From 2de7dcf50b59f030e77cb4512913c8ec8510cab2 Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Thu, 13 Aug 2026 14:32:32 -0500
Subject: [PATCH 01/14] Plugin Directory: Resolve release holds from the stable
 tag.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A release block or cooldown was resolved by looking up the release named
after the plugin's Version header. Renaming the header inside a held tag
orphaned that lookup — no release found, so no block and no cooldown —
and the tag's rebuilt package shipped immediately under the new version.

Resolve the current release from the stable tag first, the source of the
served package, falling back to the version for trunk releases, which
are keyed trunk@{version}.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../admin/metabox/class-controls.php          |   2 +-
 .../jobs/class-api-update-updater.php         |  22 +-
 .../shortcodes/class-release-confirmation.php |   3 +-
 .../tests/Current_Release_Resolution_Test.php | 235 ++++++++++++++++++
 4 files changed, 257 insertions(+), 5 deletions(-)
 create mode 100644 wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
index 575559210c..d9318fdb78 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
@@ -60,7 +60,7 @@ protected static function display_release_cooldown() {
 			return;
 		}
 
-		$release = Plugin_Directory::get_release( $post, $version );
+		$release = API_Update_Updater::get_current_release( $post );
 		if ( ! $release ) {
 			return;
 		}
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index c438c8e50b..213112bf64 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -85,7 +85,7 @@ public static function update_single_plugin( $plugin_slug ) {
 
 		$version          = get_post_meta( $post->ID, 'version', true );
 		$requires_plugins = get_post_meta( $post->ID, 'requires_plugins', true );
-		$release          = Plugin_Directory::get_release( $post, $version );
+		$release          = self::get_current_release( $post );
 		$release_time     = self::compute_release_time( $post, $release );
 		$existing_row     = $wpdb->get_row(
 			$wpdb->prepare(
@@ -231,6 +231,22 @@ public static function get_served_version( $plugin_slug ) {
 		);
 	}
 
+	/**
+	 * The release being served or held for a plugin's current version.
+	 *
+	 * Resolved from the stable tag first — the served package is built from it,
+	 * and a Version header that doesn't match its tag must not orphan the
+	 * release's block or cooldown — falling back to the version for trunk
+	 * releases, which are keyed `trunk@{version}`.
+	 *
+	 * @param \WP_Post $post The plugin post.
+	 * @return array|false The release row from Plugin_Directory::get_release(), or false when none exists.
+	 */
+	public static function get_current_release( $post ) {
+		return Plugin_Directory::get_release( $post, get_post_meta( $post->ID, 'stable_tag', true ) )
+			?: Plugin_Directory::get_release( $post, get_post_meta( $post->ID, 'version', true ) );
+	}
+
 	/**
 	 * Whether a release is being held out of `update_source` by a block.
 	 *
@@ -267,7 +283,7 @@ public static function block_release( $plugin_slug, array $block ) {
 		}
 
 		$version = get_post_meta( $post->ID, 'version', true );
-		$release = Plugin_Directory::get_release( $post, $version );
+		$release = self::get_current_release( $post );
 		if ( ! $release ) {
 			return false;
 		}
@@ -458,7 +474,7 @@ public static function force_release( $plugin_slug, $reason, $user = null ) {
 		}
 
 		$version = get_post_meta( $post->ID, 'version', true );
-		$release = Plugin_Directory::get_release( $post, $version );
+		$release = self::get_current_release( $post );
 
 		if ( ! $release ) {
 			return false;
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
index 862b1630b0..02a6b2a092 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
@@ -1,6 +1,7 @@
 <?php
 namespace WordPressdotorg\Plugin_Directory\Shortcodes;
 
+use WordPressdotorg\Plugin_Directory\Jobs\API_Update_Updater;
 use WordPressdotorg\Plugin_Directory\Plugin_Directory;
 use WordPressdotorg\Plugin_Directory\Template;
 use WordPressdotorg\Plugin_Directory\Tools;
@@ -487,7 +488,7 @@ public static function frontend_cooldown_notice( $post = null ) {
 			return;
 		}
 
-		$release = Plugin_Directory::get_release( $post, $version );
+		$release = API_Update_Updater::get_current_release( $post );
 		if ( ! $release ) {
 			return;
 		}
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
new file mode 100644
index 0000000000..3e0ee9595f
--- /dev/null
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
@@ -0,0 +1,235 @@
+<?php
+/**
+ * Tests for resolving the release a hold applies to.
+ *
+ * @package WordPressdotorg\Plugin_Directory\Tests
+ */
+
+declare( strict_types = 1 );
+
+use PHPUnit\Framework\Attributes\Group;
+use PHPUnit\Framework\TestCase;
+use WordPressdotorg\Plugin_Directory\Jobs\API_Update_Updater;
+use WordPressdotorg\Plugin_Directory\Plugin_Directory;
+
+/**
+ * Tests that a Version header that doesn't match its tag cannot orphan the
+ * release's block or cooldown: the hold is resolved from the stable tag, the
+ * source of the served package, not from the header's version label.
+ *
+ * Extends the plain PHPUnit TestCase: WP_UnitTestCase is not compatible with
+ * the PHPUnit 11 runner used by this suite. Isolation comes from giving every
+ * test its own plugin post instead of per-test transactions.
+ *
+ * The group is declared as an attribute as well as `@group`: PHPUnit 11 ignores
+ * a class-level `@group` docblock, while older runners ignore the attribute.
+ *
+ * @group jobs
+ */
+#[Group( 'jobs' )]
+class Current_Release_Resolution_Test extends TestCase {
+
+	/** The version served by the update_source row fixture. */
+	private const SERVED_VERSION = '1.0.0';
+
+	/** The tag of the held release. */
+	private const HELD_TAG = '1.4.4';
+
+	/** The mismatched Version header committed into the held tag. */
+	private const RENAMED_VERSION = '1.4.5';
+
+	/**
+	 * Counter to give every test plugin a unique slug.
+	 *
+	 * @var int
+	 */
+	private static int $plugin_count = 0;
+
+	/**
+	 * The plugin post under test.
+	 *
+	 * @var \WP_Post
+	 */
+	private \WP_Post $plugin;
+
+	/**
+	 * Create a published plugin whose held tag carries a mismatched Version header.
+	 */
+	protected function setUp(): void {
+		parent::setUp();
+
+		wp_cache_flush();
+
+		// Tools::audit_log() reads it unguarded.
+		$_SERVER['REMOTE_ADDR'] = '127.0.0.1';
+
+		$plugin = Plugin_Directory::create_plugin_post(
+			array(
+				'post_name'   => 'resolution-test-' . ( ++self::$plugin_count ),
+				'post_title'  => 'Release Resolution Test Plugin',
+				'post_status' => 'publish',
+			)
+		);
+
+		$this->assertInstanceOf( \WP_Post::class, $plugin );
+		$this->plugin = $plugin;
+
+		/*
+		 * The stub update_source table survives across runs — the WP test
+		 * installer only drops core tables — so clear leftovers that would
+		 * collide with this run's plugin ID or read as a served version.
+		 */
+		global $wpdb;
+		$wpdb->delete( $wpdb->prefix . 'update_source', array( 'plugin_id' => $this->plugin->ID ) );
+		$wpdb->delete( $wpdb->prefix . 'update_source', array( 'plugin_slug' => $this->plugin->post_name ) );
+
+		$wpdb->insert(
+			$wpdb->prefix . 'update_source',
+			array(
+				'plugin_id'        => $this->plugin->ID,
+				'plugin_slug'      => $this->plugin->post_name,
+				'available'        => 1,
+				'version'          => self::SERVED_VERSION,
+				'stable_tag'       => self::SERVED_VERSION,
+				'plugin_name'      => $this->plugin->post_title,
+				'requires_plugins' => '',
+				'last_updated'     => $this->plugin->post_modified,
+			)
+		);
+
+		update_post_meta( $this->plugin->ID, 'version', self::RENAMED_VERSION );
+		update_post_meta( $this->plugin->ID, 'stable_tag', self::HELD_TAG );
+	}
+
+	/**
+	 * Register a release for a tag.
+	 *
+	 * @param string $tag       The release tag.
+	 * @param string $version   The release version.
+	 * @param array  $overrides Fields to override.
+	 */
+	private function add_release( string $tag, string $version, array $overrides = array() ): void {
+		Plugin_Directory::add_release(
+			$this->plugin,
+			array_merge(
+				array(
+					'tag'                      => $tag,
+					'version'                  => $version,
+					'zips_built'               => true,
+					'zips_built_from_revision' => 0,
+					'confirmed'                => true,
+					'confirmations_required'   => 0,
+					'release_delay'            => DAY_IN_SECONDS,
+				),
+				$overrides
+			)
+		);
+	}
+
+	/**
+	 * The version currently in the plugin's update_source row.
+	 *
+	 * @return string The served version.
+	 */
+	private function served_version(): string {
+		return API_Update_Updater::get_served_version( $this->plugin->post_name );
+	}
+
+	/**
+	 * A renamed Version header inside a tag under cooldown keeps the hold.
+	 */
+	public function test_renamed_header_keeps_cooldown_hold(): void {
+		$this->add_release( self::HELD_TAG, self::RENAMED_VERSION );
+
+		$this->assertTrue( API_Update_Updater::update_single_plugin( $this->plugin->post_name ) );
+
+		$this->assertSame( self::SERVED_VERSION, $this->served_version() );
+		$this->assertNotFalse( wp_next_scheduled( "release_to_update_api:{$this->plugin->post_name}" ) );
+	}
+
+	/**
+	 * A renamed Version header inside a blocked tag keeps the block's hold.
+	 */
+	public function test_renamed_header_keeps_block_hold(): void {
+		$this->add_release(
+			self::HELD_TAG,
+			self::RENAMED_VERSION,
+			array(
+				'release_block' => array(
+					'scan_id'    => 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+					'risk_score' => 9.8,
+					'blocked_at' => time(),
+				),
+			)
+		);
+
+		$this->assertTrue( API_Update_Updater::update_single_plugin( $this->plugin->post_name ) );
+
+		$this->assertSame( self::SERVED_VERSION, $this->served_version() );
+		$this->assertFalse( wp_next_scheduled( "release_to_update_api:{$this->plugin->post_name}" ) );
+	}
+
+	/**
+	 * A header renamed to another, clean release's version still resolves the
+	 * hold from the stable tag serving the package.
+	 */
+	public function test_header_renamed_to_other_release_version_keeps_hold(): void {
+		$this->add_release( '2.0', '2.0', array( 'release_delay' => 0 ) );
+		$this->add_release(
+			self::HELD_TAG,
+			self::RENAMED_VERSION,
+			array(
+				'release_block' => array( 'blocked_at' => time() ),
+			)
+		);
+		update_post_meta( $this->plugin->ID, 'version', '2.0' );
+
+		$this->assertTrue( API_Update_Updater::update_single_plugin( $this->plugin->post_name ) );
+
+		$this->assertSame( self::SERVED_VERSION, $this->served_version() );
+	}
+
+	/**
+	 * A scan-driven block lands on the stable tag's release despite the rename.
+	 */
+	public function test_block_release_records_block_on_stable_tag_release(): void {
+		$this->add_release( self::HELD_TAG, self::RENAMED_VERSION );
+
+		$this->assertTrue( API_Update_Updater::block_release( $this->plugin->post_name, array( 'risk_score' => 9.8 ) ) );
+
+		$release = Plugin_Directory::get_release( get_post( $this->plugin->ID ), self::HELD_TAG );
+		$this->assertTrue( API_Update_Updater::is_release_blocked( $release ) );
+	}
+
+	/**
+	 * A reviewer force-release lifts the hold on the stable tag's release and
+	 * serves the version despite the rename.
+	 */
+	public function test_force_release_serves_renamed_version(): void {
+		$this->add_release(
+			self::HELD_TAG,
+			self::RENAMED_VERSION,
+			array(
+				'release_block' => array( 'blocked_at' => time() ),
+			)
+		);
+
+		$this->assertTrue( API_Update_Updater::force_release( $this->plugin->post_name, 'Reviewed; findings are a false positive.' ) );
+
+		$this->assertSame( self::RENAMED_VERSION, $this->served_version() );
+	}
+
+	/**
+	 * Trunk releases keep resolving by version: their rows are keyed
+	 * `trunk@{version}` and there is no stable tag release to prefer.
+	 */
+	public function test_trunk_release_still_resolves_by_version(): void {
+		update_post_meta( $this->plugin->ID, 'stable_tag', 'trunk' );
+		$this->add_release( 'trunk@' . self::RENAMED_VERSION, self::RENAMED_VERSION );
+
+		$this->assertTrue( API_Update_Updater::update_single_plugin( $this->plugin->post_name ) );
+
+		$this->assertSame( self::SERVED_VERSION, $this->served_version() );
+		$this->assertNotFalse( wp_next_scheduled( "release_to_update_api:{$this->plugin->post_name}" ) );
+	}
+}

