PluginProbe
ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO / 2.11.0
ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO v2.11.0
2.11.0 2.10.0 2.9.0 2.8.0 2.7.0 2.6.0 2.5.0 2.4.0 2.3.0 2.2.0 2.1.1 2.1.0 2.0.2 2.0.1 2.0.0 1.32.0 1.31.0 1.30.0 1.29.0 1.28.0 1.27.0 1.26.0 1.25.0 trunk 1.0.0 All 52 releases
← All changes | includes/seo/class-sitemap-generator.php +1135 -71 2.7.0 → 2.11.0 View file →
@@ -144,8 +144,98 @@
144 144 */
145 145 public const REGENERATION_ERROR_OPTION = 'thinkrank_sitemap_regeneration_error';
146 146
147 147 /**
148 + * Delivery modes accepted by the `delivery_mode` setting.
149 + *
150 + * Mirrors LLMs_Txt_Manager::DELIVERY_MODES, which solved the same problem
151 + * for llms.txt. `auto` is the only value a site should normally need.
152 + *
153 + * @since 2.9.0
154 + * @var string[]
155 + */
156 + public const DELIVERY_MODES = ['auto', 'static', 'dynamic'];
157 +
158 + /**
159 + * Cache group for documents rendered on the dynamic path.
160 + *
161 + * @since 2.9.0
162 + * @var string
163 + */
164 + private const DYNAMIC_CACHE_PREFIX = 'thinkrank_sitemap_doc_';
165 +
166 + /**
167 + * How long a dynamically rendered document is cached.
168 + *
169 + * Invalidated by content and settings changes through
170 + * {@see self::flush_dynamic_cache()}, so this is only the backstop for a
171 + * change nothing hooked.
172 + *
173 + * @since 2.9.0
174 + * @var int
175 + */
176 + private const DYNAMIC_CACHE_TTL = 12 * HOUR_IN_SECONDS;
177 +
178 + /**
179 + * How long the render lock is held before it is assumed abandoned.
180 + *
181 + * Long enough for a large site's full build, short enough that a request
182 + * killed mid-build does not lock the endpoint out for meaningfully long.
183 + *
184 + * @since 2.9.0
185 + * @var int
186 + */
187 + private const RENDER_LOCK_TTL = 60;
188 +
189 + /**
190 + * Cached stand-in for "this site does not publish that name".
191 + *
192 + * published_document_names() lists what the configuration *could* produce,
193 + * but a child whose type is excluded produces nothing. Without a negative
194 + * entry those names miss the cache forever, so every request for one
195 + * rebuilt the entire sitemap — the same cost the positive cache exists to
196 + * avoid, on a public endpoint (#754 review).
197 + *
198 + * @since 2.9.0
199 + * @var string
200 + */
201 + private const ABSENT_MARKER = "\0thinkrank-absent";
202 +
203 + /**
204 + * How many times, and how long, a losing request waits for the winner.
205 + *
206 + * Bounded at roughly a second in total: past that, building a second copy
207 + * costs less than making a crawler wait.
208 + *
209 + * @since 2.9.0
210 + * @var int
211 + */
212 + private const RENDER_LOCK_WAIT_ATTEMPTS = 4;
213 +
214 + /**
215 + * @since 2.9.0
216 + * @var int
217 + */
218 + private const RENDER_LOCK_WAIT_MICROSECONDS = 250000;
219 +
220 + /**
221 + * Where generated documents go instead of disk, when set.
222 + *
223 + * Every sitemap document this class produces — segments, the index, the
224 + * single flat file and local-sitemap.xml — is published through the one
225 + * writer, {@see self::save_sitemap_to_file()}. Swapping that writer for a
226 + * collector is therefore all it takes to render the same bytes without a
227 + * filesystem, which is what dynamic delivery needs (#752). Doing it here
228 + * rather than duplicating the build pipeline is deliberate: a second
229 + * pipeline would drift from this one, and the index in particular is
230 + * assembled from whatever the children actually produced.
231 + *
232 + * @since 2.9.0
233 + * @var callable|null
234 + */
235 + private $document_sink = null;
236 +
237 + /**
148 238 * Transient guarding against two generations running at once. Shared with
149 239 * Sitemap_Endpoint's manual generate route so an automatic rebuild and a
150 240 * manual one cannot write the same files concurrently.
151 241 *
@@ -161,8 +251,33 @@
161 251 * @var int
162 252 */
163 253 private const TERM_WALK_CHUNK = 1000;
164 254
255 + /**
256 + * Exception code for an automatic rebuild stopped short of the memory limit.
257 + *
258 + * @since 2.10.1
259 + * @var int
260 + */
261 + private const MEMORY_ABORT_CODE = 4290;
262 +
263 + /**
264 + * Whether the chunked walks should stop before the memory limit. Only on
265 + * for automatic rebuilds, whose failure is recorded and retried.
266 + *
267 + * @since 2.10.1
268 + * @var bool
269 + */
270 + private bool $memory_guard = false;
271 +
272 + /**
273 + * Largest memory cost of one walked chunk in this rebuild, in bytes.
274 + *
275 + * @since 2.10.1
276 + * @var int
277 + */
278 + private int $walk_chunk_cost = 0;
279 +
165 280 private array $sitemap_types = [
166 281 'posts' => [
167 282 'name' => 'Posts',
168 283 'post_types' => ['post'],
@@ -189,25 +304,29 @@
189 304 ]
190 305 ];
191 306
192 307 /**
308 + * The generator the content-change listeners share, built on the first
309 + * change of a request.
310 + *
311 + * @since 2.10.1
312 + * @var self|null
313 + */
314 + private static ?self $listener = null;
315 +
316 + /**
193 317 * Constructor
194 318 *
195 319 * @since 1.0.0
320 + * @since 2.10.1 Registers no hooks, whatever `$register_hooks` says. The
321 + * content-change listeners are registered once, at bootstrap,
322 + * by register_content_listeners().
196 323 *
197 - * @param bool $register_hooks Optional. Whether to register the auto-generation
198 - * hooks. Pass false for a read-only instance built
199 - * solely to query settings — the hooks are bound to
200 - * `$this`, so a second hook-registering instance
201 - * would run `handle_content_change()` twice per save.
324 + * @param bool $register_hooks Unused since 2.10.1; kept so existing callers,
325 + * Pro's included, keep working.
202 326 */
203 327 public function __construct(bool $register_hooks = true) {
204 328 parent::__construct('sitemap');
205 -
206 - // Initialize auto-generation hooks
207 - if ($register_hooks) {
208 - $this->init_auto_generation_hooks();
209 - }
210 329 }
211 330
212 331 /**
213 332 * Filter the args of a sitemap post query.
@@ -251,31 +370,57 @@
251 370 return (array) apply_filters('thinkrank_sitemap_term_query_args', $args);
252 371 }
253 372
254 373 /**
255 - * Initialize WordPress hooks for auto-generation
374 + * Register the content-change listeners that queue an automatic rebuild.
256 375 *
257 - * @since 1.0.0
376 + * Called once per request, at plugin bootstrap, next to the WP-Cron
377 + * listeners that run the rebuild these queue (both in
378 + * Plugin::register_sitemap_cron_listeners(), on plugins_loaded). The
379 + * constructor used to register them, so they existed only in a request
380 + * that happened to build a generator: the REST endpoint, the setup wizard,
381 + * an MCP ability. Block-editor saves go through REST and were heard. A
382 + * scheduled post published by WP-Cron, Quick Edit, the classic editor and
383 + * WP-CLI were not, so the post stayed out of the sitemap with nothing
384 + * pending to recover it (#824). Each instance also added its own set, so
385 + * one REST save ran the handlers once per generator built.
386 + *
387 + * The generator is built on the first change and shared for the rest of
388 + * the request, so a bulk edit does not construct one per post.
389 + *
390 + * @since 2.10.1
258 391 * @return void
259 392 */
260 - private function init_auto_generation_hooks(): void {
261 - // Content change hooks - use priority 20 to run after other plugins
262 - add_action('save_post', [$this, 'handle_content_change'], 20, 2);
263 - add_action('delete_post', [$this, 'handle_content_deletion'], 20);
264 - add_action('wp_trash_post', [$this, 'handle_content_deletion'], 20);
265 - add_action('untrash_post', [$this, 'handle_content_change_by_id'], 20);
393 + public static function register_content_listeners(): void {
394 + // Priority 20, to run after other plugins.
