Learning - Releases

Fixed

• Passing a course and issuing certificates failed on fresh installs. Every compliance event is chained to the one before it, and the chain starts from a first entry that the database update was supposed to create. Nextcloud skips that part of an update when an app is installed for the first time, so on every fresh install since 5.2 the chain had no start: "course passed", issuing or revoking a certificate and completing a mandatory training ended with a server error. The first entry is now created on install and on update. Where the chain already holds entries but its start record is missing, nothing is created automatically, because a new start would hide the gap; the admin log says so instead.
• Question translations did not work on fresh installs. The translation tables were renamed in 3.5, but the rename also ran only on updates, so fresh installs kept the old names and every translated question failed to load. The tables are now created where they are missing.

Instances that were updated from an older version, rather than installed fresh, were not affected.

Security

• The weekly study note was sent to the AI provider without consent. A background job runs once a week for everyone who studied in the last 60 days. It sent their weakest topic and the questions they got wrong to the configured AI provider to write a summary note, and it never checked whether the learner had agreed to AI processing. It now skips anyone without valid consent before reading their learning data, and the note generator refuses on its own so no other path can bypass it. This only affected instances with AI enabled.
• Outdated consent counted as consent. The server accepted any stored consent version; only the VirtuProf chat window compared it with the current consent text. The server now requires the current version on every AI path, and the VirtuProf chat and the course summary narrative no longer use their own weaker check. The course summary narrative is also rate limited now.
• A failed consent save was treated as consent. If saving the consent failed, VirtuProf closed the dialog and sent the waiting message anyway, although the server had no consent on record. The dialog now stays open with an error message and nothing is sent until the save succeeds.
• Follow-up requests are checked too. Chat-memory compression and the pool generator send further requests after the first one; each now checks consent right before sending. If the server reports missing consent, VirtuProf asks again instead of showing a generic error.

A larger rework of AI consent follows in 5.6.0: consent will name the actual AI provider, the consent text will describe exactly what is sent, and everyone will be asked once to confirm the corrected text.

Fixed

• The app icon stood out in the app menu. Learning used a coloured icon where Nextcloud expects the same monochrome glyph as every other app. The coloured logo is still used on certificates when the instance has no logo of its own.

Fixed

• Tool selections were saved but never applied. Reported again on #7 after 5.4.6: "regardless of the selection, all tools remain visible". 5.4.6 fixed the settings form, but nothing read the setting where tools actually appear. The course's learning space ignored the admin's global selection entirely, and an empty course selection ("every tool off") was read as "no selection" and showed all eight. Both levels now apply: the admin's selection, narrowed by the course's. With nothing left, the Tools tab disappears, and the dashboard drops its tools link when the admin has switched every tool off. After saving in the course administration the learning space updates without a reload. The unit tests for the learning space had carried their own copy of the old logic instead of calling the component, which is why they stayed green; they now test the component, and a rendering test counts the tools a learner sees. Verified in a browser on Nextcloud 33.0.9 with MariaDB 10.11, before and after.
• The pool rules dialog showed every pool as required. The server sends the flag as 0/1, and the dialog read 0 as "required", so the checkbox was ticked for supplementary pools too — and saving any other rule in that dialog marked the pool required again. Found while adding the option below, which depends on that flag being right.

Added

• Practice exams from required pools only. Follow-up on #9: a course may hold supplementary pools for self-study that should stay out of the exam simulation. The practice exam settings have a new option, Use required pools only, which draws questions only from pools marked Required in the pool rules. If the option is on but no pool is marked, instructors see a warning in the settings and learners get a clear message instead of "no questions". Tested on a fresh install and on upgrades from 5.5.0, on MariaDB 10.11 and PostgreSQL 16.

Requested on #9 by a team preparing aviation radio courses: until now the exam mode assumed an IT certification.

Added

• Practice exams per course. Requested on #9 for training outside IT certification: the exam mode only knew the fixed CompTIA presets (90 questions/90 minutes and 45/45, pass at 720/900). Instructors can now offer a practice exam in a course's Administration tab and set the number of questions, a time limit or none, and the pass mark in percent. Learners start it themselves from its own tab — no pool to pick first — and every attempt draws a fresh random set from all of the course's pools. Afterwards they get a review with the explanations. The CompTIA presets stay as they were; the practice exam tab shows even where the preset exam is switched off.

Practice exams never count towards a certificate: they are marked separately, and the pass evaluation reads only the other exams. For the same reason they are left out of the locks that keep an exam from being used as an answer key — an untimed one left open would otherwise block training and explanations on its pools indefinitely. The reverse direction is guarded: while a certificate-relevant exam runs in the course, a practice exam cannot start, and an old one withholds its review.

The pass verdict is decided on the server against the threshold stored when the attempt began, in integer arithmetic (74.6 % does not pass 75 %), so a later change by the instructor does not rewrite past attempts. Tested on fresh installs and on upgrades from 5.4.6, on MariaDB 10.11 and PostgreSQL 16.

Both reports came from the same install on Hetzner Storage Share: no shell, no occ, and MariaDB. #7 found a course view that failed and tool selectors that never showed their state; #8 found a false audit alarm and a certificate setup that required a command the host does not offer.

Added

• Certificates can be activated from the admin page. Signed certificates need an issuer signing key, and until now the only way to create it was occ learning:cert:init-issuer — unreachable on managed hosting without shell access, where certificates could therefore never be enabled. Reported on #8 from Hetzner Storage Share. The certificates notice now has a Generate signing key button.

It only ever creates the first key: if one exists it refuses with 409, because an existing key may already have signed certificates. Rotation stays occ-only. Creation runs under an exclusive lock, so a double-click cannot leave two active keys — a guard the occ path now shares.

Fixed

• "Checkpoint overdue" on installs with nothing to checkpoint. Reported on #8: the warning appeared next to "No checkpoint yet" and "Events since last checkpoint: 0". Overdue was measured from the last checkpoint, and a missing one counts as timestamp 0, so every fresh install was overdue from the start. The same false alarm followed every quiet week, because the weekly job deliberately skips when no new audit events exist. Overdue now means an audit event has waited more than 8 days for a checkpoint — which still catches a job that is not running.

The warning also pointed to occ learning:audit:verify, which checks the chain but creates no checkpoint. It now names the actual cause: a missing signing key (checkpoints are signed with it), or background jobs that are not running. - Tool selections appeared not to save. The selectors bound :model-value on native <input type="checkbox"> elements, which have no such prop — Vue rendered it as an inert attribute, so the boxes never showed the stored state. Every tool looked unchecked, clicking an already-enabled one changed nothing, and saving wrote all eight back. Reported on #7; four occurrences fixed. - Fresh installs never received three course tables. Version009900 does its work in postSchemaChange(), but a fresh install executes only changeSchema() and then records every migration as done — so it never ran and could never be revisited. Version010100 creates the tables in changeSchema() and copies any legacy rows afterwards. This is the likely reason a course view failed on the reporter's install, and why reinstalling the app reproduced the problem instead of fixing it. - The certification toggle always saved the previous value. It listened for @update:checked, which @nextcloud/vue 9 components no longer emit. - The active exam slot never displayed. The view read res.data.slot; the controller returns exam_slot. - Two buttons missed by 5.4.5. Both passed a styling value through a dynamic :type binding, which the new guard did not yet check. It now covers dynamic bindings too. - A missing database table no longer takes down an entire course view. Reported on #7 from an install on managed hosting, where oc_learning_course_curriculum_scopes did not exist. That table comes from a rename migration (Version009900) which deliberately aborts rather than creating an empty table over existing data — so an install can legitimately end up without it, and the app treated that as fatal. Curriculum scoping, paused-question overrides and announcements now fall back to "nothing configured" and log a warning naming the migration and the occ command that repairs it.

Writes are deliberately left throwing: reporting success for a save that stored nothing is the worse failure, and the caller has to be able to tell the user it failed.

The "is this table missing" check moved into Db\DbErrors rather than being copied — UninstallCommand has needed the same predicate since v5.3.0. It stays narrow on purpose: anything not positively identified as a missing table is rethrown, so a genuine database outage cannot turn into silently empty results.

This limits the damage. Why the table was absent is the "three course tables" entry above.

Reported in #7 by an external user on macOS, reproducible in both Safari and Chrome. The report was precise and its diagnosis correct — it just described one button out of 244.

Fixed

• "Upload image" saved the question before a file was picked. The Vue 3 migration (380dd9a, 2026-04-03) moved the app from @nextcloud/vue 8 to 9, which swapped the meaning of two NcButton props: styling moved from type to variant, and type became the native <button type> attribute. native-type was dropped entirely. The v8 spelling was never migrated, so every button passed a styling value such as "secondary" to the native attribute — and HTML's invalid-value-default turns an unknown button type into submit. Inside a <form>, every one of those buttons submitted.
• "Cancel" in the question editor saved the question instead of discarding it. Same cause (type="tertiary"), not in the report, arguably worse than the reported symptom.
• The three save buttons only worked by accident. They carried type="primary" plus a native-type="submit" that v9 ignores; they submitted because the styling value was invalid, not because they asked to. They now say type="submit" explicitly.
• All 244 NcButton instances were migrated to variant (the 222 outside forms were a visual-only defect: with variant never set, every button in the app had been rendering in the default secondary style for 5.5 months).

Added

• tests/unit/NcButtonTypeProp.test.js — pins the v9 prop contract against a real NcButton render, and scans every .vue file so the v8 spelling cannot return. The four existing gates could not see this class of defect: it is valid Vue, valid JS and valid HTML.
• tests/unit/QuestionFormSubmit.test.js — mounts the real form with real buttons and clicks them, asserting which ones reach a submit. Reverting the fix turns it red, on the submit count rather than on an attribute. Note the precondition the report already implied with "open an existing question for editing": while the required fields are empty, constraint validation suppresses submission on its own and hides the defect entirely.

