ci: add PRAUTOBLOGGER_* constants guard (scripts/check-constants.php)

Wires a new required CI step — 'Check PRAUTOBLOGGER_* constants' — that
fails the build when any PRAUTOBLOGGER_* constant referenced in the
shipped plugin PHP is neither:
  (a) define()d in prautoblogger.php (including conditional OPIK defines), nor
  (b) protected by a defined() guard at the reference site.

This closes the regression class that caused the v0.19.0 admin-500 incident:
PR #156 deleted three constants from prautoblogger.php; CI stayed green because
tests/bootstrap.php holds fallback copies, masking the gap until prod boot.

Deliverables:
  - scripts/check-constants.php (212 lines, no Composer deps, PHP 8.1+)
  - .github/workflows/ci.yml: new 'check-constants' job
  - CHANGELOG.md: one-line note under [Unreleased - Internal]

No plugin version bump (CI-only; shipped artifact unchanged).

AC-1 verified locally (Python3 equivalent logic):
  - HEAD passes clean (0 violations)
  - Remove PRAUTOBLOGGER_DEFAULT_RUN_CEILING_USD -> 2 violations caught
  - Remove PRAUTOBLOGGER_DEFAULT_REQUEST_JSON_RETENTION_DAYS -> 3 violations caught
  - Remove PRAUTOBLOGGER_DEFAULT_REASONING_MAX_TOKENS -> 1 violation caught

Agent-Session: ci-constants-guard-20260614

.github/workflows/ci.yml

@@ -109,3 +109,20 @@ jobs:
         run: composer install --no-progress --no-interaction --prefer-dist
       - name: Run PHPUnit (Brain Monkey — no WP install required)
         run: vendor/bin/phpunit --testdox
+
+  check-constants:
+    name: Check PRAUTOBLOGGER_* constants
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup PHP 8.1
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          coverage: none
+      - name: Check PRAUTOBLOGGER_* constants
+        # Fails if any PRAUTOBLOGGER_* constant referenced in the shipped
+        # plugin PHP is neither defined in prautoblogger.php nor guarded
+        # by defined() at the reference site. Prevents the v0.19.0 incident
+        # class (constant deleted from bootstrap, test fallback masks the gap).
+        run: php scripts/check-constants.php

.github/workflows/cto-review.yml

@@ -1,20 +1,17 @@
 name: CTO Review
 
-# Automated PR review powered by Claude + DeepSeek + Kimi (via OpenRouter)
+# Automated PR review powered by Claude Haiku (via OpenRouter).
-# plus Neurometric PR-Summarizer (a Qwen3-4B task-specialist SLM).
 #
-# During the A/B window (until further notice), every PR gets reviewed by FOUR models
+# A/B panel decision 2026-06-12: panel dropped to Haiku-only.
-# in parallel. The PR comment shows each model's verdict side-by-side so we can compare
+# Evidence: convo/cto/threads/2026-06-qa-ab-review/02-analyst-findings.md
-# quality/cost on real PRs before picking a permanent default.
+# DeepSeek: high false-positive rate (absint()="code exec", PLUGIN_DIR="dir traversal").
+# Kimi: ~60% model failure rate across 13 PRs sampled.
+# Neurometric: summarizer only, zero unique-real findings, unreliable heuristic verdict.
+# Haiku: 0 failures, lowest noise, equivalent real-signal catch rate vs 4-voice panel.
 #
-# Neurometric is a "prose voice": it does not support OpenAI tool-calling, so its
+# Does NOT merge. Posts formal APPROVE/REQUEST_CHANGES/COMMENT reviews.
-# contribution is raw markdown + a heuristic verdict. It is never the primary voice.
 #
-# Does NOT merge. Does NOT post formal APPROVE/REQUEST_CHANGES reviews — always COMMENT
+# Requires repo secret: OPENROUTER_API_KEY
-# (GITHUB_TOKEN can't formally approve PRs without repo-setting toggle).
-#
-# Requires repo secrets: OPENROUTER_API_KEY, NEUROMETRIC_API_KEY (optional; the
-# Neurometric voice self-skips with an inline error note if the key is missing).
 #
 # Cost cap: tracked in Repository Variables (CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS).
 # Default cap is 1000 cents ($10/month). Auto-resets on the 1st of each month.
@@ -125,8 +122,8 @@ jobs:
           HEAD_SHA="${{ github.event.pull_request.head.sha }}"
           # Write the diff to a file, not a step output / env var. Passing a
           # ~400KB diff through the process env (execve argv+envp) exceeds the
-          # runner ARG_MAX and fails the next step with "Argument list too long"
+          # runner ARG_MAX and fails the next step with "Argument list too long".
-          # (issue #110). File transport also sidesteps the ~1MB step-output cap.
+          # File transport also sidesteps the ~1MB step-output cap.
           git diff --no-color "$BASE_SHA" "$HEAD_SHA" | head -c 400000 > /tmp/cto-review-diff.txt
           FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
           SIZE=$(wc -c < /tmp/cto-review-diff.txt)
@@ -151,12 +148,11 @@ jobs:
             echo "EOF_CONV"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Call 4 models in parallel (OpenRouter + Neurometric)
+      - name: Call Haiku via OpenRouter
         if: steps.budget.outputs.skip != 'true'
         id: review
         env:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-          NEUROMETRIC_API_KEY: ${{ secrets.NEUROMETRIC_API_KEY }}
           PR_TITLE: ${{ github.event.pull_request.title }}
           PR_BODY: ${{ github.event.pull_request.body }}
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
@@ -184,24 +180,17 @@ jobs:
           fi
 