From 99e55b15017ae36e4b2f95b06fe312b13ec5bf4d Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Thu, 13 Aug 2026 15:23:43 -0500
Subject: [PATCH 02/14] Resolve holds consistently from the stable-tag release,
 not the header.

Review fixes:
- get_current_release() no longer falls back to the header version for
  tagged plugins (only trunk-stable ones, which are keyed trunk@{version}),
  closing a fail-open that reverted tagged plugins to header-keyed
  resolution and removing a redundant get_release pass per plugin.
- block_release()'s already-served guard and force_release()'s audit note
  now key on the resolved release's version instead of the header meta.
- Both cooldown notices name the resolved release; the committer notice
  computes its window from compute_release_time() to match enforcement.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../admin/metabox/class-controls.php          |  7 ++-
 .../jobs/class-api-update-updater.php         | 27 +++++++----
 .../shortcodes/class-release-confirmation.php |  6 +--
 .../tests/Current_Release_Resolution_Test.php | 46 +++++++++++++++++++
 4 files changed, 71 insertions(+), 15 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
index d9318fdb78..3cbf8a9549 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
@@ -65,6 +65,9 @@ protected static function display_release_cooldown() {
 			return;
 		}
 
+		// The held release is resolved from the stable tag, so name it — not the Version header, which may disagree.
+		$release_version = $release['version'];
+
 		$release_delay = (int) ( $release['release_delay'] ?? 0 );
 		if ( ! $release_delay ) {
 			return;
@@ -82,7 +85,7 @@ protected static function display_release_cooldown() {
 			printf(
 				/* translators: 1: version, 2: relative time until cooldown expires, 3: absolute UTC timestamp */
 				esc_html__( 'Version %1$s is in the release cooldown — it will be served to sites in %2$s (at %3$s UTC).', 'wporg-plugins' ),
-				esc_html( $version ),
+				esc_html( $release_version ),
 				esc_html( human_time_diff( time(), $cooldown_until ) ),
 				esc_html( gmdate( 'Y-m-d H:i', $cooldown_until ) )
 			);
@@ -105,7 +108,7 @@ protected static function display_release_cooldown() {
 						printf(
 							/* translators: %s: version */
 							esc_html__( 'Force-release %s now', 'wporg-plugins' ),
-							esc_html( $version )
+							esc_html( $release_version )
 						);
 						?>
 					</button>
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index 213112bf64..9d92b2c906 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -234,17 +234,24 @@ public static function get_served_version( $plugin_slug ) {
 	/**
 	 * The release being served or held for a plugin's current version.
 	 *
-	 * Resolved from the stable tag first — the served package is built from it,
-	 * and a Version header that doesn't match its tag must not orphan the
-	 * release's block or cooldown — falling back to the version for trunk
-	 * releases, which are keyed `trunk@{version}`.
+	 * Tagged plugins resolve strictly by the stable tag — the source the served
+	 * package is built from — so a Version header that disagrees with its tag
+	 * cannot redirect the release's block or cooldown onto a different release.
+	 * Trunk-stable plugins have no tag-named release row (theirs are keyed
+	 * `trunk@{version}`), so they resolve by version; their identity is the
+	 * header itself, so a header rename there is out of this method's reach.
 	 *
 	 * @param \WP_Post $post The plugin post.
 	 * @return array|false The release row from Plugin_Directory::get_release(), or false when none exists.
 	 */
 	public static function get_current_release( $post ) {
-		return Plugin_Directory::get_release( $post, get_post_meta( $post->ID, 'stable_tag', true ) )
-			?: Plugin_Directory::get_release( $post, get_post_meta( $post->ID, 'version', true ) );
+		$stable_tag = get_post_meta( $post->ID, 'stable_tag', true );
+
+		if ( ! $stable_tag || 'trunk' === $stable_tag ) {
+			return Plugin_Directory::get_release( $post, get_post_meta( $post->ID, 'version', true ) );
+		}
+
+		return Plugin_Directory::get_release( $post, $stable_tag );
 	}
 
 	/**
@@ -282,14 +289,13 @@ public static function block_release( $plugin_slug, array $block ) {
 			return false;
 		}
 
-		$version = get_post_meta( $post->ID, 'version', true );
 		$release = self::get_current_release( $post );
 		if ( ! $release ) {
 			return false;
 		}
 
-		// Already live: a block can't un-ship a served version (compared with the column's varchar(128) truncation).
-		if ( self::get_served_version( $plugin_slug ) === substr( (string) $version, 0, 128 ) ) {
+		// Already live: a block can't un-ship the resolved release once it's the served version (compared with the column's varchar(128) truncation).
+		if ( self::get_served_version( $plugin_slug ) === substr( (string) ( $release['version'] ?? '' ), 0, 128 ) ) {
 			return false;
 		}
 
@@ -473,13 +479,14 @@ public static function force_release( $plugin_slug, $reason, $user = null ) {
 			return false;
 		}
 
-		$version = get_post_meta( $post->ID, 'version', true );
 		$release = self::get_current_release( $post );
 
 		if ( ! $release ) {
 			return false;
 		}
 
+		$version = $release['version'];
+
 		// Log only what is actually lifted: a deleted block's only trace, and the cooldown only while it still runs.
 		$lifted = array();
 
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
index 02a6b2a092..6b19e8a68b 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
@@ -498,8 +498,8 @@ public static function frontend_cooldown_notice( $post = null ) {
 			return;
 		}
 