Reported in #6 by the administrator piloting Learning in Vinnytsia. Two of the three questions turned out to describe real defects rather than gaps in understanding.

Fixed

• The assistant rendered German text inside a Ukrainian interface. VirtuProf does not translate through Nextcloud's t(); it resolves against its own bundled catalogue, and 161 of its 343 reachable strings had drifted out of that catalogue — including every FAQ answer body. translateVirtuProf() then fell back to the raw source string, which is German for most of them. 63 of the 161 were already translated in l10n/uk.json and simply never made it into the catalogue; the remaining 105 are new and now exist in all six languages.
• The AI assistant was told to answer Ukrainian and French users in English. The system prompt's language map only knew German, English, Russian and Arabic, so anything else produced the instruction "If unsure, default to English". It now covers all six languages.
• The assistant ignored the Nextcloud interface language. It derived the response language from the opt-in content-language setting alone, with a hard English fallback. It now falls back to the user's Nextcloud interface language, then the instance default.
• Choosing Arabic as content language did nothing. The dropdown has offered it for months and the request sent it, but the server's whitelist did not include ar, so the value was silently replaced with the empty string and the request still answered 200.
• "Create summary" wrote an English note for a Ukrainian user. NoteGeneratorService, which the assistant reaches through its file-intent path, carried its own copy of both the language lookup and the language-name map — and its copy was missing French and Ukrainian in exactly the same way. Both now come from one shared resolver.
• The assistant panel header rendered three empty strings. Its translate helper passed the key where the function expects the language, so the panel label was blank and both the minimise and close buttons had an empty accessible name — in every language, German included.

Added

• An instructor group setting in the administration page. Members of that Nextcloud group may create courses and question pools without Nextcloud administrator rights. The mechanism is not new — it has been learning-instructors all along — but nothing named it: the admin page referred to "the configured instructor group" without saying which, and the manual claimed the instructor role was per-course only, which is wrong for creating a course in the first place.
• The five textbook fields in the pool dialog now explain themselves. They are optional and only pay off when a pool mirrors one chapter of a book; the dialog says so, and each field describes what belongs in it.
• A fifth i18n gate (scripts/gen-virtuprof-strings.mjs --check). The VirtuProf catalogue is now generated from l10n/*.json rather than hand-maintained, and the gate fails when the two disagree or when a reachable assistant string exists in no language file. Verified: removing a VirtuProf key from all six language files leaves gates 1–4 green and turns this one red. The catalogue grew from 252 to 429 keys and lost none — keys reached through vt(<expression>), which no literal scan can resolve, are carried forward until they leave l10n/de.json. --list-indirect names the 22 call sites this protects.

Documentation

• New manual section 2.3 on letting teachers create courses and pools, a corrected role description in section 1, a field-by-field table with a worked example for the pool dialog in 3.1, and two new troubleshooting entries.

Internal

• deploy-prod.sh --stage-gate now copies appinfo/ into the analysis copy. Without it ClassResolutionTest — the regression test written after the AIController/AiController outage — errored out instead of running.

Found by clicking through the 5.4.2 deployment: the wizard's "Skip" button sat at top: 16px, directly underneath the Nextcloud header, whose avatar button swallowed every click. The splash screen carries its own skip link at the bottom, so the first step looked fine — but from step two onwards there was no reachable way out of the introduction at all.

This is not new in 5.4.2; it has been there as long as the redesigned wizard. It is the sharper half of what #5 describes: users could not get rid of the introduction even when they tried.

Fixed

• The wizard's skip button clears the Nextcloud header and can actually be clicked from every step. Verified in the browser: a click on the button's own centre used to be delivered to the header's avatar.

Added

• Two browser tests that would have caught this: one walks a new account through the introduction and asserts it stays gone after clearing site data, the other asserts the skip button — not the header — receives a click aimed at it.

Reported by the same administrator piloting Learning in Vinnytsia (#5): the help wizard reappeared for users who had already been through it, and its introductory questions ("How many bits are in one byte?") were beside the point for staff in occupational safety or HR.

The reappearance turned out to be three separate defects, not a missing setting.

Fixed

• The assistant's introduction never honoured "no thanks". It read that setting from a response which does not contain it — /api/profile/telos/status returns the completion flag and nothing else — so the check was always false and the introduction started again on every single page load. The setting had been saved correctly the whole time.
• Whether the wizard had been seen lived in browser storage alone. That is scoped to one browser on one machine, so a second computer, a different browser, a private window or cleared site data all brought it back. The server is authoritative now; browser storage remains only as an offline fallback.
• Skipping the wizard recorded nothing on the server. It counts as a decision now, like completing it.
• Instructors were shown two introductions in a row — the wizard, and the slide tour the moment it closed. One introduction, one decision.
• Existing users are marked as done during the upgrade, so the update itself does not send a whole instance back through the introduction.

Changed

• Instructors now see the full nine-slide tour inside the wizard. It used to follow the wizard as a second, separate introduction; folding it in keeps the content while removing the duplication. OnboardingIntro is unreachable for now and becomes the voluntary tour in 5.5.0.
• Declining the assistant's introduction now puts the assistant in its reduced mode instead of leaving it in an undetermined state.

The introductory content itself is being reworked for 5.5.0.

Reported by the same administrator piloting Learning in Vinnytsia (#4): one error and one warning in the Nextcloud log. The warning was what it looked like. The error was the visible edge of a defect that had been silently discarding onboarding results since v4.2.0 (4 April 2026) — seventeen releases.

Fixed

• The onboarding wizard could not save a profile, and lost two more things while failing. OnboardingRedesign.vue built its own request body instead of using the shared payload builder, and posted '' for the list fields where every other caller posts an array. TelosController::saveTelos() declared those parameters ?array, so PHP raised a TypeError inside Nextcloud's Dispatcher — before the controller body ran, which is why the controller's own try/catch never saw it and the user got a bare 500.

The damage was three times the reported symptom, because finalize() ran three steps inside one try with an empty catch: 1. the learning profile was never stored — onboarding_completed stayed false, so VirtuProf kept asking for a profile the user had already filled in; 2. the AI consent was never stored, even for users who explicitly opted in. Since the universal consent gate in v5.2.1, that locks every AI feature behind consent_required for them; 3. the selected starter pool was never imported — the wizard offers a pool, the user picks one, and nothing arrives.

None of it was logged. Three fixes, at three different levels: - OnboardingRedesign.vue now builds its payload with createTelosForm() / buildTelosPayload() — the same util PersonalSettings.vue and VirtuProf.vue use, so there is one payload shape in the app instead of two that can drift apart again. - finalize() settles each step independently and logs a failure to the console instead of swallowing it, so one failing step can never cancel the other two. - saveTelos() / updateTelos() accept array|string|null for the list fields and split a string on the same separators as the frontend (, ; newline). A malformed telos payload now answers 400 instead of raising an uncatchable dispatcher TypeError.

No migration is needed and no data was corrupted — nothing was written, rather than something wrong being written. Affected users recover on their own: the profile can be filled in under Settings → Personal or through VirtuProf, the consent dialog reappears when an AI feature is used, and a starter pool can be imported from the pool list.

• Activity\Provider::parse() threw the deprecated \InvalidArgumentException. Nextcloud replaced that contract with \OCP\Activity\Exceptions\UnknownActivityException in NC 30; until then every activity-stream load logged a deprecation warning, and from NC 39 it will be logged as an error. Both throw sites migrated.

Notification\Notifier had already been moved to UnknownNotificationException — the same NC 30 cohort — and this provider was simply missed. Each throw site now has a test, so the pair cannot drift apart again.

Tests

• tests/Unit/Activity/ProviderTest.php (new), tests/unit/onboardingTelosPayload.test.js (new, covering both the payload shape and the step isolation in finalize()), and seven cases added to tests/Unit/Controller/TelosControllerTest.php.
• Every one of them was verified to fail against the pre-fix code before being kept — the controller cases reproduce the reporter's exact TypeError, and the finalize() case fails with expected [ 'telos' ] to deeply equal [ 'telos', 'consent', 'pool' ].
• tests/Support/PhpUnitStubs.php gained OCP\Activity\IEvent, IProvider and UnknownActivityException; the PHPUnit bootstrap deliberately does not load Composer's autoloader, so OCP types live there.

Also fixed — found by auditing for the same bug class

Codeberg #4 was one instance of a pattern: a frontend that posts a body the controller does not read. Nextcloud's dispatcher does not reject unknown keys and fills the missing parameter with its default, so the request succeeds and the app quietly does the wrong thing. PHPStan cannot see across the HTTP boundary and service tests start after it, so nothing caught these. An adversarial audit of every such call site turned up four more.

• Saving a course schedule deleted it. CourseController::setSchedule() takes entries; the curriculum tab sent schedule. $entries stayed at its [] default, and ScheduleService reads that as "replace the schedule with nothing" — it deleted every row, inserted none, and answered 200, which the UI reported as saved. An instructor editing a curriculum schedule lost it, with a success message.
• Reported questions lost their identity. SupportTicketController::create() reads questionId/poolId/courseId out of context; VirtuProf's "report this question" sent them at the top level, so the ticket's structured columns were stored as NULL and the question was identifiable only through the subject line. The same component already built the correct shape for its other ticket call.
• "Explain the question I just got wrong" did not load that question. The chat request sent questionId; the controller declares lastWrongQuestionId. The value was dropped, so the retrieval context never included it. The richer questionContext usually masked the defect.
• Two icon URLs were relative where Nextcloud requires absolute — Activity\Provider::setIcon() and Dashboard\LearningWidget::getIconUrl() (whose interface says so explicitly). Desktop and mobile clients do not share the web root, so those icons did not render there. Notification\Notifier had already been doing this correctly.

