v0.4.0 — 70 operations

70 operations across 11 dispatchers, up from 54 in 0.3.0. Sixteen new operations,
four fixes to things that were offered but did not work, and a console screen that
now reads like a record instead of a log dump.

New in this release

The block editor, addressed a block at a time. content-blocks-get returns the
outline of a page — every block, its address, its depth, the names of its attributes
and a short preview — so a client can find the paragraph it meant without spending a
context window on the ones it did not. content-block-update then changes one block
and leaves every other block byte-identical: because post_content is a single
column, the operation reproduces the document from its own parse and refuses, without
writing, if that reproduction is not byte-identical to what is stored.

Redirects. A retired URL can be pointed at its successor, so the traffic and the
ranking an old address earned survive a rename, and a page that is simply gone can
answer 410 instead of 404 forever. Redirects are served ahead of the front-end
request and never on an admin, cron, or REST request. A redirect that would send a
visitor back to the path they asked for is refused when written and when served,
because a rename months later can turn a good redirect into a loop.

content-links-check. A rename leaves a site pointing at its own old paths from
inside its own content, and nobody sees those until a visitor clicks one. Every answer
comes from this site's database — a link to another host is listed and left
unchecked, because a content operation that makes outbound requests is a content
operation that can be pointed anywhere.

SEO metadata, in one vocabulary. Read and written through a single vendor-neutral
set of names whichever SEO plugin the site runs.

Comment moderation. List the queue, move one comment between approved, pending,
spam and trash, and reply as the acting account. All three gate on the
comment-moderation capability alone, so a moderator with no editing rights can use
them. Nothing here deletes anything: spam and trash are reversible statuses, and the
value that would perform a permanent deletion is not in the vocabulary at all.

A user roster, and one-account role changes. user-role-set refuses four things
outright rather than letting a preview promise them: an unregistered slug, the acting
user's own account, the last remaining administrator, and a multisite super admin.
Seeing the roster and changing it are separate capabilities, and neither operation
accepts the other's.

Elementor theme templates and their display conditions, and
elementor-composition-get — a page digest whose size does not grow with the page,
including a count of how many elements carry no stored identifier, which is exactly
how much of the page no write can address.

Fixed

• Rollback now works for redirects, comments and user roles. Reversing a change
  was built when every change belonged to a post, so those three writes handed back
  references that could not be redeemed. The offer was real; the redemption was not.
  Each write now takes its own changes back, and asks the same permission the original
  change asked.
• The Activity screen reads as a record. English summaries instead of raw redacted
  JSON, a duration on every operation, an outcome filter, and a rollback reference that
  can be copied whole rather than clipped to what fitted.
• Three reads ask for their own permission. audit-list, system-environment and
  image-size-list declared a capability and left the asking to the one request path
  that calls them. That path does ask, so nothing was exposed — but a handler reachable
  only one way is a guarantee about today rather than a guarantee. audit-list now
  checks before it looks at its storage, so a caller who may not read the change log no
  longer learns whether the log exists.
• Secondary console text meets AA contrast, and the Connect screen's by-hand
  bridge check now runs on Windows — it was written in one shell dialect only, and in
  PowerShell that spelling is a parse error rather than a command that fails.

Compatibility

WordPress 6.6+, PHP 8.1+. No breaking changes to any operation's input or output
schema. Records written before this release carry no duration and show a dash.

Full detail in CHANGELOG.md.