← All changes | includes/class-metasync-opengraph.php +1141 -68 2.6.10 → 2.7.2 View file →

		@@ -31,26 +31,568 @@
31	31	*/
32	32	private $version;
33	33
34	34	/**
	35	+ * Most recently constructed instance, for cross-class reuse of the value
	36	+ * resolvers (e.g. the OTTO buffer needs the same default OG values the meta
	37	+ * box pre-fills, to tell an auto-filled default from a user-customized value).
	38	+ *
	39	+ * @var Metasync_OpenGraph|null
	40	+ */
	41	+ private static $instance;
	42	+
	43	+ /**
	44	+ * Per-request memo for get_default_og_values(), keyed on post ID. See that
	45	+ * method for why the defaults are worth memoizing and where the memo is
	46	+ * dropped.
	47	+ *
	48	+ * @var array<int, array{title:string,description:string,image:string}>
	49	+ */
	50	+ private static $default_og_values_memo = [];
	51	+
	52	+ /**
35	53	* Meta box ID
36	54	*/
37	55	const META_BOX_ID = 'metasync_opengraph_meta_box';
38	56
39	57	/**
	58	+ * The social title/description keys the meta box pre-fills from the post
	59	+ * title/excerpt and persists on save. These are the keys that can capture the
	60	+ * "Auto Draft" placeholder WordPress gives a brand-new, still-untitled post.
	61	+ */
	62	+ const AUTO_DRAFT_PRONE_KEYS = [
	63	+ '_metasync_og_title',
	64	+ '_metasync_og_description',
	65	+ '_metasync_twitter_title',
	66	+ '_metasync_twitter_description',
	67	+ ];
	68	+
	69	+ /**
	70	+ * The social title keys whose meta box default is the post title itself.
	71	+ * Unlike the description keys — whose pre-fill (the excerpt) is content the
	72	+ * editor curates separately — these mirror the title verbatim, so a stored
	73	+ * value equal to it carries no information of its own: it is the pre-fill
	74	+ * snapshot, not a customization. Reads collapse such rows to '' so the live
	75	+ * title (which a rename keeps fresh) applies instead.
	76	+ */
	77	+ const TITLE_DEFAULTED_KEYS = [
	78	+ '_metasync_og_title',
	79	+ '_metasync_twitter_title',
	80	+ ];
	81	+
	82	+ /**
	83	+ * The social description keys whose meta box default is the resolved
	84	+ * description (the excerpt the emitter would derive). The pre-fill persisted
	85	+ * that default verbatim on save, so rows exist where these keys hold a copy
	86	+ * of the excerpt as it was on save day — stale the moment the excerpt or the
	87	+ * content it is generated from changes. Reads collapse such rows to '' so
	88	+ * the live default applies instead. A value that differs from the default is
	89	+ * untouched: only text the editor genuinely typed survives.
	90	+ */
	91	+ const DESCRIPTION_DEFAULTED_KEYS = [
	92	+ '_metasync_og_description',
	93	+ '_metasync_twitter_description',
	94	+ ];
	95	+
	96	+ /**
	97	+ * Site option holding every "Auto Draft" placeholder variant this install
	98	+ * has actually seen, keyed by nothing, de-duplicated, capped. Core fills a
	99	+ * new post's title with __( 'Auto Draft' ) in the *creating admin user's*
	100	+ * locale, and that translation is not loaded on front-end requests, so no
	101	+ * render-time literal/translation list can be complete. The registry is the
	102	+ * locale-free source of truth: captured verbatim at creation time in admin,
	103	+ * where the translation does resolve, and re-read anywhere.
	104	+ */
	105	+ const AUTO_DRAFT_PLACEHOLDER_OPTION = 'metasync_auto_draft_placeholders';
	106	+
	107	+ /**
	108	+ * Upper bound on registered placeholder variants. Locales change rarely;
	109	+ * the cap keeps the site option tiny no matter how many editors come and
	110	+ * go with different locales.
	111	+ */
	112	+ const AUTO_DRAFT_PLACEHOLDER_CAP = 20;
	113	+
	114	+ /**
	115	+ * Upper bound on posts held in the get_default_og_values() memo. One
	116	+ * front-end render touches one or two posts; a back-end loop (an importer,
	117	+ * a bulk action, a resync walking every post) would otherwise grow the
	118	+ * memo — and the excerpt-derivation results it caches — without end for
	119	+ * the life of the request. When full the oldest entry is dropped first:
	120	+ * insertion order is the only order the memo has, and a dropped post
	121	+ * simply re-derives on its next read.
	122	+ */
	123	+ const DEFAULT_OG_VALUES_MEMO_CAP = 10;
	124	+
	125	+ /**
	126	+ * Per-post flag marking "this post was saved while its title was still the
	127	+ * untitled placeholder". Stores the exact placeholder string that was
	128	+ * recognized at save time, so the render path can suppress by state (flag
	129	+ * present + title still equals it) rather than by string matching alone —
	130	+ * a genuinely-titled post never carries the flag.
	131	+ */
	132	+ const UNTITLED_FLAG_META = '_metasync_untitled_placeholder';
	133	+
	134	+ /**
40	135	* Initialize the class and set its properties.
41	136	*/
42	137	public function __construct($plugin_name, $version) {
43	138	$this->plugin_name = $plugin_name;
44	139	$this->version = $version;
	140	+ self::$instance = $this;
45	141	}
46	142
47	143	/**
	144	+ * Get the most recently constructed instance (null if none yet).
	145	+ *
	146	+ * @return Metasync_OpenGraph|null
	147	+ */
	148	+ public static function get_instance() {
	149	+ return self::$instance;
	150	+ }
	151	+
	152	+ /**
	153	+ * Whether a value is the placeholder title WordPress assigns to a brand-new,
	154	+ * still-untitled post.
	155	+ *
	156	+ * Core creates the row with a *translated* title —
	157	+ * wp-admin/includes/post.php: 'post_title' => __( 'Auto Draft' ) — so matching
	158	+ * only the English literal misses every localized site. Compare against the
	159	+ * literal and the current locale's translation, so both an English install and
	160	+ * a translated one are covered, as is a value stored before a locale switch.
	161	+ * A third arm checks the captured-variant registry, because the translation
	162	+ * only resolves in admin: on front-end requests __( 'Auto Draft' ) stays
	163	+ * English even on a localized site, and a stored de_DE placeholder would
	164	+ * otherwise pass every check above.
	165	+ *
	166	+ * Exact match after trim, never fuzzy: an editor who legitimately titles a post
	167	+ * "Auto Draft" on purpose is a caller-side concern, and only the four social
	168	+ * keys in AUTO_DRAFT_PRONE_KEYS are ever routed through here.
	169	+ *
	170	+ * @param mixed $value
	171	+ * @return bool
	172	+ */
	173	+ public static function is_auto_draft_title($value) {
	174	+ if (!is_string($value)) {
	175	+ return false;
	176	+ }
	177	+ $value = trim($value);
	178	+ if ($value === '') {
	179	+ return false;
	180	+ }
	181	+ # 'default' text domain, matching the __() call core itself uses.
	182	+ if ($value === 'Auto Draft' || $value === trim(__('Auto Draft', 'default'))) { // phpcs:ignore WordPress.WP.I18n.TextDomainMismatch -- resolves core's own 'Auto Draft' placeholder, which only exists in core's 'default' domain; the plugin text domain cannot reproduce it
	183	+ return true;
	184	+ }
	185	+ # Registry arm: a variant captured in another locale's admin request.
	186	+ # Without it the guard above is English-only on every non-admin request,
	187	+ # because core never loads the 'default' MO files out there.
	188	+ return in_array($value, self::known_auto_draft_placeholders(), true);
	189	+ }
	190	+
	191	+ /**
	192	+ * Every placeholder variant known to this install: the English literal plus
	193	+ * whatever has been captured into the site option so far.
	194	+ *
	195	+ * @return string[]
	196	+ */
	197	+ public static function known_auto_draft_placeholders() {
	198	+ $stored = get_option(self::AUTO_DRAFT_PLACEHOLDER_OPTION, []);
	199	+ if (!is_array($stored)) {
	200	+ $stored = [];
	201	+ }
	202	+ $variants = ['Auto Draft'];
	203	+ foreach ($stored as $variant) {
	204	+ if (is_string($variant) && trim($variant) !== '' && !in_array(trim($variant), $variants, true)) {
	205	+ $variants[] = trim($variant);
	206	+ }
	207	+ }
	208	+ return $variants;
	209	+ }
	210	+
	211	+ /**
	212	+ * Capture a placeholder variant into the site option. Called from the
	213	+ * admin save path, where the creating request's own __( 'Auto Draft' )
	214	+ * has already verified the title *is* core's placeholder — so no
	215	+ * translation is needed here, only de-duplication and capping.
	216	+ *
	217	+ * @param mixed $title Verbatim post title recognized as the placeholder.
	218	+ * @return void
	219	+ */
	220	+ public static function remember_auto_draft_placeholder($title) {
	221	+ $title = is_string($title) ? trim($title) : '';
	222	+ if ($title === '' || $title === 'Auto Draft') {
	223	+ return;
	224	+ }
	225	+ $known = self::known_auto_draft_placeholders();
	226	+ if (in_array($title, $known, true)) {
	227	+ return;
	228	+ }
	229	+ # Persist captured variants only: the English literal is seeded
	230	+ # code-side by known_auto_draft_placeholders(), so storing it would be
	231	+ # redundant state.
	232	+ $captured = array_values(array_diff($known, ['Auto Draft']));
	233	+ $captured[] = $title;
	234	+ update_option(self::AUTO_DRAFT_PLACEHOLDER_OPTION, array_slice($captured, -self::AUTO_DRAFT_PLACEHOLDER_CAP), false);
	235	+ }
	236	+
	237	+ /**
	238	+ * admin_init callback: register the placeholder variant the current admin
	239	+ * request's translation resolves to. remember_auto_draft_placeholder()
	240	+ * de-duplicates, so repeated requests only cost one cached option read.
