keys, number field for *_count / *_price, textarea for long-form keys, plain text otherwise), and a four-source dispatcher map that routes the write through the right WP-side API per source family (core/post-data → core.editPost; gillish-cairnstone/post-meta → core.editPost({ meta: ... }); gillish-cairnstone/term-meta → core.editEntityRecord; gillish-cairnstone/block-attribute → core/block-editor.updateBlockAttributes).

v2.3.22 + v2.3.25 + v2.3.27: §5(c) follow-up polish. v2.3.22 wired the three Cairnstone-side source dispatchers (post-meta, term-meta, block-attribute) end-to-end so the form actually mutates each backing store, not just core/post-data titles. v2.3.25 narrowed the trigger heuristic (only blocks declaring bindableAttributes in their manifest show form rows; legacy library blocks without the manifest field stay silent until they opt in) and added the input-type dispatcher. v2.3.27 expanded the key-name heuristic to a richer suffix-and-stem table so cta_url, hero_image_link, price_amount, and description_long each pick the right native input on first render.

v2.3.23 + v2.3.24 + v2.3.26 + v2.3.28: §5(d) Phase 9 set-property un-dim, runtime bridge, cap-gate, i18n. v2.3.23 un-dimmed the long-disabled set-property row in the Interactions panel: the picker is no longer behind GC_DEV_MODE, an inline three-field sub-picker (source → key → value) renders below the action selector, and the picker shape is locked as v1 canonical (the original brief had promised WP-core’s BlockBindingsAttribute Connect UI but WP-core doesn’t expose it as a standalone primitive; the 3-field Cairnstone form is the correct shape for the runtime write surface). A BlockBindings::set_value() per-source write dispatcher handles post-meta + term-meta + core/post-data writable sources (block-attribute / node-link / core/term-data return false with documented deferral rationale). v2.3.24 closed the gap between the picker and the dispatcher: Shared\SetValueRestController exposes POST /wp-json/gillish/cairnstone/v1/set-value cap-gated on edit_others_posts, Shared\InteractionsRuntime renamed the setPropertyNoop handler to live setProperty, and the runtime module reads its config (setValueApiUrl + restNonce) via wp_interactivity_config('gillish-cairnstone', ...) mirroring the JS Interactivity API’s ESM-compatible config channel. v2.3.26 reconciled the JS picker cap-gate with the PHP write-scope (userCan.editOthersPosts flag publishes through to the picker; an author lacking the cap sees the set-property row but the value-write call returns 403 from the REST layer instead of half-disabling client-side). v2.3.28 registered the ten config_sp_* i18n keys for the sub-picker labels + placeholders + error strings.

Three critique cycles: the closure pattern that scales. Same audit-driven closure pattern that Phase 9 + Phase 10 used, run three times: (1) /impeccable critique after the §5(b) pill surfaced one P2 (the defaultBindings / bindableAttributes cross-check footgun) closed in v2.3.19; (2) /impeccable critique after the v2.3.23 §5(d) un-dim surfaced one P1 (the runtime bridge was missing: the dispatcher existed but nothing called it from the frontend) + four P2s closed across v2.3.24 → v2.3.26; (3) /impeccable critique on the full Phase 11 surface afterwards surfaced three more P2s (Connect-UI brief drift, i18n debt, deferred input types) closed via the brief update + v2.3.27 + v2.3.28. The pattern (critique → harden / polish / clarify → critique) caught five real defects the initial shape brief hadn’t pre-empted; the brief’s voice + anti-reference discipline caught the rest at write-time.

What was deferred and is NOT in Phase 11’s shipped surface: multi-attribute marker pill (v1 surfaces only the first bound attribute); templateLock="contentOnly" half of the §5(c) author-form trigger (Hero ships without it); array-bound RepeatingFieldEditor rows in the author form (lights up when a library block declares an array-shaped binding, today none do); multi-block grouping with subheads in the author form (single-Hero-per-post is the realistic shape); BlockBindings::set_value() for block-attribute / node-link / core/term-data sources (each returns false with documented rationale: block-attribute writes would mutate post_content, Node-link needs Node’s bridge filter, core/term-data needs taxonomy-attachment resolution); Snackbar success / failure feedback for the set-property runtime POST (brief doesn’t pin runtime feedback semantics; the runtime stays fire-and-forget per setVisitorState precedent); WP-core Connect UI as the set-property sub-picker (locked as a 3-field Cairnstone form per brief §10 item 10); camelCase coverage in pickInputComponent heuristics (snake_case-only by WordPress meta-key convention; the deferred per-key-type-hint seam is the right long-term fix).

Verification trajectory: PHPStan level 9 = 0 errors at every commit. PHPUnit 516 tests / 1339 assertions green at v2.3.28 (a step up from 496 / 1297 at v2.3.18 as the bindable-attrs cross-check, the REST controller, and the rewritten set-property contract tests all landed). composer audit: 0 advisories at every push. a11y AA: pa11y + axe-core both at 0 violations on the floor frontend scan and 0 violations on the editor scan, the local-only audit gate green across all ten pushes. Studio smoke via Chrome MCP confirmed the four UI surfaces end-to-end on a fresh CPT-editor session: Cairnstone data inspector tab renders with the chip-row picker, marker pill renders BOUND: HEADING on a fresh Hero block (the v2.3.18 first-default-binding seed), Block content form row writes back through to the post-meta backing store, and the set-property runtime POST round-trips through the cap-gated REST endpoint on click.

2026-05-26 · five Phase 11 craft commits + one rename-completion cleanup that unblocked three library blocks · commits 1b887e7 → e334e41 (v2.3.13 → v2.3.18)

Phase 11 surface layer: three of four UI surfaces shipped, Hero seeds its first defaultBindings

The source layer closed at v2.3.12 (entry below). The UI layer is now three of four surfaces in. §5(a.3) first-open seeding shipped at v2.3.13, §5(a) library-block bindableAttributes opt-in seam shipped at v2.3.14 (Hero first opted in), §5(b) editor-canvas BOUND: PRICE marker pill shipped at v2.3.15, and Hero’s first defaultBindings declaration shipped at v2.3.18 alongside the Edit refactor that closes the WP 6.9 placeholder-object React-child crash. §5(c) author-context Block content form and §5(d) Phase 9 set-property un-dim remain.

v2.3.13: §5(a.3) first-open seeding closes for the platform layer. The Pass 5-8 mirror’s plumbing (manifest field → ManifestSchema::validate_default_bindings → Shared\BlockBindings::$default_bindings registry → InspectorPanelsModule payload publish → editor read at window.gcInspectorPanels.defaultBindings) was already in place from v2.3.8. v2.3.13 closed the brief’s seeding behaviour in assets/js/gc-bindings-panel.js: a new useEffect in BindingsSectionPanel reads the published payload on each block-selection, walks the per-block defaultBindings map, and atomically writes seed entries into metadata.bindings.<attribute> only when no binding already exists. The “never re-seed once cleared” half of the contract is enforced via a Cairnstone-namespaced marker metadata.gcBindingsSeeded, an array of attribute names that survives saves and loads inside Gutenberg’s existing metadata serialisation, so the second-mount case after a × clear sees the marker and short-circuits.

v2.3.14 + v2.3.18, Hero opts in, then seeds its first source. v2.3.14 added the manifest seam bindableAttributes: ["heading", "subheading", "imageUrl"] with the matching ManifestSchema validator, the Shared\BlockBindings::$bindable_attributes registry, and the apply_bindable_attributes_filter callback that merges the declared list into WP 6.9’s block_bindings_supported_attributes filter. Hero opted in but withheld defaultBindings, the placeholder object {} that WP 6.9 substitutes for unresolved bound attrs crashed React the moment it landed as a JSX child (Objects are not valid as a React child (found: object with keys {})). v2.3.18 closed the gap with a safeBindable( v ) { return typeof v === 'string' ? v : ''; } coerce-at-render-boundary helper in Hero/editor.js, hoisting heading / subheading / imageUrl to local strings the entire render reads from. With the crash closed, Hero ships defaultBindings.heading = { source: "core/post-data", key: "title" }, the first library-block defaultBindings declaration to actually flow through the v2.3.13 seeding pipeline. Studio smoke via Chrome MCP confirmed metadata.bindings.heading seeds correctly on first inspect of a fresh Hero block, and gcBindingsSeeded: ["heading"] writes alongside so a later × clear stays cleared.

