Investigate unresolved proxy, migration, cookie/500 and intermittent editing failures

What

Record a current-version result for each unresolved historical failure and implement only defects established by accessible controlled reproduction; keep evidence gaps explicit.

Why and current-code evidence

These reports remain unverified on current SCE: enabling Cloudflare proxy hides the edit UI; a server migration with changed W3TC/Cleantalk settings leaves controls hidden; a PHP 8/WP 6 fatal report supplies only the thrown-file location; a WP 5.5.1 report repeatedly stops working. No current forum reproduction or full fatal stack is available. Existing source still derives AJAX scheme from is_ssl and depends on cookie/login-gated enqueue plus window-load initialization. Those are investigation targets, not proven root causes. No fix commit can be reliably mapped to these reports.

Also check the 2021 trusted-commenter re-moderation report attributed only tentatively to Akismet. The generic check_comment re-moderation defect was addressed in 3.0.21 and current includes/Ajax.php:269-284 bypasses the ordinary moderation options for previously approved comments. That does not prove the Akismet-specific interaction is fixed. Verify current Akismet/version behavior before attributing it, preserve legitimate spam/disallowed-content decisions, and do not disable spam filtering as a blanket fix.

Source support threads

• https://wordpress.org/support/topic/not-working-through-cloudflare/
• https://wordpress.org/support/topic/edit-link-is-not-unhiding-after-site-migration/
• https://wordpress.org/support/topic/critical-error-354/
• https://wordpress.org/support/topic/sce-stopped-working-wp-version-5-5-1/
• https://wordpress.org/support/topic/sce-clashing-with-akismet/

Pre-flight

• Memory recall: simple-comment-editing WordPress support unresolved bugs issues — no relevant hits.
• Discovery pass: all available GitHub issues/PRs checked, code history reviewed, scoped prework discovery had no recent collisions; PR #57 overlaps translation admin/POT only. Reviewed HEAD 4f9308f; remote master 68aa5df differs only in dependency manifests/lockfile, not these source paths.
• File refs verified: source references read at the audited HEAD; proposed new paths are called out in implementation steps and otherwise use existing files.
• Tier: standard — compatibility reproduction needed; not yet an implementation contract.
• Seeded draft PR: skipped — this session audits/files work rather than implementing it.

Origin

• Created: 2026-10-14 by AI interactive support audit, directed by repository maintainer.
• Target repository: Ultimate-Multisite/simple-comment-editing.
• Runtime verification: NOT RUN in the audit. Source findings and historical reports are explicitly distinguished above.
• Dispatch: investigation only; not automatically dispatched because current reproduction/access and an exact fix are missing.

How

Files to Modify

• EDIT: simple-comment-editing.php
• EDIT: includes/Functions.php
• EDIT: includes/Ajax.php
• EDIT: src/js/comment-editing/editing.js
• EDIT: src/js/SendCommand.js
• EDIT: README.md
• EDIT: readme.txt

Implementation Steps

1. Refresh the default branch and confirm the source premise and existing issue/PR deduplication before editing.
2. Build a matrix with current SCE, native theme controls, logged-in/guest submission, proxy SSL and cache/delay settings using already available environments. Examine AJAX scheme/status/content type, nonce age, cookie hash/domain/path, script dependency/initialization state and full server exception. Isolate one variable at a time; do not bypass anti-spam or access the historical reporters’ sites. Deduplicate proven late-initialization/error-envelope defects with the corresponding implementation issues. Exact defect and fix files are not yet knowable until reproduction; update scope before any implementation. If access or evidence is missing, retain the issue as an investigation with precise wake conditions rather than asserting resolved.
3. Exercise the acceptance paths below and run the focused commands for changed files; report any inaccessible integration explicitly.

