Skip disabled cron registration in Cloudflare

Author: chubes4

packages/runtime-cloudflare/README.md

@@ -18,13 +18,15 @@ The bundled MDI source is pinned to immutable commit `1870fb41279e7eb5946e506c9c
 
 The WordPress server corpus is a separate deployment artifact, never a Worker-module import. `generate:cloudflare-wordpress-runtime-corpus` uses bounded ZIP Range decoding against the pinned WordPress release, retains only `isWordPressRuntimeFile()` entries, and emits a deterministic ZIP under `artifacts/` plus the checked-in `assets/wordpress-runtime-artifact.json` provenance manifest. The immutable R2 key is derived from the corpus ZIP SHA-256. Cold boot fetches that exact object through `WORDPRESS_STATE_BUCKET`, validates the manifest and archive/file hashes and budgets, then streams it into PHP MEMFS. Static browser assets continue to use lazy exact archive ranges and Worker cache.
 
+Canonical Cloudflare boots materialize a named mu-plugin that removes only core's `wp_cron` `init` callback when the runtime policy defines `DISABLE_WP_CRON` as true. Cron spawning is explicitly disabled by this runtime policy because the PHP-WASM/MDI shutdown callback path is not supported. Update and privacy scheduling callbacks remain registered; an explicit durable cron execution contract is separate future scope.
+
 ## MDI Init Diagnostics
 
 Every `mdi-*` lifecycle diagnostic materializes the validated packaged canonical MDI seed and the separately managed R2 WordPress runtime artifact in a disposable PHP-WASM runtime. They never acquire a coordinator lease, read or write a canonical R2 revision, or promote state. The old three-option fixture was intentionally removed because it does not represent complete MDI WordPress state.
 
 `?phase=canonical-wordpress` performs a full normal WordPress boot with that exact seed and artifact outside the coordinator, then returns WordPress version, memory, and non-sensitive table counts. Its widget-state count includes the `widget_*` options and `sidebars_widgets`. `?phase=canonical-bootstrap-setup` additionally runs the normal bootstrap setup with a probe-only internal password and fixed probe origin, flushes only the disposable runtime, and returns changed-path counts. Neither probe returns password, option, user, or content values.
 
-The diagnostic-only `?phase=` probes `mdi-init-callbacks`, `mdi-init-exclude-scheduling`, `mdi-init-exclude-block-registration`, `mdi-init-exclude-theme-patterns-styles`, `mdi-init-exclude-widgets`, `mdi-init-exclude-rest-connectors-sitemaps`, and `mdi-init-exclude-initial-content-types` stop at `init`. The inventory probe returns sorted callback identifiers by priority. Each exclusion probe removes only its fixed callback group, runs `init` once, and returns before subsequent WordPress lifecycle work.
+The diagnostic-only `?phase=` probes `mdi-init-callbacks`, `mdi-init-exclude-scheduling`, `mdi-init-exclude-wp-cron`, `mdi-init-exclude-privacy-schedule`, `mdi-init-exclude-update-schedule`, `mdi-init-exclude-wp-cron-privacy-schedule`, `mdi-init-exclude-wp-cron-update-schedule`, `mdi-init-exclude-privacy-update-schedule`, `mdi-init-exclude-block-registration`, `mdi-init-exclude-theme-patterns-styles`, `mdi-init-exclude-widgets`, `mdi-init-exclude-rest-connectors-sitemaps`, and `mdi-init-exclude-initial-content-types` stop at `init`. The inventory probe returns sorted callback identifiers by priority. Each exclusion probe removes only its fixed callback group through WordPress's public `remove_action()` API, runs `init` once, and returns the exact removed names, completion, and memory measurements before subsequent WordPress lifecycle work.
 
