# Changelog — v9.0.0

## National public experience

- Rebuilt the homepage around ministry journeys rather than internal website sections.
- Added strategic pathways for Bible engagement, Find SU Near You, programmes, prayer, volunteering and partnership.
- Added a dedicated Bible & Discipleship hub emphasis for Daily Guide, Daily Power, Daily Milk and group resources.
- Added ministry impact, stories, safeguarding and partnership sections.
- Added a single app-like mobile bottom dock and removed competing mobile navigation.
- Added an announcement bar, improved national header/search experience and stronger footer pathways.
- Added modern responsive cards, page heroes, article layouts, forms, directory views and accessibility refinements.
- Added a proper `page.php` so ordinary pages no longer fall back to an archive/card-list presentation.
- Rebuilt search, 404, news index, Region/Area pages and key page templates.
- Added dedicated event, resource and giving detail templates.
- Replaced the outdated theme preview image with a v9 national digital ministry preview.

## Homepage Builder

- Corrected the inherited issue where Homepage Builder settings did not control the actual homepage output.
- Added strategic `bible` and `safeguarding` sections.
- Preserves existing administrator order/visibility and injects new sections non-destructively.

## Content freshness and public trust

- Upcoming Events now suppresses parseable past-dated events.
- Corrected statistics rendering so non-numeric values such as “Thousands” are not animated from a false zero.
- Added a Stories/News shortcode and strategic starter page.
- Added public-safe empty states instead of technical/admin language.
- Upgraded starter Privacy and Safeguarding pages to professional public commitments without fabricating formal policy details.

## Formation directory

- Corrected map/directory metadata to use the real Area fields.
- Rebuilt Region/State/Area search and directory UI.
- Preserved the supplied official starter directory and non-destructive updates.
- Added correct singular Area fallback URLs.

## URL architecture

- Removed custom-post archive/page slug collisions.
- Curated public landing pages retain `/events/`, `/resources/`, `/ministries/`, `/donate/`, etc.
- Individual records now use stable singular routes such as `/event/…`, `/resource/…`, `/ministry/…`, `/giving/…`, `/region/…` and `/area/…`.
- Rewrite rules refresh once during the v9 content migration.

## Governance and delegated administration

- Introduced custom post-type capabilities for Regions, Areas, Ministries, Events, Resources, Giving, Leaders, Media and Departments.
- Added `su_access_platform` and scoped dashboard capabilities.
- Regional and Area accounts are now restricted to their assigned formation content; unassigned scoped accounts see no formation content rather than national content.
- Corrected inherited Region/Area metadata mappings for delegated queries.
- Added Region, Area, programme and consent-reference fields to Media items.
- Removed inherited global Posts access from scoped roles where it could bypass formation controls.
- Made dashboard actions capability-aware.
- Added a Content & Digital Ministry Guide for authorised SU users.

## Events and registrations

- Added an explicit Event Registration Mode: details only, native website registration, or approved external registration link.
- Added a professional native event detail/registration journey so programmes do not require a separate portal for simple registrations.
- Consolidated native registrations into the canonical `su_event_registrations` table.
- Added a safe one-time migration path from the historical duplicate registration table when appropriate.
- Updated Event Analytics and Registrations administration to read the same canonical registration data.
- Native registration submissions use nonce validation, honeypot protection, sanitisation and minimum required fields.

## Safeguarding and privacy

- Added public safeguarding prominence on the homepage and footer.
- Added Media Consent Reference metadata for approved media governance.
- Added honeypot protection and safer sanitisation for public forms.
- Improved privacy-conscious administrative wording for registrations.
- Retained hashed-IP administrative activity logging.

## Security and operational health

- Corrected admin tools that were attached to a non-existent historical parent menu slug.
- Improved production Health Check and Launch Checklist.
- Corrected Area target validation so incomplete directories cannot incorrectly pass.
- Corrected PWA health status.
- Added capability-aware administration and role migration.
- Maintained security headers, XML-RPC default-off behaviour and REST nonce validation.

## PWA

- Upgraded service-worker cache from historical v6 to `sunigeria-v9.0.0`.
- Added old-cache cleanup and safer navigation/static-resource strategies.
- Excludes WordPress admin, login and REST API requests from service-worker interception.
- Corrected the primary-colour setting used by the manifest.
- Uses the configured site icon where available and supports a local fallback.
- Added application metadata for installable/mobile experiences.

## Application authentication and data import

- Hardened app authentication with rate-limited login attempts.
- Replaced globally scanned app tokens with user-addressable v9 bearer tokens stored as password hashes.
- Added 30-day token expiry, last-used tracking and explicit logout/revocation.
- Retained a bounded transitional path for historical pre-v9 tokens so existing clients can be migrated safely.
- Hardened CSV import with file-size/type checks, upload validation, required-header validation, row-length protection and sanitisation.

## REST/API

- Corrected Region filtering to use content-type-specific metadata.
- Added `upcoming=true` event filtering support.
- Improved item-not-found and failed-write responses.
- Kept structured directory endpoints for approved app/client use.

## Search and discoverability

- Added lightweight Organisation, Article and Event structured data.
- Added Open Graph and Twitter sharing metadata.
- Added contextual meta descriptions.
- Added Google Search Console and Bing Webmaster verification settings.
- Automatically defers metadata/schema output when a recognised SEO plugin is installed.
- Uses WordPress core XML sitemaps.

## Upgrade safety

- Existing non-empty page content is preserved by automatic migration.
- Genuine customised menus are preserved; only the untouched historical starter menu is reorganised automatically.
- Manual starter refresh is non-destructive to existing non-empty pages.
- Legacy “Research & Resource Development” starter ministry is migrated to “Training & Resource Development” where safe, preventing new duplicate starter records.