v1.37.0 — wp.org review blockers

Fixed — three things that would have failed a wordpress.org review

• The self-hosted updater is out of the package. wordpress.org forbids a plugin that updates
  itself from outside the directory, and Plugin Check enforces it statically — the old
  file_exists( vendor/… ) guard was functionally correct (the built package has no vendor/, so
  it never ran) but the scanner flags the reference whether or not it can execute. The wiring moved
  to updater.php, which .distignore excludes, and neither the library path nor PucFactory
  appears anywhere in the built ZIP. GitHub and self-hosted installs still auto-update, because
  that file is present there. Verified: a .distignore build is 728 KB / 105 files with zero
  updater references.
• Requires at least was a false promise. Every block declares apiVersion: 3, which needs
  WordPress 6.3; the header and readme both claimed 6.0. Users on 6.0–6.2 would have installed
  it and found broken blocks.
• Tested up to 7.0 → 7.1, and the header description trimmed from 157 to 133 characters
  (Plugin Check caps it at 140).

Note for anyone editing updater.php: it is required, so __FILE__ there is updater.php, not
the plugin's main file. PUC keys updates off the main file's basename, so the caller passes it in
explicitly — getting that wrong silently breaks updates for every self-hosted install.

All notable changes to the Zehoro Toolkit will be documented in this file.

Free 1.36.2 — the 5 launch blocks + lean-Free reorg + wp.org hardening

Free now ships exactly the wordpress.org funnel: the 5 launch blocks (Key Takeaways, Pros & Cons, FAQ, Author Box, "We Tested") plus Table of Contents, Article schema and Visual Styles.

Requires Zehoro Toolkit Pro 1.220.0+ if you run Pro. Thirteen modules (Callout, Stat Callout, Steps, Testimonial, Inline Product, Content Box, CTA Swap, Disclaimer, Last Updated, Category Pills, Home Filter Pills, RSS CPT Support, Archive Title Cleanup) moved to Pro. Block names, shortcodes, option keys and stored content are unchanged — install Pro 1.220.x FIRST so those modules keep rendering.

Security: closes a stored DOM-XSS in the Table of Contents scroll-spy (the active-section label is now built with textContent/createElement, never innerHTML). Also: the noscript module-save redirect fires correctly, add_submenu_page() no longer emits a PHP 8.1 deprecation, front-end TOC strings are translatable, and the rename-migrator log is WP_DEBUG-gated.

Suite: 287 green.

Free 1.28.0 — Modules page: Core/Surface re-cut + bucket-scoped pill counts

Changed — Modules page re-cut along Core vs Surface. The flat four-bucket nav now groups under two tiers matching the product's architecture: Core · the content-business engine (holding The Loop, the CMS-agnostic engine) over Surface · WordPress rendering (Blocks / Conversion / Utilities, the per-connector toolbox). New Plugin::bucket_tier() + TIER_CORE/TIER_SURFACE; the Toolkit bucket label is now Utilities (internal key unchanged). IA only — no modules move on the Free side.

Fixed — status-pill counts ignored the active bucket. The top All/Active/Inactive/Free/Pro pills counted every card and only refreshed Active/Inactive, and never re-ran on a bucket switch — selecting The Loop still read All (34) while the bucket held 14. Every pill is now scoped to the selected bucket + search and recomputes on each filter change.

v1.27.3

RENAME-DRIFT-1: ArticleSchema reads the canonical zehoro_author_* key (with legacy fallback) so the author sameAs isn't dropped from JSON-LD after the brand-rename migration.

Free 1.27.2 — security: stored-XSS hardening in JSON-LD schema

Dev-Team audit fix (Batch A). Steps HowTo taskName is now sanitized + slash-escaped so a </script> can't break out of the JSON-LD block (16-vector adversarial probe clean); ArticleSchema drops JSON_UNESCAPED_SLASHES for defense-in-depth parity. Free suite 182 green.

Free 1.27.1 — Modules page: 4 buckets (The Loop front door) + bulk suite-card fix

Bundles 1.27.0 → 1.27.1 (2026-07-06, through the Zorasi Dev Team gate).

• 1.27.0 — Modules page grouped into 4 buckets one level above the fine groups: The Loop (the daily-driver front door) leads, with Blocks / Conversion / Toolkit under "Set up once." edit_log moves into The Loop; the nav pills move to Toolkit; bucket-scoped bulk enable/disable.
• 1.27.1 — (refuter fix) bucket bulk enable/disable now syncs folded suite cards (Blocks / Schema / Reading & Trust) + pill counts, instead of leaving them stale until reload.

Free suite 180 green.

v1.26.0 — audit remediations (FAQ force · pills CSS · updater token)

Verified audit remediations (175 tests green):

• FAQ 'Always Output Schema' override — 'force' now emits before the SEO-plugin coexistence gate instead of being silently suppressed.
• Pills CSS on archives/home — CategoryPills + HomeFilterPills force the shared stylesheet via zehoro/load_global_styles on the non-singular views they render on (mirrors TableOfContents); fixes unstyled pills.
• Updater token — Free no longer forwards Pro's encrypted (v1:/b64:) GitHub token to GitHub (was 401-ing + breaking update checks); auth deferred to plugins_loaded + ciphertext-skip. Plaintext ZEHORO_GITHUB_TOKEN still authenticates.

Free 1.25.6 — prune orphaned .zui dead CSS

Syncs the shared .zui stylesheet with Pro 1.174.3: removed the never-built .zui-momentum / .zui-pill / .zui-bars / .zui-dots components (CSS-only mockup leftovers, 0 references in either plugin). −1.66 KB, no functional change. Not deployed.

Free 1.25.5 — shared .zui CSS: a11y contrast + responsive + tidy

Syncs the shared .zui admin design system with Pro 1.174.1's UX pass (the stylesheet is shared verbatim):

• a11y: two tokens darkened to pass WCAG-AA contrast — --zui-muted-2 (.zui-help text now 4.61:1) and --zui-gold (header/label text ≥4.65:1).
• responsive: shell stacks at ≤1080px (before the WP menu squeezes the column); .zui-scroll-x utility added.
• chore: pruned the dead in-page nav-rail CSS (−1.3 KB). No functional change. Not deployed.

Free 1.25.3 — migrator autoloads the hot options (selective)

Fixed — the rename migrator left zehoro_active_modules un-autoloaded

On sites upgraded from the old lkst_* plugin, the migrator copied every renamed option with autoload=false — including zehoro_active_modules, read on every request → an individual SELECT per pageview instead of WordPress's single cached autoload query. Now autoloads only the genuinely-hot keys (active_modules + the 5 CSS-variable colours, read on every content page); the ~26 module-conditional settings stay autoload=false. Fresh installs were already fine. External-audit (Gemini) finding — applied selectively, not the proposed blanket autoload=true. +1 test (175 green).