measure(m3): the declared PHP target is detected, and the replay budget is sized

classes/class.memberorder.php:936:getMemberOrderByCode, injection. A value concatenated into SQL with
no prepare, which is the declared M3 target for PHP, found for the first time.

Nothing about detection changed. The population became affordable: tier-zero pruning scoped to its
partition, batches budgeted by the sink work they imply, a per-query timeout no longer cancelling the
scan, and a reserve kept for arbitration. Before those this population completed zero questions at
every budget tried.

At 500 regions with a 3,600 s deadline: 271 of 406 questions completed, 213 findings, 2,950 s, and
eight findings in the target file including the target itself.

The earlier bounded attempt failed for a reason no budget increase could fix -- 25 regions of 4,461
is 0.6 percent of the population and the target was never asked about -- so this sizes the replay
before spending hours on it. One scan at this budget is 2,950 s, a push transaction is two scans plus
discovery and preparation, so the three declared comparisons are roughly five and a half hours.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

benchmarks/measurements/2026-09-22-php-declared-target-in-scope.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": 1,
+  "experiment": "php-declared-target-in-scope-v1",
+  "date": "2026-09-22",
+  "task": "pre-push-safety-net 13.3",
+  "claim_scope": "Sizing the population a bounded PHP transfer replay needs. One whole-repository scan, detection only, no comparison.",
+  "why": "The earlier bounded attempt failed for a reason no budget increase could fix: 25 regions of 4,461 is 0.6% of the population and the declared target was never asked about. A three-case replay costs hours, so the budget is established with one scan first.",
+  "result": {
+    "budget": {
+      "max_regions": 500,
+      "deadline_seconds": 3600
+    },
+    "questions_completed": 271,
+    "questions_arbitrated": 406,
+    "findings": 213,
+    "seconds": 2949.8,
+    "declared_target_found": true,
+    "target": "classes/class.memberorder.php:936:getMemberOrderByCode, injection",
+    "target_file_findings": 8
+  },
+  "the_target_itself": "`$wpdb->get_var(\"SELECT id FROM $wpdb->pmpro_membership_orders WHERE code = '\" . $code . \"' LIMIT 1\")`. A value concatenated into SQL with no prepare, which is the declared M3 target for PHP and is detected here for the first time.",
+  "what_changed_to_make_it_reachable": "Nothing about detection. The population became affordable: tier-zero pruning scoped to its partition (7.3), batches budgeted by the sink work they imply (7.7), a per-query timeout no longer cancelling the scan, and a reserve kept for arbitration. Before those, this population completed zero questions at any budget tried.",
+  "cost_implied_for_the_replay": "One whole-repository scan at this budget costs 2,950 s. A push transaction is two scans plus discovery and preparation, so a case is roughly 6,600 s and the three declared comparisons roughly five and a half hours. That is the price of the population that contains the target.",
+  "limits": [
+    "Detection only. This scan makes no comparison and establishes no novelty, which is what the replay is for.",
+    "271 of 406 questions completed, so the population is examined but not exhausted.",
+    "PMPro is a development subject and qualifies nothing."
+  ]
+}