Each of these is now pinned by a request-boundary test in tests/unit/requestPayloadContracts.test.js, verified to fail against the pre-fix components.

Also fixed — in the profile endpoint itself

• An emptied help-topics list was silently preserved. saveTelos() forwarded the list only when it was non-empty, so [] and '' both meant "omit" rather than "clear". Emptying the textarea and saving kept the old value — and since help topics are published to classmates through the classbook at course or public visibility, a user could not withdraw a topic once shared. An omitted field (null) still means "leave as is"; a supplied empty one now clears, matching what updateTelos() already did.
• A malformed updateTelos() payload could half-save. Skipping a non-array telos and carrying on meant {"telos": "oops", "bio": "changed"} stored the bio and answered 200 — a worse outcome than the TypeError it replaced. It is now rejected before any other field is touched.

Known limitations

• List values are not round-trip safe: a topic containing a comma, semicolon or newline is split on reload, because the frontend has always joined and split on those characters and there is no escaping scheme. The string path added above follows the same convention rather than introducing a second one.
• Users whose onboarding failed before this release keep a local "onboarding seen" flag while the server has no profile. They can fill the profile at any time, and the assistant prompts students who have it enabled, but there is no automatic reconciliation for instructors or for users with the assistant switched off.

Prompted by a report from a system administrator piloting Learning at a manufacturing company in Vinnytsia, Ukraine (#3), who raised two problems: parts of the interface appear only in English or German, and there is no manual. Both turned out to be real defects, and the first one was considerably larger than the report suggested.

Added

• Ukrainian interface language (uk) — the sixth language, complete at 2,940 keys in the main catalogue plus 252 in the VirtuProf runtime catalogue. Plural form is the three-form Slavic rule, not the two-form default.
• This is a first pass and has not been reviewed by a native speaker. It is labelled as such in the manual, with instructions for submitting corrections without touching code.
• docs/MANUAL.md — a user and administrator manual covering the chain the reporter asked for: course → learning materials → pool → questions → students → test attempt → results → completion, plus admin setup, the occ commands, mandatory training and compliance, the AI consent model, and how to add or fix a translation.
• Linked from README.md and from a new <documentation> element in info.xml. That element was absent, so the App Store listing offered no documentation link at all — the direct reason the reporter could not find any.
• Two new i18n gates, both wired into check-i18n-parity.sh:
• scripts/check-i18n-coverage.py compares the source against the catalogue. Gates 1–3 all compare the language files against each other, so a string missing from all of them at once passes every one of them. Verified by reconstructing the defect: removing a key from all six files leaves gates 1–3 green and turns this one red. It covers JS/Vue t()/n(), PHP $l->t() and the indirect toolCatalog.js keys.
• scripts/check-i18n-placeholders.py asserts that every translated value carries the same placeholders ({n}, %1$s, …) as its German source, and that no value is written in the wrong script. With six languages and machine-assisted translation, a dropped placeholder became the likeliest remaining defect.

Fixed

• 635 interface strings were absent from the translation catalogue entirely. They were passed through t() but had no entry in de.json, so Nextcloud's l10n fell back to the source string and rendered them in German in every language, including English.
• 618 came from JS/Vue, 10 from PHP $l->t() calls (notification subjects, the legal notice and privacy links), and 7 from toolCatalog.js, which reaches t() through a variable and is invisible to any literal scan.
• The most-used casualties: the course materials tab almost in full, parts of course administration, and the answer-type selector in the question form — Einzelauswahl / Mehrfachauswahl / Freitext, the three options every author picks between when writing a question.
• All 635 are now in the catalogue and translated into all six languages.
• VirtuProf keeps its own 252-key runtime catalogue (src/l10n/virtuprof-strings.js) which is separate from l10n/*.json and was not covered by any gate. A language added to the main catalogue alone would leave the assistant speaking German or English. It now carries a uk dictionary, and virtuprof-i18n.js lists it.
• VirtuProf's backend language allow-list silently discarded valid choices. VirtuProfController::ALLOWED_INTERFACE_LANGUAGES did not contain fr, although the frontend has offered French all along; normalizeInterfaceLanguage() coerces anything unlisted to '' and returns no error, so a French user's choice was dropped without a trace. Both fr and uk are now listed, with a comment naming the three places that must stay in sync.
• scripts/deploy-prod.sh synced a hard-coded five-language list. A new language would have been generated, guarded and committed — and then never copied to the server. Now six, alongside l10n_js_sync.py and check-i18n-parity.sh.

Known limits

• Some strings still reach t() through variables that the coverage gate cannot enumerate (onboarding slide definitions, dashboard tiles, a few config objects). Run python3 scripts/check-i18n-coverage.py --list-indirect to see the remaining call sites. Those were not audited in this pass.
• The content language layer — optional parallel translations of question text, held in learning_q_translations / learning_a_translations — still accepts only de, en, ru, ar. Adding uk means a DB migration against a CHECK constraint and a re-test on both PostgreSQL and MariaDB, so it is deliberately out of scope here. It is not a blocker for Ukrainian use: questions authored directly in Ukrainian are stored and displayed unchanged, because the base question row has no language constraint.

Fixed

• Every AI endpoint returned HTTP 500 instead of working (#3). Nextcloud derives the controller class from the route name, so 'name' => 'ai#available' resolves to OCA\Learning\Controller\AiController. The file was named AIController.php and declared class AIController; because PSR-4 autoloading is case-sensitive, the class was never found and the App Framework threw QueryNotFoundException before the request reached any of our code. All five ai#* routes — available, generate, status, import and explain — have been broken this way since they were introduced in v2.7.0.
• Visible effect was mostly log noise: the callers in QuestionList.vue, LeitnerMode.vue and TrainingMode.vue swallow the failure and fall back to aiAvailable = false, so the AI buttons simply never appeared. Nothing was lost, but nothing worked either, and every page that asked wrote a stack trace to nextcloud.log.

• The class-resolution failure happens before the authentication middleware, which is why the endpoint answered 500 to anonymous callers where every healthy route answers 401. That difference is what pinned the diagnosis.

• Four SQL queries referenced columns that do not exist, each failing with SQLSTATE 42703 every time it ran. All four were invisible to PHPStan — the defect lives in a string — and each sat behind a catch (\Throwable) that turned the error into a 500 or an empty result.

• LernprofilService: c.name on learning_courses, which has title. In enrichPoolsWithCourseData this broke /api/profile/skill-map outright (since 2026-04-09); the identical mistake in the cheat-sheet query hit only users who actually had wrong answers to report, so it stayed hidden behind an empty-result early return on fresh accounts.
• RagContextService and CourseSummaryService: ua.user_id on learning_user_answers, which has no user column at all — the user hangs off the session. Both now join learning_sessions the way NoteGeneratorService already did. User weaknesses and trouble spots never loaded; they threw.
• CourseSummaryService additionally compared the boolean is_correct against the integer 1, a type error on PostgreSQL. It now tests the column directly, which is portable across PostgreSQL and MariaDB.
• NoteGeneratorService: chapter_ref on learning_pools, a column that never existed (the chapter columns are chapter_key / chapter_title / chapter_order). Every authorised POST /api/notes/generate died in this query, before reaching the model at all.
• RagContextService: name on learning_courses. This is the first query buildContext() runs once a course is set, and a shared catch aborted the whole build after it — so VirtuProf answered without any course context (no chunks, pool questions, Leitner stats or weaknesses) and without reporting an error.
• CourseSummaryService: winner_uid on learning_duel_sessions. That column only exists on the league tables; a duel's winner follows from the scores. This query is on the ordinary course-summary path, so it took summaries, snapshots, narratives and CSV exports down with it. Wins are now counted from the scores of finished duels — and so is the total, because a duel that is still waiting for an opponent or expired unplayed has no winner and would otherwise sit in the denominator of win_rate.
• FeedController reported no course names. It called getName() on the course entity, which only has getTitle(); the surrounding catch turned that into course_name: null for every feed item rather than an error.
• Skill map and cheat sheet exposed courses the user is not in. enrichPoolsWithCourseData accepted a user id and then ignored it, so it returned every course any accessible pool had been added to. An instructor can attach a pool that was merely edit-shared with them, which handed the pool's owner the id and title of a course they are not a member of. Both queries now apply the same membership test the rest of the service already used, and both order their results — a pool can belong to several courses and the mapping keeps the first row, which without an explicit order was whatever the database happened to return first.
• LernprofilController logged nothing when it failed. All five catch (\Throwable) blocks returned a 500 without touching the logger, which is why nextcloud.log held no trace of an endpoint that had been broken since April 2026. They now log the exception before returning.

Security

• Duels and gameshows could be started on any pool. DuelService::createDuel and GameshowService::createSession only checked pool access when a courseId was supplied, and both endpoints accept none — so two cooperating users could start a session on an arbitrary pool id and read its questions, its answer options, and after answering the correct answer id. TrainingService has always gated its equivalent path. Both now call the same check, which is made public on QuestionService rather than copied a sixth time. Verified live in both directions: a pool the caller cannot reach is refused, one they can reach still works.
• The Wissensturm category endpoint had the same hole from a different angle: it took any pool id as the chosen category and read a question from it. It is now authorised against the session — the pool the session was created with, or any pool of its course — rather than against the caller's own pool access, because players who join a session legitimately are not required to have access to its pool.
• POST /api/courses/{id}/summary/snapshot did not check course access. Every other endpoint in SummaryController passes through CourseService::findById() first; this one called the service directly, so any logged-in user could snapshot an arbitrary course id and read the result back through their own snapshot. It now applies the same gate and answers 403.

