=== Yatoon Salon Booking & Appointments ===
Contributors: yatoon, freemius
Tags: booking, appointments, salon, spa, square
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 4.6.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Mobile-first salon booking with staff scheduling, customer self-service, reminders, flexible payments, and optional Square integration.

== Description ==

**A flexible WordPress booking system built for salons, spas, and service businesses.** The free version provides a complete local booking workflow, while Pro adds Square integration and advanced operational features.

Yatoon has powered daily bookings at a real nail salon for more than a year, connecting a branded customer experience with day-to-day salon operations.

**[Try the live booking demo](https://yatoon.com/bookingdemo/)** - no account or installation required.

= Start booking with Free =

Square is not required. Local mode runs inside WordPress and gives service businesses a practical booking system without connecting an external scheduling or payment account.

* Mobile-first booking for services, options, staff, date, time, customer details, and confirmation
* Services, service variations, qualified staff, business hours, staff schedules, breaks, and closed dates
* Any Staff assignment and final server-side availability checks to help prevent schedule conflicts
* Multiple services and guests in one booking journey, with separate staff choices and reference photos
* Booking calendar, appointment management, client records, notes, and basic reports
* Email confirmations and configurable booking notifications
* Secure customer self-service for viewing, cancelling, rescheduling, rebooking, and adding appointments to a calendar
* Staff Portal schedule view for day-to-day mobile access
* Service menu, waitlist, form fields, brand basics, privacy tools, and a guided one-click migration from Bookly or Amelia (Pro also migrates from LatePoint)
* SEO-ready local discovery storefront with portfolio, popular services, multi-location links, private favorites, and quick rebooking
* Privacy-safe booking-funnel reporting and an installable lightweight customer app for home-screen access
* Gutenberg blocks, Elementor widgets, shortcodes, responsive layouts, RTL styles, and maintained language catalogs
* Up to two staff members in the Free plan

= Grow with Pro =

Upgrade when your business needs Square, payments, automation, more staff, or broader salon operations. Pro includes everything in Free, plus:

* Unlimited staff members
* Square Appointments synchronization, Square online payments, deposits, refunds, sync monitoring, and recovery tools
* Optional Vagaro availability and booking creation, plus Google Calendar two-way availability
* Stripe and PayPal payment options, deposits, prepayment, invoices, taxes, and refund workflows
* SMS reminders through Twilio and optional WhatsApp workflows (Pro adds full Meta WhatsApp Cloud API templates)
* Packages, memberships, gift cards, coupons, loyalty, recurring appointments, waitlist automation, broadcasts, and review requests
* Verified-appointment review badges and one-customer-at-a-time timed waitlist claim links
* Advanced customer self-service, including changing services safely
* Multi-location rules, shared resources, inventory, commissions, dynamic pricing, group classes, reports, and automations
* Advanced brand controls, operational diagnostics, authenticated REST integrations, and priority support
* Native Bricks, Beaver Builder, and Divi booking modules

External providers are optional and require their own accounts, credentials, supported regions, and any applicable provider fees.
Features connected to external providers also depend on those providers' API availability, compatibility, policies, and continued service; provider outages or API changes can temporarily affect the corresponding integration without affecting Local mode.

= Reliability for real salon operations =

Yatoon rechecks staff qualification, working hours, breaks, closed dates, existing appointments, and relevant external availability before sensitive booking changes are saved. If confirmation fails, the booking form keeps the customer's details and provides clear recovery actions instead of forcing the customer to start over.

Pro's Operations health center adds recent sync activity, webhook status, stale-sync warnings, failed background jobs, retry controls, migration status, upgrade snapshots, rollback tools, performance measurements, and a privacy-safe technical summary for support.

= Add Yatoon anywhere =

* `[yatoon_booking]` - complete booking form
* `[yatoon_discovery]` - indexable salon discovery storefront, portfolio, favorites, reviews, and booking entry points
* `[yatoon_service_menu]` - visual service menu with Book buttons
* `[yatoon_customer_portal]` - customer self-service portal
* `[yatoon_staff_portal]` - mobile staff schedule portal
* `[yatoon_growth_storefront]` - Pro package and membership storefront
* `[yatoon_group_appointments]` - Pro capacity-based classes and independent attendee reservations

Every major shortcode is also available as a native Gutenberg block and Elementor widget.

