← All changes | includes/os-settings.php +601 -106 0.9.6 → 1.1.13 View file →

		@@ -1,7 +1,7 @@
1	1	<?php
2	2	/**
3		- * Desktop Mode — OS Settings Persistence.
	3	+ * OpenStation — OS Settings Persistence.
4	4	*
5	5	* Persists each user's OS Settings preferences (wallpaper, accent color,
6	6	* dock size, custom gradient/image, HD-only toggle, and AI integration
7	7	* settings) to user meta so they survive across browsers, devices, and
		@@ -8,40 +8,163 @@
8	8	* private/incognito sessions. The JS layer writes to localStorage on
9	9	* every change for instant read-back, then asynchronously syncs to this
10	10	* endpoint so user meta is the durable source of truth.
11	11	*
12		- * @package WPDesktopMode
	12	+ * @package OpenStation
13	13	*/
14	14
15	15	defined( 'ABSPATH' ) || exit;
16	16
17		-/** User meta key for OS Settings. */
18		-const DESKTOP_MODE_OS_SETTINGS_META_KEY = 'desktop_mode_os_settings';
	17	+/**
	18	+ * User meta key for OS Settings.
	19	+ *
	20	+ * The VALUE keeps its pre-rebrand spelling on purpose: it is a
	21	+ * persisted or externally-visible identifier, so renaming it would
	22	+ * orphan data already written by live installs (or break a live
	23	+ * URL). The mismatch between this constant's name and its value is
	24	+ * deliberate — it is NOT a half-finished rename.
	25	+ */
	26	+const OPENSTATION_OS_SETTINGS_META_KEY = 'desktop_mode_os_settings';
19	27
20	28	/** Valid dock-size IDs — mirrors the TS `DOCK_SIZES` constant. */
21		-const DESKTOP_MODE_OS_SETTINGS_DOCK_SIZES = array( 'compact', 'default', 'large' );
	29	+const OPENSTATION_OS_SETTINGS_DOCK_SIZES = array( 'compact', 'default', 'large' );
22	30
	31	+/** Valid window-radius IDs — mirrors the TS `WINDOW_RADII` constant. */
	32	+const OPENSTATION_OS_SETTINGS_WINDOW_RADII = array( 'sharp', 'default', 'round' );
	33	+
	34	+/** How a newly opened window lands — mirrors the TS `OPEN_WINDOWS_AS` constant. */
	35	+const OPENSTATION_OS_SETTINGS_OPEN_WINDOWS_AS = array( 'default', 'maximized', 'focused' );
	36	+
	37	+/**
	38	+ * Valid admin-bar mode IDs — mirrors the TS `ADMIN_BAR_MODES` constant.
	39	+ *
	40	+ * `static` keeps the WordPress admin bar pinned above the shell (the
	41	+ * default), `dynamic` auto-hides it to a peek strip that reveals on
	42	+ * hover or keyboard focus, and `hidden` removes it entirely.
	43	+ */
	44	+const OPENSTATION_OS_SETTINGS_ADMIN_BAR_MODES = array( 'static', 'dynamic', 'hidden' );
	45	+
23	46	/** Valid desktop-layout IDs — mirrors the TS `DESKTOP_LAYOUTS` constant. */
24		-const DESKTOP_MODE_OS_SETTINGS_DESKTOP_LAYOUTS = array( 'classic', 'unified', 'spatial' );
	47	+const OPENSTATION_OS_SETTINGS_DESKTOP_LAYOUTS = array( 'classic', 'unified' );
25	48
26	49	/**
	50	+ * Valid dock-placement IDs — mirrors the TS `DOCK_PLACEMENTS` constant.
	51	+ *
	52	+ * Which edge the single dock sits on. Read by the layout dispatcher for
	53	+ * `unified`; `classic` derives its two rails from the layout itself and
	54	+ * ignores this.
	55	+ */
	56	+const OPENSTATION_OS_SETTINGS_DOCK_PLACEMENTS = array( 'bottom', 'left', 'right' );
	57	+
	58	+/**
	59	+ * Valid dock-behavior IDs — mirrors the TS `DOCK_BEHAVIORS` constant.
	60	+ *
	61	+ * `static` keeps the dock always on screen (the default); `dynamic`
	62	+ * parks it off its edge behind a peek strip that reveals when the
	63	+ * pointer reaches that edge or something on it takes keyboard focus,
	64	+ * and releases the band it floats over from the work area.
	65	+ */
	66	+const OPENSTATION_OS_SETTINGS_DOCK_BEHAVIORS = array( 'static', 'dynamic' );
	67	+
	68	+/**
	69	+ * `mobileLayout` — which experience the shell renders. `auto`
	70	+ * follows the viewport; the other two force it either way.
	71	+ * Mirrors `OsModePreference` in `src/mode/index.ts`.
	72	+ */
	73	+const OPENSTATION_OS_SETTINGS_MOBILE_LAYOUTS = array( 'auto', 'desktop', 'mobile' );
	74	+
	75	+/** `mobileTabs` — at most this many ids pinned to the phone tab bar. */
	76	+const OPENSTATION_OS_SETTINGS_MOBILE_TABS_MAX = 3;
	77	+
	78	+/**
	79	+ * Playable range for the window-reveal duration override, in ms.
	80	+ * Mirrors `MIN_REVEAL_DURATION_MS` / `MAX_REVEAL_DURATION_MS` in
	81	+ * `src/reveals/registry.ts`.
	82	+ *
	83	+ * `0` sits OUTSIDE this range on purpose: it is the "no override"
	84	+ * sentinel, not a duration, and is handled before the clamp.
	85	+ */
	86	+const OPENSTATION_OS_SETTINGS_REVEAL_DURATION_MIN = 80;
	87	+const OPENSTATION_OS_SETTINGS_REVEAL_DURATION_MAX = 4000;
	88	+
	89	+/**
27	90	* Returns a well-shaped default OS settings array.
28	91	*
29	92	* Mirrors the TypeScript `DEFAULTS` constant so a fresh user account
30	93	* gets the same starting state in both environments.
31	94	*
32		- * @since 0.5.0
33		- *
34	95	* @return array
35	96	*/
36		-function desktop_mode_default_os_settings() {
	97	+function openstation_default_os_settings() {
37	98	return array(
38		- 'wallpaper' => 'dark',
39		- 'accent' => 'wp-blue',
	99	+ 'wallpaper' => 'galaxy',
	100	+ // Pulse, the brand's signature. Mirrors `DEFAULTS` in
	101	+ // `src/settings/constants.ts`.
	102	+ 'accent' => 'pulse',
	103	+ // Only read when `accent` is `custom`. Seeded with Pulse so
	104	+ // picking Custom before touching the wheel is a no-op rather
	105	+ // than a jump to black. Mirrors `DEFAULTS` in
	106	+ // `src/settings/constants.ts`.
	107	+ 'customAccent' => '#f252fc',
40	108	'dockSize' => 'default',
41		- 'desktopLayout' => 'classic',
	109	+ // `round` (16px), not the preset id literally named `default`.
	110	+ // Preset ids are stored values and cannot be renamed, so the
	111	+ // option labelled "Default" in the picker is no longer the
	112	+ // shipped default. Must stay in step with `DEFAULTS` in
	113	+ // `src/settings/constants.ts` — PHP seeds the first load and JS
	114	+ // owns every paint after it, so a mismatch shows up as the
	115	+ // corners changing shape a moment after the shell boots.
	116	+ 'windowRadius' => 'round',
	117	+ 'openWindowsAs' => 'default',
	118	+ // How the WordPress admin bar presents above the shell.