v2.3.15: §5(b) editor-canvas marker pill. A BOUND: <ATTR-LABEL> pill renders at the end of the Gutenberg block toolbar (BlockControls group other) whenever a block has any bindable attribute currently bound. The pill reads the same metadata.bindings + attributeLabels registries the inspector section header uses, so a heading attribute bound to core/post-data title surfaces as BOUND: HEADING and the two surfaces agree on which attribute the pill names by construction. Hover exposes a tooltip with the source qualifier (“From Post Data · title”) so the author has the full binding identity without opening the inspector. Typography matches DESIGN.md label (11px / 600 / tracked uppercase, --gc-quiet-slate text, no fill, no border) so the pill reads as a status indicator rather than a CTA. The marker mounts at the withCanvasInspector HOC level on every block (no-ops when no binding present), so any block participating in WP 6.9’s block_bindings_supported_attributes map gets the indicator, not just Cairnstone library blocks. v1 stops at hover-tooltip; click-to-unbind + Snackbar Undo from the §5(a) chip-row × path lands in a follow-up pass.

v2.3.16, the Canvas → Cairnstone JS-global rename completion (cleanup that unblocked three library blocks). The v2.3.0 namespace rebrand renamed window.gcCanvasBlocks → window.gcCairnstoneBlocks in the runtime bootstrap assets/js/gc-block-runtime.js and most consumers, but four editor files were missed and had been silently broken since: three library blocks (Badge, Pricing Table, Pricing Pro) failed their prereq guard and never registered their custom editorRender with the runtime, falling back to defaultEditorRender on every author insert, so the rich preset / silhouette / variant pickers never rendered in the editor. The fourth file, assets/js/gc-inspector-panels.js, read its manifest registry from the stale gcCanvasBlocks._manifests registry that never gets populated because BlockRuntimeAssets.php writes to the canonical gcCairnstoneBlocks._manifests. The mismatch meant sectionsFor() saw an empty registry and every Cairnstone block’s per-manifest globalAttributes opt-out (canvasStyle / conditionalContent / canvasInteractions / schemaEmission) silently fell through to default-true across the whole library, defeating the per-block opt-out seam. Hero was unstuck at v2.3.14 as a sibling fix during the §5(a) bindable-attrs work; the v2.3.14 entry tracked the remaining four as a cleanup task. v2.3.16 closes it with a wholesale replace_all gcCanvasBlocks → gcCairnstoneBlocks across the four files. No semantic change; the rename was always meant to be wholesale. Verified via Chrome MCP: 1 gc-library-badge-editor-wrap + 2 block-editor-block-variation-pickers rendered in the editor iframe after a fresh post insert; gcCairnstoneBlocks._manifests carries the full 15-block registry; asset URLs at ?ver=2.3.16; no gcCanvasBlocks references anywhere in console, DOM, or runtime.

v2.3.18 also swept a stroke-width hairlines bug that the rename had been hiding. Four library variation-icon helpers wrote SVG presentation attributes in their createElement calls using the kebab-case CSS form ('stroke-width', 'stroke-linecap') instead of React’s camelCase DOM form (strokeWidth, strokeLinecap). React rejected the kebab keys with the runtime warning “Invalid DOM property `stroke-width`. Did you mean `strokeWidth`?” and the rendered SVG silently dropped the attribute, so variation thumbnails rendered without their hairline strokes. Twelve sites swept across PricingTable (7: the bars helper + 6 inline el('line', …) calls for the comparison-table variant), PricingPro (1: the bars helper mirrored from PricingTable), DiscountBanner (1: the viewport outline rect), AffiliateDisclosure (3: the circle stroke, path stroke, and the same path’s stroke-linecap → strokeLinecap on the same object literal). The bug shipped with the original library authoring but was hidden until v2.3.16 unblocked Badge / PricingTable / PricingPro’s variantIcon path; DiscountBanner and AffiliateDisclosure shared the bug by copy-paste-pattern but their warnings sat behind the variation-picker open state.

Verification trajectory: PHPStan level 9 = 0 errors at every commit. PHPUnit 38 / 38 through v2.3.13, 496 / 1297 from v2.3.14 onwards (Hero bindableAttributes opt-in landed with 22 new tests covering the registry + filter callback). composer audit: 0 advisories at every push. a11y AA: 0 violations on the floor frontend scan + 0 violations on the editor scan (pa11y + axe-core via the Studio Playwright slot, run automatically before every git push origin main).

2026-05-26 · eight craft commits + one hotfix bundled into the §5(a) commit · commits 7396361 → a566dbf (v2.3.2 → v2.3.12)

Phase 11 source-registration layer complete: four-of-four binding source families landed

The substrate Phase 11 needs ships in two halves. The source layer closes today: four register_block_bindings_source() calls, one shared orphan-label contract (resolve_value_with_fallback routes every callback), one JS-side bootstrap mirror per WP-core’s class-wp-customize-widgets.php pattern, one defaultBindings manifest-driven five-seam mirror matching Phase 10 Pass 5-8. The UI layer remains: §5(a.3) first-open seeding, §5(b) editor-canvas marker pill, §5(c) author-context Block content form, §5(d) Phase 9 set-property un-dim.

What shipped (source side): v2.3.8 (daa3c65) bundled the Pass 1 foundation (Shared\BlockBindings registry + ManifestSchema::validate_default_bindings + 16 tests) + RepeatingFieldEditor extraction to gc-controls.js + inject_default_bindings hooked into FILTER_REGISTER_BLOCK_ARGS + the defaultBindings payload publish + the first two source families (gillish-cairnstone/post-meta, gillish-cairnstone/term-meta) into one catch-up version after six craft commits shipped without per-commit bumps. v2.3.9 (34ad71d) added gillish-cairnstone/block-attribute with recursive block-tree walking on anchor / clientId. v2.3.12 (a566dbf) added the fourth and final family gillish-cairnstone/node-link via a new gillish_node_resolve_link bridge filter mirroring the GeoIp country-resolution pattern (Cairnstone declares the binding shape; Gillish Node owns the runtime resolution).

§5(a) inspector tab shipped + hotfixed (UI side, first surface): v2.3.10 landed assets/js/gc-bindings-panel.js as the first JS surface of Phase 11: a Cairnstone-owned inspector section peer to Style / Visibility / Schema / Interactions, lists bindable attributes (read from WP 6.9’s __experimentalBlockBindingsSupportedAttributes editor setting), status pill BOUND: PRICE in the section header, chip-row or flat-list SelectControl picker per attribute. v2.3.11 hotfixed a fields-list shape mismatch discovered during smoke: get_post_meta_fields_list and get_term_meta_fields_list originally returned an object-keyed map ({key => {label, value}}) but WP-core’s native BlockBindingsAttribute component (block-editor.js line 46522) calls source.data?.find() on the data field and expects the array-of-objects shape per core/post-meta ({label, args: {key}, type}). The mismatch crashed any block on binding-set because the React error boundary caught the resulting TypeError with the generic “This block has encountered an error and cannot be previewed.” The fix shipped both halves in one commit: PHP-side emits the WP-core-shape array; JS-side buildPickerOptions reads args.key + label off each entry; inline-script bootstrap defends with Array.isArray(cfg.fields) ? cfg.fields : [].

Verification trajectory: PHPStan level 9 = 0 errors at every commit. PHPUnit 37 / 37 through v2.3.11, 38 / 38 at v2.3.12 (one new test pins the FILTER_NODE_RESOLVE_LINK constant to prevent accidental cross-plugin renames). Studio smoke confirmed end-to-end on a fresh post-new.php tab: paragraph bound to gc_price post-meta renders cleanly with “Cairnstone post meta” placeholder (WP-core’s native fallback when no value is set); WP-core’s Attributes panel reads “Price” as the field label from the new array shape; Cairnstone’s own “dataBOUND: CONTENT” inspector section header renders alongside it; no React error boundary triggered; four Cairnstone sources visible in wp.blocks.getBlockBindingsSources() registry. composer audit: 0 advisories. a11y AA: 0 violations (puppeteer + axe-core scan against the gc_cairnstone_block CPT editor).