	241	+ *
	242	+ * @return void
	243	+ */
	244	+ public static function seed_auto_draft_placeholder() {
	245	+ self::remember_auto_draft_placeholder(__('Auto Draft', 'default')); // phpcs:ignore WordPress.WP.I18n.TextDomainMismatch -- resolves core's own 'Auto Draft' placeholder, which only exists in core's 'default' domain; the plugin text domain cannot reproduce it
	246	+ }
	247	+
	248	+ /**
	249	+ * Read a persisted social meta value, collapsing the "Auto Draft" placeholder
	250	+ * to an empty string.
	251	+ *
	252	+ * Every consumer resolves these fields through a "first non-empty wins" chain
	253	+ * (persisted key -> OTTO staging key -> real post title). A stored placeholder
	254	+ * is truthy, so the chain would keep it; returning '' lets the chain fall
	255	+ * through to the real title. That fixes rows already polluted before this fix
	256	+ * shipped, at render time, without a DB migration.
	257	+ *
	258	+ * Public and static because the three consumers that actually emit or forward
	259	+ * these values live in different classes: this emitter,
	260	+ * Otto_html_class::apply_metabox_og_precedence(), and Metasync_Plugin_Sync's
	261	+ * mirror into Yoast/RankMath/AIOSEO storage. Follows the same
	262	+ * sanitize-at-the-source pattern as Metasync_Canonical_Sanitizer::sanitize().
	263	+ *
	264	+ * @param mixed $value Raw stored meta value.
	265	+ * @return string
	266	+ */
	267	+ public static function strip_auto_draft_title($value) {
	268	+ if (self::is_auto_draft_title($value)) {
	269	+ return '';
	270	+ }
	271	+ return is_scalar($value) ? (string) $value : '';
	272	+ }
	273	+
	274	+ /**
	275	+ * Read one of the AUTO_DRAFT_PRONE_KEYS for a post with the placeholder
	276	+ * collapsed to '' — and, for the title keys, a stored snapshot of the
	277	+ * title default the pre-fill showed (the post title, or the og title for
	278	+ * the twitter twin), and for the description keys a stored snapshot of
	279	+ * the resolved description, collapsed too.
	280	+ *
	281	+ * @param int $post_id
	282	+ * @param string $key
	283	+ * @return string
	284	+ */
	285	+ public static function get_social_meta($post_id, $key) {
	286	+ return self::strip_description_snapshot(
	287	+ $post_id,
	288	+ $key,
	289	+ self::strip_title_snapshot(
	290	+ $post_id,
	291	+ $key,
	292	+ self::strip_auto_draft_title(get_post_meta($post_id, $key, true))
	293	+ )
	294	+ );
	295	+ }
	296	+
	297	+ /**
	298	+ * Collapse a stored social title that merely mirrors the post's own title.
	299	+ *
	300	+ * The meta box used to pre-fill Title from the post title as a real value
	301	+ * and persist it on save, so rows exist where `_metasync_og_title` (and the
	302	+ * twitter twin) hold a verbatim copy of the title as it was on save day.
	303	+ * Renaming the post then left that snapshot stale with nothing to tell it
	304	+ * apart from a typed title. Collapsing it here — at the read, the same
	305	+ * place the "Auto Draft" placeholder collapses — makes such a row read as
	306	+ * unset, and the render-time fallback to the *live* title keeps the social
	307	+ * title in step with every rename. A value that differs from the title is
	308	+ * untouched: only text the editor genuinely typed survives.
	309	+ *
	310	+ * The twitter twin compares against what the og title field showed when
	311	+ * the pre-fill was rendered — a stored og title if one is set, otherwise
	312	+ * the same live post title — since that is exactly what the pre-fill
	313	+ * echoed into the twitter field. Without that chain, a twitter row echoed
	314	+ * from a typed og title would read as a deliberate override and stop
	315	+ * following the og title it always rendered.
	316	+ *
	317	+ * Compared after trim on both sides: stored values pass through
	318	+ * sanitize_text_field, which trims, so only the post title side can carry
	319	+ * surrounding whitespace.
	320	+ *
	321	+ * Public and static for the same reason strip_auto_draft_title() is: the
	322	+ * consumers live in different classes (this emitter, the precedence
	323	+ * resolver, the plugin sync mirror, the SEO suite).
	324	+ *
	325	+ * @param int $post_id
	326	+ * @param string $key One of TITLE_DEFAULTED_KEYS; others pass through.
	327	+ * @param mixed $value Stored meta value, already placeholder-collapsed.
	328	+ * @return string
	329	+ */
	330	+ public static function strip_title_snapshot($post_id, $key, $value) {
	331	+ $value = is_scalar($value) ? (string) $value : '';
	332	+ if ($value === '' || !in_array($key, self::TITLE_DEFAULTED_KEYS, true)) {
	333	+ return $value;
	334	+ }
	335	+
	336	+ $default = self::default_social_title($post_id, $key);
	337	+ if ($default === '') {
	338	+ return $value;
	339	+ }
	340	+
	341	+ return trim($value) === trim($default) ? '' : $value;
	342	+ }
	343	+
	344	+ /**
	345	+ * The default a title key renders when its own field is blank: the live
	346	+ * post title for the og key, and for the twitter key whatever the og field
	347	+ * would show (a stored og title if one is set, otherwise the same live
	348	+ * title) — the exact chain the meta box fallback used to pre-fill as a
	349	+ * value and still shows as the twitter field's placeholder.
	350	+ *
	351	+ * social_post_title() — not the raw post_title — is what the pre-fill ever
	352	+ * stored, and it returns '' for a still-untitled post, where there is no
	353	+ * meaningful default to compare against anyway (such rows are the
	354	+ * placeholder case strip_auto_draft_title() already handles).
	355	+ *
	356	+ * @param int $post_id
	357	+ * @param string $key
	358	+ * @return string
	359	+ */
	360	+ private static function default_social_title($post_id, $key) {
	361	+ $title = self::social_post_title(get_post($post_id));
	362	+ if ($key === '_metasync_og_title') {
	363	+ return $title;
	364	+ }
	365	+
	366	+ $og = self::get_social_meta($post_id, '_metasync_og_title');
	367	+ return $og !== '' ? $og : $title;
	368	+ }
	369	+
	370	+ /**
	371	+ * Collapse a stored social description that merely mirrors the default the
	372	+ * meta box pre-filled.
	373	+ *
	374	+ * The meta box pre-filled Description from the resolved description (the
	375	+ * manual excerpt, or one generated from the content) as a real value and
	376	+ * persisted it on save, so rows exist where `_metasync_og_description` (and
	377	+ * the twitter twin) hold a copy of the excerpt as it was on save day.
	378	+ * Changing the excerpt — or the content the excerpt is generated from — then
	379	+ * left that snapshot stale with nothing to tell it apart from a typed
	380	+ * description. Collapsing it here — at the read, the same place the "Auto
	381	+ * Draft" placeholder and title snapshots collapse — makes such a row read as
	382	+ * unset, and the render-time fallback to the *live* excerpt keeps the social
	383	+ * description in step. A value that differs from the default is untouched:
	384	+ * only text the editor genuinely typed survives.
	385	+ *
	386	+ * The twitter twin compares against what the og description field showed
	387	+ * when the pre-fill was rendered — a stored og description if one is set,
	388	+ * otherwise the same resolved default — since that is exactly what the
	389	+ * pre-fill echoed into the twitter field.
	390	+ *
	391	+ * Compared after whitespace normalization on both sides: descriptions pass
	392	+ * through sanitize_textarea_field, which preserves line breaks, and a manual
	393	+ * excerpt can carry them while the generated default cannot, so a snapshot
	394	+ * and its default must be compared with runs of whitespace treated as one
	395	+ * space rather than byte-for-byte.
	396	+ *
	397	+ * Public and static for the same reason strip_title_snapshot() is: the
	398	+ * consumers live in different classes (this emitter, the precedence
	399	+ * resolver, the plugin sync mirror, the SEO suite).
	400	+ *
	401	+ * @param int $post_id
	402	+ * @param string $key One of DESCRIPTION_DEFAULTED_KEYS; others pass through.
	403	+ * @param mixed $value Stored meta value, already placeholder-collapsed.
	404	+ * @return string
	405	+ */
	406	+ public static function strip_description_snapshot($post_id, $key, $value) {
	407	+ $value = is_scalar($value) ? (string) $value : '';
	408	+ if ($value === '' || !in_array($key, self::DESCRIPTION_DEFAULTED_KEYS, true)) {
	409	+ return $value;
	410	+ }
	411	+
	412	+ $default = self::default_social_description($post_id, $key);
	413	+ if ($default === '') {
	414	+ return $value;
	415	+ }
	416	+
	417	+ return self::normalize_description_compare($value) === self::normalize_description_compare($default)
	418	+ ? ''
	419	+ : $value;
	420	+ }
	421	+
	422	+ /**
	423	+ * The default a description key renders when its own field is blank: the
	424	+ * resolved description for the og key, and for the twitter key whatever the
	425	+ * og field would show (a stored og description if one is set, otherwise the
	426	+ * same resolved default — even when that default is empty) — the exact
	427	+ * chain the meta box fallback used to pre-fill as a value.
	428	+ *
	429	+ * Resolved through the emitter's own instance so it matches what actually
	430	+ * renders; when no instance is available the default cannot be proven, so ''
	431	+ * is returned and the caller keeps the stored value rather than risk
	432	+ * discarding text the editor typed.
	433	+ *
	434	+ * @param int $post_id
	435	+ * @param string $key
	436	+ * @return string
	437	+ */
	438	+ private static function default_social_description($post_id, $key) {
	439	+ $instance = self::get_instance();
	440	+ if (!$instance) {
	441	+ return '';
	442	+ }
	443	+
	444	+ $default = (string) $instance->get_default_og_values($post_id)['description'];
	445	+ if ($key === '_metasync_og_description') {
	446	+ return $default;
	447	+ }
	448	+
	449	+ # The og chain runs for the twitter twin even when the resolved default
	450	+ # is empty: the pre-fill echoed the og description into the twitter
	451	+ # field whenever the og field carried a value, so that — not the empty
	452	+ # excerpt — is the default a stored twitter echo must match to collapse.