-		$release_time   = $release['confirmations'] ? max( $release['confirmations'] ) : (int) $release['date'];
-		$cooldown_until = $release_time + $release_delay;
+		// Match the enforced window: compute_release_time() is what update_single_plugin() gates on.
+		$cooldown_until = API_Update_Updater::compute_release_time( $post, $release ) + $release_delay;
 
 		if ( $cooldown_until <= time() ) {
 			return;
@@ -511,7 +511,7 @@ public static function frontend_cooldown_notice( $post = null ) {
 				sprintf(
 					/* translators: 1: plugin version, 2: relative time until cooldown expires, 3: delay duration in hours, 4: plugins@wordpress.org link */
 					__( 'Version %1$s will be released to sites in about %2$s. WordPress.org currently delays plugin updates by %3$d hours so moderators and security scanners can review changes before they reach users. If this update fixes a security issue that needs to ship sooner, contact %4$s.', 'wporg-plugins' ),
-					'<code>' . esc_html( $version ) . '</code>',
+					'<code>' . esc_html( $release['version'] ) . '</code>',
 					esc_html( human_time_diff( time(), $cooldown_until ) ),
 					(int) ( $release_delay / HOUR_IN_SECONDS ),
 					'<a href="mailto:plugins@wordpress.org">plugins@wordpress.org</a>'
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
index 3e0ee9595f..365aff3067 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
@@ -232,4 +232,50 @@ public function test_trunk_release_still_resolves_by_version(): void {
 		$this->assertSame( self::SERVED_VERSION, $this->served_version() );
 		$this->assertNotFalse( wp_next_scheduled( "release_to_update_api:{$this->plugin->post_name}" ) );
 	}
+
+	/**
+	 * A tagged plugin resolves strictly by its stable tag: a release row that
+	 * exists only for the header version is not a fallback.
+	 */
+	public function test_tagged_plugin_ignores_version_release_row(): void {
+		$this->add_release( self::RENAMED_VERSION, self::RENAMED_VERSION, array( 'release_block' => array( 'blocked_at' => time() ) ) );
+
+		$this->assertFalse( API_Update_Updater::get_current_release( get_post( $this->plugin->ID ) ) );
+	}
+
+	/**
+	 * The block's already-served guard compares the resolved release's version,
+	 * not the header: a header renamed to equal the served version cannot make
+	 * a different, unserved release look already-live and refuse the block.
+	 */
+	public function test_block_release_guard_uses_resolved_release_version(): void {
+		update_post_meta( $this->plugin->ID, 'version', self::SERVED_VERSION );
+		$this->add_release( self::HELD_TAG, '2.0' );
+
+		$this->assertTrue( API_Update_Updater::block_release( $this->plugin->post_name, array( 'risk_score' => 9.8 ) ) );
+
+		$release = Plugin_Directory::get_release( get_post( $this->plugin->ID ), self::HELD_TAG );
+		$this->assertTrue( API_Update_Updater::is_release_blocked( $release ) );
+	}
+
+	/**
+	 * The force-release audit note names the release actually unblocked — the
+	 * stable-tag-resolved one — not the plugin's Version header.
+	 */
+	public function test_force_release_audit_log_names_resolved_release(): void {
+		update_post_meta( $this->plugin->ID, 'version', '9.9.9' );
+		$this->add_release( self::HELD_TAG, '7.7.7', array( 'release_block' => array( 'blocked_at' => time() ) ) );
+
+		$this->assertTrue( API_Update_Updater::force_release( $this->plugin->post_name, 'Reviewed.' ) );
+
+		$notes = get_comments(
+			array(
+				'post_id' => $this->plugin->ID,
+				'type'    => 'internal-note',
+			)
+		);
+		$this->assertNotEmpty( $notes );
+		$this->assertStringContainsString( 'version 7.7.7', $notes[0]->comment_content );
+		$this->assertStringNotContainsString( '9.9.9', $notes[0]->comment_content );
+	}
 }

From b58593b319429df75c8101cbd9db68258a4dda88 Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Thu, 13 Aug 2026 16:05:10 -0500
Subject: [PATCH 03/14] Harden hold resolution: strict tag match, block gate,
 UI on empty header.

Second review round:
- get_current_release() matches the release strictly by tag instead of
  through Plugin_Directory::get_release(), whose loose == collapses
  numerically-equal tags ('1.4'/'1.40') and whose tag-first lookup lets a
  dormant tag shadow the trunk@{version} row.
- The block hold no longer gates on the header-derived is_new_version, so a
  header renamed to match the served version can't write the blocked tag live.
- block_release()'s already-served guard no longer reads empty === empty as
  a match.
- The cooldown UIs resolve and key off the stable-tag release: the metabox
  force-release staleness token is the release tag (not the header version),
  and both notices no longer bail on an empty header version, so an enforced
  hold stays visible and liftable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../admin/metabox/class-controls.php          | 20 +++----
 .../jobs/class-api-update-updater.php         | 35 ++++++++---
 .../shortcodes/class-release-confirmation.php |  6 +-
 .../tests/Current_Release_Resolution_Test.php | 58 +++++++++++++++++++
 4 files changed, 93 insertions(+), 26 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
index 3cbf8a9549..376aafe1d1 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
@@ -55,17 +55,12 @@ static function display() {
 	protected static function display_release_cooldown() {
 		$post = get_post();
 
-		$version = get_post_meta( $post->ID, 'version', true );
-		if ( ! $version ) {
-			return;
-		}
-
+		// Resolved from the stable tag, so the hold shows even when the Version header is empty or disagrees.
 		$release = API_Update_Updater::get_current_release( $post );
 		if ( ! $release ) {
 			return;
 		}
 
-		// The held release is resolved from the stable tag, so name it — not the Version header, which may disagree.
 		$release_version = $release['version'];
 
 		$release_delay = (int) ( $release['release_delay'] ?? 0 );
@@ -103,7 +98,7 @@ protected static function display_release_cooldown() {
 					></textarea>
 				</p>
 				<p>
-					<button type="submit" name="force_release_version" value="<?php echo esc_attr( $version ); ?>" class="button">
+					<button type="submit" name="force_release_tag" value="<?php echo esc_attr( $release['tag'] ); ?>" class="button">
 						<?php
 						printf(
 							/* translators: %s: version */
@@ -124,7 +119,7 @@ protected static function display_release_cooldown() {
 	 * @param int $post_id The post being saved.
 	 */
 	public static function save_post( $post_id ) {
-		if ( empty( $_POST['force_release_version'] ) ) {
+		if ( empty( $_POST['force_release_tag'] ) ) {
 			return;
 		}
 
@@ -141,10 +136,11 @@ public static function save_post( $post_id ) {
 		// and to make the security boundary explicit.
 		check_admin_referer( 'update-post_' . $post_id );
 
-		$version           = get_post_meta( $post->ID, 'version', true );
-		$submitted_version = sanitize_text_field( wp_unslash( $_POST['force_release_version'] ) );
-		if ( $submitted_version !== $version ) {
-			// Submitted version doesn't match current — a newer commit landed since the form was rendered.
+		// Staleness guard on the release identity, not the header version: a newer commit
+		// that moved the stable tag since the form rendered lands a different release here.
+		$release       = API_Update_Updater::get_current_release( $post );
+		$submitted_tag = sanitize_text_field( wp_unslash( $_POST['force_release_tag'] ) );
+		if ( ! $release || $submitted_tag !== (string) $release['tag'] ) {
 			return;
 		}
 
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index 9d92b2c906..90918dafc0 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -101,11 +101,16 @@ public static function update_single_plugin( $plugin_slug ) {
 		$is_new_version = substr( (string) $version, 0, 128 ) !== $existing_version;
 
 		/*
-		 * Hold a blocked version out of the row: the previously served version keeps
+		 * Hold a blocked release out of the row: the previously served version keeps
 		 * being served, and the deferred serve is cancelled rather than postponed.
 		 * Status changes still reach the row right away.
+		 *
+		 * Gated on the block alone, not $is_new_version: a header renamed to match
+		 * the served version would make that proxy false, writing the blocked
+		 * release's stable tag live. block_release() already refuses to block a
+		 * served release, so a held release is never the one already in the row.
 		 */
-		if ( self::is_release_blocked( $release ) && $is_new_version ) {
+		if ( self::is_release_blocked( $release ) ) {
 			wp_clear_scheduled_hook( "release_to_update_api:{$post->post_name}" );
 
 			if ( $existing_row ) {
@@ -238,20 +243,31 @@ public static function get_served_version( $plugin_slug ) {
 	 * package is built from — so a Version header that disagrees with its tag
 	 * cannot redirect the release's block or cooldown onto a different release.
 	 * Trunk-stable plugins have no tag-named release row (theirs are keyed
-	 * `trunk@{version}`), so they resolve by version; their identity is the
-	 * header itself, so a header rename there is out of this method's reach.
+	 * `trunk@{version}`), so they resolve by that key; their identity is the
+	 * header version, so a header rename there is out of this method's reach.
+	 *
+	 * Matched strictly by tag, unlike Plugin_Directory::get_release(): its
+	 * wp_list_filter() match is loose (`'1.4' == '1.40'`) and prefers a bare
+	 * tag over a `trunk@{version}` row, either of which could resolve a hold
+	 * off the wrong release.
 	 *
 	 * @param \WP_Post $post The plugin post.
-	 * @return array|false The release row from Plugin_Directory::get_release(), or false when none exists.
+	 * @return array|false The matching release row, or false when none exists.
 	 */
 	public static function get_current_release( $post ) {
 		$stable_tag = get_post_meta( $post->ID, 'stable_tag', true );
 
-		if ( ! $stable_tag || 'trunk' === $stable_tag ) {
-			return Plugin_Directory::get_release( $post, get_post_meta( $post->ID, 'version', true ) );
+		$target = ( ! $stable_tag || 'trunk' === $stable_tag )
+			? 'trunk@' . get_post_meta( $post->ID, 'version', true )
+			: $stable_tag;
+
+		foreach ( (array) Plugin_Directory::get_releases( $post ) as $release ) {
+			if ( isset( $release['tag'] ) && (string) $release['tag'] === (string) $target ) {
+				return $release;
+			}
 		}
 
-		return Plugin_Directory::get_release( $post, $stable_tag );
+		return false;
 	}
 
 	/**
@@ -295,7 +311,8 @@ public static function block_release( $plugin_slug, array $block ) {
 		}
 
 		// Already live: a block can't un-ship the resolved release once it's the served version (compared with the column's varchar(128) truncation).
-		if ( self::get_served_version( $plugin_slug ) === substr( (string) ( $release['version'] ?? '' ), 0, 128 ) ) {
+		$served_version = self::get_served_version( $plugin_slug );
+		if ( '' !== $served_version && substr( (string) ( $release['version'] ?? '' ), 0, 128 ) === $served_version ) {
 			return false;
 		}
 
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
index 6b19e8a68b..1ac95b5082 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
@@ -483,11 +483,7 @@ public static function frontend_cooldown_notice( $post = null ) {
 			return;
 		}
 
