# Batoi Press 0.4.0

Batoi Press 0.4.0 starts the operational-hardening track for pre-1.0 production pilots, with governed user lifecycle management and stronger release verification.

## Highlights

- User lifecycle controls in Admin Console:
  - edit user email and role
  - reset passwords
  - disable and reactivate accounts
  - filter users by search term, role, and status
- Owner safeguards:
  - the current user cannot disable their own account
  - the last active owner account cannot be disabled
  - the last active owner account cannot be demoted
- Disabled users cannot sign in, and already-authenticated disabled users are treated as signed out on the next auth check.
- User lifecycle changes are written to the audit log.
- Smoke coverage now verifies that disabled users cannot authenticate.

## Versioning

- `radpress/config/update.json` is incremented to `0.4.0`.
- Release package and public `latest.json` manifest should be generated from that version.

## Verification

- PHP syntax, smoke, update, package, and manifest checks passed.

## Follow-Up Before 1.0.0

Continue hardening with broader list filtering, update safety coverage, and optional package-trust groundwork.
