0.4.8: Scoped splash-header CSS fix. Source reviewed; live Astra rendering remains to be checked on the installed site. No PHP logic or stored page content changes.

0.4.7 — isolated WordPress 6.8 / PHP 8.3 checks passed: error table setup, deduplication, error display, resolve/reopen and notes, resolved filtering, diagnostic redaction, failed service-email capture, historical failure import, anonymous read/mutation restrictions. No email was sent. Fatal PHP shutdown capture and live mail transport were not induced/tested. No visual browser verification.

0.4.6: WordPress 6.8/PHP 8.3 isolated checks passed for HTML mail headers, escaping, membership action button, embedded-image MIME construction, offline document logo, full-width CSS, exact preserved agreement wording and unchanged signed record/seal. Real email transport was intercepted; no emails sent. Visual browser/email-client rendering is not verified.

0.4.5: Tested in isolated WordPress 6.8 / PHP 8.3 Playground.
Passed: plugin activation, privacy acknowledgement required/server validated, invalid and outdated tokens rejected, original privacy snapshot preserved after policy change, new-tab registration link, audit filters/display and snapshot view, WordPress personal-data export inclusion, CSV formula neutralisation, certificate failure logging, anonymous log access blocked.
Tests did not send real emails. Live SMTP delivery and the installed CertWright version remain to be checked on the user's site. No visual browser verification was performed for this release.

0.4.4 menu update checks
WordPress 6.8 / PHP 8.3 Playground: plugin activation and blueprint assertions completed. Checked nested WordPress menu output, automatic splash header, no duplicate injection, and unchanged ordinary page content. JavaScript syntax check passed. Visual browser and interactive dropdown testing remain to be checked on the installed site.

0.4.3 VALIDATION — isolated WordPress 6.8 / PHP 8.3
Fluent Forms Free 6.2.15 and supplied CertWright integration.

Passed the earlier membership/certificate regression checks plus:
- Registration full-name source and exact [name]/[full name] personalisation.
- Organisation name placeholder is not replaced with a member name.
- Signing before reading or passing the questions is rejected server-side.
- Questions cannot be passed before the reading confirmation.
- Incorrect answers keep the form locked; five correct answers unlock it.
- Maximum five questions enforced; six questions rejected.
- Name change, agreement version change, expired pass and altered evidence
  invalidate the understanding check.
- Signature-name substitution is rejected.
- Browser flow: read confirmation -> wrong answers and feedback -> all correct
  -> read-only prefilled name -> real Fluent Forms AJAX submission.
- Signed copy includes personalised text and comprehension evidence.
- A later name correction does not modify a historical signed snapshot.
- Organisational acceptance still works and gates certificate generation.
- Real Fluent Forms replay after a name change is rejected with HTTP 422.
- Signed-copy owner access, other-member denial and anonymous denial.
- Mobile and desktop layouts inspected; no horizontal overflow.
- The cleaned Word document rendered and all six pages visually inspected.

No real email was sent; every test mail call was intercepted.
The exact local Astra/MySQL/SMTP/cron installation still needs its acceptance
check. Automated checks prove the configured gate works, not that a person
read every word or that a signature establishes legal identity.

0.4.0 VALIDATION — isolated WordPress 6.8 / PHP 8.3
Fluent Forms Free 6.2.15 and the supplied CertWright 1.0.0 source.

Passed:
- New agreement tables, draft-publication guard and generated Fluent Forms form.
- Signing nonce, required acknowledgements and repeat-submission handling.
- Pending membership cannot issue a certificate or access private records.
- Acceptance activates membership; repeated admission decisions are rejected.
- Real CertWright PDF creation and queued three-letter/sequence certificate.
- Member records restricted to own region and national scope.
- Financial record author cannot approve their own record; another admin can.
- Coordinator access requires active membership and, when enabled, qualification.
- National messaging restricted to administrators, with active/opt-in recipients.
- Suspension blocks a queued activity email and a queued CertWright delivery.
- Restored accepted membership passes the certificate delivery check.
- Eligibility REST: self succeeds, other-member and anonymous requests fail.
- Real browser signing submission using Fluent Forms AJAX.
- Pending dashboard and authenticated signed-agreement copy.
- 390px and 1440px Join layouts have no horizontal overflow.

All email calls were intercepted. No live email was sent.
This is portable WordPress with SQLite, not your installed Astra/MySQL stack.
Test the actual site's SMTP, cron, theme, cache and CertWright release locally.
No claim of external voting-app integration or training-course testing is made.