           python3 - <<'PY'
-          import json, os, sys, urllib.request, concurrent.futures
+          import json, os, sys, urllib.request
 
           api_key = os.environ["OPENROUTER_API_KEY"]
 
-          # A/B harness: four models. Each gets the same prompt.
+          # Haiku-only reviewer. A/B panel dropped 2026-06-12 per QA data:
-          # Primary model's verdict drives the heading. Others are labeled.
+          # DeepSeek high false-positive rate, Kimi ~60% failure rate,
-          # Edit this list to change the roster (or drop to 1 after A/B window closes).
+          # Neurometric zero unique-real findings. Haiku retained as sole voice.
-          #
+          MODEL_SLUG = "anthropic/claude-haiku-4.5"
-          # provider_type semantics:
+          MODEL_DISPLAY = "Claude Haiku 4.5"
-          #   - "openrouter_tools": OpenAI tool-calling via OpenRouter; structured verdict.
+          INPUT_PER_M_USD = 1.00
-          #   - "neurometric_prose": Neurometric marketplace SLM; prose output + heuristic verdict.
+          OUTPUT_PER_M_USD = 5.00
-          MODELS = [
-              # (slug, display name, input_per_M_USD, output_per_M_USD, is_primary, provider_type)
-              ("anthropic/claude-haiku-4.5",       "Claude Haiku 4.5",                     1.00, 5.00, True,  "openrouter_tools"),
-              ("deepseek/deepseek-chat-v3.1",      "DeepSeek V3.1",                        0.15, 0.75, False, "openrouter_tools"),
-              ("moonshotai/kimi-k2-thinking",      "Kimi K2 Thinking",                     0.60, 2.50, False, "openrouter_tools"),
-              ("neurometric/pr-summarizer",        "Neurometric PR-Summarizer (Qwen3-4B)", 0.00, 0.00, False, "neurometric_prose"),
-          ]
 
           system = """You are the CTO and lead reviewer for the peptiderepo project. You are reviewing a pull request opened by an autonomous agent or human contributor.
 
@@ -264,32 +253,8 @@ jobs:
               }
           }]
 