-		$version = get_post_meta( $post->ID, 'version', true );
-		if ( ! $version ) {
-			return;
-		}
-
+		// Resolved from the stable tag, so the notice shows even when the Version header is empty or disagrees.
 		$release = API_Update_Updater::get_current_release( $post );
 		if ( ! $release ) {
 			return;
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
index 365aff3067..b2f3ae86a8 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
@@ -258,6 +258,64 @@ public function test_block_release_guard_uses_resolved_release_version(): void {
 		$this->assertTrue( API_Update_Updater::is_release_blocked( $release ) );
 	}
 
+	/**
+	 * A header renamed down to the already-served version cannot write the
+	 * blocked tag into update_source: the block gate no longer keys on the
+	 * header-derived is_new_version proxy.
+	 */
+	public function test_block_held_when_header_matches_served_version(): void {
+		global $wpdb;
+
+		update_post_meta( $this->plugin->ID, 'version', self::SERVED_VERSION );
+		$this->add_release( self::HELD_TAG, self::SERVED_VERSION, array( 'release_block' => array( 'blocked_at' => time() ) ) );
+
+		$this->assertTrue( API_Update_Updater::update_single_plugin( $this->plugin->post_name ) );
+
+		$row = $wpdb->get_row( $wpdb->prepare( "SELECT version, stable_tag FROM {$wpdb->prefix}update_source WHERE plugin_slug = %s", $this->plugin->post_name ) );
+		$this->assertSame( self::SERVED_VERSION, $row->version );
+		$this->assertSame( self::SERVED_VERSION, $row->stable_tag );
+	}
+
+	/**
+	 * The already-served guard doesn't read an empty served version and an empty
+	 * resolved version as a match, which would wrongly refuse the block.
+	 */
+	public function test_block_not_refused_for_empty_versions(): void {
+		global $wpdb;
+
+		$wpdb->delete( $wpdb->prefix . 'update_source', array( 'plugin_slug' => $this->plugin->post_name ) );
+		$this->add_release( self::HELD_TAG, '' );
+
+		$this->assertTrue( API_Update_Updater::block_release( $this->plugin->post_name, array( 'risk_score' => 9.8 ) ) );
+		$this->assertTrue( API_Update_Updater::is_release_blocked( Plugin_Directory::get_release( get_post( $this->plugin->ID ), self::HELD_TAG ) ) );
+	}
+
+	/**
+	 * A tag that is numerically equal but textually different to the stable tag
+	 * does not resolve: the match is strict, not wp_list_filter's loose ==.
+	 */
+	public function test_numeric_collision_tag_not_matched(): void {
+		update_post_meta( $this->plugin->ID, 'stable_tag', '1.4' );
+		$this->add_release( '1.40', '1.40', array( 'release_block' => array( 'blocked_at' => time() ) ) );
+
+		$this->assertFalse( API_Update_Updater::get_current_release( get_post( $this->plugin->ID ) ) );
+	}
+
+	/**
+	 * A dormant SVN tag named like the trunk version does not shadow the
+	 * `trunk@{version}` release the trunk plugin actually serves.
+	 */
+	public function test_trunk_version_not_shadowed_by_like_named_tag(): void {
+		update_post_meta( $this->plugin->ID, 'stable_tag', 'trunk' );
+		update_post_meta( $this->plugin->ID, 'version', '1.2.3' );
+		$this->add_release( '1.2.3', '1.2.3', array( 'release_block' => array( 'blocked_at' => time() ) ) );
+		$this->add_release( 'trunk@1.2.3', '1.2.3' );
+
+		$release = API_Update_Updater::get_current_release( get_post( $this->plugin->ID ) );
+		$this->assertSame( 'trunk@1.2.3', $release['tag'] );
+		$this->assertFalse( API_Update_Updater::is_release_blocked( $release ) );
+	}
+
 	/**
 	 * The force-release audit note names the release actually unblocked — the
 	 * stable-tag-resolved one — not the plugin's Version header.

From 7b89c7f3fc1b85ff81180731fc27b5bf140e5e6e Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 11:55:35 -0500
Subject: [PATCH 04/14] Key the already-served guard and the release write on
 the tag.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

block_release()'s already-served guard compared the resolved release's
version against update_source.version, while the release identity is the
tag: a re-commit into the served tag with a bumped header missed the
guard and recorded a block that held nothing. The guard now compares by
identity — the ref against the row's stable_tag for tagged releases,
falling back to the version for ref-less trunk-stable rows — via a
get_served_row() helper that get_served_version() now delegates to.

add_release() looked up the existing release through get_release(),
whose wp_list_filter() match is loose ('1.4' == '1.40'): the write could
merge onto a numerically-equal different release and, through the strict
dedupe below it, delete the genuine row. The lookup is now a strict tag
match, consistent with the dedupe.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../class-plugin-directory.php                | 13 ++++-
 .../jobs/class-api-update-updater.php         | 39 +++++++++----
 .../tests/Current_Release_Resolution_Test.php | 55 ++++++++++++++++++-
 3 files changed, 94 insertions(+), 13 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php
index d1969f4c15..052a6e7da7 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php
@@ -1722,7 +1722,16 @@ public static function add_release( $plugin, $data ) {
 
 		$plugin = self::get_plugin_post( $plugin );
 
-		$release = self::get_release( $plugin, $data['tag'] ) ?: [
+		// Strict match only: get_release()'s loose lookup ('1.4' == '1.40') could merge onto the wrong release.
+		$release = false;
+		foreach ( self::get_releases( $plugin ) as $r ) {
+			if ( isset( $r['tag'] ) && (string) $r['tag'] === $data['tag'] ) {
+				$release = $r;
+				break;
+			}
+		}
+
+		$release = $release ?: [
 			'date'                     => time(),
 			'tag'                      => '',
 			'version'                  => '',
@@ -1772,7 +1781,7 @@ public static function add_release( $plugin, $data ) {
 		// Find any other releases using this slug (as in the case of updates) and remove it.
 		// Only one release can exist in any given tag.
 		foreach ( $releases as $i => $r ) {
-			if ( $r['tag'] === $release['tag'] ) {
+			if ( (string) $r['tag'] === $release['tag'] ) {
 				unset( $releases[ $i ] );
 			}
 		}
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index 90918dafc0..b3b863d8f1 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -220,22 +220,32 @@ public static function update_single_plugin( $plugin_slug ) {
 	}
 
 	/**
-	 * The version currently served from `update_source`.
+	 * The `update_source` row identifying what is currently served.
 	 *
 	 * @param string $plugin_slug The plugin slug.
-	 * @return string The served version, or '' when the plugin isn't in `update_source`.
+	 * @return object|null The row's version and stable_tag, or null when the plugin isn't in `update_source`.
 	 */
-	public static function get_served_version( $plugin_slug ) {
+	public static function get_served_row( $plugin_slug ) {
 		global $wpdb;
 
-		return (string) $wpdb->get_var(
+		return $wpdb->get_row(
 			$wpdb->prepare(
-				"SELECT version FROM {$wpdb->prefix}update_source WHERE plugin_slug = %s",
+				"SELECT version, stable_tag FROM {$wpdb->prefix}update_source WHERE plugin_slug = %s",
 				$plugin_slug
 			)
 		);
 	}
 
+	/**
+	 * The version currently served from `update_source`.
+	 *
+	 * @param string $plugin_slug The plugin slug.
+	 * @return string The served version, or '' when the plugin isn't in `update_source`.
+	 */
+	public static function get_served_version( $plugin_slug ) {
+		return (string) ( self::get_served_row( $plugin_slug )->version ?? '' );
+	}
+
 	/**
 	 * The release being served or held for a plugin's current version.
 	 *
@@ -291,7 +301,7 @@ public static function is_release_blocked( $release ) {
 	 * version itself stays blocked until a reviewer force-releases it.
 	 *
 	 * The counterpart to force_release(). It refuses when the version cannot be
-	 * held: no plugin, no release, or the version already being served. Blocking
+	 * held: no plugin, no release, or the release already being served. Blocking
 	 * an already-held release is a no-op success that preserves the existing
 	 * block. Capability checks and audit logging are the caller's.
 	 *
@@ -310,10 +320,19 @@ public static function block_release( $plugin_slug, array $block ) {
 			return false;
 		}
 
-		// Already live: a block can't un-ship the resolved release once it's the served version (compared with the column's varchar(128) truncation).
-		$served_version = self::get_served_version( $plugin_slug );
-		if ( '' !== $served_version && substr( (string) ( $release['version'] ?? '' ), 0, 128 ) === $served_version ) {
-			return false;
+		// Already live: a block can't un-ship a served release — compared by identity (the ref for tagged rows, the version for ref-less trunk-stable rows), with the columns' varchar(128) truncation.
+		$served = self::get_served_row( $plugin_slug );
+		if ( $served ) {
+			if ( $served->stable_tag && 'trunk' !== $served->stable_tag ) {
+				$is_served = substr( (string) $release['tag'], 0, 128 ) === (string) $served->stable_tag;
+			} else {
+				$is_served = '' !== (string) $served->version
+					&& substr( (string) ( $release['version'] ?? '' ), 0, 128 ) === (string) $served->version;
+			}
+
+			if ( $is_served ) {
+				return false;
+			}
 		}
 
 		// Already held; recording a second block would merge it into the first.
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
index b2f3ae86a8..979b12bfcc 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
@@ -244,7 +244,7 @@ public function test_tagged_plugin_ignores_version_release_row(): void {
 	}
 
 	/**
-	 * The block's already-served guard compares the resolved release's version,
+	 * The block's already-served guard keys on the resolved release's identity,
 	 * not the header: a header renamed to equal the served version cannot make
 	 * a different, unserved release look already-live and refuse the block.
 	 */
@@ -316,6 +316,59 @@ public function test_trunk_version_not_shadowed_by_like_named_tag(): void {
 		$this->assertFalse( API_Update_Updater::is_release_blocked( $release ) );
 	}
 