395 + add_action('save_post', static function (int $post_id, \WP_Post $post): void {
396 + self::listener()->handle_content_change($post_id, $post);
397 + }, 20, 2);
398 + add_action('delete_post', static function (int $post_id): void {
399 + self::listener()->handle_content_deletion($post_id);
400 + }, 20);
401 + add_action('wp_trash_post', static function (int $post_id): void {
402 + self::listener()->handle_content_deletion($post_id);
403 + }, 20);
404 + add_action('untrash_post', static function (int $post_id): void {
405 + self::listener()->handle_content_change_by_id($post_id);
406 + }, 20);
266 407
267 - // Taxonomy change hooks
268 - add_action('created_term', [$this, 'handle_taxonomy_change'], 20, 3);
269 - add_action('edited_term', [$this, 'handle_taxonomy_change'], 20, 3);
270 - add_action('delete_term', [$this, 'handle_taxonomy_change'], 20, 3);
408 + foreach (['created_term', 'edited_term', 'delete_term'] as $hook) {
409 + add_action($hook, static function (int $term_id, int $tt_id, string $taxonomy): void {
410 + self::listener()->handle_taxonomy_change($term_id, $tt_id, $taxonomy);
411 + }, 20, 3);
412 + }
413 + }
271 414
272 - // NOTE: the WP-Cron regeneration listeners (thinkrank_regenerate_sitemap
273 - // and thinkrank_regenerate_sitemap_settings) are registered at plugin
274 - // bootstrap (Plugin::register_sitemap_cron_listeners(), on plugins_loaded)
275 - // rather than here. A cron run never builds this class via the REST
276 - // endpoint (no rest_api_init), so registering them in the constructor
277 - // would leave the scheduled events with no listener at cron time.
415 + /**
416 + * The generator the content-change listeners share.
417 + *
418 + * @since 2.10.1
419 + * @return self
420 + */
421 + private static function listener(): self {
422 + return self::$listener ??= new self(false);
278 423 }
279 424
280 425 /**
281 426 * Generate XML sitemap
@@ -452,8 +597,15 @@
452 597 ]
453 598 ],
454 599 'use_sitemap_index' => false,
455 600
601 + // How the sitemap reaches crawlers. 'auto' keeps the historical
602 + // behaviour wherever the web root is writable, and only falls back
603 + // to serving the sitemap from PHP where writing a file is
604 + // impossible — previously a hard failure with nothing served
605 + // (#752).
606 + 'delivery_mode' => 'auto',
607 +
456 608 // General Settings
457 609 'links_per_sitemap' => 1000,
458 610 'include_images' => true,
459 611 'include_featured_images' => false,
@@ -519,8 +671,16 @@
519 671 if (array_key_exists('styling_logo_url', $sanitized)) {
520 672 $sanitized['styling_logo_url'] = esc_url_raw((string) $sanitized['styling_logo_url']);
521 673 }
522 674
675 + // A mode this build cannot act on has to be stored as the fallback
676 + // rather than kept verbatim, or get-sitemap-settings reports a delivery
677 + // mode the site does not actually apply.
678 + if (array_key_exists('delivery_mode', $sanitized)) {
679 + $mode = sanitize_key((string) $sanitized['delivery_mode']);
680 + $sanitized['delivery_mode'] = in_array($mode, self::DELIVERY_MODES, true) ? $mode : 'auto';
681 + }
682 +
523 683 return $sanitized;
524 684 }
525 685
526 686 /**
@@ -538,8 +698,15 @@
538 698 'title' => 'Enable Sitemap',
539 699 'description' => 'Generate XML sitemap for search engines',
540 700 'default' => true
541 701 ],
702 + 'delivery_mode' => [
703 + 'type' => 'string',
704 + 'title' => 'Sitemap Delivery',
705 + 'description' => 'How the sitemap is served: auto picks static when the WordPress root is writable and dynamic when it is not, static writes files to the web root, dynamic serves the sitemap from WordPress with no files written',
706 + 'enum' => self::DELIVERY_MODES,
707 + 'default' => 'auto'
708 + ],
542 709 'include_posts' => [
543 710 'type' => 'boolean',
544 711 'title' => 'Include Posts',
545 712 'description' => 'Include blog posts in sitemap',
@@ -762,8 +929,11 @@
762 929 // well-bounded routine with no ceiling (#402).
763 930 $total = count($all_ids);
764 931
765 932 for ($offset = 0; $offset < $total; $offset += self::ID_WALK_CHUNK) {
933 + $this->assert_memory_headroom();
934 + $chunk_start = memory_get_usage(true);
935 +
766 936 $chunk = array_slice($all_ids, $offset, self::ID_WALK_CHUNK);
767 937
768 938 $posts = get_posts($this->filter_query_args([
769 939 'post_type' => $post_types,
@@ -772,8 +942,12 @@
772 942 'post__in' => $chunk,
773 943 'orderby' => 'post__in', // preserve the resolved order
774 944 ]));
775 945
946 + // get_featured_image() hydrates each featured image under the
947 + // attachment's own ID, which the chunk's post IDs do not reach.
948 + $attachment_ids = [];
949 +
776 950 foreach ($posts as $post) {
777 951 if ($this->should_include_in_sitemap($post, $settings)) {
778 952 /**
779 953 * Filter a sitemap entry's permalink.
@@ -794,14 +968,25 @@
794 968 $priority = $this->calculate_intelligent_priority($post, $post->post_type);
795 969 $changefreq = $this->calculate_change_frequency($post, $post->post_type);
796 970 $images = $this->extract_post_images($post, $settings);
797 971
972 + $thumbnail_id = (int) get_post_thumbnail_id($post);
973 + if ($thumbnail_id > 0) {
974 + $attachment_ids[] = $thumbnail_id;
975 + }
976 +
798 977 yield $this->generate_url_entry($url, $lastmod, $priority, $changefreq, $images);
799 978 }
800 979 }
801 980
802 - // Free the hydrated chunk before loading the next one.
981 + // Free the hydrated chunk before loading the next one — including
982 + // the copies get_posts() left in the runtime object cache.
803 983 unset($posts);
984 + $this->release_walk_memory(
985 + $chunk_start,
986 + $this->chunk_post_cache_groups($post_types),
987 + array_merge($chunk, $attachment_ids)
988 + );
804 989 }
805 990 }
806 991
807 992 /**
@@ -861,8 +1046,11 @@
861 1046 // Same moving window as the post walk above, for the same reason.
862 1047 $total = count($all_ids);
863 1048
864 1049 for ($offset = 0; $offset < $total; $offset += self::TERM_WALK_CHUNK) {
1050 + $this->assert_memory_headroom();
1051 + $chunk_start = memory_get_usage(true);
1052 +
865 1053 $chunk = array_slice($all_ids, $offset, self::TERM_WALK_CHUNK);
866 1054
867 1055 $terms = get_terms($this->filter_term_query_args([
868 1056 'taxonomy' => $taxonomy,
@@ -891,8 +1079,9 @@
891 1079 }
892 1080 }
893 1081
894 1082 unset($terms);
1083 + $this->release_walk_memory($chunk_start, ['terms', 'term_meta'], $chunk);
895 1084 }
896 1085 }
897 1086
898 1087 /**
@@ -1729,8 +1918,14 @@
1729 1918 * @param string $source Either 'content' or 'settings'.
1730 1919 * @return void
1731 1920 */
1732 1921 private function mark_regeneration_pending(string $source): void {
1922 + // Whatever made the static files stale made the rendered ones stale
1923 + // too. Invalidating here rather than only on the rebuild keeps the two
1924 + // delivery modes reacting to exactly the same triggers, which is the
1925 + // only way a dynamic site stays as fresh as a static one (#752).
1926 + $this->flush_dynamic_cache();
1927 +
1733 1928 $pending = get_option(self::REGENERATION_PENDING_OPTION, []);
1734 1929 $pending = is_array($pending) ? $pending : [];
1735 1930
1736 1931 $since = !empty($pending['since']) ? (int) $pending['since'] : time();
@@ -1736,11 +1931,13 @@
1736 1931 $since = !empty($pending['since']) ? (int) $pending['since'] : time();
1737 1932 $current = isset($pending['source']) ? (string) $pending['source'] : '';
1738 1933 $source = ($current === 'settings' || $source === 'settings') ? 'settings' : 'content';
1739 1934
1935 + // Merged so the bookkeeping a rebuild keeps on the marker (`started`,
1936 + // `memory_limit`) survives an edit made while it is outstanding.
