=== LumenCache ===
Contributors:      nasruleam, celsiusanderson
Tags:              cache, full-page-cache, performance, woocommerce, page-speed
Requires at least: 6.0
Tested up to:      7.1
Requires PHP:      8.1
Stable tag:        1.7.5
License:           GPL-2.0-or-later
License URI:       https://www.gnu.org/licenses/gpl-2.0.html

RAM-first full-page caching that serves pages before WordPress loads, with automatic WooCommerce and LMS integration.

== Description ==

LumenCache implements a RAM-first full-page cache with a WordPress
`advanced-cache.php` drop-in. On a cache HIT, the drop-in serves complete HTML
before the normal WordPress bootstrap and database queries. This early-response
path reduces application-layer work and keeps repeat page requests fast across
Nginx, Apache, and LiteSpeed.

The cache is designed to fail open when its storage layer is unavailable, so a
cache connection problem does not take the WordPress site offline.

== Research Foundation ==

Academic Reference:
"Dynamic Resource Mapping in Zero-Reload Server Architectures: Eliminating
Application-Layer Latency and Extension Dependency in High-Concurrency CMS
personalised requests continue through the full WordPress stack.

This architecture is intended to reduce repeated bootstrap work, database
queries, and extension overhead while preserving WordPress compatibility. It
also provides a practical bridge between academic performance research and
everyday publishing workloads, including content-heavy sites, WooCommerce
catalogues, and membership-driven pages.

Research author: **Professor Nasrul Eam — Dean, Light & Composition University**.

= Ten-Subsystem Architecture =

1. **RAM-First Full-Page Cache Engine** — PHP stores complete HTML at
   `shutdown` and resolves repeat requests from the in-memory cache layer.
2. **Nginx / Apache Proxy Bridge** — Static or dynamic server config bypasses
   PHP entirely for cache hits.
3. **Selective Bypass Cookie Router** — `sys_active_state` cookie routes
   logged-in users and cart-active visitors to live PHP.
4. **Application Driver Profile Engine** — Auto-detects WooCommerce,
   LearnDash, LifterLMS, MemberPress, BuddyBoss and registers tailored bypass
   rules and invalidation hooks.
5. **Surgical Cache Invalidation** — Post save / nav menu / widget / theme
   switch events trigger precise per-URL or full purges.
6. **REST API State Endpoint** — `/wp-json/lumencache/v1/user-state` serves
   personalised fragments for skeleton-hydration clients.
7. **Skeleton Hydration DOM Worker** — `skeleton-hydration.js` replaces cached
   placeholders with live content on load.
8. **WP-CLI Management Interface** — `flush`, `flush-url`, `status` commands.

= Configuration (optional) =

All settings are configurable from **LumenCache → Settings** in the WordPress
admin. Optionally override any setting via wp-config.php — constants always win:

    define( 'LUMENCACHE_REDIS_HOST',          '127.0.0.1' );
    define( 'LUMENCACHE_REDIS_PORT',          6379 );
    define( 'LUMENCACHE_REDIS_SOCKET',        '' );
    define( 'LUMENCACHE_REDIS_PASSWORD',      '' );
    define( 'LUMENCACHE_REDIS_DATABASE',      0 );
    define( 'LUMENCACHE_REDIS_TIMEOUT',       1.0 );
    define( 'LUMENCACHE_REDIS_PREFIX',        'cache:' );
    define( 'LUMENCACHE_CACHE_TTL',           86400 );
    define( 'LUMENCACHE_CACHE_SALT',          '' );
    define( 'LUMENCACHE_CACHE_QUERY_STRINGS', false );
    define( 'LUMENCACHE_PROXY_PASSWORD',      '' );

= WP-CLI =

    wp lumencache flush
    wp lumencache flush-url https://example.com/page/
    wp lumencache status

== Installation ==

== Privacy ==

LumenCache stores rendered page HTML and cache metadata in the in-memory cache
service configured by the site administrator. It does not send cache contents,
visitor data, or analytics data to a third-party LumenCache service. The
optional user-state endpoint returns only the requested dynamic values to the
requesting browser; sites should review those values and their own privacy
policy before enabling personalized hydration.