	119	+ // `hidden` ships as the default so a fresh desktop has ONE
	120	+ // navigation surface: everything the user can open lives on the
	121	+ // dock, and the dock's "Exit OpenStation" tile is the way back
	122	+ // to classic admin. `static` (vanilla behavior) and `dynamic`
	123	+ // are one pick away in OpenStation Preferences → Appearance.
	124	+ 'adminBarMode' => 'hidden',
	125	+ // Always on screen. `dynamic` (auto-hide behind a peek strip)
	126	+ // is one pick away in OpenStation Preferences → Appearance.
	127	+ 'dockBehavior' => 'static',
	128	+ // The Split layout's sidebar answers for itself: a folded
	129	+ // sidebar over a static bottom dock is a valid desk.
	130	+ 'sideDockBehavior' => 'static',
	131	+ // One dock holding every menu, with the system tiles grouped
	132	+ // behind a hairline. `classic` (side bar for core menus + bottom
	133	+ // dock for plugins) is the other option; it is no longer what a
	134	+ // first-run desktop looks like.
	135	+ 'desktopLayout' => 'unified',
	136	+ // Which edge the single dock sits on. Ignored by `classic`,
	137	+ // which derives both of its rails from the layout.
	138	+ 'dockPlacement' => 'bottom',
42	139	'dockRailRenderer' => 'default',
	140	+ // Active desktop-theme slug, or `''` for the system default.
	141	+ // Site-wide library (`includes/desktop-themes/`), per-user
	142	+ // activation. Not validated against the installed list here —
	143	+ // the enqueue path checks existence on every request, so a
	144	+ // deleted theme degrades silently instead of needing a
	145	+ // user-meta rewrite.
	146	+ 'desktopTheme' => '',
	147	+ // Slugs of the desktop themes whose `recommendedOsSettings`
	148	+ // block has already been applied for this user. A theme's
	149	+ // recommendations are seeded ONCE — the first time the user
	150	+ // activates it — and this list is the record of that. It is
	151	+ // what makes "never overwrite a user's later choices" true:
	152	+ // re-activating a theme they have worn before changes
	153	+ // nothing. The Themes tab's "Apply recommended layout" action
	154	+ // is the deliberate way back. Capped at 64 slugs.
	155	+ 'appliedThemeRecommendations' => array(),
43	156	'unfocusEffect' => 'darken',
	157	+ // Window-reveal id — the clip-path transition that uncovers a
	158	+ // window's content once it finishes loading. Off by default;
	159	+ // `none` is the plain opacity fade the shell has always had.
	160	+ 'windowReveal' => 'none',
	161	+ // Global reveal duration override in ms. 0 means "use each
	162	+ // reveal's own tuned timing" — the shipped reveals have
	163	+ // durations chosen per shape (Radar's full turn is slower
	164	+ // than Sweep's straight line), and one flat number would
	165	+ // lose that.
	166	+ 'windowRevealDuration' => 0,
44	167	// Window-link renderer id — how relation ties between windows
45	168	// are drawn (see includes/window-links.php). `svg-splines` is
46	169	// the shipped built-in; `none` disables the visuals.
47	170	'windowLinkRenderer' => 'svg-splines',
		@@ -75,11 +198,11 @@
75	198	'ai' => array(
76	199	'enabled' => false, // AI assistant is opt-in; enabled from OS Settings → Features once a provider is configured.
77	200	),
78	201	// Per-user opt-IN for the native Posts window. When true,
79		- // clicking the Posts dock tile opens the `<wpd-table>`-driven
	202	+ // clicking the Posts dock tile opens the `<os-table>`-driven
80	203	// native window instead of the chromeless `edit.php` iframe.
81		- // Default OFF as of 0.9.1 — the native windows are now opt-in
	204	+ // Default OFF — the native windows are opt-in
82	205	// Beta. Fresh installs land on the classic iframe; users turn
83	206	// this on in OS Settings → Features → Beta features to try it.
84	207	// Per-user override of the WordPress Heartbeat interval, in
85	208	// seconds. 60s matches Core's "idle" default; the allowed
		@@ -84,9 +207,9 @@
84	207	// Per-user override of the WordPress Heartbeat interval, in
85	208	// seconds. 60s matches Core's "idle" default; the allowed
86	209	// rates (15/30/45/60) all sit at or above Core's 15 s
87	210	// `minimalInterval` floor. See
88		- // `desktop_mode_apply_heartbeat_rate_setting` for the
	211	+ // `openstation_apply_heartbeat_rate_setting` for the
89	212	// `heartbeat_settings` filter that applies this.
90	213	'heartbeatRate' => 60,
91	214	'nativePostsEnabled' => false,
92	215	// Per-user list of column keys hidden in the native Posts
		@@ -93,8 +216,13 @@
93	216	// window (e.g. array( 'author', 'tags' )). Empty array means
94	217	// every column is visible. The sticky 'title' column is always
95	218	// shown — the UI prevents toggling it.
96	219	'nativePostsHiddenColumns' => array(),
	220	+ // Per-user list of column keys hidden in the native Pages
	221	+ // window (e.g. array( 'author', 'parent' )). Empty array means
	222	+ // every column is visible. The sticky 'title' column is always
	223	+ // shown — the UI prevents toggling it.
	224	+ 'nativePagesHiddenColumns' => array(),
97	225	// Per-user opt-IN for the native Pages window. Same posture as
98	226	// nativePostsEnabled — defaults OFF (Beta), users opt in to swap
99	227	// the classic `edit.php?post_type=page` iframe for the native UI.
100	228	'nativePagesEnabled' => false,
		@@ -111,8 +239,17 @@
111	239	// Per-user opt-IN for the native Comments window. Defaults OFF
112	240	// (Beta); the server-side cap gate (`edit_posts`) means the
113	241	// toggle only matters for users who could see the Comments tile.
114	242	'nativeCommentsEnabled' => false,
	243	+ // Per-user opt-IN for Station Home, the native Dashboard
	244	+ // window. Defaults OFF: the ordinary `index.php` Dashboard
	245	+ // (including any custom dashboard a plugin builds there) opens
	246	+ // as a chromeless iframe until the user opts in via OS
	247	+ // Settings → Features → Beta features.
	248	+ 'stationHomeEnabled' => false,
	249	+ // Performance enhancements are enabled unless explicitly disabled.
	250	+ 'adminAssetCacheEnabled' => true,
	251	+ 'windowPrewarmEnabled' => true,
115	252	// When true, left-clicking the empty wallpaper triggers the
116	253	// "Show desktop" toggle (macOS-style) and the matching entry is
117	254	// hidden from the wallpaper context menu. When false (default),
118	255	// the entry stays in the menu and left clicks on the wallpaper
		@@ -117,8 +254,31 @@
117	254	// hidden from the wallpaper context menu. When false (default),
118	255	// the entry stays in the menu and left clicks on the wallpaper
119	256	// do nothing. Per-user.
120	257	'showDesktopOnWallpaperClick' => false,
	258	+ // Whether the close-all-windows shortcut (Alt+Cmd/Ctrl+W) asks
	259	+ // before it closes. The dialog's "Don't ask again" checkbox is
	260	+ // what writes false; OpenStation Preferences -> Windows is what
	261	+ // turns it back on. Per-user.
	262	+ 'confirmCloseAllWindows' => true,
	263	+ // Mio — a soft-body companion that floats over
	264	+ // the wallpaper, settles onto nearby windows, and watches the
	265	+ // pointer. Off by default; toggled from the wallpaper context
	266	+ // menu. Per-user. See `docs/mio.md`.