	453	+ $og = self::get_social_meta($post_id, '_metasync_og_description');
	454	+ return $og !== '' ? $og : $default;
	455	+ }
	456	+
	457	+ /**
	458	+ * Normalize a description for equality comparison: trimmed, with runs of
	459	+ * whitespace collapsed to a single space. Falls back to a plain trim when
	460	+ * the value is not valid UTF-8 and the /u pattern therefore fails.
	461	+ *
	462	+ * @param string $value
	463	+ * @return string
	464	+ */
	465	+ private static function normalize_description_compare($value) {
	466	+ $normalized = preg_replace('/\s+/u', ' ', trim((string) $value));
	467	+ return is_string($normalized) ? $normalized : trim((string) $value);
	468	+ }
	469	+
	470	+ /**
	471	+ * A post's title for social use, suppressing only WordPress's own placeholder.
	472	+ *
	473	+ * Distinct from strip_auto_draft_title(), which is for *stored* meta values:
	474	+ * there the string is all we have, since a legacy row carries no clue about the
	475	+ * status it was written under. A live post gives us both signals, so require
	476	+ * both — the post is still an auto-draft AND its title is the placeholder. An
	477	+ * editor who genuinely titles a published post "Auto Draft" (an article about
	478	+ * the placeholder itself, say) keeps it as their og:title.
	479	+ *
	480	+ * @param WP_Post|mixed $post
	481	+ * @return string
	482	+ */
	483	+ public static function social_post_title($post) {
	484	+ if (!$post instanceof WP_Post) {
	485	+ return '';
	486	+ }
	487	+ if ($post->post_status === 'auto-draft' && self::is_auto_draft_title($post->post_title)) {
	488	+ return '';
	489	+ }
	490	+ # State-based arm: the post was saved while still untitled (flag set at
	491	+ # save time, where translations resolve) and its title is still that
	492	+ # flagged placeholder. This is what catches a placeholder-titled post
	493	+ # that went on to be published — the status check above no longer
	494	+ # matches it, and on a localized site the string checks cannot either.
	495	+ $flagged = get_post_meta($post->ID, self::UNTITLED_FLAG_META, true);
	496	+ if (is_string($flagged) && trim($flagged) !== '' && trim((string) $post->post_title) === trim($flagged)) {
	497	+ return '';
	498	+ }
	499	+ return (string) $post->post_title;
	500	+ }
	501	+
	502	+ /**
	503	+ * Whether MetaSync social output is disabled for a post.
	504	+ *
	505	+ * The site-wide switch and the per-post switch both disable only MetaSync's
	506	+ * social output; callers must leave third-party SEO output untouched.
	507	+ *
	508	+ * @param int $post_id Post ID.
	509	+ * @return bool
	510	+ */
	511	+ public static function is_social_output_disabled($post_id = 0) {
	512	+ if (Metasync_Feature_Flags::is_disabled(Metasync_Feature_Flags::SOCIAL_OG)) {
	513	+ return true;
	514	+ }
	515	+
	516	+ return $post_id > 0 && get_post_meta($post_id, '_metasync_og_enabled', true) === '0';
	517	+ }
	518	+
	519	+ /**
	520	+ * The default OG values the meta box pre-fills for a post: post title,
	521	+ * generated excerpt, and featured image. Computed with the same helpers the
	522	+ * meta box/emitter use, so a caller can compare a stored _metasync_og_* value
	523	+ * against the default and tell whether the user genuinely customized it (the
	524	+ * meta box persists these defaults on save, so a non-empty value alone does
	525	+ * not prove user intent).
	526	+ *
	527	+ * The title is returned empty on a still-untitled post rather than as the
	528	+ * "Auto Draft" placeholder, so the meta box pre-fills nothing and callers
	529	+ * comparing a stored value against this default don't read the placeholder as
	530	+ * a deliberate override.
	531	+ *
	532	+ * Memoized per request: the values are pure functions of the post, and one
	533	+ * front-end render resolves them several times (every collapsed description
	534	+ * read asks for the default, and the OTTO precedence walk asks again) — on
	535	+ * page-builder content the excerpt pass alone re-runs the whole
	536	+ * shortcode-strip pipeline each time. The save handler drops the memo
	537	+ * before its comparisons, since save_post fires after the post row write
	538	+ * and the comparison must see the new title/excerpt. Capped at
	539	+ * DEFAULT_OG_VALUES_MEMO_CAP posts for loops that walk many posts in one
	540	+ * request.
	541	+ *
	542	+ * @param int $post_id
	543	+ * @return array{title:string,description:string,image:string}
	544	+ */
	545	+ public function get_default_og_values($post_id) {
	546	+ $post_id = (int) $post_id;
	547	+ // No real post: get_post(0) answers with the global post, which would
	548	+ // then be memoized under key 0 and served for every later bogus id.
	549	+ if ($post_id <= 0) {
	550	+ return ['title' => '', 'description' => '', 'image' => ''];
	551	+ }
	552	+ if (isset(self::$default_og_values_memo[$post_id])) {
	553	+ return self::$default_og_values_memo[$post_id];
	554	+ }
	555	+
	556	+ $post = get_post($post_id);
	557	+ if (!$post instanceof WP_Post) {
	558	+ return ['title' => '', 'description' => '', 'image' => ''];
	559	+ }
	560	+
	561	+ if (count(self::$default_og_values_memo) >= self::DEFAULT_OG_VALUES_MEMO_CAP) {
	562	+ // unset() on the first key, NOT array_shift(): the memo is keyed by
	563	+ // post id, and array_shift() reindexes integer keys from zero —
	564	+ // after one eviction the survivors would live under 0..8 and any
	565	+ // post with a low id would be served another post's defaults.
	566	+ unset(self::$default_og_values_memo[array_key_first(self::$default_og_values_memo)]);
	567	+ }
	568	+ return self::$default_og_values_memo[$post_id] = [
	569	+ 'title' => self::social_post_title($post),
	570	+ 'description' => (string) $this->get_post_excerpt($post),
	571	+ 'image' => (string) $this->get_featured_image_url($post->ID),
	572	+ ];
	573	+ }
	574	+
	575	+ /**
	576	+ * Drop the get_default_og_values() memo. Called on the save path, where the
	577	+ * just-written post row must be re-read rather than served from a memo
	578	+ * populated earlier in the request; also the seam long-lived processes
	579	+ * (tests, CLI) use to simulate a fresh request. Mirrors
	580	+ * Metasync_Otto_Config::clear_cache().
	581	+ */
	582	+ public static function clear_default_og_values_memo() {
	583	+ self::$default_og_values_memo = [];
	584	+ }
	585	+
	586	+ /**
48	587	* Register all hooks for this class
49	588	*/
50	589	public function init() {
51	590	# Admin hooks
52	591	add_action('add_meta_boxes', [$this, 'add_meta_box']);
	592	+ # Runs before save_meta_box_data so the untitled flag it maintains is
	593	+ # already current when the meta box save guard consults it.
	594	+ add_action('save_post', [$this, 'track_untitled_post'], 5, 2);
53	595	add_action('save_post', [$this, 'save_meta_box_data']);
54	596	add_action('admin_enqueue_scripts', [$this, 'enqueue_admin_scripts']);
55	597
56	598	# Alternative script loading for post edit screens
		@@ -77,11 +619,95 @@
77	619	add_action('wp_ajax_metasync_og_preview', [$this, 'ajax_generate_preview']);
78	620
79	621	# Register cross-plugin dedup filters (Yoast / Rank Math) when their plugins are active
80	622	$this->register_dedup_filters();
	623	+
	624	+ # Keep the localized "Auto Draft" placeholder out of SEO-plugin titles
	625	+ # for posts published while still untitled.
	626	+ $this->register_untitled_title_filters();
	627	+
	628	+ # Seed the placeholder registry with this admin user's locale variant,
	629	+ # so localized values are recognized everywhere even before any new
	630	+ # post is created on a localized install.
	631	+ if (is_admin()) {
	632	+ add_action('admin_init', [self::class, 'seed_auto_draft_placeholder']);
	633	+ }
	634	+
	635	+ # Shared predicate so the legacy emitter (Metasync_Seo_Output::hook_metasync_metatags)
	636	+ # can suppress its own OG/Twitter blocks whenever this class will emit for the post
	637	+ add_filter('metasync_opengraph_will_emit', [$this, 'will_emit']);
81	638	}
82	639
83	640	/**
	641	+ * Shared predicate: returns true when output_opengraph_tags() will emit
	642	+ * the consolidated OG/Twitter block for the current request.
	643	+ *
	644	+ * Mirrors the early-return guards in output_opengraph_tags() so this
	645	+ * canonical emitter and the legacy emitter stay mutually exclusive —
	646	+ * exactly one fires per page, and neither stays silent on a
	647	+ * MetaSync-only site.
	648	+ *
	649	+ * @param bool $default Filter default (ignored; the real answer is computed).
	650	+ * @return bool
	651	+ */
	652	+ public function will_emit($default = false) {
	653	+ # Feature switched off, so this emitter stays silent. The legacy emitter
	654	+ # checks the same switch independently, so reporting false here cannot
	655	+ # hand it the work.