== Frequently Asked Questions ==

= Getting a 502 Bad Gateway on Nginx after activating or during WooCommerce use? =

Nginx has a default `fastcgi_buffer_size` of only 4KB–8KB. When combining rich caching headers with WooCommerce session cookies, the upstream response header exceeds this limit. Nginx immediately terminates the connection with:
`upstream sent too big header while reading response header from upstream`, resulting in an instant 502 Bad Gateway error.

To resolve this, add the following FastCGI and proxy buffer directives to your Nginx configuration (within the `http {}`, `server {}`, or PHP `location` block):

    fastcgi_buffer_size 32k;
    fastcgi_buffers 16 16k;
    fastcgi_busy_buffers_size 32k;
    proxy_buffer_size 32k;
    proxy_buffers 16 16k;
    proxy_busy_buffers_size 32k;

After adding these directives, test and reload Nginx:
    nginx -t && systemctl reload nginx

= Why are 0 pages cached? =

Two common causes:
1. **Nginx config not applied** — visit Server Setup and paste the config blocks.
2. **WooCommerce session cookie** — fixed in v1.1.0. Previous versions bypassed
   the cache for *all* visitors on WooCommerce sites due to the always-present
   `wp_woocommerce_session_*` cookie.

= Why can key salting affect server-level caching? =

When `LUMENCACHE_CACHE_SALT` is set, PHP stores keys as SHA-256 hashes. A
server-level configuration must use the same key strategy or it will produce
cache misses. Disable the salt for a plain-key configuration, or use the
compatible hashed-key server template.

= Does LumenCache work with LiteSpeed? =

Yes. LiteSpeed supports Apache-compatible `.htaccess` rewrites. LumenCache uses
the Apache proxy mode on LiteSpeed. For better performance, ask your host
which in-memory cache acceleration options are available.

= Can I still use wp-config.php constants? =

Yes — constants always take precedence over admin settings. If you define a
constant, the corresponding field in the Settings tab is shown locked (read-only).

== Changelog ==

= 1.7.5 (October 6, 2026) =
* REST API GUEST HYDRATION RESILIENCY: Hardened `/wp-json/lumencache/v1/user-state` to gracefully isolate guest-safe keys (`cart-count`, `cart-total`) when unauthenticated requests contain mixed-key requests (such as headers rendering both cart widgets and member greetings), preventing 403 authorization rejections from breaking guest cart hydration.
* LCU LMS & SENSEI COURSE PROGRESSION: Added native student course progress resolution for Light & Composition University's LMS (`Educational_Products_LMS_Progress`) and Sensei LMS, alongside existing LearnDash and LifterLMS integrations; added `lumencache_resolve_course_progress` and `lumencache_enqueue_hydration_script` filters.
* SKELETON HYDRATION PROGRESS BARS & REHYDRATION API: Enhanced `skeleton-hydration.js` to dynamically update progress bar widths (`role="progressbar"`, `.lms-progress-bar`, `.progress-bar`) and support `data-lumencache-suffix` attributes; exposed `window.lumenCacheHydrate` API and registered `lumencache:rehydrate` event listener for AJAX catalog pagination and mini-cart drawers.
* WP-CLI STACK COMMAND ENHANCEMENTS: Added `wp lumencache flush-all` subcommand alias, `--url=<url>` flag support for `flush-url`, and enriched `wp lumencache status` with HTTP 304 ETag status, Speculation Rules API state, storage driver, SWR grace periods, browser cache TTL, Apache/LiteSpeed RAM Proxy status, and Pro status.
* WP-CLI AUTOMATION PROVISIONING: Added `wp lumencache deploy-dropin`, `wp lumencache remove-dropin`, `wp lumencache write-htaccess`, and `wp lumencache remove-htaccess` subcommands for automated headless server provisioning and CI/CD pipelines.
* PRO COMPATIBILITY BRIDGE & DUAL HOOK DISPATCH: Restored `lc_is_pro_active()` and `lc_has_pro_feature()` legacy function aliases; added dual hook dispatching for all five Pro administrative sections (`lc_render_pro_*` and `lumencache_render_pro_*`); added legacy `lumencache_render_pro_panel()` and `lc_render_pro_panel()` compatibility bridges.