	267	+ 'mioEnabled' => false,
	268	+ 'mioApiEnabled' => false,
	269	+ 'mioShowOnWallpaper' => true,
	270	+ // The user's own Mio, as built in "Make it yours": partial
	271	+ // appearance + silhouette overrides, both empty until they
	272	+ // touch a control. Stored per user rather than per browser
	273	+ // because it is a preference about the person — ten minutes
	274	+ // spent building a companion should be waiting on their phone.
	275	+ // Sanitized by `openstation_sanitize_mio_look()`; the ranges
	276	+ // are enforced client-side in `sanitizeMioConfig()`.
	277	+ 'mioStyle' => array(
	278	+ 'appearance' => array(),
	279	+ 'physics' => array(),
	280	+ ),
121	281	// Diagonal corner ribbon on My WordPress tiles whose post
122	282	// status isn't `publish` (draft / pending / private /
123	283	// scheduled). On by default — surfaces unpublished work at
124	284	// a glance. Per-user.
		@@ -124,11 +284,12 @@
124	284	// a glance. Per-user.
125	285	'showPostStatusRibbons' => true,
126	286	// Unlocks developer-facing surfaces meant for plugin
127	287	// authors: the Starter Widget appears in the add-widget
128		- // picker, and the OS Settings → Components tab runs its
129		- // intentional missing-import-warner demo. Off by default.
130		- // Per-user.
	288	+ // picker, the OS Settings → Components tab runs its
	289	+ // intentional missing-import-warner demo, and the Code Blue
	290	+ // error-log reader registers (icon, window, REST routes).
	291	+ // Off by default. Per-user.
131	292	'developerModeEnabled' => false,
132	293	// Per-user opt-OUT for the folder-sharing feature. Defaults
133	294	// ON. When false:
134	295	// - The Share button, share-settings modal, "Leave shared
		@@ -143,23 +304,30 @@
143	304	// disappears without any database changes. The site-wide
144	305	// "Delete folder sharing data" action in OS Settings →
145	306	// Features → Advanced is a separate destructive cleanup.
146	307	'foldersSharingEnabled' => true,
147		- // Per-item placement preferences. Map of item id (dock-item
148		- // slug or registered desktop-icon id) → one of:
149		- // 'both' — show on both dock and desktop.
150		- // 'dock' — show only on the dock; hide from desktop.
151		- // 'desktop' — show only on the wallpaper; hide from dock.
	308	+ // Per-item navigation placement. Map of item id → one of:
	309	+ // 'both' — show on a rail and on the desktop.
	310	+ // 'rail' — show only on a rail: the dock, or the sidebar
	311	+ // for a Core admin menu in the split layout.
	312	+ // 'desktop' — show only on the wallpaper.
152	313	// 'hidden' — hide from every shell surface.
153		- // Missing keys mean "no override" — items use their native rail.
	314	+ // Missing keys mean "no override" — the item takes the default
	315	+ // for its kind, which lives in `src/nav/defaults.ts`.
154	316	// Sanitized as map<sanitize_key, enum>. Capped at 256 entries.
155		- 'itemVisibility' => array(),
156		- // Per-user dock ordering. Ordered list of item ids; ids not in
157		- // the list keep their server-supplied position appended after
158		- // the listed ones. Unknown ids are tolerated.
159		- 'dockOrder' => array(),
160		- // Persisted desktop position for every dock item the user has
161		- // promoted to the wallpaper via `itemVisibility[id]=desktop|both`.
	317	+ 'navPlacement' => array(),
	318	+ // Per-user ordering, flat across every dock/sidebar zone. Ids
	319	+ // not in the list keep their registration order and render
	320	+ // after the listed ones. Unknown ids are tolerated.
	321	+ 'navOrder' => array(),
	322	+ // Which experience the shell renders: 'auto' follows the
	323	+ // viewport, 'desktop' / 'mobile' force it. See `includes/mobile.php`.
	324	+ 'mobileLayout' => 'auto',
	325	+ // Ids pinned to the phone tab bar, at most three. Empty means
	326	+ // the server default (`openstation_mobile_tab_bar`).
	327	+ 'mobileTabs' => array(),
	328	+ // Persisted desktop position for every item the user has
	329	+ // promoted to the wallpaper via `navPlacement[id]=desktop|both`.
162	330	// Keyed by item id, value is `{ x: int, y: int }`. The JS
163	331	// synthesizer reads this when building a synthetic placement so
164	332	// the icon lands where the user last dragged it instead of
165	333	// resetting to (0, 0) on every reload. Capped at 256 entries.
		@@ -172,47 +340,111 @@
172	340	*
173	341	* Always returns a fully-shaped array so the JS side doesn't need to
174	342	* defend against partial or missing keys.
175	343	*
176		- * @since 0.5.0
177		- *
178	344	* @param int $user_id The user ID.
179	345	* @return array
180	346	*/
181		-function desktop_mode_get_os_settings( $user_id ) {
	347	+function openstation_get_os_settings( $user_id ) {
182	348	$user_id = (int) $user_id;
183	349	if ( $user_id <= 0 ) {
184		- return desktop_mode_default_os_settings();
	350	+ return openstation_sanitize_os_settings( array() );
185	351	}
186	352
187		- $raw = get_user_meta( $user_id, DESKTOP_MODE_OS_SETTINGS_META_KEY, true );
	353	+ $raw = get_user_meta( $user_id, OPENSTATION_OS_SETTINGS_META_KEY, true );
188	354	if ( ! is_array( $raw ) ) {
189		- return desktop_mode_default_os_settings();
	355	+ return openstation_sanitize_os_settings( array() );
190	356	}
191	357
192		- return desktop_mode_sanitize_os_settings( $raw );
	358	+ return openstation_sanitize_os_settings( $raw );
193	359	}
194	360
195	361	/**
196	362	* Saves sanitized OS settings for a user.
197	363	*
198		- * @since 0.5.0
199		- *
200	364	* @param int $user_id The user ID.
201	365	* @param mixed $settings Raw settings payload from the client.
202	366	* @return bool True on success, false otherwise.
203	367	*/
204		-function desktop_mode_save_os_settings( $user_id, $settings ) {
	368	+function openstation_save_os_settings( $user_id, $settings ) {
205	369	$user_id = (int) $user_id;
206	370	if ( $user_id <= 0 ) {
207	371	return false;
208	372	}
209	373
210		- $clean = desktop_mode_sanitize_os_settings( $settings );
211		- return false !== update_user_meta( $user_id, DESKTOP_MODE_OS_SETTINGS_META_KEY, $clean );
	374	+ $clean = openstation_sanitize_os_settings( $settings );
	375	+ return false !== update_user_meta( $user_id, OPENSTATION_OS_SETTINGS_META_KEY, $clean );
212	376	}
213	377
214	378	/**
	379	+ * Strip the rail-synthesis prefix an id could carry before the
	380	+ * navigation model.
	381	+ *
	382	+ * `dock:<id>` / `desktop:<id>` used to mean "this tile is a copy of an
	383	+ * item whose real home is the other rail". Nothing synthesizes copies
	384	+ * any more — an item is one item wherever it is painted — so the
	385	+ * prefix is noise, and left in place it would key a preference to an
	386	+ * id nothing registers.
	387	+ *
	388	+ * @param string $id Possibly-prefixed id.
	389	+ * @return string Canonical id.