1740 1937 update_option(
1741 1938 self::REGENERATION_PENDING_OPTION,
1742 - [
1939 + array_merge($pending, [
1743 1940 'since' => $since,
1744 1941 'source' => $source,
1745 1942 'attempts' => !empty($pending['attempts']) ? (int) $pending['attempts'] : 0,
1746 1943 'next_attempt' => !empty($pending['next_attempt'])
@@ -1748,9 +1945,9 @@
1748 1945 : time() + self::REGENERATION_TAKEOVER_GRACE,
1749 1946 // Bumped on every change so a rebuild can tell whether the edit
1750 1947 // it started for is still the newest one outstanding.
1751 1948 'revision' => (!empty($pending['revision']) ? (int) $pending['revision'] : 0) + 1,
1752 - ],
1949 + ]),
1753 1950 true
1754 1951 );
1755 1952 }
1756 1953
@@ -1796,8 +1993,18 @@
1796 1993 $revision !== null
1797 1994 && is_array($pending)
1798 1995 && (int) ($pending['revision'] ?? 0) !== $revision
1799 1996 ) {
1997 + // This attempt succeeded, so drop what it claimed: the newer change
1998 + // waits the grace a fresh edit gets, not a failure backoff it never
1999 + // earned. Not zero: that edit queued its own debounced event, and
2000 + // a marker due at once had the next admin request rebuild in its
2001 + // shutdown and the event rebuild again seconds later.
2002 + unset($pending['started'], $pending['memory_limit']);
2003 + $pending['attempts'] = 0;
2004 + $pending['next_attempt'] = time() + self::REGENERATION_TAKEOVER_GRACE;
2005 +
2006 + update_option(self::REGENERATION_PENDING_OPTION, $pending, true);
1800 2007 return;
1801 2008 }
1802 2009
1803 2010 delete_option(self::REGENERATION_PENDING_OPTION);
@@ -1803,8 +2010,69 @@
1803 2010 delete_option(self::REGENERATION_PENDING_OPTION);
1804 2011 }
1805 2012
1806 2013 /**
2014 + * Record the attempt that is about to run before it runs.
2015 + *
2016 + * A PHP fatal — the memory limit or max_execution_time — is not a
2017 + * Throwable, so no catch or finally around the generation runs when the
2018 + * process dies, and a failure recorded afterwards was never recorded at
2019 + * all: `attempts` stayed 0, the backoff never applied, and the next request
2020 + * started the same doomed rebuild again (a fatal every few minutes for as
2021 + * long as an admin was logged in). Claiming the attempt up front makes the
2022 + * backoff hold even when nothing after this line gets to run, and leaves a
2023 + * `started` stamp the next attempt can recognise as an interrupted one.
2024 + *
2025 + * @since 2.10.1
2026 + * @return void
2027 + */
2028 + private function claim_regeneration_attempt(): void {
2029 + $pending = get_option(self::REGENERATION_PENDING_OPTION, null);
2030 +
2031 + // Nothing outstanding (e.g. a manual generation already satisfied it):
2032 + // there is no marker to retry from, so nothing to claim.
2033 + if (!is_array($pending) || empty($pending['since'])) {
2034 + return;
2035 + }
2036 +
2037 + if (!empty($pending['started'])) {
2038 + // The previous attempt claimed itself and never reported back.
2039 + update_option(
2040 + self::REGENERATION_ERROR_OPTION,
2041 + [
2042 + 'message' => __('The previous automatic sitemap rebuild stopped before it finished, most likely because PHP ran out of memory or time. It is retried with a growing delay. If this keeps happening, raise the PHP memory_limit or max_execution_time, or run WP-Cron from a system cron.', 'thinkrank'),
2043 + 'source' => isset($pending['source']) ? (string) $pending['source'] : 'content',
2044 + 'attempts' => !empty($pending['attempts']) ? (int) $pending['attempts'] : 1,
2045 + 'time' => (int) $pending['started'],
2046 + ],
2047 + false
2048 + );
2049 + }
2050 +
2051 + $attempts = (!empty($pending['attempts']) ? (int) $pending['attempts'] : 0) + 1;
2052 +
2053 + $pending['attempts'] = $attempts;
2054 + $pending['next_attempt'] = time() + $this->regeneration_backoff($attempts);
2055 + $pending['started'] = time();
2056 +
2057 + update_option(self::REGENERATION_PENDING_OPTION, $pending, true);
2058 + }
2059 +
2060 + /**
2061 + * Delay before the next takeover after the given number of attempts.
2062 + *
2063 + * @since 2.10.1
2064 + * @param int $attempts Attempts made so far (1 or more).
2065 + * @return int Seconds.
2066 + */
2067 + private function regeneration_backoff(int $attempts): int {
2068 + return (int) min(
2069 + self::REGENERATION_TAKEOVER_GRACE * (2 ** min(max($attempts, 1), 10)),
2070 + self::REGENERATION_MAX_BACKOFF
2071 + );
2072 + }
2073 +
2074 + /**
1807 2075 * Record a failed regeneration instead of discarding it.
1808 2076 *
1809 2077 * Keeps the pending marker in place so the rebuild is retried, but backs the
1810 2078 * next attempt off exponentially (capped) so a persistently failing
@@ -1810,22 +2078,30 @@
1810 2078 * next attempt off exponentially (capped) so a persistently failing
1811 2079 * generation cannot run on every admin request.
1812 2080 *
1813 2081 * @since 2.2.1
1814 - * @param string $message Failure detail.
1815 - * @param string $source Either 'content' or 'settings'.
2082 + * @since 2.10.1 Accepts the memory limit a rebuild had to stop short of, and
2083 + * does not count an attempt claim_regeneration_attempt()
2084 + * already counted.
2085 + * @param string $message Failure detail.
2086 + * @param string $source Either 'content' or 'settings'.
2087 + * @param int|null $memory_limit Memory limit (bytes) the rebuild stopped
2088 + * short of, when that was the failure.
1816 2089 * @return void
1817 2090 */
1818 - private function record_regeneration_failure(string $message, string $source): void {
2091 + private function record_regeneration_failure(string $message, string $source, ?int $memory_limit = null): void {
1819 2092 $pending = get_option(self::REGENERATION_PENDING_OPTION, []);
1820 2093 $pending = is_array($pending) ? $pending : [];
1821 - $attempts = (!empty($pending['attempts']) ? (int) $pending['attempts'] : 0) + 1;
2094 + $attempts = !empty($pending['attempts']) ? (int) $pending['attempts'] : 0;
1822 2095
1823 - $backoff = min(
1824 - self::REGENERATION_TAKEOVER_GRACE * (2 ** min($attempts, 10)),
1825 - self::REGENERATION_MAX_BACKOFF
1826 - );
2096 + // An attempt that claimed itself up front has already been counted.
2097 + if (empty($pending['started'])) {
2098 + $attempts++;
2099 + }
2100 + $attempts = max($attempts, 1);
1827 2101
2102 + $backoff = $this->regeneration_backoff($attempts);
2103 +
1828 2104 // Same precedence mark_regeneration_pending() enforces: a settings
1829 2105 // rebuild outranks a content one and must not be downgraded by a failed
1830 2106 // attempt. Overwriting it routed the retry back through the content
1831 2107 // path, where should_auto_generate() can be false and the completion
@@ -1834,20 +2110,24 @@
1834 2110 // whichever attempt actually failed.
1835 2111 $current = isset($pending['source']) ? (string) $pending['source'] : '';
1836 2112 $pending_source = ($current === 'settings' || $source === 'settings') ? 'settings' : 'content';
1837 2113
1838 - update_option(
1839 - self::REGENERATION_PENDING_OPTION,
1840 - [
1841 - 'since' => !empty($pending['since']) ? (int) $pending['since'] : time(),
1842 - 'source' => $pending_source,
1843 - 'attempts' => $attempts,
1844 - 'next_attempt' => time() + $backoff,
1845 - 'revision' => !empty($pending['revision']) ? (int) $pending['revision'] : 0,
1846 - ],
1847 - true
1848 - );
2114 + $marker = [
2115 + 'since' => !empty($pending['since']) ? (int) $pending['since'] : time(),
2116 + 'source' => $pending_source,
2117 + 'attempts' => $attempts,
2118 + 'next_attempt' => time() + $backoff,
2119 + 'revision' => !empty($pending['revision']) ? (int) $pending['revision'] : 0,
2120 + ];
1849 2121
2122 + // Remembered so has_memory_for_retry() can keep requests with no more
2123 + // memory than this from repeating the same attempt.