	656	+ if (Metasync_Feature_Flags::is_disabled(Metasync_Feature_Flags::SOCIAL_OG)) {
	657	+ return false;
	658	+ }
	659	+
	660	+ if (!is_singular($this->get_supported_post_types())) {
	661	+ return false;
	662	+ }
	663	+
	664	+ global $post;
	665	+ if (!$post instanceof WP_Post) {
	666	+ return false;
	667	+ }
	668	+
	669	+ # Only an explicit '0' opt-out disables output; unset/empty counts as enabled
	670	+ $og_enabled = get_post_meta($post->ID, '_metasync_og_enabled', true);
	671	+ if ($og_enabled === '0') {
	672	+ return false;
	673	+ }
	674	+
	675	+ # OTTO active with persisted OG data owns the page (legacy emitter suppresses too)
	676	+ if ($this->otto_owns_og($post->ID)) {
	677	+ return false;
	678	+ }
	679	+
	680	+ # Third-party SEO plugin active: yield entirely, legacy emitter keeps its original behavior
	681	+ if (apply_filters('metasync_opengraph_check_conflicts', true) && $this->has_seo_plugin_conflicts()) {
	682	+ return false;
	683	+ }
	684	+
	685	+ return true;
	686	+ }
	687	+
	688	+ /**
	689	+ * Whether OTTO owns this page's Open Graph / Twitter output.
	690	+ *
	691	+ * When OTTO is enabled and has persisted OG data for the post, OTTO's
	692	+ * dynamically-injected tags (and the buffer-level dedup) take precedence, so
	693	+ * the per-post OG meta box values are not emitted on the frontend. Shared by
	694	+ * the frontend emitter (to suppress duplicate output) and the admin meta box
	695	+ * (to warn the user their values won't apply on an OTTO-managed page).
	696	+ *
	697	+ * @param int $post_id
	698	+ * @return bool
	699	+ */
	700	+ private function otto_owns_og($post_id) {
	701	+ if (!class_exists('Metasync_Otto_Config') || !Metasync_Otto_Config::is_otto_enabled()) {
	702	+ return false;
	703	+ }
	704	+ $otto_og_title = get_post_meta($post_id, '_metasync_otto_og_title', true);
	705	+ $otto_og_desc = get_post_meta($post_id, '_metasync_otto_og_description', true);
	706	+ return !empty($otto_og_title) || !empty($otto_og_desc);
	707	+ }
	708	+
	709	+ /**
84	710	* Add the Open Graph meta box to post and page editors
85	711	*/
86	712	public function add_meta_box() {
87	713	# Don't show meta box if user's role doesn't have plugin access
		@@ -101,8 +727,16 @@
101	727	if (!empty($general_settings['disable_social_opengraph_metabox'])) {
102	728	return;
103	729	}
104	730
	731	+ # LPS / custom-HTML pages bake their own OG/social tags into their HTML bundle,
	732	+ # served before wp_head — so this box does nothing on them. Hide it; the SEO
	733	+ # read-only notice covers the messaging.
	734	+ $lps_post_id = isset($_GET['post']) ? intval($_GET['post']) : (isset($_POST['post_ID']) ? intval($_POST['post_ID']) : 0); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- read-only post ID to pick meta boxes
	735	+ if (function_exists('metasync_is_custom_or_lps_page') && $lps_post_id > 0 && metasync_is_custom_or_lps_page($lps_post_id)) {
	736	+ return;
	737	+ }
	738	+
105	739	# Get supported post types (allow filtering)
106	740	$post_types = $this->get_supported_post_types();
107	741	$plugin_name = Metasync::get_effective_plugin_name();
108	742
		@@ -108,8 +742,9 @@
108	742
109	743	foreach ($post_types as $post_type) {
110	744	add_meta_box(
111	745	self::META_BOX_ID,
	746	+ /* translators: %s: effective plugin name (whitelabel-aware). */
112	747	sprintf(esc_html__('Social Media & Open Graph by %s', 'metasync'), $plugin_name),
113	748	[$this, 'render_meta_box'],
114	749	$post_type,
115	750	'normal',
		@@ -124,12 +759,16 @@
124	759	public function render_meta_box($post) {
125	760	# Add nonce for security
126	761	wp_nonce_field('metasync_opengraph_nonce', 'metasync_opengraph_nonce');
127	762
128		- # Get existing values
	763	+ # Get existing values. The four social title/description keys are read through
	764	+ # get_social_meta(), which collapses the "Auto Draft" placeholder, a stored
	765	+ # snapshot of the post title, and a stored snapshot of the resolved
	766	+ # description to '' — so a polluted legacy row shows an empty field (the
	767	+ # default lives in the placeholder) and re-saving clears it.
129	768	$og_enabled = get_post_meta($post->ID, '_metasync_og_enabled', true);
130		- $og_title = get_post_meta($post->ID, '_metasync_og_title', true);
131		- $og_description = get_post_meta($post->ID, '_metasync_og_description', true);
	769	+ $og_title = self::get_social_meta($post->ID, '_metasync_og_title');
	770	+ $og_description = self::get_social_meta($post->ID, '_metasync_og_description');
132	771	$og_image = get_post_meta($post->ID, '_metasync_og_image', true);
133	772	$og_url = get_post_meta($post->ID, '_metasync_og_url', true);
134	773	$og_type = get_post_meta($post->ID, '_metasync_og_type', true);
135	774
		@@ -135,10 +774,10 @@
135	774
136	775	# Twitter Card fields
137	776	$twitter_card = get_post_meta($post->ID, '_metasync_twitter_card', true);
138	777	$twitter_site = get_post_meta($post->ID, '_metasync_twitter_site', true);
139		- $twitter_title = get_post_meta($post->ID, '_metasync_twitter_title', true);
140		- $twitter_description = get_post_meta($post->ID, '_metasync_twitter_description', true);
	778	+ $twitter_title = self::get_social_meta($post->ID, '_metasync_twitter_title');
	779	+ $twitter_description = self::get_social_meta($post->ID, '_metasync_twitter_description');
141	780	$twitter_image = get_post_meta($post->ID, '_metasync_twitter_image', true);
142	781	$twitter_image_alt = get_post_meta($post->ID, '_metasync_twitter_image_alt', true);
143	782
144	783	# Twitter App Card fields
		@@ -160,14 +799,36 @@
160	799	if ($og_enabled === '') {
161	800	# For new posts, default to enabled
162	801	$og_enabled = '1';
163	802	}
164		- if (empty($og_title)) {
165		- $og_title = $post->post_title;
166		- }
167		- if (empty($og_description)) {
168		- $og_description = $this->get_post_excerpt($post);
169		- }
	803	+ # The post title is the default social title, but it is shown as a
	804	+ # placeholder, never as the field's value. Submitting a page carries
	805	+ # every value attribute to the save handler, so pre-filling the title
	806	+ # persisted a verbatim snapshot of it — one a later rename left stale
	807	+ # (and indistinguishable from a typed title). An empty field plus a
	808	+ # placeholder keeps the default visible while storing nothing, and the
	809	+ # render-time fallback to the live title tracks renames on its own.
	810	+ # social_post_title() suppresses WordPress's own "Auto Draft"
	811	+ # placeholder, so a brand-new post shows no misleading hint either.
	812	+ $title_placeholder = self::social_post_title($post);
	813	+ # What twitter:title actually renders when its own field is blank: the
	814	+ # OG title if one is set, otherwise the same live post title. Shown as
	815	+ # the twitter field's placeholder for the same reason as above.
	816	+ $twitter_title_placeholder = ($og_title !== '') ? $og_title : $title_placeholder;
	817	+ # The resolved description (the manual excerpt, or one generated from
	818	+ # the content) is the default social description, and like the title it
	819	+ # is shown as a placeholder, never as the field's value. Pre-filling it
	820	+ # persisted a snapshot of the excerpt as of save day — one a later
	821	+ # excerpt or content edit left stale, and indistinguishable from a
	822	+ # typed description. An empty field plus a placeholder keeps the
	823	+ # default visible while storing nothing, and the render-time fallback
	824	+ # to the live excerpt tracks edits on its own.
	825	+ $description_placeholder = $this->get_post_excerpt($post);
	826	+ # What twitter:description actually renders when its own field is
	827	+ # blank: the OG description if one is set, otherwise the same resolved
	828	+ # default. Shown as the twitter field's placeholder for the same
	829	+ # reason as above.
	830	+ $twitter_description_placeholder = ($og_description !== '') ? $og_description : $description_placeholder;
170	831	if (empty($og_url)) {
171	832	$og_url = $this->get_canonical_url($post);
172	833	}
173	834	if (empty($og_type)) {
		@@ -175,23 +836,20 @@
175	836	}
176	837	if (empty($og_image)) {
177	838	$og_image = $this->get_featured_image_url($post->ID);
178	839	}
179		-
	840	+
180	841	# Twitter defaults
181	842	if (empty($twitter_card)) {
182	843	$twitter_card = 'summary_large_image';
183	844	}
184		- if (empty($twitter_title)) {
185		- $twitter_title = $og_title;
186		- }
187		- if (empty($twitter_description)) {
188		- $twitter_description = $og_description;
189		- }
190	845	if (empty($twitter_image)) {
191	846	$twitter_image = $og_image;
192	847	}
193	848
	849	+ # Whether OTTO is managing this page's OG output (values below won't apply on the frontend)
	850	+ $otto_owns_og = $this->otto_owns_og($post->ID);
	851	+
194	852	# Include the meta box template
195	853	include plugin_dir_path(__FILE__) . '../admin/partials/metasync-opengraph-meta-box.php';
196	854	}
197	855
		@@ -198,10 +856,20 @@
198	856	/**
199	857	* Save meta box data
200	858	*/
201	859	public function save_meta_box_data($post_id) {
	860	+ # Drop the defaults memo before anything below can bail. This handler is
	861	+ # hooked to save_post, so it runs for EVERY save of the post — including
	862	+ # ones initiated by another meta box, a bulk action, or a sync flow that
	863	+ # carries no OG nonce and would have returned early above the old flush
	864	+ # position. Without this clear, a memo seeded earlier in the same request
	865	+ # (a metabox render, a sync read) survives the post-row write and serves
	866	+ # the pre-save title/excerpt to the snapshot comparisons in later
	867	+ # save_post subscribers — the Yoast re-sync on shutdown among them.