= 1.7.4 (October 6, 2026) =
* TAB CONTINUITY & FORM REDIRECTION: Injected explicit `from_tab` hidden inputs across Settings, Cache Controls (Flush All, Purge URL), and Server Setup action forms, guaranteeing that all form submissions and admin-post actions reliably redirect administrators back to their active working tab.
* HTACCESS ERROR RESILIENCY: Hardened `handle_htaccess_write()` to validate `WP_Error` return states from `Htaccess::write_rules()`, passing distinct error notices with diagnostic messages instead of reporting false positive success on filesystem permission failures; added distinct `htaccess=removed` handling for rule deletions.
* APACHE & LITESPEED SERVER SETUP CARD: Introduced dedicated "Apache / LiteSpeed Direct RAM Proxy (.htaccess)" management card on the Server Setup tab for Apache and LiteSpeed environments, providing real-time deployment status, one-click rule write/remove controls, and a copyable rewrite rules block.
* TEN SUBSYSTEMS OVERVIEW MATRIX: Expanded "Core Engine Systems" on the administrative overview to feature all ten subsystems, providing live status and operational descriptions for the new HTTP 304 & ETag Validation Engine and Next-Gen Speculation Rules API Engine.
* MULTI-DEVICE RESPONSIVENESS (<620px, <480px): Overhauled admin layout styles with responsive column-wrapping for all settings labels and input controls on viewports <=620px, single-column metrics card grid on screens <=480px, column layout for URL purges, and >=40px touch targets for mobile usability.

= 1.7.3 (October 6, 2026) =
* INTRA-REQUEST STATE SYNCHRONIZATION: Enhanced `Cookie_Router::set_active_cookie()` to immediately mirror active state into superglobal `$_COOKIE['sys_active_state'] = 'true'`, ensuring all downstream checks and speculation suppression evaluate correctly within the identical PHP lifecycle.
* RECOVERY ON CART ITEM REMOVAL: Added `woocommerce_cart_item_removed` listener to `Cookie_Router`, automatically clearing `sys_active_state` and restoring high-speed RAM caching when a guest shopper removes the final item from their cart.
* REVERSE PROXY SSL RESILIENCY: Hardened cookie dispatch in `Cookie_Router::send_cookie()` with full reverse proxy and Cloudflare SSL awareness (`HTTP_X_FORWARDED_SSL`, `HTTP_CF_VISITOR`), guaranteeing correct `Secure` attribute propagation.
* SPECULATION RULES BYPASS HARDENING: Expanded `Speculation_Rules::should_render()` with comprehensive suppression checks for `DONOTCACHEPAGE`, `woocommerce_cart_hash`, native WooCommerce checkout/account templates (`is_cart()`, `is_checkout()`, `is_account_page()`), and password-protected posts.
* SPECULATION URL PATTERNS & SELECTOR EXCLUSIONS: Enhanced speculation rules schema to explicitly exclude exact `/cart`, `/checkout`, `/my-account` paths, archive mime types (`.tar*`, `.gz*`), and link downloads (`a[download]`).
* SANITIZED AJAX FRAGMENTS HANDLING: Hardened `Woo_Guard::maybe_short_circuit_fragments()` with query parameter sanitization (`sanitize_text_field( wp_unslash( ... ) )`).

= 1.7.2 (October 6, 2026) =
* QUERY OPTIMIZATION: Eliminated redundant MySQL transient deletion on frontend cache writes (`Redis_Connector::set()`), preventing database churn and maintaining 15-second key count caching exclusively for the administrative dashboard.
* OUTPUT BUFFER COLLAPSE: Added nested output buffer level tracking (`$capture_buffer_level`) in `Cache_Engine`, safely collapsing unclosed third-party template and widget buffers prior to cache capture.
* ERROR RECOVERY HARDENING: Extended fatal error detection in output buffer shutdown hook to intercept `E_RECOVERABLE_ERROR`, guaranteeing incomplete or faulted pages are never committed to cache.
* DEDICATED BLOG & AUTHOR INVALIDATION: Added surgical cache purging for static front page blog listings (`page_for_posts`) and post author archives (`get_author_posts_url`), ensuring archives immediately reflect newly published and updated articles.
* SLASHED & UNSLASHED KEY PURGE PARITY: Expanded `purge_post()` and `purge_url()` to invalidate both trailing-slashed and unslashed canonical Redis keys in a single atomic batched `DEL` command.
* REVERSE PROXY SSL EXPANSION: Extended HTTPS scheme detection to support `HTTP_X_FORWARDED_SSL` and Cloudflare `HTTP_CF_VISITOR` payloads across write paths and URL purges.
* DEACTIVATION & UNINSTALL HYGIENE: Enhanced `Lifecycle::deactivate()` and `Lifecycle::uninstall()` to automatically flush Redis cache keys and clean up all transient caches (`lumencache_key_count`, `lumencache_nginx_confirmed`, `lumencache_qs_bridge_check`).
* REDIS SCAN BOUNDS: Added iteration bounds to `Redis_Connector::key_count()` and `delete_pattern()` to defend against runaway driver loops during full-keyspace cursor traversal.

