release: prep v1.5.2 — ⚠️ TAG HELD pending the second ultrareview

[dknauss]

Version bump + changelog for the patch. The tag is deliberately held — see below.

⚠️ Do not tag yet

A second ultrareview is still running in another session and may confirm further bugs. If it does, they belong in this patch. Tagging now would either ship a fix whose changelog omits its siblings, or force a v1.5.3 days later.

v1.4.0's gate 8 caught a changelog overclaim by diffing the real commits. The same discipline says don't finalise the changelog until the commit set is final. This repo has held a tag for exactly this reason before, and the hold was correct that time too.

What clears it: the other review completing, and either no confirmed findings, or their fixes merged here and folded into the 1.5.2 changelog.

Merging this PR is fine whenever you like — it's the tag that's held.

What's in it

Diffed v1.5.1..main rather than trusting the commit list. One shippable file:

File
includes/class-config.php	+46/−3 — the normalizing-equivalent-key dedupe from #153

Changelog decisions

Two entries from one fix, split because they're different audiences:

• The general one names the symptom a user would actually notice — a rename or visibility rule that stops working while still appearing in settings — rather than the mechanism. That silent-failure shape is the worst part of the bug and deserves to be the sentence people read.
• The authorization one states that it closes a way for a saver who can't list users to undo an administrator's per-person rule, with the cosmetic-only guarantee restated, because that's the claim people will check.

Not framed as a security release. Hiding is cosmetic — no capability was granted or removed, and the affected page stayed URL-reachable throughout for anyone allowed to open it. Same framing as 1.4.1.

Riding along, not changelog material: the readme listing copy rewritten in #152 (D4 non-autoloaded differentiator, tags, description). It publishes with the release, but it's directory copy, not plugin behaviour.

Upgrade Notice is 271 chars (Plugin Check limit 300).

Gate

Docker-free lanes green locally: unit 167/167 (223 assertions), WPCS clean, PHPStan 0, doc-links clean. Integration + e2e ran green on #153 and re-run here in CI.

When the tag does happen

v1.5.2 will be the first release through the new deploy gate. Pushing the tag builds and publishes the GitHub Release, then the deploy job pauses for your approval on the wordpress-org environment before anything reaches WordPress.org. It's also the first real test of whether the workflow_call wiring fires at all — the deploy-trigger todo stays open until it does.

🤖 Generated with Claude Code