== Installation ==

1. Install and activate Yatoon Salon Booking.
2. Complete **Yatoon Booking > Setup Wizard**.
3. Configure services, variations, staff qualifications, schedules, business hours, breaks, and closed dates.
4. Stay in Local mode with Free, or connect the integrations your Pro workflow requires.
5. Add the Yatoon Booking block, Elementor widget, or `[yatoon_booking]` shortcode to a public page.
6. Exclude booking and portal pages from full-page caching and delayed JavaScript optimization.
7. Complete a test booking and confirmation before launch. If configured, also test payment, refunds, synchronization, customer self-service, and staff workflows.

== Screenshots ==

1. Mobile-first booking with a clear five-step flow, service choices, and persistent cart.
2. Service variations, upgrades, options, and recommended add-ons.
3. Pro multi-service group appointments for a client and guests in one visit.
4. Qualified staff selection with Any Staff and preferred-team choices.
5. Recommended openings plus fast week, month, and time selection.
6. Per-service reference photo uploads with a visible Uploaded confirmation.
7. Complete confirmation receipt with guests, services, times, prices, directions, and calendar actions.
8. Service catalog controls for categories, pricing, status, and upload rules.
9. Pro brand controls for logos, colors, typography, buttons, and live previews.
10. Mobile Staff Portal with a practical day calendar.
11. Customer self-service for reviewing, rescheduling, or cancelling safely, with Pro service changes.
12. Pro service changes with duration checks and qualified available staff.

== Frequently Asked Questions ==

= Does the Free version require Square or another external service? =

No. Free can run in Local mode inside WordPress. Square, Vagaro, Stripe, PayPal, Twilio, and Google Calendar are optional Pro integrations.

= What makes Yatoon different from a generic appointment plugin? =

Yatoon focuses on salon workflows: service variations, multi-service visits, reference photos, qualified technicians, Any Staff assignment, customer self-service, and practical staff and client tools. Pro extends those workflows with Square and other advanced operations.

= What does Pro add? =

Pro adds unlimited staff, Square Appointments synchronization, Vagaro availability and booking creation, online payments and deposits, SMS and calendar integrations, advanced customer self-service, growth tools, multi-location operations, and priority support. Features that use third-party providers require separately configured provider accounts.

= What does the Square integration cover? =

Square is optional and available in Pro. Yatoon Pro supports Square Appointments synchronization plus Square online payment, deposit, and refund options. It does not replace Square's native point-of-sale application. Exact behavior depends on correct Square location, service, variation, team-member, and permission mappings.

= How does Yatoon protect against schedule conflicts? =

It checks staff qualification, working hours, breaks, closed dates, existing appointments, shared resources, and external availability where applicable. A final server-side check runs immediately before the change is saved.

= Can one booking contain several services or guests? =

Yes. Each guest can have separate services, staff assignments, timing, and reference photos while remaining part of one booking journey.

= Can customers and staff manage appointments from a phone? =

Yes. Customers can install the lightweight booking app from a supported browser for fast access to booking, discovery, and My Appointments. The Customer Portal provides secure self-service, and the installable Staff Portal is designed for mobile daily operations.

= Does it support deposits and online payments? =

Online payments and deposits are available in Pro. Configure only the provider and deposit rules required by your business, then test the full payment and refund workflow in the provider's test environment before going live.

= Is Yatoon multilingual? =

Yes. Yatoon is translation-ready and includes maintained catalogs for Simplified Chinese, Traditional Chinese, Spanish (Spain and Mexico), and Vietnamese. English is the source language. Community translations distributed by WordPress.org continue to work, and untranslated strings safely fall back to English. Business-owned service names, descriptions, policies, and custom labels remain editable by the site owner.

= Where can I get help? =

Downloads, licensing, updates, and priority support are available through [Yatoon.com](https://yatoon.com/). Copy the privacy-safe technical summary from Operations when reporting an integration problem.

== External Services and Privacy ==

Free Local mode performs booking and availability inside WordPress and does not require Square, Vagaro, Stripe, PayPal, Twilio, Google Calendar, Microsoft Outlook, or Meta WhatsApp.

The plugin bundles Freemius for optional account connection, licensing, updates, and upgrade screens. Freemius is contacted when an administrator chooses to opt in, connect an account, manage a license, or use related services, and may receive the site, administrator, plugin, WordPress, PHP, and license information required to provide them. See [Freemius Privacy Policy](https://freemius.com/privacy/) and [Terms](https://freemius.com/terms/).