= 1.7.1 (October 6, 2026) =
* HTTP HEAD METHOD SUPPORT: Enabled early RAM cache HIT handling for HTTP HEAD requests across both advanced-cache.php drop-in and server/lumen-cache-proxy.php, serving accurate response headers in <1ms without body transfer and eliminating unnecessary WordPress bootstrap on crawler/probe checks.
* RFC 7232 CONDITIONAL GET HARDENING: Expanded If-None-Match evaluation to seamlessly support unquoted ETags, wildcard asterisk (*), and multi-tag header values, preventing accidental cache re-downloads.
* PREDIS AUTOLOADER RESOLUTION: Hardened early autoloader path resolution to respect custom WP_PLUGIN_DIR definitions before falling back to WP_CONTENT_DIR/plugins.
* HEADERS_SENT DEFENSE: Wrapped proxy header emission in defensive headers_sent() check to prevent PHP runtime notices.

= 1.7.0 (October 6, 2026) =
* SPECULATION RULES API ENGINE: Introduced next-generation browser speculation rules (`<script type="speculationrules">`) delivering sub-50ms instant page navigation via Chromium background prefetching and prerendering, fully accelerated by sub-millisecond RAM cache delivery.
* CONDITIONAL GET & HTTP 304 NOT MODIFIED: Added native ETag generation and `If-None-Match` validation directly into early drop-in and proxy readers, terminating repeat requests with `HTTP 304 Not Modified` and 0 bytes transfer.
* RFC 5861 STALE-WHILE-REVALIDATE & EDGE HEADERS: Emitted modern `Cache-Control: public, max-age=..., stale-while-revalidate=...` headers for browser caches and edge CDN proxies.
* WORDPRESS.ORG PLUGIN CHECK COMPLIANCE: Hardened input attribute rendering, added translator comments across all internationalized placeholders, namespaced pro compatibility surfaces, and cleared 100% of repository linter errors.
* EARLY DROP-IN PREDIS BOOTSTRAP: Resolved silent drop-in bail-out in environments without `ext-redis` PHP extension. Both `advanced-cache.php` and `server/lumen-cache-proxy.php` now detect and load LumenCache's bundled Predis autoloader (`wp-content/plugins/lumen-cache/vendor/autoload.php`) before early bail-out checks.
* RAM HIT RATIO AUDIT & CERTIFICATION: Verified RAM cache hit-rate scaling from 0% past the 98% target (certified at 98.1% across 150+ requests with 0 DB queries on hits).

= 1.6.35 (October 6, 2026) =
* EARLY DROP-IN PREDIS BOOTSTRAP: Resolved silent drop-in bail-out in environments without `ext-redis` PHP extension. Both `advanced-cache.php` and `server/lumen-cache-proxy.php` now detect and load LumenCache's bundled Predis autoloader (`wp-content/plugins/lumen-cache/vendor/autoload.php`) before early bail-out checks.
* RAM HIT RATIO AUDIT & CERTIFICATION: Verified RAM cache hit-rate scaling from 0% past the 98% target (certified at 98.1% across 150+ requests with 0 DB queries on hits).
* PRO TELEMETRY COUNTER HARMONIZATION: Verified real-time telemetry incrementing across `advanced-cache.php`, `lumen-cache-proxy.php`, and `class-cache-engine.php` with 0 transport latency.
* DROP-IN DEPLOYER RE-SYNC: Updated `Drop_In::deploy()` template to preserve the bundled autoloader fallback on redeployments and settings compiles.