+	/**
+	 * A re-commit into the already-served tag cannot be blocked, even when it
+	 * bumps the header: the guard compares the ref the row serves, not the
+	 * version label, so it can't claim to hold a package that already shipped.
+	 */
+	public function test_block_refused_for_recommit_into_served_tag(): void {
+		update_post_meta( $this->plugin->ID, 'stable_tag', self::SERVED_VERSION );
+		update_post_meta( $this->plugin->ID, 'version', '1.0.1' );
+		$this->add_release( self::SERVED_VERSION, '1.0.1' );
+
+		$this->assertFalse( API_Update_Updater::block_release( $this->plugin->post_name, array( 'risk_score' => 9.8 ) ) );
+		$this->assertFalse( API_Update_Updater::is_release_blocked( Plugin_Directory::get_release( get_post( $this->plugin->ID ), self::SERVED_VERSION ) ) );
+	}
+
+	/**
+	 * Trunk-stable rows carry no per-release ref, so the already-served guard
+	 * falls back to their identity — the version — and still refuses the block.
+	 */
+	public function test_block_refused_for_served_trunk_release(): void {
+		global $wpdb;
+
+		$wpdb->update(
+			$wpdb->prefix . 'update_source',
+			array( 'stable_tag' => 'trunk' ),
+			array( 'plugin_slug' => $this->plugin->post_name )
+		);
+		update_post_meta( $this->plugin->ID, 'stable_tag', 'trunk' );
+		update_post_meta( $this->plugin->ID, 'version', self::SERVED_VERSION );
+		$this->add_release( 'trunk@' . self::SERVED_VERSION, self::SERVED_VERSION );
+
+		$this->assertFalse( API_Update_Updater::block_release( $this->plugin->post_name, array( 'risk_score' => 9.8 ) ) );
+		$this->assertFalse( API_Update_Updater::is_release_blocked( Plugin_Directory::get_release( get_post( $this->plugin->ID ), 'trunk@' . self::SERVED_VERSION ) ) );
+	}
+
+	/**
+	 * The block's write lands on the exact tag: add_release() must not merge it
+	 * onto a numerically-equal different release ('1.4' == '1.40') and delete
+	 * the genuine row in the process.
+	 */
+	public function test_block_write_lands_on_exact_tag_not_numeric_equal(): void {
+		update_post_meta( $this->plugin->ID, 'stable_tag', '1.4' );
+		$this->add_release( '1.40', '1.40', array( 'date' => time() ) );
+		$this->add_release( '1.4', '1.4', array( 'date' => time() - DAY_IN_SECONDS ) );
+
+		$this->assertTrue( API_Update_Updater::block_release( $this->plugin->post_name, array( 'risk_score' => 9.8 ) ) );
+
+		$releases = array_column( Plugin_Directory::get_releases( $this->plugin ), null, 'tag' );
+		$this->assertSame( '1.4', $releases['1.4']['version'] );
+		$this->assertTrue( API_Update_Updater::is_release_blocked( $releases['1.4'] ) );
+		$this->assertSame( '1.40', $releases['1.40']['version'] );
+		$this->assertFalse( API_Update_Updater::is_release_blocked( $releases['1.40'] ) );
+	}
+
 	/**
 	 * The force-release audit note names the release actually unblocked — the
 	 * stable-tag-resolved one — not the plugin's Version header.

From 2e3f3752c01992cb4acfce0db6b01198df95633a Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 12:03:30 -0500
Subject: [PATCH 05/14] Tighten comments.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../admin/metabox/class-controls.php          |  3 +-
 .../jobs/class-api-update-updater.php         | 30 +++++++------------
 2 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
index 376aafe1d1..3aaf0eca40 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php
@@ -136,8 +136,7 @@ public static function save_post( $post_id ) {
 		// and to make the security boundary explicit.
 		check_admin_referer( 'update-post_' . $post_id );
 
-		// Staleness guard on the release identity, not the header version: a newer commit
-		// that moved the stable tag since the form rendered lands a different release here.
+		// Staleness guard on the release identity: a commit that moved the stable tag since the form rendered lands a different release here.
 		$release       = API_Update_Updater::get_current_release( $post );
 		$submitted_tag = sanitize_text_field( wp_unslash( $_POST['force_release_tag'] ) );
 		if ( ! $release || $submitted_tag !== (string) $release['tag'] ) {
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index b3b863d8f1..ae10cb276c 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -101,14 +101,11 @@ public static function update_single_plugin( $plugin_slug ) {
 		$is_new_version = substr( (string) $version, 0, 128 ) !== $existing_version;
 
 		/*
-		 * Hold a blocked release out of the row: the previously served version keeps
-		 * being served, and the deferred serve is cancelled rather than postponed.
-		 * Status changes still reach the row right away.
-		 *
-		 * Gated on the block alone, not $is_new_version: a header renamed to match
-		 * the served version would make that proxy false, writing the blocked
-		 * release's stable tag live. block_release() already refuses to block a
-		 * served release, so a held release is never the one already in the row.
+		 * Hold a blocked release out of the row: the previous version keeps being
+		 * served, the deferred serve is cancelled, and status changes still reach
+		 * the row. Gated on the block alone — a header renamed to the served
+		 * version turns the $is_new_version proxy false, and block_release()
+		 * refuses served releases, so a held release is never already in the row.
 		 */
 		if ( self::is_release_blocked( $release ) ) {
 			wp_clear_scheduled_hook( "release_to_update_api:{$post->post_name}" );
@@ -249,17 +246,12 @@ public static function get_served_version( $plugin_slug ) {
 	/**
 	 * The release being served or held for a plugin's current version.
 	 *
-	 * Tagged plugins resolve strictly by the stable tag — the source the served
-	 * package is built from — so a Version header that disagrees with its tag
-	 * cannot redirect the release's block or cooldown onto a different release.
-	 * Trunk-stable plugins have no tag-named release row (theirs are keyed
-	 * `trunk@{version}`), so they resolve by that key; their identity is the
-	 * header version, so a header rename there is out of this method's reach.
-	 *
-	 * Matched strictly by tag, unlike Plugin_Directory::get_release(): its
-	 * wp_list_filter() match is loose (`'1.4' == '1.40'`) and prefers a bare
-	 * tag over a `trunk@{version}` row, either of which could resolve a hold
-	 * off the wrong release.
+	 * Resolved strictly by the stable tag — the source of the served package —
+	 * so a Version header that disagrees with its tag cannot redirect a hold
+	 * onto a different release. Trunk-stable plugins resolve by their
+	 * `trunk@{version}` key instead; their identity is the header version.
+	 * Strict matching, unlike Plugin_Directory::get_release()'s loose lookup
+	 * (`'1.4' == '1.40'`), which could land on the wrong release.
 	 *
 	 * @param \WP_Post $post The plugin post.
 	 * @return array|false The matching release row, or false when none exists.

From b8147e34eead7b1d6e2ba8d55bb685639f2b66e6 Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 12:05:42 -0500
Subject: [PATCH 06/14] Anchor the releases-listing cooldown line on the
 enforced window.

render_cooldown_status() was the last copy of the cooldown-clock
arithmetic still on the old inline formula (latest confirmation, else
the release row's date), so the releases listing could show a serve
time that disagreed with the metabox and the frontend notice on the
same screen. It now derives the window from compute_release_time(),
the anchor update_single_plugin() actually gates on.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../shortcodes/class-release-confirmation.php         | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
index 1ac95b5082..df8845ff6e 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
@@ -266,7 +266,7 @@ static function get_approval_text( $plugin, $data ) {
 			);
 		}
 
-		self::render_cooldown_status( $data );
+		self::render_cooldown_status( $plugin, $data );
 
 		echo '</div>';
 
@@ -289,9 +289,10 @@ static function get_approval_text( $plugin, $data ) {
 	 * force-released), discarded releases, releases that haven't moved past
 	 * confirmation/processing, or where the cooldown window has elapsed.
 	 *
-	 * @param array $data The release row from Plugin_Directory::get_releases().
+	 * @param \WP_Post $plugin The plugin post object.
+	 * @param array    $data   The release row from Plugin_Directory::get_releases().
 	 */
-	protected static function render_cooldown_status( $data ) {
+	protected static function render_cooldown_status( $plugin, $data ) {
 		$release_delay = (int) ( $data['release_delay'] ?? 0 );
 		if ( ! $release_delay ) {
 			return;
@@ -306,8 +307,8 @@ protected static function render_cooldown_status( $data ) {
 			return;
 		}
 
-		$release_time   = $data['confirmations'] ? max( $data['confirmations'] ) : (int) $data['date'];
-		$cooldown_until = $release_time + $release_delay;
+		// Match the enforced window: compute_release_time() is what update_single_plugin() gates on.
+		$cooldown_until = API_Update_Updater::compute_release_time( $plugin, $data ) + $release_delay;
 
 		if ( $cooldown_until <= time() ) {
 			return;

From 07d3401df3005afd5c002629ff39311c09b2ef32 Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 12:09:11 -0500
Subject: [PATCH 07/14] Anchor the release clock on the release date, not
 post_modified.

