5.3.14

Page design, end to end — and a browser way in.

Elementor

Twelve abilities now, not two. Build a whole page rather than nudge one setting:
elementor-write (append, prepend, after, before, replace-element, replace-page,
delete), elementor-move, and a catalogue read from the widgets this site
actually has — so a layout is composed from real widget names and real setting
names, and a dry run says which keys it did not recognise before anything is
written.

Beyond one page: elementor-settings-read/write reaches a page's own settings
(layout template, background, page-level CSS) and the site kit, which is where
global colours and fonts live. elementor-templates and
elementor-template-write create headers, footers and popups and place them
with the conditions that decide where they apply.

Two fixes worth naming. Writing a layout to a page that had never been opened in
the editor stored it and rendered nothing — Elementor only renders for a post
whose meta says the builder built it. And a container's own spacing was missing
from the catalogue, because "declared under the Advanced tab" was being read as
"already listed elsewhere", which is true for a widget and not for a container.

Gutenberg

A block has no id, so it is addressed by where it sits: 2.1 is the third
block's second child. block-read reports that path for every block;
block-find locates blocks by type, attribute or text; block-update changes
one block's attributes; block-move takes a block before, after or inside
another; and block-write gained the same targeted modes as Elementor.

Signing in from a browser

authorization_code with PKCE, alongside the existing code-in-wp-admin flow.
With it, the two discovery documents a connector looks for and a
WWW-Authenticate header on the MCP endpoint's 401 — without which a refusal
tells a client no and does not tell it where to ask.

S256 only. Redirect addresses are fixed at registration and matched exactly, and
an unregistered one is refused where it is found rather than reported by
redirecting to it.

MCP

The server offered ten tools from a list written by hand a long time ago. Every
ability added since was reachable over the CLI and invisible to any MCP client.
It now offers what is registered — fifty-eight.

Setting up

Activating opens one screen: switch abilities on, and copy the endpoint. That
address is what every client needs and was written nowhere anyone would look.

Also

Connections shows one row per connection rather than one per token, and revoking
a row ends that approval alone. "Check Again" reaches this plugin's update
check, which had been serving a cached answer for up to twelve hours.
Documentation under docs/. The changelog in readme.txt had stopped at 5.3.7
while the plugin said 5.3.13, so six releases were showing as though they never
happened.