= 1.6.34 (September 15, 2026) =
* PRO COMPATIBILITY: Hardened `lumencache_is_pro_active()` to verify `defined( 'LUMENCACHE_PRO_VERSION' ) && get_option( 'lumencache_pro_status' ) === 'active'`, preventing false positive status if the Pro add-on is deactivated or uninstalled.
* CLOUDFLARE EDGE SYNC: Hooked `lumencache_purge_urls` into single-URL purge operations (`purge_url`), ensuring Admin Bar "Purge This URL" and WP-CLI `flush-url` actions automatically purge Cloudflare edge cache alongside local Redis.
* APACHE & LITESPEED TELEMETRY: Added Pro hit-counter telemetry parity to the pre-bootstrap proxy (`server/lumen-cache-proxy.php`) on cache HITs, and updated `Drop_In::write_config()` to synchronize compiled `pro_active` state to deployed proxy files.
* ADMIN ACTIONS CONTEXT: Injected `from_tab` retention to the Cloudflare purge form on the Cache Controls page, keeping administrators on their current tab after purging.

= 1.6.33 (September 15, 2026) =
* ADMIN BAR: Added contextual "Purge This URL" sub-node when viewing frontend content, enabling instant single-URL cache invalidation directly from the toolbar without flushing the entire site.
* DASHBOARD WIDGET: Retained administrator on `wp-admin/index.php` after flushing cache via `redirect_to` handling, complete with dismissible success notice and refined button hover styling.
* WP-CLI: Enhanced `wp lumencache status` with `--format` support (table, json, yaml, csv) and drop-in / `WP_CACHE` status visibility; aligned `flush-url` output with semantic WP-CLI warning conventions.
* REST API & HOLE-PUNCHING: Automated WooCommerce cart and session initialization (`wc_load_cart`) during REST API user-state hydration requests; added LifterLMS course-progress resolution support.
* REST API EXTENSIBILITY: Introduced `lumencache_user_state_keys` and `lumencache_resolve_user_state_{$key}` filters for developer extensibility.
* NONCE HARDENING: Supported both query parameter and `X-WP-Nonce` header authentication across REST user-state hydration and Admin Bar AJAX flush handlers.

= 1.6.32 (September 15, 2026) =
* SETTINGS & CONNECTION TEST: Added native AJAX Redis connection testing (`lumencache_test_redis`) supporting both phpredis and Predis drivers, Unix sockets, host/port, database indexes, connection timeouts, and authentication passwords.
* UI & TAB NAVIGATION: Implemented seamless browser URL synchronization (`history.replaceState`) on sidebar tab switches, preventing stale tab states across page reloads.
* QUICK SETUP TRACKER: Enabled 1-click execution for Apache / LiteSpeed rewrite rule generation directly from the Quick Setup Tracker on the Overview tab, eliminating unnecessary navigation steps.
* ADMIN ACTION REDIRECTS: Added contextual `tab` and `from_tab` state retention across all admin actions (cache flushes, drop-in deployment, settings save, salt save, and rewrite operations), preserving the user's active view after every submission.
* SETTINGS HARDENING: Enhanced password field handling to preserve special characters and ensured default namespace fallback (`cache:`) when clearing key prefix.
* SETTINGS CACHE: Added `Settings::reset_cache()` method to reset in-process configuration memory.

= 1.6.31 (September 15, 2026) =
* NGINX: Synchronized `nginx_map_block()` and sample Nginx configurations with `wp-postpass_` and `comment_author_` cookie bypass rules, preventing cached responses for unlocked password-protected posts and returning commenters.
* APACHE & LITESPEED: Enhanced `.htaccess` rewrite rules to directly exclude `/feed/` requests and XML sitemaps before proxy evaluation, avoiding unnecessary PHP execution overhead.
* APACHE & LITESPEED: Added explicit `wp-postpass_` and `comment_author_` cookie rewrite conditions to `.htaccess` configuration.
* PROXY DEPLOYMENT: Hardened `Htaccess::deploy_proxy()` to verify and ensure target upload directory existence with `wp_mkdir_p()`.
* PRE-BOOTSTRAP PROXY & DROP-IN: Aligned socket connection timeouts, `\Redis::OPT_READ_TIMEOUT`, Predis `read_write_timeout`, and `comment_author_` cookie bypass across both `server/lumen-cache-proxy.php` and `server/advanced-cache.php`.

