…init

get_defaults() returned raw booleans while settings_defaults() normalises
checkbox defaults with (int) (bool). Since get_default_option() switched to
the former, checkbox defaults resolved to true/false instead of 1/0, which
breaks consumers that expect a numeric value (block attributes, REST schemas).
Defaults are now stored pre-normalised.

custom_css has no 'default' key in its field definition, so settings_defaults()
assigned '' while get_defaults() had no entry at all, making the option resolve
to false. Added an explicit entry.

The wzkb_settings_defaults filter was also bypassed on the get_default_option()
path. It is now applied by both consumers, keeping get_defaults() itself
unfiltered so it runs exactly once per path. Settings::$prefix is initialised at
declaration because it was only assigned in the constructor, which never runs
outside the admin area, so settings_defaults() fired _settings_defaults rather
than wzkb_settings_defaults on the frontend.

Also picks up root file drift from the sync: composer.json and package.json
versions catch up to 3.1.2, and CLAUDE.md/AGENTS.md links match pro.

sanitize_setting_value() called each field's type-specific sanitizer with
only the raw value, dropping the field config. sanitize_repeater_field()
needs that config for its subfield schema, so every repeater row came back
empty and was discarded before validation ever ran.

… in the same request

Include the 3.1.3 wizard repeater-row fix note and pro-side admin comment cleanups.

…dling

Aligns with the WordPress.org plugin-review fix applied in webberzone-image-optimizer: renames the WZSettingsAdmin/WZTomSelectSettings/WZInitTomSelect JS globals to Webber-prefixed names, makes settings_sanitize() run its sanitizer loop even without a referer, guards $input with is_array() instead of a truthy check, and removes the dead freemkitTomSelectSettings fallback.

get_sanitize_callback() returned false for any field type without a
matching sanitize_{type}_field() method, and settings_sanitize() then let
array_merge() store the submitted value raw. radio, radiodesc, thumbsizes,
select, wysiwyg, file, password, css and html all fell through that path.

- Add the nine missing sanitizers. Choice fields (radio, radiodesc,
  select, thumbsizes) validate against the options the field actually
  renders and fall back to the field own default rather than blanking.
- Generalise the repeater-only closure so every callback receives the
  field configuration, and make sanitize_missing() the fallback instead
  of false, so no type can store raw input.
- sanitize_missing() now deep-sanitizes arrays instead of passing through.
- Build the output array from stored settings rather than merging raw
  input, so submitted keys that are not registered settings are sanitized
  too instead of being written verbatim.

register_setting() now declares type => object and an explicit default.
show_in_rest is off: the value is an open-ended map with no REST schema,
and settings_sanitize() expects a form submission.

Settings_API VERSION 2.11.0 -> 3.0.0.

Adds get_settings_with_defaults(), get_blog_option() and aligns docblocks;
notice API members switch from private to protected.

The note explaining the convention had it backwards: it said double
brackets while showing single. Double brackets are the escaped form and
render as the literal [toc]; single brackets trigger TOC insertion.

…rocessing

Replace two-phase bulk push with bounded chunk processing: preview articles, start job, process chunks, finalize commits per repo/branch. Add retry logic with exponential backoff, stale-job guards, and resume-from-pause support. Track tasks by key, render status updates incrementally, and show commit URLs in summary.