Clinical Training Logbook Changelog – Dantian Digital Studio

Release history for Clinical Training Logbook. See the Clinical Training Logbook user guide for how each feature works.

Clinical Training Logbook (Free) — 1.0.0 (2026-10-04)

Added

Deleting a WordPress user now handles their logbook data: choosing “Attribute all content to” moves all their entries to the surviving user (previously WordPress moved only posts, silently orphaning logbook records), while “Delete all content” removes the entries and their evidence files through the plugin’s normal deletion path. The delete confirmation screen warns with the student’s actual logbook data counts before you decide.
Layered requirement rules for one intervention (for example “5 across all clinics” plus “at least 3 in one clinic”) now display as a single consolidated unit everywhere: one card per intervention on the student overview with each rule as its own labelled progress bar, and grouped rows under one intervention cell in the admin Requirements table. Each requirement row gains an “Add rule” shortcut that opens the form pre-filled for adding a companion rule to the same intervention.

Fixed

The entry form’s intervention pickers now respect the selected level and clinic type, so students no longer see interventions configured for a different level.
Requirement form: the optional client age-range panel no longer opens expanded on every edit; the first clinic type is no longer silently attached to newly added requirements, and editing preserves the stored clinic scope; a requirement targeting a specific diagnostic, advice, or case-detail item keeps that item selected on edit instead of silently widening to the whole category on save.

Security

Updater classes gained direct-access guards, and the post-licence-activation redirect now uses WordPress’s safe-redirect API.

Accessibility

Dark mode: solid buttons and status badges now use dedicated fill colours that keep white text readable (WCAG AA) — previously the primary action button could drop to ~2:1 contrast with the OS in dark mode. The success badge colour was also corrected in light mode.
Dialogs and the entry form landmark now always carry an accessible name for screen readers; progress cards announce their numeric progress (“3 of 5 required logged”), and the setup wizard traps keyboard focus while open.
Small action buttons meet the 24px minimum target size; the admin Usage Analytics page gains dark-mode and Windows High Contrast support.
Settings tables no longer mix role="presentation" with <th scope="row"> (WCAG 1.3.1); label associations preserved.
Cloud-storage status messages and the migration progress bar now use the plugin’s semantic colour tokens, so they adapt in dark mode and honour reduced-motion; status meaning never relies on colour alone.

Privacy

Uninstall now also removes the storage-failure log, every admin’s setup-wizard dismissal flag, and the activation-welcome transient, so a full wipe leaves no plugin rows behind.
Voice dictation now discloses — in the suggested privacy-policy text, the readme, and the in-app voice help — that the browser’s speech recognition may send dictated audio to the browser vendor for transcription. The plugin itself never receives the audio; typing always works.
The personal-data export now includes the legacy chronic/mental health fields where a migrated site holds values.

Changed

The admin sidebar item for student entries is now labelled “Logbook Entries” to match the page it opens.
Unified the internal admin-AJAX nonce convention on the WordPress-standard _ajax_nonce key across all handlers (no behaviour change; security parity).

Performance

Added a database index for date-ordered entry queries (schema 1.2.0; applied automatically on update).
Student lists no longer issue one extra query per student for names on Pro admin pages.

Removed

Removed an unused internal progress-cache table (new installs no longer create it) and several dead internal code paths left over from earlier refactors, including an unreachable delete handler and an inert upload hook.
Removed a dead, unreachable cohort requirement-preview code path left over from an earlier refactor.

Added

WordPress Privacy API integration: personal-data exporter and eraser for student treatment records, plus suggested privacy-policy content. An erasure request also deletes the student’s uploaded evidence files.
Opt-in clean uninstall: a Data management section on the Site Setup settings tab with two toggles — delete all plugin data (every table and setting, including Pro data) and delete all uploaded evidence files. Both default off: uninstalling keeps everything unless you consciously opt in. Credentials and API keys are always removed on uninstall regardless.
Onboarding: a Program setup wizard and an in-page setup checklist on the settings hub guide first-time configuration (Levels → Clinic Types → Interventions → Requirements → Clinic Minimums), plus a one-time, dismissible “finish setting up” notice after activation.
A single Upgrade to Pro settings tab — the only place the free plugin mentions Pro. Hidden automatically when Pro is active. No notices, banners, or per-feature teasers anywhere else.
Self-hosted update channel: until the plugin is listed on WordPress.org, the free plugin receives updates directly from the Dantian Health store. (This component is stripped from the WordPress.org build.)

