v6.40.0

Added

• Audience calendars and environments list their shortcode (#1814). A Shortcode column with the forms list's copy button; an environment's is tied to its calendar. The copy script is ffc-copy-shortcode.js, and ffc-form-list-copy-shortcode remains a deprecated handle alias until 6.41.0.
• A card-corner setting in Public Design (#1827). Settings → Public Design → Card corners drives --ffc-radius-lg, the corner of the form and verification card, the user dashboard and its cards, so a design at 0 squares the cards as well as the fields. It applies in both themes.
• Public Design sets the information notices' colour (#1842). It draws their bar and text in the light theme; their background is derived from it, and a colour below 4.5:1 on it is saved with a warning.
• A wipe-and-seed script for the testes site (#1855). .github/scripts/testes-seed.php empties the plugin's tables, posts and demo users, then writes 20+ fictitious records per module through the plugin's own code. It refuses to run without --yes-wipe and a --site equal to home_url().
• The plugin says what it is as a project (#1857). Settings → Documentation opens with the license and a free-forever promise and ends with "About this project": free software under the AGPLv3, made by public servants in Brazil. README.md and both readmes say the same.
• Booking outside a calendar's rules needs a confirmation (#1859). One warning lists every broken rule; "I agree" unlocks after 15 seconds, nothing is saved without it, and the booking is logged. Personal calendars too. Audience calendars gain an Admin bypass toggle and ffc_bypass_audiences.
• "Override Conflicts" works (#1859). Its holder may book over an occupied slot after the warning; the earlier booking is cancelled and its owner gets a new, editable email, "Your booking was cancelled by an administrator".