For plugins without a version_date meta, compute_release_time() fell
back to post_modified, which moves on any post edit: a moderator note
or term change would re-arm the cooldown displays for a version live
for months. The fallback is now the release row's own date, which is
fixed at creation; post_modified remains only as a last resort when
there is no release row at all.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../jobs/class-api-update-updater.php         | 16 +++++++---
 .../tests/Current_Release_Resolution_Test.php | 31 +++++++++++++++++++
 2 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index ae10cb276c..ec9d1cbca9 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -441,16 +441,24 @@ protected static function clear_plugin_caches( $plugin_slug ) {
 	/**
 	 * Determine the release timestamp for a plugin version.
 	 *
-	 * Falls back through the commit timestamp on the plugin post, and is replaced by the
-	 * latest committer-confirmation time when release confirmations are required (the
-	 * version isn't really "released" until the last confirmation lands).
+	 * Anchored on the version's commit time (`version_date`), falling back to the
+	 * release row's own date — unlike post_modified, neither slides on unrelated
+	 * post edits — and replaced by the latest committer-confirmation time when
+	 * release confirmations are required (the version isn't really "released"
+	 * until the last confirmation lands).
 	 *
 	 * @param \WP_Post   $post    The plugin post.
 	 * @param array|bool $release The release row from Plugin_Directory::get_release(), or false.
 	 * @return int Unix timestamp.
 	 */
 	public static function compute_release_time( $post, $release ) {
-		$release_time = strtotime( $post->version_date ? $post->version_date : $post->post_modified );
+		if ( $post->version_date ) {
+			$release_time = strtotime( $post->version_date );
+		} elseif ( ! empty( $release['date'] ) ) {
+			$release_time = (int) $release['date'];
+		} else {
+			$release_time = strtotime( $post->post_modified );
+		}
 
 		if (
 			$release &&
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
index 979b12bfcc..008873e464 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
@@ -369,6 +369,37 @@ public function test_block_write_lands_on_exact_tag_not_numeric_equal(): void {
 		$this->assertFalse( API_Update_Updater::is_release_blocked( $releases['1.40'] ) );
 	}
 
+	/**
+	 * Without a version_date, the release clock anchors on the release row's own
+	 * date: post_modified would slide on unrelated post edits and re-arm cooldown
+	 * displays for an already-served release.
+	 */
+	public function test_release_time_anchors_on_release_date_without_version_date(): void {
+		$release = array(
+			'date'                   => time() - WEEK_IN_SECONDS,
+			'confirmations_required' => 0,
+			'confirmations'          => array(),
+		);
+
+		$this->assertSame( $release['date'], API_Update_Updater::compute_release_time( get_post( $this->plugin->ID ), $release ) );
+	}
+
+	/**
+	 * A version_date on the plugin outranks the release row's date as the clock anchor.
+	 */
+	public function test_release_time_prefers_version_date(): void {
+		$version_time = time() - DAY_IN_SECONDS;
+		update_post_meta( $this->plugin->ID, 'version_date', gmdate( 'Y-m-d H:i:s', $version_time ) );
+
+		$release = array(
+			'date'                   => time() - WEEK_IN_SECONDS,
+			'confirmations_required' => 0,
+			'confirmations'          => array(),
+		);
+
+		$this->assertSame( $version_time, API_Update_Updater::compute_release_time( get_post( $this->plugin->ID ), $release ) );
+	}
+
 	/**
 	 * The force-release audit note names the release actually unblocked — the
 	 * stable-tag-resolved one — not the plugin's Version header.

From 82986694c190d1011c5a4903fa1831597e70b10f Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 12:27:35 -0500
Subject: [PATCH 08/14] Drop get_served_version(); read the row through
 get_served_row().

Its last production caller moved onto get_served_row() when the
already-served guard became identity-based; the tests now read the
row directly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../plugin-directory/jobs/class-api-update-updater.php | 10 ----------
 .../tests/Current_Release_Resolution_Test.php          |  2 +-
 .../plugin-directory/tests/Update_Source_Hold_Test.php | 10 +++++-----
 3 files changed, 6 insertions(+), 16 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index ec9d1cbca9..0586f2c6f6 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -233,16 +233,6 @@ public static function get_served_row( $plugin_slug ) {
 		);
 	}
 
-	/**
-	 * The version currently served from `update_source`.
-	 *
-	 * @param string $plugin_slug The plugin slug.
-	 * @return string The served version, or '' when the plugin isn't in `update_source`.
-	 */
-	public static function get_served_version( $plugin_slug ) {
-		return (string) ( self::get_served_row( $plugin_slug )->version ?? '' );
-	}
-
 	/**
 	 * The release being served or held for a plugin's current version.
 	 *
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
index 008873e464..e5f7c50e2c 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
@@ -132,7 +132,7 @@ private function add_release( string $tag, string $version, array $overrides = a
 	 * @return string The served version.
 	 */
 	private function served_version(): string {
-		return API_Update_Updater::get_served_version( $this->plugin->post_name );
+		return (string) ( API_Update_Updater::get_served_row( $this->plugin->post_name )->version ?? '' );
 	}
 
 	/**
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Update_Source_Hold_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Update_Source_Hold_Test.php
index bfea9d556b..0af9dbf8a0 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Update_Source_Hold_Test.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Update_Source_Hold_Test.php
@@ -290,7 +290,7 @@ public function test_block_holds_unserved_version(): void {
 		$this->assertSame( 'High-risk release.', $block['reason'] );
 		$this->assertNotEmpty( $block['blocked_at'] );
 
-		$this->assertSame( self::SERVED_VERSION, API_Update_Updater::get_served_version( $this->plugin->post_name ) );
+		$this->assertSame( self::SERVED_VERSION, (string) ( $this->get_row()->version ?? '' ) );
 		$this->assertFalse( wp_next_scheduled( "release_to_update_api:{$this->plugin->post_name}" ) );
 	}
 
@@ -313,7 +313,7 @@ public function test_block_outlasts_cooldown(): void {
 
 		API_Update_Updater::update_single_plugin( $this->plugin->post_name );
 
-		$this->assertSame( self::SERVED_VERSION, API_Update_Updater::get_served_version( $this->plugin->post_name ) );
+		$this->assertSame( self::SERVED_VERSION, (string) ( $this->get_row()->version ?? '' ) );
 	}
 
 	/**
@@ -334,7 +334,7 @@ public function test_block_holds_first_release(): void {
 
 		API_Update_Updater::update_single_plugin( $this->plugin->post_name );
 
-		$this->assertSame( '', API_Update_Updater::get_served_version( $this->plugin->post_name ) );
+		$this->assertSame( '', (string) ( $this->get_row()->version ?? '' ) );
 	}
 
 	/**
@@ -453,7 +453,7 @@ public function test_force_release_clears_block(): void {
 		$this->assertTrue( API_Update_Updater::force_release( $this->plugin->post_name, 'Reviewed; false positive.' ) );
 
 		$this->assertFalse( API_Update_Updater::is_release_blocked( $this->get_release() ) );
-		$this->assertSame( self::STAGED_VERSION, API_Update_Updater::get_served_version( $this->plugin->post_name ) );
+		$this->assertSame( self::STAGED_VERSION, (string) ( $this->get_row()->version ?? '' ) );
 
 		$audit_log = $this->get_audit_log();
 		$this->assertStringContainsString( 'lifting the release block', $audit_log );
@@ -471,7 +471,7 @@ public function test_force_release_clears_block_and_cooldown(): void {
 		$this->assertTrue( API_Update_Updater::force_release( $this->plugin->post_name, 'Reviewed; false positive.' ) );
 
 		$this->assertFalse( API_Update_Updater::is_release_blocked( $this->get_release() ) );
-		$this->assertSame( self::STAGED_VERSION, API_Update_Updater::get_served_version( $this->plugin->post_name ) );
+		$this->assertSame( self::STAGED_VERSION, (string) ( $this->get_row()->version ?? '' ) );
 
 		$this->assertStringContainsString(
 			'lifting the release block and bypassing the 24-hour release cooldown',

From c08ee1993bf5d1d9b06fa5efaed5747e150dd946 Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 12:27:54 -0500
Subject: [PATCH 09/14] Show the cooldown line only for the current release.

render_cooldown_status() runs per row in the releases listing, but
compute_release_time() prefers the plugin-wide version_date, so after
a new commit every superseded row with a release_delay re-displayed a
pending serve time. A superseded row is never served; skip everything
but the release the stable tag resolves to.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../shortcodes/class-release-confirmation.php  |  9 ++++++++-
 .../tests/Current_Release_Resolution_Test.php  | 18 ++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
index df8845ff6e..425a117b84 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
@@ -287,7 +287,8 @@ static function get_approval_text( $plugin, $data ) {
 	 * Render a single line describing the cooldown state of a release: pending serve time.
 	 * Skipped for releases without a cooldown delay (feature off at release creation, or
 	 * force-released), discarded releases, releases that haven't moved past
-	 * confirmation/processing, or where the cooldown window has elapsed.
+	 * confirmation/processing, rows other than the current release (superseded rows are
+	 * never served), or where the cooldown window has elapsed.
 	 *
 	 * @param \WP_Post $plugin The plugin post object.
 	 * @param array    $data   The release row from Plugin_Directory::get_releases().
@@ -307,6 +308,12 @@ protected static function render_cooldown_status( $plugin, $data ) {
 			return;
 		}
 
+		// Only the current release can be pending; superseded rows are never served.
+		$current = API_Update_Updater::get_current_release( $plugin );
+		if ( ! $current || (string) $current['tag'] !== (string) ( $data['tag'] ?? '' ) ) {
+			return;
+		}
+
 		// Match the enforced window: compute_release_time() is what update_single_plugin() gates on.
 		$cooldown_until = API_Update_Updater::compute_release_time( $plugin, $data ) + $release_delay;
 
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
index e5f7c50e2c..7c5da51bf0 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
@@ -11,6 +11,7 @@
 use PHPUnit\Framework\TestCase;
 use WordPressdotorg\Plugin_Directory\Jobs\API_Update_Updater;
 use WordPressdotorg\Plugin_Directory\Plugin_Directory;
+use WordPressdotorg\Plugin_Directory\Shortcodes\Release_Confirmation;
 
 /**
  * Tests that a Version header that doesn't match its tag cannot orphan the
@@ -400,6 +401,23 @@ public function test_release_time_prefers_version_date(): void {
 		$this->assertSame( $version_time, API_Update_Updater::compute_release_time( get_post( $this->plugin->ID ), $release ) );
 	}
 
+	/**
+	 * The releases listing shows the cooldown line only for the current release:
+	 * a superseded row is never served, so the plugin-wide version_date anchor
+	 * must not re-display a pending serve time on old rows after a new commit.
+	 */
+	public function test_cooldown_line_only_for_current_release(): void {
+		update_post_meta( $this->plugin->ID, 'version_date', gmdate( 'Y-m-d H:i:s' ) );
+		$this->add_release( self::HELD_TAG, self::RENAMED_VERSION );
+		$this->add_release( '1.0', '1.0', array( 'date' => time() - WEEK_IN_SECONDS ) );
+
+		$releases = array_column( Plugin_Directory::get_releases( $this->plugin ), null, 'tag' );
+		$plugin   = get_post( $this->plugin->ID );
+
+		$this->assertStringContainsString( 'Will be served', Release_Confirmation::get_approval_text( $plugin, $releases[ self::HELD_TAG ] ) );
+		$this->assertStringNotContainsString( 'Will be served', Release_Confirmation::get_approval_text( $plugin, $releases['1.0'] ) );
+	}
+
 	/**
 	 * The force-release audit note names the release actually unblocked — the
 	 * stable-tag-resolved one — not the plugin's Version header.

