15. Qualify the invariants the code outgrew

[nikolaystrikhar]

What: qualifies the three AGENTS.md invariants stated absolutely where the code holds them conditionally — the provider's host-wins guard, the string-callable rule, and the Absorber-naming rule — corrects the docblocks that contradict their own code, drops a stale @throws clause from Resolver_Interface, records the capability gate's residual risk beside the ordering that mitigates it, and fills three host-developer gaps in docs/configuration.md and docs/extending.md.

Usage: a maintainer now reads that Provider::bind_once() protects the seven interface ids and re-binds the ten class-name ones, so a host replacing Loader or Notices\Store binds after boot(); and that only conflict_policy and the two message keys refuse a string callable, while enabled, dependency_check and activation_callback invoke one on purpose. A host developer now finds why the static function around activation_callback is load-bearing, and that a site added to a network later never receives the callback.

Why this way:

An invariant that is false in ten of seventeen cases is worse than no invariant. bind_once()'s own docblock has been honest about the class_exists() trade-off all along and docs/extending.md documents the real rule correctly; only the durable document promised something the code never did — the one place a maintainer checks before deciding a rebinding is safe.

Scoped, not deleted. The string-callable rule is load-bearing for the three keys resolve_deferred() reads, so the fix is a qualifier plus the counter-case, not a struck line that leaves the next reader to rediscover why date is refused under conflict_policy and called under dependency_check.

The residual risk is recorded where its mitigation is argued. The paragraph explaining why the detector runs before the capability check is exactly where a reader concludes the problem is solved, so the qualifier belongs in the same breath — along with the checked-and-false claim that a pinned user is bounced to wp-login.php.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Enterprise

Run ID: aafa39d9-a65f-42cd-b7f8-ec55ea217cae

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}