	868	+ self::clear_default_og_values_memo();
	869	+
202	870	# Check if nonce is valid
203		- if (!isset($_POST['metasync_opengraph_nonce']) ||
	871	+ if (!isset($_POST['metasync_opengraph_nonce']) ||
204	872	!wp_verify_nonce($_POST['metasync_opengraph_nonce'], 'metasync_opengraph_nonce')) {
205	873	return;
206	874	}
207	875
		@@ -266,14 +934,156 @@
266	934
267	935	foreach ($all_fields as $field => $sanitize_callback) {
268	936	if (isset($_POST[$field])) {
269	937	$value = call_user_func($sanitize_callback, $_POST[$field]);
270		- update_post_meta($post_id, $field, $value);
	938	+
	939	+ # The meta box pre-fills empty social title/description fields from the
	940	+ # post title, and on a brand-new post that title is the "Auto Draft"
	941	+ # placeholder. Persisting it ships "Auto Draft" as the post's social
	942	+ # title and description forever, so store empty instead and let the
	943	+ # render-time fallback chain resolve the real title once one is set.
	944	+ if (in_array($field, self::AUTO_DRAFT_PRONE_KEYS, true)
	945	+ && $this->is_auto_draft_prefill_echo($post_id, $value)
	946	+ ) {
	947	+ $value = '';
	948	+ }
	949	+
	950	+ # A social title identical to the post's title is the default, not a
	951	+ # customization — whether the editor left an older pre-filled form
	952	+ # untouched or typed the title back verbatim. Store empty so the
	953	+ # render-time fallback to the live title applies, which is what keeps
	954	+ # a rename from leaving a stale snapshot behind. Text that differs
	955	+ # from the title passes through untouched. save_post fires after the
	956	+ # post row is written, so the comparison is against the *new* title.
	957	+ if (in_array($field, self::TITLE_DEFAULTED_KEYS, true)) {
	958	+ $value = self::strip_title_snapshot($post_id, $field, $value);
	959	+ }
	960	+
	961	+ # A social description identical to its rendered default — the
	962	+ # resolved excerpt the older pre-filled form carried, or the
	963	+ # same text typed back verbatim — is the default, not a
	964	+ # customization. Store empty so the render-time fallback to the
	965	+ # live excerpt applies, which is what keeps an excerpt or
	966	+ # content edit from leaving a stale snapshot behind. Text that
	967	+ # differs from the default passes through untouched. save_post
	968	+ # fires after the post row is written, so the comparison is
	969	+ # against the *new* excerpt and content.
	970	+ if (in_array($field, self::DESCRIPTION_DEFAULTED_KEYS, true)) {
	971	+ $value = self::strip_description_snapshot($post_id, $field, $value);
	972	+ }
	973	+
	974	+ # An empty value means "no value" for every field in this box,
	975	+ # and must not be stored as one: update_post_meta(..., '') keeps
	976	+ # a row with an empty meta_value in the table (visible only to
	977	+ # metadata_exists, EXISTS queries and exports, which would then
	978	+ # report a customization where the field is merely blank). The
	979	+ # plain read answers '' for a missing row too, so deleting is
	980	+ # behaviour-preserving for every reader. Same pattern the
	981	+ # untitled-flag write below has always used.
	982	+ if ($value === '') {
	983	+ delete_post_meta($post_id, $field);
	984	+ } else {
	985	+ update_post_meta($post_id, $field, $value);
	986	+ }
271	987	}
272	988	}
273	989	}
274	990
275	991	/**
	992	+ * Whether a submitted social field value is the meta box echoing back a
	993	+ * placeholder pre-fill rather than something the editor typed.
	994	+ *
	995	+ * Two cases, both narrow on purpose so genuinely typed text is never discarded:
	996	+ * - the value is the "Auto Draft" placeholder itself; or
	997	+ * - the post is still an auto-draft and the value is just its title echoed
	998	+ * back, which is what the pre-fill submits when the editor never touched
	999	+ * the field.
	1000	+ *
	1001	+ * @param int $post_id
	1002	+ * @param mixed $value Sanitized submitted value.
	1003	+ * @return bool
	1004	+ */
	1005	+ /**
	1006	+ * save_post tracker maintaining the untitled state this class suppresses by.
	1007	+ *
	1008	+ * Two jobs, both anchored at save time — the only place the "Auto Draft"
	1009	+ * translation reliably resolves — so the render path never has to guess:
	1010	+ *
	1011	+ * 1. Capture: when core creates an auto-draft, its title *is*
	1012	+ * __( 'Auto Draft' ) in the creating request's locale (admin requests
	1013	+ * carry the creating user's locale). Verified against that same __()
	1014	+ * call here, then remembered verbatim, so every locale variant this
	1015	+ * install ever uses is known to all contexts.
	1016	+ * 2. Flag: mark posts saved while still placeholder-titled (recognized via
	1017	+ * literal + translation + the registry above, so REST/CLI saves — where
	1018	+ * the translation stays English — still recognize a registry hit), and
	1019	+ * clear the mark as soon as a real title arrives.
	1020	+ *
	1021	+ * @param int $post_id
	1022	+ * @param WP_Post|mixed $post
	1023	+ * @return void
	1024	+ */
	1025	+ public function track_untitled_post($post_id, $post) {
	1026	+ if (wp_is_post_revision($post_id) || wp_is_post_autosave($post_id)) {
	1027	+ return;
	1028	+ }
	1029	+ if (!$post instanceof WP_Post) {
	1030	+ $post = get_post($post_id);
	1031	+ }
	1032	+ if (!$post instanceof WP_Post || $post->post_type === 'revision' || $post->post_status === 'trash') {
	1033	+ return;
	1034	+ }
	1035	+ if (!in_array($post->post_type, $this->get_supported_post_types(), true)) {
	1036	+ return;
	1037	+ }
	1038	+
	1039	+ $title = trim((string) $post->post_title);
	1040	+
	1041	+ # Capture: an auto-draft's title is core's placeholder in whatever
	1042	+ # locale resolved for the saving request — admin requests carry the
	1043	+ # creating user's locale; on untranslated requests (front end, REST,
	1044	+ # CLI) the equality below degenerates to the English literal, which
	1045	+ # remember_auto_draft_placeholder() already skips. Verified against
	1046	+ # __( 'Auto Draft' ), never trusted as a bare string, so a builder's
	1047	+ # custom-seeded auto-draft title is never captured.
	1048	+ if ($post->post_status === 'auto-draft'
	1049	+ && $title !== '' && $title === trim(__('Auto Draft', 'default'))) { // phpcs:ignore WordPress.WP.I18n.TextDomainMismatch -- resolves core's own 'Auto Draft' placeholder, which only exists in core's 'default' domain; the plugin text domain cannot reproduce it
	1050	+ self::remember_auto_draft_placeholder($title);
	1051	+ }
	1052	+
	1053	+ # Flag maintenance: recognition is context-independent thanks to the
	1054	+ # registry (an untranslated REST/CLI save still matches a captured
	1055	+ # variant), so the flag can never go stale in either direction.
	1056	+ if (self::is_auto_draft_title($title)) {
	1057	+ update_post_meta($post_id, self::UNTITLED_FLAG_META, $title);
	1058	+ } else {
	1059	+ delete_post_meta($post_id, self::UNTITLED_FLAG_META);
	1060	+ }
	1061	+ }
	1062	+
	1063	+ private function is_auto_draft_prefill_echo($post_id, $value) {
	1064	+ if (self::is_auto_draft_title($value)) {
	1065	+ return true;
	1066	+ }
	1067	+ if (!is_string($value) || trim($value) === '') {
	1068	+ return false;
	1069	+ }
	1070	+ $post = get_post($post_id);
	1071	+ if (!$post instanceof WP_Post || trim($value) !== trim((string) $post->post_title)) {
	1072	+ return false;
	1073	+ }
	1074	+ if (get_post_status($post_id) === 'auto-draft') {
	1075	+ return true;
	1076	+ }
	1077	+ # State arm: the submitted value echoes a title that was flagged as the
	1078	+ # placeholder at save time. Covers a value the string checks above
	1079	+ # missed — e.g. a localized placeholder stored under an admin user
	1080	+ # whose locale differs from the one that created the post.
	1081	+ $flagged = get_post_meta($post_id, self::UNTITLED_FLAG_META, true);
	1082	+ return is_string($flagged) && trim($flagged) !== '' && trim($flagged) === trim($value);
	1083	+ }
	1084	+
	1085	+ /**
276	1086	* Enqueue admin scripts and styles
277	1087	*/
278	1088	public function enqueue_admin_scripts($hook) {
279	1089	global $post_type;
		@@ -374,8 +1184,13 @@
374	1184	/**
375	1185	* Output Open Graph and Twitter Card tags in wp_head
376	1186	*/
377	1187	public function output_opengraph_tags() {
	1188	+ # Social Media & Open Graph switched off — emit nothing.
	1189	+ if (Metasync_Feature_Flags::is_disabled(Metasync_Feature_Flags::SOCIAL_OG)) {
	1190	+ return;
	1191	+ }
	1192	+
378	1193	if (!is_singular($this->get_supported_post_types())) {
379	1194	return;
380	1195	}
381	1196
		@@ -385,24 +1200,22 @@
385	1200	if (!$post instanceof WP_Post) {
386	1201	return;
387	1202	}
388	1203
389		- # Check if Open Graph is enabled for this post
390		- $og_enabled = get_post_meta($post->ID, '_metasync_og_enabled', true);
391		- if (empty($og_enabled) || $og_enabled !== '1') {
	1204	+ # Check if Open Graph is enabled for this post.
	1205	+ # Only an explicit '0' opt-out suppresses output; unset/empty counts as enabled
	1206	+ # so a MetaSync-only site gets one consolidated set whether or not the meta
	1207	+ # box was ever saved. Must stay in sync with will_emit().
	1208	+ if (self::is_social_output_disabled($post->ID)) {
392	1209	return;
393	1210	}
394	1211
395		- # When OTTO is active AND has OG data for this post, skip legacy OG output.
396		- # For cases where OTTO's pixel injects OG tags dynamically (without
397		- # persisting to _metasync_otto_og_* meta), the buffer-level dedup in
398		- # Otto_html_class::deduplicate_og_twitter_tags() handles cleanup.
