### Changed
- **Abilities API architecture** - Unified all ~41 abilities under a shared `AbstractAbility` base class (`src/Core/Ability/`), registered consistently through both the core WordPress Abilities API and the ACFW (agent-connector-for-wp) integration, with the same exception-handling, permission checks, and audit-log wrapping applied everywhere. Brings along the crash and data-loss fixes below.
### Fixed
- License page stuck unrecoverable after a site migration: when the stored activation id is no longer recognized by the license server (e.g. `Activation ID not found`), the React app silently discarded the error and always rendered the "Activate your license" screen with a dead (linkless) button, with no way to reach the "Deactivate license" action that would clear the stale local record. The fetch error is now surfaced and routes to the license details screen so it can be deactivated and re-activated normally.
- Fatal error on every request when license reconciliation can't reach acpt.io (e.g. cloned/staging domains) - the unguarded API call is now wrapped so a network failure degrades gracefully instead of fataling the whole site (Ticket #1164).
- CPT rewrite rules silently disabled when editing existing post types: the "Rewrite" toggle defaulted to unchecked for existing post types whose stored settings lacked an explicit `rewrite` key, so saving the form for any reason (e.g. just updating the front URL prefix) silently persisted `rewrite: false`, registering zero rewrite rules and 404ing the CPT - not fixable by flushing permalinks. Also hardens the `custom_rewrite`/front-URL-prefix priority check so a stale `custom_rewrite` value can no longer silently shadow the front URL prefix (regression of Ticket #1153, Ticket #1160).
- Image/media field values not saving when served from a different host (CDN, offloaded media, image accelerator, etc.) - attachment resolution now falls back to matching on the URL path alone when the host differs from the site's own upload base URL.
- Bricks Query Filter showed no checkbox options for POST_TYPE relation fields, and a cold indexer run could produce zero index rows; relational-loop dynamic data tags also resolved against the archive's queried object instead of the loop target (#1161, #1165).
- Site-wide crash (front-end, admin, REST, AJAX) from a missing/empty location-rule operator on `save-meta-group` - the operator is now validated and invalid rules are rejected gracefully.
- Partial updates across 8 ability families (Table, MetaField, FormField, DynamicBlock, TableGroup, Form, MetaBox, TableRecord) were silently deleting data the payload didn't mention - most seriously, omitting `columns` on a Table update deleted every column/index/foreign-key definition, and the next schema sync then dropped the corresponding database columns. All 8 now merge onto the existing record instead of rebuilding it from scratch.
- `save-meta-field` matched against the wrong data shape and never actually found the field being edited, so non-rename edits silently no-op'd and renames created orphan duplicates.
- ACFW's audit-logging/MCP registration always lost a boot-order race against the core Abilities API integration, so its decoration silently never applied when both were active.
- ACPT abilities were missing `meta.mcp.public`, so the official `wordpress/mcp-adapter` package (used by ACFW and other MCP host plugins) rejected every call with "not exposed via MCP" even though the ability registered fine.
### Added
- Integration with the [Abilities API](https://docs.acpt.io/abilities-api), including output-schema fixes for `save-post-type` and 9 other providers whose output validation was broken.
- `append_acpt_meta_field_value()` function/ability to append a single Repeater row without resending existing ones - new `AppendMetaFieldRowCommand`, wired into the Abilities API as `acpt/append-meta-field-value`.
- New Table field arithmetic functions: `SQRT`, `ABS`, `MOD`, `MEDIAN`, `COUNT`.
- New telemetry insight keys (DB engine, multisite, active theme, PHP memory limit, WooCommerce version, feature usage counters) plus a deactivation ping.
### Fixed
- Table field `Maths` singleton memoization (was comparing flattened data against raw input, so caching never worked); malformed formulas (e.g. `=(ROUND("abc",2))`) now return a graceful error instead of crashing the live AJAX formula editor.
- CodeMirror text overflow in admin meta field editors - long lines/URLs now wrap instead of overflowing the layout.
- Etch fatal error when an Image field is nested inside a Repeater (`WPAttachment` private property access via `property_exists()`).
- Dynamic blocks not appearing/rendering in the FSE site editor.
- REST block-renderer live-preview error when inserting a dynamic block in the FSE site editor.
- ACPT loop fields empty on Bricks top-level term-archive templates.
- Front URL prefix causing 404s on Custom Post Type permalinks (Ticket #1153).
- WPML custom field translations getting stuck in one language (Ticket #1118).
- Image/Audio/Video/File field values silently not persisting to `wp_postmeta` via the REST save path: `WPAttachment::fromUrl()` now resolves attachments through query-string, URL-encoding, and `-scaled` suffix variants instead of only an exact `_wp_attached_file` match, and `ACPT_Api_Rest_Fields::updateCallback()` now returns a `WP_Error` when a field fails to save instead of silently discarding the failure.
### Changed
- Refactored `Request`: replaced ambiguous `has()` with explicit `hasGet()`/`hasPost()`; `all()` now delegates to `requestAll()`.
Fixed
- `PostField::renderRelationFieldSelector()` fatal error.
- `FORMAT_NATIONAL` fallback for PHP < 8.1 environments.
- `s.charAt` crash when Phone field has null `defaultValue` or Etch key in description.
