This release rolls up the fixes and hardening work from the original 1.0.0 package into a single recommended update.
Fixed
Fixed automatic src/config.php bootstrap insertion so the guard hook is inserted after the opening <?php line instead of being appended to the end of the file.
Improved bootstrap write/remove safety during install, upgrade, and uninstall.
Removed persistent src/config.php backup files so database credentials and XenForo secrets are not left behind in non-standard files.
Temporary config write files now use a hidden .php filename so they are not exposed as plain text if ever stranded.
Removed numeric and hex path collapsing from request normalisation.
Paths such as /example/123 and /example/321 are now treated as separate paths instead of being grouped together.
Changed counter writes to use non-blocking locks.
Changed counter reads to use shared non-blocking locks.
Changed recent-hit logging to use non-blocking locks.
Removed development scaffold files from the release package.
Improved
Added dashboard health checks for:
bootstrap presence
bootstrap file existence
config writability
effective guard status
state file validity
Changed early guard state storage from executable PHP to JSON.
Updated the early bootstrap loader to read and validate JSON state safely.
Reduced false-positive risk around numeric URLs, guest 404s, and temporary bad route hits.
Retained fail-open behaviour so the forum continues operating normally if Surge Guard state is unavailable, stale, invalid, or unreadable.
Security / Hardening
Removed persistent config backups to avoid leaving sensitive XenForo configuration data on the server.
Replaced executable PHP state storage with JSON-based state storage.
Improved early-bootstrap safety while keeping the guard lightweight.
Reduced lock contention during high-volume bad-request bursts.
Upgrade recommendation
This is the recommended version for all users. Users on 1.0.0 should upgrade directly to 1.0.3.