399		- if (class_exists('Metasync_Otto_Config') && Metasync_Otto_Config::is_otto_enabled()) {
400		- $otto_og_title = get_post_meta($post->ID, '_metasync_otto_og_title', true);
401		- $otto_og_desc = get_post_meta($post->ID, '_metasync_otto_og_description', true);
402		- if (!empty($otto_og_title) || !empty($otto_og_desc)) {
403		- return;
404		- }
	1212	+ # When OTTO owns this page's OG (enabled + persisted OG data), skip legacy
	1213	+ # OG output. For cases where OTTO's pixel injects OG tags dynamically
	1214	+ # (without persisting to _metasync_otto_og_* meta), the buffer-level dedup
	1215	+ # in Otto_html_class::deduplicate_og_twitter_tags() handles cleanup.
	1216	+ if ($this->otto_owns_og($post->ID)) {
	1217	+ return;
405	1218	}
406	1219
407	1220	# Check for conflicts with other SEO plugins (allow override via filter)
408	1221	if (apply_filters('metasync_opengraph_check_conflicts', true) && $this->has_seo_plugin_conflicts()) {
		@@ -408,29 +1221,80 @@
408	1221	if (apply_filters('metasync_opengraph_check_conflicts', true) && $this->has_seo_plugin_conflicts()) {
409	1222	return;
410	1223	}
411	1224
412		- # Get Open Graph data — check persisted key first, fall back to OTTO staging key, then post default
413		- $og_title = get_post_meta($post->ID, '_metasync_og_title', true)
414		- ?: get_post_meta($post->ID, '_metasync_otto_og_title', true)
415		- ?: $post->post_title;
416		- $og_description = get_post_meta($post->ID, '_metasync_og_description', true)
417		- ?: get_post_meta($post->ID, '_metasync_otto_og_description', true)
	1225	+ # Open Graph data. The tier order — what the customer set, then OTTO, then
	1226	+ # a value brought in from another SEO plugin — comes from
	1227	+ # Metasync_Seo_Precedence so this emitter and the conflict handler cannot
	1228	+ # disagree about which value the page should carry. The resolver collapses a
	1229	+ # stored "Auto Draft" placeholder, a snapshot of the post title, and a
	1230	+ # snapshot of the resolved description to '' as it walks the chain, so a
	1231	+ # row polluted by the meta box pre-fill falls through to the live
	1232	+ # fallback (or OTTO's tier) rather than outranking it. The literal
	1233	+ # fallbacks below the chain (post title, excerpt, featured image) stay
	1234	+ # here: they are derived at render time, not stored.
	1235	+ $og_title = Metasync_Seo_Precedence::value($post->ID, Metasync_Seo_Precedence::FIELD_OG_TITLE)
	1236	+ ?: self::social_post_title($post);
	1237	+ $og_description = Metasync_Seo_Precedence::value($post->ID, Metasync_Seo_Precedence::FIELD_OG_DESCRIPTION)
418	1238	?: $this->get_post_excerpt($post);
419		- $og_image = get_post_meta($post->ID, '_metasync_og_image', true) ?: $this->get_featured_image_url($post->ID);
420		- $og_url = get_post_meta($post->ID, '_metasync_og_url', true) ?: $this->get_canonical_url($post);
	1239	+ $og_image = Metasync_Seo_Precedence::value($post->ID, Metasync_Seo_Precedence::FIELD_OG_IMAGE)
	1240	+ ?: $this->get_featured_image_url($post->ID);
	1241	+ $canonical_override = '';
	1242	+ if (class_exists('Metasync_Headless_Config') && Metasync_Headless_Config::is_active()) {
	1243	+ # The two manual keys of the canonical chain, in the same order the
	1244	+ # canonical tag resolves them. OTTO's volatile staging tier is
	1245	+ # deliberately left out: headless rehosts derived WordPress URLs,
	1246	+ # and an OTTO suggestion is not the author's answer about where
	1247	+ # content lives — a staged cross-domain canonical must not flow
	1248	+ # into headless og:url. The two can therefore disagree with the
	1249	+ # WordPress-render canonical tag only when OTTO is staging a
	1250	+ # canonical and no manual value exists; that is the documented
	1251	+ # scope split. meta_canonical is not a legacy alias: the REST sync
	1252	+ # and the classic-editor Canonical box both still write it, and
	1253	+ # the GraphQL surface reads both keys as well.
	1254	+ foreach (array('_metasync_canonical_url', 'meta_canonical') as $canonical_key) {
	1255	+ $canonical_override = Metasync_Canonical_Sanitizer::sanitize(
	1256	+ get_post_meta($post->ID, $canonical_key, true)
	1257	+ );
	1258	+ if ($canonical_override !== '') {
	1259	+ break;
	1260	+ }
	1261	+ }
	1262	+ }
	1263	+
	1264	+ # A validated canonical override is the author's final answer. It may
	1265	+ # deliberately name another host, so it bypasses headless rehosting.
	1266	+ if ($canonical_override !== '') {
	1267	+ $og_url = esc_url($canonical_override);
	1268	+ } else {
	1269	+ $og_url = get_post_meta($post->ID, '_metasync_og_url', true) ?: $this->get_canonical_url($post);
	1270	+
	1271	+ # On a headless site the rendered page is not the public page, so
	1272	+ # an own-host og:url must name the frontend. Applied at the single
	1273	+ # emission source so update_opengraph_url() continues to persist
	1274	+ # the WordPress URL used outside headless mode.
	1275	+ $og_url = $this->maybe_build_headless_url($og_url, $post->post_type);
	1276	+ }
421	1277	$og_type = get_post_meta($post->ID, '_metasync_og_type', true) ?: 'article';
422	1278
423	1279	# Get Twitter Card data — check persisted key first, fall back to OTTO staging key
424	1280	$twitter_card = get_post_meta($post->ID, '_metasync_twitter_card', true) ?: 'summary_large_image';
425	1281	$twitter_site = get_post_meta($post->ID, '_metasync_twitter_site', true);
426		- $twitter_title = get_post_meta($post->ID, '_metasync_twitter_title', true)
427		- ?: get_post_meta($post->ID, '_metasync_otto_twitter_title', true)
	1282	+
	1283	+ # Fall back to the site-wide Twitter username (Social Meta settings) so the
	1284	+ # twitter:site / twitter:creator tags the legacy emitter produced are not lost
	1285	+ # now that this emitter is the single canonical OG/Twitter source
	1286	+ $twitter_username = Metasync::get_option('social_meta')['twitter_username'] ?? '';
	1287	+ if (empty($twitter_site) && !empty($twitter_username)) {
	1288	+ $twitter_site = '@' . $twitter_username;
	1289	+ }
	1290	+ $twitter_creator = !empty($twitter_username) ? '@' . $twitter_username : '';
	1291	+ $twitter_title = Metasync_Seo_Precedence::value($post->ID, Metasync_Seo_Precedence::FIELD_TWITTER_TITLE)
428	1292	?: $og_title;
429		- $twitter_description = get_post_meta($post->ID, '_metasync_twitter_description', true)
430		- ?: get_post_meta($post->ID, '_metasync_otto_twitter_description', true)
	1293	+ $twitter_description = Metasync_Seo_Precedence::value($post->ID, Metasync_Seo_Precedence::FIELD_TWITTER_DESCRIPTION)
431	1294	?: $og_description;
432		- $twitter_image = get_post_meta($post->ID, '_metasync_twitter_image', true) ?: $og_image;
	1295	+ $twitter_image = Metasync_Seo_Precedence::value($post->ID, Metasync_Seo_Precedence::FIELD_TWITTER_IMAGE)
	1296	+ ?: $og_image;
433	1297	$twitter_image_alt = get_post_meta($post->ID, '_metasync_twitter_image_alt', true);
434	1298
435	1299	# Resolve OG image attachment ID once for reuse (twitter:image:alt fallback + og:image dimensions)
436	1300	$og_image_attachment_id = 0;
		@@ -469,8 +1333,9 @@
469	1333	$twitter_player_height = get_post_meta($post->ID, '_metasync_twitter_player_height', true);
470	1334
471	1335	# Output Open Graph tags
472	1336	echo "\n<!-- MetaSync Open Graph Tags -->\n";
	1337	+ echo '<meta property="og:locale" content="' . esc_attr(get_locale()) . '">' . "\n";
473	1338	if ($og_title) {
474	1339	echo '<meta property="og:title" content="' . esc_attr($og_title) . '">' . "\n";
475	1340	}
476	1341	if ($og_description) {
		@@ -499,8 +1364,15 @@
499	1364	}
500	1365	if ($og_type) {
501	1366	echo '<meta property="og:type" content="' . esc_attr($og_type) . '">' . "\n";
502	1367	}
	1368	+ $site_name = get_bloginfo('name');
	1369	+ if ($site_name) {
	1370	+ echo '<meta property="og:site_name" content="' . esc_attr($site_name) . '">' . "\n";
	1371	+ }
	1372	+ if (!empty($post->post_modified)) {
	1373	+ echo '<meta property="og:updated_time" content="' . esc_attr($post->post_modified) . '">' . "\n";
	1374	+ }
503	1375
504	1376	# Output Twitter Card tags
505	1377	echo "<!-- MetaSync Twitter Card Tags -->\n";
506	1378	if ($twitter_card) {
		@@ -508,8 +1380,11 @@
508	1380	}
509	1381	if ($twitter_site) {
510	1382	echo '<meta name="twitter:site" content="' . esc_attr($twitter_site) . '">' . "\n";
511	1383	}
	1384	+ if ($twitter_creator) {
	1385	+ echo '<meta name="twitter:creator" content="' . esc_attr($twitter_creator) . '">' . "\n";
	1386	+ }
512	1387	if ($twitter_title) {
513	1388	echo '<meta name="twitter:title" content="' . esc_attr($twitter_title) . '">' . "\n";
514	1389	}
515	1390	if ($twitter_description) {
		@@ -618,8 +1493,14 @@
618	1493	* complete article metadata while other SEO plugins handle og:title/description.