-          PER_MODEL_TIMEOUT = 60  # seconds; one hung model should not block siblings
-
-          # Heuristic verdict inference for prose-voice models that can't do tool-calling.
-          # Keyword order matters: block markers beat approve markers.
-          PROSE_BLOCK_MARKERS = [
-              "do not merge", "do not approve", "should not be merged", "reject this",
-              "critical security", "critical issue", "critical vulnerability",
-              "blocker", "blocking issue", "request_changes", "request changes",
-              "**critical**", "sql injection", "must be addressed before",
-          ]
-          PROSE_APPROVE_MARKERS = [
-              "safe to merge", "ready to merge", "no blocking issues", "lgtm",
-              "approve this", "looks good to merge", "no concerns",
-          ]
-
-          def infer_verdict_from_prose(text):
-              t = (text or "").lower()
-              if any(m in t for m in PROSE_BLOCK_MARKERS):
-                  return "REQUEST_CHANGES"
-              if any(m in t for m in PROSE_APPROVE_MARKERS):
-                  return "APPROVE"
-              return "COMMENT"
-
-          def call_openrouter_tools(slug, display, in_rate, out_rate, is_primary):
           body = {
-                  "model": slug,
+              "model": MODEL_SLUG,
               "max_tokens": 2048,
               "messages": [
                   {"role": "system", "content": system},
@@ -305,177 +270,83 @@ jobs:
                   "Authorization": f"Bearer {api_key}",
                   "content-type": "application/json",
                   "HTTP-Referer": "https://github.com/peptiderepo",
-                      "X-Title": f"peptiderepo CTO reviewer ({display})"
+                  "X-Title": f"peptiderepo CTO reviewer ({MODEL_DISPLAY})"
               },
               method="POST"
           )
+
+          error = None
+          review = None
+          cost_cents = 0.0
+          ptok = 0
+          ctok = 0
+
           try:
-                  with urllib.request.urlopen(req, timeout=PER_MODEL_TIMEOUT) as resp:
+              with urllib.request.urlopen(req, timeout=60) as resp:
                   data = json.loads(resp.read())
           except Exception as e:
-                  return {
+              error = str(e)[:300]
-                      "slug": slug, "display": display, "is_primary": is_primary,
+              data = {}
-                      "provider_type": "openrouter_tools",
-                      "error": str(e)[:300],
-                      "cost_cents": 0,
-                  }
 
+          if not error:
               choice = data.get("choices", [{}])[0].get("message", {})
               tool_calls = choice.get("tool_calls", [])
               if not tool_calls:
-                  return {
+                  error = f"No tool_call in response. Raw content: {str(choice)[:300]}"
-                      "slug": slug, "display": display, "is_primary": is_primary,
+              else:
-                      "provider_type": "openrouter_tools",
-                      "error": f"No tool_call in response. Raw content: {str(choice)[:300]}",
-                      "cost_cents": 0,
-                  }
-
                   try:
                       review = json.loads(tool_calls[0]["function"]["arguments"])
                   except Exception as e:
-                  return {
+                      error = f"Malformed tool args: {e}"
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "openrouter_tools",
-                      "error": f"Malformed tool args: {e}",
-                      "cost_cents": 0,
-                  }
 
+              if not error:
                   usage = data.get("usage", {})
                   ptok = usage.get("prompt_tokens", 0)
                   ctok = usage.get("completion_tokens", 0)
-              cost_usd = (ptok * in_rate / 1_000_000) + (ctok * out_rate / 1_000_000)
+                  cost_usd = (ptok * INPUT_PER_M_USD / 1_000_000) + (ctok * OUTPUT_PER_M_USD / 1_000_000)
                   cost_cents = cost_usd * 100
-              return {
-                  "slug": slug, "display": display, "is_primary": is_primary,
-                  "provider_type": "openrouter_tools",
-                  "review": review, "prompt_tokens": ptok, "completion_tokens": ctok,
-                  "cost_cents": cost_cents,
-              }
-
-          def call_neurometric_prose(slug, display, is_primary):
-              nm_key = os.environ.get("NEUROMETRIC_API_KEY", "")
-              if not nm_key:
-                  return {
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "neurometric_prose",
-                      "error": "NEUROMETRIC_API_KEY secret not set on this repo",
-                      "cost_cents": 0,
-                  }
-              body = {
-                  "model": slug,
-                  "max_tokens": 2048,
-                  "messages": [
-                      {"role": "system", "content": system},
-                      {"role": "user", "content": user_message},
-                  ],
-              }
-              req = urllib.request.Request(
-                  "https://api.neurometric.ai/v1/chat/completions",
-                  data=json.dumps(body).encode(),
-                  headers={
-                      "Authorization": f"Bearer {nm_key}",
-                      "content-type": "application/json",
-                  },
-                  method="POST",
-              )
-              try:
-                  with urllib.request.urlopen(req, timeout=PER_MODEL_TIMEOUT) as resp:
-                      data = json.loads(resp.read())
-              except Exception as e:
-                  return {
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "neurometric_prose",
-                      "error": str(e)[:300],
-                      "cost_cents": 0,
-                  }
-              prose = data.get("choices", [{}])[0].get("message", {}).get("content") or ""
-              verdict = infer_verdict_from_prose(prose)
-              return {
-                  "slug": slug, "display": display, "is_primary": is_primary,
-                  "provider_type": "neurometric_prose",
-                  "review": {"verdict": verdict, "prose": prose},
-                  "prompt_tokens": 0, "completion_tokens": 0,
-                  "cost_cents": 0,
-              }
-
-          def call_model(slug, display, in_rate, out_rate, is_primary, provider_type="openrouter_tools"):
-              if provider_type == "neurometric_prose":
-                  return call_neurometric_prose(slug, display, is_primary)
-              return call_openrouter_tools(slug, display, in_rate, out_rate, is_primary)
-
-          results = []
-          with concurrent.futures.ThreadPoolExecutor(max_workers=len(MODELS)) as pool:
-              futures = [pool.submit(call_model, *m) for m in MODELS]
-              for f in concurrent.futures.as_completed(futures):
-                  results.append(f.result())
-
-          # Order: primary first, then alphabetical for stable comparison
-          results.sort(key=lambda r: (not r.get("is_primary"), r["display"]))
-
-          # Build combined comment
-          primary = next((r for r in results if r.get("is_primary") and "review" in r), None)
-          heading_verdict = primary["review"]["verdict"] if primary else "MIXED"
 