	390	+ */
	391	+function openstation_canonical_nav_id( $id ) {
	392	+ $id = (string) $id;
	393	+ if ( 0 === strpos( $id, 'dock:' ) ) {
	394	+ return substr( $id, 5 );
	395	+ }
	396	+ if ( 0 === strpos( $id, 'desktop:' ) ) {
	397	+ return substr( $id, 8 );
	398	+ }
	399	+ return $id;
	400	+}
	401	+
	402	+/**
	403	+ * Carry a pre-navigation `itemVisibility` map into `navPlacement`.
	404	+ *
	405	+ * The only value that moves is `'dock'` → `'rail'`: the stored name
	406	+ * is now the REGION rather than a rail, so a Core admin menu the user
	407	+ * kept on a rail follows the layout into the sidebar instead of
	408	+ * needing a second migration the first time they switch.
	409	+ *
	410	+ * Runs on read (see {@see openstation_sanitize_os_settings()}) rather
	411	+ * than as a numbered migration, because OS settings are per-user meta
	412	+ * and a site with many users would pay for a sweep that the next save
	413	+ * performs for free.
	414	+ *
	415	+ * @param array $visibility Legacy map of item id → placement.
	416	+ * @return array Map of canonical item id → nav placement.
	417	+ */
	418	+function openstation_migrate_item_visibility( $visibility ) {
	419	+ $map = array(
	420	+ 'dock' => 'rail',
	421	+ 'desktop' => 'desktop',
	422	+ 'both' => 'both',
	423	+ 'hidden' => 'hidden',
	424	+ );
	425	+
	426	+ $out = array();
	427	+ foreach ( (array) $visibility as $key => $val ) {
	428	+ if ( ! is_string( $key ) || ! is_string( $val ) || ! isset( $map[ $val ] ) ) {
	429	+ continue;
	430	+ }
	431	+ $id = openstation_canonical_nav_id( $key );
	432	+ if ( '' === $id ) {
	433	+ continue;
	434	+ }
	435	+ // A prefixed and an unprefixed key can collapse onto the same
	436	+ // id. The unprefixed one is the item's own preference rather
	437	+ // than a synthesized copy's, so it wins whichever order they
	438	+ // arrive in.
	439	+ if ( $id === $key || ! isset( $out[ $id ] ) ) {
	440	+ $out[ $id ] = $map[ $val ];
	441	+ }
	442	+ }
	443	+ return $out;
	444	+}
	445	+
	446	+/**
215	447	* Sanitizes a raw OS settings payload.
216	448	*
217	449	* Unknown keys are ignored; known keys are coerced field-by-field so a
218	450	* partial save (e.g., only accent changed) merges cleanly with the
		@@ -217,25 +449,29 @@
217	449	* Unknown keys are ignored; known keys are coerced field-by-field so a
218	450	* partial save (e.g., only accent changed) merges cleanly with the
219	451	* defaults rather than wiping unset fields.
220	452	*
221		- * @since 0.5.0
222		- *
223	453	* @param mixed $raw Raw settings from the client or user meta.
224	454	* @return array Sanitized settings.
225	455	*/
226		-function desktop_mode_sanitize_os_settings( $raw ) {
227		- $defaults = desktop_mode_default_os_settings();
	456	+function openstation_sanitize_os_settings( $raw ) {
	457	+ $defaults = openstation_default_os_settings();
228	458
229	459	if ( ! is_array( $raw ) ) {
230		- return $defaults;
	460	+ $raw = array();
231	461	}
232	462
233	463	// Wallpaper — any non-empty string; registry membership is validated
234	464	// client-side at apply time.
235		- $wallpaper = isset( $raw['wallpaper'] ) && is_string( $raw['wallpaper'] ) && '' !== $raw['wallpaper']
236		- ? sanitize_key( $raw['wallpaper'] )
237		- : $defaults['wallpaper'];
	465	+ // Key-clean per `/` segment: a desktop theme's wallpapers are
	466	+ // registered as `desktop-theme/<theme>/<id>`, and a flat
	467	+ // `sanitize_key()` would fold that into an id nothing answers to.
	468	+ $wallpaper = isset( $raw['wallpaper'] ) && is_string( $raw['wallpaper'] )
	469	+ ? implode( '/', array_filter( array_map( 'sanitize_key', explode( '/', $raw['wallpaper'] ) ) ) )
	470	+ : '';
	471	+ if ( '' === $wallpaper ) {
	472	+ $wallpaper = $defaults['wallpaper'];
	473	+ }
238	474
239	475	// Accent — non-empty string; swatch validity is enforced in the picker.
240	476	$accent = isset( $raw['accent'] ) && is_string( $raw['accent'] ) && '' !== $raw['accent']
241	477	? sanitize_key( $raw['accent'] )
		@@ -240,20 +476,64 @@
240	476	$accent = isset( $raw['accent'] ) && is_string( $raw['accent'] ) && '' !== $raw['accent']
241	477	? sanitize_key( $raw['accent'] )
242	478	: $defaults['accent'];
243	479
	480	+ // The colour behind the Custom swatch. A full `#rrggbb` triplet and
	481	+ // nothing else: `sanitize_hex_color()` would also pass `#abc`, which
	482	+ // the client-side parser rejects, and a value that survives the save
	483	+ // only to be dropped on load is worse than one refused here.
	484	+ $custom_accent = isset( $raw['customAccent'] )
	485	+ && is_string( $raw['customAccent'] )
	486	+ && preg_match( '/^#[0-9a-fA-F]{6}$/', $raw['customAccent'] )
	487	+ ? strtolower( $raw['customAccent'] )
	488	+ : $defaults['customAccent'];
	489	+
244	490	// Dock size — must be one of the three known values.
245		- $dock_size = isset( $raw['dockSize'] ) && in_array( $raw['dockSize'], DESKTOP_MODE_OS_SETTINGS_DOCK_SIZES, true )
	491	+ $dock_size = isset( $raw['dockSize'] ) && in_array( $raw['dockSize'], OPENSTATION_OS_SETTINGS_DOCK_SIZES, true )
246	492	? (string) $raw['dockSize']
247	493	: $defaults['dockSize'];
248	494
249		- // Desktop layout — must be one of the three known values
250		- // (`classic`, `unified`, `spatial`). Default `classic`.
	495	+ // Window radius — must be one of the three known values.
	496	+ $window_radius = isset( $raw['windowRadius'] ) && in_array( $raw['windowRadius'], OPENSTATION_OS_SETTINGS_WINDOW_RADII, true )
	497	+ ? (string) $raw['windowRadius']
	498	+ : $defaults['windowRadius'];
	499	+
	500	+ // How a newly opened window lands — one of the three known values.
	501	+ $open_windows_as = isset( $raw['openWindowsAs'] ) && in_array( $raw['openWindowsAs'], OPENSTATION_OS_SETTINGS_OPEN_WINDOWS_AS, true )
	502	+ ? (string) $raw['openWindowsAs']
	503	+ : $defaults['openWindowsAs'];
	504	+
	505	+ // Admin-bar mode — must be one of the three known values.
	506	+ $admin_bar_mode = isset( $raw['adminBarMode'] )
	507	+ && in_array( $raw['adminBarMode'], OPENSTATION_OS_SETTINGS_ADMIN_BAR_MODES, true )
	508	+ ? (string) $raw['adminBarMode']
	509	+ : $defaults['adminBarMode'];
	510	+
	511	+ // Dock behavior — must be one of the two known values. One answer
	512	+ // per rail: the dock, and the Split layout's sidebar.