Changed

• The form editor acts at once (#1755). A tab's dot turns amber while a feature it switched on is incomplete; operator access autosaves and its first enable generates the hash; Regenerate hash and Reset counter are buttons; the CPF mode is a steps scale defaulting to audit; the quiz, GPS and IP toggles autosave.
• A form field is titled by its type, and the type no longer changes (#1756). The builder row says "Email" or "Checkbox" instead of "Field"; the type is picked once from Add New Field, and the save keeps the stored type of a field it already has, so stored answers never change type.
• ⚠ Activating a reregistration campaign no longer mails the invitations (#1762). The daily reregistration run sends them, in batches of 50, to everyone not yet invited; the edit screen says when that run is, so a mistaken activation can be undone first. Send invitations still sends at once.
• Record edit screens save their switches at once (#1757). On an existing calendar, audience, campaign, notice, reason or Date Messages rule a toggle saves as it flips, through one ffc_update_record endpoint; a campaign's status still waits for Save. New calendars start public.
• Settings use the control that fits each choice (#1758, #1816). Steps for captcha mode, GPS fallback and cache expiry; toggles for the IP strategy and ALTCHA display, each captcha display toggle with its own description; SMTP locks to WP default while Total Mail Queue is active. New installs start on ALTCHA (on HTTPS) and a 15-minute cache.
• What a certificate requires is one table (#1759). Settings → Certificates → Required data replaces Required Certificate Tags and Required Form Fields: each row has a name, label, type and a switch each for the form and the certificate HTML. A one-shot migration builds it from both.
• The Scheduling menu has seven rows (#1761). The Self / Audience separators, their icons and the New Personal Calendar row leave; Environments becomes a view of Audience Calendars, whose environment count links to it. The old Environments URL redirects there with every query argument.
• Scheduling editors use vertical tabs and the shared admin frame (#1761, #1788). The personal calendar, audience calendar and audience editors are one box with tabs; lists, Appointments and Import & Export use the shared cards. No field or action changed. .ffc-form-tabs is .ffc-vtabs; FFC.FormEditorTabs stays a deprecated alias until 6.41.0.
• Add New on Environments chooses the calendar in view (#1796, #1801). From a calendar's Environments tab or from the list filtered to one calendar, the new environment's form opens with that calendar selected; an unknown id is ignored and an existing environment keeps its saved calendar.
• "Admin bypass" reads naturally in Portuguese (#1789). Every administrator and manager bypass label now says "Exceção para administradores" (or "gestores") instead of "Burlar do administrador"; the two legacy Scheduling redirects share one query-forwarding helper.
• The user dashboard follows the plugin's design (#1826, #1827). It takes the Public Design font, the palette and the Core\Icons registry; it has one text field style, one button family (.button, secondary, primary or danger outline) and one status badge (.ffc-pill).
• Settings → Documentation and the readmes describe this batch (#1833). The topics and the three readmes now say that personal data starts masked for administrators too, name the PII administrator roles, and cover the Activity Log names, Add New on Environments and the dashboard's look. The screenshots of the form builder, the two lists and the user dashboard are refreshed.
• Inline CSS moved to the stylesheets and frozen (#1837). Settings tabs, Date Messages, the Scheduling colour picker and the dialogs the scripts build read classes and tokens instead of style="", so they follow dark mode; InlineStyleTest freezes what legitimately stays (e-mails, documents, operator colours, run-time values).
• Public form feedback is styled by the sheet and follows dark mode (#1840). .ffc-field-error named three things; the input state is now is-invalid / is-valid, the CPF/RF message .ffc-field-message, the reregistration error .ffc-rereg-field-error. The helper's error and success boxes read palette tokens.
• Log Out sits in the dashboard's tab bar (#1840). The user dashboard prints it at the end of the tab bar, outside the tablist, so it shows on every tab instead of only on Profile; on phones it is the last, full-width item under the stacked tabs.
• The certificate form's notices are one component (#1842). .ffc-notice in five tones with a Core\Icons icon, printed by Core\Notice and FFC.notice(); the quiz, schedule-exception and grading notices now sit above the title.
• Admin messages follow one rule per layer (#1843). Page notices go through Core\AdminNotice and FFC.Admin.notify(): a Core\Icons icon, and only success and info close. Callouts inside a screen are .ffc-notice; status lines and autosave badges are .ffc-status. The short-URL toast is gone.
• One standard for field errors, warnings, hints and required markers (#1844). Every plugin form shows a field's problem under it with an icon and appends it to aria-describedby (FFC.fieldMessage(), Core\FieldMessage). The public form's invalid state shows, audience booking drops alert(), one hidden * and one counter remain.
• The calendar, audience, dashboard and reregistration notices use .ffc-notice too (#1842). So do the CSV info alerts and the WebView banner, through Core\Notice / FFC.notice(); their old classes and CSS are gone.
• One danger-text utility (#1853). .ffc-text-error is gone; .ffc-text-danger lives in the utility sheet beside its success and info siblings and reads --ffc-danger-text, so the Cache tab's warnings match the metabox notes.
• Roles follow one naming pattern and four tiers per module (#1860). Labels read FFC <menu name> [- <part>] - <tier>; slugs are unchanged. Audience Calendars gains an Administrator, Short URLs, Date Messages and FFC Settings four roles each; ffc_test_date_messages and ffc_test_settings_smtp are new.
• ⚠ Some roles lose capabilities on upgrade (#1860). Personal Calendars Bookings Operator and Manager lose the bypass; FFC Read-only loses the activity log, which with identity resolution becomes FFC Administrator's alone. A one-shot step updates the stored roles and names.

