perf: lazy-load the top My Sites toolbar and defer initial site-list hydration

Start by inspecting the installed WordPress implementations of WP_Admin_Bar::initialize(), get_blogs_of_user() and wp_admin_bar_my_sites_menu(), then trace the toolbar and filtering paths in inc/managers/class-site-manager.php and magic-link rewriting in inc/sso/class-admin-bar-magic-links.php. Review the named Site Manager and SSO tests and the My Networks implementation reference before changing the scoped files. Done means bounded authenticated pagination, working navigation and fallbacks, preserved permissions and SSO behavior, updated DESIGN.md, and the listed scoped checks and runtime measurements.

What

Lazy-load the top WordPress My Sites toolbar dropdown beside My Networks so an unopened menu does not enumerate and hydrate the full site list or construct every site's management links. This is not the bottom-right Toolbox/Jumper UI.

Keep current-site navigation and an explicit full My Sites administration link immediately available. Fetch bounded, paginated results only when the menu is opened or explicitly requested, preserving the existing site visibility rules, permissions and SSO/magic links.

Why / measured evidence

Read-only authenticated local Users-request profiling, with the My Networks lazy-loading change already served:

Events count both switches and restores, not 118 distinct sites. Later site-list calls were already largely request-cached and added no SQL. The bottom Toolbox setup/render cost about 4ms and no additional SQL on the same request; do not optimize that unrelated UI for this issue.

These are inclusive instrumented CLI request-attribution measurements, not production HTTP savings. One additional run was substantially slower with identical operation counts, so do not promise a fixed latency reduction. Persistent Redis was disabled locally. Verify with controlled HTTP runs after implementing.

Root cause and verified files

• inc/managers/class-site-manager.php:1158-1277, hide_customer_sites_from_super_admin_list(): builds up to 40 site objects plus the main site. Reads of $site->blogname and $site->siteurl hydrate WordPress site details and activate downstream blog-switch hooks.
• inc/managers/class-site-manager.php:1280-1362, is_frontend_my_sites_toolbar_request() and get_current_site_for_frontend_my_sites_toolbar(): existing opt-in, frontend-only, direct-toolbar-initialization optimization is a reference pattern. It intentionally excludes admin/AJAX/REST/CLI and protects nested get_active_blog_for_user() calls. Do not simply remove those guards.
• inc/sso/class-admin-bar-magic-links.php: existing My Sites node rewriting must remain effective for lazily loaded links.
• tests/WP_Ultimo/Managers/Site_Manager_Test.php: existing toolbar context, filtering, user scope and archived/spam/deleted tests.
• tests/WP_Ultimo/SSO/Admin_Bar_Magic_Links_Test.php: existing magic-link coverage.
• DESIGN.md: record the changed interaction and fallback behavior.

Reference the WordPress core WP_Admin_Bar::initialize() / get_blogs_of_user() preparation path and wp_admin_bar_my_sites_menu() separately. Deferring just the submenu callback leaves the initial 113-query hydration cost intact. Core lives in the WordPress installation, not in this plugin repository; inspect its installed implementation rather than guessing repository paths.

Use the existing site manager for the authenticated endpoint and add assets/js/my-sites-toolbar.js for the native toolbar controller, following existing asset conventions. If investigation requires a different write surface, record and validate the amended scope before editing. Related implementation reference: Ultimate-Multisite/ultimate-multisite-multinetwork#63, which lazy-loads My Networks with pagination, nonce checks, retry and keyboard/touch support. It is a reference, not an implementation dependency or an assumption that the PR has merged.

Files Scope

• inc/managers/class-site-manager.php
• inc/sso/class-admin-bar-magic-links.php
• NEW: assets/js/my-sites-toolbar.js
• tests/WP_Ultimo/Managers/Site_Manager_Test.php
• tests/WP_Ultimo/SSO/Admin_Bar_Magic_Links_Test.php
• DESIGN.md

Bounded implementation contract

1. Restrict the lightweight initial site-list behavior to the direct toolbar initialization context; do not globally change get_blogs_of_user() for profile links, dashboards, admin screens, REST clients or application code.
2. Preserve existing allowed-site filtering and current-user context. The lazy endpoint must be authenticated, nonce-protected and server-authorized. Do not expose unrelated sites, globally cache capability decisions, or weaken authorization.
3. Return at most 10–20 sites per fetch, with deterministic ordering and explicit pagination. Do not preload the complete list in script localization or hidden HTML.
4. Preserve network/site-specific URLs, customer-owned-site visibility semantics, existing get_blogs_of_user filters and magic-link/SSO behavior. Restore any switched context in a finally block.
5. Retain current-site and full-list navigation without JavaScript. Support hover, keyboard focus and touch; provide loading, empty and explicit retry states, no duplicate in-flight requests, and no focus theft on hover.
6. Cover admin and frontend toolbar paths. Do not modify WordPress core or unrelated installed plugins. Do not enable the existing frontend optimization setting globally as a substitute for this implementation.

Acceptance / verification

• Unopened toolbar does not perform full managed-site enumeration/detail hydration or per-site submenu construction.
• Opening the menu fetches only a bounded page; load-more results are disjoint and full-list access remains available.
• Verify current-site navigation and generated links under both subdomain and subdirectory multisite, mapped domains and secondary networks where available.
• Preserve permission denial, customer/non-super-admin behavior, site-state filtering and magic-link behavior. No cross-user/site information disclosure.
• Keyboard activation, Escape/focus return, touch layout, failed-request retry and JavaScript-disabled fallback work in the real rendered product.
• Existing affected Site_Manager and Admin_Bar_Magic_Links suites pass, with only narrow new boundary coverage; no new test runner/harness is needed.
• Run scoped PHPCS/ESLint/PHPStan and inspect standard PHP/browser errors.
• Repeat authenticated HTTP before/after benchmarks with identical user pagination, revisions and cache configuration. Record actual HTTP time separately from CLI attribution; count both scalar and bulk cache-key reads and actual backend calls separately.
• Do not claim the 0.5-second target is reached without runtime evidence. Do not merge or deploy as part of worker implementation without the normal authorized lifecycle.

Rollback: revert the isolated lazy-toolbar change to restore the existing eager menu; no persistent data migration is required.

Pre-flight and routing

• Memory recall: My Sites toolbar/cache performance query returned no relevant stored lessons; current-session runtime evidence is supplied above.
• Discovery: scoped recent-commit, merged-PR, open-PR and claimed-issue searches returned no matching work. Additional open searches for My Sites performance/toolbar returned no matches.
• File references: the five implementation/test/design paths above were verified as tracked; line numbers reflect the inspected revision and must be rechecked at worker pickup.
• Tier: tier:standard — existing authorization patterns within a defined toolbar-only boundary; not a mechanical exact-edit task.
• Seeded draft PR: skipped; preserve the measured finding without anchoring a worker to an unverified patch.

Leaf implementation task. Dispatch: #auto-dispatch. Create a focused implementation PR referencing this issue; no release or deployment is requested.