Changelog

13 October 2026

Hear a line of the transcript

• Click a line of a session transcript to hear it. The recording plays from that line, and the line being heard is marked as it goes. Quiet speech is lifted so a whisper can be heard.
• Change who said a line. The same click offers the speakers: give the line to the other voice when it landed with the wrong one. The rest of the transcript is untouched, and the line shows "set by you".
• Session audio is kept for 90 days (it was 30), so there is time to listen back. A client who wants their audio gone sooner can have 30 days: a box on the consent screen, or "delete audio after 30 days" in a session's … menu. It applies to their recordings already kept, too. Each recording keeps the window its client was told, so a later change to the setting never keeps audio longer.
• A client repeating your words stays the client. In some ways of working the client says the therapist's words back. The working document now keeps those lines with the client.

7 October 2026

The online demo: a copy of your own

• Each visitor to the online demo gets their own copy of the fictional practice. Nothing one visitor does shows up for another, and nothing is kept once they leave. Start again in the demo's banner begins a fresh copy.
• The demo does what the app does. Adding a colleague, setting a sign-in PIN, deleting a client, the booking page, the travel log, client resource pages and the full Workshop conversation all work there now. Exports download in the browser, and email drafts open in your own email program. Nothing is sent.
• Still switched off in the demo: connecting a calendar, a bank feed or a mailbox, and buying a plan.

1 October 2026

Choose how updates install

• Updates can wait for you. Settings → System & data → Updates offers two choices. Install automatically works as before: a new version downloads in the background and applies when Peribolos restarts — overnight if it is left idle, never during a recording. Ask before installing holds a new version until you choose Install now — on the Settings card, on the update notice, or from the tray icon. Nothing downloads before then.
• Every release is tested as it ships. Before a release is built, the full set of checks runs on the Python and packages the app installs on a Mac. A release that fails them is never built.
• The app installs exactly what was tested. A new install, and an update that changes them, installs the packages Peribolos runs on at the versions the release was tested with, and checks each file against a recorded fingerprint before using it. This applies on Windows, Apple Silicon Macs from macOS 14 and Intel Macs from macOS 11; older Macs install as before.

30 September 2026

(later) — A locked note takes addenda only

• A locked clinical note can't be rewritten. Lock Now says only addendums are possible after locking, but a locked note also offered Edit (unlock), which replaced its whole text. That button has gone. A locked note now takes only an addendum, added below what was written. A rewrite made before this still shows in the note's history and in a clinical-record export.
• Lock Now waits for an edit that is saving. Pressed while an edit to the same note was being saved, a lock could land in between and the edit was then written over the locked note. The lock now lands after the edit. An addendum made as a note locks is dated after the lock, never before.

30 September 2026

A changed note no longer reads as verified

• The integrity check compares a note with its last recorded revision. Under each note in an exported clinical record, "Integrity verified at export" now appears only when the note's text matches its hash and that hash is the one its last recorded revision carries. The ✓ on a note in the Office follows the same rule. Until now a note whose text and hash had been replaced together, with no revision recorded, still read as verified, and so did a note with no revisions at all.
• A note that doesn't verify says why. Under the note in the export, and on the ⚠ beside it in the Office: "Hash mismatch — this text does not match the note's last recorded revision", or "No revision history — this note has no recorded revisions to check its text against". A note whose text doesn't match its own hash says what it said before.

30 September 2026

Workshop material in the data export

• The Data export card offers process notes, recordings and the Workshop's material. Each is a box under the practice record in Settings → System & data. None is ticked to begin with; what you tick goes in the file. Until now the card offered none of them, so an export left them behind unless the address was typed by hand.
• On a shared practice they aren't offered. They don't record who wrote them, so the file couldn't tell whose they are; the card says so where the boxes would be. If a colleague joins after the card was drawn, pressing Export with boxes ticked saves nothing and says why.