Added

• scripts/check-sql-columns.py — resolves every alias-qualified column reference in app/lib against the live database schema. It found all four SQL defects above in one run.
• ClassResolutionTest — walks both places where Nextcloud builds a class name from a string (appinfo/routes.php route names and the FQCNs in appinfo/info.xml) and asserts each one resolves to a file whose name matches exactly, plus that the file declares the class name the router will ask for. Neither PHPStan nor the controllers' own unit tests can catch this: those tests use the real class name, so they load and pass while HTTP is broken.

Changed

• .githooks/pre-push now runs PHPUnit and the SQL column check. Neither the PHP test suite nor any schema check ran in a mandatory gate before, which is the reason both classes of defect survived for months. Note that the versioned hook was not the active one — core.hooksPath pointed at a stale copy in .git/hooks.
• The API test for /api/profile/skill-map asserts 200 and a payload shape; it accepted 500 before, and so reported a hard SQL error as passing for four months.
• The API test for /api/ai/available asserts 200 and a boolean payload. It previously accepted 200 or 500, which is what let a total outage ship through 23 tagged releases over five months — the endpoint always answers 200 with {available:bool}, including when no API key is configured, so a 500 was never an acceptable outcome.

Added

• occ learning:uninstall — removes everything this app leaves in the database, so the app can be uninstalled cleanly (#1). Dry run by default; --execute is required to change anything.
• Drops all learning_* tables, including the legacy names from both historical rename waves, and clears the rows left in migrations, appconfig, preferences, jobs, notifications, activity and activity_mq.
• Deletes the metadata rows before dropping the tables. Leaving the oc_migrations rows behind makes a later reinstall skip every migration and boot broken, so if a run dies between the two phases, this order leaves the recoverable state.
• Refuses to run when issuer/certificate data exists unless --keep-certificates or --drop-certificates is chosen: the Ed25519 issuer key is unrecoverable, and losing it makes every certificate ever issued permanently unverifiable.
• Refuses to run when any table cannot be read. An unreadable table is never mistaken for an empty one — every guess here is destructive.
• Reports rather than touches what it cannot safely change: the theming legal links (rewritten by Application::boot() on every request, so they can only be cleared after app:remove — the command prints the statement), the Dashboard layout row, and the files the app created under /Learning/ in users' homes.
• Tables carrying the learning_ prefix that this version does not know about are reported, not dropped.
• scripts/db-uninstall-probe.php — runs the real command against a throwaway MariaDB and PostgreSQL, covering platform behaviour no unit test or PostgreSQL-only dev instance can reach.

Fixed

• occ learning:import-pool-json no longer drops valid open questions. The pre-check demanded at least two answers for every question, which is right for multiple choice but wrong for open (fill-in) questions — those carry exactly one model answer and were skipped silently. The check now mirrors what QuestionService::create already enforced.

Changed

• The privacy and imprint pages name the operating company, with the registration details an imprint requires, instead of a private individual.

Notes

• No repair step is used for uninstall. Nextcloud executes <repair-steps><uninstall> from AppManager::disableApp(), so it also fires when an admin merely disables the app — a drop there would let one mis-click destroy every course, pool and certificate. The reasoning, including why a marker-armed variant was rejected, is recorded in UninstallCommand's class docblock.

A whole-app security audit (8 review lanes) followed by an adversarial multi-model pre-live review. Every finding was verified against the actual code before fixing; fixes shipping to the public App Store were themselves re-reviewed. No functional/feature changes — hardening only.

Security — Access control (IDOR)

• Course-scoped authorization on RAG import/list/delete/moderate endpoints (an instructor of course A could previously touch course B's shared RAG pool); course-membership gates on RAG contribution and on listing one's own contributions.
• Answer-key exports (CSV/JSON) require export-level access (owner, edit-share, or the instructor of a course the pool is attached to) — not plain read access; enrolled students can no longer pull answer keys.
• Course-access gates on document index/material-folder and course feed endpoints (previously cross-course content/PII could leak).

Security — Exam integrity (oracle prevention)

• During an active exam, explanations, correct answers, PBQ solution config and translated explanations are withheld across all surfaces that emit question-derived data (training/exam payloads, translation endpoints, the spaced-repetition due-queue, and VirtuProf's RAG + client-supplied question context).
• Starting an exam no longer auto-completes an existing exam by switching course context; correct PBQ answers now increment the exam score even when per-question feedback is suppressed.

Security — AI / GDPR

• Per-user AI consent is now enforced on every user-triggered LLM path (VirtuProf chat/interview, course summary, AI question generation, note generation, AI explanations) — the admin ai_enabled toggle alone is no longer sufficient. The frontend catches the consent-required response and points the user to the in-app consent dialog.
• Stored chat memory is NFKC-normalized and injection-filtered before re-entering the system prompt (a payload stripped on turn 1 could previously reappear on turn 2); the injection sanitizer now covers the same role-change / prompt-leak / jailbreak markers as the detector.
• File-intent note generation and chat-memory compression now count against the shared AI rate limit.

Security — Data-layer robustness

• Repair migration for course-feature table-name drift (curriculum scopes, question overrides, announcements) — cross-DB safe (PostgreSQL 16 / MariaDB / SQLite), identifier-quoted, fail-fast on platform-detection error, and it aborts rather than orphaning legacy data if a rename fails.
• Prefix-agnostic insert ids (exam slots, announcements) instead of a hardcoded oc_ sequence name; entity model aligned with the shipped schema.

Database

• Version009900: idempotent, data-preserving repair of legacy learning_curriculum_scopes / learning_q_overrides / learning_announcements → learning_course_*. Verified on PostgreSQL 16.

Versions 4.4.8 and 4.4.9 were internal migration-vehicle bumps and were never released; this entry covers everything since 4.4.7.

Added

• Signed completion certificates. A course can define pass criteria (score threshold, validity period). When a learner passes, the app mints a cryptographically signed certificate — a W3C Verifiable Credential (Ed25519 / VC-JWT) bound to the learner and the course.
• did:web issuer identity. Each instance is its own credential issuer via a path-based did:web derived from the server URL; the public key is published at the app's did.json. Issuer keys are generated with occ learning:cert:init-issuer, stored encrypted at rest (ICrypto), and can be rotated without invalidating previously issued certificates.
• Public verification portal. Anyone can verify a certificate by its ID / QR code on a public page. Signature, key status, claim binding, revocation and expiry are checked as an AND-chain; unknown IDs leak no personal data. Course owners can revoke certificates.
• Compliance report. Per-course completion/compliance report for instructors and admins (who passed, when, certificate status).
• Certificate view. A printable, A4-ready certificate with QR code, a prominent Certificate ID and a verification link.

Changed

• Avatars overhauled. The default assistant Nova is now a full chibi character with emotion-aware expressions (neutral / happy / sad / surprised / sleep / celebrate) instead of an abstract shape. The three scholar skins (Theoretiker / Kosmologe / Astrophysik-Popularisierer) were polished — gradient shading, larger eyes, brighter signature accents.

Setup

• Certificates need a one-time key. Run occ learning:cert:init-issuer once per server to generate the issuer signing key. Until it exists, the admin settings page shows a reminder and no certificate is minted when a learner passes. See README → Installation → Certificates setup.

Database

• Version009100 creates learning_cert_keys and learning_certificates; Version009200 adds revoked_at. Verified on PostgreSQL 16 and MariaDB (the credential_json / secret_key_enc TEXT columns are intentionally unindexed to avoid the utf8mb4 key-length limit).

Fixed

• learning_user_stats had no primary key (#24). Reported by @haecks on a fresh NC 33.0.5 install: Nextcloud logged "Table 'oc_learning_user_stats' has no primary key and therefore will not behave sane in clustered setups. This will throw an exception and not be installable in a future version of Nextcloud." The table was created back in Version001200 with only a unique index (learn_ustats_user_uniq) on user_id, never a primary key. Since there is exactly one stats row per user and every access path addresses the table by user_id, user_id is the natural primary key. A new migration (Version008000) drops the now-redundant unique index and promotes user_id to the primary key. The migration is idempotent (guards for missing table/column and an already-present primary key) so it is safe on existing installs and re-runs. Verified live on PostgreSQL 16 and independently on MariaDB 11.4 with utf8mb4 (the varchar(64) key stays well under InnoDB's index-length limit).

Fixed

• v4.4.5 shipped without the data/ directory (starter pools, campaigns, simulator scenarios, privacy-info.json, PWA guide, course materials — 77 files). The release build followed a cp file-list that omitted data/, so on a clean v4.4.5 install the "Add starter pool" feature, campaigns, the practicum/simulator scenarios and the privacy page had no backing data. v4.4.6 restores data/ (verified: tarball file-set now matches the last-known-good v4.4.4 manifest). The i18n content of v4.4.5 (#21 + #19) is unchanged and included.

Fixed

• Passing a course and issuing certificates failed on fresh installs. Every compliance event is chained to the one before it, and the chain starts from a first entry that the database update was supposed to create. Nextcloud skips that part of an update when an app is installed for the first time, so on every fresh install since 5.2 the chain had no start: "course passed", issuing or revoking a certificate and completing a mandatory training ended with a server error. The first entry is now created on install and on update. Where the chain already holds entries but its start record is missing, nothing is created automatically, because a new start would hide the gap; the admin log says so instead.
• Question translations did not work on fresh installs. The translation tables were renamed in 3.5, but the rename also ran only on updates, so fresh installs kept the old names and every translated question failed to load. The tables are now created where they are missing.

Instances that were updated from an older version, rather than installed fresh, were not affected.