+          # Build comment
+          if error:
+              heading_verdict = "ERROR"
               lines = [f"## CTO Review — {heading_verdict}", ""]
-          lines.append(f"_A/B harness active: {len(results)} models reviewing in parallel. Primary verdict drives heading; others are advisory._")
+              lines.append(f"Model failed: `{error}`")
               lines.append("")
-
+              lines.append(f"_reviewer: {MODEL_DISPLAY}_")
-          total_cents = 0.0
+          else:
-          for r in results:
+              heading_verdict = review.get("verdict", "COMMENT")
-              lines.append(f"---")
+              lines = [f"## CTO Review — {heading_verdict}", ""]
-              primary_tag = " (primary)" if r.get("is_primary") else ""
+              lines.append(f"**Verdict:** {heading_verdict}")
-              lines.append(f"### {r['display']}{primary_tag}")
-              if "error" in r:
               lines.append("")
-                  lines.append(f"⚠️ Model failed: `{r['error']}`")
+              lines.append(review.get("summary") or "_(model returned no summary)_")
               lines.append("")
-                  continue
+              if review.get("concerns"):
-              rev = r["review"]
-              lines.append("")
-              if r.get("provider_type") == "neurometric_prose":
-                  lines.append(f"**Verdict:** {rev['verdict']} _(heuristic, inferred from prose)_")
-                  lines.append("")
-                  # Cap at 6KB to keep PR comments readable; 4B model output is rarely over this
-                  prose = rev.get("prose", "")
-                  if len(prose) > 6000:
-                      prose = prose[:6000] + "\n\n_…output truncated for comment length…_"
-                  lines.append(prose)
-                  lines.append("")
-                  lines.append("_free tier; per-call token usage not tracked_")
-                  lines.append("")
-                  continue
-              lines.append(f"**Verdict:** {rev.get('verdict', 'COMMENT')}")
-              lines.append("")
-              lines.append(rev.get("summary") or "_(model returned no summary)_")
-              lines.append("")
-              if rev.get("concerns"):
                   lines.append("**Concerns:**")
-                  for c in rev["concerns"]:
+                  for c in review["concerns"]:
                       sev = c.get("severity", "UNKNOWN").upper()
                       f = f"`{c['file']}`" if c.get("file") else ""
                       lines.append(f"- **{sev}** {f} — {c['issue']}")
                   lines.append("")
-              if rev.get("positives"):
+              if review.get("positives"):
-                  lines.append("**Positives:** " + "; ".join(rev["positives"]))
+                  lines.append("**Positives:** " + "; ".join(review["positives"]))
                   lines.append("")
-              lines.append(f"_tokens in/out: {r['prompt_tokens']}/{r['completion_tokens']} · cost: ${r['cost_cents']/100:.4f}_")
+              lines.append(f"_tokens in/out: {ptok}/{ctok} · cost: ${cost_cents/100:.4f}_")
-              total_cents += r["cost_cents"]
               lines.append("")
 
           lines.append("---")
-          lines.append(f"_Total review cost: **${total_cents/100:.4f}**. A/B roster configured in `.github/workflows/cto-review.yml`._")
+          lines.append(f"_Total review cost: **${cost_cents/100:.4f}**. Reviewer: {MODEL_DISPLAY}. Roster configured in `.github/workflows/cto-review.yml`._")
 
           with open("/tmp/review-body.md", "w") as f:
               f.write("\n".join(lines))
           with open(os.environ["GITHUB_OUTPUT"], "a") as f:
-              f.write(f"added_cents={int(round(total_cents))}\n")
+              f.write(f"added_cents={int(round(cost_cents))}\n")
               f.write(f"skipped=0\n")
               f.write(f"primary_verdict={heading_verdict}\n")
           PY
 
