Core as a Composer package, and where wp-content goes

WordPress installed as a dependency, which requires the content directory to move out of the core directory.

// wp-config.php, before wp-settings.php is loaded
define( 'WP_CONTENT_DIR', dirname( __DIR__ ) . '/app' );
define( 'WP_CONTENT_URL', WP_HOME . '/app' );

// and the layout:
//   public/
//     wp/          ← core, from composer, never edited
//     app/         ← themes, plugins, uploads
//     index.php
//     wp-config.php
//   composer.json
//   composer.lock  ← the only thing that describes the site

The constants must be defined before core loads, which means wp-config.php is doing real work rather than holding credentials. The layout is the part that surprises people used to a standard install, and the payoff is that the core directory is disposable — deleting and reinstalling it is a Composer command rather than an event.