Security

• The weekly study note was sent to the AI provider without consent. A background job runs once a week for everyone who studied in the last 60 days. It sent their weakest topic and the questions they got wrong to the configured AI provider to write a summary note, and it never checked whether the learner had agreed to AI processing. It now skips anyone without valid consent before reading their learning data, and the note generator refuses on its own so no other path can bypass it. This only affected instances with AI enabled.
• Outdated consent counted as consent. The server accepted any stored consent version; only the VirtuProf chat window compared it with the current consent text. The server now requires the current version on every AI path, and the VirtuProf chat and the course summary narrative no longer use their own weaker check. The course summary narrative is also rate limited now.
• A failed consent save was treated as consent. If saving the consent failed, VirtuProf closed the dialog and sent the waiting message anyway, although the server had no consent on record. The dialog now stays open with an error message and nothing is sent until the save succeeds.
• Follow-up requests are checked too. Chat-memory compression and the pool generator send further requests after the first one; each now checks consent right before sending. If the server reports missing consent, VirtuProf asks again instead of showing a generic error.

A larger rework of AI consent follows in 5.6.0: consent will name the actual AI provider, the consent text will describe exactly what is sent, and everyone will be asked once to confirm the corrected text.

Fixed

• The app icon stood out in the app menu. Learning used a coloured icon where Nextcloud expects the same monochrome glyph as every other app. The coloured logo is still used on certificates when the instance has no logo of its own.

Fixed

• Tool selections were saved but never applied. Reported again on #7 after 5.4.6: "regardless of the selection, all tools remain visible". 5.4.6 fixed the settings form, but nothing read the setting where tools actually appear. The course's learning space ignored the admin's global selection entirely, and an empty course selection ("every tool off") was read as "no selection" and showed all eight. Both levels now apply: the admin's selection, narrowed by the course's. With nothing left, the Tools tab disappears, and the dashboard drops its tools link when the admin has switched every tool off. After saving in the course administration the learning space updates without a reload. The unit tests for the learning space had carried their own copy of the old logic instead of calling the component, which is why they stayed green; they now test the component, and a rendering test counts the tools a learner sees. Verified in a browser on Nextcloud 33.0.9 with MariaDB 10.11, before and after.
• The pool rules dialog showed every pool as required. The server sends the flag as 0/1, and the dialog read 0 as "required", so the checkbox was ticked for supplementary pools too — and saving any other rule in that dialog marked the pool required again. Found while adding the option below, which depends on that flag being right.

Added

• Practice exams from required pools only. Follow-up on #9: a course may hold supplementary pools for self-study that should stay out of the exam simulation. The practice exam settings have a new option, Use required pools only, which draws questions only from pools marked Required in the pool rules. If the option is on but no pool is marked, instructors see a warning in the settings and learners get a clear message instead of "no questions". Tested on a fresh install and on upgrades from 5.5.0, on MariaDB 10.11 and PostgreSQL 16.

Requested on #9 by a team preparing aviation radio courses: until now the exam mode assumed an IT certification.

Added

• Practice exams per course. Requested on #9 for training outside IT certification: the exam mode only knew the fixed CompTIA presets (90 questions/90 minutes and 45/45, pass at 720/900). Instructors can now offer a practice exam in a course's Administration tab and set the number of questions, a time limit or none, and the pass mark in percent. Learners start it themselves from its own tab — no pool to pick first — and every attempt draws a fresh random set from all of the course's pools. Afterwards they get a review with the explanations. The CompTIA presets stay as they were; the practice exam tab shows even where the preset exam is switched off.

Practice exams never count towards a certificate: they are marked separately, and the pass evaluation reads only the other exams. For the same reason they are left out of the locks that keep an exam from being used as an answer key — an untimed one left open would otherwise block training and explanations on its pools indefinitely. The reverse direction is guarded: while a certificate-relevant exam runs in the course, a practice exam cannot start, and an old one withholds its review.

The pass verdict is decided on the server against the threshold stored when the attempt began, in integer arithmetic (74.6 % does not pass 75 %), so a later change by the instructor does not rewrite past attempts. Tested on fresh installs and on upgrades from 5.4.6, on MariaDB 10.11 and PostgreSQL 16.

Both reports came from the same install on Hetzner Storage Share: no shell, no occ, and MariaDB. #7 found a course view that failed and tool selectors that never showed their state; #8 found a false audit alarm and a certificate setup that required a command the host does not offer.

Added

• Certificates can be activated from the admin page. Signed certificates need an issuer signing key, and until now the only way to create it was occ learning:cert:init-issuer — unreachable on managed hosting without shell access, where certificates could therefore never be enabled. Reported on #8 from Hetzner Storage Share. The certificates notice now has a Generate signing key button.

It only ever creates the first key: if one exists it refuses with 409, because an existing key may already have signed certificates. Rotation stays occ-only. Creation runs under an exclusive lock, so a double-click cannot leave two active keys — a guard the occ path now shares.

Fixed

• "Checkpoint overdue" on installs with nothing to checkpoint. Reported on #8: the warning appeared next to "No checkpoint yet" and "Events since last checkpoint: 0". Overdue was measured from the last checkpoint, and a missing one counts as timestamp 0, so every fresh install was overdue from the start. The same false alarm followed every quiet week, because the weekly job deliberately skips when no new audit events exist. Overdue now means an audit event has waited more than 8 days for a checkpoint — which still catches a job that is not running.

The warning also pointed to occ learning:audit:verify, which checks the chain but creates no checkpoint. It now names the actual cause: a missing signing key (checkpoints are signed with it), or background jobs that are not running. - Tool selections appeared not to save. The selectors bound :model-value on native <input type="checkbox"> elements, which have no such prop — Vue rendered it as an inert attribute, so the boxes never showed the stored state. Every tool looked unchecked, clicking an already-enabled one changed nothing, and saving wrote all eight back. Reported on #7; four occurrences fixed. - Fresh installs never received three course tables. Version009900 does its work in postSchemaChange(), but a fresh install executes only changeSchema() and then records every migration as done — so it never ran and could never be revisited. Version010100 creates the tables in changeSchema() and copies any legacy rows afterwards. This is the likely reason a course view failed on the reporter's install, and why reinstalling the app reproduced the problem instead of fixing it. - The certification toggle always saved the previous value. It listened for @update:checked, which @nextcloud/vue 9 components no longer emit. - The active exam slot never displayed. The view read res.data.slot; the controller returns exam_slot. - Two buttons missed by 5.4.5. Both passed a styling value through a dynamic :type binding, which the new guard did not yet check. It now covers dynamic bindings too. - A missing database table no longer takes down an entire course view. Reported on #7 from an install on managed hosting, where oc_learning_course_curriculum_scopes did not exist. That table comes from a rename migration (Version009900) which deliberately aborts rather than creating an empty table over existing data — so an install can legitimately end up without it, and the app treated that as fatal. Curriculum scoping, paused-question overrides and announcements now fall back to "nothing configured" and log a warning naming the migration and the occ command that repairs it.

Writes are deliberately left throwing: reporting success for a save that stored nothing is the worse failure, and the caller has to be able to tell the user it failed.

The "is this table missing" check moved into Db\DbErrors rather than being copied — UninstallCommand has needed the same predicate since v5.3.0. It stays narrow on purpose: anything not positively identified as a missing table is rethrown, so a genuine database outage cannot turn into silently empty results.

This limits the damage. Why the table was absent is the "three course tables" entry above.

Reported in #7 by an external user on macOS, reproducible in both Safari and Chrome. The report was precise and its diagnosis correct — it just described one button out of 244.

Fixed

• "Upload image" saved the question before a file was picked. The Vue 3 migration (380dd9a, 2026-04-03) moved the app from @nextcloud/vue 8 to 9, which swapped the meaning of two NcButton props: styling moved from type to variant, and type became the native <button type> attribute. native-type was dropped entirely. The v8 spelling was never migrated, so every button passed a styling value such as "secondary" to the native attribute — and HTML's invalid-value-default turns an unknown button type into submit. Inside a <form>, every one of those buttons submitted.
• "Cancel" in the question editor saved the question instead of discarding it. Same cause (type="tertiary"), not in the report, arguably worse than the reported symptom.
• The three save buttons only worked by accident. They carried type="primary" plus a native-type="submit" that v9 ignores; they submitted because the styling value was invalid, not because they asked to. They now say type="submit" explicitly.
• All 244 NcButton instances were migrated to variant (the 222 outside forms were a visual-only defect: with variant never set, every button in the app had been rendering in the default secondary style for 5.5 months).

Added

• tests/unit/NcButtonTypeProp.test.js — pins the v9 prop contract against a real NcButton render, and scans every .vue file so the v8 spelling cannot return. The four existing gates could not see this class of defect: it is valid Vue, valid JS and valid HTML.
• tests/unit/QuestionFormSubmit.test.js — mounts the real form with real buttons and clicks them, asserting which ones reach a submit. Reverting the fix turns it red, on the submit count rather than on an attribute. Note the precondition the report already implied with "open an existing question for editing": while the required fields are empty, constraint validation suppresses submission on its own and hides the defect entirely.

Reported in #6 by the administrator piloting Learning in Vinnytsia. Two of the three questions turned out to describe real defects rather than gaps in understanding.

Fixed

• The assistant rendered German text inside a Ukrainian interface. VirtuProf does not translate through Nextcloud's t(); it resolves against its own bundled catalogue, and 161 of its 343 reachable strings had drifted out of that catalogue — including every FAQ answer body. translateVirtuProf() then fell back to the raw source string, which is German for most of them. 63 of the 161 were already translated in l10n/uk.json and simply never made it into the catalogue; the remaining 105 are new and now exist in all six languages.
• The AI assistant was told to answer Ukrainian and French users in English. The system prompt's language map only knew German, English, Russian and Arabic, so anything else produced the instruction "If unsure, default to English". It now covers all six languages.
• The assistant ignored the Nextcloud interface language. It derived the response language from the opt-in content-language setting alone, with a hard English fallback. It now falls back to the user's Nextcloud interface language, then the instance default.
• Choosing Arabic as content language did nothing. The dropdown has offered it for months and the request sent it, but the server's whitelist did not include ar, so the value was silently replaced with the empty string and the request still answered 200.
• "Create summary" wrote an English note for a Ukrainian user. NoteGeneratorService, which the assistant reaches through its file-intent path, carried its own copy of both the language lookup and the language-name map — and its copy was missing French and Ukrainian in exactly the same way. Both now come from one shared resolver.
• The assistant panel header rendered three empty strings. Its translate helper passed the key where the function expects the language, so the panel label was blank and both the minimise and close buttons had an empty accessible name — in every language, German included.

