fix(audit L5): unter der Sperre Divis Laufzeit-Caches verwerfen (Options-Cache-Gruppe, GlobalData-/GlobalPreset-Static, et_theme_options) vor raw() und design_rev

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/Unit/Integrations/Divi/Design/DesignChangeTest.php

@@ -56,6 +56,9 @@ final class DesignChangeTest extends TestCase
 
             public array $restores = [];
 
+            /** @var list<string> refresh()/raw() in the order they happened */
+            public array $calls = [];
+
             public function __construct(
                 private array &$stored,
                 private int $failWrites,
@@ -79,8 +82,15 @@ final class DesignChangeTest extends TestCase
                 return DiviFeature::PresetWrite;
             }
 
+            public function refresh(): void
+            {
+                $this->calls[] = 'refresh';
+            }
+
             public function raw(): array
             {
+                $this->calls[] = 'raw';
+
                 return $this->stored;
             }
 
@@ -205,6 +215,25 @@ final class DesignChangeTest extends TestCase
         self::assertSame([], $area->writes);
     }
 
+    /** Audit L5 (re-review): under the lock Divi's request caches are dropped before the inventory is read. */
+    public function testTheAreaDropsItsCachesUnderTheLockBeforeReading(): void
+    {
+        $stored = ['v' => 1];
+        $area = self::area($stored);
+        $snapshots = Mockery::mock(SnapshotStore::class);
+        $snapshots->allows('save')->andReturn('presets-1');
+        $snapshots->allows('attachLog');
+
+        (new DesignChange($snapshots, new FakeChangeLog(1), new DesignLock()))->run(
+            'lit/divi-presets-set',
+            $area,
+            ['confirm' => true, 'design_rev' => $area->rev($stored)],
+            self::plan(['v' => 2])
+        );
+
+        self::assertSame(['refresh', 'raw'], array_slice($area->calls, 0, 2));
+    }
+
     /** Final review I-5: a confirm while another change of the area runs writes nothing. */
     public function testAHeldLockRefusesTheConfirm(): void
     {