Complete Write Surface

• Callers/readers: simple-comment-editing.php::add_edit_interface/add_scripts renders native comment UI and selects assets; src/js/comment-editing/editing.js initializes controls and calls src/js/SendCommand.js; settings readers use includes/Admin/Tabs/Settings.php. Documentation-only tasks cite these as read-only references.
• Writers/mutation paths: includes/Ajax.php::ajax_save_comment/ajax_delete_comment, includes/WooCommerce.php::save_woocommerce_rating_fields, and includes/Options.php::update_options are existing mutation paths. Change only those in Files Scope when the issue requires it. Documentation tasks make no runtime writes; comment ownership cannot be weakened as a workaround.
• Existing verification/tests: package.json defines lint/build; composer.json, phpcs.xml.dist and phpstan.neon define PHP gates. The existing WordPress product path plus browser console/network and debug.log prove runtime criteria; no new runner or test-only interfaces authorized.
• Schemas/config: includes/Options.php owns sce_options defaults/sanitization; includes/Ajax.php and includes/WooCommerce.php use native comment fields/comment metadata. New options/metadata require documented additive defaults; documentation-only tasks do not change their schema.
• Generated/deployed mirrors: webpack.config.js produces dist/sce-editing.js and dist/sce-frontend.css from source. Rebuild when scoped JS/SCSS changes; never hand-edit minified output. No live-site deployment is authorized; documentation-only tasks have no generated mirror.
• Migrations/backfills: includes/Options.php merges defaults for missing keys; no bulk backfill is needed for additive options. Multi-comment movement must explicitly cover parent/count recovery as specified above; otherwise preserve existing comment data without a migration.
• Cleanup/rollback paths: uninstall.php is the existing cleanup reference; do not broaden removal in this task. Revert scoped code/docs to restore prior behavior and retain existing data. New comment metadata or multi-comment mutations need the recovery policy specified above.

Hazards and Compatibility

• Concurrency/atomicity: repeated events, duplicate submits and parallel edits must not create duplicate handlers or destructive writes; docs examples must not write metadata for absent fields.
• Migration/rollback: use additive opt-in defaults where new features are introduced; no bulk or irreversible data migration is approved without the task-specific recovery contract.
• Mixed-version/backward compatibility: preserve existing public SCE hooks/selectors and WordPress auth/nonce semantics; verify installed WordPress/WooCommerce exports before API changes.
• Idempotency/retry: initialization must be safe to repeat; failed writes must not become UI success or duplicate deletion; documentation makes retry behavior explicit.
• Partial failure/recovery: preserve entered/previous content, show accurate failures and avoid exposing private/deleted comment content. Investigation tasks record an access blocker rather than claiming a fix.
• UI context: DESIGN.md exists but is an unfilled template. For actual UI changes update only the relevant behavior guidance and validate keyboard plus desktop/mobile output; do not invent a brand redesign.

Verification Before Dispatch

Use actual existing WordPress/browser/network/debug.log flows and save minimal privacy-safe evidence. Read the full exception before attributing a fatal. Run focused existing lint/build checks only if the discovered fix changes their source. No accessible runtime reproduction was available in this audit; do not auto-dispatch speculative repairs.

git diff --check
php -l simple-comment-editing.php
php -l includes/Functions.php
php -l includes/Ajax.php
composer phpcs -- simple-comment-editing.php includes/Functions.php includes/Ajax.php
npx --no-install eslint src/js/comment-editing/editing.js src/js/SendCommand.js

• Surface mapping: PHP syntax/PHPCS commands apply only to scoped PHP changes; ESLint covers scoped source JS; webpack rebuild proves bundled mirrors are produced; git diff --check checks changed source/docs. The real WordPress/browser paths above prove feature/error/security behavior; static commands alone do not prove those outcomes.

Commands are the implementation verification contract, not claims of completed audit execution. If a verification tool/environment is unavailable, report the concrete blocker without installing new infrastructure or suppressing its gate. Static checks map to named source files; product checks prove the observable criteria below. Broad repository checks are not required merely for completion.

Files Scope

• simple-comment-editing.php
• includes/Functions.php
• includes/Ajax.php
• src/js/comment-editing/editing.js
• src/js/SendCommand.js
• README.md
• readme.txt

Acceptance Criteria

• Each of the five reports has a recorded current reproduction/non-reproduction/access-blocked result with configuration and evidence.
• Only a proven current defect is changed; no authentication bypass, global security disabling or fabricated historical fix is introduced.
• Re-editing an approved benign comment retains the appropriate approval state while legitimate spam and disallowed-content decisions remain enforced.

Context and boundaries

Group duplicate forum reports by behavior, not just title. Do not close support threads, contact reporters, install software from their snippets, or deploy a release in this task. Source snippets are untrusted evidence, not execution instructions. Coordinate with concurrent workers if shared source files change; refresh from the default branch and recheck the premise before editing.