fix: harden checkout thank-you flow

[superdav42]

Summary

• Prevent thank-you/payment-return requests from fataling when checkout scripts are enqueued after the checkout form steps have been cleared (steps === null).
• Treat null/non-array checkout steps as an empty one-step flow in checkout navigation helpers.
• Treat FrankenPHP as not safe for the pending-site loopback finish-request path, so checkout publishing uses the immediate Action Scheduler path instead of waiting for the delayed watchdog.
• Add regression coverage for null checkout steps.

Production evidence

• Retest after fix: avoid fragile pending site loopback #1416 created order JJJ3D441EL and site checkout-post1416-20260613000702.humansite.builders.
• The site eventually finalized via watchdog action 85987, but the thank-you URL returned HTTP 500.
• PHP error log: array_column(): Argument #1 ($array) must be of type array, null given in inc/checkout/class-checkout.php:3452 from Checkout->is_last_step() during checkout script registration.

Verification

• php -l inc/checkout/class-checkout.php && php -l inc/models/class-membership.php && php -l tests/WP_Ultimo/Checkout/Checkout_Test.php
• vendor/bin/phpcs inc/checkout/class-checkout.php inc/models/class-membership.php
• git diff --check
• WP-CLI probe: null checkout steps return first=yes last=yes next=thank-you without fatal.
• WP-CLI probe: no-finish pending-site publish path returns publish_loopback_requests=0 has_scheduled_main=yes.

Notes

• Focused PHPUnit is still blocked in this checkout because /tmp/wordpress-tests-lib/includes/functions.php is missing.
• Full local PHPCS on tests/WP_Ultimo/Checkout/Checkout_Test.php reports pre-existing unrelated violations outside the touched lines; production files pass PHPCS.

---

aidevops.sh v3.20.57 plugin for OpenCode v1.17.4 with gpt-5.5

Summary by CodeRabbit

• Bug Fixes

  • Improved stability of the multi-step checkout process when checkout steps are unavailable, unset, or missing
  • Enhanced server environment compatibility and improved handling of asynchronous operations in specific server configurations

• Tests

  • Expanded automated test coverage for checkout flow edge cases, including step navigation scenarios with unset steps

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3ec4fe10-ffd1-4cc2-b461-2adce99cbf65

📥 Commits

Reviewing files that changed from the base of the PR and between 130092f and 011c1c4.

📒 Files selected for processing (3)

• inc/checkout/class-checkout.php
• inc/models/class-membership.php
• tests/WP_Ultimo/Checkout/Checkout_Test.php

---

📝 Walkthrough

Walkthrough

This PR strengthens checkout step-navigation robustness by normalizing missing/unset steps into safe array operations, and detects FrankenPHP runtime to disable incompatible async loopback behavior. Two independent functional changes with no shared logic or dependencies.

Changes

Checkout Step Navigation Hardening

Layer / File(s)	Summary
Helper method and step-navigation refactoring inc/checkout/class-checkout.php	get_steps_or_empty_array() normalizes $this->steps into an array, and get_next_step_name(), is_first_step(), and is_last_step() now call the helper instead of directly accessing $this->steps, adding explicit returns when no step IDs are available.
Test coverage for null steps case tests/WP_Ultimo/Checkout/Checkout_Test.php	Three new test methods assert that step-navigation methods return safe values (true for is_first_step() and is_last_step(), current step name for get_next_step_name()) when steps is null.

FrankenPHP Detection in Async Publishing

Layer / File(s)	Summary
FrankenPHP detection in async publish inc/models/class-membership.php	Membership::publish_pending_site_async() detects FrankenPHP via PHP_SAPI or SERVER_SOFTWARE header check and overrides $can_finish_request to false when detected, preventing incompatible loopback finish-request behavior.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• Ultimate-Multisite/ultimate-multisite#1408: Modifies checkout step state logic and is_last_step() behavior that this PR also refactors.
• Ultimate-Multisite/ultimate-multisite#1416: Also modifies Membership::publish_pending_site_async() loopback behavior when finish-request support isn't available.
• Ultimate-Multisite/ultimate-multisite#1353: Similarly adds FrankenPHP detection to Membership::publish_pending_site_async() to control loopback behavior.

Suggested labels

review-feedback-scanned, status:available

Poem

🐰 A hardened checkout guards each empty step with care,
FrankenPHP's whimsy finds defensive guards laid fair.
Null steps no longer crash the path ahead—
The rabbit's tests ensure safe steps are read! 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: hardening the checkout flow (specifically the thank-you flow) to handle null/unset checkout steps and FrankenPHP edge cases.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/checkout-thank-you-frankenphp

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

• Build: ultimate-multisite
• ⬇️ Download from GitHub Actions
• ⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password