=== Doodle Site Vault ===
Tags: backup, migration, wpress, encryption, multisite, wp-cli
Requires at least: 6.4
Requires PHP: 8.1
Stable tag: 2.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Independent full-directory WordPress backups, standard WPRESS interoperability, encrypted snapshots, incremental files, network recovery and advanced transfer tools.

== Description ==
Original software, not affiliated with ServMask and not a premium-extension license bypass. No paid extension code is bundled.

WHAT IS NEW IN 2.1:
* Restore dry-runs with saved SHA-256 verification reports, duplicate-target detection and a health/activity panel.
* Reload-resumable browser uploads, owner-checked checkpoints, abort and locked allocation/finalization.
* Opt-in encrypted scheduled off-site queue with bounded retries, interruption watchdogs and local retention protection.
* Completion-hook isolation, exact internal-table reservation and interrupted upload finalization recovery.
* See V2.1-GUIDE.md and TEST-REPORT.md for setup, scope and test results.

WHAT WAS ADDED IN 2.0:
* Full WordPress directory and ALL wp-content backup mode, including core, root files, configuration, drop-ins, custom content and this plugin. Symlinks and special files are skipped.
* A genuine standard uncompressed/unencrypted WPRESS encoder and decoder, not a renamed DSV archive. Bidirectional single-site interoperability was locally tested with the unmodified All-in-One WP Migration 7.112 plugin.
* Full root recovery data is contained in the WPRESS database.sql as harmless SET statements with encoded recovery comments. Native ServMask imports database/site content; Doodle Site Vault extracts/restores root recovery data separately. Native ServMask does NOT restore core/config from these extras.
* One-flow dashboard WPRESS creation, authenticated WPRESS downloads, standard WPRESS uploads and conversion.
* DSV incremental FILE snapshots with full database snapshots, SHA-256 manifests, ancestor references, deletion journaling, materialization and baseline retention protection. PHP SQLite3 is required for incremental manifests; the site database remains MySQL/MariaDB.
* Same-topology whole-network DSV backup/restore, database-prefix mapping, child-site media/role preservation and rollback. Main site ID 1 and one network only; no subsite extraction or topology conversion.
* Protected scheduled encryption passwords, configurable 15-minute to 7-day intervals and existing email notification support.
* Path-style S3 / R2 Signature V4 connector: resumable multipart uploads, abort, conditional range downloads. Configurable endpoint, region, bucket, prefix and protected secret credentials. Manual transfers use WP-CLI; opt-in encrypted scheduled uploads can use the operational queue.
* Expiring, quota-limited, HMAC-authenticated direct site-to-site archive transfer with replay protection. Pairing and sending use WP-CLI; destructive destination restoration is separate.
* Private recovery extraction and optional CLI core/drop-in restoration. Destination wp-config.php, root .htaccess and web.config are never blindly overwritten.

EXISTING FEATURES:
Streaming DSV compression/encryption, checksums, complete verification before live changes, staged restore, rollback journal, component/exclusion controls, local retention, administrator/nonce checks, symlink and traversal checks, range downloads, chunked imports, and WP-CLI diagnostics/recovery.

IMPORTANT LIMITS:
WPRESS interoperability is standard, unencrypted/uncompressed SINGLE-SITE only. Encrypted backups, incremental chains and network migrations use DSV. ServMask encrypted/compressed and multisite-extension archives are not supported. DSV network recovery requires matching topology and main-site ID 1; externally mapped domains and changes of network URL scheme/base path require separately validated mappings. Cross-version/core/plugin compatibility is not universal.

MySQL/MariaDB supported tables only; WordPress-prefix tables are included, not unrelated applications sharing the database. Views, triggers, foreign keys, partitioning and unsupported schemas are not supported. Each DSV JSON record is capped at 4 MiB (base64 values reduce the raw row-size limit); conversion SQL statements are capped at 8 MiB. Total archive size has no license cap, but memory, disk, execution time, request limits, database packets and format limits still apply.

A backup is not a consistent live-write snapshot: pause writes/orders/external workers. Core recovery is an explicit CLI operation; normal migration preserves destination configuration/core. Recovery is not one atomic whole-site transaction. Root configuration and database secrets make plaintext WPRESS files highly sensitive. Full mode can include other backup archives inside wp-content; exclude those explicitly if necessary.

See V2-GUIDE.md, ARCHITECTURE.md and TEST-REPORT.md. Use staging and independent host backups. Cloud API behavior was tested locally with a mock S3 API and signatures compared with AWS botocore; live AWS/R2 credentials were not supplied or tested. No production certification or universal compatibility claim is made.

== Installation ==
1. Independently back up the site; finish/cancel existing plugin jobs.
2. Upload doodle-site-vault-2.1.0.zip under Plugins > Add New > Upload Plugin. Replace the installed version if prompted.
3. Activate and open Site Vault. PHP 8.1+ 64-bit, OpenSSL, zlib, MySQL/MariaDB and private writable storage are required.
4. Configure DSV_STORAGE_DIR outside ALL web-served directories in wp-config.php for durable backups. Temporary storage is not a disaster-recovery plan.
5. For full single-site WPRESS, leave both full-directory checkboxes enabled, choose Standard .wpress and create the backup. Review the plaintext warning, then download WPRESS.
6. Use DSV for encrypted/network/incremental backups. See the guide for advanced CLI recipes.

== Frequently Asked Questions ==
= Does WPRESS mean the whole server can be imported anywhere? =
No. It is a WordPress archive, not a hosting account/OS/email/DNS backup. Compatible WordPress/PHP/database/filesystem environments are required. Native ServMask imports database and wp-content; extra root recovery data is handled by this plugin.

= Are all commercial extension features identical? =
No. The five requested feature categories have original implementations with documented boundaries. There is no cloud OAuth UI, Google Drive/Dropbox connector, multisite topology conversion, incremental database replication, service SLA or automatic commercial updater.

= Can encrypted DSV backups be opened by ServMask? =
No. Export a standard unencrypted WPRESS explicitly if interoperability is needed. Doing so exposes plaintext backup secrets and requires consent.

= Can I restore version 1 DSV files? =
The original archive format is retained. Original v1 archive import/restore paths were regression-tested. Old archives cannot contain files that v1 never exported. Create a fresh v2 full baseline for incremental backups.

= Does deleting a backup delete cloud data? =
No. Local deletion/retention does not delete remote S3 objects. Configure bucket lifecycle rules independently. Incremental ancestors are retained while local descendants depend on them.

= What remains after deactivation? =
Archives, manifests, protected settings, pairing/checkpoint data and recovery files/tables remain. Deactivation clears plugin schedules. Explicitly clean recovery jobs and remove data only after validating recovery.

== Changelog ==
= 2.1.0 =
Operational dry-runs and SHA-256 reports, resumable uploads, optional encrypted scheduled off-site queue, activity/health, completion hook isolation and upload/path safety fixes. See V2.1-GUIDE.md.

= 2.0.0 =
Full-directory recovery; standard WPRESS interoperability; incremental files; same-topology networks; encrypted/custom scheduling; S3 multipart/range tools; paired direct transfer; private extraction; tests and updated documentation.
= 1.0.0 =
Initial independent DSV backup/migration implementation.
