Replace post meta sync storage with dedicated sync_updates table

src/wp-admin/admin.php

@@ -113,6 +113,14 @@
 	wp_schedule_event( time(), 'daily', 'delete_expired_transients' );
 }
 
+// Schedule sync updates cleanup.
+if ( wp_is_collaboration_enabled()
+	&& ! wp_next_scheduled( 'wp_delete_old_sync_updates' )
+	&& ! wp_installing()
+) {
+	wp_schedule_event( time(), 'daily', 'wp_delete_old_sync_updates' );
+}
+
 set_screen_options();
 
 $date_format = __( 'F j, Y' );

src/wp-admin/includes/schema.php

@@ -186,6 +186,15 @@ function wp_get_db_schema( $scope = 'all', $blog_id = null ) {
 	KEY post_parent (post_parent),
 	KEY post_author (post_author),
 	KEY type_status_author (post_type,post_status,post_author)
+) $charset_collate;
+CREATE TABLE $wpdb->sync_updates (
+	id bigint(20) unsigned NOT NULL auto_increment,
+	room varchar(255) NOT NULL,
+	update_value longtext NOT NULL,
+	created_at datetime NOT NULL default '0000-00-00 00:00:00',
+	PRIMARY KEY  (id),
+	KEY room (room,id),
+	KEY created_at (created_at)
 ) $charset_collate;\n";
 
 	// Single site users table. The multisite flavor of the users table is handled below.

src/wp-admin/includes/upgrade.php

@@ -886,7 +886,7 @@ function upgrade_all() {
 		upgrade_682();
 	}
 
-	if ( $wp_current_db_version < 61644 ) {
+	if ( $wp_current_db_version < 61698 ) {
 		upgrade_700();
 	}
 

src/wp-includes/class-wpdb.php

@@ -299,6 +299,7 @@ class wpdb {
 		'term_relationships',
 		'termmeta',
 		'commentmeta',
+		'sync_updates',
 	);
 
 	/**
@@ -404,6 +405,15 @@ class wpdb {
 	 */
 	public $posts;
 
+	/**
+	 * WordPress Sync Updates table.
+	 *
+	 * @since 7.0.0
+	 *
+	 * @var string
+	 */
+	public $sync_updates;
+
 	/**
 	 * WordPress Terms table.
 	 *

src/wp-includes/collaboration.php

@@ -6,6 +6,21 @@
  * @since 7.0.0
  */
 
+/**
+ * Checks whether real-time collaboration is enabled.
+ *
+ * The feature requires both the site option and the database schema
+ * introduced in db_version 61698.
+ *
+ * @since 7.0.0
+ *
+ * @return bool True if collaboration is enabled, false otherwise.
+ */
+function wp_is_collaboration_enabled() {
+	return get_option( 'wp_enable_real_time_collaboration' )
+		&& get_option( 'db_version' ) >= 61698;
+}
+
 /**
  * Injects the real-time collaboration setting into a global variable.
  *
@@ -14,11 +29,34 @@
  * @access private
  */
 function wp_collaboration_inject_setting() {
-	if ( get_option( 'wp_enable_real_time_collaboration' ) ) {
+	if ( wp_is_collaboration_enabled() ) {
 		wp_add_inline_script(
 			'wp-core-data',
 			'window._wpCollaborationEnabled = true;',
 			'after'
 		);
 	}
 }
+
+/**
+ * Deletes sync updates older than 7 days from the wp_sync_updates table.
+ *
+ * Rows left behind by abandoned collaborative editing sessions are cleaned up
+ * to prevent unbounded table growth.
+ *
+ * @since 7.0.0
+ */
+function wp_delete_old_sync_updates() {
+	if ( ! wp_is_collaboration_enabled() ) {
+		return;
+	}
+
+	global $wpdb;
+
+	$wpdb->query(
+		$wpdb->prepare(
+			"DELETE FROM {$wpdb->sync_updates} WHERE created_at < %s",
+			gmdate( 'Y-m-d H:i:s', time() - WEEK_IN_SECONDS )
+		)
+	);
+}

src/wp-includes/collaboration/class-wp-http-polling-sync-server.php

@@ -3,6 +3,7 @@
  * WP_HTTP_Polling_Sync_Server class
  *
  * @package WordPress
+ * @since 7.0.0
  */
 
 /**
@@ -73,6 +74,7 @@ class WP_HTTP_Polling_Sync_Server {
 	 * Storage backend for sync updates.
 	 *
 	 * @since 7.0.0
+	 * @var WP_Sync_Storage
 	 */
 	private WP_Sync_Storage $storage;
 
@@ -130,9 +132,10 @@ public function register_routes(): void {
 				'type'     => 'integer',
 			),
 			'room'      => array(
-				'required' => true,
-				'type'     => 'string',
-				'pattern'  => '^[^/]+/[^/:]+(?::\\S+)?$',
+				'required'  => true,
+				'type'      => 'string',
+				'pattern'   => '^[^/]+/[^/:]+(?::\\S+)?$',
+				'maxLength' => 255, // The size of the wp_sync_updates.room column.
 			),
 			'updates'   => array(
 				'items'    => $typed_update_args,
@@ -198,7 +201,7 @@ public function check_permissions( WP_REST_Request $request ) {
 					sprintf(
 						/* translators: %s: The room name encodes the current entity being synced. */
 						__( 'You do not have permission to sync this entity: %s.' ),
-						$room
+						esc_html( $room )
 					),
 					array( 'status' => rest_authorization_required_code() )
 				);