	513	+ $dock_behavior = isset( $raw['dockBehavior'] )
	514	+ && in_array( $raw['dockBehavior'], OPENSTATION_OS_SETTINGS_DOCK_BEHAVIORS, true )
	515	+ ? (string) $raw['dockBehavior']
	516	+ : $defaults['dockBehavior'];
	517	+ $side_dock_behavior = isset( $raw['sideDockBehavior'] )
	518	+ && in_array( $raw['sideDockBehavior'], OPENSTATION_OS_SETTINGS_DOCK_BEHAVIORS, true )
	519	+ ? (string) $raw['sideDockBehavior']
	520	+ : $defaults['sideDockBehavior'];
	521	+
	522	+ // Desktop layout — must be one of the known values (`classic`,
	523	+ // `unified`). Default `unified`.
251	524	$desktop_layout = isset( $raw['desktopLayout'] )
252		- && in_array( $raw['desktopLayout'], DESKTOP_MODE_OS_SETTINGS_DESKTOP_LAYOUTS, true )
	525	+ && in_array( $raw['desktopLayout'], OPENSTATION_OS_SETTINGS_DESKTOP_LAYOUTS, true )
253	526	? (string) $raw['desktopLayout']
254	527	: $defaults['desktopLayout'];
255	528
	529	+ // Dock placement — which edge the single dock sits on. Must be one
	530	+ // of the three known values (`bottom`, `left`, `right`).
	531	+ $dock_placement = isset( $raw['dockPlacement'] )
	532	+ && in_array( $raw['dockPlacement'], OPENSTATION_OS_SETTINGS_DOCK_PLACEMENTS, true )
	533	+ ? (string) $raw['dockPlacement']
	534	+ : $defaults['dockPlacement'];
	535	+
256	536	// Dock rail renderer id — accept any sanitize_key()-clean
257	537	// string. JS-side registry resolves at use time and falls back
258	538	// to `'default'` when the picked renderer isn't registered.
259	539	$dock_rail_renderer = $defaults['dockRailRenderer'];
		@@ -263,8 +543,46 @@
263	543	$dock_rail_renderer = $slug;
264	544	}
265	545	}
266	546
	547	+ // Desktop theme slug — a pattern check, NOT an allow-list, the
	548	+ // same idiom as `dockRailRenderer` above. Validating against the
	549	+ // installed-theme option here would load (and unserialize) that
	550	+ // option on every single settings write for a value the enqueue
	551	+ // path re-checks anyway. `''` is the system default and is a
	552	+ // legitimate value, so an empty/absent key keeps the default.
	553	+ $desktop_theme = $defaults['desktopTheme'];
	554	+ if ( isset( $raw['desktopTheme'] ) && is_string( $raw['desktopTheme'] ) ) {
	555	+ $desktop_theme = sanitize_key( $raw['desktopTheme'] );
	556	+ }
	557	+
	558	+ // appliedThemeRecommendations — list of desktop-theme slugs whose
	559	+ // recommendations this user has already been seeded with. Unknown
	560	+ // slugs are kept (a deleted-then-reinstalled theme must not
	561	+ // re-seed and clobber the settings the user has since chosen).
	562	+ $applied_theme_recommendations = $defaults['appliedThemeRecommendations'];
	563	+ if ( isset( $raw['appliedThemeRecommendations'] ) && is_array( $raw['appliedThemeRecommendations'] ) ) {
	564	+ $applied_theme_recommendations = array();
	565	+ foreach ( $raw['appliedThemeRecommendations'] as $theme_slug ) {
	566	+ if ( ! is_string( $theme_slug ) || '' === $theme_slug ) {
	567	+ continue;
	568	+ }
	569	+ $theme_slug = sanitize_key( $theme_slug );
	570	+ if ( '' === $theme_slug ) {
	571	+ continue;
	572	+ }
	573	+ $applied_theme_recommendations[] = $theme_slug;
	574	+ }
	575	+ // Keep the MOST RECENT 64, not the first 64 — the client
	576	+ // appends, so trimming from the front would silently discard
	577	+ // the entry that was just written and let the theme re-seed on
	578	+ // the next activation.
	579	+ $applied_theme_recommendations = array_slice(
	580	+ array_values( array_unique( $applied_theme_recommendations ) ),
	581	+ -64
	582	+ );
	583	+ }
	584	+
267	585	// Unfocus effect id — accept the `none` sentinel or any registry id.
268	586	// Effect ids mirror the JS registry pattern `^[a-z0-9_/-]+$` (slashes
269	587	// allowed for `vendor/sub-id` namespacing), so we lower-case and strip
270	588	// to that charset rather than using sanitize_key() (which would drop
		@@ -278,8 +596,39 @@
278	596	$unfocus_effect = $slug;
279	597	}
280	598	}
281	599
	600	+ // Window-reveal id — same id charset and same no-allow-list
	601	+ // reasoning as the unfocus effect above. The JS surface resolves at
	602	+ // play time and treats an unknown id as "no reveal", so a reveal
	603	+ // belonging to a temporarily-deactivated plugin survives the
	604	+ // round-trip and starts working again the moment it re-registers.
	605	+ $window_reveal = $defaults['windowReveal'];
	606	+ if ( isset( $raw['windowReveal'] ) && is_string( $raw['windowReveal'] ) ) {
	607	+ $slug = preg_replace( '/[^a-z0-9_\/-]/', '', strtolower( $raw['windowReveal'] ) );
	608	+ if ( '' !== $slug ) {
	609	+ $window_reveal = $slug;
	610	+ }
	611	+ }
	612	+
	613	+ // Window-reveal duration override — 0 (the default) means "leave
	614	+ // each reveal's own timing alone". Anything else is clamped into
	615	+ // the playable range rather than rejected: a value past the end of
	616	+ // the range still expresses a direction, and the nearest playable
	617	+ // duration is the honest reading of it.
	618	+ $window_reveal_duration = $defaults['windowRevealDuration'];
	619	+ if ( isset( $raw['windowRevealDuration'] ) && is_numeric( $raw['windowRevealDuration'] ) ) {
	620	+ $requested = (int) round( (float) $raw['windowRevealDuration'] );
	621	+ if ( $requested > 0 ) {
	622	+ $window_reveal_duration = max(
	623	+ OPENSTATION_OS_SETTINGS_REVEAL_DURATION_MIN,
	624	+ min( OPENSTATION_OS_SETTINGS_REVEAL_DURATION_MAX, $requested )
	625	+ );
	626	+ } else {
	627	+ $window_reveal_duration = 0;
	628	+ }
	629	+ }
	630	+
282	631	// Window-link renderer id — same id charset as unfocus effects
283	632	// (slashes allowed for `vendor/sub-id`). No allow-list: the JS
284	633	// render host resolves at use time and falls back to the built-in
285	634	// `svg-splines` when the picked renderer isn't registered.
		@@ -412,9 +761,9 @@
412	761	}
413	762	}
414	763
415	764	// Heartbeat rate — one of the four allowed values. The PHP
416		- // filter `desktop_mode_apply_heartbeat_rate_setting` reads
	765	+ // filter `openstation_apply_heartbeat_rate_setting` reads
417	766	// this and passes it through to `heartbeat_settings` so
418	767	// WordPress Core itself reduces the interval on the next page
419	768	// load. 5 s is intentionally excluded: Core's
420	769	// `minimalInterval` floor clamps anything below 15 back up to
		@@ -451,8 +800,27 @@
451	800	// user meta indefinitely.
