TOC Genius Free and Pro 0.4.3 — release validation
Prepared 26 October 2026.

A matched release of the independently usable Free plugin and separate Pro
add-on. Pro requires Free 0.4.0 or later; use the matched 0.4.3 pair.

CHANGES

Current release labels replace development-stage wording in plugin readmes and
website copy. The website's native screenshot gallery is refreshed for both
exact 0.4.3 packages. The interactive demo remains a separate browser-local
simulation using sample content. Its descriptive labels now link to the current
native screenshots. Historical versioned archives and reports remain unchanged.

Plugin runtime code is unchanged from 0.4.2. This release retains opted-in,
batched cleanup of stored temporary drafts and orphan expiry rows, per-site
multisite choices, and Free settings retention during a Pro-only uninstall.

FREE SUBMISSION CHECKS

Official Plugin Check 2.1.0 ran with Pro physically absent on WordPress 7.1.3 /
PHP 8.5.4 and WordPress 6.5 / PHP 7.4.3. On each stack, the default 34 checks,
expanded static 29 checks and runtime 5 checks returned zero errors and zero
warnings. These sets overlap; they are not 68 independent security tests.

The public WordPress.org readme validator returned zero syntax errors and one
warning: contributor tocgenius could not be found on 26 October 2026. The owner
must register that intended account or provide the actual registered username
before submission. No account was created and no package was submitted here.
Passing automated checks is not WordPress.org approval or a guarantee of approval.

NATIVE VALIDATION

On WordPress 7.1.3 / PHP 8.5.4 and WordPress 6.5 / PHP 7.4.3:
- Each stack passed 433 paired native assertions across ten suites, plus
  23 HTML5 assertions.
- Each stack passed 232 physically Free-only native assertions across five
  suites, plus 23 HTML5 assertions.
- Each stack passed 24 additional Free uninstall-cleanup assertions, including
  opt-in retention, batched draft cleanup, unrelated-row preservation and actual
  WordPress cache-branch transitions. No Redis/Memcached server was certified.

On the current Free-only HTTP fixture, 33 security assertions passed. These
exercised administrator/editor/author/subscriber permissions, missing/invalid/
array nonces, malformed and bounded inputs, DOM safety of generated HTML,
REST metadata role restrictions and typed global settings.

All fourteen PHP files passed syntax checks on both runtimes; all six JavaScript
files parsed. The exact ZIPs were installed and activated using WordPress's
plugin installer in fresh browser fixtures. This does not claim an upgrade test.
Candidate, independent rebuild, release and website copies are byte-identical.

A fresh manual Free source review examined all seven PHP and four JavaScript
files, inventoried all twenty package files and checked the twenty-one targeted
PHPCS ignores in their surrounding data flows. It covered early validation and
sanitization, unslashing, contextual output escaping, capability and nonce checks,
REST metadata, AJAX, Classic/Gutenberg input, rendering, SQL, uninstall and
repository/privacy disclosures. No confirmed blocking source/security finding
was found. Exact article markup is parsed without execution for editor previews;
this does not require destructively sanitizing the entire article. Generated
TOC text and attributes are escaped, and the preview iframe is sandboxed.

Ten genuine native screenshots were captured from the installed 0.4.3 packages:
three Free captures with Pro absent and seven Pro captures. Each capture workflow
passed thirteen scoped checks. The website publishes all three Free captures
and four Pro captures: shared designs, rules, navigation and recovery history.
The PNGs are direct browser captures without retouching, compositing, injected
styles or replacement UI. Demo articles, designs and rules are fictional samples.
The website uses normal responsive image sizing and links to full-size originals.

These assertion counts overlap across editions and stacks; they are not unique
security guarantees. Initial fixture and capture-harness failures are preserved
in the internal evidence and were corrected before final checks. Their earlier
failures are not represented as passing runs. Current and minimum stack tests
do not claim a fresh multisite or all-browser qualification.

UPDATES AND DATA

Back up your database and plugin files, then test the update on staging. Verify
the supplied SHA-256 checksums and use WordPress Plugins > Add New > Upload
Plugin to replace Free first and then Pro. Free-only sites need only Free.
Do not uninstall as an update step: explicitly enabled cleanup removes plugin
data. Check representative articles, manual placement and per-article controls.
For Pro, also check a rule, shared design and adaptive navigation in your theme.

Configuration transfer/history exclude article bodies and per-article choices.
Deliberately saved heading anchors remain in article content after uninstall.
Cache-only drafts for deleted or former site members can remain until their
original 15-minute expiry. Draft validity does not promise instant erasure.

SUPPORTED SCOPE

Minimum WordPress 6.5 and PHP 7.4. Static Gutenberg Heading blocks and supported
Classic content are within scope; stored-content previews do not run arbitrary
dynamic blocks or shortcodes from other plugins. Test the final article in your
own theme, including mobile layout and pre-existing bookmarked anchors.

The checks do not certify every theme, builder, browser or device, or establish
universal accessibility, performance or security. No paid checkout, licensing,
subscription, updater, real-inbox or customer-message workflow was tested.

Both plugins run locally without accounts, telemetry, remote licence checks or
external assets. Readmes explain authenticated same-site APIs and stored data.
Local Pro functionality has no licence gate. Paid checkout, subscriptions and an
automatic Pro update service have not launched. Support uses the existing
website helpdesk; no paid response-time service level is promised.

PACKAGE IDENTITIES

tocgenius-0.4.3.zip
61,116 bytes; 20 members
SHA256 81b9444da0e1372ba52a8dc82cf8faa7edae9bcc3daf7f62a6fc0e5cce75f9b2

tocgenius-pro-0.4.3.zip
71,832 bytes; 15 members
SHA256 e621e67419e9cc58f60f312008c12a972a843592aef4ea29a4d027a595559fa4