2124 + if ($memory_limit !== null && $memory_limit > 0) {
2125 + $marker['memory_limit'] = $memory_limit;
2126 + }
2127 +
2128 + update_option(self::REGENERATION_PENDING_OPTION, $marker, true);
2129 +
1850 2130 update_option(
1851 2131 self::REGENERATION_ERROR_OPTION,
1852 2132 [
1853 2133 'message' => $message,
@@ -1902,16 +2182,34 @@
1902 2182 if (!self::has_overdue_regeneration()) {
1903 2183 return;
1904 2184 }
1905 2185
1906 - // Cron is running: it is about to do exactly this work.
2186 + $pending = get_option(self::REGENERATION_PENDING_OPTION, []);
2187 + $pending = is_array($pending) ? $pending : [];
2188 + $source = isset($pending['source']) ? (string) $pending['source'] : 'content';
2189 +
2190 + // Cron is running and its own event for this rebuild is still queued
2191 + // and due: it is about to do exactly this work. Only then — an event
2192 + // that has already been consumed (e.g. it fired while another process
2193 + // held the generation lock) is never re-queued, and returning here
2194 + // unconditionally left the rebuild to requests that could not finish it.
1907 2195 if (wp_doing_cron()) {
2196 + $hook = $source === 'settings' ? 'thinkrank_regenerate_sitemap_settings' : 'thinkrank_regenerate_sitemap';
2197 + $next = wp_next_scheduled($hook);
2198 +
2199 + if ($next !== false && $next <= time()) {
2200 + return;
2201 + }
2202 + }
2203 +
2204 + // The last attempt had to stop short of this process's memory limit.
2205 + // Retrying at the same (or a lower) limit only repeats that, so leave
2206 + // the rebuild to a process with more room — WP-CLI, a system cron, or a
2207 + // host with a higher limit — instead of burning it on every request.
2208 + if (!$this->has_memory_for_retry($pending)) {
1908 2209 return;
1909 2210 }
1910 2211
1911 - $pending = get_option(self::REGENERATION_PENDING_OPTION, []);
1912 - $source = (is_array($pending) && isset($pending['source'])) ? (string) $pending['source'] : 'content';
1913 -
1914 2212 if ($source === 'settings') {
1915 2213 $this->regenerate_sitemap_from_settings();
1916 2214 return;
1917 2215 }
@@ -1945,8 +2243,227 @@
1945 2243 delete_transient(self::GENERATION_LOCK_TRANSIENT);
1946 2244 }
1947 2245
1948 2246 /**
2247 + * This process's PHP memory limit in bytes.
2248 + *
2249 + * @since 2.10.1
2250 + * @return int Bytes, or -1 when unlimited (or unreadable).
2251 + */
2252 + private function current_memory_limit(): int {
2253 + $limit = (string) ini_get('memory_limit');
2254 +
2255 + if ($limit === '' || $limit === '-1') {
2256 + return -1;
2257 + }
2258 +
2259 + $bytes = (int) wp_convert_hr_to_bytes($limit);
2260 +
2261 + return $bytes > 0 ? $bytes : -1;
2262 + }
2263 +
2264 + /**
2265 + * May this process retry a rebuild that last stopped at the memory limit?
2266 + *
2267 + * Raises the limit the way wp-admin does first, so a request that can get
2268 + * more room than the failed attempt had is still allowed to try.
2269 + *
2270 + * @since 2.10.1
2271 + * @param array $pending The pending marker.
2272 + * @return bool True when there is no recorded memory failure, or this
2273 + * process has more memory than the attempt that failed.
2274 + */
2275 + private function has_memory_for_retry(array $pending): bool {
2276 + if (empty($pending['memory_limit'])) {
2277 + return true;
2278 + }
2279 +
2280 + wp_raise_memory_limit('admin');
2281 +
2282 + $limit = $this->current_memory_limit();
2283 +
2284 + return $limit === -1 || $limit > (int) $pending['memory_limit'];
2285 + }
2286 +
2287 + /**
2288 + * Release what one walked chunk left behind.
2289 + *
2290 + * Hydrating a chunk through get_posts()/get_terms() also stores every
2291 + * object and its meta in the in-process object cache, which nothing
2292 + * empties until the request ends. Unsetting the chunk therefore freed
2293 + * nothing, and the walk grew with the size of the site instead of the size
2294 + * of a chunk — about 1.3 GB on a 45k-post site.
2295 + *
2296 + * A persistent object cache that supports it drops only its in-process
2297 + * copy (`flush_runtime`); the shared store keeps its data. WordPress's
2298 + * default cache has no shared store, and flushing it would empty every
2299 + * group for the rest of the request (options, the queried object, other
2300 + * plugins' data), so there only the chunk's own entries are deleted. A
2301 + * persistent cache without `flush_runtime` is left alone: deleting from it
2302 + * would evict the objects for every other request too.
2303 + *
2304 + * @since 2.10.1
2305 + * @param int $chunk_start memory_get_usage(true) before the chunk was hydrated.
2306 + * @param array $groups Cache groups keyed by the chunk's object IDs.
2307 + * @param int[] $ids The chunk's object IDs, plus any objects it
2308 + * hydrated under their own (featured images).
2309 + * @return void
2310 + * @throws \Error See assert_memory_headroom().
2311 + */
2312 + private function release_walk_memory(int $chunk_start, array $groups, array $ids): void {
2313 + // What one chunk costs before it is released: the margin the next one
2314 + // needs. Measured in the same real allocated size assert_memory_headroom()
2315 + // compares against the limit, so the two are the same unit.
2316 + $this->walk_chunk_cost = max($this->walk_chunk_cost, memory_get_usage(true) - $chunk_start);
2317 +
2318 + if (wp_using_ext_object_cache()) {
2319 + if (
2320 + function_exists('wp_cache_supports')
2321 + && wp_cache_supports('flush_runtime')
2322 + && function_exists('wp_cache_flush_runtime')
2323 + ) {
2324 + wp_cache_flush_runtime();
2325 + }
2326 + } elseif (!empty($ids)) {
2327 + foreach ($groups as $group) {
2328 + wp_cache_delete_multiple($ids, $group);
2329 + }
2330 + }
2331 +
2332 + $this->assert_memory_headroom();
2333 + }
2334 +
2335 + /**
2336 + * Cache groups get_posts() fills per post for the given post types.
2337 + *
2338 + * The post, its meta, and one relationships group per taxonomy the post
2339 + * type uses (update_object_term_cache()). Term objects themselves are
2340 + * bounded by the number of terms, not posts, so they are left cached.
2341 + *
2342 + * @since 2.10.1
2343 + * @param string[] $post_types Post types being walked.
2344 + * @return string[] Cache groups keyed by post ID.
2345 + */
2346 + private function chunk_post_cache_groups(array $post_types): array {
2347 + $groups = ['posts', 'post_meta'];
2348 +
2349 + foreach (get_object_taxonomies($post_types) as $taxonomy) {
2350 + $groups[] = $taxonomy . '_relationships';
2351 + }
2352 +
2353 + return array_values(array_unique($groups));
2354 + }
2355 +
2356 + /**
2357 + * Stop an automatic rebuild before the memory limit rather than at it.
2358 + *
2359 + * A PHP memory fatal skips every catch and finally, so the lock, the
2360 + * failure record and the backoff are all lost with it, while stopping here
2361 + * is an ordinary, fully recorded failure. Checked before each chunk is
2362 + * hydrated, against a margin of at least the largest chunk seen so far.
2363 + *
2364 + * It throws an \Error, not an \Exception, on purpose: the per-segment
2365 + * catch (\Exception) blocks in generate_multiple_sitemaps() would otherwise
2366 + * swallow it and carry on — writing an index without the aborted segments
2367 + * and then pruning their files as orphans. Only the automatic rebuild's
2368 + * catch (\Throwable) is meant to see it.
2369 + *
2370 + * @since 2.10.1
2371 + * @return void
2372 + * @throws \Error When the automatic rebuild is close to the memory limit.
2373 + */
2374 + private function assert_memory_headroom(): void {
2375 + if (!$this->memory_guard) {
2376 + return;
2377 + }
2378 +
2379 + $limit = $this->current_memory_limit();
2380 + if ($limit === -1) {
2381 + return;
2382 + }
2383 +
2384 + // A fifth of the limit (at least 32 MB) for writing the files, or one
2385 + // and a half of the costliest chunk if that is more — and never more
2386 + // than half the limit either way. Without that outer cap a single
2387 + // anomalously expensive chunk (500 posts of serialised page-builder or
2388 + // ACF meta reaches hundreds of megabytes) puts the margin above the
2389 + // limit itself, so every later check aborts at any usage at all, the
2390 + // failure records this process's limit, and has_memory_for_retry()
2391 + // then refuses every process that has the same limit. A site that
2392 + // never actually ran out of memory would stop rebuilding until WP-CLI
2393 + // or a system cron happened to run.