Security

Uploaded clinical evidence is now stored privately — by default in a directory above the public web root (with a deny-file-protected uploads folder as fallback) — and is never publicly downloadable. Files are served only through an authenticated proxy that verifies the viewer is the owning student, an administrator, or (with Pro) an authorised trainer. A security notice warns the administrator if the fallback location is ever web-reachable.
Cloud-storage credentials (Bunny API key and pull token, Google Drive service-account JSON) are now encrypted at rest with authenticated (AEAD) encryption, so a database dump alone yields no usable credential. The master key can be supplied via a DCLB_SECRET_KEY wp-config constant to keep it out of the database entirely; otherwise it is auto-generated. A tampered or wrong-key value fails closed rather than decaying to plaintext.

Changed

Free is now the base of a Free + Pro pair. Pro-specific UI assets (cohorts, reports, journal, migration, allocations, trainer, usage) moved to the Pro add-on; Free retains the shared utilities as the single source of truth.
Free works standalone with open access: the free plugin has no allocation concept — eligible students can submit entries immediately. Allocation-based gating (levels, locking, cohort resolution) is supplied entirely by Pro through extension points with safe open defaults.
The treatment-save AJAX action is now dclb_save_treatment; the old asc_save_treatment name remains as a deprecated alias for one release.
Minimum WordPress version raised to 6.7. Interactive surfaces (tabbed panels and disclosure regions) use the native WordPress Interactivity API, which requires 6.7. Frontend JavaScript loads via the WordPress Script Modules API + import map (per-file delivery, no bundling); shared modules load a single time across the Free/Pro pair instead of being inlined into each bundle.
CSS authored in logical properties (margin-inline, inset-inline, text-align: start) so a single stylesheet renders correctly in both LTR and RTL with no separate RTL stylesheet.
Pro’s progress-snapshot export now uses the browser’s native Print / Save as PDF — no PDF library ships in either plugin (smaller download; system fonts render accented names).
Asset build is now build-time only (no runtime writes into the plugin directory), with a safe fallback to serving src/.

Fixed

Entry-form drafts are now scoped per-user in the browser (a student can no longer see another student’s draft on a shared device).
Sanitised a clinic-minimums filter input (wp_unslash); hardened the theme-token <style> output against CSS injection (sanitize_hex_color).
The setup wizard no longer re-opens on top of the page a step button just navigated to; it auto-opens only on the first visit or via the “Open setup wizard” button.
Links inside WordPress admin notices stay readable when the plugin’s dark mode is active.

Security

Distribution package no longer includes development files or any credentials; package size reduced from ~21 MB to ~321 KB.

Accessibility

Corrected focus tracking to use the element’s ownerDocument; added a global reduced-motion reset across plugin surfaces.

Clinical Training Logbook Pro — 1.0.0 (2026-10-04)

Added

Layered requirement rules for one intervention now display grouped on the Reports progress cards and the cohort snapshot table (matching Free’s consolidated overview cards), with per-rule progress inside each group.
When a WordPress user is deleted with “Attribute all content to”, Pro’s data now follows the entries to the surviving user: allocations (a duplicate active allocation for the same level is archived rather than doubled, with a history record of the merge), allocation history, evidence attachments, evidence-object index, and the audit log’s student references. Without attribution, Pro removes the student’s allocations, allocation history, and trainer feedback alongside the entries. The delete confirmation warning includes Pro’s attachment and active-allocation counts.

Fixed

Privacy: a GDPR erasure request now removes the trainer feedback attached to the erased student’s entries. Previously the feedback rows could survive the erasure (they were resolved via entries another step had already deleted) and linger orphaned in the database.

Changed

Deleting an allocation now requires the server-side confirmation token the delete dialog sends — a scripted request without it is rejected (defence in depth; the visible flow is unchanged).
Deleting a logbook entry (admin delete, or as part of an erasure) now also deletes any trainer feedback left on that entry’s reflection. Feedback on a deleted clinical record has no referent; previously it remained in the database, invisible but recoverable by direct SQL. Feedback rows already orphaned by deletions made on earlier versions are not swept automatically.

