Commit 208614f24af for woocommerce

commit 208614f24af64ed0ba52ee8abf981e73d5d876fd
Author: Jamel Noel Reid <MrJnrman@users.noreply.github.com>
Date:   Mon Oct 12 17:12:52 2026 +0200

    Add AI review catalog entry for blocking remote calls (#69712)

    [DEVPROD-1254] Catalog blocking remote calls

diff --git a/.ai/review/guidelines/perf-blocking-remote-call.md b/.ai/review/guidelines/perf-blocking-remote-call.md
new file mode 100644
index 00000000000..41027e87464
--- /dev/null
+++ b/.ai/review/guidelines/perf-blocking-remote-call.md
@@ -0,0 +1,28 @@
+# Blocking remote calls on page renders
+
+**Source:**
+
+- #69160: the Helper updates cache moved to a one-week lifetime but counts as fresh for 12 hours, so
+  `get_updates_count()` made a blocking WooCommerce.com request while an admin page rendered. Fixed in
+  #69454.
+- Earlier review finding: a tracker POST made blocking now ran inside the WooCommerce.com connect
+  request.
+
+**What broke:** A remote request that used to be cached, deferred, or non-blocking started running
+synchronously while a page rendered. A slow or unreachable remote host then delayed that page.
+
+**Pattern to catch:**
+
+- A cache lifetime and its freshness check drifting apart (`set_transient( ..., WEEK_IN_SECONDS )`
+  next to an "older than 12 hours" check), so a stale-but-present cache falls through to a live
+  request.
+- `'blocking' => false` removed, or a remote call moved from cron or AJAX into a render hook,
+  `admin_menu`, `admin_notices`, or a menu badge count.
+- A new `wp_remote_*` or `WC_Helper_API` call on a path that renders a page.
+
+**How to confirm:** Follow the call from the render hook to the request. Read the cache read and its
+guards on the way: what makes it return early, and when can that be skipped? Is anything bounding how
+often it runs (a separate count cache, a backoff)?
+
+**Don't flag when:** The request already ran on that path before the change, it runs only in cron,
+Action Scheduler, AJAX or REST handlers, or the cache in front of it is unchanged.
diff --git a/.ai/review/personas/performance.md b/.ai/review/personas/performance.md
index 982a36e5c05..99d4531bbaa 100644
--- a/.ai/review/personas/performance.md
+++ b/.ai/review/personas/performance.md
@@ -107,6 +107,16 @@ This controls false positives. Follow it strictly.
   mixed list must be SPLIT (regular names primed always, transient names under the guard), never
   wrapped whole. Check the guard's direction.

+## Remote calls on page renders
+
+- A hunk that adds, or newly reaches, a synchronous remote request (`wp_remote_get()`,
+  `wp_safe_remote_post()`, `WC_Helper_API` calls, `'blocking' => true`) on a path that renders a
+  page (admin or storefront) makes that page wait on another server. Trace when it fires: a cache
+  that now lives longer but counts as fresh for less time, a removed `'blocking' => false`, or a
+  check moved out of cron or AJAX into a render hook all count.
+- Don't flag requests that already ran on that path before the change, ones that run only in cron,
+  Action Scheduler, AJAX or REST handlers, or ones behind a cache the hunk does not change.
+
 ## Severity

 Pure performance findings **never block**. Every finding whose only claim is query count, scan shape,
@@ -115,6 +125,8 @@ or cache priming is `follow-up`, never `fix here`, and at most `medium`:
 - **`medium`, `follow-up`** — the hunk makes a hot path (checkout, cart, product listing or rendering,
   order admin list) unboundedly worse: per-item queries or fan-out rows that grow with the collection.
   Say so plainly in `description`: name the hot path and what the cost scales with.
+- **`medium`, `follow-up`** — a new synchronous remote request on any page render, admin included:
+  a slow or hanging remote host stalls the page for every user who hits it.
 - **`low`, `follow-up`** — a bounded regression, a new anti-pattern on a warm or admin path, dead
   priming, a redundant guard, or bounded overhead off hot paths.

diff --git a/ai-review-config.json b/ai-review-config.json
index 84593bad2f6..6b6d33ed75b 100644
--- a/ai-review-config.json
+++ b/ai-review-config.json
@@ -83,7 +83,11 @@
 					"term_relationships",
 					"meta_key",
 					"union",
-					"get_results"
+					"get_results",
+					"wp_remote_",
+					"wp_safe_remote",
+					"_in_seconds",
+					"helper_api"
 				],
 				"always_paths": [],
 				"signal_types": [
@@ -953,6 +957,32 @@
 				"performance"
 			]
 		},
+		{
+			"name": "perf-blocking-remote-call",
+			"file": ".ai/review/guidelines/perf-blocking-remote-call.md",
+			"path": [
+				"plugins/woocommerce/includes/**/*.php",
+				"plugins/woocommerce/src/**/*.php"
+			],
+			"signals": [
+				"wp_remote_",
+				"wp_safe_remote_",
+				"WC_Helper_API",
+				"set_transient",
+				"set_site_transient",
+				"HOUR_IN_SECONDS",
+				"DAY_IN_SECONDS",
+				"WEEK_IN_SECONDS",
+				"MONTH_IN_SECONDS",
+				"'blocking'",
+				"'timeout'",
+				"admin_menu",
+				"admin_notices"
+			],
+			"personas": [
+				"performance"
+			]
+		},
 		{
 			"name": "script-handle-loading-contract",
 			"file": ".ai/review/guidelines/script-handle-loading-contract.md",