fix(zone-cold): JSON_MERGE_PATCH 原子寫入 + JSON_REMOVE 原子刪除（B2）

set()/set_many() 原本 get_blob_raw()→array_merge→save_blob() 三步，並發
寫入會互相覆蓋整個 blob；remove() 同樣是 read-modify-write。改為：
- 新增 private save_patch()：INSERT ... ON DUPLICATE KEY UPDATE
  data = JSON_MERGE_PATCH(COALESCE(data,'{}'), patch)
- remove()：UPDATE ... SET data = JSON_REMOVE(COALESCE(data,'{}'), '$.key')
- save_blob() 改用 TMDO_DB::upsert()
- SQLite 保留 read-modify-write fallback
- ZoneColdTest stub 補 JSON_REMOVE / JSON_MERGE_PATCH / upsert 三種 SQL 模擬

對應 A v3.3.3 P1-21。unit 379 / integration 398 GREEN

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TbG1keQQ7XBa7qMQY16KCY

includes/zones/class-tmdo-zone-cold.php

@@ -149,36 +149,58 @@ class TMDO_Zone_Cold {
 	 * @param mixed  $value     Value to store.
 	 */
 	public static function set( int $post_id, string $post_type, string $meta_key, mixed $value ): void {
-		$data              = self::get_blob_raw( $post_id, $post_type );
+		self::save_patch( $post_id, $post_type, array( $meta_key => $value ) );
-		$data[ $meta_key ] = $value;
-		self::save_blob( $post_id, $post_type, $data );
 	}
 
 	/**
 	 * Set multiple cold meta values at once.
 	 *
+	 * Uses JSON_MERGE_PATCH on MySQL to avoid a read-then-write round trip.
+	 * Falls back to read-modify-write on SQLite.
+	 *
 	 * @param int    $post_id   Post ID.
 	 * @param string $post_type Post type.
 	 * @param array  $values    meta_key => value pairs.
 	 */
 	public static function set_many( int $post_id, string $post_type, array $values ): void {
-		$data = self::get_blob_raw( $post_id, $post_type );
+		self::save_patch( $post_id, $post_type, $values );
-		$data = array_merge( $data, $values );
-		self::save_blob( $post_id, $post_type, $data );
 	}
 
 	/**
 	 * Remove a key from the cold blob.
 	 *
+	 * Uses JSON_REMOVE on MySQL for an atomic single-key removal without a full
+	 * blob read. Falls back to read-modify-write on SQLite.
+	 *
 	 * @param int    $post_id   Post ID.
 	 * @param string $post_type Post type slug.
 	 * @param string $meta_key  Meta key to remove.
 	 * @return void
 	 */
 	public static function remove( int $post_id, string $post_type, string $meta_key ): void {
+		if ( defined( 'TMDO_IS_SQLITE' ) && TMDO_IS_SQLITE ) {
 			$data = self::get_blob_raw( $post_id, $post_type );
 			unset( $data[ $meta_key ] );
 			self::save_blob( $post_id, $post_type, $data );
+			return;
+		}
+
+		global $wpdb;
+		$table = self::table( $post_type );
+		$path  = '$.' . $meta_key;
+
+		// phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.DirectDatabaseQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Table name from TMDO_Zone_Cold::table() via TMDO_DB::table().
+		$wpdb->query(
+			$wpdb->prepare(
+				"UPDATE `{$table}` SET data = JSON_REMOVE(COALESCE(data, '{}'), %s), updated_at = %s WHERE post_id = %d",
+				$path,
+				TMDO_DB::now(),
+				$post_id
+			)
+		);
+		// phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.DirectDatabaseQuery,WordPress.DB.DirectDatabaseQuery.NoCaching
+
+		wp_cache_delete( "cold_{$post_id}", self::cache_group( $post_type ) );
 	}
 
 	/**
@@ -224,39 +246,63 @@ class TMDO_Zone_Cold {
 	 * @return void
 	 */
 	private static function save_blob( int $post_id, string $post_type, array $data ): void {
-		global $wpdb;
 		$table = self::table( $post_type );
-		$now   = TMDO_DB::now();
 		$json  = wp_json_encode( $data );
 
-		$existing = $wpdb->get_var(
+		TMDO_DB::upsert(
-			$wpdb->prepare( "SELECT id FROM `{$table}` WHERE post_id = %d LIMIT 1", $post_id ) // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Table name from TMDO_Zone_Cold::table() via TMDO_DB::table().
-		);
-
-		if ( $existing ) {
-			$wpdb->update(
-				$table,
-				array(
-					'data'       => $json,
-					'updated_at' => $now,
-				),
-				array( 'post_id' => $post_id ),
-				array( '%s', '%s' ),
-				array( '%d' )
-			);
-		} else {
-			$wpdb->insert(
 			$table,
 			array(
 				'post_id'    => $post_id,
 				'data'       => $json,
-					'updated_at' => $now,
+				'updated_at' => TMDO_DB::now(),
 			),
+			array( 'data', 'updated_at' ),
+			'post_id',
 			array( '%d', '%s', '%s' )
 		);
-		}
 