From f9efae8d5af77d2e0373eef0f569f4b788b5437a Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 12:27:55 -0500
Subject: [PATCH 10/14] Fold add_release()'s lookup and dedupe into one pass.

Both walked get_releases() with the same strict tag comparison, with
nothing persisted in between; one fetch now captures the existing
release and removes every same-tag entry on the way.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../class-plugin-directory.php                | 20 ++++++-------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php
index 052a6e7da7..3b15906673 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php
@@ -1722,12 +1722,14 @@ public static function add_release( $plugin, $data ) {
 
 		$plugin = self::get_plugin_post( $plugin );
 
-		// Strict match only: get_release()'s loose lookup ('1.4' == '1.40') could merge onto the wrong release.
+		$releases = self::get_releases( $plugin );
+
+		// Strict match only: get_release()'s loose lookup ('1.4' == '1.40') could merge onto the wrong release. Only one release can exist in any given tag.
 		$release = false;
-		foreach ( self::get_releases( $plugin ) as $r ) {
+		foreach ( $releases as $i => $r ) {
 			if ( isset( $r['tag'] ) && (string) $r['tag'] === $data['tag'] ) {
-				$release = $r;
-				break;
+				$release = $release ?: $r;
+				unset( $releases[ $i ] );
 			}
 		}
 
@@ -1776,16 +1778,6 @@ public static function add_release( $plugin, $data ) {
 		}
 		unset( $release['unblock'] );
 
-		$releases = self::get_releases( $plugin );
-
-		// Find any other releases using this slug (as in the case of updates) and remove it.
-		// Only one release can exist in any given tag.
-		foreach ( $releases as $i => $r ) {
-			if ( (string) $r['tag'] === $release['tag'] ) {
-				unset( $releases[ $i ] );
-			}
-		}
-
 		// Add this release in
 		$releases[] = $release;
 

From 591d17db87e3a15ba7e0e1c9ce60f2644afa44a3 Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 13:00:51 -0500
Subject: [PATCH 11/14] Resolve the listing's current-release check in constant
 time.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

render_cooldown_status() called get_current_release() per release row,
and that call walks all releases — O(N^2) over a plugin's release
count. The row in hand only needs its tag compared against the current
target, so the target derivation moves into get_current_release_tag()
and the walk disappears from the listing entirely.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../jobs/class-api-update-updater.php         | 20 ++++++++++++++-----
 .../shortcodes/class-release-confirmation.php |  3 +--
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index 0586f2c6f6..b8ba936e69 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -247,11 +247,7 @@ public static function get_served_row( $plugin_slug ) {
 	 * @return array|false The matching release row, or false when none exists.
 	 */
 	public static function get_current_release( $post ) {
-		$stable_tag = get_post_meta( $post->ID, 'stable_tag', true );
-
-		$target = ( ! $stable_tag || 'trunk' === $stable_tag )
-			? 'trunk@' . get_post_meta( $post->ID, 'version', true )
-			: $stable_tag;
+		$target = self::get_current_release_tag( $post );
 
 		foreach ( (array) Plugin_Directory::get_releases( $post ) as $release ) {
 			if ( isset( $release['tag'] ) && (string) $release['tag'] === (string) $target ) {
@@ -262,6 +258,20 @@ public static function get_current_release( $post ) {
 		return false;
 	}
 
+	/**
+	 * The release tag a plugin's current version is served or held under.
+	 *
+	 * @param \WP_Post $post The plugin post.
+	 * @return string The stable tag, or `trunk@{version}` for trunk-stable plugins.
+	 */
+	public static function get_current_release_tag( $post ) {
+		$stable_tag = get_post_meta( $post->ID, 'stable_tag', true );
+
+		return ( ! $stable_tag || 'trunk' === $stable_tag )
+			? 'trunk@' . get_post_meta( $post->ID, 'version', true )
+			: $stable_tag;
+	}
+
 	/**
 	 * Whether a release is being held out of `update_source` by a block.
 	 *
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
index 425a117b84..3a9af5ad3a 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
@@ -309,8 +309,7 @@ protected static function render_cooldown_status( $plugin, $data ) {
 		}
 
 		// Only the current release can be pending; superseded rows are never served.
-		$current = API_Update_Updater::get_current_release( $plugin );
-		if ( ! $current || (string) $current['tag'] !== (string) ( $data['tag'] ?? '' ) ) {
+		if ( (string) ( $data['tag'] ?? '' ) !== (string) API_Update_Updater::get_current_release_tag( $plugin ) ) {
 			return;
 		}
 

From f805ba88f7ed5310c096780d9771859736228fac Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 13:08:22 -0500
Subject: [PATCH 12/14] Fall back to the version release when the ref resolves
 no row.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A stable tag flipped to trunk at an unchanged version creates no
trunk@{version} release row, so get_current_release() returned false —
and a false release fails every gate open: release_delay reads 0,
is_release_blocked() reads false, and the row is rewritten to serve
trunk, whose bytes are where the blocked tag was cut from. The strict
ref lookup now falls back to the version-named, then version-carrying,
release; the fallback only fires on a miss, so it can never redirect a
hold away from a ref-resolved release.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../jobs/class-api-update-updater.php         | 28 +++++++++--
 .../tests/Current_Release_Resolution_Test.php | 46 +++++++++++++++++--
 2 files changed, 67 insertions(+), 7 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index b8ba936e69..a280d5a9ce 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -243,19 +243,41 @@ public static function get_served_row( $plugin_slug ) {
 	 * Strict matching, unlike Plugin_Directory::get_release()'s loose lookup
 	 * (`'1.4' == '1.40'`), which could land on the wrong release.
 	 *
+	 * When the ref has no release row (a stable tag flipped to trunk at an
+	 * unchanged version creates none), the version-named — then version-
+	 * carrying — release is a fallback: a miss would fail the block and
+	 * cooldown gates open, and the fallback never overrides a ref-resolved
+	 * hold.
+	 *
 	 * @param \WP_Post $post The plugin post.
 	 * @return array|false The matching release row, or false when none exists.
 	 */
 	public static function get_current_release( $post ) {
-		$target = self::get_current_release_tag( $post );
+		$target   = self::get_current_release_tag( $post );
+		$releases = (array) Plugin_Directory::get_releases( $post );
 
-		foreach ( (array) Plugin_Directory::get_releases( $post ) as $release ) {
+		foreach ( $releases as $release ) {
 			if ( isset( $release['tag'] ) && (string) $release['tag'] === (string) $target ) {
 				return $release;
 			}
 		}
 
-		return false;
+		$version = (string) get_post_meta( $post->ID, 'version', true );
+		if ( '' === $version ) {
+			return false;
+		}
+
+		$carrying = false;
+		foreach ( $releases as $release ) {
+			if ( (string) ( $release['tag'] ?? '' ) === $version ) {
+				return $release;
+			}
+			if ( ! $carrying && (string) ( $release['version'] ?? '' ) === $version ) {
+				$carrying = $release;
+			}
+		}
+
+		return $carrying;
 	}
 
 	/**
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
index 7c5da51bf0..b061ead165 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
@@ -235,13 +235,51 @@ public function test_trunk_release_still_resolves_by_version(): void {
 	}
 
 	/**
-	 * A tagged plugin resolves strictly by its stable tag: a release row that
-	 * exists only for the header version is not a fallback.
+	 * A release row for the header version is a fallback only: it resolves when
+	 * the stable tag has no row (the gates would otherwise fail open), and never
+	 * overrides the stable tag's own release.
 	 */
-	public function test_tagged_plugin_ignores_version_release_row(): void {
+	public function test_version_release_row_is_fallback_only(): void {
 		$this->add_release( self::RENAMED_VERSION, self::RENAMED_VERSION, array( 'release_block' => array( 'blocked_at' => time() ) ) );
 