Two WP 6.9 quirks documented inline: (1) PHP register_block_bindings_source() does NOT auto-mirror to the editor’s JS wp.blocks registry, the native sources reach JS via hardcoded calls in wp-includes/js/dist/editor.js lines 31152-31155; third-party sources must publish their own JS-side bootstrap. (2) The PHP-side $allowed_source_properties allowlist accepts only label, get_value_callback, uses_context, passing get_fields_list silently fails (it’s JS-side only). The patterns landed canonical in BlockBindings::bootstrap_js_sources with full docblocks.

2026-05-21 PM → 2026-05-22 · nine craft-passes + four post-audit landings + voice polish + Rich Results micro-pass · commits f14013c → f6a5b63 (v2.2.120 → v2.2.138)

Phase 10 closed at 20 of 20 on the impeccable audit

The Schema panel reaches the top of the rubric’s Excellent band. Same closure pattern as Phase 9 the morning before: nine craft-passes shipped a working surface, then a /impeccable audit cycle scored the surface at 16 of 20 (Good band) with five concrete findings: three P1 a11y gaps (aria-live region + focus management + status-badge ARIA wiring on the RepeatingFieldEditor), one P2 perf miss (readGcSchema cascading memo invalidation), one P2 touch-target gap (the repeating-row × button below 44×44 px), and four hard-coded theming leaks in the inspector CSS.

What shipped: v2.2.135 (0def8ee) landed harden + optimize + adapt-F5 + polish in one coordinated commit, closing all five named findings plus a bonus a11y fix (replacing redundant label: null + hideLabelFromVision with proper accessible names). v2.2.136 (2c62a27) extended the adapt-pass to five additional touch-target gaps the audit hadn’t explicitly enumerated: step indicator tabs, raw JSON-LD <summary>, the inherit override + revert links, and the repeating-row + Add button. The pseudo-element hit-area overlay pattern (math visible-height + 2 × |inset| = 44) is now Cairnstone’s house style for inspector chrome; six elements use it across the Phase 10 surface. v2.2.137 (7fdb063) is the post-audit voice polish: the toggle-off help text drops the “JSON-LD” acronym (now reads “Tell search engines what this block is so they can show rich results in search.”), the footer shifts to present tense (“Emits Product JSON-LD” replaces “Will emit”; “Not emitting” replaces “Emission disabled”). v2.2.138 (f6a5b63) closes the last deferred item from the shape brief: the Test in Rich Results ↗ link in the actively-emitting footer state, opening Google’s Rich Results Test in a new tab with a three-tier URL fallback (preview link → permalink → bare validator).

Audit trajectory: 16 / 20 → 20 / 20 (a11y / perf / theming / responsive all advanced 3 → 4; anti-patterns held at 4). 436 PHPUnit tests / 1210 assertions green at ship. PHPStan level 9 at 0 errors throughout the nine passes + four post-audit landings. Two P3-er parked (F-8 read_block_type_default per-request caching, sub-millisecond; F-10 dynamic-content aria-live polish on warn footer + Auto-filled tag transitions); neither blocks wp.org submission. The shape brief was retired to plans/DONE-WORK.md with a closure entry listing every (10): commit; the brief file was deleted from plans/ per the planning-documents close-out routine missed when Pass 9 first shipped.

Six process lessons codified: (1) the audit-driven closure pattern scales (Phase 9 + Phase 10 both closed via the same cycle); (2) the pseudo-element hit-area pattern is Cairnstone house style for inspector chrome (six elements use it); (3) single-commit multi-command coordination beats four separate landings when changes are coupled on the same files; (4) extend /impeccable adapt beyond the literal audit finding when the broader interpretation is clear (the five additional touch-target gaps were the unenumerated implication of one named F-5); (5) the manifest-driven five-seam pattern from Pass 5-8 is formal infrastructure (schemaDefault + schemaAutoMap + attributeLabels reused by Phase 11’s defaultBindings); (6) floor lifts mid-craft are cheap when test envs roll forward in lockstep (three WP lifts 6.6 → 6.8 → 6.9 plus one PHP lift 8.2 → 8.3 all absorbed without breaking Phase 10 momentum). The Phase 10 craft surface is now the second canonical instance of the audit-driven closure workflow; the template generalises.

2026-05-21 · nine ship-passes + one hotfix · commits 669238e → 2efece9 (v2.2.111 → v2.2.119)

Phase 9 closed at 20 of 20 on the impeccable audit

The interaction system reaches the top of the rubric’s Excellent band. A post-Pass-11b audit + critique cycle scored the surface at 14 of 20 and 24 of 40 respectively, surfacing two WCAG-blocking P0s (single-click destroy on the row Delete button, drag-only reorder), three P1s (menu keyboard semantics, the fourteen-radio action picker overwhelming first-touch, icon-glyph drift from the Composing Bench register), and a fan of P2 / P3 polish items. Nine post-audit ship-passes plus one hotfix closed every finding across roughly four hours of focused work.

What shipped: snackbar Undo for the row Delete button (matches Gutenberg’s trash-post + remove-block convention; restores at the original index); keyboard reorder via Move up / Move down items in the meatball menu with wp.a11y.speak position announcements (closes WCAG 2.5.7 Dragging Movements); progressive-disclosure action picker (fourteen radios collapse into a five-row accordion, unwired families dim behind a GC_DEV_MODE gate); full WAI-ARIA menu keyboard semantics (Arrow / Home / End wrap-around + focus return to the meatball trigger); icon-glyph consistency via inline SVG components matching the @wordpress/icons paths (drag handle widens 20 → 24px to clear WCAG 2.5.8); threshold TextControl input race fixed with a debounce-commit buffer + inline dropped-value feedback; scroll-observer JSON precision rounded to 4 decimals + initial-state fire skipped so chains stop firing on page load. Plus a polish sweep closing five P2 / P3 findings in one commit, and the Pass 12g hotfix that rolled back a wp-icons script-dep regression (the handle isn’t registered in WP-core; relying on it silently blanked the entire Interactions panel).

Audit trajectory: 14 / 20 → 17 / 20 (after polish sweep) → 20 / 20 (final, after Pass 12i). 307 PHPUnit tests / 798 assertions green at ship. PHPStan level 9 at 0 errors throughout. Three CDP smoke-tests on the live build verified the snackbar Undo restore path, the meatball Arrow / Home / End wrap-around, and (the day’s most portable lesson) the icon-glyph regression that PHPUnit and node --check couldn’t see: missing script-handle registration only surfaces when WordPress actually tries to print the page. Cross-phase carry-overs (Class action runtime, Media action runtime, set-property runtime, Time + Index trigger runtimes) re-categorized to Phase 11 and Phase 16 scope rather than tracked as Phase 9 closure-debt; the consuming phase owns the runtime. Inspector trilogy advances: Style + Visibility + Interactions all shipped, Schema panel is next with the shape brief already locked.

2026-05-20 · directive-driven roadmap reorganisation · FOUNDATION + CLAUDE.md commit 804982b

Phases 10–17 renumbered to front-load sidebar infrastructure before any new blocks

Every infrastructure phase that touches the editor sidebar is now pulled forward, so the inspector contract locks before any block-building work resumes. The reasoning Erlend named is the same one that paused Phase 7b in May: walking 13+ existing blocks’ sidebars after every infrastructure addition is the wasted work that compounded fastest. Locking the whole infrastructure stack first eliminates the repeat verification.

The new order after Phase 9 closes: Phase 10 Schema panel (third top-level inspector panel, shipped) → Phase 11 Block Bindings (binding picker on core blocks, shipped) → Phase 12 import / export (CPT-level toolbar, not block-edit sidebar, shipped) → Phases 13–15 AI integration (Abilities API base, richer introspection, preview + batch) → Phase 16 library upgrade pass (first block-building phase, against a now-stable sidebar) → Phase 17 third-party block verification. Phase 18 license plumbing stays last by convention.

Old → new mapping: 10 → 12 (Import/export), 11 → 16 (Library upgrade), 12 → 17 (Third-party verification), 13 → 10 (Schema panel), 14 → 13 (AI Abilities API), 15 → 14 (AI introspection), 16 → 15 (AI preview + batch), 17 → 11 (Block Bindings). License plumbing (18) unchanged. References in recent-change entries below this one use the pre-2026-05-20 numbering: map back via the table above when in doubt.