= 1.6.30 (September 15, 2026) =
* TIMEOUT: Added explicit connection and read timeouts for phpredis (`\Redis::OPT_READ_TIMEOUT`) and Predis (`read_write_timeout`) to protect PHP worker processes from hanging on stalled Redis operations.
* SOCKETS: Added explicit timeout to phpredis Unix socket connections and cleaned up TCP host/port parameters on Predis socket connections.
* LATENCY & QUERY OPTIMIZATION: Implemented in-memory memoization and transient caching for `key_count()` to eliminate redundant full-keyspace SCAN operations across admin page views.
* ARRAY SAFETY: Hardened `delete()` and `delete_pattern()` against PHP 8.1+ argument unpacking errors by guaranteeing integer-indexed array keys with `array_values()`.
* TELEMETRY: Standardized memory extraction in `memory_used()` across both phpredis and Predis drivers for accurate RAM usage reporting.
* RECONNECT: Added `reconnect()` and `get_prefix()` helper methods to `Redis_Connector`.

= 1.6.29 (September 15, 2026) =
* FIX: Protected logged-in sessions in Cookie Router (`clear_active_cookie()`) when WooCommerce cart is emptied or subscriptions stop, ensuring `sys_active_state` cookie is preserved while user remains logged in.
* FIX: Expanded WooCommerce bypass routes across early drop-in, proxy, and application drivers to include `/wc-api/` to safeguard payment gateway callbacks and webhooks from being cached.
* FIX: Hooked `woocommerce_variation_set_stock` to immediately purge stale caches when variable product inventory levels are updated.
* HARDENING: Dynamic cookie path and domain resolution in `send_cookie()` with reverse proxy HTTPS detection via `HTTP_X_FORWARDED_PROTO`.

= 1.6.28 (September 15, 2026) =
* FIX: Added universal WordPress DONOTCACHEPAGE constant compliance in both bypass decision and shutdown write checks.
* FIX: Added contextual bypass checks in Cache_Engine for 404 pages, post draft previews, customizer previews, robots.txt, trackbacks, XML-RPC, and password-protected posts (`wp-postpass_` cookie).
* HARDENING: Added PHP fatal error detection (`error_get_last()`) during output buffer capture to guarantee broken pages or fatal errors are never written to cache.
* INVALIDATION: Added surgical invalidation for post status transitions (`transition_post_status`) so unpublishing or trashing a post immediately clears its cached HTML from Redis.
* INVALIDATION: Added post comment and review invalidation hooks (`comment_post`, `edit_comment`, `wp_set_comment_status`, `delete_comment`, `trashed_comment`, `spammed_comment`) and `created_term`.
* PERFORMANCE: Optimized post purging with batched multi-key Redis DEL execution and automated invalidation of all taxonomy archive URLs (categories, tags) associated with the updated post.
* REVERSE PROXY: Aligned HTTPS scheme detection across Cache_Engine, advanced-cache.php, and lumen-cache-proxy.php behind SSL-terminating reverse proxies.

= 1.6.27 (September 15, 2026) =
* FIX: Synchronized pre-bootstrap Apache/LiteSpeed proxy (`lumen-cache-proxy.php`) with complete feed bypass rules (`/feed/` and `?feed=`) to prevent XML feeds from caching as HTML.
* FIX: Expanded XML sitemap bypass in both `advanced-cache.php` and `lumen-cache-proxy.php` to cover core WordPress (`wp-sitemap`), standard sitemaps (`sitemap_index`), and paginated variants.
* FIX: Automated compiled configuration snapshot synchronization into deployed `wp-content/uploads/lumen-cache-proxy.php` on file deployment and settings save.

= 1.6.26 (September 15, 2026) =
* DOCS: Added Nginx 502 Bad Gateway troubleshooting FAQ and recommended 32KB FastCGI/Proxy buffer configuration directives.
* SERVER CONFIG: Updated Nginx global and per-site templates with 32k FastCGI and Proxy buffer directives to eliminate "upstream sent too big header" errors.
* UI: Added high-performance buffer configuration callout in Server Setup and Hosting Guide for Plesk and Nginx + PHP-FPM environments.
* PRO: Added Nginx FastCGI buffer size recommendation to Config Consistency Checker.

= 1.6.25 (September 4, 2026) =
* FEATURE: Added mobile admin bar quick-action button adjacent to native new-content icon (hook priority 71) with responsive display on viewports <= 782px.
* UI: Integrated dashicons-performance tachometer icon inside a touch-friendly 46px target with live Redis connection indicator dot.
* UX: Implemented high-contrast, Apple-grade backdrop-blurred confirmation modal ("Clear All Cache?") to prevent accidental cache purges on touch devices.
* PERFORMANCE: Asynchronous non-blocking AJAX cache purge with spinning telemetry feedback, dynamic page count reset, and floating feedback toast notification.

