- F-15: uninstall now removes ALL espinstanda_* options and transients (incl. the
encrypted password and its self-provisioned key).
- F-16: register the "Gravity Forms required" admin notice unconditionally so it is
reachable when GF is inactive (gform_loaded never fires then).
- F-22: self-heal the daily retention cron on admin_init (matches the schema self-heal).
- F-19: re-validate the stored payload via Field_Mapper::validate_payload() before a
resubmit (DB-tamper trust boundary).
- F-20: increment the retry count on resubmit and dispatch the previously-dead
espinstanda_resubmit_success notification event.
- F-23: emit the theme's Form-5 date-range JS only on pages that embed a Gravity Form
and disconnect the MutationObserver (was observing the DOM subtree forever).
- F-24: bump plugin to 1.1.0; add readme.txt changelog documenting the audit fixes and
the required ops actions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- F-06: throttle the public create per IP (20/h) and per email (5/h) before the
paid API call and the PII write.
- F-11: wrap the create path in try/catch - on an unexpected error fail closed for
that submission (no quote-less entry), alert admins, keep the form working.
- F-14: abort the StartQuote when the write-ahead insert fails (no unaudited call);
fire the failure alert even when storage is disabled (build an in-memory tx).
- F-10/F-17: treat a 2xx with a missing/empty quoteRef as ambiguous
(possible_duplicate=1), not a hard failure - a quote may exist.
- F-07: write created_at/delivered_at/event timestamps in UTC to match the gmdate()
retention/dedupe cutoffs; display in site-local via get_date_from_gmt.
- F-09: log (no silent return) when async record_feed_result cannot resolve a
delivered transaction.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- F-01: derive the dedupe key from submission content (form id + mapped values)
instead of a per-request token, so identical re-POSTs / retry-after-error
collapse to the existing quote. Keeps the per-request lock; adds a content lock
race guard and a 30-min recent_delivered_by_dedupe short-circuit.
- F-12: refuse resubmit of an already-delivered transaction (AJAX + worker).
- F-18: scope the resubmit self-recovery guard to the content dedupe key so a
customer's different event is no longer skipped.
- F-05: anonymize PII on stale failed/pending rows via the cron; add delete_by_email
and wire WP's Erase Personal Data eraser.
- F-13: exempt stranded delivered rows (no entry_id) from the retention purge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
zbatteandClaude Fable 5