Consequence applied 2026-05-20: the 5 already-shipped Phase 7b transplants (Badge, Section Divider, FAQ, Testimonial, Pricing Table) face the same post-infrastructure drift risk as the 10 unshipped ones, strict reading of the same principle that motivated the renumbering. They stay live through Phases 10–15 (no UX regression) but get a sidebar-alignment pass in Phase 16 alongside the full transplant of the remaining 10. All 15 transplants now land in Phase 16.

2026-05-20 · six decision-level landings across the design-substrate vault · FOUNDATION row 229 amendment e0b7f87 · PRODUCT.md amendment a1a6713 · CLAUDE.md amendment bd2a17a

Shape briefs locked for Phase 9 and Phase 4.X, plus better-together strategy and customer-extensibility positioning

Same-day landing tally after Phase 8 closed: two shape briefs locked, two advance-shape sketches written, one architectural cross-cutting decision, one strategic-direction landing, and a refresh of the public positioning story. Phase 4.X craft → Phase 9 craft is the natural shipping sequence (Phase 4.X ships the visitor-state primitive first so Phase 9’s set-visitor-state action wires live instead of as a registered no-op).

• Phase 9 shape brief locked. The interaction system ships as a per-block Interactions PanelBody in the default Settings tab (sibling to Visibility + Schema), with a plain-language “When → Then” structure inside per-interaction popovers. Trigger taxonomy expands from the original five interaction-driven names to four axes: Interaction (click / hover / focus / keyboard), Time (media-time), Index (slide-change / step-change / tab-change), Scroll (scroll-progress continuous plus the existing discrete crossings). Action vocabulary in four families: State (toggle Phase 8 state classes), Class (author-named CSS hooks), Media (HTMLMediaElement methods), Property (Phase 11 Block Bindings writes including set-visitor-state). Click-to-target with hover-highlight + dropdown fallback for cross-block targets. Setup → Configure → Test lifecycle per interaction. Free tier on wp.org. Mobbin-1.5-backed (~60 screens across 14 reference products including Webflow Interactions, Framer interactions popover, Figma Prototype, Airtable Automations, Fibery, Qatalog, Intercom Proactive Support, Zapier, beehiiv, Relevance AI, Chatbase, PlayAI, Rive, Jitter).
• Phase 4.X CC visitor-state primitive shape brief locked. Extends Cairnstone’s existing visitor-context primitive (visit count + sticky cookies + local hour) into a cross-block key-value store keyed by namespace + sub-key. Storage hybrid: anonymous → sticky cookie gc_visitor_<namespace>; logged-in → WP user meta. Write hybrid: client-side cookie writes for anonymous, REST endpoint for logged-in (with wp_rest nonce + read capability check + 60-writes-per-minute rate limit + 4 KB payload cap + 100-keys-per-namespace cap). Anonymous → logged-in migration on wp_login with a 10-minute cookie-wins / older-state-from-user-meta-wins conflict window. Additive cookie naming (the existing gc_cc_<blockId> CC stickiness contract preserved 100%). Unblocks the three Phase 9 no-op actions: set-visitor-state directly, set-property via Phase 11 Block Bindings, and the Chapter Router’s per-visitor bookmark / playhead-resume features via Phase 11.
• Better-together = Pro-tier strategy landed. Cairnstone’s Pro-tier story past acquisition: any commercial or runtime-dynamic feature defaults to a Cairnstone + Node composition. Cairnstone declares form and structure; Node owns runtime decisions (GeoIP catalogue, GSC data, click stats, A/B engine, managed-link health, rank tracking, manifest / CRA status). When shaping any new Pro feature the default first question is “is there a Node-integration angle?” Three integration mechanics live: public hook filters (the shipped pattern), Phase 11 Block Bindings sources (the forward-looking mechanism), and REST + cron-cached tables for higher-volume queries. The catalogued Pro features (Pricing Pro geo-bound pricing, affiliate auto-fallback, A/B Variant Splitter, Search Impression Sink CC recipe, Volume-gated content container, Rank Tracker Booster, click-quota Discount Banner, CRA compliance indicator) are proof-of-concept examples; the product is the composition surface. PRODUCT.md gained a new “Pro-tier positioning” section; CLAUDE.md gained a strategic-direction pointer.
• Customer-extensibility post-launch positioning. The catalogued Pro features will keep growing, but the strategic goal post-launch is not to anticipate every use case, it is to make the use cases customers have not surfaced yet authorable by them. Two extension paths: the builder UI (Phase 7 Repeater + Phase 8 states + Phase 9 triggers + Phase 11 Block Bindings against Node sources) for non-technical authors composing within the primitives, and the Phases 13–15 Abilities API surface for technical authors and AI agents constructing blocks / bindings / interactions programmatically. Phases 13–15 are reframed as the customer-extensibility surface, not as “AI features” in the bandwagon sense.
• FOUNDATION row 229 expanded to mirror the Phase 9 shape brief: four trigger axes named, four action families named, three no-op-until-dependent-phase contracts surfaced (media-time → Phase 11, set-property → Phase 11, set-visitor-state → Phase 4.X). Plan-doc now consistent with the shape brief before Phase 9 craft starts.

2026-05-20 · commit 5283bda (Pass 6 closes Phase 8, v2.2.82); earlier Phase 8 chain 45ba07c → 76096eb

Phase 8 closed: state-driven controls wired end-to-end

Phase 8 (state-driven controls, Default / Hover / Focus / Active / Disabled) is structurally complete. Pass 6 closed the last gap: the universal Style panel’s StyleBody (DropShadow geometry + background-colour / text-colour / padding / margin / font-size gap-fillers) now reads and writes the slice the state switcher at the top of the Styles tab points at, instead of always writing to gcStyle.default. Before Pass 6 the switcher was half-functional for the seven non-transplanted blocks and for any universal-control surface in the four transplanted blocks, picking Hover and adjusting the universal shadow silently edited Default. A new hasAnyStyleChanges( attributes ) helper drives the nuclear Reset Style button so it stays visible whenever ANY state slice carries edits, never stranding a Hover-only customisation when Default is empty.

The server-side substrate (src/Shared/StyleAttribute.php) emits each non-default state as a dual selector pair: :hover, .gc-hover; :focus-visible, .gc-focus; :active, .gc-active; :disabled, [disabled], .gc-disabled, all merged over default. The five state names are the shared vocabulary Phase 9 set-state targets, fixed by the Model D shape. The Pass 5 StateBindingDisciplineTest machine-guards the per-block write-key contract (a transplanted block may rebind only the value-binding key, and that key MUST stay the gcStateEditing-selected variable, never a literal 'default'). Composer test 155/155, composer stan [OK] 0 at level 9, node --check clean. CPT-editor visual verify is the follow-on once the deploy run lands.

2026-05-20 · directive-driven phase-plan consolidation

Phase 7b merged into Phase 11; Video embed Pro block also lands in Phase 11

Phase 7b (the sidebar transplant, paused 2026-05-15 with 5 of 15 shipped blocks transplanted) is no longer a standalone phase. The 10 remaining transplants (three primitives: Container, Columns, Repeater, plus seven library blocks, Affiliate Disclosure, Author Bio, Discount Banner, Hero, Pricing Pro, Table of Contents, Trust Badges) fold into Phase 11’s library-upgrade scope. The Video embed Pro block (idea graduated the same day from the Block-ideas backlog) also lands in Phase 11: a Conditional-Content-leveraging YouTube / Vimeo / Twitch / generic-iframe wrapper whose commercial-distribution use cases: geo-licensed video, premium-content gating, A/B-by-device, fit the Pro tier.

Phase 11 becomes a single library-completeness pass with three folded scopes: (a) the 10 remaining transplants onto the locked sidebar pattern from the 2026-05-15 Default block-builder sidebar decision, retiring the four transplant padlocks and the src/Modules/Scratch/ substrate when the last block ships; (b) the Video embed Pro block (full block shape brief deferred to /impeccable shape Block video-embed when Phase 11 starts); (c) the six state+interaction-driven blocks on top of Phase 8/9 primitives: Accordion, Tabs, Modal, Carousel, Counter, Reveal-on-scroll. The 2026-05-15 Phase 7b pause-decision is marked superseded; the 8/9/10 rotation that note also codified stays load-bearing. Phase 9 (the interaction system) is the next active beat.

