From 8ff3a6ec3103cd2ecef1dae53f69f760b8657409 Mon Sep 17 00:00:00 2001
From: Steve Hanlon <steve@hanlon.co.uk>
Date: Fri, 12 Jun 2026 10:29:33 +0100
Subject: [PATCH] Fix step status+notes save (forms were nested in HTML)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The step card's save form wrapped the entire card, including the
autocheck 'Run checks' button and per-step extras like the email
'Send' form — those are also <form> elements. Nested forms are
invalid HTML; browsers silently drop the outer form's submit when
they see an inner one.

So clicking 'Save step' was effectively a no-op: the POST to
wph_save_step never reached the server, and the status reverted to
'not started' on reload. The bug had been there since the autocheck
panel was introduced in v0.3 of the healthcheck.

Restructured the step card as a <div> wrapper containing three
siblings: (1) static content (title, blurb, sub-items, watch-outs,
escalation), (2) the autocheck panel + step render_extra (each with
their own forms), (3) the save form. No nesting anywhere.

Verified end-to-end on testsite: step status and notes now persist
across page loads. The email step (which has 3 sibling forms — refresh
checks, send test, save) also renders without nesting.
---
 includes/admin-page.php | 63 +++++++++++++++++++++++------------------
 1 file changed, 36 insertions(+), 27 deletions(-)

diff --git a/includes/admin-page.php b/includes/admin-page.php
index e8ffedb..40645fc 100644
--- a/includes/admin-page.php
+++ b/includes/admin-page.php
@@ -272,10 +272,7 @@ function wph_render_step_card(WPH_Session $session, WPH_Step $step): void {
     $status = $state['status'];
     $notes  = $state['notes'];
     ?>
-    <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="wph-step" id="step-<?php echo esc_attr($step->id()); ?>">
-        <?php wp_nonce_field('wph_save_step_' . $step->id()); ?>
-        <input type="hidden" name="action" value="wph_save_step">
-        <input type="hidden" name="step" value="<?php echo esc_attr($step->id()); ?>">
+    <div class="wph-step" id="step-<?php echo esc_attr($step->id()); ?>">
         <header>
             <h2><?php echo esc_html($step->title()); ?></h2>
             <span class="wph-step-status wph-status-<?php echo esc_attr($status); ?>"><?php echo esc_html(str_replace('_', ' ', $status)); ?></span>
@@ -303,29 +300,41 @@ function wph_render_step_card(WPH_Session $session, WPH_Step $step): void {
         <?php if ($status === WPH_Session::STATUS_BLOCKED && ($esc = $step->escalation())): ?>
             <div class="wph-escalation"><?php echo esc_html($esc); ?></div>
         <?php endif; ?>
-        <?php wph_render_autocheck($session, $step); ?>
-        <?php $step->render_extra($session->data()); ?>
-        <p>
-            <label>
-                <strong>Status:</strong>
-                <select name="status">
-                    <?php foreach (WPH_Session::VALID_STATUSES as $s): ?>
-                        <option value="<?php echo esc_attr($s); ?>" <?php selected($status, $s); ?>><?php echo esc_html(str_replace('_', ' ', $s)); ?></option>
-                    <?php endforeach; ?>
-                </select>
-            </label>
-        </p>
-        <p>
-            <label><strong>Notes:</strong></label>
-            <textarea name="notes" placeholder="What did you check, find, fix, or flag?"><?php echo esc_textarea($notes); ?></textarea>
-        </p>
-        <p>
-            <button class="button">Save step</button>
-            <?php if ($state['updated_at']): ?>
-                <span class="description">Last saved <?php echo esc_html(human_time_diff($state['updated_at'], time())); ?> ago</span>
-            <?php endif; ?>
-        </p>
-    </form>
+
+        <?php
+        // Inner forms (autocheck refresh, step-specific extras like email send)
+        // are rendered as siblings of the save form — never nested. Nested forms
+        // are invalid HTML; browsers drop the outer form's submit silently.
+        wph_render_autocheck($session, $step);
+        $step->render_extra($session->data());
+        ?>
+
+        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="wph-step-save">
+            <?php wp_nonce_field('wph_save_step_' . $step->id()); ?>
+            <input type="hidden" name="action" value="wph_save_step">
+            <input type="hidden" name="step" value="<?php echo esc_attr($step->id()); ?>">
+            <p>
+                <label>
+                    <strong>Status:</strong>
+                    <select name="status">
+                        <?php foreach (WPH_Session::VALID_STATUSES as $s): ?>
+                            <option value="<?php echo esc_attr($s); ?>" <?php selected($status, $s); ?>><?php echo esc_html(str_replace('_', ' ', $s)); ?></option>
+                        <?php endforeach; ?>
+                    </select>
+                </label>
+            </p>
+            <p>
+                <label><strong>Notes:</strong></label>
+                <textarea name="notes" placeholder="What did you check, find, fix, or flag?"><?php echo esc_textarea($notes); ?></textarea>
+            </p>
+            <p>
+                <button class="button button-primary">Save step</button>
+                <?php if ($state['updated_at']): ?>
+                    <span class="description">Last saved <?php echo esc_html(human_time_diff($state['updated_at'], time())); ?> ago</span>
+                <?php endif; ?>
+            </p>
+        </form>
+    </div>
     <?php
 }