== Changelog ==

= 1.0.4 =
* Database: the webhook-event unique index is renamed from "event" to "gateway_mode_event_id" (same columns, still unique). Existing sites are migrated in place without touching stored records.
* Database: activation and a periodic check verify every table, column (type, length, nullability) and index by database introspection; a damaged schema is repaired automatically where possible.
* Security: all SQL uses $wpdb->prepare() with %i identifier placeholders for table and column names; table names are limited to the plugin's own fixed list.
* Payments: checkout, payment, refund and webhook writes, background jobs, the reconciler, privacy export/erasure and unsubscribe pause with a clear "temporarily unavailable" answer while the database schema is incomplete or newer than the plugin; a database error on a missing column or table pauses them at once.
* Payments: a payment confirmed by the provider is saved together with the paid order. If that cannot be saved (including a lost database connection), the background reconciler completes it from the provider, and no second payment can be started for the order meanwhile.
* Refunds: each refund is recorded with its recovery check before the provider is called. If any try has no definite answer (even when a later retry is rejected) or the request is interrupted, the amount stays reserved and the refund is resolved with the provider under the same identity; it is sent again only when the provider shows that it does not exist.
* PayPal: prices PayPal cannot charge exactly (decimals in HUF, JPY or TWD) are not offered with PayPal and are never rounded.
* Privacy: unsubscribe and erasure requests stay effective after a reinstall or a change of the WordPress salts. Exception: opt-outs recorded before 1.0.4 for people whose email was later erased are protected with the WordPress security keys; if all keys are changed they can no longer be read, so recovery reminders pause and Diagnostics asks the site owner to restore the keys or discard those old opt-outs. Erasure also clears the checkout sessions of buyers who paid without the email step; the export includes checkout sessions and email history, page by page. Links sent before this update keep working for their remaining lifetime (unsubscribe, recovery, order status); old links never enable test mode.
* Reminders: the consent journal records whether the buyer was shown the reminder notice or the site owner relied on a lawful basis without a notice.
* Reliability: receipts and order notifications are sent once even when several queue runners overlap; turning them off also stops queued ones. A background job whose lease expired cannot overwrite the result of the runner that took it over; refund totals are recalculated under the order lock.
* Fixes: purchase events on the standalone checkout page; Pay button text presets and the logo picker; preview of a product without a price; network-wide deactivation on multisite; uninstall after an incomplete installation; stricter validation of checkout requests.

= 1.0.3 =
* Renamed to OfferPact Checkout with permanent directory and text domain offerpact-checkout. No functional changes.
* Prevents simultaneous loading with a copy installed under an earlier folder name; existing settings and records use the same storage.

= 1.0.2 =
* Renamed the plugin directory and text domain.
* Preserves all Free 1.0.1 compliance fixes and all three native recovery reminders.
* Prevents simultaneous loading with the previous checkout copy; existing settings and records use the same storage.


= 1.0.1 =
* Recovery: the two optional follow-up reminders (reminder 2 and 3) are built in, with their own timing, subject, text and button, configured in Recovery and Emails. All are off by default.
* Checkout session REST routes check the session token in their permission callback.
* HTML emails use a fluid inline layout (no embedded style block).
* Admin screens escape assembled form markup with an explicit allow-list.

= 1.0.0 =
* First public release.

== Upgrade Notice ==

= 1.0.4 =
Database, payment, refund and privacy reliability fixes. Existing orders, settings, opt-outs and webhook history are kept; no action required.

= 1.0.3 =
Renamed to OfferPact Checkout. Deactivate any copy installed under an earlier folder name first, and do not delete it through WordPress during migration: both share settings and records.


= 1.0.1 =
Follow-up reminders 2 and 3 are built in again; existing settings and saved reminder jobs are kept. No separate extension is needed for them.
