XOOPS · mambax7 · Sep 22, 2026 · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,45 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project uses [Semantic Versioning](https://semver.org/) with pre-release tags
 (`1.0.0-alpha.N`).
 
+## Unreleased
+
+_Nothing yet._
+
+## [1.0.0-alpha.3] — 1.0.0 Alpha 3 — 2026-09-21
+
+### Fixed (Goffy / wgSimpleAcc field report)
+
+- Inspections no longer report every finding twice (file-level `visitFile` now runs only on the view-provider's primary PSI file).
+- `isResultSet` quick-fix inserts before the current PSI statement (Inspect Code batch apply no longer no-ops after the first click in a file).
+- An early-exit `isResultSet` / `mysqli_result` guard covers later `fetch*` of the same variable, including `while (list(...) = $db->fetchRow($result))`.
+- ROOT_PATH guard: `die` and `exit` after `namespace` / `use` are recognized; the quick-fix inserts *after* the namespace (never before — invalid PHP).
+- ROOT_PATH guard is not required on 404/403 directory stubs, `admin/` CP scripts, `xoops_version.php`, or files whose first work is including `mainfile.php` / `header.php` / `admin_header.php`.
+
+### Fixed (release review, PR #4)
+
+- Replaced deprecated `StartupActivity` with `ProjectActivity`.
+- `FilenameIndex.getVirtualFilesByName` now passes `Project` (the two-arg overload is deprecated).
+- Marketplace Plugin Verifier **Critical** on IntelliJ IDEA is the missing `com.jetbrains.php` plugin in IU, not a PhpStorm incompatibility — verify against PhpStorm.
+- Persist Alpha 2 `coreProfile` into `coreVersion` (legacy-only XML keeps 2.5/2.7/4.0; explicit new `Auto` is not overwritten).
+- Batch isResultSet quick-fix reuses inspection analysis at the fetch offset; reassignment inside a positive `if` is unguarded.
+- ROOT_PATH open-tag handling is shared (`<?php` and `<?`); short-tag insert-after-`<?` fallback removed.
+- Language-constant index keeps original spelling; resolution is exact-case (name recognition stays case-insensitive). Only a `$smarty.const.` prefix is stripped.
+- isResultSet reassignment ends at `;`, `,`, an unmatched closer, or `or`/`and`/`xor`; `?:`, `??`, `||`, `&&` keep the fetch inside the assignment.
+- ROOT_PATH guard is still required for includes that start with HTML (quick-fix declines without a file-leading open tag); stub detection ignores `;` inside quotes.
+- `xor` in an early-exit condition is not a dominating isResultSet guard; language-constant cap is enforced before the 5001st name; scanner accepts `templates/…` and `blocks/…` manifest spellings and honours Cancel while walking template trees; the unregistered-template inspection applies the same manifest-spelling rule. A block template at `templates/blocks/foo.tpl` registered as `foo.tpl` (the XOOPS convention) is neither "unregistered" nor "missing"; `$modversion['blocks'][1]['template'] = '…'` assignment syntax is read as a registration alongside `'template' => '…'`; commented-out entries are ignored by the scanner too. A positive `isResultSet(...) xor …` guard is not a guard. The comment mask steps over quoted strings, so `//` or `#` inside a string (a URL in a description) no longer hides the rest of the line from the manifest, guard and template readers. A `module.json`-only module is not scanned for unregistered templates. The missing-registered-template inspection reads the manifest through the comment-only mask (it had masked the string literals it needed and never reported). `define()` must be a real call (`mydefine('_MI_…')` is not indexed). The register-template quick-fix ignores commented-out entries. A positive `isResultSet` guard does not cover a fetch inside a closure. The ROOT_PATH quick-fix is attached only where it can insert. An unreadable or oversized `xoops_version.php` yields one `SCAN_ERROR` instead of every template being reported unregistered. Commented-out `define()` lines are not indexed as language constants. Heredoc/nowdoc bodies are skipped by the comment-only mask, so `//` or `/*` inside them cannot hide later code. A VFS event on the `language` directory itself invalidates the constant cache. A `define()` inside a string literal is not indexed. Unbraced `if`/`while`/`for`/`foreach` bodies are reported without an isResultSet quick-fix; add braces before applying the guard fix. Bootstrap detection matches exact filenames (`custom-header.php`, `mainfile.php.bak` do not count). Template registrations are read only from `$modversion['templates']` / `$modversion['blocks']` statements (shared `XoopsManifestTemplates` reader). An `elseif` early exit is not a dominating guard. Core version detection ignores `12.5` / `12.7` / `14.0`. The isResultSet quick-fix declines when the statement assigns the result before fetching. Ctrl+B prefers a `define()` in the same module when several modules define the same name.
+
+### Added
+
+- Language-constant completion scans every `language/**/*.php` (not a five-name allowlist).
+- Ctrl+B / Find Usages on `_MI_` / `_AM_` / `_MD_` / `_CO_` / `_MB_` constants (resolves to `define()` in `language/english/` when present).
+- Inspection: `.tpl` on disk under `templates/` or `blocks/` not listed in `xoops_version.php` (inverse of missing registered template), with a register-in-manifest quick-fix.
+- Inspection: `XOBJ_DTYPE_UNICODE_*` deprecated since 2.7.3, rename quick-fix to the non-UNICODE successor (silent when Core Version is 2.5).
+- JUnit 4 analyzer / policy / scanner / plugin.xml tests.
+
+### Changed
+
+- Plugin version is taken only from `gradle.properties` (`plugin.xml` no longer hard-codes `<version>`).
+
 ## [1.0.0-alpha.2] — 1.0.0 Alpha 2 — 2026-08-12
 
