v0.6.0 — WordPress.org-ready release

First release validated against the official wordpress.org submission gate: PHP_CodeSniffer with WordPress-Core and WordPress-Extra (0 errors / 0 warnings) and the wordpress.org Plugin Check Plugin (Success — no errors). The wp.org-bound ZIP attached to this release (bible-by-midvash-0.6.0-wporg.zip) is the one we will submit to https://wordpress.org/plugins/.

Added

• uninstall.php. Cleans bbm_options and every bbm_* transient on plugin deletion (multisite-aware via switch_to_blog()). Uses $wpdb->esc_like() + $wpdb->prepare() for the LIKE pattern so the _ characters in the transient prefix stay literal.
• Two-target build. scripts/build-zip.ts --target=wp-org produces a ZIP with vendor/plugin-update-checker excluded and the auto-update block stripped from the entry-point (the wordpress.org Plugin Review Guidelines forbid plugins from bundling their own update mechanism when hosted on the official directory). The default build keeps the updater for installs distributed via wordpress.midvash.com.
• CI version-coherence gate. The release workflow now fails fast if the header Version:, the BBM_VERSION constant, the readme.txt Stable tag and the matching changelog entry don't all agree.
• Per-IP AJAX rate limit on bbm_get_verse (120 requests / 60s, bucketed by salted-hash of the IP — raw IP never persisted).
• manage_options capability check on the admin-only bbm_get_versions AJAX endpoint.

Fixed

• Security. Every $_POST / $_GET access now flows through wp_unslash() + sanitize_*(). The admin tab is validated against a whitelist. wp_remote_get() calls now set reject_unsafe_urls=true (SSRF defence) and limit_response_size=256KB. The widget's verse rendering output is documented as pre-escaped (phpcs:ignore with a comment explaining wp_kses_post() would strip the Schema.org microdata).
• Performance. BBM_Books::get_matching_pattern() and get_lookup_table() now memoize per-locale in a static cache (was rebuilding a ~1.2k-element regex on every the_content filter call — material gain on archives and themes that render multiple post bodies). Verse reads now go object cache → transient → API. Retry budget on the synchronous tooltip path cut from 3× / 4s to 2× / 1s.
• WP 6.7+ notice. Removed the explicit load_plugin_textdomain() call — WP 4.6+ auto-loads .mo files by slug match, and Plugin Check flags the explicit call as discouraged.

Changed

• Reference parsing centralised in BBM_Books::parse_reference(). BBM_Parser, BBM_API and BBM_Block now share one regex / one accent-tolerance pass / one chapter-range validation.
• Tooltip i18n now flows through __() against the bundled .mo files instead of a hardcoded 9-locale dict in PHP. New locales come for free as .po files are added.
• Inline admin JS extracted to assets/js/bbm-admin.js, properly enqueued with wp_localize_script() (was a 90-line inline <script> in the settings page).
• mb_strtolower fallback via BBM_Books::lower() for shared hosts without the mbstring extension.
• Deactivation no longer wipes the cache — was punishing users who deactivate to debug a theme conflict. Cleanup happens in uninstall.php instead.

Removed

• Dead BBM_API::get_books() and BBM_API::clear_cache() methods (zero callers in any version).

Catalogue

The Bible-versions list in readme.txt was 11 versions stale. Now mirrors the live API: 53 versions across 9 locales. Newly disclosed:

• Portuguese (Brazil): BPM, ONBV, NVA, BLPT, TFT
• Spanish: RVR1909, RVG
• French: CRAMPON, FRASBL
• German: MEN, LUTH1545

i18n

86 / 86 strings translated in all 9 locales (pt_BR, en_US, es_ES, fr_FR, de_DE, it_IT, ru_RU, ko_KR, zh_CN). 0 fuzzy, 0 untranslated.

Distribution

This release ships two ZIPs:

• bible-by-midvash-0.6.0.zip — full build with the auto-updater bundled, for installs distributed via wordpress.midvash.com.
• bible-by-midvash-0.6.0-wporg.zip — auto-updater stripped, for submission to the wordpress.org plugin directory.

Plugin Check validation log and PHPCS reports both clean on the wp.org build.