29 September 2026

(later still) — Working documents open in the Workshop

• Read it ▸ opens the working document in the Workshop. In the app, the note that appears when a session has been workshopped opened a new tab showing an error ("Unauthorized") instead of the document. It now opens in the same reading view as expand ▸, whichever client is on screen.
• That note shows the right client's name. If you had moved to another client while a session was being workshopped, it showed the name of the client on screen. It now shows whose session it is.
• Export summary saves the financial year's summary. Finances → Print summary opened the same error in the app. Now called Export summary, it saves the summary into your Downloads folder (as a PDF where Chrome is installed) and shows it in Finder, like the other exports.
• The Welcome page's export link goes to Settings. "Export everything as JSON" replaced the Welcome page with the same error. It now links to Settings → System & data, where Export all data is.

29 September 2026

(later again) — Firsts under goals, and what doesn't fit

• Firsts, under their goals. On each goal, the firsts that show it moving: what happened for the first time in the work, in your words. When one comes round again, mark it; when it holds, say so. A first can sit under no goal yet, at the foot of Goals, and moves to a goal by editing it. Removing a goal keeps its firsts.
• Goals are kept with your process notes. They move, with the goals the weekly review drafts and the sessions each goal was worked in, from the practice record's database to the process notes' one. Goals look and work as before, and each keeps its id, so every link to it holds. A copy of the practice database is kept beside it from just before the move. Goals now travel in a data export's Workshop section.
• What doesn't fit. On the formulation desk, under the integrated hypothesis: material the formulation doesn't account for yet. An item stays until you can say why it fits, and the reason stays with it.
• Two questions at the foot of each workshopped session. "A first today?" (with the goal to keep it under) and, once the desk holds a hypothesis of yours, "Anything that doesn't fit the formulation?". What you write joins the list; nothing is suggested or filled in for you.
• Both lists reach that client's Workshop chat, de-identified like the rest of the case. Neither reaches the clinical record. Both travel in a data export's Workshop section.

29 September 2026

(later) — The Online bookings card, corrected

• The card no longer says Calendly or Acuity bookings arrive for review. Those services don't connect to Peribolos, and the calendar sync never turned one of their bookings into an intake. The card now says so, and links to Intakes, where each booking is added by hand.

29 September 2026

Cal.com bookings on the calendar

• Cal.com bookings now show on the Office calendar. A discovery call booked through Cal.com appears on the Home calendar at its time, in the day, week and month views, beside the sessions. It is marked with a dashed gold edge and is never counted, numbered or invoiced as a session. Selecting it shows when and where the call is, and opens the intake or the client it belongs to.
• Read from the connected Google calendar. The calendar sync reads the bookings Cal.com places there, so no Cal.com key is needed for them to appear. A booking moved or cancelled in Cal.com moves or leaves the calendar on the next sync. The second copy some Apple calendars add from the confirmation email is not shown.
• The day view places every appointment at its time again. Since 20 September, each appointment after the first in a day sat lower than its time by the height of the ones above it.

23 September 2026

(later) — Crash reports you can switch on

• Crash reports stay off unless you switch them on. Once a build carries somewhere to send them, the Office asks once: Turn on or Not now. Not now leaves them off. The switch is in Settings → Privacy & security → Usage and diagnostics.
• What a crash report carries, precisely. The error, its message, the lines of code it passed through and the app version, sent to Sentry in the United States. Client names, email addresses, phone numbers and the home-folder path are removed first, by the same de-identification the Workshop uses. A report that can't be de-identified is not sent. No log history, no local variables, no computer name. Every text in a report is cut to 300 characters, so a message that happens to quote a note leaves as a fragment at most.
• Calendar log lines no longer name the client. Creating an event logs its id and date only.
• Saving Settings no longer records a crash-report choice nobody made. The switch is sent only when it was changed.

