# Entries, exports and staff access — 1.2.6

The inbox supports form, answer-text, inclusive UTC date, read/unread, starred and assignee filters, with 25 entries per page. Answer search uses escaped database LIKE over retained JSON; it is not a semantic search index or a large-database performance guarantee. An entry detail page shows all stored values, expiry, notification status, delivery recovery and paginated outcome history. Choose Site timezone or UTC for display; date filters and exported timestamps remain UTC. Returning from details or a bulk action retains the selected filters.

Select up to 100 entries for read/unread, star/unstar, assignment, selected export or deletion. Every mutation uses a POST nonce and its required capability. Deletion also requires an explicit confirmation; the existing local privacy/deletion lifecycle removes associated delivery, outcome and measurement data. Entries already transferred to external providers cannot be recalled. Viewing an entry alone does not change its read state.

The Lead manager role can read/export entries, update workflow/review outcomes and manage delivery. It cannot edit forms, change credentials, delete entries, run the global delivery worker, install plugins or change WordPress settings. Without an explicit Team access policy, the role can access all entries and basic assignment organizes work. Pro's Team access can narrow this to listed forms, entries assigned to that user, or both, and can restrict individual actions. Saved restrictions remain enforced by Free when Pro is inactive. Administrators assign WordPress roles through Users; a Team access policy only narrows those capabilities and never grants them. Custom roles can be granted individual capabilities deliberately:

| Capability | Access |
|---|---|
| `kconv_view_entries` | Scoped inbox/detail; whole-site measurement requires all-entry access |
| `kconv_export_entries` | Scoped entry CSV; measurement CSV also requires all-entry access |
| `kconv_review_entries` | Read/star/assignment and Pro outcome review |
| `kconv_manage_delivery` | Scoped delivery report, reviewed resend and eligible replay; global worker requires administrator access |
| `kconv_delete_entries` | Permanent local entry deletion |

The role is added once per site; existing custom roles are not rewritten. Administrators retain access through their existing management capability. Multisite remains unsupported. Explicit full data-removal uninstall removes the plugin role and its administrator capability grants.

## CSV

One-row-per-entry CSV is the default. Columns include entry/form IDs, UTC time, mail status, read/star/assignee and the union of field IDs in the filtered historical entries. New entries preserve submission-time labels/types/title and their form revision. Historical rows without a snapshot use an explicit current-label fallback; the upgrade does not invent their original labels. Checkbox-group answers are readable comma-separated values. A second long layout retains one row per field/value. Both use spreadsheet formula-prefix protection. Field IDs identify historical answers even when present-day labels change. Wide exports use Label [field_id] where consistent, plus per-row field-definition JSON. Long exports identify each field and the definition source.

Exports use 100-row keyset batches and a maximum entry ID captured at export start; later submissions are excluded. Wide layout scans field IDs first, with a 250-column limit; narrow the selection or choose long layout if exceeded. Both layouts stage the complete file in private temporary streams before sending download headers. Database/JSON/selection failures produce an error instead of an apparently complete partial CSV. Limits are 100,000 entries, 64 MiB output and 45 seconds preparation; narrower filters may be needed. Streams spill to the host temporary directory after 2 MiB and are closed after use; they are not published as website files. Exports verify selection counts, bytes and a checksum. This is not a database-wide snapshot: concurrent review changes can still affect the export, and count verification cannot detect every same-sized replacement. No scheduled export or encryption of downloaded files is provided.

## Reusing forms

The form list supports search, 12-card pages and Duplicate as draft. Clones copy fields, settings and conditional/step flows. They do not copy entries, notification recipient, integration credentials, transfer acknowledgements, license or measurement configuration. Configure those deliberately before publishing. Duplication cannot send anything by itself.

## Question types

Free includes date, time, checkbox group and fixed hidden value questions alongside ordinary text, contact, choice, repeatable and private-file fields. Date uses real calendar validation (YYYY-MM-DD), time uses 24-hour HH:MM, and groups store a deduplicated array of configured options. Required groups require at least one selection. Hidden values are set by the administrator and applied on the server; submitted overrides are ignored. They are not secrets, query-string prefill or UTM attribution. Public schemas can expose the configured default.