Added

• An instructor group setting in the administration page. Members of that Nextcloud group may create courses and question pools without Nextcloud administrator rights. The mechanism is not new — it has been learning-instructors all along — but nothing named it: the admin page referred to "the configured instructor group" without saying which, and the manual claimed the instructor role was per-course only, which is wrong for creating a course in the first place.
• The five textbook fields in the pool dialog now explain themselves. They are optional and only pay off when a pool mirrors one chapter of a book; the dialog says so, and each field describes what belongs in it.
• A fifth i18n gate (scripts/gen-virtuprof-strings.mjs --check). The VirtuProf catalogue is now generated from l10n/*.json rather than hand-maintained, and the gate fails when the two disagree or when a reachable assistant string exists in no language file. Verified: removing a VirtuProf key from all six language files leaves gates 1–4 green and turns this one red. The catalogue grew from 252 to 429 keys and lost none — keys reached through vt(<expression>), which no literal scan can resolve, are carried forward until they leave l10n/de.json. --list-indirect names the 22 call sites this protects.

Documentation

• New manual section 2.3 on letting teachers create courses and pools, a corrected role description in section 1, a field-by-field table with a worked example for the pool dialog in 3.1, and two new troubleshooting entries.

Internal

• deploy-prod.sh --stage-gate now copies appinfo/ into the analysis copy. Without it ClassResolutionTest — the regression test written after the AIController/AiController outage — errored out instead of running.

Found by clicking through the 5.4.2 deployment: the wizard's "Skip" button sat at top: 16px, directly underneath the Nextcloud header, whose avatar button swallowed every click. The splash screen carries its own skip link at the bottom, so the first step looked fine — but from step two onwards there was no reachable way out of the introduction at all.

This is not new in 5.4.2; it has been there as long as the redesigned wizard. It is the sharper half of what #5 describes: users could not get rid of the introduction even when they tried.

Fixed

• The wizard's skip button clears the Nextcloud header and can actually be clicked from every step. Verified in the browser: a click on the button's own centre used to be delivered to the header's avatar.

Added

• Two browser tests that would have caught this: one walks a new account through the introduction and asserts it stays gone after clearing site data, the other asserts the skip button — not the header — receives a click aimed at it.

Reported by the same administrator piloting Learning in Vinnytsia (#5): the help wizard reappeared for users who had already been through it, and its introductory questions ("How many bits are in one byte?") were beside the point for staff in occupational safety or HR.

The reappearance turned out to be three separate defects, not a missing setting.

Fixed

• The assistant's introduction never honoured "no thanks". It read that setting from a response which does not contain it — /api/profile/telos/status returns the completion flag and nothing else — so the check was always false and the introduction started again on every single page load. The setting had been saved correctly the whole time.
• Whether the wizard had been seen lived in browser storage alone. That is scoped to one browser on one machine, so a second computer, a different browser, a private window or cleared site data all brought it back. The server is authoritative now; browser storage remains only as an offline fallback.
• Skipping the wizard recorded nothing on the server. It counts as a decision now, like completing it.
• Instructors were shown two introductions in a row — the wizard, and the slide tour the moment it closed. One introduction, one decision.
• Existing users are marked as done during the upgrade, so the update itself does not send a whole instance back through the introduction.

Changed

• Instructors now see the full nine-slide tour inside the wizard. It used to follow the wizard as a second, separate introduction; folding it in keeps the content while removing the duplication. OnboardingIntro is unreachable for now and becomes the voluntary tour in 5.5.0.
• Declining the assistant's introduction now puts the assistant in its reduced mode instead of leaving it in an undetermined state.

The introductory content itself is being reworked for 5.5.0.

Reported by the same administrator piloting Learning in Vinnytsia (#4): one error and one warning in the Nextcloud log. The warning was what it looked like. The error was the visible edge of a defect that had been silently discarding onboarding results since v4.2.0 (4 April 2026) — seventeen releases.

Fixed

• The onboarding wizard could not save a profile, and lost two more things while failing. OnboardingRedesign.vue built its own request body instead of using the shared payload builder, and posted '' for the list fields where every other caller posts an array. TelosController::saveTelos() declared those parameters ?array, so PHP raised a TypeError inside Nextcloud's Dispatcher — before the controller body ran, which is why the controller's own try/catch never saw it and the user got a bare 500.

The damage was three times the reported symptom, because finalize() ran three steps inside one try with an empty catch: 1. the learning profile was never stored — onboarding_completed stayed false, so VirtuProf kept asking for a profile the user had already filled in; 2. the AI consent was never stored, even for users who explicitly opted in. Since the universal consent gate in v5.2.1, that locks every AI feature behind consent_required for them; 3. the selected starter pool was never imported — the wizard offers a pool, the user picks one, and nothing arrives.

None of it was logged. Three fixes, at three different levels: - OnboardingRedesign.vue now builds its payload with createTelosForm() / buildTelosPayload() — the same util PersonalSettings.vue and VirtuProf.vue use, so there is one payload shape in the app instead of two that can drift apart again. - finalize() settles each step independently and logs a failure to the console instead of swallowing it, so one failing step can never cancel the other two. - saveTelos() / updateTelos() accept array|string|null for the list fields and split a string on the same separators as the frontend (, ; newline). A malformed telos payload now answers 400 instead of raising an uncatchable dispatcher TypeError.

No migration is needed and no data was corrupted — nothing was written, rather than something wrong being written. Affected users recover on their own: the profile can be filled in under Settings → Personal or through VirtuProf, the consent dialog reappears when an AI feature is used, and a starter pool can be imported from the pool list.

• Activity\Provider::parse() threw the deprecated \InvalidArgumentException. Nextcloud replaced that contract with \OCP\Activity\Exceptions\UnknownActivityException in NC 30; until then every activity-stream load logged a deprecation warning, and from NC 39 it will be logged as an error. Both throw sites migrated.

Notification\Notifier had already been moved to UnknownNotificationException — the same NC 30 cohort — and this provider was simply missed. Each throw site now has a test, so the pair cannot drift apart again.

Tests

• tests/Unit/Activity/ProviderTest.php (new), tests/unit/onboardingTelosPayload.test.js (new, covering both the payload shape and the step isolation in finalize()), and seven cases added to tests/Unit/Controller/TelosControllerTest.php.
• Every one of them was verified to fail against the pre-fix code before being kept — the controller cases reproduce the reporter's exact TypeError, and the finalize() case fails with expected [ 'telos' ] to deeply equal [ 'telos', 'consent', 'pool' ].
• tests/Support/PhpUnitStubs.php gained OCP\Activity\IEvent, IProvider and UnknownActivityException; the PHPUnit bootstrap deliberately does not load Composer's autoloader, so OCP types live there.

Also fixed — found by auditing for the same bug class

Codeberg #4 was one instance of a pattern: a frontend that posts a body the controller does not read. Nextcloud's dispatcher does not reject unknown keys and fills the missing parameter with its default, so the request succeeds and the app quietly does the wrong thing. PHPStan cannot see across the HTTP boundary and service tests start after it, so nothing caught these. An adversarial audit of every such call site turned up four more.

• Saving a course schedule deleted it. CourseController::setSchedule() takes entries; the curriculum tab sent schedule. $entries stayed at its [] default, and ScheduleService reads that as "replace the schedule with nothing" — it deleted every row, inserted none, and answered 200, which the UI reported as saved. An instructor editing a curriculum schedule lost it, with a success message.
• Reported questions lost their identity. SupportTicketController::create() reads questionId/poolId/courseId out of context; VirtuProf's "report this question" sent them at the top level, so the ticket's structured columns were stored as NULL and the question was identifiable only through the subject line. The same component already built the correct shape for its other ticket call.
• "Explain the question I just got wrong" did not load that question. The chat request sent questionId; the controller declares lastWrongQuestionId. The value was dropped, so the retrieval context never included it. The richer questionContext usually masked the defect.
• Two icon URLs were relative where Nextcloud requires absolute — Activity\Provider::setIcon() and Dashboard\LearningWidget::getIconUrl() (whose interface says so explicitly). Desktop and mobile clients do not share the web root, so those icons did not render there. Notification\Notifier had already been doing this correctly.

Each of these is now pinned by a request-boundary test in tests/unit/requestPayloadContracts.test.js, verified to fail against the pre-fix components.

Also fixed — in the profile endpoint itself

• An emptied help-topics list was silently preserved. saveTelos() forwarded the list only when it was non-empty, so [] and '' both meant "omit" rather than "clear". Emptying the textarea and saving kept the old value — and since help topics are published to classmates through the classbook at course or public visibility, a user could not withdraw a topic once shared. An omitted field (null) still means "leave as is"; a supplied empty one now clears, matching what updateTelos() already did.
• A malformed updateTelos() payload could half-save. Skipping a non-array telos and carrying on meant {"telos": "oops", "bio": "changed"} stored the bio and answered 200 — a worse outcome than the TypeError it replaced. It is now rejected before any other field is touched.

Known limitations

• List values are not round-trip safe: a topic containing a comma, semicolon or newline is split on reload, because the frontend has always joined and split on those characters and there is no escaping scheme. The string path added above follows the same convention rather than introducing a second one.
• Users whose onboarding failed before this release keep a local "onboarding seen" flag while the server has no profile. They can fill the profile at any time, and the assistant prompts students who have it enabled, but there is no automatic reconciliation for instructors or for users with the assistant switched off.