Yatoon does not download fonts from a remote CDN. Font choices use a family already supplied locally by the active theme/site, with a system-font fallback.

The optional merchant push relay is disabled by default and also requires the site owner to configure a private worker secret. When explicitly enabled, Yatoon sends a signed, pseudonymous subscription endpoint and a generic event type to `yatoon-api.yatoon.workers.dev` so the Cloudflare Worker can deliver the push notification. Customer names, contact details, services, appointment times and notes are not sent. See [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/).

Pro integrations contact only the providers an administrator configures and enables. Depending on the workflow, the minimum required booking, customer, staff, catalog, calendar, message, payment, refund, location, and provider-reference data is sent to that provider. Provider credentials are stored encrypted in WordPress; Yatoon diagnostics must not include them.

* [Square Privacy](https://squareup.com/us/en/legal/general/privacy)
* [Vagaro Privacy](https://www.vagaro.com/privacy)
* [Stripe Privacy](https://stripe.com/privacy)
* [PayPal Privacy](https://www.paypal.com/us/legalhub/privacy-full)
* [Twilio Privacy](https://www.twilio.com/en-us/legal/privacy)
* [Google Privacy](https://policies.google.com/privacy)
* [Microsoft Privacy](https://privacy.microsoft.com/privacystatement)
* [Meta Privacy](https://www.facebook.com/privacy/policy/)

Site owners are responsible for obtaining required consent, publishing an accurate privacy notice, configuring retention, and complying with the rules of their region and chosen providers.

