v0.1.3 Error pressure floor, fresh tick reads, site-language alerts

[0.1.3] - 2026-09-04

Fixed

• The "error pressure alone" rule no longer turns a quiet minute into a storm. It now needs the same minimum of distinct addresses as the score (the "Minimum distinct addresses" setting). With a page cache in front, PHP mostly sees cache misses, and three slow requests from two addresses were enough to re-trigger a storm every fifteen minutes and email each time.
• The tick no longer repeats a minute it has already processed. A slow front-end request loads the options at its start; when the cron tick ran meanwhile, the inline guard at that request's shutdown saw a stale cursor and a stale state, recomputed the same minute and sent the transition alert again (two to five copies of each). The tick now drops the runtime options cache after taking its lock and re-reads the cursor, the state, and the stored rows.
• Alerts are formatted in the site language. When the inline guard ran the tick inside a translated front-end page, the date and the decimals followed that page's locale.

v0.1.2 Client IP resolution shared with WC Antifraud

Changed

• Client IP resolution is now the same code as WC Antifraud 1.7.0's WCAF_Client_IP (prefix renamed), so both plugins agree on who the client is. Gains: port suffixes normalized, carrier-grade NAT peers treated as local proxies, Cloudflare peer without CF-Connecting-IP falls back to the forwarded-header walk, "Not a proxy" dismissal next to "Trust this proxy".
• Daily list refresh hook renamed to bsr_refresh_cloudflare_ips; an upgrade routine migrates 0.1.1 installs on the first request.

v0.1.1 Beacon through index.php, no CLI tick on APCu

Fixed

• The beacon URL goes through index.php explicitly, so a root redirect (language plugin, static front page) cannot swallow it before the plugin answers. Filter bsr_beacon_url_base.
• On the APCu backend the minute tick refuses to run from the command line, where it cannot see the counters PHP-FPM wrote; the inline guard on the next front-end request does the work instead.

v0.1.0 Radar only

0.1.0

Radar only. Detects and reports; nothing is blocked, challenged, or rate-limited. The purpose of this release is to calibrate the swarm metrics against real traffic.

Added

• Request classifier (html, search, rest, xmlrpc, login, register, comment, admin-ajax, wc-ajax, checkout, cart, asset, 404) with a WooCommerce module.
• Counter store: persistent object cache, APCu, or a transient fallback (warned about on the Radar).
• Swarm metrics per minute: single-hit ratio, asset ratio, user-agent evenness, error pressure, endpoint concentration, storm score gated by volume against the baseline.
• Beacon (204, no-store) emitted on every page, so page caches do not hide browsers.
• Learned baseline over the first seven days.
• Good-bot verification (Googlebot, Bingbot, Applebot, Yandex by reverse DNS plus forward confirmation; DuckDuckBot by its address list).
• Storm states calm, warning, storm, cooling with logged, explained transitions and email alerts.
• Trusted-proxy client IP resolution (Cloudflare, local proxies, declared proxies).
• Radar and Settings screens, dashboard widget, GitHub updater.

See CHANGELOG.md for details.