23 September 2026

Plans you can cancel yourself; a daily usage signal, on unless you turn it off

• A held plan can be cancelled in the app. Settings → Account now has Cancel plan, with a plain confirm: nothing is charged, the plan runs to the end of the period, then the install moves to the free allowance. Keep my plan undoes it. Payment details and invoices open Stripe's billing page. The card says what choosing a plan actually does: nothing is charged until 1 January 2027, and it can be cancelled any time before then. It no longer says installs will be "asked whether to convert", and the thank-you page no longer says a payment was processed when nothing was charged.
• Terms for the plans. The terms are rewritten for Peribolos Pty Ltd: the free period, the founding rate, billing, cancelling and refunds, with Australian Consumer Law rights stated as untouched. Also at peribolos.app/terms.
• A daily usage signal, on unless you turn it off. Once a day the app sends a random install number and its version, to show that Peribolos is in use. Nothing about your practice, clients or notes goes with it. The number stays the same, so it is random rather than anonymous. New installs choose in setup (the box is ticked). An install that never chose sends nothing until the Office has shown a one-time notice with a Turn off button, and an install that already said no stays off. The switch is in Settings → Privacy & security → Usage and diagnostics. The crash-report switch appears there only once there is somewhere for reports to go.
• Help always shows an address: contact@peribolos.app, where none is set.
• Fixed: the key page printed the name typed into it without escaping it.
• Fixed: in the desktop app, ticking "Send calendar invitations to clients" during setup did nothing. The choice was sent to a place the setup window isn't allowed to write to, and it was lost without a message. Every setup choice is now saved with the practice details and takes effect when Peribolos first opens. Anyone who ticked it before can switch it on under Settings → Calendar.

20 September 2026

Sessions, not renders; one path through a session; the Office leads with today

• The word "render" is gone. A session is workshopped; the button is Workshop it; plans carry sessions a month; the note written after a recording — the one that gates the automatic pass — is the reflective note. The website's pricing and data pages say the same.
• The Workshop's session page is a ladder. Start with (process note or record) → the note or the recording → the reflective note (recording path only) → Workshop it → the clinical note to the record. Each step reads done, current or waiting with a one-line reason; the current step is the prominent one. Nothing underneath changed: dictation, imports, the automatic pass and the recording poll work as before.
• The Office home is Today. The date, one live summary line, today's sessions as rows that open the Workshop's session page, and the week calendar below — redrawn on both Home and the Calendar page: today's column tinted, time and name on each block, the current-time line. The set-up banners fold into one line; the stat tiles move to Finances.
• The client profile has three tabs — Sessions (timeline behind a toggle), Record, Admin — and the header keeps Book session and Open in Workshop with the rest behind "…". Every old tab link still lands.
• The Library's map is the first thing seen. Starting points sit as a strip along its top edge; "more" opens the full panel. The second tab is Texts.
• A path journal, kept on this computer. Which views open, in what order, and which controls are used — keys only, never text, never a client — so the rooms can be laid out from real paths. Read it at /paths; a summary rides in problem reports only when that switch is on.

18 September 2026

The hosted demo does what a downloaded copy does

• Recording, dictation and audio import transcribe on the demo. The demo machine now carries the same CPU transcription engine the app ships on Linux, Windows and Intel Macs (faster-whisper, model baked into the image, nothing downloaded at runtime), so a visitor can record a fictional session, dictate a note or import a clip and read the transcript back. No speaker labels there — the diarization stack stays Apple-Silicon opt-in. The engine script runs without the whisperx wrapper now, which also unblocks the shipped app's non-Apple-Silicon venv (it had installed faster-whisper alone and then asked for whisperx).
• Renders work on the demo. Process, clinical and recording renders go through the demo's own proxy on loopback — the server mints itself a token at boot — so every render is paid from the same daily wallet as the Workshop chat. The old "not available in the demo" lock on the dictate and render buttons is gone.
• The demo says where audio goes. The banner and the recording consent screen name the demo server, not "this device", and ask for fictional material only. Audio is deleted once its transcript is stored; the databases are rebuilt on every restart, as before.
• The demo machine is bigger. 2GB and two shared vCPUs (was 512MB / one), which is what two copies of the model — the server's for dictation and a worker's for a recording — need.