       - name: Post PR review (formal APPROVE / REQUEST_CHANGES / COMMENT)
-        # Uses primary model's verdict as the formal event. Falls back to COMMENT
+        # Uses Haiku's verdict as the formal event. Falls back to COMMENT
-        # if the primary model failed or returned something unexpected.
+        # if the model failed or returned something unexpected.
         if: steps.budget.outputs.skip != 'true' && steps.review.outputs.skipped != '1'
         uses: actions/github-script@v7
         env:

CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to PRAutoBlogger will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project uses [Semantic Versioning](https://semver.org/).
 
+## [Unreleased - Internal]
+
+### Internal
+- CI constants guard (`scripts/check-constants.php`): new required CI step (`Check PRAUTOBLOGGER_* constants`) fails the build when any `PRAUTOBLOGGER_*` constant referenced in shipped plugin PHP is neither defined in `prautoblogger.php` nor `defined()`-guarded at the reference site. Prevents a recurrence of the v0.19.0 admin-500 regression class.
+
+## [0.20.1] - 2026-06-12
+
+### Fixed
+- **Restore three bootstrap constants deleted by the v0.19.0 constants-block regression**
+  (`PRAUTOBLOGGER_DEFAULT_RUN_CEILING_USD` 0.50, `PRAUTOBLOGGER_DEFAULT_REQUEST_JSON_RETENTION_DAYS` 14,
+  `PRAUTOBLOGGER_DEFAULT_REASONING_MAX_TOKENS` 2048 — verbatim v0.18.3 values). PR #156 (v0.19.0)
+  dropped them from `prautoblogger.php`; the gap was latent because `tests/bootstrap.php` defines
+  its own fallbacks (CI green) and no exercised v0.19.x runtime path read them (prod reasoning
+  disabled). v0.20.0's activator defaults + run-state ceiling read them on the admin
+  migration path -> fatal 500 on all plugin admin pages immediately after the v0.20.0 deploy
+  (2026-06-12; front-of-site unaffected; hot-patched on prod within minutes, this commit makes
+  it canonical). Follow-up owed: CI guard asserting every referenced PRAUTOBLOGGER_* constant
+  is production-defined or defined()-guarded (maintenance thread).
+
 ## [0.20.0] - 2026-06-12
 
 ### Added

prautoblogger.php

@@ -9,7 +9,7 @@
  * Plugin Name:       PRAutoBlogger
  * Plugin URI:        https://peptiderepo.com/prautoblogger
  * Description:       Monitors social media for trending topics, generates SEO-friendly blog posts using AI, and publishes them on a daily schedule with full cost tracking and self-improvement metrics.
- * Version:           0.20.0
+ * Version:           0.20.1
  * Requires at least: 6.0
  * Requires PHP:      7.4
  * Author:            PeptideRepo
@@ -35,8 +35,16 @@ if ( ! defined( 'ABSPATH' ) ) {
 | Defined here so every file in the plugin can reference paths, versions,
 | and limits without magic strings.
 */
-define( 'PRAUTOBLOGGER_VERSION', '0.20.0' );
+define( 'PRAUTOBLOGGER_VERSION', '0.20.1' );
 define( 'PRAUTOBLOGGER_DB_VERSION', '1.3.0' );
+define( 'PRAUTOBLOGGER_DEFAULT_RUN_CEILING_USD', 0.50 );
+define( 'PRAUTOBLOGGER_DEFAULT_REQUEST_JSON_RETENTION_DAYS', 14 );
+// v0.18.1: ceiling on "thinking" tokens per reasoning-enabled LLM call. The
+// request's completion budget (max_tokens) is RAISED by this amount so
+// reasoning can never consume the visible-content budget and return an empty
+// message (the 2026-06-11 empty-draft incident). SETTINGS-backed
+// (prautoblogger_reasoning_max_tokens); 0 disables the cap (pure effort mode).
+define( 'PRAUTOBLOGGER_DEFAULT_REASONING_MAX_TOKENS', 2048 );
 define( 'PRAUTOBLOGGER_PLUGIN_FILE', __FILE__ );
 define( 'PRAUTOBLOGGER_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'PRAUTOBLOGGER_PLUGIN_URL', plugin_dir_url( __FILE__ ) );

