=== Quarivo Form Shield ===
Contributors: taka235345
Tags: contact form, contact form 7, inbox, spam, email
Requires at least: 6.7
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Keep Contact Form 7 inquiries in a local review inbox, even when mail sending fails, and quietly quarantine only high-confidence spam.

== Description ==

Quarivo Form Shield adds an independent, local inbox for Contact Form 7. It stores a reviewable record before Contact Form 7 attempts email, so a local mail error does not make the original inquiry disappear.

= The important distinction =

WordPress can report that its mail method processed a request without an error. That is not a mailbox delivery receipt. Quarivo Form Shield therefore shows **Mail handoff accepted — delivery not verified** separately from a mail error, skipped spam mail, and mail that was not attempted.

= Conservative spam handling =

* Balanced mode is the default and treats every language equally.
* Japanese-site enhanced and Strict Japanese modes are explicit administrator choices.
* One URL, one foreign-language message, missing JavaScript, or a public email address does not cause automatic quarantine by itself.
* Compound signals include URL/link structure, a honeypot, browser-observed timing, local rate evidence, repeated promotion structure, executable markup, and bounded local moderator feedback.
* Only high-confidence Quarivo results are quietly quarantined. Lower evidence stays visible as **Needs review** and ordinary mail remains available.
* Akismet, reCAPTCHA, Cloudflare Turnstile, Flamingo, and other Contact Form 7 decisions are not disabled or overwritten. An existing spam result remains spam.
* No message is automatically deleted.

= Local inbox =

The responsive WordPress administration inbox provides:

* All, unread, read, important, normal, needs review, auto-quarantined, spam, mail-error, and invalid counts.
* Search, form filtering, 25/50/100-row pagination, and bounded per-page bulk actions.
* Full submitted fields, source form/page, sender information, score/reasons, Contact Form 7 status, and mail-processing status.
* Reversible normal/review/spam decisions and local learning from explicit moderator choices.
* A deliberate plain-text resend to the validated site administrator address. Submitted data is never reused as an email header and attachments are not automatically resent.
* Private JSON and formula-safe CSV export.

= Failure-safe storage =

The first database insert occurs before validation, spam handling, upload processing, and email. Later Contact Form 7 hooks enrich the same unique row, preventing duplicate records from one request.

If a database write fails, Quarivo retries before mail, writes an authenticated-encrypted local recovery record, shows an administrator health warning, and processes a small recovery batch when the database becomes available. The original mail path is left available. A simultaneous database, private-filesystem, and mail outage cannot be made loss-free by an in-process plugin; Quarivo reports that failure instead of silently claiming success.

= Protected attachments =

Validated Contact Form 7 temporary uploads are copied before Contact Form 7 removes them. Quarivo enforces a 25 MB default storage limit and stores each file as AES-256-GCM authenticated ciphertext under a random opaque name in a protected plugin directory inside the site's configured WordPress uploads directory. It does not create a public attachment URL. A capability and nonce checked administrator request verifies and decrypts a download. If authenticated encryption or private storage is unavailable, Quarivo does not retain the attachment and displays a storage warning.

= Privacy and retention =

* No API key, CAPTCHA, remote request, telemetry, external font, or third-party asset is required by Quarivo Form Shield.
* Password, token, API-key, PIN, CVV, and card-number-like field names are redacted automatically. Administrators can add exact excluded field names.
* Contact Form 7 do-not-store and storage-consent metadata is respected: operational metadata may remain, but submitted field values are not copied when the form prohibits storage.
* Visible IP storage defaults to anonymized. Full IP display is opt-in; a keyed local hash supports rate checks.
* Read, non-important entries and encrypted attachments have separate retention controls. Unread and important entries are not removed by scheduled entry retention.
* WordPress personal-data export and erasure tools include exact sender-email matches.
* Plugin deletion retains data by default. Permanent removal must first be selected in settings and confirmed by typing DELETE.

= Contact Form 7 dependency =

Contact Form 7 is not bundled. If it is absent or inactive, Quarivo Form Shield does not cause a fatal error. The existing inbox remains available and a clear administrator notice explains that new capture is paused.

== Installation ==

1. Install and activate Contact Form 7.
2. Upload the `quarivo-form-shield` folder to `/wp-content/plugins/`, or install its ZIP from **Plugins > Add New > Upload Plugin**.
3. Activate **Quarivo Form Shield**.
4. Open **Form Shield > Inbox**. Balanced protection and local capture require no API key or external account.
5. Review **Form Shield > Settings** for retention, field exclusions, and your privacy notice.

== Frequently Asked Questions ==

= Does “mail handoff accepted” mean the inquiry reached the recipient? =

No. It means the local WordPress mail method processed the request without reporting an error. A downstream mail server can still reject, quarantine, delay, or misroute it. The saved inbox record is the reliable local copy.

= Does the plugin require Flamingo? =

No. Quarivo Form Shield has its own tables and inbox. If Flamingo is active, Quarivo does not change or delete Flamingo records.

= Does it send inquiry data to an AI or external API? =

No. Scoring, storage, learning, and review stay on the WordPress site.

= Can I restore a false positive? =

Yes. Mark it Normal or Needs review in the inbox. The record is never automatically deleted, and explicit Normal feedback can slightly reduce matching soft structural evidence in the future.

= What happens to data when I delete the plugin? =

It is retained by default. To remove Quarivo tables, settings, encrypted attachments, fail-safe files, and learning data during plugin deletion, first open **Form Shield > Settings**, select permanent deletion, type DELETE, and save. Contact Form 7 forms and Flamingo data are never deleted by this option.

== Changelog ==

= 1.0.1 =
* Uses the configured WordPress uploads directory for encrypted private storage and fail-safe recovery files.
* Uses WordPress.org language packs instead of bundled translation files.
* Limits activation and operational notices to the Plugins screen and Quarivo Form Shield screens.

= 1.0.0 =
* First public-review candidate focused on deep Contact Form 7 capture.
* Adds server-bound request identity, bounded hostile-input processing, guarded private-storage roots, attachment memory checks, resend throttling, and concurrency-safe fail-safe recovery.
* Passes the official Plugin Check with no reported errors or warnings.

= 0.1.0 =
* Initial private local-test build.
* Adds pre-mail inbox persistence, final mail-result tracking, conservative compound scoring, protected attachments, encrypted database-failure recovery, privacy tools, retention, review, resend, export, and explicit uninstall controls.
