feat(images): retry Cloudflare NSFW-blocked prompts with a sanitized fallback

Cloudflare's Workers AI FLUX.1 schnell content filter sometimes rejects
peptide-comic prompts as NSFW (HTTP 400, errors[].code === 3030). On
2026-04-20 this produced a silent publish-without-featured-image for
post #650 ("Semaglutide vs Tirzepatide") — the LLM-rewritten scene
tripped the filter and we had no recovery path.

New behaviour: on a 3030 response, the Cloudflare provider throws a
typed PRAutoBlogger_Image_NSFW_Blocked exception. The batch wrapper
catches it and tags the per-slot result with
`error_type: nsfw_blocked`. Image_Pipeline hands the results to a new
PRAutoBlogger_Image_NSFW_Retry helper, which reruns the blocked slot
once with a sanitized fallback prompt (title + style suffix, no LLM
rewrite). On success the retry result replaces the error entry; on a
second block, a WARNING is logged and the pipeline publishes without
that image — same terminal behaviour we had before, just explicit.

Files:

- New providers/class-image-nsfw-blocked.php — typed exception.
- providers/class-cloudflare-image-support.php — is_nsfw_error() +
  throw_if_nsfw() helpers.
- providers/class-cloudflare-image-provider.php — calls throw_if_nsfw
  inside the 4xx branch; batch catches the typed exception and marks
  the result with error_type.
- core/class-image-prompt-builder.php — new public build_fallback_prompt
  shim so the retry layer can reach the rule-based fallback without
  going through the LLM path.
- New core/class-image-nsfw-retry.php — single-shot retry helper.
- core/class-image-pipeline.php — invokes the retry between batch
  completion and per-slot processing.
- admin/class-settings-fields-extended.php — new toggle
  `prautoblogger_image_nsfw_retry` (default on) in the Images section.

Tests:

- CloudflareImageProviderTest — 3030 response throws NSFW exception;
  batch tags the per-slot result with `error_type: nsfw_blocked`.
- ImagePipelineTest — retry succeeds when provider returns a good
  result on the second call; retry is skipped when the setting is off.

Cost impact: worst-case an extra Cloudflare call per NSFW-blocked slot
(~$0.000834). Current incidence ~2% of generations; ~+$0.00002 per
generation amortized. Immaterial.

Uninstall: new option covered by the existing prautoblogger_% LIKE
sweep in uninstall.php.

Part of the v0.8.0 image bundle (issues from thread image-mime-bug).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

includes/providers/class-cloudflare-image-provider.php

@@ -136,6 +136,7 @@ class PRAutoBlogger_Cloudflare_Image_Provider implements PRAutoBlogger_Image_Pro
 
 			if ( $status >= 400 ) {
 				$this->support->log_client_error( $status, $api_token, $account_id, $raw );
+				$this->support->throw_if_nsfw( $raw );
 				throw new \RuntimeException(
 					sprintf(
 						/* translators: %1$d: HTTP status, %2$s: error body. */
@@ -183,12 +184,10 @@ class PRAutoBlogger_Cloudflare_Image_Provider implements PRAutoBlogger_Image_Pro
 		$results = [];
 		foreach ( $requests as $key => $req ) {
 			try {
-				$results[ $key ] = $this->generate_image(
-					$req['prompt'],
-					$req['width'],
-					$req['height'],
-					$req['options'] ?? []
-				);
+				$results[ $key ] = $this->generate_image( $req['prompt'], $req['width'], $req['height'], $req['options'] ?? [] );
+			} catch ( PRAutoBlogger_Image_NSFW_Blocked $e ) {
+				// Tag NSFW so the pipeline's retry layer can rebuild the prompt.
+				$results[ $key ] = [ 'error' => $e->getMessage(), 'error_type' => 'nsfw_blocked' ];
 			} catch ( \Throwable $e ) {
 				$results[ $key ] = [ 'error' => $e->getMessage() ];
 			}