 ### Fixed
@@ -23,7 +62,7 @@ and this project uses [Semantic Versioning](https://semver.org/) with pre-releas
 
 ## [1.0.0-alpha.1] — 1.0.0 Alpha 1 — 2026-08-11
 
-First public alpha of **XOOPS Support** — a PhpStorm / IntelliJ helper for XOOPS 2.5 / 2.7 / 4.0 module and core work.
+First public alpha of **XOOPS Support** — a PhpStorm / IntelliJ helper for XOOPS 2.5 / 2.7 / 4.0 Core and module development.
 
 Early preview: APIs, inspections, and quick fixes may change before a stable 1.0.
 
@@ -44,7 +83,7 @@ Early preview: APIs, inspections, and quick fixes may change before a stable 1.0
   - Wrong Smarty delimiters (XOOPS `<{ … }>` vs bare `{ … }`)
 - **Live templates** — `xoguard`, `xofetch`, `xofetchdb`, `xohead`, `xolang`, `xocriteria`, `xorequest`, `xoexec`
 - **Language-constant completion** — `_MI_` / `_AM_` / `_MD_` / … from `language/**/*.php`, with project cache and VFS invalidation
-- **Settings** — enable/disable, suppress startup notification, core profile, table prefix
+- **Settings** — enable/disable, suppress startup notification, Core Version, table prefix
 - **Dynamic plugin** — no `require-restart`; install / disable / enable without IDE restart when unload succeeds
 - **CI / release** — GitHub Actions (`check`, `verifyPlugin`, `buildPlugin`); tag `v*` must match `pluginVersion`
 - **Compatibility** — PhpStorm **2024.3+** (`since-build=243`, open-ended `until-build` for 2025.x / 2026.2.x)
@@ -56,4 +95,6 @@ Early preview: APIs, inspections, and quick fixes may change before a stable 1.0
 - Overview scans are sequenced so a slower older scan cannot overwrite a newer refresh
 - License: GPL-2.0 (SPDX **GPL-2.0-or-later** in packaging docs)
 
+[1.0.0-alpha.3]: https://github.com/XOOPS/phpstorm-plugin/releases/tag/v1.0.0-alpha.3
+[1.0.0-alpha.2]: https://github.com/XOOPS/phpstorm-plugin/releases/tag/v1.0.0-alpha.2
 [1.0.0-alpha.1]: https://github.com/XOOPS/phpstorm-plugin/releases/tag/v1.0.0-alpha.1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -24,6 +24,9 @@ Thanks for helping improve the PhpStorm plugin for XOOPS developers.
 
 - Java 21, package root `org.xoops.support`.
 - Keep inspections **fast and heuristic** unless a full PSI analysis is clearly worth it.
+- File-level `visitFile` inspections must call `PhpTextUtil.isPrimaryPsiFile` (PHP+HTML dual PSI).
+- Quick-fixes compute ranges from the PSI element at apply-time, not frozen offsets.
+- Tests are **JUnit 4** (`org.junit.Test`, public classes/methods) via `testFramework(TestFrameworkType.Platform)`. Jupiter will not start the IPG executor.
 - Prefer **quick fixes** that are safe and local (single file / small edit).
 - Do not hard-code AI vendor names or branding in UI strings.
 - Index / PSI access from background threads must use `ReadAction` (see `XoopsProjectService`).
@@ -38,11 +41,11 @@ CI runs the same command set.
 