2394 + $headroom = (int) min(
2395 + max(
2396 + min(max($limit * 0.2, 32 * MB_IN_BYTES), $limit * 0.5),
2397 + $this->walk_chunk_cost * 1.5
2398 + ),
2399 + $limit * 0.5
2400 + );
2401 +
2402 + // The real allocated size, which is what PHP enforces memory_limit
2403 + // against; memory_get_usage(false) reports only what is handed out of
2404 + // those allocations and so understates the margin by the allocator's
2405 + // slack.
2406 + $usage = memory_get_usage(true);
2407 +
2408 + if ($usage > $limit - $headroom) {
2409 + throw new \Error(
2410 + sprintf(
2411 + /* translators: 1: memory in use, 2: PHP memory limit. */
2412 + __('The sitemap rebuild was stopped at %1$s of the %2$s PHP memory limit, before PHP would have run out of memory. It will be retried by a process with more memory (WP-CLI or a system cron). To let it finish in the admin, raise the PHP memory_limit.', 'thinkrank'),
2413 + size_format($usage),
2414 + size_format($limit)
2415 + ),
2416 + self::MEMORY_ABORT_CODE
2417 + );
2418 + }
2419 + }
2420 +
2421 + /**
2422 + * Run an automatic rebuild's generation with the fatal-safe bookkeeping.
2423 + *
2424 + * @since 2.10.1
2425 + * @param array $settings Sitemap settings.
2426 + * @return bool Whatever generate_and_save() returned.
2427 + * @throws \Throwable Whatever generation throws, after the memory guard is
2428 + * switched back off.
2429 + */
2430 + private function generate_for_regeneration(array $settings): bool {
2431 + // Same headroom wp-admin gives itself; a no-op when the limit is
2432 + // already higher or unlimited.
2433 + wp_raise_memory_limit('admin');
2434 +
2435 + $this->claim_regeneration_attempt();
2436 + $this->memory_guard = true;
2437 + $this->walk_chunk_cost = 0;
2438 +
2439 + try {
2440 + return $this->generate_and_save($settings);
2441 + } finally {
2442 + $this->memory_guard = false;
2443 + }
2444 + }
2445 +
2446 + /**
2447 + * Record a failure thrown by an automatic rebuild.
2448 + *
2449 + * @since 2.10.1
2450 + * @param \Throwable $e What was thrown.
2451 + * @param string $source Either 'content' or 'settings'.
2452 + * @return void
2453 + */
2454 + private function record_thrown_regeneration_failure(\Throwable $e, string $source): void {
2455 + $memory_limit = null;
2456 +
2457 + if ($e instanceof \Error && $e->getCode() === self::MEMORY_ABORT_CODE) {
2458 + $memory_limit = $this->current_memory_limit();
2459 + $memory_limit = $memory_limit > 0 ? $memory_limit : null;
2460 + }
2461 +
2462 + $this->record_regeneration_failure($e->getMessage(), $source, $memory_limit);
2463 + }
2464 +
2465 + /**
1949 2466 * Report how automatic regeneration is faring, for the admin UI.
1950 2467 *
1951 2468 * The feature used to fail invisibly: `last_generated` simply stopped
1952 2469 * advancing and nothing drew attention to it (#629).
@@ -2044,16 +2561,20 @@
2044 2561 * auto_generate setting: the user deliberately changed inclusion rules and
2045 2562 * expects the served file to reflect them even if content-triggered
2046 2563 * auto-generation is turned off. Still respects the master `enabled` flag.
2047 2564 *
2048 - * @return void
2565 + * @since 2.10.0 Reports whether the served sitemap was actually rebuilt, so
2566 + * a caller can say so rather than assume it (#764). Existing
2567 + * callers that ignore the return are unaffected.
2568 + *
2569 + * @return bool True when the served sitemap now reflects the settings.
2049 2570 */
2050 - public function regenerate_sitemap_from_settings(): void {
2571 + public function regenerate_sitemap_from_settings(): bool {
2051 2572 if (!$this->acquire_generation_lock()) {
2052 2573 // A manual generation (or another request's takeover) is already
2053 2574 // writing the files; the pending marker survives so this rebuild is
2054 2575 // retried rather than lost.
2055 - return;
2576 + return false;
2056 2577 }
2057 2578
2058 2579 try {
2059 2580 $settings = $this->get_settings('site');
@@ -2060,25 +2581,56 @@
2060 2581 if (empty($settings['enabled'])) {
2061 2582 // The sitemap was disabled: remove the previously generated static
2062 2583 // files so the web server stops serving a stale sitemap that
2063 2584 // crawlers would otherwise keep fetching.
2064 - $this->delete_published_sitemaps();
2585 + //
2586 + // A file that could not be removed is still being served, so
2587 + // this is not a success. Reporting one here would tell a caller
2588 + // the sitemap was gone while the web server kept answering with
2589 + // it, which is the failure this return value exists to prevent
2590 + // (#764).
2591 + $removal = $this->delete_published_sitemaps($settings);
2592 + $stuck = is_array($removal['failed'] ?? null) ? $removal['failed'] : [];
2593 +
2594 + if (!empty($stuck)) {
2595 + $this->record_regeneration_failure(
2596 + $this->stuck_files_message($stuck, true),
2597 + 'settings'
2598 + );
2599 +
2600 + return false;
2601 + }
2602 +
2065 2603 $this->mark_regeneration_complete();
2066 - return;
2604 +
2605 + return true;
2067 2606 }
2068 2607
2069 2608 $revision = $this->current_regeneration_revision();
2070 2609
2071 - if ($this->generate_and_save($settings)) {
2610 + if ('dynamic' === $this->resolve_delivery_mode($settings)) {
2611 + // Returns false when a static file is stuck in the web root:
2612 + // the server keeps serving that file in preference to WordPress,
2613 + // so the switch has not taken effect (#764).
2614 + return $this->switch_to_dynamic_delivery($settings, $revision, 'settings');
2615 + }
2616 +
2617 + if ($this->generate_for_regeneration($settings)) {
2072 2618 $this->mark_regeneration_complete($revision);
2073 - } else {
2074 - $this->record_regeneration_failure(
2075 - __('The sitemap files could not be written to the site root.', 'thinkrank'),
2076 - 'settings'
2077 - );
2619 +
2620 + return true;
2078 2621 }
2622 +
2623 + $this->record_regeneration_failure(
2624 + $this->write_failure_message(),
2625 + 'settings'
2626 + );
2627 +
2628 + return false;
2079 2629 } catch (\Throwable $e) {
2080 - $this->record_regeneration_failure($e->getMessage(), 'settings');
2630 + $this->record_thrown_regeneration_failure($e, 'settings');
2631 +
2632 + return false;
2081 2633 } finally {
2082 2634 $this->release_generation_lock();
2083 2635 }
2084 2636 }
@@ -2083,8 +2635,27 @@
2083 2635 }
2084 2636 }
2085 2637
2086 2638 /**
2639 + * When a rebuild has been outstanding since, or 0 when none is.
2640 + *
2641 + * Lets a caller report an honest "saved, but the served file has not caught
2642 + * up yet" instead of a bare success (#764).
2643 + *
2644 + * @since 2.10.0
2645 + * @return int Unix timestamp, or 0 when nothing is pending.
2646 + */
2647 + public static function regeneration_pending_since(): int {
2648 + $pending = get_option(self::REGENERATION_PENDING_OPTION, []);
2649 +
2650 + if (!is_array($pending) || empty($pending['since'])) {
2651 + return 0;
2652 + }
2653 +
2654 + return (int) $pending['since'];
2655 + }
2656 +
2657 + /**
2087 2658 * Remove every static sitemap file ThinkRank publishes to the web root.
2088 2659 *
2089 2660 * Called when the sitemap feature is disabled, by the cleanup route, and by
2090 2661 * both removal paths, so /sitemap.xml, /sitemap_index.xml, the segmented
@@ -2183,10 +2754,17 @@
2183 2754 return;
2184 2755 }
2185 2756
2186 2757 $revision = $this->current_regeneration_revision();
2758 + $settings = $this->get_settings('site');
2187 2759
2188 - if ($this->generate_and_save($this->get_settings('site'))) {
2760 + // See regenerate_sitemap_from_settings(): nothing to write.