includes/providers/class-cloudflare-image-support.php

@@ -111,4 +111,62 @@ class PRAutoBlogger_Cloudflare_Image_Support {
 			'cloudflare-image'
 		);
 	}
+
+	/**
+	 * Cloudflare Workers AI error code for NSFW content rejection.
+	 *
+	 * Observed on FLUX.1 schnell on 2026-04-20 when backfilling the post
+	 * "Semaglutide vs Tirzepatide". Documented upstream as
+	 * `AiError: Input prompt contains NSFW content.`
+	 */
+	public const ERROR_CODE_NSFW = 3030;
+
+	/**
+	 * Return true when the Cloudflare response body contains the NSFW
+	 * content-filter error code (3030).
+	 *
+	 * The body shape is `{"errors":[{"code":3030,"message":"..."}],...}`.
+	 * Parsing is tolerant: any JSON decode failure or missing key returns
+	 * false, so a malformed 4xx never masquerades as NSFW.
+	 *
+	 * @param string $raw Raw response body from Cloudflare.
+	 * @return bool True when at least one error entry carries code 3030.
+	 */
+	public function is_nsfw_error( string $raw ): bool {
+		$decoded = json_decode( $raw, true );
+		if ( ! is_array( $decoded ) || empty( $decoded['errors'] ) || ! is_array( $decoded['errors'] ) ) {
+			return false;
+		}
+		foreach ( $decoded['errors'] as $err ) {
+			if ( is_array( $err ) && (int) ( $err['code'] ?? 0 ) === self::ERROR_CODE_NSFW ) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+	/**
+	 * Throw a typed NSFW exception when the response body signals CF's
+	 * content-filter rejection (code 3030). No-op otherwise.
+	 *
+	 * Centralised so callers stay at one line at the call site and so the
+	 * exception-construction shape can't drift between call sites.
+	 *
+	 * @param string $raw Raw response body.
+	 * @return void
+	 * @throws PRAutoBlogger_Image_NSFW_Blocked When the body contains code 3030.
+	 */
+	public function throw_if_nsfw( string $raw ): void {
+		if ( ! $this->is_nsfw_error( $raw ) ) {
+			return;
+		}
+		throw new PRAutoBlogger_Image_NSFW_Blocked(
+			sprintf(
+				/* translators: %s: truncated error body. */
+				esc_html__( 'Cloudflare Workers AI rejected the prompt as NSFW: %s', 'prautoblogger' ),
+				esc_html( substr( $raw, 0, 300 ) )
+			),
+			$raw
+		);
+	}
 }

includes/providers/class-image-nsfw-blocked.php

@@ -0,0 +1,45 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Exception raised when an image provider rejects a prompt as NSFW.
+ *
+ * Cloudflare Workers AI returns HTTP 400 with an `errors[].code === 3030`
+ * body when its content filter blocks a prompt. We catch that shape in
+ * the provider and raise this typed exception so the image pipeline can
+ * distinguish a content-filter rejection from a generic 4xx and retry
+ * once with a sanitized fallback prompt.
+ *
+ * Triggered by: PRAutoBlogger_Cloudflare_Image_Provider on NSFW 4xx.
+ * Dependencies: None.
+ *
+ * @see providers/class-cloudflare-image-provider.php — Raises this.
+ * @see core/class-image-nsfw-retry.php               — Catches + rebuilds prompt.
+ * @see https://developers.cloudflare.com/workers-ai/models/flux-1-schnell/ — Upstream error codes.
+ */
+class PRAutoBlogger_Image_NSFW_Blocked extends \RuntimeException {
+
+	/**
+	 * The raw upstream response body, kept verbatim for log forensics.
+	 *
+	 * @var string
+	 */
+	private string $upstream_body;
+
+	/**
+	 * @param string          $message       Human-readable summary.
+	 * @param string          $upstream_body Raw response body from the provider.
+	 * @param \Throwable|null $previous      Optional previous exception.
+	 */
+	public function __construct( string $message, string $upstream_body = '', ?\Throwable $previous = null ) {
+		parent::__construct( $message, 0, $previous );
+		$this->upstream_body = $upstream_body;
+	}
+
+	/**
+	 * @return string Raw upstream body (may be empty).
+	 */
+	public function get_upstream_body(): string {
+		return $this->upstream_body;
+	}
+}