Root causes identified and fixed:
1. Missing salts in bootstrap: derive_encryption_key() returned '' (no 32-byte
key) because AUTH_KEY/SECURE_AUTH_KEY were undefined. All crypto group tests
in KeyStoreTest failed as a result. Fix: define AUTH_KEY + SECURE_AUTH_KEY
in tests/bootstrap.php with deterministic 64-char test salts.
2. PHP constant mid-run redefinition: ConfigVersionTest.setUp() defined
PRV_OPENROUTER_API_KEY='sk-or-test-key', which bled into KeyStoreTest
(runs after ConfigVersionTest alphabetically). Same constant was defined in
5 test classes (ConfigVersion, ProbeRunner, ProjectedCost, RunLock, Uninstall).
Fix: define PRV_OPENROUTER_API_KEY once in bootstrap; remove per-class defines.
Update KeyStoreTest expectations to reflect constant-is-always-set reality:
get_source() => SOURCE_CONSTANT, get_key() => 'sk-or-test-key'.
3. Remaining @runInSeparateProcess complexity: CaptureWriterTest sentinel test
was using @runInSeparateProcess to avoid constant bleed, but that caused
error_log() calls inside the executor to surface as PHPUnit\Framework\Exception
in the child process output. Now that constant is defined in bootstrap, the
sentinel test runs in the main process and just asserts 'sk-or-test-key'
doesn't appear in stored rows (equivalent P0 security coverage).
4. DashboardPanelTest collector calls get_results() twice (trendline + standings).
The wpdb stub returned the same array for both calls; the second call expected
peptide_slug keys but got trendline keys, causing 'Undefined array key' error.
Fix: add wpdb_results_queue support to the stub (shifts one result set per
call when queue is non-empty); update collector tests to use the queue.
Agent-Session: claude/adopt-ci-20260616
Adds PRV_Cron_Guard hooked on init to re-schedule managed cron hooks when missing after rsync deploys. Delegates to PRV_Cron::schedule() and PRV_Prune_Cron::schedule(). Idempotent. Two wp_next_scheduled() reads per request; no DB writes unless event missing.
Per-call recording of cost and I/O for every LLM probe. New tables prv_call_meta (schema v3) and prv_call_io. New admin pages: Costs (spend drill-down vs $5 cap) and Call Log (paginated + detail drawer). 90-day I/O retention prune via prv_daily_prune cron. P0 security: key never stored; gateway client exposes HTTP status only.
QA APPROVED 2026-06-15 SHA 09dc6db9ce
Squash-merge PR #6: PR Vision v0.2.3 — UI-editable encrypted provider API key
QA APPROVED: 2026-06-14-85956da7c86bed2c9e2cf60625fda0cf2e9518bb.md
All 5 CI checks green on head SHA 85956da7c8
Rename to PR Vision (PRV_/pr-vision); fix www-strip char-mask in competitor display (str_starts_with); make PHPCS a CI gate; remove dead in-run cache.
QA: APPROVE — qa-reviews/pr-vision/2026-06-13-c633fdb9e1541386a713a6de12d2ee2ae4239640.md
Agent-Session: pr-vision rename v0.1.1 merge
