WordPress.org manual review remediation — 17 Aug 2026
-------------------------------------------------------
This review build removes bundled runtime translation catalogs so WordPress.org can generate and deliver locale packs through translate.wordpress.org. The source POT template remains for translator/developer reference only. Frontend and administration presentation boundaries were re-audited for late escaping: scalar text, URL and attribute values use context-appropriate esc_* functions, while trusted SMSocial renderer markup is filtered at the final output boundary with a deliberately scoped wp_kses() allowlist. The service-worker endpoint remains a non-HTML application/javascript response whose dynamic payload is produced by wp_json_encode() before insertion. No commercial updater, external licence-server client or paid-feature runtime is included in this WordPress.org Core package.

SMSocial Core 0.17.0 — Public Core distribution candidate
-----------------------------------------------------------------------
Normal requests no longer re-run migration-ledger, SHOW TABLES, SHOW FULL COLUMNS, SHOW INDEX and record-count health inspection across every database-backed module. An autoloaded schema-version stamp gates the fast path. Full migration/schema/module validation still runs after activation or a DB schema-version change, and explicit System Health/diagnostics continue to perform deep inspection. SchemaBuilder and MigrationLedger also memoize repeated introspection within a deep-check request. The stamp is persisted only after the complete module graph boots successfully. DB schema remains 31.

wporg.9.5 Security Audit Gate — authorization, privacy and abuse hardening
----------------------------------------------------------------------------
This pass keeps the verified Core Code Split and zero-finding Plugin Check baseline while tightening least-privilege administration and asynchronous privacy boundaries. Role mappings/import/reset now require the dedicated user-management capability; diagnostic views/exports require the diagnostics capability and log clearing additionally requires general management permission. Feed Sync no longer discloses private/deleted Activity UUID references outside the viewer visibility boundary and is rate-limited per user. Public health computation is server-side bounded, diagnostic filesystem paths are redacted, and frontend error decoding avoids secondary HTML parsing. REST ownership/IDOR, CSRF/nonces, SQL preparation, uploads, SSRF/redirects and authentication/password reset were re-reviewed. DB schema remains 31.

wporg.9.4.1 Security Audit Gate 1.1 — direct admin nonce boundary
-----------------------------------------------------------------
This security pass keeps the verified wporg.9.3 Core presentation/runtime intact while replacing the admin-post custom nonce wrapper with canonical WordPress check_admin_referer() enforcement after capability checks. The broad nonce suppression is removed. Authentication identify/resend responses are now account-state neutral at the public boundary, with rate limits applied before existence checks; authentication failure guidance points to SMSocial's internal redacted diagnostics channel. REST authorization/IDOR boundaries, SQL preparation, uploads, SSRF controls, redirects, escaping and session controls were re-reviewed. DB schema remains 31.

wporg.9.3 Core Presentation Boundary — paid UI pruning
------------------------------------------------------
This rebuild starts from the verified wporg.8.1 baseline. Commercial backend modules are removed from the Core runtime while the proven shared App Shell/admin presentation is preserved. Inactive Messages/Notifications placeholders are no longer rendered by Core; their entry points remain extension-conditional, and the Events development-status card is removed from the public App Shell. DB schema remains 31.

This ZIP is a WordPress.org distribution preflight build of SMSocial Core.
It is intentionally separate from the commercial SMSocial distribution.
Updates for this build must be provided by WordPress.org only.

wporg.8.1 final Plugin Check performance-query cleanup
------------------------------------------------------
Managed Auth/App/Legal page recovery now resolves canonical page slugs and verifies SMSocial ownership markers instead of querying postmeta values. Composer staging now uses a private prefixed attachment status plus an indexed token slug for active stages, while 30-day feed-image retention candidates are sourced from canonical SMSocial Activity relationships and then re-verified against attachment retention metadata. DB schema remains 31.

wporg.8 custom-table DB intent
------------------------------
SMSocial stores social-network state in dedicated plugin-owned tables. Repository classes
therefore use $wpdb directly by design. wporg.8 documents that boundary with PHPCS
direct-query/no-caching annotations only; prepared-query and unescaped-parameter security
checks remain enabled. Repository-level caching is not forced for privacy, moderation,
messaging or social state because stale authorization/state is unsafe. Safe caching and
first-load performance remain a separate release gate before 1.0.