== Changelog ==

= 4.6.2 =
* BREAKING CHANGE - fonts: remote Google Fonts loading was removed for privacy and GDPR reasons and was NOT replaced with self-hosted font files. The Brand & Colors font setting now only adds the chosen family name to the CSS font stack, so it has a visible effect only where the active theme, a child theme, or another plugin already serves that font locally; otherwise the booking page falls back to the system font. A site that was relying on Yatoon to fetch Inter, Poppins, Roboto, Montserrat, Lato, or Playfair Display will look different after updating. This is a deliberate behaviour change, not a fix, and the only way to restore the old appearance is to host the font yourself. The setting screen now says all of this in place of the previous wording.
* New - no-show tracking and automatic deposits (Pro), the feature the Add-ons screen and the upgrade prompts have advertised since 4.5 and that had no implementation behind it at all: the "No-show Tracking" menu item simply opened the General settings tab. Yatoon now counts how many times a customer has been marked No Show inside a window you choose (3 in 12 months by default) and either requires a deposit on their next booking or flags them for staff, with a screen listing every flagged customer and a one-click permanent exemption for anyone marked no-show by mistake. Customers are matched by the email address or phone number on the appointment - the same weak link the rest of the plugin uses - so someone booking under two different addresses counts as two people; the screen says so. Requiring a deposit reuses the amount and gateway already configured under Payments, and warns you when no gateway is configured and therefore nothing can actually be charged. The rule attaches nothing to the booking path while it is switched off.
* Fixed a brand new Pro install hiding roughly half of what was just paid for. The runtime profile is picked while the plugin file is still loading, before the licence state is knowable, so every fresh install landed on the lean "local" profile - which leaves Reports, Orders & Invoices, Shared resources, Staff x Location rules, Group sessions, the Operations centre, the REST API and the AI assistant switched off, with no menu entry anywhere to suggest they existed. A licensed Pro site is now promoted once to the complete profile as soon as the licence can be read, and a site that upgrades to Pro later is promoted then. Sites where an administrator has already chosen a profile are never overridden.
* Added a visible way to find switched-off modules on any profile: the Feature Modules menu entry now carries a count of what is disabled, and Yatoon admin screens show a dismissible notice naming each switched-off module with a direct link to its switch. Previously the only route was the admin search box, which requires already knowing the feature exists.
* Fixed the plugin never loading its own translations. The package ships seven compiled catalogs in /languages and called load_plugin_textdomain() zero times. WordPress 6.7+ can register them from the plugin header, which hid the problem in development, but this plugin supports WordPress 5.8 and nothing registered them there - so on 5.8 through 6.6 the admin stayed English in every locale. The loader now runs on 'init' on WordPress 6.7+ and on 'plugins_loaded' below it, matching each version's requirement.
* Fixed the Feature Modules runtime building translated strings while the plugin file was still loading, which both triggers WordPress 6.7's "translation loaded too early" warning and freezes the text domain as untranslated for the rest of the request. The runtime module lists no longer contain translated labels at all.
* Replaced the two file-level phpcs:disable directives in the settings template with one ignore per statement, each stating its reason. The first had no matching phpcs:enable, so it silenced database sniffs across the remaining 2,800 lines of the file, including code written years later.
* Added bin/release-checks.php, a pre-release assertion script covering the failure modes this release ran into twice: a manage-token query that forgets the expiry column, a ".min" asset that is not actually minified, a concatenated bundle that was not rebuilt after its inputs changed, a PHP parse error, and a missing direct-access guard. Run it with `php bin/release-checks.php`; any failure exits non-zero and explains why that assertion exists.
* Corrected several readme claims that overstated what ships. Vagaro is described as a one-way import plus booking creation rather than synchronization, because Yatoon sends Vagaro no reschedules and no cancellations, receives no Vagaro webhook and runs no scheduled re-pull. Square point of sale is described as recording a Square POS or Tap to Pay payment status, because there is no cart, retail checkout, cash drawer, or Terminal API. The REST integration now lists its actual routes and states that there is no availability endpoint and no published reference. The Bricks, Beaver Builder and Divi modules are described as shortcode adapters and noted as being present in the free plugin too, not Pro-only.
* Expanded the External Services disclosure into a per-service list giving the hostname contacted, what is sent, when it is sent, and both the privacy policy and terms for each provider - including the OpenAI, Anthropic, Apple, Cloudflare Turnstile and Zoom endpoints that were previously not listed at all.
* Fixed the booking form jumping up and down when moving from services or options to the next step by coalescing competing scroll targets into one stable position.
* Fixed every button colour, font and radius set under Button Labels, Fonts & Colours being ignored on the booking page. The template skins (.yatoon-template-beauty/clean/luxury, and the default is beauty) style the same buttons with !important at a higher specificity, so a bare class override lost the cascade no matter which stylesheet loaded last - a merchant could set the ADD colour, see it in the admin live preview, and still get the template's pink gradient live. Affected ADD, Continue, Confirm and Add Guest; hover states and the leftover coloured glow now follow the chosen colour too.
* Reclaimed the large empty band above "Your appointments" at the top of the booking form. The step indicator is hidden on step 1 but was reserving its full 84px height there, so every visitor paid 84px of dead space on the screen where booking converts, to protect against a layout shift that only occurs when a saved session resumes past step 1. The reserve is now a 10px spacer (8px under 640px).
* Fixed the Free-plan staff limit so up to two staff members can be created and enforced that limit on the server.
* Localized booking prices and dates, improved phone-error accessibility, and prevented iOS form zoom.
* Hardened recurring manage-link expiry, large-option autoloading, release asset validation, and card-on-file authorization checks.
* Added and hardened import/migration support for moving from Fresha, Booksy, Vagaro, Square, or generic CSV exports.
* Pro: keep a card on file after explicit cancellation-policy consent and charge missed appointments or late cancellations when enabled.

