Merge v1.0 hardening updates

.github/workflows/plugin-quality.yml

@@ -64,6 +64,31 @@ jobs:
 
       - run: composer phpunit
 
+  browser-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.2"
+          coverage: none
+
+      - uses: ramsey/composer-install@v3
+        with:
+          working-directory: plugin/plan-your-day
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+
+      - run: npm ci
+
+      - run: npx playwright install --with-deps chromium
+
+      - run: npm run browser-smoke
+
   plugin-check:
     runs-on: ubuntu-latest
     steps:
@@ -79,9 +104,89 @@ jobs:
           working-directory: plugin/plan-your-day
           composer-options: "--no-dev --optimize-autoloader"
 
-      - uses: wordpress/plugin-check-action@v1
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Run Plugin Check
+        env:
+          WP_ENV_HOME: ${{ runner.temp }}/wp-env
+        run: |
+          trap 'status=$?; if [ "$status" -ne 0 ]; then docker ps -a || true; find "$WP_ENV_HOME" -maxdepth 3 -type f -print || true; fi; exit "$status"' EXIT
+
+          plugin_dir="$(realpath ./plugin/plan-your-day)"
+
+          cat > .wp-env.json <<EOF
+          {
+            "core": null,
+            "port": 8880,
+            "testsEnvironment": false,
+            "plugins": [ "https://downloads.wordpress.org/plugin/plugin-check.zip" ],
+            "mappings": {
+              "wp-content/plugins/plan-your-day": "$plugin_dir"
+            }
+          }
+          EOF
+
+          wp_env_tools="$RUNNER_TEMP/wp-env-tools"
+          mkdir -p "$wp_env_tools"
+          cat > "$wp_env_tools/package.json" <<'EOF'
+          {
+            "private": true,
+            "dependencies": {
+              "@wordpress/env": "11.5.0"
+            },
+            "overrides": {
+              "rimraf": {
+                "glob": "^13.0.6"
+              }
+            }
+          }
+          EOF
+          npm --prefix "$wp_env_tools" --no-audit --no-fund install
+          export PATH="$wp_env_tools/node_modules/.bin:$PATH"
+          command -v wp-env
+          wp-env --version
+          cat .wp-env.json
+          wp-env start --update
+          wp-env run cli wp cli info
+          wp-env run cli wp plugin list
+          wp-env run cli wp plugin list-checks
+          wp-env run cli wp plugin list-check-categories
+
+          wp-env run cli wp plugin activate plan-your-day
+
+          set +e
+          wp-env run cli wp plugin check plan-your-day \
+            --format=json \
+            --ignore-warnings \
+            --exclude-files=.distignore,DECISIONS.md,phpcs.xml.dist,phpunit.xml.dist,.wp-env.json \
+            --exclude-directories=tests,tools \
+            --require=./wp-content/plugins/plugin-check/cli.php \
+            > "$RUNNER_TEMP/plugin-check-results.txt"
+          status=$?
+          set -e
+
+          cat "$RUNNER_TEMP/plugin-check-results.txt"
+          if grep -Eq '"type"[[:space:]]*:[[:space:]]*"ERROR"' "$RUNNER_TEMP/plugin-check-results.txt"; then
+            exit 1
+          fi
+
+          exit "$status"
+
+      - uses: actions/upload-artifact@v4
+        if: ${{ always() }}
         with:
-          build-dir: ./plugin/plan-your-day
-          exclude-directories: tests,tools
-          exclude-files: .distignore,DECISIONS.md,phpcs.xml.dist,phpunit.xml.dist
-          ignore-warnings: true
+          name: plugin-check-results
+          path: ${{ runner.temp }}/plugin-check-results.txt
+          if-no-files-found: ignore
+
+      - name: Stop wp-env
+        if: ${{ always() }}
+        env:
+          WP_ENV_HOME: ${{ runner.temp }}/wp-env
+        run: |
+          export PATH="$RUNNER_TEMP/wp-env-tools/node_modules/.bin:$PATH"
+          if command -v wp-env >/dev/null 2>&1; then
+            wp-env destroy --force || true
+          fi

.gitignore

@@ -16,3 +16,5 @@ Thumbs.db
 node_modules/
 vendor/
 plugin/plan-your-day/.phpunit.cache/
+playwright-report/
+test-results/

AGENTS.md

@@ -2,10 +2,14 @@
 
 ## Project
 
-This repository contains the standalone **Plan Your Day** WordPress plugin.
+This repository contains the standalone **Plan Your Day** WordPress plugin. The
+plugin source lives in `plugin/plan-your-day/`.
 
 Plan Your Day is a reusable plugin. It must not be branded to, named after, or architecturally tied to any specific client/site.
 