17 September 2026

Moving between clients no longer ends a recording

• Opening another client or session mid-recording keeps the recording running. The warning added on 1 September to stop a room switch from silently ending a capture was catching the Workshop's own left-hand rows too. A click on a Today row or a client — which opens it inside the page — showed "Leave the Workshop and end the recording?", and agreeing reloaded the page, which ended the recording. A session recording on 16 September stopped 46 minutes in, most likely this way; its audio was kept and recovered. Those rows now open in place with nothing asked; leaving for the Office or the Library still asks first.
• Every other way of reloading the Workshop asks first too. The refresh button, opening a global-search result and the health banner's Recheck all reloaded the page with no warning while a recording ran. They now ask, and the question says "reload" when the page is staying in the Workshop rather than "leave".
• Recordings stop on their own after 70 minutes, not 60. A longer-booked session still runs to its booked length plus ten minutes. A length chosen from the picker beside the record button is kept as before.

14 September 2026

Light and dark are chosen per room

• The light/dark toggle is now the room's own. One shared setting had put every room into the same mode, so a Workshop turned dark for the evening took the Office and the Library with it. Each room now keeps its own choice: the Office, the Workshop and the Library are toggled and remembered separately. A choice made before this change carries over as the starting point for each room until it is toggled there.

14 September 2026

Supervision sessions: read off the calendar, and a page of their own

• The calendar's supervision sessions are proposed into the log. Every supervision row had been typed in by hand, months late, from a calendar that already held the session as an event. The Office's CPD page (Supervision Hours) and the Workshop's supervision shelf now list the events in the registration year that read as supervision and aren't logged yet, each with the supervisor, kind and hours read off the title and the duration — corrected in place, then logged with one click. Nothing lands on its own. A title the practitioner has landed once is remembered, so the next event with that title reads the same way; the words the practitioner's own calendar uses ("soup") are added once and kept. An event that wasn't supervision is skipped and stays skipped, reversibly.
• A supervision session has a page in the Workshop, shaped like a client session's: a recording block (record now, import audio, import a transcript — the recording is filed against the session and listed there), a notes block (the clinician's own words, dictation included, autosaved to the working space) and the three reflection prompts, which still compose the Category B review where the rule earns one. Opened from the new Supervision section in the left rail, from the Deliberate Practice home's supervision line, or straight from a calendar proposal ("Log & open"). The hours stay in the Office; the pages live in the Workshop.

11 September 2026

The updater re-checks on the clock, not on awake hours

• A night asleep no longer delays the update check. After an "up to date" answer the app waited six hours before looking again — but that wait ran on a clock that pauses while the Mac sleeps, so on a laptop it meant six hours of use. On the dogfood machine a release sat unnoticed for seventeen hours: the lid closed twenty minutes after the last check and the machine hibernated overnight. The wait is now measured against the wall clock, polled every five minutes, so a check that fell due overnight runs within minutes of waking. The updater log records when a check was overdue and by how much.

11 September 2026

The Office's exports save a file inside the desktop app

• "Export all data", "Export Record" and the NDIS bulk CSV now work in Peribolos.app. Each was a browser download — a link click, or a new tab — which the desktop app's WebView cancels silently (no download handler is installed in the shell), and a new-tab navigation carries none of the bearer token the app puts on its own requests, so the server refused it anyway. In a browser tab the buttons worked; in the app they did nothing. Now the file is saved by Peribolos itself into your Downloads folder (or the folder set as exports.folder in config), shown in Finder / Explorer, and a notice names the file. The same on every surface.
• The legal summary and the intake form save the same way. Finalising a legal summary writes the bundle into the export folder (the disclosure is logged exactly as before, once, and not at all when the save is refused); the intake form lands as intake-form.pdf, or as print-ready intake-form.html when no Chromium-family browser is installed to render a PDF.
• One export folder for the whole product. exports.folder in config.yaml now covers the Workshop's transcript and audio exports too; the day-old recording.export_dir is still read when exports.folder is unset, so a config that set it keeps landing files where it did.
• An export never overwrites an earlier one. A second export the same day lands as name (2), then name (3).
• The hosted demo keeps downloading in the browser. Its server's disk is a Fly machine, so saving there would mean nothing; the demo page uses the download form and the save form refuses.