Historical validation from earlier releases follows:

FIRST RELEASE VERIFICATION — 12 October 2026

Executed in an isolated WordPress 6.8 / PHP 8.3 Playground installation:
- Plugin activation and automatic page creation.
- Coordinator application approval by an administrator.
- Private directory excludes other regions and non-consenting members.
- Withdrawing contact consent removes the member from coordinator views.
- Changing region revokes coordinator access.
- Local activity submission, administrator publication and regional visibility.
- National activity publication and visibility in multiple regional groups.
- New account email generation (captured locally, not delivered externally).
- Password setup through WordPress and subsequent login.
- Selected region retained through account setup and membership completion.

Separate browser check using the complete existing home-page code:
- Map selection produces the correct region-specific join/group links.
- Reset clears the selected-region link.
- Integration JavaScript reports no browser errors.
- Home page has no horizontal overflow at 390px.

Still requires verification on your local Astra site:
- Your existing plugins, caching and theme combination.
- Real email delivery, sender configuration and password-reset links.
- Navigation menu placement and the appearance of the generated pages.

The test fixtures, test accounts, captured emails and test server are not
included in the plugin package.

0.2.0 ADDITIONAL VERIFICATION
WordPress 6.8 / PHP 8.3 with supplied CertWright 1.0.0, isolated test instance:
- Completed membership schedules and creates one real PDF certificate.
- Repeated issue request leaves one certificate and one email queue row.
- CertWright worker processes the queue with mail captured (no real email sent).
- Public groups require administrator activation and an approved coordinator.
- Revoking the coordinator removes the region; no member email in public JSON.
- Browser: image marker, alphabetical directory card, map popup, close control;
  no horizontal overflow at 390px, no browser script errors.
- Certificate PDF rendered and visually inspected.
- Full updated home page contains no removed agency text or links.
Local outgoing email, actual theme/caching and installed CertWright version
still require the site's acceptance check. No production delivery was tested.

0.2.1 BRANDING VERIFICATION
Isolated WordPress 6.8/PHP 8.3 with CertWright 1.0.0: logo attachment import
and site-logo assignment passed; repeated setup reused the same attachment.
Homepage logo loaded from plugin asset. Desktop/mobile headers and popup
visually inspected. Map and directory controls passed. New portrait and
landscape certificate PDFs inspected with the lion emblem.

0.3.0 REGIONAL EMAIL VERIFICATION
WordPress 6.8 / PHP 8.3 in an isolated instance, all emails intercepted:
- Regional contact groups and shared coordinator page displayed successfully.
- Cross-region recipients and members without contact consent rejected.
- Overlapping groups deduplicated into one recipient per email address.
- Drafts do not send; confirmation queues them; repeated send rejected.
- Consent withdrawal before delivery skips recipient.
- Revoked coordinator cannot deliver pending emails.
- Ordinary member cannot prepare an email campaign.
- Failed mail schedules retry; subsequent successful retry sends once.
- Privacy export includes delivery records and contact groups.
- Real browser form: preview, send confirmation and queued status passed.
- Preference-link GET leaves consent intact; confirmation POST opts out.
- Mobile width check and visual review passed.
- Certificates menu points to CertWright's canonical certificate route;
  separate integration settings and legacy redirect registration verified.
No real outbound email or live SMTP delivery was performed. Test your local
mail catcher and later your production SMTP before sending member messages.

0.3.1 PAGE AND NUMBER VERIFICATION
WordPress 6.8/PHP 8.3 with the supplied CertWright package:
- All 150 region keys have distinct three-letter prefixes.
- New Fairfax certificate issued as frx-00001; retry kept that number.
- Next Fairfax reservation frx-00002; Leichhardt independently lei-00001.
- Existing long-number certificate retained its identifier.
- Generated PDF visually checked with lowercase short number.
- Shared frontend template, six navigation links and logo loaded successfully.
- Desktop and mobile views visually checked; no horizontal overflow at 390px.
- HTTP request to /wp-admin/ppm-coordinate returned the expected 302 redirect
  to the approved coordinator's frontend area; admin destination also checked.

0.3.2 HEADER VERIFICATION
WordPress 6.8 / PHP 8.3 isolated installation: new shortcode homepage, original homepage blocks and membership page render one shared plugin header with identical navigation and selected Customizer image. Logo image loads; width <=150px at 1440px and 390px viewports. No horizontal overflow. Existing Customizer selection survives first-run branding. Complete homepage block nesting checked. No real emails sent. Live local Astra installation not accessible from this environment.

0.4.3 targeted checks: real WordPress admin login; agreement, regions and certificate settings HTTP 200; generated agreement menu URL; legacy admission URL redirect; anonymous admin access requires login.

0.4.3: Existing read/quiz/sign browser regression and membership/certificate gates tested. Targeted organisation and member substitution checks cover legacy aliases, invalid email, unknown fields, immutable published and signed text, missing location, changed location and personalised privacy. No real emails sent. Local Astra/MySQL/email delivery still need site acceptance testing.