452	801	$native_posts_hidden_columns = array_slice( array_values( array_unique( $native_posts_hidden_columns ) ), 0, 32 );
453	802	}
454	803
	804	+ $native_pages_hidden_columns = $defaults['nativePagesHiddenColumns'];
	805	+ if ( isset( $raw['nativePagesHiddenColumns'] ) && is_array( $raw['nativePagesHiddenColumns'] ) ) {
	806	+ $native_pages_hidden_columns = array();
	807	+ foreach ( $raw['nativePagesHiddenColumns'] as $col ) {
	808	+ if ( ! is_string( $col ) || '' === $col ) {
	809	+ continue;
	810	+ }
	811	+ $slug = sanitize_key( $col );
	812	+ if ( '' === $slug ) {
	813	+ continue;
	814	+ }
	815	+ $native_pages_hidden_columns[] = $slug;
	816	+ }
	817	+ // Cap to a sane upper bound — far more than any plausible
	818	+ // column count, but blocks a malicious payload from bloating
	819	+ // user meta indefinitely.
	820	+ $native_pages_hidden_columns = array_slice( array_values( array_unique( $native_pages_hidden_columns ) ), 0, 32 );
	821	+ }
	822	+
455	823	$native_pages_enabled = isset( $raw['nativePagesEnabled'] )
456	824	? (bool) $raw['nativePagesEnabled']
457	825	: $defaults['nativePagesEnabled'];
458	826
		@@ -467,12 +835,37 @@
467	835	$native_comments_enabled = isset( $raw['nativeCommentsEnabled'] )
468	836	? (bool) $raw['nativeCommentsEnabled']
469	837	: $defaults['nativeCommentsEnabled'];
470	838
	839	+ $station_home_enabled = isset( $raw['stationHomeEnabled'] )
	840	+ ? (bool) $raw['stationHomeEnabled']
	841	+ : $defaults['stationHomeEnabled'];
	842	+
	843	+ // Site-wide performance controls supersede the legacy per-user values.
	844	+ // Keep the snapshot keys so existing window consumers can read them.
	845	+ $extended_options = openstation_get_extended_options();
	846	+ $admin_asset_cache_enabled = $extended_options['admin_asset_cache'];
	847	+ $window_prewarm_enabled = $extended_options['window_prewarm'];
	848	+
471	849	$show_desktop_on_wallpaper_click = isset( $raw['showDesktopOnWallpaperClick'] )
472	850	? (bool) $raw['showDesktopOnWallpaperClick']
473	851	: $defaults['showDesktopOnWallpaperClick'];
474	852
	853	+ $confirm_close_all_windows = isset( $raw['confirmCloseAllWindows'] )
	854	+ ? (bool) $raw['confirmCloseAllWindows']
	855	+ : $defaults['confirmCloseAllWindows'];
	856	+
	857	+ $mio_enabled = isset( $raw['mioEnabled'] )
	858	+ ? (bool) $raw['mioEnabled']
	859	+ : ( isset( $raw['mioApiEnabled'] ) ? (bool) $raw['mioApiEnabled'] : $defaults['mioEnabled'] );
	860	+
	861	+ // A missing key means "no look saved yet", which sanitizes to the
	862	+ // same pair of empty arrays the defaults carry — so this needs no
	863	+ // isset() branch of its own.
	864	+ $mio_style = openstation_sanitize_mio_look(
	865	+ isset( $raw['mioStyle'] ) ? $raw['mioStyle'] : null
	866	+ );
	867	+
475	868	$show_post_status_ribbons = isset( $raw['showPostStatusRibbons'] )
476	869	? (bool) $raw['showPostStatusRibbons']
477	870	: $defaults['showPostStatusRibbons'];
478	871
		@@ -479,20 +872,59 @@
479	872	$developer_mode_enabled = isset( $raw['developerModeEnabled'] )
480	873	? (bool) $raw['developerModeEnabled']
481	874	: $defaults['developerModeEnabled'];
482	875
	876	+ // mobileLayout — the phone/desktop override.
	877	+ $mobile_layout = isset( $raw['mobileLayout'] )
	878	+ && in_array( $raw['mobileLayout'], OPENSTATION_OS_SETTINGS_MOBILE_LAYOUTS, true )
	879	+ ? (string) $raw['mobileLayout']
	880	+ : $defaults['mobileLayout'];
	881	+
	882	+ // mobileTabs — ordered nav ids pinned to the phone tab bar. Same
	883	+ // id grammar as navOrder, capped at the tab bar's slot count.
	884	+ $mobile_tabs = array();
	885	+ if ( isset( $raw['mobileTabs'] ) && is_array( $raw['mobileTabs'] ) ) {
	886	+ $seen_tabs = array();
	887	+ foreach ( $raw['mobileTabs'] as $id ) {
	888	+ if ( ! is_string( $id ) || '' === $id ) {
	889	+ continue;
	890	+ }
	891	+ $slug = sanitize_key( openstation_canonical_nav_id( $id ) );
	892	+ if ( '' === $slug || isset( $seen_tabs[ $slug ] ) ) {
	893	+ continue;
	894	+ }
	895	+ $seen_tabs[ $slug ] = true;
	896	+ $mobile_tabs[] = $slug;
	897	+ if ( count( $mobile_tabs ) >= OPENSTATION_OS_SETTINGS_MOBILE_TABS_MAX ) {
	898	+ break;
	899	+ }
	900	+ }
	901	+ }
	902	+
483	903	$folders_sharing_enabled = isset( $raw['foldersSharingEnabled'] )
484	904	? (bool) $raw['foldersSharingEnabled']
485	905	: $defaults['foldersSharingEnabled'];
486	906
487		- // itemVisibility — map<sanitize_key, enum>. Unknown ids are kept
	907	+ // navPlacement — map<sanitize_key, enum>. Unknown ids are kept
488	908	// (a deactivated plugin's setting should survive reactivation);
489	909	// invalid placement values are dropped.
490		- $item_visibility = array();
491		- if ( isset( $raw['itemVisibility'] ) && is_array( $raw['itemVisibility'] ) ) {
492		- $allowed_placements = array( 'both', 'dock', 'desktop', 'hidden' );
	910	+ //
	911	+ // Reads the pre-navigation `itemVisibility` map when this user has
	912	+ // no `navPlacement` yet, so an existing arrangement carries over on
	913	+ // first load and is written back on the next save. See
	914	+ // `openstation_migrate_item_visibility()`.
	915	+ $raw_placement = array();
	916	+ if ( isset( $raw['navPlacement'] ) && is_array( $raw['navPlacement'] ) ) {
	917	+ $raw_placement = $raw['navPlacement'];
	918	+ } elseif ( isset( $raw['itemVisibility'] ) && is_array( $raw['itemVisibility'] ) ) {
	919	+ $raw_placement = openstation_migrate_item_visibility( $raw['itemVisibility'] );
	920	+ }
	921	+
	922	+ $nav_placement = array();
	923	+ if ( ! empty( $raw_placement ) ) {
	924	+ $allowed_placements = array( 'both', 'rail', 'desktop', 'hidden' );
493	925	$count = 0;
494		- foreach ( $raw['itemVisibility'] as $key => $val ) {
	926	+ foreach ( $raw_placement as $key => $val ) {
495	927	if ( $count >= 256 ) {
496	928	break;
497	929	}
498	930	if ( ! is_string( $key ) || '' === $key || ! is_string( $val ) ) {
		@@ -504,34 +936,38 @@
504	936	}
505	937	if ( ! in_array( $val, $allowed_placements, true ) ) {
506	938	continue;
507	939	}
508		- $item_visibility[ $slug ] = $val;
	940	+ $nav_placement[ $slug ] = $val;
509	941	++$count;
510	942	}
511	943	}
512	944
513		- // dockOrder — ordered list of item ids. Most are sanitize_key()-
514		- // clean dock slugs, but cross-rail tiles the user promoted carry a
515		- // rail-synthesis prefix (`desktop:<id>` / `dock:<id>`, built by
516		- // src/settings/item-placement.ts). sanitize_key() strips the colon,
517		- // which silently breaks the JS order match on reload and can collide
518		- // with an unrelated id — so allow the colon (and hyphen/underscore)
519		- // while still rejecting anything outside the JS id charset.