619	1494	* Cross-plugin dedup is handled via register_dedup_filters() instead.
620	1495	*/
621	1496	public function output_article_tags() {
	1497	+ # article:* tags are part of the same Open Graph block, so they follow
	1498	+ # the same switch as output_opengraph_tags().
	1499	+ if (Metasync_Feature_Flags::is_disabled(Metasync_Feature_Flags::SOCIAL_OG)) {
	1500	+ return;
	1501	+ }
	1502	+
622	1503	if (!is_singular()) {
623	1504	return;
624	1505	}
625	1506
		@@ -627,8 +1508,12 @@
627	1508	if (!$post instanceof WP_Post) {
628	1509	return;
629	1510	}
630	1511
	1512	+ if (self::is_social_output_disabled($post->ID)) {
	1513	+ return;
	1514	+ }
	1515	+
631	1516	$og_type = get_post_meta($post->ID, '_metasync_og_type', true) ?: 'article';
632	1517	if ($og_type !== 'article') {
633	1518	return;
634	1519	}
		@@ -734,16 +1619,27 @@
734	1619	$yoast_active = is_plugin_active('wordpress-seo/wp-seo.php')
735	1620	|| is_plugin_active('wordpress-seo-premium/wp-seo-premium.php');
736	1621	$rank_math_active = is_plugin_active('seo-by-rank-math/rank-math.php');
737	1622
738		- $article_timestamps_enabled = ($settings['article_timestamps'] ?? 'true') !== 'false';
739		- $article_author_enabled = ($settings['article_author'] ?? 'true') !== 'false';
740		- $article_section_enabled = ($settings['article_section'] ?? 'true') !== 'false';
741		- $article_tags_enabled = ($settings['article_tags'] ?? 'true') !== 'false';
	1623	+ # The article:* tags these filters suppress are emitted by
	1624	+ # output_article_tags(), which stands down when the Social Media & Open
	1625	+ # Graph feature is switched off. Treat every article feature as disabled
	1626	+ # in that case so the third party keeps rendering its own tags — pulling
	1627	+ # ours without releasing theirs would leave the page with none.
	1628	+ $social_enabled = Metasync_Feature_Flags::is_enabled(Metasync_Feature_Flags::SOCIAL_OG);
742	1629
	1630	+ $article_timestamps_enabled = $social_enabled && ($settings['article_timestamps'] ?? 'true') !== 'false';
	1631	+ $article_author_enabled = $social_enabled && ($settings['article_author'] ?? 'true') !== 'false';
	1632	+ $article_section_enabled = $social_enabled && ($settings['article_section'] ?? 'true') !== 'false';
	1633	+ $article_tags_enabled = $social_enabled && ($settings['article_tags'] ?? 'true') !== 'false';
	1634	+
743	1635	# Yoast: remove individual presenters based on which MetaSync features are enabled
744	1636	if ($yoast_active && ($article_timestamps_enabled || $article_author_enabled)) {
745	1637	add_filter('wpseo_frontend_presenters', function( $presenters ) use ( $article_timestamps_enabled, $article_author_enabled ) {
	1638	+ $post_id = function_exists('get_queried_object_id') ? (int) get_queried_object_id() : 0;
	1639	+ if (self::is_social_output_disabled($post_id)) {
	1640	+ return $presenters;
	1641	+ }
746	1642	foreach ( $presenters as $key => $presenter ) {
747	1643	if ( $article_timestamps_enabled && (
748	1644	$presenter instanceof \Yoast\WP\SEO\Presenters\Open_Graph\Article_Published_Time_Presenter ||
749	1645	$presenter instanceof \Yoast\WP\SEO\Presenters\Open_Graph\Article_Modified_Time_Presenter
		@@ -763,25 +1659,98 @@
763	1659	# Rank Math's tag() method passes content through rank_math/opengraph/facebook/{property}
764	1660	# where {property} is the OG property with colons replaced by underscores.
765	1661	# Returning false causes tag() to skip output (empty($content) check).
766	1662	if ($rank_math_active) {
	1663	+ $keep_third_party = function ($value) {
	1664	+ $post_id = function_exists('get_queried_object_id') ? (int) get_queried_object_id() : 0;
	1665	+ return self::is_social_output_disabled($post_id) ? $value : false;
	1666	+ };
767	1667	if ($article_timestamps_enabled) {
768		- add_filter('rank_math/opengraph/facebook/article_published_time', '__return_false', 999);
769		- add_filter('rank_math/opengraph/facebook/article_modified_time', '__return_false', 999);
	1668	+ add_filter('rank_math/opengraph/facebook/article_published_time', $keep_third_party, 999);
	1669	+ add_filter('rank_math/opengraph/facebook/article_modified_time', $keep_third_party, 999);
770	1670	}
771	1671	if ($article_tags_enabled) {
772		- add_filter('rank_math/opengraph/facebook/article_tag', '__return_false', 999);
	1672	+ add_filter('rank_math/opengraph/facebook/article_tag', $keep_third_party, 999);
773	1673	}
774	1674	if ($article_author_enabled) {
775		- add_filter('rank_math/opengraph/facebook/article_author', '__return_false', 999);
	1675	+ add_filter('rank_math/opengraph/facebook/article_author', $keep_third_party, 999);
776	1676	}
777	1677	if ($article_section_enabled) {
778		- add_filter('rank_math/opengraph/facebook/article_section', '__return_false', 999);
	1678	+ add_filter('rank_math/opengraph/facebook/article_section', $keep_third_party, 999);
779	1679	}
780	1680	}
781	1681	}
782	1682
783	1683	/**
	1684	+ * Hook the untitled-placeholder suppression into the title pipelines of
	1685	+ * the SEO plugins that can own the <title>/og:title/twitter:title output
	1686	+ * when MetaSync's own emitter stands down due to a conflict.
	1687	+ *
	1688	+ * Rank Math funnels <title>, og:title and twitter:title through one filter
	1689	+ * (rank_math/frontend/title wraps Paper::get_title()), so one hook covers
	1690	+ * all three. Yoast builds them from separate presenters, so it needs the
	1691	+ * title filter plus the og/twitter title filters.
	1692	+ *
	1693	+ * The hooks are registered unconditionally: each only fires while its
	1694	+ * plugin is actually generating a title, and the callback no-ops unless
	1695	+ * the current post carries the untitled flag.
	1696	+ *
	1697	+ * @return void
	1698	+ */
	1699	+ private function register_untitled_title_filters() {
	1700	+ add_filter('rank_math/frontend/title', [$this, 'strip_untitled_from_seo_title'], 99);
	1701	+ add_filter('wpseo_title', [$this, 'strip_untitled_from_seo_title'], 99);
	1702	+ add_filter('wpseo_opengraph_title', [$this, 'strip_untitled_from_seo_title'], 99);
	1703	+ add_filter('wpseo_twitter_title', [$this, 'strip_untitled_from_seo_title'], 99);
	1704	+ }
	1705	+
	1706	+ /**
	1707	+ * Remove the flagged placeholder from an SEO plugin's assembled title.
	1708	+ *
	1709	+ * The incoming value is the finished template output ("placeholder -
	1710	+ * Site name"), so the placeholder segment is cut out and any dangling
	1711	+ * separator tidied. An empty result (title was the placeholder alone)
	1712	+ * cannot be returned as-is: both plugins treat an empty value as "do
	1713	+ * nothing" and re-use their own generated title, so the site name is the
	1714	+ * replacement of last resort.
	1715	+ *
	1716	+ * @param mixed $title Assembled title from the SEO plugin.
	1717	+ * @return string
	1718	+ */
	1719	+ public function strip_untitled_from_seo_title($title) {
	1720	+ if (!is_string($title) || trim($title) === '') {
	1721	+ return $title;
	1722	+ }
	1723	+ $post = get_post();
	1724	+ if (!$post instanceof WP_Post) {
	1725	+ return $title;
	1726	+ }
	1727	+ $flagged = get_post_meta($post->ID, self::UNTITLED_FLAG_META, true);
	1728	+ if (!is_string($flagged) || trim($flagged) === '') {
	1729	+ return $title;
	1730	+ }
	1731	+ # Same state check as social_post_title(): only while the live title
	1732	+ # still *is* the flagged placeholder.
	1733	+ if (trim((string) $post->post_title) !== trim($flagged)) {
	1734	+ return $title;
	1735	+ }
	1736	+ if (strpos($title, $flagged) === false) {
	1737	+ return $title;
	1738	+ }
	1739	+ $remainder = trim(str_replace($flagged, '', $title));
	1740	+ # Tidy the separator(s) that flanked the removed segment.
	1741	+ $remainder = trim((string) preg_replace('/^[\s\-–—|·»•]+|[\s\-–—|·»•]+$/u', '', $remainder));
	1742	+ if ($remainder === '') {
	1743	+ $remainder = trim((string) get_bloginfo('name'));
	1744	+ }
	1745	+ if ($remainder === '') {
	1746	+ # A space, not '': an empty return is a no-op for these filters.