Added

First public release of Dantian Clinical Training Logbook Pro — the institutional add-on for the free Dantian Clinical Training Logbook plugin (requires Free 1.0.0+ active).
Allocations — single and batch student-to-level allocation with status tracking, locking, audit history, and a confirmation on create. Cohorts are optional: allocate directly to a level, or pick a cohort to set the level automatically and scope the student to its trainers.
Cohorts (Cohort Profiles tab) — level links, trainer assignment, requirement-snapshot preview, per-cohort requirement overrides.
Trainer Workspace ([dclb_trainer_workspace]) — cohort/student selection, entry list with filters, entry detail with inline notes preview, journal view, reflection feedback.
Student shortcodes — reflection journal ([dclb_journal]) and usage insights ([dclb_usage]).
Reporting suite — Student Entries (filters, CSV export, sortable columns, admin delete, progress-snapshot PDF export via the browser’s print dialog), Journal Overview, Cohort Progress matrix, Usage Analytics, and the treatment Migration Workspace.
Two-track evidence review — independent Privacy and Notes Completeness tracks with configurable standard reasons, student notification emails, and optional exclusion of flagged entries from progress. Both OFF by default.
Reflection feedback — trainer/admin feedback on reflections with optional student email. OFF by default.
Cloud storage — Bunny CDN direct uploads and Google Drive backend with per-student subfolders, bidirectional storage migration, unlinked-files cleanup, and authenticated streaming of cloud evidence (credentials can be locked via wp-config.php constants).
Soft evidence enforcement + weekly reminder emails — configurable day/time/subject/body; the email and the on-screen reflection chips share one evaluator and always agree.
Treatment audit log, dashboard widget, and the configurable terminology pack (rename Treatment / Client / intervention-category labels).
Licensing — enter and manage your license key on the Licensing settings tab. A valid license enables automatic Pro updates and is re-checked daily. Licensing is soft: an expired or missing key never locks features or affects students — it pauses updates and shows administrators a single dismissible reminder.
Allocation gating is supplied to the free plugin through its extension points: with Pro active, students log against active allocations; without Pro, the free plugin remains open-access.
Trainer access to evidence downloads: the free plugin’s authenticated file proxy admits authorised trainers for their cohorts’ students; cloud-stored evidence streams through the same proxy.
Uninstall honours the free plugin’s Data management toggles: by default all Pro tables, settings, and evidence are retained; opting in removes Pro data and Pro-managed evidence too.
Automatic allocation locking (optional, off by default) — turn on “lock automatically when complete” on the Student Allocations page and a student’s allocation locks itself once every required requirement for its level is met (including any required notes/reflection). You can still unlock manually.
Journal Overview CSV export — an Export CSV button downloads the filtered reflections (UTF-8, opens cleanly in Excel).
Journal Overview pagination — a “Load more” control on the admin Journal Overview and the [dclb_journal] surface reveals reflections beyond the first page, so students with many entries are shown in full (previously the view stopped at the first 25 with no way to reach older ones).

Changed

The Journal Overview now shows all treatments by default rather than only those with a reflection, so recently-logged entries still awaiting a reflection are visible.

Security

Cloud-storage credentials (Bunny API key and pull token, Google Drive service-account JSON) are now encrypted at rest with authenticated (AEAD) encryption, so a database dump alone yields no usable credential. Credential reveals fail closed on a tampered or wrong-key value rather than decaying to plaintext. The master key can be supplied via a DCLB_SECRET_KEY wp-config constant — the Cloud Storage settings surface recommends this — to keep it out of the database. Uninstall purges the stored credentials and master key.

Privacy

A GDPR erasure now removes Bunny-stored cloud evidence on the scheduled cleanup as well as Google Drive (previously an index-tracked Bunny object could be left behind). The personal-data export includes trainer review-flag reasons about the student’s own entries.

Internationalisation

Trainer Workspace interface strings are now translatable (delivered through the plugin’s config data so a Script Module can localise them).

Fixed

Weekly reminder digests no longer chase evidence the clinic type does not require. An entry is listed only when a required item is missing — required notes with nothing uploaded, or a required reflection that is empty or below the minimum word count. Previously the digest flagged any entry without a notes upload regardless of whether notes were required, so students logging Self treatments (reflection required, notes not) were emailed weekly about “missing required evidence” they had no way to supply, contradicting the completed chips on their own overview.
The Journal Overview “All treatments” filter now genuinely includes treatments without a reflection; it previously fell through to a secondary flag and still hid them, so “All” behaved like “With reflections”.
Weekly reminder digests are deduplicated per week — re-running the schedule in the same week no longer re-sends the same digest.
License reminder notices no longer stack and stay dismissed after an administrator dismisses them.
License notice text meets contrast requirements in dark mode.