# Releasing the FORTVISION plugin

Run the smoke suite BEFORE tagging every release. It boots a throwaway
WordPress (WP Playground — no Docker/MySQL) with `trunk` mounted as the plugin
and checks the things static tools miss.

```bash
bash release-check.sh
```

It must print `RESULT: N pass, 0 fail`. It verifies:

1. **`php -l`** on every `.php` file changed since the last `X.Y.Z` tag.
2. **Activation** — the plugin activates with no fatal / unexpected output.
3. **Sync collectors** — every `collect_*` query in `base/dbsync.php` executes
   with no `$wpdb->last_error` (catches broken `$wpdb->prepare()` rewrites).
4. **Log-endpoint auth matrix** — the debug-log REST routes are denied to
   anonymous callers, allowed to an admin, and allowed with the site's
   FORTVISION events key.

Why this exists: 4.6.24 shipped a `\WP_REST_Request` namespace bug that both
`php -l` and Plugin Check passed — only running the endpoints caught it. This
suite reproduces that class of failure. (Verified: injecting that exact bug
turns steps 5 red.)

## Full release steps

1. Make your code changes in `trunk/`.
2. Bump `Version:` in `trunk/index.php` and `Stable tag:` in `trunk/readme.txt`,
   add a `== Changelog ==` entry.
3. `bash release-check.sh` → must be all-pass.
4. Optional deeper scan: run Plugin Check (see the WP.org email / the sandbox).
5. `svn commit trunk -m "X.Y.Z: ..."`
6. `svn copy trunk tags/X.Y.Z && svn commit tags/X.Y.Z -m "Tag X.Y.Z"`
7. Confirm: `curl -s https://api.wordpress.org/plugins/info/1.0/fortvision-platform.json`
   shows the new `version` and `tested`.