v6.19.0

Fixed

• Certificate preview resolves the {{logo_gov}} / {{logo_org}} branding tokens (#903): the client-side previews (form-editor live preview + public CSV-download preview) now substitute the two branding keys from CertificatePreviewSamples, which lacked them (logos showed as raw {{…}}); mirrors the URLs the real generators inject (the server-side template preview already resolved them via PdfHtmlRenderer).
• Internal — @since docblock audit against the published-release history (#905): corrected 166 tags across 104 files that cited never-published "phantom" patch numbers or vague X.Y.x placeholders to the release each symbol actually first shipped in, plus forward-dated tags mistakenly set to 6.20.0/6.19.0 (#865, #897). Docs only; no runtime change.

Added

• Client-IP resolution epic — trusted-proxy + Cloudflare auto-detection + diagnostics (#899): consolidated all client-IP resolution into one Core ClientIpResolver (#900) that owns the historical legacy header-walk and a new secure trusted-proxy strategy (Cloudflare CF-Connecting-IP at a CF edge, right→left X-Forwarded-For for configured proxies, else the direct TCP peer); added a read-only IP Diagnostics settings tab with trusted-proxy config (auto/cloudflare/custom/direct), daily Cloudflare-CIDR refresh (CloudflareCidrRefresh cron + bundled fallback) and a header-injection self-test (#901), plus a notice recommending secure+Cloudflare (#902). The effective default stays legacy — behaviour is unchanged; the flip to secure is deliberately deferred (gated on shadow-mode telemetry, #902). Opt-in via the ffc_ip_resolver_mode / ffc_trusted_proxies / ffc_ip_shadow_logging filters. Non-breaking; no new cross-module edge.

Changed

• Internal (#809) — quality & coverage batch: PHP line coverage raised to 90.38% (piso 84 → 86) — every remaining api/ REST controller and self-scheduling/ handler taken to ≥90%, the pcov-mis-attributed AbstractDismissibleNotice/EmailTemplateDefaults and UserDashboardActivator fixed (#910, #912, #913, #914); the tests/Integration/ layer grew from 1 to 3 wiring smokes (PluginActivationSmokeTest + ModuleWiringSmokeTest, #911); and the JS tail (ffc-email-model + the two ffc-csv-* stragglers) went to 100% (#916). Tests only; no runtime change.
• IP Diagnostics shadow_logging is an inline autosave toggle (#901, #907): the shadow-divergence-logging control became a .ffc-toggle that saves on flip (ffc_update_setting), kept as a named in-form field so autosave and the form Save never clobber each other (invariant also documented in CLAUDE.md).