 The fixed widget probes split `wp_widgets_init` without changing its normal path: `mdi-widgets-callbacks` returns the sorted nested `widgets_init` inventory before `init`; `mdi-widgets-constructors` runs only the core default widget registrations and reports widget class count; `mdi-widgets-hooks` adds the nested action; `mdi-widgets-factory` runs only `WP_Widget_Factory::_register_widgets`; and `mdi-widgets-remaining-hooks` runs the remaining nested callbacks. The bounded direct-registration phases are `mdi-widgets-direct-basic-classic-first`, `mdi-widgets-direct-basic-classic-second`, `mdi-widgets-direct-media`, `mdi-widgets-direct-custom-html-block`, `mdi-widgets-direct-block`, and `mdi-widgets-direct-custom-html`. They remove every normal nested callback, then call `_register()` only on their fixed allowlisted factory objects and return attempted classes, count, completion, and memory. `mdi-widgets-option-reads` reports only fixed widget option names, grouped by `get_option()` presence and direct `$wpdb` SQLite-row presence; it returns no option values. `mdi-widgets-get-settings` calls only `get_settings()` on each default factory object, with `mdi-widgets-get-settings-first` and `mdi-widgets-get-settings-second` as fixed halves; each reports completed classes and array-shape dimensions only. `mdi-widgets-register-one` preloads the fixed `widget_text` option, calls that object's `get_settings()`, then calls only `_register_one()` for its fixed instance. Every phase uses fixed source identities and returns before later lifecycle work; none accepts callback names, removal rules, widget classes, or option names from request input.
 

packages/runtime-cloudflare/src/worker.ts

@@ -265,13 +265,13 @@ async function discardRuntime(runtime: Runtime): Promise<void> {
 }
 
 async function bootRuntime(bucket: R2Bucket, pointer: MarkdownPointer, origin: string, authConstants: Record<WordPressAuthConstant, string>): Promise<Runtime> {
-  return { ...await bootWordPressRuntime("do-not-attempt-installing", true, true, undefined, await readMarkdownRevision(bucket, pointer), new Uint8Array(markdownPrimaryBootstrapIndex), origin, authConstants, bucket), pointer }
+  return { ...await bootWordPressRuntime("do-not-attempt-installing", true, true, undefined, await readMarkdownRevision(bucket, pointer), new Uint8Array(markdownPrimaryBootstrapIndex), origin, authConstants, bucket, true), pointer }
 }
 
 async function bootstrapCanonicalRuntime(env: Env, coordinator: DurableObjectStub, requestUrl: string, lease: Lease): Promise<Runtime> {
   if (!env.WORDPRESS_ADMIN_PASSWORD) throw new Error("WORDPRESS_ADMIN_PASSWORD is required to bootstrap a complete canonical WordPress revision.")
   const origin = new URL(requestUrl).origin
-  const runtime = await bootWordPressRuntime("do-not-attempt-installing", true, true, undefined, await packagedCanonicalMarkdownSeed(), new Uint8Array(markdownPrimaryBootstrapIndex), origin, await canonicalWordPressAuthConstants(env), env.WORDPRESS_STATE_BUCKET)
+  const runtime = await bootWordPressRuntime("do-not-attempt-installing", true, true, undefined, await packagedCanonicalMarkdownSeed(), new Uint8Array(markdownPrimaryBootstrapIndex), origin, await canonicalWordPressAuthConstants(env), env.WORDPRESS_STATE_BUCKET, true)
   try {
     const passwordFile = "/tmp/wordpress-admin-password"
     runtime.php.writeFile(passwordFile, new TextEncoder().encode(env.WORDPRESS_ADMIN_PASSWORD))
@@ -568,7 +568,7 @@ async function runBootProbe(phase: string, bucket: R2Bucket): Promise<Response>
 