= 4.6.1 =
* Fixed the booking form jumping up and down when moving from services or options to the next step by coalescing competing scroll targets into one stable position.
* Fixed the Free-plan staff limit so up to two staff members can be created and enforced that limit on the server.
* Localized booking prices and dates, improved phone-error accessibility, removed remote font loading, and prevented iOS form zoom.
* Hardened recurring manage-link expiry, large-option autoloading, and release asset validation.
* Extended one-time AI consent, sensitive-data screening, and the site-wide provider budget to the customer-portal reschedule/cancel assistant; completed a systematic gettext pass across settings, portals, operational tools, provider errors, and notification defaults.
* Hardened client-IP rate limits with an opt-in trusted-proxy allowlist; forwarded headers remain ignored by default.
* Added an explicit uninstall data policy: appointments, customers, services, staff, settings, and integration data are preserved unless permanent deletion was deliberately enabled.
* Fixed network activation on WordPress Multisite so every existing site receives the complete Yatoon schema before migrations run.
* Added explicit customer consent and sensitive-data screening before frontend AI requests can reach a configured third-party provider.
* Added idempotent booking contact indexes and reduced the durable job queue's fallback poll from every minute to every five minutes while retaining prompt single-run jobs.
* Hashed OTP codes, limited failed attempts, stripped uploaded-image metadata by re-encoding, and translated direct JSON/error responses.
* New: client Look History. The client profile now has a place to log what color, style, or product a visit used, with an optional photo, tied to that client and (when logged from a booking) that appointment automatically.
* Pro: keep a card on file after explicit cancellation-policy consent; Stripe stores the card details, not WordPress.
* Pro: charge for missed appointments and late cancellations, as a fixed amount or a percentage of the booking. Manual by default, with an optional automatic mode.
* New: move in from Fresha, Booksy, Vagaro or any system that exports a CSV. Customers, appointment history, remaining package visits and gift card balances all come across, with a preview before anything is written and every import reversible.
* Staff Portal sign-in — PIN, Google, and email/text-message codes — is now set up directly from the employee editor instead of a separate Identity screen, and setting a PIN no longer reloads the page.
* Fixed a site activated through WP-CLI or another headless/staging tool never getting past the licensing library's one-time connect-or-skip prompt: 10 admin pages returned a bare "Sorry, you are not allowed to access this page" until that prompt was seen in a browser.
* Fixed the Settings page itself being able to disappear from the admin menu on some installs, from the plugin registering its other pages before its own Settings page instead of first.
* Fixed a JavaScript error on every Settings tab except General, and on five locked feature-preview pages, from a script reading a Deposit/Prepay control that only exists on the General tab.
* Fixed the setup wizard creating a duplicate "My Appointments" customer page and silently switching every customer-facing link to it, instead of reusing the page the plugin already creates automatically on activation.
* Fixed the Clients screen showing "No clients yet" directly under a heading that said how many customers you have — three of the five sort columns used SQL the database rejects.
* Fixed the month view of the booking date picker, which threw a JavaScript error and never rendered.
* Fixed five Settings sub-pages (SMS, Google Calendar, Deposit & Prepay, No-show Tracking, Waitlist) rendering their controls without the script driving them.
* Fixed a fatal error on every fresh install from the salon-operations dashboard loading on a profile switch it did not belong to.
* Fixed double-booking on customer self-service: rescheduling and changing services now take the same per-day lock new bookings already used.
* Added rate limiting to the booking endpoint, per visitor and per contact detail.
* Fixed appointment times shown in Zoom invitations, confirmation emails, admin notifications and waitlist notices, which were shifted by the site's UTC offset.
* API credentials are no longer silently stored in plain text when a server cannot encrypt; saving now fails with a clear notice instead.
* Reference-photo uploads now verify the chosen service actually accepts them, instead of only checking the site-wide switch.
* Push notifications no longer send customer names, services or appointment times to an external relay.
* Escaped staff names in the booking form, added accessible names to form controls, translated 60+ booking-flow strings, raised touch targets to 44x44, and fixed a text colour below the accessibility contrast floor.
* Availability lookups now cache within a request: a multi-location, multi-service search dropped from hundreds of database queries to a handful.
* Free and Pro no longer drift on cancelled-appointment workload counting, webhook health checks, or the Reviews builder widget.