Prompted by a report from a system administrator piloting Learning at a manufacturing company in Vinnytsia, Ukraine (#3), who raised two problems: parts of the interface appear only in English or German, and there is no manual. Both turned out to be real defects, and the first one was considerably larger than the report suggested.

Added

• Ukrainian interface language (uk) — the sixth language, complete at 2,940 keys in the main catalogue plus 252 in the VirtuProf runtime catalogue. Plural form is the three-form Slavic rule, not the two-form default.
• This is a first pass and has not been reviewed by a native speaker. It is labelled as such in the manual, with instructions for submitting corrections without touching code.
• docs/MANUAL.md — a user and administrator manual covering the chain the reporter asked for: course → learning materials → pool → questions → students → test attempt → results → completion, plus admin setup, the occ commands, mandatory training and compliance, the AI consent model, and how to add or fix a translation.
• Linked from README.md and from a new <documentation> element in info.xml. That element was absent, so the App Store listing offered no documentation link at all — the direct reason the reporter could not find any.
• Two new i18n gates, both wired into check-i18n-parity.sh:
• scripts/check-i18n-coverage.py compares the source against the catalogue. Gates 1–3 all compare the language files against each other, so a string missing from all of them at once passes every one of them. Verified by reconstructing the defect: removing a key from all six files leaves gates 1–3 green and turns this one red. It covers JS/Vue t()/n(), PHP $l->t() and the indirect toolCatalog.js keys.
• scripts/check-i18n-placeholders.py asserts that every translated value carries the same placeholders ({n}, %1$s, …) as its German source, and that no value is written in the wrong script. With six languages and machine-assisted translation, a dropped placeholder became the likeliest remaining defect.

Fixed

• 635 interface strings were absent from the translation catalogue entirely. They were passed through t() but had no entry in de.json, so Nextcloud's l10n fell back to the source string and rendered them in German in every language, including English.
• 618 came from JS/Vue, 10 from PHP $l->t() calls (notification subjects, the legal notice and privacy links), and 7 from toolCatalog.js, which reaches t() through a variable and is invisible to any literal scan.
• The most-used casualties: the course materials tab almost in full, parts of course administration, and the answer-type selector in the question form — Einzelauswahl / Mehrfachauswahl / Freitext, the three options every author picks between when writing a question.
• All 635 are now in the catalogue and translated into all six languages.
• VirtuProf keeps its own 252-key runtime catalogue (src/l10n/virtuprof-strings.js) which is separate from l10n/*.json and was not covered by any gate. A language added to the main catalogue alone would leave the assistant speaking German or English. It now carries a uk dictionary, and virtuprof-i18n.js lists it.
• VirtuProf's backend language allow-list silently discarded valid choices. VirtuProfController::ALLOWED_INTERFACE_LANGUAGES did not contain fr, although the frontend has offered French all along; normalizeInterfaceLanguage() coerces anything unlisted to '' and returns no error, so a French user's choice was dropped without a trace. Both fr and uk are now listed, with a comment naming the three places that must stay in sync.
• scripts/deploy-prod.sh synced a hard-coded five-language list. A new language would have been generated, guarded and committed — and then never copied to the server. Now six, alongside l10n_js_sync.py and check-i18n-parity.sh.

Known limits

• Some strings still reach t() through variables that the coverage gate cannot enumerate (onboarding slide definitions, dashboard tiles, a few config objects). Run python3 scripts/check-i18n-coverage.py --list-indirect to see the remaining call sites. Those were not audited in this pass.
• The content language layer — optional parallel translations of question text, held in learning_q_translations / learning_a_translations — still accepts only de, en, ru, ar. Adding uk means a DB migration against a CHECK constraint and a re-test on both PostgreSQL and MariaDB, so it is deliberately out of scope here. It is not a blocker for Ukrainian use: questions authored directly in Ukrainian are stored and displayed unchanged, because the base question row has no language constraint.

Fixed

• Every AI endpoint returned HTTP 500 instead of working (#3). Nextcloud derives the controller class from the route name, so 'name' => 'ai#available' resolves to OCA\Learning\Controller\AiController. The file was named AIController.php and declared class AIController; because PSR-4 autoloading is case-sensitive, the class was never found and the App Framework threw QueryNotFoundException before the request reached any of our code. All five ai#* routes — available, generate, status, import and explain — have been broken this way since they were introduced in v2.7.0.
• Visible effect was mostly log noise: the callers in QuestionList.vue, LeitnerMode.vue and TrainingMode.vue swallow the failure and fall back to aiAvailable = false, so the AI buttons simply never appeared. Nothing was lost, but nothing worked either, and every page that asked wrote a stack trace to nextcloud.log.

• The class-resolution failure happens before the authentication middleware, which is why the endpoint answered 500 to anonymous callers where every healthy route answers 401. That difference is what pinned the diagnosis.

• Four SQL queries referenced columns that do not exist, each failing with SQLSTATE 42703 every time it ran. All four were invisible to PHPStan — the defect lives in a string — and each sat behind a catch (\Throwable) that turned the error into a 500 or an empty result.

• LernprofilService: c.name on learning_courses, which has title. In enrichPoolsWithCourseData this broke /api/profile/skill-map outright (since 2026-04-09); the identical mistake in the cheat-sheet query hit only users who actually had wrong answers to report, so it stayed hidden behind an empty-result early return on fresh accounts.
• RagContextService and CourseSummaryService: ua.user_id on learning_user_answers, which has no user column at all — the user hangs off the session. Both now join learning_sessions the way NoteGeneratorService already did. User weaknesses and trouble spots never loaded; they threw.
• CourseSummaryService additionally compared the boolean is_correct against the integer 1, a type error on PostgreSQL. It now tests the column directly, which is portable across PostgreSQL and MariaDB.
• NoteGeneratorService: chapter_ref on learning_pools, a column that never existed (the chapter columns are chapter_key / chapter_title / chapter_order). Every authorised POST /api/notes/generate died in this query, before reaching the model at all.
• RagContextService: name on learning_courses. This is the first query buildContext() runs once a course is set, and a shared catch aborted the whole build after it — so VirtuProf answered without any course context (no chunks, pool questions, Leitner stats or weaknesses) and without reporting an error.
• CourseSummaryService: winner_uid on learning_duel_sessions. That column only exists on the league tables; a duel's winner follows from the scores. This query is on the ordinary course-summary path, so it took summaries, snapshots, narratives and CSV exports down with it. Wins are now counted from the scores of finished duels — and so is the total, because a duel that is still waiting for an opponent or expired unplayed has no winner and would otherwise sit in the denominator of win_rate.
• FeedController reported no course names. It called getName() on the course entity, which only has getTitle(); the surrounding catch turned that into course_name: null for every feed item rather than an error.
• Skill map and cheat sheet exposed courses the user is not in. enrichPoolsWithCourseData accepted a user id and then ignored it, so it returned every course any accessible pool had been added to. An instructor can attach a pool that was merely edit-shared with them, which handed the pool's owner the id and title of a course they are not a member of. Both queries now apply the same membership test the rest of the service already used, and both order their results — a pool can belong to several courses and the mapping keeps the first row, which without an explicit order was whatever the database happened to return first.
• LernprofilController logged nothing when it failed. All five catch (\Throwable) blocks returned a 500 without touching the logger, which is why nextcloud.log held no trace of an endpoint that had been broken since April 2026. They now log the exception before returning.

Security

• Duels and gameshows could be started on any pool. DuelService::createDuel and GameshowService::createSession only checked pool access when a courseId was supplied, and both endpoints accept none — so two cooperating users could start a session on an arbitrary pool id and read its questions, its answer options, and after answering the correct answer id. TrainingService has always gated its equivalent path. Both now call the same check, which is made public on QuestionService rather than copied a sixth time. Verified live in both directions: a pool the caller cannot reach is refused, one they can reach still works.
• The Wissensturm category endpoint had the same hole from a different angle: it took any pool id as the chosen category and read a question from it. It is now authorised against the session — the pool the session was created with, or any pool of its course — rather than against the caller's own pool access, because players who join a session legitimately are not required to have access to its pool.
• POST /api/courses/{id}/summary/snapshot did not check course access. Every other endpoint in SummaryController passes through CourseService::findById() first; this one called the service directly, so any logged-in user could snapshot an arbitrary course id and read the result back through their own snapshot. It now applies the same gate and answers 403.

Added

• scripts/check-sql-columns.py — resolves every alias-qualified column reference in app/lib against the live database schema. It found all four SQL defects above in one run.
• ClassResolutionTest — walks both places where Nextcloud builds a class name from a string (appinfo/routes.php route names and the FQCNs in appinfo/info.xml) and asserts each one resolves to a file whose name matches exactly, plus that the file declares the class name the router will ask for. Neither PHPStan nor the controllers' own unit tests can catch this: those tests use the real class name, so they load and pass while HTTP is broken.

Changed

• .githooks/pre-push now runs PHPUnit and the SQL column check. Neither the PHP test suite nor any schema check ran in a mandatory gate before, which is the reason both classes of defect survived for months. Note that the versioned hook was not the active one — core.hooksPath pointed at a stale copy in .git/hooks.
• The API test for /api/profile/skill-map asserts 200 and a payload shape; it accepted 500 before, and so reported a hard SQL error as passing for four months.
• The API test for /api/ai/available asserts 200 and a boolean payload. It previously accepted 200 or 500, which is what let a total outage ship through 23 tagged releases over five months — the endpoint always answers 200 with {available:bool}, including when no API key is configured, so a 500 was never an acceptable outcome.