520		- $dock_order = array();
521		- if ( isset( $raw['dockOrder'] ) && is_array( $raw['dockOrder'] ) ) {
	945	+ // navOrder — ordered list of item ids, flat across every zone.
	946	+ // Reads the pre-navigation `dockOrder` when absent, stripping the
	947	+ // rail-synthesis prefixes (`dock:` / `desktop:`) that model no
	948	+ // longer has.
	949	+ $raw_order = array();
	950	+ if ( isset( $raw['navOrder'] ) && is_array( $raw['navOrder'] ) ) {
	951	+ $raw_order = $raw['navOrder'];
	952	+ } elseif ( isset( $raw['dockOrder'] ) && is_array( $raw['dockOrder'] ) ) {
	953	+ $raw_order = $raw['dockOrder'];
	954	+ }
	955	+
	956	+ $nav_order = array();
	957	+ if ( ! empty( $raw_order ) ) {
522	958	$seen = array();
523		- foreach ( $raw['dockOrder'] as $id ) {
	959	+ foreach ( $raw_order as $id ) {
524	960	if ( ! is_string( $id ) || '' === $id ) {
525	961	continue;
526	962	}
527		- $slug = (string) preg_replace( '/[^a-z0-9_:-]+/', '', strtolower( $id ) );
	963	+ $slug = sanitize_key( openstation_canonical_nav_id( $id ) );
528	964	if ( '' === $slug || isset( $seen[ $slug ] ) ) {
529	965	continue;
530	966	}
531	967	$seen[ $slug ] = true;
532		- $dock_order[] = $slug;
533		- if ( count( $dock_order ) >= 256 ) {
	968	+ $nav_order[] = $slug;
	969	+ if ( count( $nav_order ) >= 256 ) {
534	970	break;
535	971	}
536	972	}
537	973	}
		@@ -579,12 +1015,23 @@
579	1015
580	1016	return array(
581	1017	'wallpaper' => $wallpaper,
582	1018	'accent' => $accent,
	1019	+ 'customAccent' => $custom_accent,
583	1020	'dockSize' => $dock_size,
	1021	+ 'windowRadius' => $window_radius,
	1022	+ 'openWindowsAs' => $open_windows_as,
	1023	+ 'adminBarMode' => $admin_bar_mode,
584	1024	'desktopLayout' => $desktop_layout,
	1025	+ 'dockPlacement' => $dock_placement,
	1026	+ 'dockBehavior' => $dock_behavior,
	1027	+ 'sideDockBehavior' => $side_dock_behavior,
585	1028	'dockRailRenderer' => $dock_rail_renderer,
	1029	+ 'desktopTheme' => $desktop_theme,
	1030	+ 'appliedThemeRecommendations' => $applied_theme_recommendations,
586	1031	'unfocusEffect' => $unfocus_effect,
	1032	+ 'windowReveal' => $window_reveal,
	1033	+ 'windowRevealDuration' => $window_reveal_duration,
587	1034	'windowLinkRenderer' => $window_link_renderer,
588	1035	'windowLinkVisibility' => $window_link_visibility,
589	1036	'windowLinksEnabled' => $window_links_enabled,
590	1037	'windowLinkRaiseOnFocus' => $window_link_raise_on_focus,
		@@ -597,17 +1044,28 @@
597	1044	'heartbeatRate' => $heartbeat_rate,
598	1045	'nativePostsEnabled' => $native_posts_enabled,
599	1046	'nativePostsHiddenColumns' => $native_posts_hidden_columns,
600	1047	'nativePagesEnabled' => $native_pages_enabled,
	1048	+ 'nativePagesHiddenColumns' => $native_pages_hidden_columns,
601	1049	'nativeUsersEnabled' => $native_users_enabled,
602	1050	'nativePluginsEnabled' => $native_plugins_enabled,
603	1051	'nativeCommentsEnabled' => $native_comments_enabled,
	1052	+ 'stationHomeEnabled' => $station_home_enabled,
	1053	+ 'adminAssetCacheEnabled' => $admin_asset_cache_enabled,
	1054	+ 'windowPrewarmEnabled' => $window_prewarm_enabled,
604	1055	'showDesktopOnWallpaperClick' => $show_desktop_on_wallpaper_click,
	1056	+ 'confirmCloseAllWindows' => $confirm_close_all_windows,
	1057	+ 'mioEnabled' => $mio_enabled,
	1058	+ 'mioApiEnabled' => $mio_enabled,
	1059	+ 'mioShowOnWallpaper' => isset( $raw['mioShowOnWallpaper'] ) ? (bool) $raw['mioShowOnWallpaper'] : $defaults['mioShowOnWallpaper'],
	1060	+ 'mioStyle' => $mio_style,
605	1061	'showPostStatusRibbons' => $show_post_status_ribbons,
606	1062	'developerModeEnabled' => $developer_mode_enabled,
607	1063	'foldersSharingEnabled' => $folders_sharing_enabled,
608		- 'itemVisibility' => $item_visibility,
609		- 'dockOrder' => $dock_order,
	1064	+ 'navPlacement' => $nav_placement,
	1065	+ 'navOrder' => $nav_order,
	1066	+ 'mobileLayout' => $mobile_layout,
	1067	+ 'mobileTabs' => $mobile_tabs,
610	1068	'dockPromotedPositions' => $dock_promoted_positions,
611	1069	);
612	1070	}
613	1071
		@@ -612,12 +1070,10 @@
612	1070	}
613	1071
614	1072	/**
615	1073	* Registers the REST routes for OS settings.
616		- *
617		- * @since 0.5.0
618	1074	*/
619		-function desktop_mode_register_os_settings_rest_routes() {
	1075	+function openstation_register_os_settings_rest_routes() {
620	1076	register_rest_route(
621	1077	'desktop-mode/v1',
622	1078	'/os-settings',
623	1079	array(
		@@ -622,15 +1078,15 @@
622	1078	'/os-settings',
623	1079	array(
624	1080	array(
625	1081	'methods' => WP_REST_Server::READABLE,
626		- 'callback' => 'desktop_mode_rest_get_os_settings',
627		- 'permission_callback' => 'desktop_mode_rest_os_settings_permission',
	1082	+ 'callback' => 'openstation_rest_get_os_settings',
	1083	+ 'permission_callback' => 'openstation_rest_os_settings_permission',
628	1084	),
629	1085	array(
630	1086	'methods' => WP_REST_Server::CREATABLE,
631		- 'callback' => 'desktop_mode_rest_save_os_settings',
632		- 'permission_callback' => 'desktop_mode_rest_os_settings_permission',
	1087	+ 'callback' => 'openstation_rest_save_os_settings',
	1088	+ 'permission_callback' => 'openstation_rest_os_settings_permission',
633	1089	'args' => array(
634	1090	'settings' => array(
635	1091	'required' => true,
636	1092	'type' => 'object',
		@@ -639,49 +1095,90 @@
639	1095	),
640	1096	)
641	1097	);
642	1098	}
643		-add_action( 'rest_api_init', 'desktop_mode_register_os_settings_rest_routes' );
	1099	+add_action( 'rest_api_init', 'openstation_register_os_settings_rest_routes' );
644	1100
645	1101	/**
646	1102	* Permission gate for OS settings REST routes.
