=== Attic — Safe Database Audit ===
Contributors: rainynewt
Tags: database, audit, cleanup, performance, optimization
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.1
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

A read-only database audit that quarantines instead of deleting, and searches your code before it calls anything orphaned.

== Description ==

Uninstalled and misbehaving plugins leave behind lingering database bloat — autoloaded options, ghost cron events, stranded transients, orphaned tables. Traditional cleanup tools reach for aggressive drop/delete queries that risk breaking your site.

Attic audits your WordPress database for bloat, without any of that:

* **Autoloaded option bloat** — oversized options that load on every page request, ranked by size against Site Health's 800 KB line.
* **Ghost cron events** — scheduled hooks with no registered callback, firing forever and doing nothing.
* **Orphaned tables** — tables no installed plugin claims, with reclaimable megabytes up front.
* **Stranded transients** — expired timeout pairs and orphaned rows.
* **Leftovers from deleted plugins** — data whose owning plugin is absent from disk entirely.

Two rules outrank every feature:

1. **Quarantine, never delete.** Options are stored before removal. Tables are renamed (`wp_attic_quarantined_*`), never dropped until a purge window passes.
2. **Nothing is called orphaned until your code has been searched for it.** Attic streams `wp-content` — plugins, mu-plugins, themes, `wp-config.php` — looking for every candidate name before promoting anything to high confidence.

Every finding shows its full evidence inline: which rule fired, what it attributed to and whether that plugin exists on disk, how many code references were found, and the size. A finding you cannot audit is a finding you should not act on.

== Installation ==

1. Upload the `attic` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Navigate to **Tools → Attic** to run your first audit.

== Frequently Asked Questions ==

= Is this safe? =

The scan is read-only. Nothing changes until you take an explicit, confirmed action. Core options like `siteurl`, `active_plugins` and `cron` can never be flagged, and neither can anything on your own protected list or the `attic_protected_options` filter.

= How do I undo something? =

Tools → Attic → Quarantine. Every action creates a batch; restore a whole batch in one click. Batches auto-purge after 30 days (configurable).

= Why does my finding say "review" instead of "high"? =

High confidence requires: the owning plugin absent from disk (or size-flagged *and* unread), AND zero literal AND zero prefix references in your code. Dynamic option names never literal-match, so weak signals still demote findings. If your filesystem could not be read, everything is marked unverified rather than guessed at.

= Does it work with external object caches? =

Yes — when Redis/Memcached is active, transients never touch the options table, and Attic says so instead of showing a meaningless clean bill of health.

= Multisite? =

Single-site and subdirectory multisite installs work. Network-wide fleet scanning is planned.

== Filters ==

* `attic_protected_options` — additional never-flag option names
* `attic_protected_cron_hooks` / `attic_protected_tables` — same, for cron and tables
* `attic_finding_confidence` — last word on any single finding's confidence
* `attic_reference_scan_roots` — unusual layouts, custom content dirs

== Changelog ==

= 1.0.1 =
* Fix: Quarantine action now correctly updates finding state (broken by SQL syntax error).
* Fix: Orphan tables rule no longer flags Attic's own tables on sites with nested table prefixes (e.g. wp_pc_attic_*).
* Add: Stop scan button to abort long-running scans mid-flight.
* Fix: Findings page defaults to latest completed scan instead of showing duplicates across all scans.
* Fix: Scan complete state now hides progress bar and stop button cleanly.
* Fix: Empty quarantine batches are cleaned up automatically.

= 1.0.0 =
* Initial plugin release: read-only database audit with quarantine-based undo, five detection rules, budgeted scan engine, reference scanning, quarantine with batch restore, and attribution map.