+The latest published release is v0.5. The project is preparing for v1.0 with
+focused public-release hardening and cleanup.
+
 ## Hard rules
 
 - Do not reference DKC, Destination Kona Coast, or any other site-specific branding in code, comments, docs, settings, namespaces, text domains, admin labels, or frontend copy.
@@ -15,30 +19,51 @@ Plan Your Day is a reusable plugin. It must not be branded to, named after, or a
 - Inspect the existing code before editing.
 - Do not introduce a new build system unless absolutely necessary.
 - Do not remove accessibility features.
+- Do not introduce Font Awesome, icon fonts, bundled icon images, or SVG icon
+  assets for UI chrome. Use CSS-only details for carets, grips, toggles, and
+  similar controls unless the asset is real content.
+- Keep the bundled Noto Sans font files and their license together. Do not add
+  or replace fonts without confirming license coverage.
 - Escape and sanitize all WordPress output/input appropriately.
 - Do not allow raw HTML/JS injection through admin-editable copy/category fields unless a deliberate sanitized rich-text pattern already exists.
 
-## Current feature direction
+## Current product surface
 
 The plugin currently supports:
 - frontend place/category/custom searches,
+- "Get more results" pagination for category and custom searches,
 - waypoint selection,
+- waypoint reorder/remove and clear-trip behavior,
 - route/directions behavior,
-- admin-editable interface copy,
-- admin-editable/custom categories.
+- map preview and Google Maps handoff behavior,
+- distance labels and distance-unit settings,
+- frontend color mode switching with an admin default,
+- Noto Sans frontend/admin typography,
+- admin-editable interface copy where the setting is still useful,
+- admin-editable/custom categories with draggable ordering.
+
+## Current v1.0 direction
+
+Prioritize release readiness over new feature breadth. Current hardening lanes
+include:
+
+- CSS-only UI details and removal of bundled icon assets.
+- REST token bootstrap cache safety.
+- Rate-limit state moving to expiring transients.
+- Google geocode failure handling.
+- Stable, quiet WordPress Plugin Check workflow coverage.
 
-Current planned features include:
-- “Get more results” for category and custom searches,
-- a mobile fixed waypoint-count tab,
-- distance preference controls,
-- transportation preference controls for walking, driving, or both,
-- a later compacting pass after copy and category settings are cleaned up.
+PHPStan is not part of the current v1.0 gate. A one-off scan without WordPress
+stubs reports missing WordPress symbols, so do not add PHPStan to CI unless the
+project also adds reproducible WordPress-aware tooling.
 
 ## UI/accessibility expectations
 
 - Use real buttons for interactive controls.
 - Preserve keyboard access.
 - Preserve accessible names for controls.
+- Preserve color mode behavior: admin default first, system preference only
+  when configured, and explicit frontend user choice as the strongest signal.
 - Loading/error/status messages should be understandable to screen reader users.
 - Do not steal focus unexpectedly.
 - Use polite live/status announcements where helpful, but do not announce every result one-by-one.
@@ -57,7 +82,17 @@ Current planned features include:
 
 ## Testing expectations
 
-Before finishing a task, check:
+Before finishing a code task, choose checks that match the change. Common
+checks include:
+
+- `cd plugin/plan-your-day && composer test`
+- `npm ci && npx playwright install chromium && npm run browser-smoke`
+- `find plugin/plan-your-day -name '*.php' -print -exec php -l {} \;`
+- GitHub `Plugin Quality` workflow for PHP syntax, PHPCS, PHPUnit, browser
+  smoke, and WordPress Plugin Check.
+
+Also check, as relevant:
+
 - frontend still renders with default settings,
 - saved settings still load,
 - category/custom searches still work,
@@ -67,4 +102,4 @@ Before finishing a task, check:
 - no client/site-specific references were introduced.
 
 ## Additional Rules
-- when referring to an Issue on a  GitHub repo, capitalize the I. 
+- When referring to an Issue on a GitHub repo, capitalize the I.

README.md

@@ -1,12 +1,16 @@
-# Plan Your Day
+# Waypoints
 
-Plan Your Day is a configurable WordPress plugin for building day-trip planners
-with Google Maps and Places data. The plugin source lives in
+Waypoints is a configurable WordPress plugin for building day-trip planners with
+Google Maps and Places data. The plugin source lives in
 `plugin/plan-your-day/`.
 
