# wppqa Baseline — wb-listora (Free) — 2026-05-11

**Baseline taken after:** Foundation cleanup Pass 1 (stale baselines + plan docs archived) + complete frontend refactor (v2 tokens + primitives + 16 blocks migrated + v1 vocabulary deleted).

**Comparison:** Prior baseline at `audit/wppqa-baseline-2026-05-08/SUMMARY.md` (0 release blockers, 3 wiring false-positives unchanged).

---

## Scoreboard

| Check | Passed | Failed | Severity of failures |
|---|---|---|---|
| plugin-dev-rules | 9 | 0 | n/a (16 warnings, no failures) |
| rest-js-contract | 6 | 0 | clean |
| wiring-completeness | 5 | 3 | 3 × high (all classified as known-limitation false-positives, see below) |

**Real release blockers: 0.**

---

## plugin-dev-rules — 16 warnings

### Medium severity (1)

**Breakpoint proliferation** (`PLUGIN-DEV-RULES-001`):
The rule wants 3 breakpoints (640/1024/1440). Free emits 8 distinct: `480, 600, 640, 782, 900, 960, 1024, 1700`.

| Breakpoint | Purpose |
|---|---|
| 480px | Card → stack at small mobile |
| 600px | wp-admin default mobile breakpoint (not ours — inherited from WP admin CSS context) |
| 640px | Our canonical mobile breakpoint (per v2 token system) |
| 782px | wp-admin tablet/desktop transition (inherited from WP admin) |
| 900px / 960px | dashboard sidebar collapse (legacy — could consolidate to 1024) |
| 1024px | Our canonical tablet/desktop breakpoint |
| 1700px | Featured carousel wide-screen tweak |

**Classification:** half false-positive (482, 782 are WP-admin contexts we can't control), half real (900/960 + 1700 are component-local fixes that should snap to canonical breakpoints).

**Action:** schedule a follow-up commit to consolidate the 900px / 960px / 1700px to either 1024px or 1440px. ~30 min.

### Low severity (15) — tap-target sizing in admin CSS

15 buttons across admin CSS files measure 14-34px height. WordPress admin context — where button heights are constrained by WP-admin's own button conventions (default 28-30px) — typically can't hit 40px. These are wp-admin compatibility, not customer-facing buttons.

**Classification:** false-positive in admin context. Real for any frontend button (none flagged on frontend CSS).

**Action:** none — admin button heights conform to wp-admin convention. Document as known-limitation.

---

## rest-js-contract — clean

6 checks pass. No JS reads a key that PHP doesn't return. Refactor introduced 0 regressions.

---

## wiring-completeness — 3 known false-positives

All 3 high-severity findings are **service-layer reads** that the wppqa rule (which only inspects `templates/` for consumers) cannot detect:

| Setting | Reader (verified) | Real or FP |
|---|---|---|
| `listora_duplicate_filter` | `class-listing-columns.php` itself uses it in the admin list-table filter dropdown logic — not a template setting | FALSE POSITIVE — admin-only filter, no template read needed |
| `license_key` | Pro reads this option directly via service layer; not a template setting | FALSE POSITIVE — Pro service consumer, not template |
| `retention_days` | `class-email-log.php` retention cron uses this directly; not a template setting | FALSE POSITIVE — service-layer reader |

**Classification:** all 3 are known wppqa rule limitations (template-only consumer scan). These have been classified the same way in the 2026-05-07 and 2026-05-08 baselines. Recommend wppqa rule enhancement to also scan `includes/` for service-layer readers.

**Action:** none — historic classification carries forward.

---

## Delta vs prior baseline (2026-05-08)

| Metric | 2026-05-08 | 2026-05-11 | Change |
|---|---|---|---|
| plugin-dev-rules pass | 9 | 9 | unchanged |
| plugin-dev-rules warnings | (not tracked separately) | 16 | introduced visibility (warnings were always present, baseline now records them) |
| rest-js-contract pass | 6 | 6 | unchanged |
| wiring-completeness pass | 5 | 5 | unchanged |
| wiring-completeness false-positives | 3 | 3 | unchanged |
| **Release blockers** | **0** | **0** | unchanged |

The frontend refactor (Phases 0-4.5, 14 commits, 1700+ token migrations) introduced **zero new wppqa findings**. The plugin's static-analysis profile is identical pre-refactor vs post-refactor.

---

## Recommendations

1. **Consolidate breakpoints** (medium): converge `900px`, `960px`, `1700px` to canonical 1024px or 1440px. 30 min.
2. **Document admin tap-target exception**: wp-admin button conventions take precedence over the 40px frontend rule in admin context. One-line addition to CLAUDE.md.
3. **Service-layer wiring scan**: file a wppqa enhancement to inspect `includes/` for service-layer setting readers, reducing false-positive volume. Separate project — not on the wb-listora critical path.

No release blockers. No regressions from the refactor. Plugin is in stable, clean state.