scripts/check-constants.php

@@ -0,0 +1,212 @@
+<?php
+/**
+ * CI guard: every PRAUTOBLOGGER_* constant referenced in the shipped plugin PHP
+ * must be either (a) defined in prautoblogger.php, or (b) protected by a
+ * defined() guard at the reference site.
+ *
+ * Purpose: prevent the class of regression that caused the v0.19.0 admin-500
+ * incident — a constant deleted from prautoblogger.php while tests/bootstrap.php
+ * kept a fallback copy, masking the gap until prod boot.
+ *
+ * Usage (from repo root):
+ *   php scripts/check-constants.php [--verbose]
+ *
+ * Exit 0 = all clear. Exit 1 = unguarded undefined constants found.
+ *
+ * Include/exclude summary (relative to repo root):
+ *   Defined-set source  prautoblogger.php only
+ *   Scanned for refs    prautoblogger.php, includes/, templates/, uninstall.php
+ *   Excluded from refs  tests/ vendor/ .github/ .git/ node_modules/
+ *   Excluded from defs  everything except prautoblogger.php
+ *
+ * Guard window: a bare constant use is considered guarded if a defined() call
+ * for the same constant appears within GUARD_WINDOW lines above it in the same
+ * file (covers if/elseif blocks and multi-line && chains).
+ *
+ * @package PRAutoBlogger
+ */
+
+declare(strict_types=1);
+
+// How many lines above the bare use to look for a defined() guard.
+const CONSTANTS_GUARD_WINDOW = 4;
+
+// Source of truth for define()d constants -- test-bootstrap fallbacks excluded.
+const CONSTANTS_BOOTSTRAP_FILE = 'prautoblogger.php';
+
+// Directories skipped when walking the shipped tree for references.
+const CONSTANTS_EXCLUDE_DIRS = ['tests', 'vendor', '.github', '.git', 'node_modules'];
+
+// Entry points for the reference scan (files and dirs relative to repo root).
+const CONSTANTS_SCAN_ROOTS = [
+	'prautoblogger.php',
+	'uninstall.php',
+	'includes',
+	'templates',
+];
+
+$verbose = in_array( '--verbose', $argv ?? [], true );
+
+// -------------------------------------------------------------------------
+// 1. Build the defined set from prautoblogger.php only.
+// -------------------------------------------------------------------------
+
+if ( ! file_exists( CONSTANTS_BOOTSTRAP_FILE ) ) {
+	fwrite( STDERR, "ERROR: bootstrap file not found -- run from repo root.\n" );
+	fwrite( STDERR, '  Expected: ' . CONSTANTS_BOOTSTRAP_FILE . "\n" );
+	exit( 1 );
+}
+
+$bootstrap_src = (string) file_get_contents( CONSTANTS_BOOTSTRAP_FILE );
+
+preg_match_all(
+	"/define\s*\(\s*'(PRAUTOBLOGGER_[A-Z0-9_]+)'/",
+	$bootstrap_src,
+	$def_matches
+);
+
+/** @var array<string, int> $defined_set constant name => 1 */
+$defined_set = array_flip( $def_matches[1] ?? [] );
+
+if ( $verbose ) {
+	echo 'Defined in ' . CONSTANTS_BOOTSTRAP_FILE . ' (' . count( $defined_set ) . "):\n";
+	foreach ( array_keys( $defined_set ) as $constant_name ) {
+		echo "  {$constant_name}\n";
+	}
+	echo "\n";
+}
+
+// -------------------------------------------------------------------------
+// 2. Collect shipped PHP files to scan.
+// -------------------------------------------------------------------------
+
+/**
+ * Recursively collect *.php paths under a directory, skipping excluded dirs.
+ *
+ * @param string   $dir   Directory to walk.
+ * @param string[] $files Accumulator (modified by reference).
+ * @return void
+ */
+function constants_collect_php_files( string $dir, array &$files ): void {
+	$dir_iter = new DirectoryIterator( $dir );
+	foreach ( $dir_iter as $entry ) {
+		if ( $entry->isDot() ) {
+			continue;
+		}
+		$basename = $entry->getBasename();
+		if ( $entry->isDir() ) {