2026-05-15 · commits 5a710cb (plan), 2becd68 (CLAUDE.md), ffdacf5 (this site), fc73d6a (readme)

Phase 7b paused; the back half reordered (8 / 9 / 10)

Phase 7b (sidebar transplant) was paused by directive at 5 of 16 blocks, and the back half was resequenced: state-driven controls moved to Phase 8, the interaction system to Phase 9, and import / export to Phase 10. Phase 7 (the Repeater primitive) had already shipped on 2026-05-14 and keeps its number ahead of the renumbered tail. The roadmap sections, table of contents, status pill, and every cross-reference on this site were retargeted to match; the plan, CLAUDE.md, and the readme changelog were corrected in step.

2026-05-14 → 2026-05-15 · commits ae0b0e9 → 7e9662b (the Phase 7b transplant + Section Divider shadow chain, v2.2.42 → v2.2.65)

Phase 7b: the locked sidebar pattern propagates to the library

Every shipped block is migrating onto one universal Styles-tab shape (Typography, Dimensions, Border, Opacity, Color, an optional block-specific panel, Shadow, Advanced) with a role-based Color panel that carries named brand roles plus a Custom background / text / link mode. The pattern was locked against a throwaway scratch substrate over ~30 commits, then propagated block by block, each its own shippable version.

• Five of sixteen blocks transplanted. Badge and Section Divider proved the pattern handles real bespoke complexity; order #3 (FAQ, Testimonial, Pricing Table) followed as the moderate-content trio. Each ships native Typography / Dimensions / Border, the Cairnstone Opacity and Color panels, and per-block placement of its own controls (Testimonial’s Layout in Settings between Quote and Attribution; Pricing Table’s variant in Settings as identity, its highlight accent as its own Styles panel).
• Section Divider shadow rebuilt per-geometry. A long-running shadow defect was root-caused: CSS filter is a chain, so stacking identical drop-shadow() passes recursively smeared the source (sparse-glyph saturation, a wave-path browser freeze). Fixed by choosing the shadow primitive per source geometry: box-shadow for the hairline, a non-recursive text-shadow list for glyph and label text, a bounded drop-shadow() for the SVG wave. Captured as a reusable contract.
• Four transplant invariants are now build-enforced. Regression tests fail composer test if a transplanted block’s manifest typography drifts from the anchor, a Styles panel loses its marker class, a colour-opted-out block is missing from the duplicate-control suppression list, or no styles panel is mounted unconditionally to anchor the slot order. Live review caught what contract checks missed; the guards now catch it first.

Phase 7b was paused on 2026-05-15 at 5 of 16 blocks (orders #1–#3 done). When it resumes it closes only when the last block ships and the scratch substrate is deleted; order #4 (Hero, Discount Banner, Author Bio, Pricing Pro) is the resume entry point. The universal-sidebar buttons / CTR-styleability pass stays sequenced after the phase closes.

2026-05-13 → 2026-05-14 · release bump 1d9668a, plus the surrounding craft and polish commit chain

v2.2 release line: Badge block, Pricing Pro craft, universal CTA polish, inserter split

Five clusters landed across the release line.

• Badge, the thirteenth library block (ec9b479 + polish chain through v2.2.14). A small label block (free tier) with seven silhouettes (rectangular, rounded, pill, hexagon, ribbon, octagon, parallelogram), a curated 24-icon Cairnstone set (relocated from Pricing Pro into Shared\IconSet for cross-block reuse), label-text that accepts spaces, optional shadow, optional radius slider, and a clip-path emission that survives the universal Style panel’s drop-shadow. Opts out of the universal Style panel for the outer wrapper so the silhouette stays clipped; gcStyle inline-style emission moved after the sprite emission to fix a shadow + clip-path render-ordering bug. Twelve free + one Pro becomes thirteen free + one Pro across the library.
• Pricing Pro craft + a11y (b183261 → 0232791 → d6759b6). Per-tier icon picker with the 24-glyph Cairnstone curated set (the same set Badge now re-uses via Shared\IconSet); per-feature glyph override popover so a feature can carry an icon distinct from its tier’s default; toggle a11y upgrade to radiogroup + aria-checked + arrow-key navigation; sticky-header offset for the WP admin bar (the sticky-top header was sliding under the 32px / 46px admin-bar strip); editor preview parity (the editor canvas was rendering a stale variant after a billing-mode flip); seed-reset paths and brightening-reversal fixes.
• Universal library polish (acb4ae4, 0be6a2b, ae6e95f, d6078a4). 44px tap target + distinct focus-visible on every CTA across the library (WCAG 2.2 AA Target Size Minimum + accessible focus indication, applied uniformly so no per-block follow-ups need to repeat the rule). Compact ColorDropdown for all per-instance colour pickers: dense swatch surface that fits more colours per row in the property panel without scrolling. Swatch polish: dropped the placeholder ‘/’ glyph on empty swatches; always-on Cairnstone Ink hairline border so the swatch reads as a control even when empty.
• Affiliate Disclosure site-wide overrides (e179418 + bee9e1d + 3799e61). New Options key + typed getter for FTC-compliance template overrides at the site level (so a site that uses “Amazon Associates” as their default does not need to re-pick on every block insert). New Settings tab surfaces the overrides; render path threads them through both the editor and the frontend so the default cascades from Settings → block-level pick → free-text custom.
• Inserter category split: Cairnstone Free + Cairnstone Pro (f61f8fe). The inserter now shows two Cairnstone categories: “Cairnstone Free” (twelve blocks, alphabetical) and “Cairnstone Pro” (one block, Pricing Pro). The “My blocks” category for CPT-saved blocks sits between them. Server-side category registration order coordinates with client-side block registration order so authors see a coherent free-then-pro grouping.

Plus a CairnstoneBlock module hardening session on 2026-05-14 (c9f3f75 + 64e5386 + 1a6c3f2 + 091fd83): CPT capability tightening to manage_options via the primitive-cap override map (singular meta-caps deliberately omitted to avoid user_has_cap recursion), _wp_old_slug write after the auto-slug repair so future alias-registration surfaces have the history WP-core would write on a normal wp_update_post path, and BreakingChangeForker::resolve() decoupled from the request layer (takes $new_slug as an explicit argument, callable from WP-CLI / REST / cron). No behaviour changes; the public-facing breaking-change resolution flow (Cancel / Migrate / Publish as a new block) is unchanged.

2026-05-13 · commits 49c9c24 (PricingTable polish), ca0dcb4 (Affiliate Disclosure), 39cc947 (Pro-locked placeholder + LicenseStrings), 0cb023b (Discount Banner), b008b22 (Pricing Pro)

Phase 6 Batch D: first mixed-tier batch closes

Four blocks shipped, eleven free + one Pro across the full library. Together with the PricingTable polish chain that prefaced the batch, this commit chain takes Phase 6 to twelve shipped library blocks.

