=== Harmonic Mix Scheduled Updates ===
Contributors: harmonicmix
Tags: updates, plugin updates, theme updates, scheduler, maintenance, logging, audit
Requires at least: 6.0
Requires PHP: 7.4
Stable tag: 1.0.13
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lightweight WordPress update auditing for plugins, themes, core, maintenance mode, and native update checks, with optional scheduled plugin auto-update management.

== Description ==

Harmonic Mix Scheduled Updates provides two complementary modes:

* Logging Only — observes and records plugin, theme, and WordPress core update activity without changing WordPress's normal update timing.
* Managed Plugin Updates — keeps logging enabled and moves administrator-selected plugin auto-updates into a configurable maintenance window.

The plugin is intentionally lightweight. It does not scan files, perform backups, inject front-end assets, or act as a malware/security scanner.

Features include:

* Plugin update audit history.
* Plugin install, activate, deactivate, and uninstall/delete lifecycle auditing.
* Theme update auditing without taking over theme update policy.
* WordPress core update auditing without taking over core update policy.
* Manual Update now tracking, including the WordPress user when available.
* Automatic WordPress plugin and theme update tracking.
* Managed update maintenance window for plugins with WordPress Auto-updates enabled.
* Sequential managed plugin updates.
* Manual Update now actions remain available in managed mode.
* Old, target, and resulting version recording.
* Core-update reconciliation to avoid duplicate audit rows when a version change becomes visible before the normal completion callback.
* Recovery statuses for core updates whose normal completion callback is not observed.
* Native WordPress plugin, theme, and core update-check heartbeat observations.
* Heartbeat summaries on the admin page; complete heartbeat history is retained in the CSV export.
* Maintenance-mode observation, stale maintenance reporting, and maintenance-clear auditing when observable by WordPress.
* 12-hour self-expiring managed-update lock.
* Consecutive managed plugin failure detection.
* Configurable administrator email notification threshold and reminder interval.
* Fallback detection when WordPress core files are replaced outside an observed WordPress upgrader process.
* Clear Plugins-screen messaging when automatic plugin update timing is managed.
* A locally generated Installation ID for optional support identification. The ID is never transmitted automatically.
* Complete CSV audit export and a focused 50-record recent-history view.
* No telemetry.

This plugin intentionally does not automatically update itself. Use the normal WordPress Update now action when a new version of Harmonic Mix Scheduled Updates is available.

== Installation ==

1. Upload the plugin ZIP from Plugins > Add Plugin > Upload Plugin, or install it from the WordPress Plugin Directory if available.
2. Activate Harmonic Mix Scheduled Updates.
3. Go to Settings > Scheduled Updates.
4. Leave Managed Plugin Updates disabled for logging-only operation, or enable it to manage the plugin update window.
5. On Plugins > Installed Plugins, use WordPress's normal Auto-updates controls to select which plugins are eligible for managed automatic updates.

== Frequently Asked Questions ==

= What if the plugin folder is deleted manually outside WordPress? =

Removing the plugin directory with FTP, SSH, or a hosting file manager bypasses WordPress deactivation and uninstall processing. The plugin therefore cannot run cleanup code at that moment. Any retained audit table and settings remain in the WordPress database. Harmonic Mix Scheduled Updates uses single-run cron events rather than a permanently recurring managed-update event, so an orphaned scheduled run will not continually recreate itself when the plugin code is absent. Reinstalling and activating the plugin clears stale managed-update events and resumes using the retained data. For a complete intentional removal, use the WordPress Plugins screen and the plugin's Remove data on uninstall option.


= Can I still click Update now manually? =

Yes. Manual plugin, theme, and core updates continue to use the normal WordPress updater. When logging is enabled, the plugin records the observed update and the initiating WordPress user when available.

= What happens if I enable Managed Plugin Updates? =

For plugins that have WordPress Auto-updates enabled, normal automatic installation is deferred to the configured maintenance window. Manual Update now actions still work normally.

= Does managed mode update themes? =

No. Theme updates are audited, but this plugin does not reschedule or take over theme update policy.

= Does it manage WordPress core updates? =

No. It audits core updates but leaves WordPress core update policy to WordPress, the site administrator, or the hosting provider.

= What are the WordPress Update Checks on the status page? =

They are passive heartbeat observations of WordPress's native cron update checks for plugins, themes, and core. Routine heartbeat rows are retained in the complete CSV audit export but are hidden from the normal recent-history table.

= Does maintenance-mode auditing guarantee every maintenance event will be captured? =

No. The plugin records maintenance mode when it can observe WordPress's .maintenance state during updater hooks or subsequent WordPress execution. A very brief externally-created maintenance period can prevent plugins from loading and may end before this plugin gets an opportunity to observe it. Stale or forgotten .maintenance states are more readily detectable once WordPress resumes loading plugins.

= What happens if a managed update process crashes? =

The managed-run lock expires after 12 hours. A stale managed update record can then be marked incomplete, allowing the next scheduled run to proceed.