 ## Status
 
-The plugin is under active development. Completed foundation work includes:
+The latest published release is **v0.5**. The project is in v1.0 release
+preparation, with UI polish and final hardening work happening in focused pull
+requests.
+
+Completed foundation work includes:
 
 - WordPress plugin scaffold, activation/deactivation hooks, uninstall routine,
   release metadata, and Composer PSR-4 autoloading.
@@ -25,14 +29,28 @@ The plugin is under active development. Completed foundation work includes:
   shared planner renderer.
 - WordPress REST browse/route endpoints with POST-only requests, guest-safe
   visitor token validation, same-site request checks, trusted-proxy-aware client
-  IP resolution, and file-backed rate limiting.
+  IP resolution, and configurable rate limiting.
 - Frontend JavaScript that updates browse and trip state through REST instead of
   full-page planner reloads.
 - Admin-editable categories, admin-editable interface copy, cache-clear tools,
   and a Google API test tool.
+- Browser smoke coverage for shortcode and block renders, category browsing,
+  load-more, waypoint add/reorder/remove, clear-trip behavior, focus recovery,
+  and narrow-viewport start-options behavior.
+- GitHub Actions quality checks for PHP syntax, PHPCS, PHPUnit, browser smoke,
+  and WordPress Plugin Check.
+
+Current v1.0 hardening work is split into open PRs for:
 
-Browser automation and broader production QA are still tracked in GitHub
-issues.
+- Removing bundled icon assets in favor of CSS-only UI details.
+- Making REST token bootstrap cache behavior safer.
+- Moving rate-limit state to expiring transients.
+- Hardening Google geocode failure handling.
+- Keeping the Plugin Check workflow stable and quiet.
+
+PHPStan is not part of the current v1.0 gate. A one-off scan without WordPress
+stubs only reports missing WordPress symbols, so the project is relying on the
+checks above for this release.
 
 ## Requirements
 
@@ -55,6 +73,14 @@ issues.
 - `docs/` contains installation, usage, admin, release, architecture, settings,
   security, troubleshooting, and historical planning notes for the plugin.
 
+## Naming Note
+
+The public plugin name is **Waypoints**. The source still uses `plan-your-day`
+for the plugin directory and text domain, `[plan_your_day]` for the shortcode,
+`plan_your_day_*` for settings/options/hooks, `Acodebeard\PlanYourDay` for the
+PHP namespace, and related REST, asset, and CSS identifiers because the plugin
+was renamed after those compatibility surfaces already existed.
+
 ## Documentation
 
 Start with [docs/README.md](docs/README.md). Current docs cover installation,
@@ -71,8 +97,8 @@ security, and troubleshooting.
    composer install
    ```
 
-3. Activate **Plan Your Day** from the WordPress Plugins screen.
-4. Open **Settings > Plan Your Day**.
+3. Activate **Waypoints** from the WordPress Plugins screen.
+4. Open **Settings > Waypoints**.
 5. Configure the required default location and Google API keys.
 
 Release zips should include generated Composer autoload files so production
@@ -86,7 +112,7 @@ From `plugin/plan-your-day/`, build an installable WordPress admin zip with:
 ./tools/build-release-zip.sh
 ```
 
-The script creates `dist/plan-your-day-0.1.0.zip` at the repository root,
+The script creates `dist/plan-your-day-0.5.zip` at the repository root,
 installs production-only Composer autoload files into a temporary staging copy,
 and packages the final artifact with a top-level `plan-your-day/` directory
 suitable for **Plugins > Add New > Upload Plugin**.
@@ -127,7 +153,22 @@ Server-side Google API keys must not be exposed to frontend runtime config.
 
 ## Useful Checks
 
-Run PHP syntax checks from the repository root:
+Run the PHP checks from the plugin directory:
+
+```sh
+cd plugin/plan-your-day
+composer test
+```
+
+Run the browser smoke suite from the repository root:
+
+```sh
+npm ci
+npx playwright install chromium
+npm run browser-smoke
+```
+
+Run a quick PHP syntax-only sweep from the repository root:
 
 ```sh
 find plugin/plan-your-day -name '*.php' -print -exec php -l {} \;
@@ -140,4 +181,5 @@ rg "localhost|example\\.test|Kona|pier" plugin/plan-your-day
 ```
 
 The plugin PHPUnit suite covers current service, settings, and activation
-behavior. Browser and broader integration QA are still tracked separately.
+behavior. The GitHub `Plugin Quality` workflow also runs WordPress Plugin Check
+against an installable wp-env-backed plugin checkout.

docs/ADMIN.md

@@ -1,9 +1,9 @@
 # Admin Workflows
 
-Plan Your Day settings live under:
+Waypoints settings live under:
 
 ```text
-Settings > Plan Your Day
+Settings > Waypoints
 ```
 
 Only administrators with `manage_options` can change plugin settings or run the
@@ -73,8 +73,8 @@ Each category row includes:
 - enabled state
 - sort order
 
-The starter category fallback setting controls whether fresh or empty installs
-show the built-in generic starter rows instead of no category buttons.
+Fresh installs start with the built-in starter rows. Administrators can delete
+all saved rows when they want visitors to use custom search only.
 
 ## Google API And Cache