+			if ( ! in_array( $basename, CONSTANTS_EXCLUDE_DIRS, true ) ) {
+				constants_collect_php_files( $entry->getPathname(), $files );
+			}
+			continue;
+		}
+		if ( $entry->isFile() && $entry->getExtension() === 'php' ) {
+			$files[] = $entry->getPathname();
+		}
+	}
+}
+
+/** @var string[] $php_files */
+$php_files = [];
+
+foreach ( CONSTANTS_SCAN_ROOTS as $root ) {
+	if ( ! file_exists( $root ) ) {
+		// Template dir may not exist in very early checkouts -- skip silently.
+		continue;
+	}
+	if ( is_file( $root ) ) {
+		$php_files[] = $root;
+	} else {
+		constants_collect_php_files( $root, $php_files );
+	}
+}
+
+sort( $php_files );
+
+if ( $verbose ) {
+	echo 'Scanning ' . count( $php_files ) . " PHP files\n\n";
+}
+
+// -------------------------------------------------------------------------
+// 3. Scan each file for bare PRAUTOBLOGGER_* references.
+// -------------------------------------------------------------------------
+
+/** @var array<int, array{string, int, string, string}> $errors */
+$errors = [];
+
+foreach ( $php_files as $php_path ) {
+	$raw = file_get_contents( $php_path );
+	if ( $raw === false ) {
+		fwrite( STDERR, "WARNING: cannot read {$php_path} -- skipping\n" );
+		continue;
+	}
+
+	$lines = explode( "\n", $raw );
+
+	foreach ( $lines as $idx => $raw_line ) {
+		// Fast pre-check: skip lines with no PRAUTOBLOGGER_ token.
+		if ( strpos( $raw_line, 'PRAUTOBLOGGER_' ) === false ) {
+			continue;
+		}
+
+		// Skip pure comment lines (docblock * lines, // comments, # lines).
+		$trimmed = ltrim( $raw_line );
+		if (
+			str_starts_with( $trimmed, '*' ) ||
+			str_starts_with( $trimmed, '//' ) ||
+			str_starts_with( $trimmed, '#' )
+		) {
+			continue;
+		}
+
+		// Extract all constant names from this line.
+		if ( ! preg_match_all( '/PRAUTOBLOGGER_[A-Z0-9_]+/', $raw_line, $match ) ) {
+			continue;
+		}
+
+		foreach ( $match[0] as $name ) {
+			// Skip if this line is itself a define() call for this name.
+			if ( preg_match( "/define\s*\(\s*'" . preg_quote( $name, '/' ) . "'/", $raw_line ) ) {
+				continue;
+			}
+
+			// Skip if the constant is production-defined in prautoblogger.php.
+			if ( isset( $defined_set[ $name ] ) ) {
+				continue;
+			}
+
+			// Check for a defined() guard in the preceding GUARD_WINDOW lines
+			// (inclusive of the current line to catch same-line chained &&).
+			$window_start = max( 0, $idx - CONSTANTS_GUARD_WINDOW );
+			$guarded      = false;
+			for ( $w = $window_start; $w <= $idx; $w++ ) {
+				if ( preg_match( "/defined\s*\(\s*'" . preg_quote( $name, '/' ) . "'/", $lines[ $w ] ) ) {
+					$guarded = true;
+					break;
+				}
+			}
+
+			if ( ! $guarded ) {
+				$errors[] = [ $php_path, $idx + 1, $name, $raw_line ];
+			}
+		}
+	}
+}
+
+// -------------------------------------------------------------------------
+// 4. Report results.
+// -------------------------------------------------------------------------
+
+if ( $errors !== [] ) {
+	fwrite( STDERR, "\nFAIL -- Unguarded undefined PRAUTOBLOGGER_* constants:\n\n" );
+	foreach ( $errors as [ $php_path, $lineno, $name, $line_text ] ) {
+		fwrite( STDERR, "  {$php_path}:{$lineno}: {$name}\n" );
+		fwrite( STDERR, '    ' . trim( $line_text ) . "\n" );
+	}
+	fwrite( STDERR, "\nTo fix: add  define( '" . $errors[0][2] . "', ... )  to prautoblogger.php,\n" );
+	fwrite( STDERR, "or guard the reference with  if ( defined( '" . $errors[0][2] . "' ) ) { ... }\n\n" );
+	exit( 1 );
+}
+
+echo "OK -- All PRAUTOBLOGGER_* constants are production-defined or defined()-guarded.\n";
+exit( 0 );