	1747	+ $remainder = ' ';
	1748	+ }
	1749	+ return $remainder;
	1750	+ }
	1751	+
	1752	+ /**
784	1753	* AJAX handler for generating social media preview
785	1754	*/
786	1755	public function ajax_generate_preview() {
787	1756
		@@ -807,9 +1776,8 @@
807	1776	$preview_html = $this->generate_preview_html($title, $description, $image, $url, $twitter_title, $twitter_description, $twitter_image);
808	1777
809	1778	if (empty($preview_html)) {
810	1779	wp_send_json_error(['message' => 'Failed to generate preview HTML']);
811		- return;
812	1780	}
813	1781
814	1782	wp_send_json_success(['preview' => $preview_html]);
815	1783
		@@ -824,9 +1792,9 @@
824	1792	private function generate_preview_html($title, $description, $image, $url, $twitter_title = '', $twitter_description = '', $twitter_image = '') {
825	1793	# Parse domain from URL
826	1794	$domain = '';
827	1795	if (!empty($url)) {
828		- $parsed = parse_url($url);
	1796	+ $parsed = wp_parse_url($url);
829	1797	$domain = $parsed['host'] ?? '';
830	1798	}
831	1799
832	1800	# Fallback to site URL if no domain found
		@@ -831,9 +1799,9 @@
831	1799
832	1800	# Fallback to site URL if no domain found
833	1801	if (empty($domain)) {
834	1802	$site_url = get_site_url();
835		- $parsed = parse_url($site_url);
	1803	+ $parsed = wp_parse_url($site_url);
836	1804	$domain = $parsed['host'] ?? 'your-site.com';
837	1805	}
838	1806
839	1807	# Provide fallbacks for empty values
		@@ -993,15 +1961,27 @@
993	1961
994	1962	# Generate excerpt from content
995	1963	$content = $post->post_content;
996	1964
997		- # Process shortcodes to get the actual rendered content (what users see on frontend)
998		- # This converts page builder shortcodes into their actual HTML output
999		- $content = do_shortcode($content);
	1965	+ # Do NOT run do_shortcode()/apply_filters('the_content') here.
	1966	+ # This method runs on wp_head (priority 5, before the body renders) to build
	1967	+ # og:description. On page-builder pages (Elementor, etc.) the_content fully
	1968	+ # renders the page — including widgets like Elementor Loop Grid — which makes
	1969	+ # the builder mark those widgets' per-request inline CSS as "already printed".
	1970	+ # When the real widget renders later in the body, the builder's dedup then
	1971	+ # OMITS its inline <style> (e.g. <style id="loop-NNNN"> carrying the loop
	1972	+ # card's flex/width vars), collapsing the layout (stacked cards, full-width
	1973	+ # images). We only need plain text for a meta description, so strip instead of
	1974	+ # render — matching how Metasync_Seo_Output builds its description safely.
	1975	+ $content = strip_shortcodes($content);
1000	1976
1001		- # Apply WordPress content filters (same filters used on the frontend)
1002		- # This ensures we get the exact same content as displayed on the page
1003		- $content = apply_filters('the_content', $content);
	1977	+ # Page builders (Divi, Elementor, WPBakery) store content as shortcodes.
	1978	+ # do_shortcode() only renders shortcodes whose handlers are registered, and when
	1979	+ # this runs server-side (REST/cron/CLI) or before the builder loads the [et_pb_*]
	1980	+ # tags are never expanded. strip_shortcodes() only removes *registered* shortcodes
	1981	+ # too, so any leftover shortcode-style tags are removed by pattern below — otherwise
	1982	+ # raw builder markup leaks into the og:description.
	1983	+ $content = $this->strip_shortcode_markup($content);
1004	1984
1005	1985	# Remove HTML tags to get clean text
1006	1986	$content = wp_strip_all_tags($content);
1007	1987
		@@ -1008,13 +1988,20 @@
1008	1988	# Remove extra whitespace, line breaks, and special characters
1009	1989	$content = preg_replace('/\s+/', ' ', $content);
1010	1990	$content = trim($content);
1011	1991
1012		- # If content is still empty or too short, fallback to post title
	1992	+ # If content is still empty or too short, fallback to post title. A brand-new
	1993	+ # post has no content and its title is the "Auto Draft" placeholder, which
	1994	+ # must not become the og:/twitter:description — strip it so the caller's
	1995	+ # fallback chain resolves to something real instead.
1013	1996	if (empty($content) || strlen($content) < 20) {
1014		- $content = $post->post_title;
	1997	+ $content = self::social_post_title($post);
1015	1998	}
1016	1999
	2000	+ if ($content === '') {
	2001	+ return '';
	2002	+ }
	2003	+
1017	2004	# Generate excerpt
1018	2005	$excerpt = wp_trim_words($content, 30, '...');
1019	2006
1020	2007	return $excerpt;
		@@ -1020,8 +2007,31 @@
1020	2007	return $excerpt;
1021	2008	}
1022	2009
1023	2010	/**
	2011	+ * Strip shortcode markup from a string.
	2012	+ *
	2013	+ * Removes registered shortcodes via strip_shortcodes(), then strips any
	2014	+ * leftover shortcode-style tags (e.g. unregistered page-builder tags such
	2015	+ * as [et_pb_section ...] / [/et_pb_section]) by pattern. The pattern is
	2016	+ * anchored to a leading letter so legitimate bracketed prose like
	2017	+ * "[2026 Guide]" is preserved.
	2018	+ *
	2019	+ * @param string $content
	2020	+ * @return string
	2021	+ */
	2022	+ private function strip_shortcode_markup($content) {
	2023	+ if (empty($content) || !is_string($content)) {
	2024	+ return (string) $content;
	2025	+ }
	2026	+
	2027	+ $content = strip_shortcodes($content);
	2028	+ $content = preg_replace('/\[\/?[a-zA-Z][^\]]*\]/', '', $content);
	2029	+
	2030	+ return $content;
	2031	+ }
	2032	+
	2033	+ /**
1024	2034	* Get featured image URL
1025	2035	*/
1026	2036	private function get_featured_image_url($post_id) {
1027	2037	$thumbnail_id = get_post_thumbnail_id($post_id);
		@@ -1173,8 +2183,62 @@
1173	2183	return $permalink;
1174	2184	}
1175	2185
1176	2186	/**
	2187	+ * Rehost a URL onto the public frontend when headless mode is active.
	2188	+ *
	2189	+ * Unlike the derived-URL callers elsewhere, the value handed here can be a
	2190	+ * stored one an editor typed, which may legitimately point at a third-party
	2191	+ * host. Only a URL on this site's own host is rewritten; anything else is
	2192	+ * returned untouched. A builder failure is returned as an empty string so
	2193	+ * the emitter cannot advertise the WordPress host on an active headless site.
	2194	+ *
	2195	+ * @param mixed $url URL to consider rehosting.
	2196	+ * @param string $post_type Post type, for the frontend path prefix.
	2197	+ * @return mixed Original URL when inactive or foreign; public URL or empty
	2198	+ * string for an own-host URL while active.
	2199	+ */
	2200	+ private function maybe_build_headless_url($url, $post_type = '') {
	2201	+ if (!class_exists('Metasync_Headless_Config') || !Metasync_Headless_Config::is_active() || !$this->is_own_host_url($url)) {
	2202	+ return $url;
	2203	+ }
	2204	+
	2205	+ return Metasync_Headless_Url_Builder::from_wp_url($url, $post_type);
	2206	+ }
	2207	+
	2208	+ /**
	2209	+ * Whether a URL addresses this WordPress site rather than a foreign host.
	2210	+ *
	2211	+ * Accepts only HTTP(S) URLs on the exact site host, protocol-relative URLs
	2212	+ * on that host, and genuine site-relative paths beginning with one slash.
	2213	+ *
	2214	+ * @param mixed $url URL to test.
	2215	+ * @return bool
	2216	+ */
	2217	+ private function is_own_host_url($url) {
	2218	+ if (!is_string($url) || $url === '' || preg_match('/\s/', $url)) {
	2219	+ return false;
	2220	+ }
	2221	+
	2222	+ if ($url[0] === '/' && (!isset($url[1]) || $url[1] !== '/')) {
	2223	+ return true;
	2224	+ }
	2225	+
	2226	+ $is_protocol_relative = strpos($url, '//') === 0;
	2227	+ $scheme = strtolower((string) wp_parse_url($url, PHP_URL_SCHEME));
	2228	+ if (!$is_protocol_relative && !in_array($scheme, array('http', 'https'), true)) {
	2229	+ return false;
	2230	+ }
	2231	+
	2232	+ $url_host = wp_parse_url($url, PHP_URL_HOST);
	2233	+ $site_host = wp_parse_url(home_url('/'), PHP_URL_HOST);
	2234	+
	2235	+ return !empty($url_host)
	2236	+ && !empty($site_host)
	2237	+ && strcasecmp((string) $url_host, (string) $site_host) === 0;
	2238	+ }
	2239	+
	2240	+ /**
1177	2241	* Update OpenGraph URL when post is saved
1178	2242	*/
1179	2243	public function update_opengraph_url($post_id) {
1180	2244	# Only update for supported post types
		@@ -1314,11 +2378,20 @@
1314	2378	/**
1315	2379	* Check if post slug changed via edit slug functionality
1316	2380	*/
1317	2381	public function check_slug_change() {
	2382	+ # Fires on the same admin-ajax request as core's sample-permalink
	2383	+ # handler, but at priority 5 — before core validates the nonce and
	2384	+ # capability at its own priority-10 callback. Verify them ourselves
	2385	+ # before any post-meta write. Return (not die) so core still serves
	2386	+ # the preview request normally.
	2387	+ if (!check_ajax_referer('samplepermalink', 'samplepermalinknonce', false)) {
	2388	+ return;
	2389	+ }
	2390	+
1318	2391	# Get the post ID from the request
1319	2392	$post_id = isset($_POST['post_id']) ? intval($_POST['post_id']) : 0;
1320		- if (!$post_id) {
	2393	+ if (!$post_id || !current_user_can('edit_post', $post_id)) {
1321	2394	return;
1322	2395	}
1323	2396
1324	2397	# Only check for supported post types
		@@ -1351,9 +2424,9 @@
1351	2424	# This means the og:url was set to the post permalink (not a custom URL)
1352	2425	if ($current_og_url !== $current_permalink && strpos($current_og_url, '?p=') === false) {
1353	2426	# Check if the og:url was the old permalink by comparing with a generated old permalink
1354	2427	$old_post = clone $post;
1355		- $old_slug = isset($_POST['new_slug']) ? sanitize_title($_POST['new_slug']) : $post->post_name;
	2428	+ $old_slug = isset($_POST['new_slug']) ? sanitize_title(wp_unslash($_POST['new_slug'])) : $post->post_name;
1356	2429
1357	2430	# If the og:url doesn't match the current permalink, it might be the old one
1358	2431	# We'll update it to the new permalink
1359	2432	if ($current_og_url !== $current_permalink) {