   if (phase === "canonical-wordpress" || phase === "canonical-bootstrap-setup") {
     const canonicalSeed = await packagedCanonicalMarkdownSeed()
-    const runtime = await bootWordPressRuntime("do-not-attempt-installing", true, true, undefined, canonicalSeed, new Uint8Array(markdownPrimaryBootstrapIndex), "https://canonical-probe.invalid", {}, bucket)
+    const runtime = await bootWordPressRuntime("do-not-attempt-installing", true, true, undefined, canonicalSeed, new Uint8Array(markdownPrimaryBootstrapIndex), "https://canonical-probe.invalid", {}, bucket, true)
     try {
       if (phase === "canonical-bootstrap-setup") {
         const passwordFile = "/tmp/wp-codebox-canonical-bootstrap-probe-password"
@@ -588,6 +588,9 @@ echo json_encode([
   'optionCount' => (int) $wpdb->get_var("SELECT COUNT(*) FROM {\$wpdb->options}"),
   'widgetOptionCount' => (int) $wpdb->get_var("SELECT COUNT(*) FROM {\$wpdb->options} WHERE option_name LIKE 'widget\\_%'"),
   'widgetStateOptionCount' => (int) $wpdb->get_var("SELECT COUNT(*) FROM {\$wpdb->options} WHERE option_name LIKE 'widget\\_%' OR option_name = 'sidebars_widgets'"),
+  'wpCronInitAttached' => false !== has_action('init', 'wp_cron'),
+  'updateScheduleInitAttached' => false !== has_action('init', 'wp_schedule_update_checks'),
+  'privacyScheduleInitAttached' => false !== has_action('init', 'wp_schedule_delete_old_privacy_export_files'),
   'memoryBytes' => memory_get_usage(true),
   'peakMemoryBytes' => memory_get_peak_usage(true),
 ]);` })).text.trim()
@@ -1000,6 +1003,7 @@ async function bootWordPressRuntime(
   siteUrl = SITE_URL,
   authConstants: Partial<Record<WordPressAuthConstant, string>> = {},
   runtimeBucket?: R2Bucket,
+  canonicalCronAdapter = false,
 ): Promise<{ php: PHP; requestHandler: PHPRequestHandler; wordpressVersion: string }> {
   const requestHandler = await bootWordPressAndRequestHandler({
     createPhpRuntime,
@@ -1031,6 +1035,7 @@ async function bootWordPressRuntime(
           materializeRuntimeFiles(php, MARKDOWN_ROOT, markdownFiles)
           if (markdownIndexSeed) php.writeFile(MARKDOWN_RESOLVED_INDEX_PATH, markdownIndexSeed)
         }
+        if (canonicalCronAdapter) materializeCanonicalCronAdapter(php)
       } : undefined,
       beforeDatabaseSetup: databaseSeed ? (php: PHP) => {
         php.mkdir("/wordpress/wp-content/database")
@@ -1058,6 +1063,20 @@ function materializeRuntimeFiles(php: PHP, root: string, files: RuntimeFile[]):
   }
 }
 
+function materializeCanonicalCronAdapter(php: PHP): void {
+  const path = "/wordpress/wp-content/mu-plugins/wp-codebox-canonical-cron-policy.php"
+  php.mkdir(path.slice(0, path.lastIndexOf("/")))
+  php.writeFile(path, new TextEncoder().encode(`<?php
+/**
+ * Plugin Name: WP Codebox Canonical Cron Policy
+ */
+
+if ( defined( 'DISABLE_WP_CRON' ) && DISABLE_WP_CRON ) {
+	remove_action( 'init', 'wp_cron' );
+}
+`))
+}
+
 function collectRuntimeFiles(php: PHP, root: string): RuntimeFile[] {
   const files: RuntimeFile[] = []
   const visit = (directory: string): void => {

