[RensTillmann]

Summary

src/
├── assets/js/              # PDF recovery, eligible Enter/Next, tab/click, builder rejection recovery
├── includes/class-ajax.php # administrator/nonce guards and invisible-column validation
├── includes/class-shortcodes.php # ordered font setup and language reactivation
├── super-forms.php         # 6.4.010 metadata and localized error messages
└── docs/changelog.md       # beta release notes

Base: release/6.4.x, because these are beta counterparts of applicable fixes already shipped in LTS 6.3.323. No LTS-only Button/Divider feature, unrelated beta drafts, vendor changes or stored-data migrations. PHP minimum remains 7.4; Tested-up-to becomes 7.1.3, verified in the runtime matrix.

Evidence

• Before: the exact published 6.4.009 ZIP reproduced seven failures across PDF recovery/font order, subscriber builder access, hidden-submit Enter, invisible columns and tab/click; five targeted checks already passed.
  After: all 14 targeted browser/AJAX checks pass on source-built commit 4bcf439ac0aad5893b2f623997b0b4006262b09d, including the previously passing admin/debug paths.
• Independent review found two edge cases: Cyrillic–Arabic–Cyrillic font reactivation and an eligible Next after ineligible buttons. Both were reproduced before fixing and have passing browser regressions. No unresolved spec-parity finding.
• The release builder produced identical ZIPs twice; package contract, version/changelog assertions and secret scan passed. Existing reviewed Google Auth conditional-PHP vendor allowance is unchanged; no blanket lint exemption was used.
• Full qualification accepted: run 20261021-022316-6d01e0, exact source-built ZIP SHA-256 6e7346b1bbbccb6372284efca738c4fa237a0a38661e706867d98736977bf19d. Browser report: 101 passed, 0 failed, 0 flaky, 7 declared skips. PHPUnit: 612 tests / 10,285 assertions, no failures/errors/warnings; its one HTTP-upload-only skip is covered by a passing browser/server proof. Candidate security, CVE proof and skip coverage are green.
• Upgrade/runtime/payment proof: historical6.4.007 upload upgrade passed. Actual published6.4.009 upgrade preserved form/entry hashes in all four PHP7.4/8.3 × WordPress7.1.3/7.0.7 cells; submission, Stripe, PayPal, PHP logs and restoration passed in each. Every installed candidate payload matched the ZIP inventory.
• Actual browser smoke: required and malformed-email submissions saved no entry; corrected input displayed the success popup and persisted exact values. Two deliberate valid submissions saved one entry each; owned fixtures were removed. Actual GitBook revision navigation and mobile documentation preview also verified in docs: prepare beta 6.4.010 publication #300.
• Preparation failures remain preserved: an initial browser-closure/print-cleanup failure has no confirmed cause; subsequent isolated security/print runs passed. Stripe's hosted page requested static SDK resources blocked by the sandbox. The harness now allows the exact js.klarna.com and js.playground.klarna.com browser asset hosts, with WordPress/Node egress unchanged and no console-error exemption. Only the final accepted run is in the qualified report; old baseline failures are separate.
• Awaiting owner approval: version 6.4.010, commit 4bcf439ac0aad5893b2f623997b0b4006262b09d, exact ZIP hash above. No tag, release, updater change or live documentation merge is authorized yet.

Merge Danger

Door: two-way

No settings/form/entry migration. Reverting security guards would reopen the protected builder requests. Product publication, tags and updater changes remain pending approval of the exact qualified ZIP.

Blast Radius: forms

Beta form submission/validation, PDF generation, keyboard navigation and builder requests. Stable 6.3.323, current published beta downloads, email drafts and documentation publication are unchanged by this PR.