• PricingTable polish (49c9c24). Closed the five P0/P1/P2 findings from the 2026-05-13 critique that scored the block 20/40: the checkmark accent leaked to non-highlighted tiers (One-Voice Rule violation, ~30% of card surface accented), per-tier panel had no progressive disclosure (~16 controls visible per tier, 45+ on a three-tier table), seed copy was the generic-SaaS "Plans that grow with you" template fingerprint, CTA silently disappeared when label was set but URL was empty, and per-CTA opacity + colours were over-flexibility. Each tier now renders inside its own PanelBody with initialOpen: index === 0; seed copy rewritten Cairnstone-voice ("The library, on every site." not "Plans that grow with you"); inline Notice surfaces in the editor when a CTA needs a link; per-CTA colour + opacity removed (the universal Cairnstone Style panel handles block-wide CTA styling, the highlighted tier already inherits the accent). Mobile comparison-grid additionally gained the accessible-responsive-table pattern: data-tier-name + data-not-included-label attributes surface tier context via CSS attr() on stacked cells.
• Affiliate Disclosure (ca0dcb4). FTC-compliance copy block, always-visible when placed. Three attributes: template (Amazon Associates / general / sponsored / commission / custom), disclosure (the rendered body), showIcon (info-circle SVG, default on). Template-picker UX: selecting a named template overwrites the Textarea with the template body (with a confirm() if the author had unsaved edits, FTC copy is the kind of thing nobody wants to accidentally lose); editing the Textarea away from the chosen template's default auto-flips the picker to "Custom" so the relationship stays visible. wp_kses allows ONE inline <a href> for "see how this works" links; rejects everything else. US-FTC templates ship in v1; EU localisation is a .po extension when international expansion lands.
• Pro-locked placeholder + Shared\LicenseStrings (39cc947). A Cairnstone Pro discovery block. Renders an upgrade card in the editor canvas for free-tier authors (lock icon + headline + body + "Unlock Pro" external CTA + "What's in Pro" internal admin CTA); frontend render returns empty string (no public-facing payload). New Shared\LicenseStrings class is the single source of truth for Pro-discovery copy across all surfaces: methods tier_label() / tier_body() / primary_cta_label() / secondary_cta_label() / purchase_url() / admin_overview_url(). Purchase URL filterable via new Hooks::FILTER_PRO_PURCHASE_URL for reseller channels + A/B-tested landing pages. Today registers unconditionally because Licensing::has_tier('pro') returns true under the dev stub; Phase 18 will add the inverse gate (skip registration when Pro is active) so the discovery block disappears for Pro-licensed sites.
• Discount Banner (0cb023b). Time-windowed promotional block with three layout variants picked at insert: bar (full-width strip), card (in-flow contained block), floating-corner (position: fixed with a four-corner enum). Coupon-pill copy-to-clipboard via navigator.clipboard.writeText (textarea + execCommand fallback for older browsers, selectable-text fallback when JS missing); 2-second "Copied!" feedback. Countdown is static text re-rendered each page load: thresholds at 2 days ("Ends in N days"), 4 hours ("Ends today"), 1 hour ("Last hours"), under an hour ("Ending soon"). PHP render-time auto-hide: if NOW > endDate, render returns empty string (cache-friendly; the whole block disappears once the page cache expires). Frontend JS enqueued only when the page contains the block (has_block() gate on wp_enqueue_scripts). On mobile, all four floating-corner positions collapse to the same full-width sticky-bottom toast.
• Pricing Pro (b008b22). The first Pro-tier library block. Inherits Pricing Table's CSS scaffold (.gc-library-pricing__*) and layers three Pro additions: (1) Block-level Monthly/Annual toggle with auto-computed savings badge (computed as 100 * (1 - annual / (12 * monthly)) averaged across all dual-priced tiers, rounded; suppressed when ≤0%); both price blocks render in the DOM, the wrapper's billing-mode class hides one via CSS, toggle JS is a class-swap, not a DOM rewrite. (2) Block-level recommendedTier: number | null as a SelectControl picker, replaces the free block's per-tier highlighted boolean (a pricing table has at most one recommended tier; the boolean shape allowed the always-wrong "two recommended" state). (3) Sticky comparison header (position: sticky; top: 0) pins the tier header row to the viewport top while the visitor scrolls a long feature list; dropped on mobile (the layout stacks anyway). Reorder + remove operations on tiers track the recommendedTier index correctly. Frontend toggle persists the visitor's preference to localStorage. Per-tier icon picker + custom feature-glyph override + multi-currency model deferred to a follow-up commit (open questions in the brief).

Cross-batch craft notes: all four blocks ship at the same fidelity bar as Hero + Pricing Table (PHPStan 0, composer test green, Chrome MCP smoke on TEST, accessible markup, theme-neutral rendering, edge cases handled). Color strategy locked Restrained across all four, the named failure mode "WP-cheery surface chrome" (gradients, rounded-everything reflex, emoji on pricing badges, animated checkmarks) explicitly anti-goaled in the brief. The Pro-locked placeholder is the architecturally-novel piece: it sets the pattern future Pro blocks will follow (single placeholder per block, free-tier-visible inserter discovery card, frontend renders empty, filtered out when Pro is active).

2026-05-13 · commits 2ab9d52 (Hero), c257caf (CC category move), e45167e (Hero CTA invisibility bug), 0c89fa6 (per-CTA colour + opacity), b99237c (Pricing Table), 7e068b7 (Language dropdown + Hero CTA collapsibles)

Phase 6 Batch C: Hero and Pricing Table with the variation-picker pattern

Two attribute-driven library blocks shipped, both exercising Gutenberg's BlockVariationPicker on insert. Each variation pre-seeds copy + structural defaults; post-insert the variant is editable from the sidebar without losing content. The pattern lifted from Columns in Batch A, now standard for any library block with meaningfully different layouts.

• Hero. Six variants: split-right, split-left, centered, left-aligned, overlay-bg, minimal. Heading + subheading + heading level (H1–H6). Two CTAs (primary + secondary) with per-CTA background / text / colour + 0–100% opacity. Image + focal point picker (split + overlay-bg only). Overlay darken slider (overlay-bg only). Silent degradation: overlay-bg without image falls back to centered; minimal suppresses subheading + secondary CTA. Sidebar split into four collapsible PanelBody sections (Hero, Primary action, Secondary action, Image) so the rail stays compact; CTA panels closed by default since variations seed sensible defaults.
• Pricing Table. Five variants: two-tier, three-tier (highlighted middle, the SaaS default), four-tier, comparison grid, single-offer. Tier repeater carries name + description + currency / amount / period (amount stored as string so "Free" / "Custom" / "Contact us" round-trips alongside numeric prices) + features list + highlight toggle + badge label + CTA with per-tier colour + opacity. The comparison variant auto-aligns features across tiers by string match in first-appearance order, no separate "comparison features" data shape; same per-tier list drives every variant. Card surface uses color-mix(in oklab, currentColor 4%) so it adapts to dark / light themes without inline colours; the accent colour for highlighted tiers + per-CTA overrides are the only inline-style emissions.

Two debugging waypoints worth pinning from the Hero ship chain:

• Primary CTA was invisible (e45167e). The first CSS had background: currentColor paired with color: var(--wp--preset--color--background) on the same selector. currentColor resolves to THIS element's color property, which was just set to the background preset, so bg and text both computed to the same value. Fix: two independent token reads, background: var(--wp--preset--color--foreground, oklch(22% 0.02 250)) + color: var(--wp--preset--color--background, oklch(98% 0.005 250)). Pattern worth remembering: currentColor + a color-property override on the same rule is a circular dependency.
• Visibility panel Language signal was a text input asking for BCP-47 tags (7e068b7). Violation of CLAUDE.md's "Build for humans, not developers" rule: nobody remembers ISO codes. Converted to a curated ComboboxControl + chip-list multi-picker mirroring the Country pattern: 22 languages with human labels ("Norwegian Bokmål", "Chinese (any)") storing the BCP-47 tag under the hood. Parentheses for regional disambiguation, em-dashes banned per the language convention.

Wiring: two new Options keys, two ModuleRegistry entries, two boot() calls in Plugin::register_hooks(), two rows in BlockRuntimeAssets::manifest_driven_modules, two new block-name entries on the wp_enqueue_block_style list, ~480 lines of theme-neutral CSS in gc-blocks-frontend.css. 61 tests green, PHPStan 0 errors. Chrome MCP smoke on the CPT editor confirmed both blocks register, both variation pickers surface their schematic icons, and the Pricing Table comparison grid auto-aligns 8 distinct features across 3 tiers with 12 checkmarks (3+4+5 raw → 8 deduped union; --gc-pricing-cols: 3 set on the wrapper).

2026-05-13 · commits 6697def, a500987, fced4ae, 0e5a06e, d033fef, 23e232a, 2cd25e7, 81cb06b, e237161

Section Divider polish + cross-cutting block-attribute hygiene

The Section Divider block from Batch B got a focused polish pass after the user surfaced a chain of regressions. Each commit closed a specific bug and several surfaced architectural foot-guns worth fixing preemptively elsewhere:

• Defaults + per-variant gating + Styles-tab placement (6697def). Default thickness 1 → 3 (the line was nearly invisible out of the box). Width slider gated to line/wave/label (made no sense on dots/asterisks). Thickness control surfaced for all variants with variant-aware help text. Both panel bodies moved from Settings to Styles tab. Force-default-tools-panel-items filter extended to supports.color so Background+Text both render without a + click.
• Saved-block slug repair for title-less publishes (a500987). Title-less gc_cairnstone_block publishes got an auto-slug equal to the post ID (e.g. "115"), a valid WP slug but NOT a valid Gutenberg block-name leaf (must start with a letter). Block never reached the inserter. Three-part fix: SavePostHandler::is_valid_block_slug() regex check; save_post repair that writes cairnstone-block-<ID> via $wpdb->update when the slug fails the regex; SavedBlockRegistry safety-net fallback for legacy rows.
• Supports parity + border-opacity row layout (fced4ae). Section Divider's supports declared a thin slice (margin + text-color); other library blocks declared the broader matrix. Expanded to padding + background + border-color/radius/style/width. Plus: rebuilt Border Opacity row as a flex layout [input on left] [full-width slider on right] matching the native Border + Radius rows it shares the panel with.
• Attribute rename style → variant (0e5a06e). The first foot-gun: Gutenberg's __experimentalBorder support writes to attributes.style as an object. Section Divider's manifest declared its variant picker on the same key as a string. Every border-slider drag clobbered style: "dots" with style: { border: {...} }, editor read “not a known variant”, snapped to default Line. Renamed to variant. Backward compat: PHP render reads raw $block->parsed_block['attrs'] first (WP's schema filter strips unknown keys from $attributes but parsed_block carries them); editor adds mount-time migration. Plus: font-size GapFiller now gated by variant (only visible when variant === 'label') since dots/asterisks/wave/line have no text to size.
• Shadow color persistence + wave-shaped drop-shadow (d033fef). DropShadowRow's commit heuristic was dropping the whole dropShadow attribute when all geometry was zero, killing the author's chosen colour the moment they dragged blur back to 0 (and preventing colour-first authoring). Fix: drop only when geometry AND colour both match defaults. Plus: rebuilt wave-variant drop-shadow as filter: drop-shadow() on the SVG path with the author's actual values (via a --gc-divider-shadow CSS custom property + --has-wave-shadow wrapper class), suppressing the rectangular box-shadow that would otherwise paint a bar behind the wave. Previous selector-driven fix ([style*="box-shadow"]) matched on the frontend but not in the editor; class-driven works in both contexts.
• Preemptive Testimonial rename layout → layoutVariant (23e232a). Same foot-gun, applied before it bites: Gutenberg's supports.layout auto-declares attributes.layout as an object. Testimonial declared its "stacked" / "side-by-side" variant on the same key. Testimonial doesn't declare supports.layout today, but a future enablement would silently clobber the variant. Renamed proactively. Same three-step shape (manifest + PHP parsed_block fallback + editor mount-time migration).
• Saved Cairnstone block deletability (2cd25e7). Inserting a saved block, then trying to delete it via Backspace did nothing; after save+reload the block was essentially unreachable without the code editor. Two root causes: the editor return wrapped in a plain <div> without useBlockProps (so apiVersion 3 couldn't attach selection chrome), and useBlockProps drops merged onKeyDown props (same Phase 5 finding the CC block hit). Fix: useBlockProps on the wrapper + native keydown listener on [data-block] that catches Backspace/Delete when the parent is the selected block.
• Documentation: reserved-name rule (81cb06b). Added to CLAUDE.md's “Things NOT to do”: don't name a custom block attribute after a Gutenberg-reserved key (style, layout, className, align, anchor, backgroundColor, textColor, linkColor, gradient, fontSize, fontFamily, lock, metadata). Pinned references to the divider + testimonial rename commits so future maintainers can lift the working pattern verbatim.
• Documentation: browser-MCP speed routine (e237161). Added to CLAUDE.md's “Live browser + server testing” section: six defaults that cut typical browser-driving from ~7 round-trips per verification to ~2 (state changes via wp.data.dispatch, state inspection via javascript_tool, aggressive browser_batch, drop sub-2s waits, prefer javascript_tool over find for known surfaces, never standalone screenshots). Pinned to the wave-shadow verification from d033fef as worked example.
• Deploy filter fix (separate, untracked in git: deploy.txt). The auto-deploy WinSCP script used -criteria=size, which silently skipped byte-equivalent edits (a 1 → 3 default change at the same string position). Manifest renames AND version bumps both hit this. Changed to -criteria=either so modification-time triggers sync when size is identical. Verified with a 2.1.0 → 2.1.1 round-trip bump on TEST: file synced both directions, identical size, different mtime.

Two patterns elevated to project lore: any custom block attribute named after a Gutenberg-reserved key is a latent bug (apply the divider+testimonial three-step fix preemptively), and Gutenberg's render_callback receives schema-filtered $attributes but the raw payload survives on $block->parsed_block['attrs'] (essential for legacy-attribute fallbacks). Both now in CLAUDE.md.

2026-05-12 · commit df10fe1

Phase 6 Batch B: Trust Badges, Testimonial, Section Divider, FAQ, Table of Contents

Five attribute-driven library blocks shipped, all following the v2.1 Author Bio pattern: no InnerBlocks, sidebar-only authoring, theme-neutral rendering, manifest-driven registration.

• Trust Badges. Repeater of badge images (Media Library + alt + URL), heading toggle, four-mode alignment (left/center/right/spread-evenly), badge-height slider (24–96 px), grayscale-by-default with hover-restore.
• Testimonial. Quote + attribution (name + role + photo) + optional 1–5 star rating (Unicode ★ / ☆, no icon font). Two layouts: stacked (default, photo next to attribution) and side-by-side (feature photo on the left, collapses to stacked under 600 px viewport).
• Section Divider. Five styles: line, dots, asterisks, wave (inline SVG), labelled (centered text with rules either side). Width + thickness sliders. currentColor everywhere so the host theme paints the mark. (Subsequently polished in the 2026-05-13 chain above.)
• FAQ. Repeater of question/answer pairs rendered as native HTML <details>/<summary> accordions, zero JS. Any-open + single-open modes (modern HTML name= attribute, gracefully degrades to any-open on older browsers). Emits FAQPage JSON-LD schema (toggleable) so search engines and AI assistants can read the questions (AEO; Google deprecated FAQ rich results in 2023).
• Table of Contents. DOMDocument-parsed nested heading list from the live post body, auto-injecting anchor IDs into headings that lack them via a the_content filter. Configurable depth (H2–H6), numbered toggle, mobile-collapsible toggle. Returns empty (no markup) when the post has no qualifying headings.

Wiring: six new Options keys, five ModuleRegistry entries, five boot() calls in Plugin::register_hooks(), five rows in BlockRuntimeAssets::manifest_driven_modules, five new block-name entries on the wp_enqueue_block_style list, ~330 lines of theme-neutral structural CSS in gc-blocks-frontend.css. 61 tests green, PHPStan 0 errors, server-side introspection confirms all five register and render via do_blocks().

2026-05-12

Phase 6 Batch A: library scaffold + Author Bio Card v2.1 + Social Profiles

The structural scaffold for library blocks: src/Library/<Slug>/ directory pattern with each block as an AbstractModule subclass + manifest-driven runtime. Second inserter category gillish-cairnstone-custom (“Cairnstone, My blocks”) split from the shipped library bucket so authors see their CPT-saved blocks separately from the shipped ones.

Author Bio Card v2.1 is the first library block, attribute-driven (no InnerBlocks template). Sidebar-only controls: photo picker, photo-size slider 48–320 px, name, title, bio, social link toggles + icon-size radio (small/medium/large). Theme-neutral rendering: no opinionated colours, no inline fonts, the theme paints via theme.json tokens and Gutenberg's has-* classes. The v1 InnerBlocks experiment (5f4473e) was rebuilt as v2 attribute-driven after the user flagged that mixing inner-block authoring (image toolbar in the canvas) with sidebar authoring (everything else) confused authors.

Social Profiles settings. New Settings → Social profiles tab. Single source of truth for ten platforms (Twitter/X, LinkedIn, GitHub, YouTube, Instagram, Facebook, Mastodon, Bluesky, TikTok, Personal website). Library blocks that surface social links (Author Bio today, more in later batches) read from these as the default; per-block override available in the block sidebar. Closed-enum SocialProfiles::PLATFORMS with hand-curated inline SVG icons (16×16, currentColor).

Permanent Preview button shipped alongside: PluginPreviewMenuItem entry “Preview Cairnstone block ↑ ” in the editor header's Preview dropdown. Always visible regardless of which sidebar tab is open. Disabled with “(publish first)” label when the post is an auto-draft.

2026-05-12 · commits 678ed1e → e271ec2 (seven Phase 5 commits in the chain)

Phase 5 shipped: save = registered block type, end-to-end

The first phase that closes the chain from designer composes a block in the CPT editor to that block appears in the inserter on every post and page. Seven commits across the foundation chain, editor-side bridge, Preview-live route, document-panel additions, templateLock for author-side instances, two editor JS gotchas surfaced as CLAUDE.md docs, the breaking-change detection + sticky inline notice, and the three resolution paths (Cancel + Migrate + Publish-as-new-block) all wired and verified.