 ## Version bumps
 
-1. Update `pluginVersion` in `gradle.properties`.
-2. Update `<version>` and change-notes in `src/main/resources/META-INF/plugin.xml`.
-3. Update `CHANGELOG.md` and `whats-new.html`.
+1. Update `pluginVersion` in `gradle.properties` (this is the single source; do not add `<version>` to `plugin.xml`).
+2. Update change-notes in `src/main/resources/META-INF/plugin.xml`.
+3. Update `CHANGELOG.md` and `whats-new.html` (and the version table in `README.md`).
 4. Tag release with the **same** version as `pluginVersion` in `gradle.properties`, e.g.  
-   `git tag v1.0.0-alpha.1 && git push origin v1.0.0-alpha.1` (triggers release workflow).
+   `git tag v1.0.0-alpha.3 && git push origin v1.0.0-alpha.3` (triggers release workflow).
 
 ## Reporting issues
 

diff --git a/README.md b/README.md
@@ -8,15 +8,15 @@ It brings XOOPS conventions into the IDE: inspections with Alt+Enter quick fixes
 | --- | --- |
 | Repository | [github.com/XOOPS/phpstorm-plugin](https://github.com/XOOPS/phpstorm-plugin) |
 | Plugin id | `org.xoops.plugin.support` |
-| Version | **1.0.0 Alpha 1** (`1.0.0-alpha.1`) |
+| Version | **1.0.0 Alpha 3** (`1.0.0-alpha.3`) |
 | Compatibility | PhpStorm **2024.3+** (since-build `243`, no upper cap — includes **2026.2.x**) |
 | License | [GPL-2.0-or-later](LICENSE) |
 
 ## Features
 
-- **Inspections + quick fixes** — root-path guards, `isResultSet` before `fetch*`, `query()` vs `exec()`, deprecated `queryF`/`quoteString`, missing registered templates, wrong Smarty delimiters, `include` → `include_once` for headers. For input: **keyed** `$_GET`/`$_POST`/`$_COOKIE['key']` offer `\Xmf\Request::getString` fixes; **bare** `$_GET`/`$_POST`/`$_REQUEST`/`$_COOKIE` and **keyed `$_REQUEST`** are warnings only (no auto-fix when the source is ambiguous)
+- **Inspections + quick fixes** — root-path guards (namespaced files; 404/entry-point skips), `isResultSet` before `fetch*` (including `while (list = fetchRow)`), `query()` vs `exec()`, deprecated `queryF`/`quoteString` and `XOBJ_DTYPE_UNICODE_*`, missing *and unregistered* templates, wrong Smarty delimiters, `include` → `include_once` for headers. For input: **keyed** `$_GET`/`$_POST`/`$_COOKIE['key']` offer `\Xmf\Request::getString` fixes; **bare** `$_GET`/`$_POST`/`$_REQUEST`/`$_COOKIE` and **keyed `$_REQUEST`** are warnings only (no auto-fix when the source is ambiguous)
 - **Live templates** — `xoguard`, `xofetch`, `xofetchdb`, `xohead`, `xolang`, `xocriteria`, `xorequest`, `xoexec`
-- **Language constants** — completion for `_MI_` / `_AM_` / `_MD_` / … from `language/**/*.php`
+- **Language constants** — completion and Ctrl+B for `_MI_` / `_AM_` / `_MD_` / `_CO_` / `_MB_` from every `language/**/*.php`
 - **Project tools** — detection balloon, scanner tool window, **Tools → XOOPS Support**
 - **Module scaffold** — legacy or hybrid (PSR-4 / composer) via **New → XOOPS Module…**
 
@@ -81,7 +81,7 @@ xoops-support/
 Edit `gradle.properties` for version and platform target:
 
 ```properties
-pluginVersion=1.0.0-alpha.1
+pluginVersion=1.0.0-alpha.3
 platformVersion=2024.3.5
 pluginSinceBuild=243
 pluginUntilBuild=          # empty = open-ended (2026.2+)