### Added
- New advanced option: `restrictLoggerUserPosts` in Post, Post multiple, and Relational fields.
### Changed
- Etch integration - no longer requires external patches; native `WPAttachment` conversion and filter fixes.
- Bricks: through-relationship dynamic data tags (up to 2 hops).
- Batch-prime WP post cache before gallery loops to eliminate N+1 queries.
### Fixed
- `Restrict image extensions` option was being polluted by `Input file accepts` values.
- Repeater sort blanked the second item - reindex regex extended to cover `_id` / `_required` hidden inputs.
- Field group for `product` post type was leaking onto the WooCommerce attribute edit page.
- PHPFastCache created per-host cache directories due to `HTTP_HOST` fallback; added cache folder setting.
- Logged-out users could bypass form role restrictions.
- DateTime picker always showed AM/PM regardless of the configured field format.
- `Url::fullUrl()` and `Url::baseUri()` no longer emit warnings in PHP CLI / WP-CLI / server-cron contexts.
- Gallery drag & drop lost attachment IDs after reorder.
- RankMath integration script no longer enqueued on the frontend.
- Meta box migrated to the wrong field group when saving an unrelated group.
### Added
- Add gallery lightbox support with GLightbox and fix inspector panel layout
### Fixed
- Table field settings and rendering
- Prevent raw HTML markup from showing in Gutenberg Preferences panel
- Allow Editors to access AJAX actions needed for post editing
- Flush phpfastcache on plugin upgrade to prevent stale serialized objects
- Gallery elements loop in GeneratePress PRO
- Resolve address field not working after selecting a search result
### Changed
- Removed tests files from bundle release
### Fixed
- Correct table data sanitization
- Prevent double-slashing of JSON values when saving option page meta
- Route `HTML_TYPE` through customWpKses and preserve base64 image validation in JSON sanitization
- Repeater field visibility conditions
- Set global $post in `set_loop_object()` so Bricks resolves post tags
- Add `flush_rewrite_rules()` after taxonomy save/delete to prevent 404 on front-end taxonomy URLs
### Fixed
- Move `sendInsights` to WP-Cron and add stampede guard
- Fix Bricks builder relational fields query loop
- Refresh user allcaps after `ACPT_Permissions::setPermissions()` so option page caps take effect immediately
- Resolve cURL timeout on plugin update by raising API timeout and capping failed-fetch cache TTL
- Fix import dataset files
- Fix media fields in Elementor PRO dynamic data
- Fix relational fields in repeaters — now populate correctly when added from cache
### Security
- Add capability middleware for AJAX actions via proxy pattern
- Implement nonce verification in `saveSettingsAction`
- Expose security nonce to frontend via `document.globals`
- Update frontend AJAX utility to automatically include nonce in requests
- Add `Nonce::create()` helper method
### Added
- Add `Video` multiple field
- Add Elementor PRO dynamic data provider test suite
- Add Elementor Widget test suite
- Add Bricks provider test suite
- Add gallery loop tag support
- Add form submission confirmation email with post URL
### Fixed
- Fix phone number national/international formatting for local and unrecognised numbers
- Fix email address validation before adding items in `InputMultiValue`
- Fix correct data fetch in Elementor PRO dynamic data provider
- Fix `stripslashes` breaking JSON strings in post meta
### Added
- Add comprehensive test suite for `IP` utility class (9 tests covering all IP source priorities and newline handling)
- Add comprehensive test suite for `Browser` utility class (15 tests covering all browser and platform detection)
- Add comprehensive test suite for `Email` template classes (62 tests across BlankEmailTemplate, LightEmailTemplate, DarkEmailTemplate)
### Fixed
- Improve cache handling: suppress `fopen` and `unserialize` errors with reusable method
- Preventing fatal error triggered by `CustomPostTypeAdminColumnsGenerator:applySortingBasedOnUserPreferences()`
- Fix `fetchAllMetaAction()` to group meta fields by actual belong conditions instead of repository lookups, with human-readable labels
- Security: Replace unsafe `unserialize()` with JSON serialization
- Add fallback for clipboard copy on HTTP and unsupported browsers
- Fixed error handling in Elementor PRO dynamic data provider
- Fix email preview newline rendering: HTML minification was corrupting newlines in email headers/footers
### Changed
- Refactor `MetaGroupModel::isVisible()` with `Request` object for testability and add a comprehensive visibility test suite
- Refactor `IP::getClientIP()` to accept optional `Request` object for better testability
- Improved email template newline handling: added explicit conversion of all newline types (CRLF, CR, LF) to HTML line breaks
### Added
- Add configurable default sort order per CPT in admin list table
### Fixed
- Fixed image field preview not showing after save/refresh on Option Pages
- Fixed field visibility not resolving correctly when called programmatically
- Fixed field resolution on child posts in Breakdance integration
- Fixed cache key mismatch on Option Page meta saving
- Fixed map field skipping default marker on pristine maps and invalid fitBounds error
- Fixed Slim SEO data fetching
- Fixed Elementor and Elementor PRO data fetching on archive pages
- Fixed safe null handling in Elementor template editing
### Changed
- Improved attachment URL resolution performance in `WPAttachment::fromUrl()`