2761 + if ('dynamic' === $this->resolve_delivery_mode($settings)) {
2762 + $this->switch_to_dynamic_delivery($settings, $revision, 'content');
2763 + return;
2764 + }
2765 +
2766 + if ($this->generate_for_regeneration($settings)) {
2189 2767 $this->mark_regeneration_complete($revision);
2190 2768 } else {
2191 2769 // Previously this returned quietly and last_generated simply
2192 2770 // stopped advancing, leaving the site owner with no way to learn
@@ -2191,14 +2769,14 @@
2191 2769 // Previously this returned quietly and last_generated simply
2192 2770 // stopped advancing, leaving the site owner with no way to learn
2193 2771 // the sitemap had stopped updating (#629).
2194 2772 $this->record_regeneration_failure(
2195 - __('The sitemap files could not be written to the site root.', 'thinkrank'),
2773 + $this->write_failure_message(),
2196 2774 'content'
2197 2775 );
2198 2776 }
2199 2777 } catch (\Throwable $e) {
2200 - $this->record_regeneration_failure($e->getMessage(), 'content');
2778 + $this->record_thrown_regeneration_failure($e, 'content');
2201 2779 } finally {
2202 2780 $this->release_generation_lock();
2203 2781 }
2204 2782 }
@@ -2215,8 +2793,26 @@
2215 2793 * @param array $settings Sitemap settings.
2216 2794 * @return bool True when the sitemap files were written.
2217 2795 */
2218 2796 public function generate_and_save(array $settings): bool {
2797 + // Dynamic delivery publishes no files, so writing them here would put a
2798 + // static copy back in the web root for the server to serve in place of
2799 + // the dynamic route. Guarding at each call site left gaps — the
2800 + // snapshot migrator's post-import regeneration had none — so the rule
2801 + // lives with the writing instead.
2802 + //
2803 + // `is_collecting()` is the exception that makes dynamic delivery work
2804 + // at all: render_document() and collect_documents() reach this same
2805 + // method with the writer swapped for a collector, and that is precisely
2806 + // the dynamic build. Only a real write is skipped.
2807 + if (!$this->is_collecting() && 'dynamic' === $this->resolve_delivery_mode($settings)) {
2808 + // Whatever prompted this call changed the sitemap's content, so the
2809 + // rendered copies must not outlive it.
2810 + $this->flush_dynamic_cache();
2811 +
2812 + return true;
2813 + }
2814 +
2219 2815 // Index mode is driven by the use_sitemap_index toggle (not merely by how
2220 2816 // many sitemap_urls happen to be configured). When the toggle is on but
2221 2817 // no child sitemaps are set up yet, synthesize the per-type segmented set
2222 2818 // so we emit a real <sitemapindex> with paginated children instead of a
@@ -2243,9 +2839,13 @@
2243 2839 // names is never touched (#515).
2244 2840 $this->prune_orphaned_segments($settings, [['filename' => basename($primary)]]);
2245 2841 }
2246 2842
2247 - if ($written) {
2843 + // last_generated describes what is on disk. A dynamic render publishes
2844 + // nothing, so advancing it would report a static publication that never
2845 + // happened and would let primary_sitemap_file_exists() callers believe
2846 + // there is a file to serve.
2847 + if ($written && !$this->is_collecting()) {
2248 2848 $settings['last_generated'] = gmdate('c');
2249 2849 $this->save_settings('site', null, $settings);
2250 2850 }
2251 2851
@@ -2252,8 +2852,433 @@
2252 2852 return $written;
2253 2853 }
2254 2854
2255 2855 /**
2856 + * Whether this instance is rendering documents rather than publishing them.
2857 + *
2858 + * @since 2.9.0
2859 + *
2860 + * @return bool
2861 + */
2862 + private function is_collecting(): bool {
2863 + return $this->document_sink !== null;
2864 + }
2865 +
2866 + /**
2867 + * Complete a regeneration that delivers dynamically, retiring stale files.
2868 + *
2869 + * Dynamic delivery renders nothing to disk, but that is only half the job.
2870 + * A web server hands back an existing `/sitemap.xml` without ever loading
2871 + * WordPress, so any file left over from a previous static generation goes on
2872 + * being served forever and {@see \ThinkRank\Frontend\SEO_Manager
2873 + * ::maybe_serve_sitemap()} is never reached. Switching to dynamic while
2874 + * leaving those files in place would therefore appear to do nothing at all.
2875 + *
2876 + * Both transitions matter and they differ:
2877 + *
2878 + * - An explicit switch to `dynamic` happens on a site whose root is usually
2879 + * still writable, so the files can simply be removed.
2880 + * - An `auto` site that becomes read-only cannot remove them, because
2881 + * deleting an entry needs write permission on the directory that holds
2882 + * it. There the stale sitemap really is stuck in front of us, and the
2883 + * honest outcome is a recorded failure naming it rather than a rebuild
2884 + * reported as complete (#754 review).
2885 + *
2886 + * Ownership is tested per file by the shared helper, so another plugin's
2887 + * sitemap at one of our names is never deleted (#515).
2888 + *
2889 + * @since 2.9.0
2890 + *
2891 + * @param array $settings Sitemap settings.
2892 + * @param int $revision Revision this rebuild is completing.
2893 + * @param string $source 'settings' or 'content', for the failure record.
2894 + * @return void
2895 + */
2896 + private function switch_to_dynamic_delivery(array $settings, int $revision, string $source): bool {
2897 + $this->flush_dynamic_cache();
2898 +
2899 + $removal = $this->delete_published_sitemaps($settings);
2900 + $stuck = is_array($removal['failed'] ?? null) ? $removal['failed'] : [];
2901 +
2902 + if (!empty($stuck)) {
2903 + $this->record_regeneration_failure($this->stuck_files_message($stuck), $source);
2904 +
2905 + return false;
2906 + }
2907 +
2908 + $this->mark_regeneration_complete($revision);
2909 +
2910 + return true;
2911 + }
2912 +
2913 + /**
2914 + * Why a stale file left in the web root means the change has not landed.
2915 + *
2916 + * Shared by every path that removes published files, so they cannot
2917 + * describe the same situation differently (#764).
2918 + *
2919 + * The two situations that reach it differ in what WordPress is doing, and
2920 + * the message has to say which. After a switch to dynamic delivery
2921 + * WordPress IS serving the sitemap and the files shadow it. After the
2922 + * sitemap is switched off WordPress serves nothing, so the one message
2923 + * used to tell a site owner who had just disabled the sitemap that it was
2924 + * "being served from WordPress", which is the opposite of what they did.
2925 + *
2926 + * @since 2.10.0
2927 + * @since 2.10.0 Public, so the REST endpoint uses it rather than a copy;
2928 + * takes $sitemap_disabled for the disabled path.
2929 + *
2930 + * @param string[] $stuck Basenames that could not be removed.
2931 + * @param bool $sitemap_disabled True when the files outlived disabling
2932 + * the sitemap rather than a switch to
2933 + * dynamic delivery.
2934 + * @return string
2935 + */
2936 + public function stuck_files_message(array $stuck, bool $sitemap_disabled = false): string {
2937 + if ($sitemap_disabled) {
2938 + return sprintf(
2939 + /* translators: 1: comma-separated file names, 2: absolute path to the WordPress root. */
2940 + __('The sitemap is disabled, but these files are still in the site root and your web server is still serving them: %1$s. They could not be removed because %2$s is not writable. Delete them, or ask your host to make the WordPress root writable.', 'thinkrank'),
2941 + implode(', ', $stuck),
2942 + untrailingslashit(ABSPATH)
2943 + );
2944 + }
2945 +
2946 + return sprintf(
2947 + /* translators: 1: comma-separated file names, 2: absolute path to the WordPress root. */
2948 + __('The sitemap is being served from WordPress, but these files are still in the site root and your web server will keep serving them instead: %1$s. They could not be removed because %2$s is not writable. Delete them, or ask your host to make the WordPress root writable.', 'thinkrank'),
2949 + implode(', ', $stuck),
2950 + untrailingslashit(ABSPATH)
2951 + );
2952 + }
2953 +
2954 + /**
2955 + * What to tell the site owner when publishing the files failed.
2956 + *
2957 + * The old wording stated the symptom and stopped there, so the reported
2958 + * cause was a guess and this reached support as a plugin fault rather than
2959 + * a folder permission (#752, #753). When the root is demonstrably
2960 + * unwritable, say that, and say what to do about it.