-		$this->assertFalse( API_Update_Updater::get_current_release( get_post( $this->plugin->ID ) ) );
+		$release = API_Update_Updater::get_current_release( get_post( $this->plugin->ID ) );
+		$this->assertSame( self::RENAMED_VERSION, $release['tag'] );
+
+		$this->add_release( self::HELD_TAG, self::RENAMED_VERSION );
+
+		$release = API_Update_Updater::get_current_release( get_post( $this->plugin->ID ) );
+		$this->assertSame( self::HELD_TAG, $release['tag'] );
+	}
+
+	/**
+	 * Flipping the stable tag to trunk at an unchanged version creates no
+	 * trunk@{version} release row; the hold on the version-named release must
+	 * keep the gates closed rather than orphan into a fail-open miss.
+	 */
+	public function test_trunk_flip_at_same_version_keeps_hold(): void {
+		update_post_meta( $this->plugin->ID, 'version', self::RENAMED_VERSION );
+		update_post_meta( $this->plugin->ID, 'stable_tag', 'trunk' );
+		$this->add_release( self::RENAMED_VERSION, self::RENAMED_VERSION, array( 'release_block' => array( 'blocked_at' => time() ) ) );
+
+		$release = API_Update_Updater::get_current_release( get_post( $this->plugin->ID ) );
+		$this->assertSame( self::RENAMED_VERSION, $release['tag'] );
+		$this->assertTrue( API_Update_Updater::is_release_blocked( $release ) );
+
+		$this->assertTrue( API_Update_Updater::update_single_plugin( $this->plugin->post_name ) );
+		$this->assertSame( self::SERVED_VERSION, $this->served_version() );
+	}
+
+	/**
+	 * The fallback also survives the combination of both evasions: a renamed
+	 * header inside the held tag, then a stable-tag flip to trunk.
+	 */
+	public function test_trunk_flip_with_renamed_header_keeps_hold(): void {
+		update_post_meta( $this->plugin->ID, 'stable_tag', 'trunk' );
+		$this->add_release( self::HELD_TAG, self::RENAMED_VERSION, array( 'release_block' => array( 'blocked_at' => time() ) ) );
+
+		$release = API_Update_Updater::get_current_release( get_post( $this->plugin->ID ) );
+		$this->assertSame( self::HELD_TAG, $release['tag'] );
+		$this->assertTrue( API_Update_Updater::is_release_blocked( $release ) );
 	}
 
 	/**

From 5baf4f48b165646ded69f04464f1a999e5f5cfe1 Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 13:27:44 -0500
Subject: [PATCH 13/14] Give the listing the same current-release resolution as
 the gates.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The listing's cooldown line compared rows against the strict
get_current_release_tag() while get_current_release() gained a
fallback, so in the trunk-flip state the listing suppressed the line
for the release the metabox showed as current. single_plugin() now
resolves get_current_release() once and passes it down the rows —
one walk per listing, one canonical notion — and the helper, whose
only remaining caller was the resolver itself, is inlined back.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../jobs/class-api-update-updater.php         | 21 ++++++-------------
 .../shortcodes/class-release-confirmation.php | 19 ++++++++++-------
 .../tests/Current_Release_Resolution_Test.php | 15 +++++++++++++
 3 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
index a280d5a9ce..2510296e5d 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-api-update-updater.php
@@ -253,7 +253,12 @@ public static function get_served_row( $plugin_slug ) {
 	 * @return array|false The matching release row, or false when none exists.
 	 */
 	public static function get_current_release( $post ) {
-		$target   = self::get_current_release_tag( $post );
+		$stable_tag = get_post_meta( $post->ID, 'stable_tag', true );
+
+		$target = ( ! $stable_tag || 'trunk' === $stable_tag )
+			? 'trunk@' . get_post_meta( $post->ID, 'version', true )
+			: $stable_tag;
+
 		$releases = (array) Plugin_Directory::get_releases( $post );
 
 		foreach ( $releases as $release ) {
@@ -280,20 +285,6 @@ public static function get_current_release( $post ) {
 		return $carrying;
 	}
 
-	/**
-	 * The release tag a plugin's current version is served or held under.
-	 *
-	 * @param \WP_Post $post The plugin post.
-	 * @return string The stable tag, or `trunk@{version}` for trunk-stable plugins.
-	 */
-	public static function get_current_release_tag( $post ) {
-		$stable_tag = get_post_meta( $post->ID, 'stable_tag', true );
-
-		return ( ! $stable_tag || 'trunk' === $stable_tag )
-			? 'trunk@' . get_post_meta( $post->ID, 'version', true )
-			: $stable_tag;
-	}
-
 	/**
 	 * Whether a release is being held out of `update_source` by a block.
 	 *
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
index 3a9af5ad3a..c1fee89fda 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
@@ -124,6 +124,9 @@ class_exists( 'Two_Factor_Core' ) &&
 	static function single_plugin( $plugin ) {
 		$releases = Plugin_Directory::get_releases( $plugin );
 
+		// Resolved once for the whole listing; each row's cooldown line compares against it.
+		$current_release = API_Update_Updater::get_current_release( $plugin );
+
 		echo '<div class="wp-block-table is-style-stripes">
 		<table class="plugin-releases-listing">
 		<colgroup>
@@ -184,7 +187,7 @@ static function single_plugin( $plugin ) {
 					implode( ', ', $data['committer'] ),
 				),
 				self::get_actions( $plugin, $data ),
-				self::get_approval_text( $plugin, $data ) .
+				self::get_approval_text( $plugin, $data, $current_release ) .
 					self::get_rollout_strategy( $plugin, $data )
 			);
 		}
@@ -198,7 +201,7 @@ static function single_plugin( $plugin ) {
 		</style>';
 	}
 
-	static function get_approval_text( $plugin, $data ) {
+	static function get_approval_text( $plugin, $data, $current_release = null ) {
 		ob_start();
 
 		if ( ! $data['confirmations_required'] ) {
@@ -266,7 +269,7 @@ static function get_approval_text( $plugin, $data ) {
 			);
 		}
 
-		self::render_cooldown_status( $plugin, $data );
+		self::render_cooldown_status( $plugin, $data, $current_release );
 
 		echo '</div>';
 
@@ -290,10 +293,11 @@ static function get_approval_text( $plugin, $data ) {
 	 * confirmation/processing, rows other than the current release (superseded rows are
 	 * never served), or where the cooldown window has elapsed.
 	 *
-	 * @param \WP_Post $plugin The plugin post object.
-	 * @param array    $data   The release row from Plugin_Directory::get_releases().
+	 * @param \WP_Post   $plugin          The plugin post object.
+	 * @param array      $data            The release row from Plugin_Directory::get_releases().
+	 * @param array|null $current_release The already-resolved current release, or null to resolve here.
 	 */
-	protected static function render_cooldown_status( $plugin, $data ) {
+	protected static function render_cooldown_status( $plugin, $data, $current_release = null ) {
 		$release_delay = (int) ( $data['release_delay'] ?? 0 );
 		if ( ! $release_delay ) {
 			return;
@@ -309,7 +313,8 @@ protected static function render_cooldown_status( $plugin, $data ) {
 		}
 
 		// Only the current release can be pending; superseded rows are never served.
-		if ( (string) ( $data['tag'] ?? '' ) !== (string) API_Update_Updater::get_current_release_tag( $plugin ) ) {
+		$current_release = $current_release ?? API_Update_Updater::get_current_release( $plugin );
+		if ( ! $current_release || (string) ( $data['tag'] ?? '' ) !== (string) $current_release['tag'] ) {
 			return;
 		}
 
diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
index b061ead165..3056d2eb8a 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/Current_Release_Resolution_Test.php
@@ -456,6 +456,21 @@ public function test_cooldown_line_only_for_current_release(): void {
 		$this->assertStringNotContainsString( 'Will be served', Release_Confirmation::get_approval_text( $plugin, $releases['1.0'] ) );
 	}
 
+	/**
+	 * The listing's cooldown line follows the same resolution as the rest of the
+	 * UI: with the stable tag flipped to trunk at an unchanged version, the
+	 * fallback-resolved release is the current one and keeps its line.
+	 */
+	public function test_cooldown_line_follows_fallback_resolution(): void {
+		update_post_meta( $this->plugin->ID, 'version', self::RENAMED_VERSION );
+		update_post_meta( $this->plugin->ID, 'stable_tag', 'trunk' );
+		$this->add_release( self::RENAMED_VERSION, self::RENAMED_VERSION );
+
+		$releases = array_column( Plugin_Directory::get_releases( $this->plugin ), null, 'tag' );
+
+		$this->assertStringContainsString( 'Will be served', Release_Confirmation::get_approval_text( get_post( $this->plugin->ID ), $releases[ self::RENAMED_VERSION ] ) );
+	}
+
 	/**
 	 * The force-release audit note names the release actually unblocked — the
 	 * stable-tag-resolved one — not the plugin's Version header.

From a7bd1d54c8f82e2a07c6f5208b65537d7438241d Mon Sep 17 00:00:00 2001
From: Konstantin Obenland <obenland@gmx.de>
Date: Fri, 14 Aug 2026 13:41:52 -0500
Subject: [PATCH 14/14] Satisfy the diff lint on touched listing lines.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../shortcodes/class-release-confirmation.php        | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
index c1fee89fda..76cd7ef4b9 100644
--- a/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
+++ b/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php
@@ -187,7 +187,7 @@ static function single_plugin( $plugin ) {
 					implode( ', ', $data['committer'] ),
 				),
 				self::get_actions( $plugin, $data ),
-				self::get_approval_text( $plugin, $data, $current_release ) .
+				self::get_approval_text( $plugin, $data, $current_release ) . // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Escaped when built.
 					self::get_rollout_strategy( $plugin, $data )
 			);
 		}
@@ -201,7 +201,15 @@ static function single_plugin( $plugin ) {
 		</style>';
 	}
 
-	static function get_approval_text( $plugin, $data, $current_release = null ) {
+	/**
+	 * The confirmation/cooldown status text for a release row.
+	 *
+	 * @param \WP_Post   $plugin          The plugin post object.
+	 * @param array      $data            The release row from Plugin_Directory::get_releases().
+	 * @param array|null $current_release Optional. The already-resolved current release, to save re-resolving per row.
+	 * @return string The release approval text, filtered via `wporg_plugins_release_approval_text`.
+	 */
+	public static function get_approval_text( $plugin, $data, $current_release = null ) {
 		ob_start();
 
 		if ( ! $data['confirmations_required'] ) {