[arosasg]

An approved customer could keep accessing [didit_gate] content after a signed revocation if they had started another verification attempt.
The pending session pointer had moved, so the webhook updated the old session record but left the user's approval active.

Apply confirmed decisions to either the pending session or the session currently granting access.
Read the recorded decision when displaying status or checking access so revocations received before upgrading also take effect.
Updates to an obsolete session still cannot overwrite a newer approval.
Prepare WordPress release 0.3.4 with regression coverage for declined, expired, KYC-expired, review, superseded, and out-of-order decisions.

Validation:

• Reproduced on the official 0.3.3 plugin in WordPress 7.1.2 over HTTP: real login, session creation, signed webhook, and rendered protected content.
• The same journey passes with the fix, including a newer approval surviving an old session's revocation and a current expiry locking content.
• Upstream Didit responses use a local synthetic fixture; no production customer data was used.
• All 102 PHP assertions pass locally, plus syntax and diff checks.

PR #9 superseded the broader browser-callback implementation in #8.
This carries its remaining revocation behavior forward without replacing the session binding and branding now on main.