= 1.6.24 (August 23, 2026) =
* COMPATIBILITY: Tested and verified full compatibility with WordPress 7.1.
* PERFORMANCE: Verified pre-bootstrap drop-in execution, cache purging hooks, and REST API user-state endpoints on WordPress 7.1.

= 1.6.23 (August 15, 2026) =
* SECURITY: Added explicit ABSPATH direct access guard to `server/lumen-cache-proxy.php`.
* IMPROVEMENT: Updated `Htaccess::deploy_proxy()` to automatically configure localized ABSPATH definitions upon file deployment.

= 1.6.22 (August 15, 2026) =
* COMPLIANCE: Full compliance with WordPress.org Guideline 5; streamlined UI with clean external Pro link.
* DROP-IN: `advanced-cache.php` is now completely self-contained with compiled configuration snapshot data.
* SANITIZATION: Strict input and header sanitization against CRLF injection across all pre-bootstrap request paths.

= 1.6.21 (August 14, 2026) =
* HOUSEKEEPING: Updated Plugin URI to point to the official Dev Lab page.

= 1.6.20 (August 11, 2026) =
* FIX: Adjusted Quick Setup step flex rules in `assets/css/admin.css` to prevent connector lines from overlapping labels.

= 1.6.19 (August 11, 2026) =
* FIX: Replaced WordPress functions in `lumen-cache-proxy.php` with native PHP casts since the proxy runs pre-bootstrap.
* FIX: Corrected root path calculation (`LUMENCACHE_PROXY_ABSPATH`) for WordPress `index.php` and `wp-config.php` inclusion.

= 1.6.18 (August 11, 2026) =
* FIX: Added return value check on `$redis->auth()` and `$redis->select()` in `connect_phpredis()`.

= 1.6.17 (August 11, 2026) =
* PERF: Guarded debug string concatenation behind an explicit `LUMENCACHE_DEBUG` check for zero production overhead.

= 1.6.16 (August 11, 2026) =
* FIX: Replaced non-existent WordPress helper calls in `advanced-cache.php` with native PHP casts and isset checks.
* FIX: Corrected `enable_wp_cache()` string replacement logic for reliable `WP_CACHE` insertion into `wp-config.php`.

= 1.6.15 (August 11, 2026) =
* FIX: `Lifecycle::uninstall()` now flushes all Redis keys before removing plugin files.
* FIX: Corrected connection source label in Settings for manually-entered host/port settings.

= 1.6.14 (August 11, 2026) =
* SECURITY: Added direct file access protection via `ABSPATH` check to all server drop-ins.
* SANITIZATION: Sanitized all `$_SERVER` inputs across pre-bootstrap request paths.

= 1.6.13 (August 11, 2026) =
* FIX: Prevented RSS/Atom feeds from caching to avoid incorrect `Content-Type: text/html` response headers.
* FIX: Hardened URL sanitization in manual cache purge handler using `esc_url_raw()`.

= 1.6.12 (August 10, 2026) =
* NEW: Built-in WooCommerce cart-fragments guard against crawler-triggered fragment storms.

= 1.6.11 (August 9, 2026) =
* COMPLIANCE: Standardized update delivery on the official WordPress.org channel.
* DOCS: Added direct SSH installation instructions for Plesk in the Hosting Guide.

= 1.6.10 (August 9, 2026) =
* NEW: Added RAM Cache Engine connectivity check to Quick Setup and introduced the Hosting Guide tab.

= 1.6.9 (August 9, 2026) =
* IMPROVED: Quick Setup tracker review drawer for active, fully-configured sites.

= 1.6.8 (August 9, 2026) =
* NEW: Added interactive 4-step Quick Setup progress tracker on the Overview tab.

= 1.6.7 (August 9, 2026) =
* FIX: Aligned admin card headers and status badges across dashboard screens.

= 1.6.6 (August 8, 2026) =
* SECURITY: Synchronized MemberPress session cookie matching across Nginx, Apache, and PHP drivers.

= 1.6.5 (August 8, 2026) =
* FIX: Updated navigation references and doc comments for modular settings architecture.

= 1.6.4 (August 8, 2026) =
* UX: Refined dashboard sidebar layout with dedicated feature navigation panels.