10 September 2026

Export a session's transcript, and its audio, from the Workshop

• Every recording with a transcript now has an "export transcript" button. It saves a plain-text file to your Downloads folder — speaker labels applied (Therapist / Client rather than SPEAKER_1), each turn stamped with its time, a short header naming the client, session, recording date, duration and how the speakers were labelled — then shows the file in Finder. The filename carries initials, the date and the recording number, never the client's name.
• "Export audio" works inside the desktop app. The old "export ▸" link was a browser download, and the app's window cancels those silently, so in Peribolos.app it did nothing. Both exports are now saved by Peribolos itself and revealed in Finder, the same on every surface. The audio button only appears while the audio is still on this computer.
• Recordings of your own work export too — a supervision or own-practice recording gets the same two buttons in the Own work list.
• Where files land is yours to set. recording.export_dir in config.yaml; empty means Downloads. An export never overwrites an earlier one.

10 September 2026

Facilitated group supervision counts as Category B from 2026-27

• A facilitated group session now earns a Category B CPD entry, from the 2026-2027 registration year. Until now only a peer group without a facilitator did; a group run by a supervisor was logged as supervision hours and nothing else. From 2026-27 both kinds reach the CPD log, with the reflection written beside the session composing into the review, the same way a peer session's already does. Individual supervision is unchanged.
• The rule is gated by registration year, not by today's date. A group session logged for 2025-2026 stays out of the CPD log however the rule reads now, so a return already made never changes shape. Moving a session back a year, like retyping it, removes the entry it no longer earns.
• Sessions logged before the change are caught up. Group sessions already in the 2026-27 year that had no CPD entry get one at the next start (two on the dogfood install); nothing from earlier years is touched.

10 September 2026

Restarting to apply an update now applies it

• The old server no longer outlives the restart. "Restart to apply update" relaunched the app but never stopped the Peribolos server underneath it, so the server from the previous version kept running, and the new app opened its window onto it: the update was installed on disk and nothing on screen had changed. Found on the dogfood install with a 0.1.1118 app showing a 0.1.1117 server for three days. Restart — from the tray item, the Restart now button, and the overnight auto-apply alike — now stops the server first, waits for it to let go of its port, and only then relaunches.
• At launch, the app checks who is already on its port. Each server now carries the version it was started from and says so on request. If the port is held by a Peribolos server from a different version, the app stops it and starts its own; a server of the same version, or a developer's server run from the repository, is used as before. Every such decision is written to the updater log in the data folder, so a "the update didn't take" report can be read there.

31 August 2026

Profile drafting works again

• A cited author who shares a client's surname no longer stops the drafting. Profile drafting reads your own Workshop activity and proposes short additions to your practitioner profile. On the dogfood practice it had not completed a run since mid-July: the profile lists "Mentalising / MBT — Fonagy, Allen, Bateman", someone in the caseload shares a surname with one of those authors, and the safety check that stops client details leaving the machine could not tell the author from the client. Every run failed, and trying again could never clear it.
• Your own profile now travels the way it always did everywhere else. The note renders and the Workshop have always carried your profile as background framing, where the check knows not to read it as client material. Profile drafting was carrying it as material instead. It now sits with the rest.
• The profile is still checked, more closely than before. A date of birth, a phone number, an email, an address, or a client's name written out all stop the run before anything is sent. What passes is a bare surname on its own — which is how clinicians cite authors, and nothing else.
• When a run does stop, it says why and where to put it right. Previously it failed silently on the scheduled run and, in Settings, said only that something had hiccuped and to try again. It now names the text that stopped it, points at the Practitioner tab, and confirms that nothing was sent and nothing was changed.