scripts/cloudflare-local-gate.mjs

@@ -172,14 +172,14 @@ async function assertCanonicalProbes() {
   const wordpress = await (await request(`${origin}/?phase=canonical-wordpress`)).json()
   const setup = await (await request(`${origin}/?phase=canonical-bootstrap-setup`)).json()
   const counts = ["canonicalSeedFiles", "postCount", "pageCount", "userCount", "optionCount", "widgetOptionCount", "widgetStateOptionCount", "memoryBytes", "peakMemoryBytes"]
-  if (wordpress.completed !== true || typeof wordpress.evidence?.wordpressVersion !== "string" || counts.some((key) => !Number.isInteger(wordpress.evidence?.[key])) || wordpress.evidence.widgetStateOptionCount !== 19) {
+  if (wordpress.completed !== true || typeof wordpress.evidence?.wordpressVersion !== "string" || counts.some((key) => !Number.isInteger(wordpress.evidence?.[key])) || wordpress.evidence.widgetStateOptionCount !== 19 || wordpress.evidence.wpCronInitAttached !== false || wordpress.evidence.updateScheduleInitAttached !== true || wordpress.evidence.privacyScheduleInitAttached !== true) {
     throw new Error(`Canonical WordPress probe did not boot the complete seed: ${JSON.stringify(wordpress)}`)
   }
   const changedCounts = ["createdPathCount", "changedPathCount", "deletedPathCount"]
   if (setup.completed !== true || typeof setup.evidence?.wordpressVersion !== "string" || changedCounts.some((key) => !Number.isInteger(setup.evidence?.[key])) || setup.evidence.changedPathCount < 1) {
     throw new Error(`Canonical bootstrap setup probe did not produce ephemeral changes: ${JSON.stringify(setup)}`)
   }
-  console.log(`Canonical probes: WordPress ${wordpress.evidence.wordpressVersion}, ${wordpress.evidence.widgetOptionCount} widget_* options plus sidebars_widgets, ${setup.evidence.changedPathCount} changed ephemeral paths.`)
+  console.log(`Canonical probes: WordPress ${wordpress.evidence.wordpressVersion}, cron init disabled while update/privacy scheduling remain registered, ${wordpress.evidence.widgetOptionCount} widget_* options plus sidebars_widgets, ${setup.evidence.changedPathCount} changed ephemeral paths.`)
 }
 
 async function assertMdiDiagnostics() {

tests/cloudflare-runtime.test.ts

@@ -313,6 +313,24 @@ test("Cloudflare MDI lifecycle diagnostics use the complete packaged seed withou
   assert.match(worker, /function canonicalChangedPathCounts/)
 })
 
+test("Cloudflare canonical runtime materializes a conditional cron policy without removing other scheduling callbacks", async () => {
+  const worker = await readFile(new URL("../packages/runtime-cloudflare/src/worker.ts", import.meta.url), "utf8")
+  const adapter = worker.match(/function materializeCanonicalCronAdapter\(php: PHP\): void \{[\s\S]*?\n\}/)?.[0]
+
+  assert.ok(adapter, "The canonical cron policy materializer is present.")
+  assert.match(adapter, /wp-content\/mu-plugins\/wp-codebox-canonical-cron-policy\.php/)
+  assert.match(adapter, /defined\( 'DISABLE_WP_CRON' \) && DISABLE_WP_CRON/)
+  assert.match(adapter, /remove_action\( 'init', 'wp_cron' \)/)
+  assert.doesNotMatch(adapter, /wp_schedule_update_checks|wp_schedule_delete_old_privacy_export_files|\$GLOBALS\['wp_filter'\]/)
+  assert.match(worker, /runtimeBucket\?: R2Bucket,\n  canonicalCronAdapter = false,/)
+  assert.match(worker, /authConstants, bucket, true\), pointer/)
+  assert.match(worker, /env\.WORDPRESS_STATE_BUCKET, true\)/)
+  assert.match(worker, /canonical-probe\.invalid", \{\}, bucket, true\)/)
+  assert.match(worker, /'wpCronInitAttached' => false !== has_action\('init', 'wp_cron'\)/)
+  assert.match(worker, /'updateScheduleInitAttached' => false !== has_action\('init', 'wp_schedule_update_checks'\)/)
+  assert.match(worker, /'privacyScheduleInitAttached' => false !== has_action\('init', 'wp_schedule_delete_old_privacy_export_files'\)/)
+})
+
 test("Cloudflare keeps PHP-WASM in the entry Worker and uses the Durable Object only for leases", async () => {
   const worker = await readFile(new URL("../packages/runtime-cloudflare/src/worker.ts", import.meta.url), "utf8")
   const coordinator = await readFile(new URL("../packages/runtime-cloudflare/src/state-coordinator.ts", import.meta.url), "utf8")