**Major release:** decoupled storage from blur, customer-intel protection, self-hosted updates, and a Debug Log page for diagnosing silent installs. - New `Customer Map → Debug Log` page with env, queue, cron, shutdown-hook health, recent failures, a ring-buffered event log, a live Nominatim probe, and a copy-report-to-clipboard button. - Instrumented logging at upgrade, cron self-heal, shutdown-hook gates, batch start/end, and per-order geocode results. - Schema gains `lat_orig` / `lng_orig` (dbDelta migration; legacy rows backfilled from current `lat`/`lng`). - Blur radius now configured in **km** (default 3, max 500). - Blur is deterministic per-row and applied at query time — change the radius and existing data shifts immediately, no re-geocode required. - Public AJAX strips order counts. Popups show only city/country; stats bar shows countries + cities. - Remote single-customer locations still appear (marketing angle), but competitors can no longer derive sales numbers from the public map. - Public requests are clamped to MAX(site default, requested) — a shortcode can ask for more anonymisation, never less. - Live blur slider on the admin map. - Live shortcode preview that mirrors the current product filter + blur, with copy-to-clipboard. - New \`[customer_map blur="..."]\` shortcode attribute. - Plugin polls gitlab.nolle.engineering/tools/customer-map for new releases, surfaces them in the standard wp-admin update flow. - Auto-update **disabled by default** — operators opt in per-install via the standard Plugins screen link. - Manual "Check for updates now" button on the Debug Log page. - New \`ncm_blur_radius_km\` (default 3). - New \`NCM_UPDATE_PROJECT\` constant for installs hosted on a different GitLab path.