• Foundation chain (commit 678ed1e). save_post_gc_cairnstone_block listener parses post_content via parse_blocks into _gc_block_tree meta with schemaVersion = 1. On init priority 12, SavedBlockRegistry::register_all() iterates published CPT posts and calls register_block_type( "gillish-cairnstone/<slug>", … ) for each. Render assembles inner blocks via do_blocks; per-instance content overrides the CPT template when present.
• Editor-side bridge (commit 6afe37b). SavedBlockRegistry::enqueue_editor_bootstrap() localises window.gcSavedBlocks with each published block’s serialized markup. gc-saved-blocks-bootstrap.js reads the payload + calls wp.blocks.registerBlockType client-side. First insert populates innerBlocks from the saved markup via replaceInnerBlocks; existing instances keep their own content.
• Preview-live route (commit 7fe5b19). Dedicated query var ?gc_cairnstone_block_preview={ID}&_wpnonce={NONCE} with five layers of leak prevention: CPT’s public:false, dedicated query var (not the CPT slug), edit_post cap + valid nonce required (failure → 404, not 401), X-Robots-Tag header + <meta> robots, and explicit sitemap-exclusion filters for WP-core, Yoast, Rank Math, AIOSEO.
• Document-panel additions (commit aec6f73). Three Phase 5 surface elements in Gutenberg’s document sidebar via PluginPostStatusInfo: Preview-live button, read-only block-name strip showing the slug authors will see in the inserter, and a first-publish success snackbar. The snackbar uses wp.data.subscribe + a sessionStorage bridge to survive Gutenberg’s post-new → post.php navigation.
• templateLock for author-side instances (commit 378a9a9, contextual fix in daada6b). Inserting a saved Cairnstone block on a regular post locks the inner structure as contentOnly, authors edit text + media but can’t reorder or delete blocks. Inserting the same block inside another gc_cairnstone_block CPT post unlocks fully, the designer composes freely, including nesting saved blocks inside each other.
• Breaking-change detection + notice (commit 433a2a2, polished in 84bf44c + 023b3e1 + b2f73ad). Tree-shape diff between snapshot and new tree; structural changes surface a sticky inline admin notice with three resolution radios. Cancel default-checked (safe path is the default). Reverse-diff suppressed via a re-entrant $skip_detection_depth counter so the Cancel-triggered wp_update_post doesn’t re-surface a fresh notice.
• Migrate + Publish-as-new-block (commit e271ec2). Migrate walks every affected post and rewrites instances’ innerBlocks to match the new template (deep-copied via JSON round-trip, innerContent reset to [null × N]). Lossy-diff helper inspects top_removed + attrs_removed; a JS confirm() dialog with PHP-templated count surfaces before submit when the diff loses fields. Publish-as-new-block creates a fresh CPT under a typed slug + reuses resolve_cancel() to restore the original post; both block-types end up registered, designer continues editing the new one.

Deliberately deferred to Phase 5.x: snapshot rollback at render time (the snapshot meta exists; the render-time fallback doesn’t), pre-publish dry-run validation (the resolution UX already covers the failure mode after the fact), and CPT list-view enhancements (WP’s default works; bespoke columns are polish). None of these block Phase 6, all are non-trivial enough that batching them into a single Phase 5.x sweep is cleaner than threading them through other work.

2026-05-12 · commit 051efb9

Columns overhaul: variation picker, 1–5 columns, drag-to-resize

The free-tier gillish-cairnstone/columns primitive got a fundamental rewrite. The previous version was “two narrow columns hugging the left edge with no asymmetric ratios”, absolutely mediocre. The new version matches the WP-native columns block’s UX while exceeding it on column count (5 vs. 4) and intentional defaults (full alignment, drag handles).

• Variation picker: Gutenberg’s BlockVariationPicker fires on insert with eight presets: 100 · 50/50 · 33/66 · 66/33 · 33/33/33 · 25/50/25 · 25/25/25/25 · 20/20/20/20/20. Each variation pre-seeds inner column blocks with their width attribute set as a percentage; align: 'full' on the parent so the row spans the page by default. Inline-SVG icons render the column proportions visually, matching core/columns’s picker.
• Per-column widths: new width attribute on gillish-cairnstone/column (string CSS length). Server-side render_callback emits the value onto a --gc-col-width custom property + flex-basis inline style; the stylesheet does flex layout off those values. Validation regex rejects anything that isn’t a CSS length.
• Drag-to-resize: custom pointer-event handle on the right edge of every non-final column (ResizableBox was a false start: it can’t be a proper flex child). 16px hit area with a 4px visible chevron, fading to blue on hover/select. Drag math: pixel-delta against the .gc-columns flex track’s offsetWidth, converted to percentage, added to this column’s width + subtracted from the next sibling’s. Clamped 5%–95% so neither column collapses.
• “Add new” admin shortcut (separate commit c3d83e2): direct submenu entry under Cairnstone → Add new pointing at post-new.php?post_type=gc_cairnstone_block. Designers no longer have to navigate via “Blocks → All Cairnstone blocks → Add new”.

Browser-verified end-to-end on TEST: picker rendered with all 8 variations, 50/50 produced two 527px columns spanning the row, simulated +100px drag on the handle updated widths from 50/50 → 59.25/40.75 (math: 100px ÷ 1080px = 9.26%, matches the actual delta). Rules of Hooks violation crash that surfaced mid-test was traced to two useBlockProps calls in the same render + conditional useInnerBlocksProps, fixed by hoisting all hooks above branching.

2026-05-12 · commits 4d9008e, d3e5f31, af56141, 5b73ad9, d7bc330

Conditional Content audit and REST namespace migration

Cairnstone's launch block (Conditional Content) got a full audit pass. Five findings closed across security, plumbing, and doc accuracy:

• REST endpoint for client-mode rendering moved from gillish/node/v1/cc/country (the pre-fork slug, kept by mistake when Cairnstone became standalone in v0.2.0) to gillish/cairnstone/v1/cc/country. wp.org plugin-prefix discipline restored. Old URL stays live for one release as a backward-compat alias and carries X-Deprecated-Endpoint + X-Deprecated-Replacement response headers so monitoring can spot stale clients. Verified end-to-end on the staging env.
• EventStore insert exceptions now surface to error_log when WP_DEBUG is on. Production stays silent (analytics is opportunistic, not load-bearing). Helps diagnose schema drift during local development without changing public behaviour.
• Pre-pivot phase labels swept from every Conditional Content and VisitorContext doc-block: file headlines + inline comments + cross-references. Phase numbers in code now exclusively refer to the current FOUNDATION plan, not the pre-2026-05-11 numbering that had Phase 5 meaning "client-side render mode" instead of "save = register block type".
• Stale Node references cleaned. The Cairnstone → Node runtime dependency surface is now exactly one filter: gillish_node_is_bot for crawler classification when Node is active. Country resolution lives entirely inside Cairnstone.
• PreviewFixtureStore::save_from_post() doc-block now states that the caller must verify nonce + capability. Library-shaped sanitisation helpers should be defensive about the contract they assume.

2026-05-12 · commit 194a31f

Phase 5 shape brief confirmed

The implementation brief for Phase 5 (save = register block type) is locked in plans/CAIRNSTONE-PHASE-5-SHAPE.md alongside the prior phase briefs (Phase 2 / 3 / 4 / 4.1). Three surfaces, three lifecycle safeguards, one new PluginPostStatusInfo slot:

• Surfaces: (a) CPT editor save flow with a Cairnstone publish-success toast + read-only block-name strip + Preview-live button; (b) frontend-author insertion with templateLock="contentOnly"; (c) wp-admin CPT list view (5 columns, DataViews on WP 7.0+, WP_List_Table on 6.9).
• Lifecycle safeguards: breaking-change detection on save with a three-radio inline admin notice (migrate / new-slug / cancel) on next load, snapshot rollback when an instance's latest template fails, dry-run validation of every existing instance pre-publish.
• Design law: save is never blocked by Cairnstone. The breaking-change UX is a sticky inline notice, not a modal interrupt. Modal only for the lossy-migrate sub-step, because that action is irreversible and the user deserves an explicit confirm.

Ready for /impeccable craft.