= 4.6.0 =
* Added a polished local discovery storefront, favorites sync, quick rebooking, verified review trust signals, privacy-safe booking-funnel analytics, timed waitlist claim links, and an installable customer PWA.
* Balanced the mobile whitespace above the Your appointments card and shortened guest sign-in guidance across the booking flow.
* Added a fast, free-tier-friendly frontend AI mode with conditional availability checks, shorter prompts, bounded retries, provider-aware failover, answer caching, and clickable local-menu fallback instead of a dead-end busy message.
* Added configurable frontend AI performance and cache controls plus a clearer progress state for slower provider responses.
* Fixed multi-service owner and customer emails so every selected variation and add-on is listed with its segment duration.
* Added salon address, phone, website, manage/reschedule/cancel, and calendar links to customer confirmations, including sites with older saved email templates.
* Clarified optional guest checkout and removed repeated sign-in prompts from intermediate booking steps.
* Corrected confirmation and admin email duration for combined services and add-ons.
* Fixed multi-service Square time checks so selected add-ons and total duration match final confirmation.
* Added better Step 5 spacing and sticky-header-safe mobile progress scrolling.
* Restored desktop hover opening for the booking sign-in menu and stopped failed AI provider calls from consuming the customer's longer usage allowance.
* Added automatic model/provider failover for temporary AI overloads and rate limits, without exposing raw technical provider errors to customers.
* Replaced the browser-native booking sign-in control with a stable button menu, removing the duplicate triangle and unreliable open/close behavior seen in Chrome.
* Restored the booking sign-in menu as a tidy desktop overlay that no longer expands the whole appointment banner.
* Styled Google, Facebook, and email as consistent full-width boxed sign-in actions.
* Keeps current Gemini, OpenAI, and Claude choices while restoring the complete original working model set, compatibility-first defaults, and provider-agnostic runtime fallback.
* Increased wide-screen booking typography so the expanded layout remains readable and visually balanced.
* Added a wider, balanced booking layout for large desktop screens while preserving responsive laptop and mobile behavior.
* Removed the booking page's wide-then-shrink first-paint jump and fixed delayed AI Feature Switch checkmarks.
* Made hidden optional modules searchable with direct enable-feature guidance.
* Added secure booking-homepage customer sign-out, responsive Growth Modules forms, and clearer AI settings discovery.
* Refined the customer sign-in banner with a branded Google button, clear appointment-management copy, and a login-aware My Appointments action.
* Fixed Rank Math breadcrumb JSON-LD items that omitted the Google-required name field.
* Added Google and email-code customer sign-in, with SMS-code capability available when the Pro Twilio integration is configured.
* Added customer self-service service changes with fresh staff/time availability checks for eligible unpaid single-service appointments.
* Hardened local reschedule availability across breaks, resources, time off, and external calendars.
* Added native Brizy elements for booking, customer and staff portals, service menus, catalogs, galleries, reviews, and booking management.
* Fixed the enabled Already booked banner being suppressed by legacy option types or temporarily unavailable destination URLs.
* Prevented partial General settings actions from silently clearing unrelated checkboxes.
* Fixed delayed checkbox checkmarks across all Settings controls in Chromium and Edge.
* Fixed false no-availability results when a primary variation was also submitted as an add-on after staff selection.
* Added Google sign-in and My Appointments to the optional booking-form portal banner, automatic customer-portal page setup, and clearer OAuth readiness guidance.
* Added shared Google OpenID Connect identity for customers and explicitly authorized employees.
* Added customer Google sign-in and verified profile prefill in both Local and Square booking modes.
* Added employee Google, email-code, SMS-code, and six-digit PIN sign-in with one hardened session model.
* Added persistent identity links, one-time OAuth handoffs, collision-safe customer matching, and Square Customer resolution.
* Added an Identity & Sign-in admin screen with per-employee authorization controls and audit-ready bindings.
* Simplified the booking-page sign-in dropdown wording ("Continue with email" / "Continue with text message") and made both labels editable under Settings.
* Fixed the "Already booked with us?" banner heading not upgrading to the shorter default when the saved text used different capitalization.
* Moved the direct-access guard in class-yatoon-core.php to the top of the file (it previously sat after an unguarded top-level function).
* Fixed appointment reminders being marked as sent even when delivery failed, whenever the (Pro-only) SMS reminder toggle was left checked.
* Added revenue trend, revenue-by-service, and revenue-by-staff charts to the Reports page.
* Added an AI reschedule assistant: customers can describe a new time in their own words in "My Appointments"; AI only reads real open slots and never invents availability, and the customer still confirms before anything changes.
* Gave WhatsApp reminders and the Bookly/Amelia/LatePoint migration center their own readme callouts instead of leaving them buried in a shared bullet point.
* Rebuilt the Reports page charts on a locally-vendored Chart.js (no CDN): a combined revenue/bookings trend chart plus real bar charts for revenue by service and by staff, replacing the earlier plain CSS bars.
* Broadened the AI assistant in "My Appointments" beyond reschedule-only: it now also recognizes cancellation requests ("please cancel it") from the same chat box, still only proposing an action after checking real data, and still requiring the customer to confirm before anything changes.

= 4.5.6 =
* Closed a concurrent Square webhook duplicate-processing window with atomic event claims and safe retry release.
* Stopped the booking service worker from persisting HTML, API responses, WordPress nonces, or personalized pages.
* Added post-migration table verification so failed optional-module migrations retry instead of being marked complete.
* Added direct-access guards to remaining core integration classes and expanded executable release contracts.

Older release notes are preserved in the project release archive; the plugin package intentionally carries only recent upgrade-relevant history.