## Editing live forms

Save draft changes creates a private working copy. Visitors continue using the published form and existing shortcode. Publish updates validates and applies the complete reviewed configuration. Two tabs cannot silently overwrite one another; a conflict keeps the unsaved editor open for comparison. Saved design history keeps 10 designs without restoring operational credentials or recipients. Discard saved draft changes returns to the live form.

## Retention health

Administrators can inspect expired-entry counts, oldest expiry, last completed run and next schedule in Inbox. Run expired-entry cleanup deliberately to delete already-expired local records. A scheduled event does not prove that hosting runs WordPress cron. A failed cleanup is not reported as completed deletion. Changing retention applies to new entries only.

## Dynamically inserted forms

When the page already has the required Free/Pro scripts and styles, pass fresh server-rendered form markup to `window.KillerConversions.init(container)`, or dispatch the bubbling `kconv:mount` event from that container. Repeated calls on the same initialized element are harmless. This is not a script loader or a blanket page-builder compatibility promise. Do not clone a form's already-initialized DOM; request fresh markup instead. Fresh inserted markup is assigned a unique form instance and remapped labels and accessibility references when its IDs collide with a form already on the page. Later repeater rows use that instance too. Already-initialized DOM clones remain unsupported.

## 0.10.0 application operations

Free keeps existing entry access, search, filters, star, basic assignment/status, CSV and privacy tools. Submitted counts are local records, not conversions. Entries, private files and encrypted drafts share a configurable site storage budget (512 MiB default; administrator range 64–16384 MiB). It measures stored answer/snapshot/file/draft bytes, not database indexes, queues, notes or backups; hosts need additional capacity. A rejected over-budget write leaves the earlier saved application intact.

Pro adds named review stages, internal notes, due dates, conflict-protected assignment and audit history. Administrators can restrict staff to permitted forms and their assignments, with separate export/file/PDF/review/delivery abilities. These checks apply at server routes as well as the UI and remain effective after Pro deactivation. Administrators retain recovery access. Use the application guide for the review workflow and document limits.


## Pro review queues and saved views

In **Review workflow**, click a stage, Due today, Overdue, assignment or outcome count to open the matching queue. Combine filters for the work you want to inspect. UTC due dates define the daily boundaries; closed stages remain overdue until their dates are cleared. A due date is a reminder for your team, not an automatic message. Expired entries are excluded even before scheduled deletion.

Use **Save current filters** deliberately to keep up to ten named views for your WordPress account on this site. The saved filters never grant access: current capabilities, form and assignment scopes are checked each time. Delete a view with its own control. These local account preferences are included in WordPress personal-data export/erasure while Pro is active. Deactivation retains them; the explicit full-data uninstall removes this site's views.

## Earlier enquiries using a submitted email · Pro

Entry details initially show up to five earlier retained matches, expandable to 25. If the entry has several addresses, select the submitted email to inspect; the selector uses the first 100 indexed addresses. The lookup uses the existing local email index and current staff access. It does not collect new data, merge entries or verify who submitted them. A shared address may belong to several people. No matches does not prove there was no earlier enquiry: access, retention and erasure limit results.

## Filtered review CSV · Pro

**Export filtered entries** downloads the current Review workflow selection, including review stage, UTC due date, current outcome, assignee and retained submitted answers. It is separate from the Free wide/long export described above. Spreadsheet formula protection applies; internal notes and uploaded file contents are excluded.

Limits are 1,000 matching entries, 8 MiB and 15 seconds of preparation. Larger selections ask for narrower filters, rather than silently dropping rows. Changed selection, access or stored records and storage errors stop the complete download and ask you to reload. Protect the downloaded file; erasing site records cannot remove an external copy.

## Retention health

New entries use the saved retention period (90 days by default, configurable from 1 to 3650 days). Existing entries retain their original expiry. Expired-entry cleanup continues large backlogs in bounded scheduled batches. Retention health reports queued or overdue continuation work; WordPress cron is required and the daily cleanup remains a fallback.