24 August 2026

"Reminded" now means the email actually went

• A drafted reminder is no longer counted as a sent one. Peribolos opens reminder drafts in Mail and you send them. Nothing checked what happened next, so a draft you never got round to sending still counted as a chase and held the next reminder back for a week — then the week after, and the one after that. On the dogfood practice 22 reminder drafts had quietly piled up unsent, the last real send two weeks earlier, while every client with an overdue invoice read as recently reminded.
• Before drafting anything, Peribolos asks Mail what actually left. A read-only pass over Sent and Drafts, matched on the exact subject line of the draft. A message found in Sent is recorded as sent, with the real send time. A draft still sitting in Drafts is recorded as unsent — and clears any earlier claim that it had gone. Nothing found says nothing either way, so an old record is left alone.
• The Office says which it is. Each invoice now reads "Sent 10 Aug" or "Drafted 23 Aug — still unsent in Mail" instead of a "Last reminder" line that was blank no matter how many drafts had been opened. Finances shows a line when drafts are waiting, with the oldest date.
• Reminder subjects name their invoices. A grouped reminder is now "Payment reminder — Invoices SK0123, SK0125 ($280.00)" rather than "2 outstanding invoices ($280.00)" — the client gets the reference they need, and one client's reminder can be told from another's.
• On Windows, or with the .eml mail path, there is no mailbox to ask; those drafts read "send not checked here" and behave exactly as they did before.

17 August 2026

A Feedback button in every room

• Feedback is one click away from anywhere. A Feedback button now sits in the top right of the Office, the Workshop and the Library. It opens a single dialog: what kind of feedback, what happened, and up to three screenshots — pasted straight from the clipboard (the Cmd+Shift+4 → Cmd+V path), dropped on, or picked from a file. Images are downscaled in the browser before they travel, so a retina screenshot arrives as a few hundred KB rather than ten megabytes. During the alpha this is the shortest route from "that's odd" to something anyone can act on.
• The technical summary always rides along, and you can read it first. Every note now carries the diagnostics bundle — app version, platform, health checks, recent in-page errors, silent-recording snapshots. "What is attached besides your note" opens and shows the exact text before you send. Never any client information, never note content.
• One feedback form, not two. Settings → Provide feedback opens the same dialog instead of carrying its own copy. If direct send is not available on an install, the button offers a pre-filled email draft; if there is no way to reach support at all, it does not appear.

3 August 2026

Twilio removed; plain-language health banner

• Twilio is gone. BurstSMS is the one SMS provider. Twilio sends had failed since mid-June (sender-number/account mismatch) and the provider added a second credential surface for no working benefit. An older config.yaml still naming provider: "twilio" is treated as unconfigured — no send is attempted — and the health banner says in plain language that the provider is no longer supported and where the BurstSMS details go. Saving BurstSMS credentials in Settings migrates the config's provider line automatically. Not coming back (GoCardless rule).
• No code jargon in the health banner. Every health-check message is now plain language with an in-product way forward (brand-voice §11.5.4 — "no code in the room"). Gmail app passwords got an in-product home: Settings → Integration credentials (one field per configured account), and the banner's Gmail row links straight to it.

24 July 2026

Version 0.1.1080: first-run fixes from a cold-start walkthrough

First-run fixes from a cold-start walkthrough of the packaged app (fresh databases, no key, nothing configured):

• The first screen works now. A fresh install opens on the Welcome page — previously it showed a raw {"error": "Welcome not found"} because the page's source file never shipped in the app bundle. Help & troubleshooting, Where your data goes, and Backup & restore ship too (the same gap had every one of those pages, the ? icon in the top bar, and the "More in Help" links returning errors). If a bundled page ever goes missing again, a plain explanation renders instead of raw JSON — and the release gate now boots the packaged app and checks all four pages, so this class of gap can't ship silently again.
• The Workshop's key status is honest. On an install with no access token the sidebar footer reads Off — "AI features are off until an access token is added." — instead of claiming Online while the banner above said the opposite.
• Calendar Sync no longer fails silently. The Sync button appears only when calendar sync is turned on (it's off on a fresh install); when a sync can't run, the reason now shows next to the button instead of nothing happening.