= 1.6.3 (August 8, 2026) =
* CRITICAL: Added foreign drop-in protection to prevent overwriting existing third-party cache drop-ins.
* FIX: Aligned Redis timeout defaults and safety bypasses for dynamic/personal routes across all readers.
* FIX: Added non-HTML response rejection to prevent caching API/JSON payloads as HTML.

= 1.6.2 =
* IMPROVED: Refined update channel integration for WordPress.org directory hosting.

= 1.6.1 =
* UX: Instant click-to-show tabs across dashboard navigation.
* FIX: Fixed Admin Bar quick link URL routing.

= 1.6.0 =
* ARCHITECTURE: Split into clean Standard core with modular action/filter extensibility.
* UX: Single-page admin navigation shell with collapsible sidebar.

= 1.5.1 =
* FIX: Corrected LiteSpeed / OpenLiteSpeed server detection order.
* FIX: Added safe commented placeholders for salted Nginx configurations.

= 1.5.0 =
* NEW: Added Cloudflare edge cache purge integration support.

= 1.4.0 =
* NEW: Added cache telemetry diagnostics, bypass-reason counters, and connection test tooling.

= 1.3.0 =
* NEW: Automatic detection and bypass integration for XML sitemaps.

= 1.2.9 =
* NEW: Automatic application driver integration for educational courses and custom post types.

= 1.2.8 =
* COMPATIBILITY: Verified compatibility with WordPress 7.0 and PHP 8.5.

= 1.2.7 =
* FIX: Intelligent handling of all three `WP_CACHE` states in `wp-config.php` and automated cleanup on deactivation.

= 1.2.6 =
* UX: Added context-aware validation for Nginx key salting configurations.

= 1.2.5 =
* UX: Context-aware badges in Security Hardening Matrix and direct key salt generator.

= 1.2.4 =
* FIX: Added tracking-parameter stripping to Apache proxy to maintain parity with PHP cache keys.

= 1.2.3 =
* CRITICAL: Fixed phpredis `SCAN` cursor handling in `key_count()` and `delete_pattern()`.

= 1.2.2 =
* FIX: Automated stripping of 14 marketing tracking query parameters (Google Shopping, Meta Ads, etc.).

= 1.2.1 =
* FIX: Added connection return validation in `connect_phpredis()` and refined Unix socket handling.

= 1.2.0 =
* FIX: Output buffering rebuild for PHP-FPM and Nginx FastCGI environments.

= 1.1.1 =
* NEW: Standalone `advanced-cache.php` drop-in deployment with zero server configuration requirements.

= 1.1.0 =
* NEW: Admin settings interface, Admin Bar menu, and WP Dashboard widget.
* FIX: Resolved WooCommerce session cookie over-bypass for dramatic cache hit rate improvements.

= 1.0.3 =
* Initial public release.

== Upgrade Notice ==

= 1.7.3 =
High-performance bypass routing and Speculation Rules update featuring immediate intra-request cookie state mirroring, cart item removal recovery, reverse proxy HTTPS hardening, and expanded prefetch/prerender safety guards.

= 1.7.2 =
High-performance RAM cache engine update featuring MySQL transient write elimination on page caching, nested output buffer collapse, surgical static blog/author invalidation, dual slashed/unslashed key purges, and complete deactivation cleanup.

= 1.7.1 =
Hardened early drop-in and proxy execution with native HTTP HEAD request support, bulletproof RFC 7232 If-None-Match wildcard & unquoted ETag handling, and custom WP_PLUGIN_DIR Predis autoloader resolution.

= 1.7.0 =
Major release introducing W3C Speculation Rules API for instant sub-50ms navigation, conditional GET HTTP 304 ETag optimization for repeat visits, modern RFC 5861 stale-while-revalidate edge caching, and official WordPress.org Plugin Check compliance.

= 1.6.34 =
Comprehensive audit and hardening release across all 8 core caching pipelines, including early drop-in execution, selective bypass cookie router, Redis multi-driver resilience, contextual Admin Bar & WP-CLI invalidation, and Cloudflare edge synchronization.

= 1.6.27 =
Hardened early drop-in and Apache/LiteSpeed proxy feed/sitemap bypass parity and automated config snapshot compilation.

= 1.6.26 =
Recommended update for all Nginx, Plesk, and WooCommerce environments with official 502 Bad Gateway buffer resolution.

= 1.6.24 =
WordPress 7.1 compatibility release. Recommended update for all users.