2961 + *
2962 + * @since 2.9.0
2963 + *
2964 + * @return string
2965 + */
2966 + private function write_failure_message(): string {
2967 + if (!wp_is_writable(ABSPATH)) {
2968 + return sprintf(
2969 + /* translators: %s: absolute path to the WordPress root. */
2970 + __('The sitemap could not be written because the folder %s is not writable by PHP. Ask your host to make the WordPress root writable, or set Sitemap Delivery to Dynamic to serve the sitemap without writing files.', 'thinkrank'),
2971 + untrailingslashit(ABSPATH)
2972 + );
2973 + }
2974 +
2975 + return __('The sitemap files could not be written to the site root.', 'thinkrank');
2976 + }
2977 +
2978 + /**
2979 + * How this site delivers its sitemap.
2980 + *
2981 + * `auto` is resolved on whether the web root can be written. That is the
2982 + * right signal here (unlike llms.txt, where the question is whether the
2983 + * server applies the .htaccess charset block): a site whose root is
2984 + * read-only cannot publish a sitemap file at all, and before this existed
2985 + * the feature simply failed with "The sitemap files could not be written to
2986 + * the site root." and served nothing (#752).
2987 + *
2988 + * @since 2.9.0
2989 + *
2990 + * @param array|null $settings Sitemap settings (falls back to saved ones).
2991 + * @return string One of 'static' or 'dynamic'. Never 'auto'.
2992 + */
2993 + public function resolve_delivery_mode(?array $settings = null): string {
2994 + $settings = $settings ?? $this->get_settings('site');
2995 + $mode = (string) ($settings['delivery_mode'] ?? 'auto');
2996 +
2997 + if ('static' === $mode || 'dynamic' === $mode) {
2998 + return $mode;
2999 + }
3000 +
3001 + return wp_is_writable(ABSPATH) ? 'static' : 'dynamic';
3002 + }
3003 +
3004 + /**
3005 + * Render one published sitemap document without touching the filesystem.
3006 + *
3007 + * Runs the ordinary build pipeline with the writer swapped for a collector,
3008 + * so the bytes returned here are the bytes the static path would have
3009 + * written. `SitemapDeliveryParityTest` asserts that equivalence rather than
3010 + * trusting it.
3011 + *
3012 + * The whole set is built to answer for one file, because the index can only
3013 + * be assembled from the children that were actually produced. The result is
3014 + * cached per document, so that cost is paid once per change and not once
3015 + * per crawler request.
3016 + *
3017 + * @since 2.9.0
3018 + *
3019 + * @param string $filename Published file name, e.g. 'sitemap.xml'.
3020 + * @param array|null $settings Sitemap settings (falls back to saved ones).
3021 + * @return string|null XML, or null when this site does not publish that name.
3022 + */
3023 + public function render_document(string $filename, ?array $settings = null): ?string {
3024 + $filename = basename($filename);
3025 + $settings = $settings ?? $this->get_settings('site');
3026 +
3027 + if (empty($settings['enabled'])) {
3028 + return null;
3029 + }
3030 +
3031 + $cached = get_transient($this->dynamic_cache_key($filename));
3032 + if (self::ABSENT_MARKER === $cached) {
3033 + return null;
3034 + }
3035 + if (is_string($cached) && '' !== $cached) {
3036 + return $cached;
3037 + }
3038 +
3039 + // A miss builds the whole set, because the index can only be assembled
3040 + // from the children that were actually produced. Caching only the
3041 + // requested document therefore made a crawler walking the index and its
3042 + // children rebuild the entire site's sitemap once per file — every post
3043 + // and taxonomy query repeated N times on a public endpoint (#754
3044 + // review). The set is built once and stored in full.
3045 + return $this->stream_documents($settings, $filename);
3046 + }
3047 +
3048 + /**
3049 + * Build every document, caching each as it is produced, keeping one.
3050 + *
3051 + * A miss has to build the whole set, because the index can only be
3052 + * assembled from the children that were actually produced. It does not have
3053 + * to *hold* the whole set: the static path never keeps more than one page
3054 + * in memory, writing each to disk as it goes, and buffering every
3055 + * document's XML to return one of them undid that on the request path,
3056 + * where a large site's entire sitemap corpus would sit in a single PHP
3057 + * process (#754 review).
3058 + *
3059 + * So the sink writes each document straight to its cache entry and lets it
3060 + * go, retaining only the one this request is answering. Peak retention is
3061 + * one document, whatever the site's size.
3062 + *
3063 + * Concurrency: the first request through takes a short lock and does the
3064 + * work. One that finds the lock held waits a bounded moment for the winner
3065 + * to publish, then builds anyway, because serving a correct sitemap late
3066 + * beats serving none.
3067 + *
3068 + * @since 2.9.0
3069 + *
3070 + * @param array $settings Sitemap settings.
3071 + * @param string $wanted Document this request is answering.
3072 + * @return string|null XML for $wanted, or null when the site does not publish it.
3073 + */
3074 + private function stream_documents(array $settings, string $wanted): ?string {
3075 + $lock = self::DYNAMIC_CACHE_PREFIX . 'lock';
3076 +
3077 + if (!$this->acquire_render_lock($lock)) {
3078 + for ($attempt = 0; $attempt < self::RENDER_LOCK_WAIT_ATTEMPTS; $attempt++) {
3079 + usleep(self::RENDER_LOCK_WAIT_MICROSECONDS);
3080 +
3081 + $cached = get_transient($this->dynamic_cache_key($wanted));
3082 + if (self::ABSENT_MARKER === $cached) {
3083 + return null;
3084 + }
3085 + if (is_string($cached) && '' !== $cached) {
3086 + return $cached;
3087 + }
3088 + }
3089 + }
3090 +
3091 + $kept = null;
3092 + // Names only. Keeping the bodies here would be the very retention this
3093 + // method exists to avoid.
3094 + $produced = [];
3095 +
3096 + $previous = $this->document_sink;
3097 + $this->document_sink = function (string $name, string $xml) use (&$kept, &$produced, $wanted): void {
3098 + $produced[$name] = true;
3099 + set_transient($this->dynamic_cache_key($name), $xml, self::DYNAMIC_CACHE_TTL);
3100 +
3101 + if ($name === $wanted) {
3102 + $kept = $xml;
3103 + }
3104 + };
3105 +
3106 + try {
3107 + $this->generate_and_save($settings);
3108 +
3109 + // Names the configuration lists but this build did not produce get
3110 + // a negative entry, so asking for one again is a cache hit rather
3111 + // than another full rebuild.
3112 + $absent = $this->published_document_names($settings);
3113 +
3114 + // Also the exact name this request asked for: a paginated page past
3115 + // the end of a stem is a legitimate request shape that the base
3116 + // list cannot enumerate, and without an entry it would rebuild on
3117 + // every hit.
3118 + $absent[] = $wanted;
3119 +
3120 + foreach (array_unique($absent) as $name) {
3121 + if (!isset($produced[$name])) {
3122 + set_transient($this->dynamic_cache_key($name), self::ABSENT_MARKER, self::DYNAMIC_CACHE_TTL);
3123 + }
3124 + }
3125 + } finally {
3126 + $this->document_sink = $previous;
3127 + delete_transient($lock);
3128 + }
3129 +
3130 + return $kept;
3131 + }
3132 +
3133 + /**
3134 + * Take the render lock, if it is free.
3135 + *
3136 + * Not atomic across processes, and deliberately so: the fallback for losing
3137 + * a race is duplicated work, never a wrong or missing sitemap, so a
3138 + * heavier primitive would buy nothing here.
3139 + *
3140 + * @since 2.9.0
3141 + *
3142 + * @param string $lock Lock transient name.
3143 + * @return bool True when this request holds the lock.
3144 + */
3145 + private function acquire_render_lock(string $lock): bool {
3146 + if (false !== get_transient($lock)) {
3147 + return false;
3148 + }
3149 +
3150 + set_transient($lock, time(), self::RENDER_LOCK_TTL);
3151 +
3152 + return true;
3153 + }
3154 +
3155 + /**
3156 + * Build every document this site publishes and return them all.
3157 + *
3158 + * Verification and tooling only. This retains the whole set in memory, so
3159 + * it must never be used to answer a request: {@see self::stream_documents()}
3160 + * is the serving path and keeps one document at a time regardless of site
3161 + * size (#754 review). `SitemapDeliveryParityTest` enforces that separation
3162 + * by failing if the request path routes back through here.