647	1103	*
648		- * Requires the caller to be logged in *and* have desktop mode enabled —
649		- * see {@see desktop_mode_rest_require_enabled()} for why `read` alone is
	1104	+ * Requires the caller to be logged in *and* have OpenStation enabled —
	1105	+ * see {@see openstation_rest_require_enabled()} for why `read` alone is
650	1106	* insufficient.
651	1107	*
652		- * @since 0.8.10 Hardened to require desktop mode enabled (was `read`).
653		- *
654	1108	* @return true|WP_Error
655	1109	*/
656		-function desktop_mode_rest_os_settings_permission() {
657		- return desktop_mode_rest_require_enabled();
	1110	+function openstation_rest_os_settings_permission() {
	1111	+ return openstation_rest_require_enabled();
658	1112	}
659	1113
660	1114	/**
661	1115	* GET /desktop-mode/v1/os-settings
662	1116	*
663		- * @since 0.5.0
664		- *
665	1117	* @return WP_REST_Response
666	1118	*/
667		-function desktop_mode_rest_get_os_settings() {
668		- return rest_ensure_response( desktop_mode_get_os_settings( get_current_user_id() ) );
	1119	+function openstation_rest_get_os_settings() {
	1120	+ return rest_ensure_response( openstation_get_os_settings( get_current_user_id() ) );
669	1121	}
670	1122
671	1123	/**
672	1124	* POST /desktop-mode/v1/os-settings
673	1125	*
674		- * @since 0.5.0
	1126	+ * Accepts a PARTIAL payload: keys the request omits keep the value
	1127	+ * already stored for the user, rather than resetting to the shipped
	1128	+ * default. The client sends only the fields that changed since its
	1129	+ * last confirmed save, which is what stops two open sessions from
	1130	+ * overwriting each other — a session that never touched the
	1131	+ * wallpaper cannot express an opinion about it, so a stale snapshot
	1132	+ * can no longer undo another session's unrelated change.
675	1133	*
	1134	+ * A full payload still behaves exactly as before: every key is
	1135	+ * present, so every key wins.
	1136	+ *
	1137	+ * The merge lives here rather than in {@see openstation_save_os_settings()}
	1138	+ * on purpose. That function's contract is REPLACE, and migrations
	1139	+ * depend on it: migration 1 in `includes/migrations.php` `unset()`s
	1140	+ * keys and re-saves precisely so the sanitizer backfills the new
	1141	+ * defaults. Give the saver merge semantics and that migration
	1142	+ * silently becomes a no-op.
	1143	+ *
	1144	+ * Merging is shallow, one level deep. For the map-shaped fields
	1145	+ * (`wallpaperSettings`, `navPlacement`, `navOrder`,
	1146	+ * `dockPromotedPositions`) a request that sends the key replaces the
	1147	+ * whole map — deep-merging them would leave no way to delete an
	1148	+ * entry.
	1149	+ *
676	1150	* @param WP_REST_Request $request The REST request.
677	1151	* @return WP_REST_Response The saved settings (after sanitization).
678	1152	*/
679		-function desktop_mode_rest_save_os_settings( WP_REST_Request $request ) {
	1153	+function openstation_rest_save_os_settings( WP_REST_Request $request ) {
680	1154	$user_id = get_current_user_id();
681	1155	$payload = $request->get_param( 'settings' );
682		- desktop_mode_save_os_settings( $user_id, $payload );
683		- return rest_ensure_response( desktop_mode_get_os_settings( $user_id ) );
	1156	+
	1157	+ // A payload that isn't an object says nothing about any field, so
	1158	+ // it changes nothing. The route declares `'settings' => object`
	1159	+ // and WP's schema validation rejects a scalar before the callback
	1160	+ // runs, so this is unreachable over real REST traffic — but the
	1161	+ // sanitizer resolves a non-array to the full defaults, which
	1162	+ // means the one way to reach this function with a bad payload
	1163	+ // used to be the one way to wipe a user's settings. Returning
	1164	+ // early costs nothing and keeps "don't destroy what wasn't sent"
	1165	+ // true of every path into this handler, not just the ones the
	1166	+ // schema happens to guard.
	1167	+ if ( ! is_array( $payload ) ) {
	1168	+ return rest_ensure_response( openstation_get_os_settings( $user_id ) );
	1169	+ }
	1170	+
	1171	+ // Normalize an alias-only patch before merging it with the saved master value.
	1172	+ if ( ! array_key_exists( 'mioEnabled', $payload ) && array_key_exists( 'mioApiEnabled', $payload ) ) {
	1173	+ $payload['mioEnabled'] = $payload['mioApiEnabled'];
	1174	+ }
	1175	+
	1176	+ openstation_save_os_settings(
	1177	+ $user_id,
	1178	+ array_merge( openstation_get_os_settings( $user_id ), $payload )
	1179	+ );
	1180	+ return rest_ensure_response( openstation_get_os_settings( $user_id ) );
684	1181	}
685	1182
686	1183	/**
687	1184	* Apply the per-user Heartbeat-rate preference to the
		@@ -689,17 +1186,15 @@
689	1186	* once at page load. We set `interval` only; the allowed rates
690	1187	* (15/30/45/60 s) all sit at or above Core's 15 s
691	1188	* `minimalInterval` floor, so the floor never needs overriding.
692	1189	*
693		- * Only applies to users with Desktop Mode enabled — non-desktop
	1190	+ * Only applies to users with OpenStation enabled — non-desktop
694	1191	* sessions keep Core's defaults. Anonymous requests skip too.
695	1192	*
696		- * @since 0.8.5
697		- *
698	1193	* @param array $settings Filtered Heartbeat settings.
699	1194	* @return array
700	1195	*/
701		-function desktop_mode_apply_heartbeat_rate_setting( $settings ) {
	1196	+function openstation_apply_heartbeat_rate_setting( $settings ) {
702	1197	if ( ! is_array( $settings ) ) {
703	1198	$settings = array();
704	1199	}
705	1200	$user_id = get_current_user_id();
		@@ -705,12 +1200,12 @@
705	1200	$user_id = get_current_user_id();
706	1201	if ( $user_id <= 0 ) {
707	1202	return $settings;
708	1203	}
709		- if ( function_exists( 'desktop_mode_is_enabled' ) && ! desktop_mode_is_enabled( $user_id ) ) {
	1204	+ if ( function_exists( 'openstation_is_enabled' ) && ! openstation_is_enabled( $user_id ) ) {
710	1205	return $settings;
711	1206	}
712		- $os = desktop_mode_get_os_settings( $user_id );
	1207	+ $os = openstation_get_os_settings( $user_id );
713	1208	$rate = isset( $os['heartbeatRate'] ) ? (int) $os['heartbeatRate'] : 0;
714	1209	if ( ! in_array( $rate, array( 15, 30, 45, 60 ), true ) ) {
715	1210	return $settings;
716	1211	}
		@@ -716,5 +1211,5 @@
716	1211	}
717	1212	$settings['interval'] = $rate;
718	1213	return $settings;
719	1214	}
720		-add_filter( 'heartbeat_settings', 'desktop_mode_apply_heartbeat_rate_setting' );
	1215	+add_filter( 'heartbeat_settings', 'openstation_apply_heartbeat_rate_setting' );