= Does it scan WordPress files for changes or malware? =

No. Core version-change detection and maintenance auditing are not file-integrity monitoring. Use a security product for malware scanning and integrity checks.

= What is the Installation ID? =

It is a random identifier generated locally for this plugin installation. It is intended only as an optional reference that an administrator could voluntarily provide when asking for support. It is not a credential, does not grant access, is not designed to distinguish cloned sites, and is never transmitted automatically.

= Does this plugin send telemetry? =

No. Update history, settings, failure state, heartbeat summaries, maintenance observations, and the Installation ID remain in the local WordPress database.

== Privacy ==

This plugin stores update and plugin-lifecycle events, plugin/theme/core version information, timestamps, native update-check heartbeat observations, maintenance-state observations, and—when available—the WordPress username and user ID associated with a manual administrative action. It also stores a randomly generated Installation ID locally.

No audit history, Installation ID, or usage telemetry is transmitted to Harmonic Mix or any third party by this plugin.

Failure notification emails are sent using the site's configured WordPress mail system to the administrator-configured notification address.

== Changelog ==

= 1.0.13 =
* Added next-scheduled timestamps for WordPress plugin, theme, and core update checks.
* Added clear NOT SCHEDULED and OVERDUE states for native WordPress update-check cron events.

= 1.0.12 =
* Reconciled replacement-ZIP installs of existing plugins into one clear PLUGIN_UPDATE audit record.
* Suppressed duplicate EXTERNAL_DETECTED lifecycle rows when WordPress already reported the same plugin action.
* Removed unidentified failed install noise associated with replacement ZIP updates.
* Preserved initiating source and user information for self-update reconciliation when available.
* Kept lifecycle rows concise by showing a single installed version rather than an update-style transition.

= 1.0.11 =
* Updated public documentation and release metadata.

= 1.0.8 =
* Added admin-load plugin inventory reconciliation for installs, removals, version changes, and activation-state changes that bypass normal WordPress lifecycle hooks.
* External plugin changes are logged as EXTERNAL_DETECTED and appear in the normal recent audit history.
* Inventory is refreshed after normal WordPress plugin lifecycle events to avoid duplicate external-detection records.

= 1.0.7 =
* Sorted the Auto-update Plugins admin table alphabetically by displayed plugin name to match the normal WordPress Plugins screen more closely.

= 1.0.6 =
* Added a Settings action link on the Installed Plugins screen for direct access to the plugin settings page.
* Updated plugin version metadata for the 1.0.6 release.

= 1.0.5 =
* Added audit records for plugin install, activate, deactivate, and uninstall/delete events.
* Plugin lifecycle events are included in the normal recent-history table and complete CSV export.
* Added persistent self-version reconciliation so future manual updates of Harmonic Mix Scheduled Updates can be audited across requests.
* Preserved plugin version information on lifecycle events where WordPress makes it available.

= 1.0.4 =
* Fixed old-version capture for manual/bulk theme updates by snapshotting before package download.
* Applied the same early snapshot protection to bulk/manual plugin updates.


= 1.0.3 =
* Fixed manual/AJAX theme update auditing so the installed pre-update version is captured before theme files are replaced.
* Added a pre-install fallback snapshot for observed plugin, theme, and core updates while retaining duplicate-attempt protection.

= 1.0.2 =
* Added theme update auditing while leaving theme update policy under WordPress/administrator control.
* Added theme availability/status visibility on the admin page.
* Added passive WordPress cron heartbeat observations for plugin, theme, and core update checks.
* Added last native update-check summaries to the admin status interface.
* Kept routine heartbeat rows out of the 50-record recent-history table while retaining them in the complete CSV export.
* Added WordPress maintenance-mode observation, clear events, stale-state reporting, and current maintenance status.
* Added core-update transaction reconciliation to prevent duplicate external/automatic core update records.
* Added COMPLETED_UNOBSERVED and FAILED_OR_ABORTED recovery handling for incomplete core-update observations.
* Preserved plugin-only managed scheduling; WordPress core and themes remain audit-only.

= 1.0.1 =
* Added complete CSV log export and a 50-record recent-history view.
* Added first-activation metadata, friendly configuration-change auditing, and technical database table information.
* Added separate logging-only and managed-update modes.
* Added auditing of manual and native WordPress plugin updates.
* Added WordPress user/source information to update records when available.
* Added WordPress core update auditing.
* Added fallback detection for externally replaced/upgraded WordPress core files.
* Added managed update messaging to the Installed Plugins screen.
* Preserved normal manual Update now behavior.
* Added explicit manual-only self-update behavior.
* Added locally generated Installation ID.
* Added optional uninstall data removal.
* Added public-release licensing, privacy, and readme information.
* Refined managed failure counting and audit statuses.

= 1.0.0 =
* Initial scheduled plugin update manager with logging, failure notifications, and a 12-hour safety lock.