 		// Invalidate object cache.
 		wp_cache_delete( "cold_{$post_id}", self::cache_group( $post_type ) );
 	}
+
+	/**
+	 * Merge a partial key-value map into the cold blob atomically.
+	 *
+	 * Uses INSERT ... ON DUPLICATE KEY UPDATE with JSON_MERGE_PATCH so concurrent
+	 * writers cannot clobber each other's keys (the read-modify-write path did).
+	 * On SQLite, falls back to the classic read-modify-write path.
+	 *
+	 * @param int    $post_id   Post ID.
+	 * @param string $post_type Post type slug.
+	 * @param array  $patch     Partial key-value map to merge in.
+	 */
+	private static function save_patch( int $post_id, string $post_type, array $patch ): void {
+		if ( defined( 'TMDO_IS_SQLITE' ) && TMDO_IS_SQLITE ) {
+			$data = self::get_blob_raw( $post_id, $post_type );
+			$data = array_merge( $data, $patch );
+			self::save_blob( $post_id, $post_type, $data );
+			return;
+		}
+
+		global $wpdb;
+		$table = self::table( $post_type );
+		$json  = wp_json_encode( $patch );
+		$now   = TMDO_DB::now();
+
+		// phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.DirectDatabaseQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Table name from TMDO_Zone_Cold::table() via TMDO_DB::table().
+		$wpdb->query(
+			$wpdb->prepare(
+				"INSERT INTO `{$table}` (post_id, data, updated_at) VALUES (%d, %s, %s)
+				 ON DUPLICATE KEY UPDATE data = JSON_MERGE_PATCH(COALESCE(data, '{}'), %s), updated_at = %s",
+				$post_id,
+				$json,
+				$now,
+				$json,
+				$now
+			)
+		);
+		// phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.DirectDatabaseQuery,WordPress.DB.DirectDatabaseQuery.NoCaching
+
+		wp_cache_delete( "cold_{$post_id}", self::cache_group( $post_type ) );
+	}
 }

tests/unit/ZoneColdTest.php

@@ -89,6 +89,45 @@ class ZoneColdTest extends TestCase {
 			}
 
 			public function query( string $sql ): int|bool {
+				$flat = preg_replace( '/\s+/', ' ', $sql );
+
+				// JSON_REMOVE UPDATE — from TMDO_Zone_Cold::remove (MySQL path).
+				// SQL: UPDATE `{table}` SET data = JSON_REMOVE(..., '$.key'), ... WHERE post_id = N
+				if ( stripos( $flat, 'JSON_REMOVE' ) !== false ) {
+					if ( preg_match( "/'\\\$\\.([^']+)'/", $flat, $km )
+						&& preg_match( '/WHERE post_id = (\d+)/i', $flat, $wm ) ) {
+						$post_id = (int) $wm[1];
+						$key     = $km[1];
+						$data    = json_decode( ZoneColdTest::$db_store[ $post_id ] ?? '{}', true );
+						$data    = is_array( $data ) ? $data : array();
+						unset( $data[ $key ] );
+						ZoneColdTest::$db_store[ $post_id ] = (string) wp_json_encode( $data );
+					}
+					return 1;
+				}
+
+				// INSERT...ON DUPLICATE KEY with JSON_MERGE_PATCH — from save_patch (MySQL path).
+				// Merges the patch into the existing blob, preserving untouched keys.
+				if ( stripos( $flat, 'ON DUPLICATE KEY' ) !== false && stripos( $flat, 'JSON_MERGE_PATCH' ) !== false ) {
+					if ( preg_match( "/VALUES \((\d+), '((?:[^'\\\\]|\\\\.)*)'/i", $flat, $m ) ) {
+						$post_id                            = (int) $m[1];
+						$patch                              = json_decode( stripslashes( $m[2] ), true );
+						$patch                              = is_array( $patch ) ? $patch : array();
+						$existing                           = json_decode( ZoneColdTest::$db_store[ $post_id ] ?? '{}', true );
+						$existing                           = is_array( $existing ) ? $existing : array();
+						ZoneColdTest::$db_store[ $post_id ] = (string) wp_json_encode( array_merge( $existing, $patch ) );
+					}
+					return 1;
+				}
+
+				// INSERT...ON DUPLICATE KEY UPDATE (from TMDO_DB::upsert via save_blob).
+				// Pattern: VALUES (post_id, 'json_data', 'datetime') ON DUPLICATE KEY UPDATE col = VALUES(col)
+				if ( stripos( $flat, 'ON DUPLICATE KEY' ) !== false ) {
+					if ( preg_match( "/VALUES \((\d+), '((?:[^'\\\\]|\\\\.)*)'/i", $flat, $m ) ) {
+						ZoneColdTest::$db_store[ (int) $m[1] ] = stripslashes( $m[2] );
+					}
+				}
+
 				return 1;
 			}
 		};