Fixed

• Each role reaches the screens it can open and only the actions it can use (#1769, #1776, #1781, #1782). Scheduling, read-only, forms and recruitment allow-lists named pages that do not exist or missed ones the role holds; row actions follow their handler's capability, and a test checks every entry against the registrations.
• Audience screens render read-only for view-only users (#1777, #1779). Without ffc_manage_audiences the edit forms lock their fields and drop Save, and user access, holidays and members drop add and remove; every read-only fieldset uses .ffc-readonly-lock.
• Personal calendars admin gaps (#1770). Duplicate copies the custom blocks; the Appointments list sorts by every sortable column and labels, filters and cancels waitlisted rows; the dead Preview Calendar link and the export's unread date filters are gone.
• Audience admin screens keep their notices, hours, labels and counts (#1771, #1787, #1795). Notices stay on their own screen, a closed day keeps its hours, labels match the menu ("Audience Calendars", "Custom Users"), Download Sample works again, and member counts skip users that no longer exist.
• Front-end text keeps the plugin's size (#1827, #1828). The form info blocks, the dashboard's notification toggles and the booking confirmation notices no longer take the theme's paragraph size, and audience tags fit their name.
• The test suite no longer depends on test order or dead setup (#1793, #1798, #1803, #1806, #1809, #1811). One writer for the upgrade.php stub, no redefined bootstrap constants or /tmp fixtures, settings tabs tested through their own render(), each held by a new guard.
• The comment-language guard reads stylesheets (#1827). CommentLanguageTest recounts assets/css/ by a second traversal and knows the sheets' words; the Portuguese comments it found are now English, and so are the reregistration form's fallback strings.
• The audience event list is styled, and public text no longer takes the theme's size (#1832). The event-list panel sits under the plugin root. .ffc-shortcode names the base step and the tags under it inherit it at one class of weight; dialogs, notices and inner tags name their own steps.
• [ffc_recruitment_my_calls] and the logged-out dashboard notice load their stylesheets (#1832). Both rendered with no plugin sheet; wrapping text in dialogs, notices, descriptions and the acknowledgment carries its own line height.
• The dashboard's calendar tabs page each section on its own (#1836). Personal and Group Calendar page Upcoming by 5, Past by 3 and Cancelled by 2, with a count per heading and aligned columns; Certificates keeps its pager. The filter bar is compact, and pt_BR reads "Cancelados".
• The Reregistrations tab spaces its groups again (#1837). Completed sat flush against the Active table because the heading margin lost to the tab's own reset; each group is now a section, spaced like the calendar tabs.
• A clicked dashboard tab no longer shows a focus box (#1840). The tabs draw their ring on keyboard focus only (:focus-visible, the 2px primary ring), so a theme's button:focus outline no longer boxes the active tab after a click.
• The dashboard's tab bar wraps instead of overflowing (#1840). Between the phone layout and a width that fits every tab, the tabs flow onto a second row and Log Out stays at the right end of the last row; at 769–900px the page no longer scrolls sideways.
• The rate-limit notice shows on the form that was refused (#1846). It looked for .ffc-form, which no public form has, so the certificate form never showed it; it now sits above the refused form, counts down, and gives the button its own label back.
• Admin messages that were lost or unsafe (#1843). User Access shows its save message; the reregistration details dialog writes a server error as text; Activity Log's empty state stays in its table; the Danger Zone wears one bar; .ffc-warning-text is .ffc-text-danger, and .ffc-text-info reads the info tone.
• Two required controls now carry required (#1850). A required reregistration checkbox, such as the consent, is flagged under its group when unticked and blocks the submit; the QR short title is required while its row shows.
• Audience calendars enforce their rules (#1859). In the "All" view a day closes only when no space opens, and the form lists only open spaces. The server checks holidays, closed days, start and end hours, the site-time advance window and inactive calendars; all day means the opening window.
• ⚠ ffc_bypass_appointments no longer bypasses audience calendars (#1859). Their bypass is the new ffc_bypass_audiences, held by FFC Administrator and manage_options; a personal-calendar operator now books shared spaces under their rules.

Security

• Personal data is masked for every viewer behind an audited Reveal (#1760, #1813, #1820, #1822, #1824). The appointment detail (CPF, RF, email), the submission and appointment list email columns, the submission edit IP and linked user, and the audience Members and User access tables no longer print the clear value; each reveal is logged under its own Activity Log label.
• Reregistration PII has its own capability and admin role (#1815). View Details and Reveal need the new ffc_view_reregistration_pii, auto-granted to current managers; the new ffc_reregistration_admin role holds it. The audience screens, which have no PII capability, reveal on ffc_view_appointments_pii.
• The REST submit and booking routes now require an authenticated caller with a capability (#1861). POST /forms/{id}/submit needs the new ffc_submit_forms_api (auto-granted to ffc_view_forms_api holders) and runs the public form's own checks; POST /calendars/{id}/appointments needs ffc_manage_appointments and sanitises custom_data. The public forms keep their AJAX path.
• Rate limits persist without an object cache, and every write path records its attempts (#1861). The audience conflict probe needs a login and reports only readable schedules; private calendars hide their slots and months; /verify drops the fields the verification page hides; the form password compares in constant time; pre-flight telemetry is throttled per visitor.
• ⚠ Nobody on staff sees personal data without an audited Reveal (#1863). The unmasked tier is gone: administrators and module administrator roles reveal like Managers; lists reveal a page in one logged action; REST, view-as, Date Messages and the user-edit screen are masked.
• ⚠ Exports and staff e-mails carry PII only for the module's PII cap (#1863). Without it a CSV gets the same columns masked; a clear export is logged. Staff notices and the Date Messages summary are masked, with a link. Audiences get ffc_view_audiences_pii.