[lloc]

Sync wp/v2/sites with WordPress core PR #13055 and harden it

Aligns the RestSitesEndpoint patch with wordpress-develop#13055 (Trac #40365). The controller and the core tests are verbatim copies of the PR branch again.

Changes

• Access: the endpoint is limited to the main site and users with manage_sites. The "My Sites" exception for members is gone.
• Main site: it can no longer be archived, spammed, deleted or moved through the API.
• Atomic writes: site meta is validated before anything is written, so an invalid value no longer leaves a half-created or half-updated site.
• URLs: home and siteurl move along with a changed domain or path (mapped domains are kept).
• Paths: new paths follow the Add New Site rule (letters, numbers and hyphens below the network path, lowercased). That rules out encoded characters, dot segments and file names such as wp-login.php or robots.txt. path is required on subdirectory installs.
• Soft delete: works like "Deactivate" in Network Admin and keeps the site's users.
• IDs: a body or query id that doesn't match the URL is rejected with 400.

Breaking for API clients

• Nested paths and paths with dots, underscores, % or non-ASCII characters can no longer be set.
• A PUT that sends back a path outside the new rule (e.g. one set through Edit Site) fails with 400. Leave path out instead.

Testing

• npm run test-php-core: 318 tests pass. npm run test-php-unit: 61 tests pass.
• Black-box run against wp-env: 299 HTTP cases, no high findings.
  Report

Known, not part of this PR

• The user filter hides archived, spammed and deleted sites (get_blogs_of_user() without $all).

[github-actions]

🔍 WordPress Plugin Check Report

⚠️ Status: Passed with warnings

📊 Report

🎯 Total Issues	❌ Errors	⚠️ Warnings
1	0	1

---

⚠️ Warnings (1)

📁 modules/SiteActivePlugins/Feature.php (1 warning)

📍 Line	🔖 Check	💬 Message
169	WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound	Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "self::FILTER_MAX_SITES".

---

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

[amiut]

LGTM, thanks!