3163 + *
3164 + * @since 2.9.0
3165 + *
3166 + * @param array $settings Sitemap settings.
3167 + * @return array<string,string> Filename => XML.
3168 + */
3169 + public function collect_documents(array $settings): array {
3170 + $documents = [];
3171 +
3172 + $previous = $this->document_sink;
3173 + $this->document_sink = static function (string $name, string $xml) use (&$documents): void {
3174 + $documents[$name] = $xml;
3175 + };
3176 +
3177 + try {
3178 + $this->generate_and_save($settings);
3179 + } finally {
3180 + $this->document_sink = $previous;
3181 + }
3182 +
3183 + return $documents;
3184 + }
3185 +
3186 + /**
3187 + * The file names this site publishes, without building their contents.
3188 + *
3189 + * Used by the request router to decide whether a URL is ours before doing
3190 + * any work. Cheap: it reads the configured child list rather than querying
3191 + * for entries.
3192 + *
3193 + * @since 2.9.0
3194 + *
3195 + * @param array|null $settings Sitemap settings (falls back to saved ones).
3196 + * @return string[] File names, including paginated pages that may exist.
3197 + */
3198 + public function published_document_names(?array $settings = null): array {
3199 + $settings = $settings ?? $this->get_settings('site');
3200 + $resolved = $this->maybe_promote_to_index($settings);
3201 +
3202 + $names = [$this->get_primary_sitemap_filename($settings), 'local-sitemap.xml'];
3203 +
3204 + foreach ((array) ($resolved['sitemap_urls'] ?? []) as $child) {
3205 + if (!is_array($child) || empty($child['enabled'])) {
3206 + continue;
3207 + }
3208 +
3209 + $path = (string) wp_parse_url((string) ($child['url'] ?? ''), PHP_URL_PATH);
3210 + if ('' !== $path) {
3211 + $names[] = basename($path);
3212 + }
3213 + }
3214 +
3215 + return array_values(array_unique(array_filter($names)));
3216 + }
3217 +
3218 + /**
3219 + * Does this site publish a document under that name?
3220 + *
3221 + * Not a plain membership test against {@see self::published_document_names()}:
3222 + * that lists the configured children, and a child over the per-file URL cap
3223 + * is split into `<stem>-2.xml`, `<stem>-3.xml` and so on, with every page
3224 + * listed in the index. Gating the request router on the base list alone
3225 + * therefore 404'd exactly the pages the index points at, which is worse than
3226 + * not serving them at all.
3227 + *
3228 + * Page counts are not knowable without building, so the stem is what is
3229 + * matched; a page that does not exist is answered by the build finding
3230 + * nothing for it, and is then cached as absent.
3231 + *
3232 + * @since 2.9.0
3233 + *
3234 + * @param string $name Requested file name.
3235 + * @param array|null $settings Sitemap settings (falls back to saved ones).
3236 + * @return bool
3237 + */
3238 + public function publishes_document_name(string $name, ?array $settings = null): bool {
3239 + $names = $this->published_document_names($settings);
3240 +
3241 + if (in_array($name, $names, true)) {
3242 + return true;
3243 + }
3244 +
3245 + if (!preg_match('/^(.*)-\d+\.xml$/i', $name, $m)) {
3246 + return false;
3247 + }
3248 +
3249 + return in_array($m[1] . '.xml', $names, true);
3250 + }
3251 +
3252 + /**
3253 + * Transient key for a rendered document.
3254 + *
3255 + * @since 2.9.0
3256 + *
3257 + * @param string $filename Published file name.
3258 + * @return string
3259 + */
3260 + private function dynamic_cache_key(string $filename): string {
3261 + return self::DYNAMIC_CACHE_PREFIX . md5($filename);
3262 + }
3263 +
3264 + /**
3265 + * Drop every cached dynamic document.
3266 + *
3267 + * Called from the same places that mark the static files stale, so the two
3268 + * delivery modes invalidate on identical triggers.
3269 + *
3270 + * @since 2.9.0
3271 + *
3272 + * @return void
3273 + */
3274 + public function flush_dynamic_cache(): void {
3275 + foreach ($this->published_document_names() as $name) {
3276 + delete_transient($this->dynamic_cache_key($name));
3277 + }
3278 + }
3279 +
3280 + /**
2256 3281 * Resolve index-vs-single mode, synthesizing child sitemaps when needed.
2257 3282 *
2258 3283 * - When use_sitemap_index is on but no child sitemaps are configured, build
2259 3284 * the per-type segmented set so a real <sitemapindex> is produced (#127).
@@ -2448,8 +3473,18 @@
2448 3473 // File validation failed - error details available in exception
2449 3474 return false;
2450 3475 }
2451 3476
3477 + // Dynamic delivery: hand the document to the collector instead of the
3478 + // filesystem. Reported as published, because for this run it is — the
3479 + // caller's success/failure bookkeeping and the index assembly both key
3480 + // off this return value.
3481 + if ($this->document_sink !== null) {
3482 + ($this->document_sink)($filename, $sitemap_xml);
3483 +
3484 + return true;
3485 + }
3486 +
2452 3487 $sitemap_path = ABSPATH . $filename;
2453 3488
2454 3489 // Use WordPress filesystem API for better security
2455 3490 global $wp_filesystem;
@@ -2863,8 +3898,15 @@
2863 3898 * @param array $generated Entries from $results['sitemaps_generated'].
2864 3899 * @return string[] Basenames removed.
2865 3900 */
2866 3901 private function prune_orphaned_segments(array $settings, array $generated): array {
3902 + // Rendering for a request, not publishing: there is nothing on disk
3903 + // this run owns, and a dynamic render must never delete the files a
3904 + // site's previous static mode left behind.
3905 + if ($this->is_collecting()) {
3906 + return [];
3907 + }
3908 +
2867 3909 $kept = [];
2868 3910 foreach ($generated as $entry) {
2869 3911 if (!empty($entry['filename'])) {
2870 3912 $kept[strtolower((string) $entry['filename'])] = true;
@@ -2966,9 +4008,9 @@
2966 4008 // publishes under too (this method mirrors it deliberately), so on
2967 4009 // a migrated site the file at that path may never have been ours
2968 4010 // to delete (#515).
2969 4011 $path = ABSPATH . 'local-sitemap.xml';
2970 - if (file_exists($path) && $this->webroot_sitemap_is_ours($path, $settings)) {
4012 + if (!$this->is_collecting() && file_exists($path) && $this->webroot_sitemap_is_ours($path, $settings)) {
2971 4013 wp_delete_file($path);
2972 4014 }
2973 4015 return false;
2974 4016 }
@@ -2990,8 +4032,25 @@
2990 4032 *
2991 4033 * @since 1.15.x
2992 4034 * @return array Zero or one URL entry
2993 4035 */
4036 + /**
4037 + * Does this site publish a local business sitemap right now?
4038 + *
4039 + * The same gate {@see self::regenerate_local_sitemap()} applies, asked
4040 + * without writing anything. Callers that need to know whether the document
4041 + * exists must not test the filesystem: under dynamic delivery it is served
4042 + * from PHP and there is no file, which is how `local-sitemap.xml` came to be
4043 + * dropped from robots.txt on exactly those sites (#752).
4044 + *
4045 + * @since 2.9.0
4046 + *
4047 + * @return bool True when the local sitemap has content to publish.
4048 + */
4049 + public function publishes_local_sitemap(): bool {
4050 + return !empty($this->collect_local_entries());
4051 + }
4052 +
2994 4053 private function collect_local_entries(): array {
2995 4054 if (!class_exists('ThinkRank\\SEO\\Site_Identity_Manager')) {
2996 4055 require_once THINKRANK_PLUGIN_DIR . 'includes/seo/class-site-identity-manager.php';
2997 4056 }
@@ -3152,8 +4211,13 @@
3152 4211 * @param array $settings Sitemap settings, for the ownership test.
3153 4212 * @return void
3154 4213 */
3155 4214 private function cleanup_stale_pages(string $base_url, int $current_pages, array $settings): void {
4215 + // See prune_orphaned_segments(): a dynamic render deletes nothing.
4216 + if ($this->is_collecting()) {
4217 + return;
4218 + }
4219 +
3156 4220 $filename = basename(wp_parse_url($base_url, PHP_URL_PATH));
3157 4221 if (!preg_match('/^(.*)\.xml$/i', $filename, $m)) {
3158 4222 return;
3159 4223 }