Added

• occ learning:uninstall — removes everything this app leaves in the database, so the app can be uninstalled cleanly (#1). Dry run by default; --execute is required to change anything.
• Drops all learning_* tables, including the legacy names from both historical rename waves, and clears the rows left in migrations, appconfig, preferences, jobs, notifications, activity and activity_mq.
• Deletes the metadata rows before dropping the tables. Leaving the oc_migrations rows behind makes a later reinstall skip every migration and boot broken, so if a run dies between the two phases, this order leaves the recoverable state.
• Refuses to run when issuer/certificate data exists unless --keep-certificates or --drop-certificates is chosen: the Ed25519 issuer key is unrecoverable, and losing it makes every certificate ever issued permanently unverifiable.
• Refuses to run when any table cannot be read. An unreadable table is never mistaken for an empty one — every guess here is destructive.
• Reports rather than touches what it cannot safely change: the theming legal links (rewritten by Application::boot() on every request, so they can only be cleared after app:remove — the command prints the statement), the Dashboard layout row, and the files the app created under /Learning/ in users' homes.
• Tables carrying the learning_ prefix that this version does not know about are reported, not dropped.
• scripts/db-uninstall-probe.php — runs the real command against a throwaway MariaDB and PostgreSQL, covering platform behaviour no unit test or PostgreSQL-only dev instance can reach.

Fixed

• occ learning:import-pool-json no longer drops valid open questions. The pre-check demanded at least two answers for every question, which is right for multiple choice but wrong for open (fill-in) questions — those carry exactly one model answer and were skipped silently. The check now mirrors what QuestionService::create already enforced.

Changed

• The privacy and imprint pages name the operating company, with the registration details an imprint requires, instead of a private individual.

Notes

• No repair step is used for uninstall. Nextcloud executes <repair-steps><uninstall> from AppManager::disableApp(), so it also fires when an admin merely disables the app — a drop there would let one mis-click destroy every course, pool and certificate. The reasoning, including why a marker-armed variant was rejected, is recorded in UninstallCommand's class docblock.

A whole-app security audit (8 review lanes) followed by an adversarial multi-model pre-live review. Every finding was verified against the actual code before fixing; fixes shipping to the public App Store were themselves re-reviewed. No functional/feature changes — hardening only.

Security — Access control (IDOR)

• Course-scoped authorization on RAG import/list/delete/moderate endpoints (an instructor of course A could previously touch course B's shared RAG pool); course-membership gates on RAG contribution and on listing one's own contributions.
• Answer-key exports (CSV/JSON) require export-level access (owner, edit-share, or the instructor of a course the pool is attached to) — not plain read access; enrolled students can no longer pull answer keys.
• Course-access gates on document index/material-folder and course feed endpoints (previously cross-course content/PII could leak).

Security — Exam integrity (oracle prevention)

• During an active exam, explanations, correct answers, PBQ solution config and translated explanations are withheld across all surfaces that emit question-derived data (training/exam payloads, translation endpoints, the spaced-repetition due-queue, and VirtuProf's RAG + client-supplied question context).
• Starting an exam no longer auto-completes an existing exam by switching course context; correct PBQ answers now increment the exam score even when per-question feedback is suppressed.

Security — AI / GDPR

• Per-user AI consent is now enforced on every user-triggered LLM path (VirtuProf chat/interview, course summary, AI question generation, note generation, AI explanations) — the admin ai_enabled toggle alone is no longer sufficient. The frontend catches the consent-required response and points the user to the in-app consent dialog.
• Stored chat memory is NFKC-normalized and injection-filtered before re-entering the system prompt (a payload stripped on turn 1 could previously reappear on turn 2); the injection sanitizer now covers the same role-change / prompt-leak / jailbreak markers as the detector.
• File-intent note generation and chat-memory compression now count against the shared AI rate limit.

Security — Data-layer robustness

• Repair migration for course-feature table-name drift (curriculum scopes, question overrides, announcements) — cross-DB safe (PostgreSQL 16 / MariaDB / SQLite), identifier-quoted, fail-fast on platform-detection error, and it aborts rather than orphaning legacy data if a rename fails.
• Prefix-agnostic insert ids (exam slots, announcements) instead of a hardcoded oc_ sequence name; entity model aligned with the shipped schema.

Database

• Version009900: idempotent, data-preserving repair of legacy learning_curriculum_scopes / learning_q_overrides / learning_announcements → learning_course_*. Verified on PostgreSQL 16.

Versions 4.4.8 and 4.4.9 were internal migration-vehicle bumps and were never released; this entry covers everything since 4.4.7.

Added

• Signed completion certificates. A course can define pass criteria (score threshold, validity period). When a learner passes, the app mints a cryptographically signed certificate — a W3C Verifiable Credential (Ed25519 / VC-JWT) bound to the learner and the course.
• did:web issuer identity. Each instance is its own credential issuer via a path-based did:web derived from the server URL; the public key is published at the app's did.json. Issuer keys are generated with occ learning:cert:init-issuer, stored encrypted at rest (ICrypto), and can be rotated without invalidating previously issued certificates.
• Public verification portal. Anyone can verify a certificate by its ID / QR code on a public page. Signature, key status, claim binding, revocation and expiry are checked as an AND-chain; unknown IDs leak no personal data. Course owners can revoke certificates.
• Compliance report. Per-course completion/compliance report for instructors and admins (who passed, when, certificate status).
• Certificate view. A printable, A4-ready certificate with QR code, a prominent Certificate ID and a verification link.

Changed

• Avatars overhauled. The default assistant Nova is now a full chibi character with emotion-aware expressions (neutral / happy / sad / surprised / sleep / celebrate) instead of an abstract shape. The three scholar skins (Theoretiker / Kosmologe / Astrophysik-Popularisierer) were polished — gradient shading, larger eyes, brighter signature accents.

Setup

• Certificates need a one-time key. Run occ learning:cert:init-issuer once per server to generate the issuer signing key. Until it exists, the admin settings page shows a reminder and no certificate is minted when a learner passes. See README → Installation → Certificates setup.

Database

• Version009100 creates learning_cert_keys and learning_certificates; Version009200 adds revoked_at. Verified on PostgreSQL 16 and MariaDB (the credential_json / secret_key_enc TEXT columns are intentionally unindexed to avoid the utf8mb4 key-length limit).

Fixed

• learning_user_stats had no primary key (#24). Reported by @haecks on a fresh NC 33.0.5 install: Nextcloud logged "Table 'oc_learning_user_stats' has no primary key and therefore will not behave sane in clustered setups. This will throw an exception and not be installable in a future version of Nextcloud." The table was created back in Version001200 with only a unique index (learn_ustats_user_uniq) on user_id, never a primary key. Since there is exactly one stats row per user and every access path addresses the table by user_id, user_id is the natural primary key. A new migration (Version008000) drops the now-redundant unique index and promotes user_id to the primary key. The migration is idempotent (guards for missing table/column and an already-present primary key) so it is safe on existing installs and re-runs. Verified live on PostgreSQL 16 and independently on MariaDB 11.4 with utf8mb4 (the varchar(64) key stays well under InnoDB's index-length limit).

Fixed

• v4.4.5 shipped without the data/ directory (starter pools, campaigns, simulator scenarios, privacy-info.json, PWA guide, course materials — 77 files). The release build followed a cp file-list that omitted data/, so on a clean v4.4.5 install the "Add starter pool" feature, campaigns, the practicum/simulator scenarios and the privacy page had no backing data. v4.4.6 restores data/ (verified: tarball file-set now matches the last-known-good v4.4.4 manifest). The i18n content of v4.4.5 (#21 + #19) is unchanged and included.

Fixed

• Passing a course and issuing certificates failed on fresh installs. Every compliance event is chained to the one before it, and the chain starts from a first entry that the database update was supposed to create. Nextcloud skips that part of an update when an app is installed for the first time, so on every fresh install since 5.2 the chain had no start: "course passed", issuing or revoking a certificate and completing a mandatory training ended with a server error. The first entry is now created on install and on update. Where the chain already holds entries but its start record is missing, nothing is created automatically, because a new start would hide the gap; the admin log says so instead.
• Question translations did not work on fresh installs. The translation tables were renamed in 3.5, but the rename also ran only on updates, so fresh installs kept the old names and every translated question failed to load. The tables are now created where they are missing.

Instances that were updated from an older version, rather than installed fresh, were not affected.

Security

• The weekly study note was sent to the AI provider without consent. A background job runs once a week for everyone who studied in the last 60 days. It sent their weakest topic and the questions they got wrong to the configured AI provider to write a summary note, and it never checked whether the learner had agreed to AI processing. It now skips anyone without valid consent before reading their learning data, and the note generator refuses on its own so no other path can bypass it. This only affected instances with AI enabled.
• Outdated consent counted as consent. The server accepted any stored consent version; only the VirtuProf chat window compared it with the current consent text. The server now requires the current version on every AI path, and the VirtuProf chat and the course summary narrative no longer use their own weaker check. The course summary narrative is also rate limited now.
• A failed consent save was treated as consent. If saving the consent failed, VirtuProf closed the dialog and sent the waiting message anyway, although the server had no consent on record. The dialog now stays open with an error message and nothing is sent until the save succeeds.
• Follow-up requests are checked too. Chat-memory compression and the pool generator send further requests after the first one; each now checks consent right before sending. If the server reports missing consent, VirtuProf asks again instead of showing a generic error.

A larger rework of AI consent follows in 5.6.0: consent will name the actual AI provider, the consent text will describe exactly what is sent, and everyone will be asked once to confirm the corrected text.

Fixed

• The app icon stood out in the app menu. Learning used a coloured icon where Nextcloud expects the same monochrome glyph as every other app. The coloured logo is still used on certificates when the instance has no logo of its own.

Fixed

• Tool selections were saved but never applied. Reported again on #7 after 5.4.6: "regardless of the selection, all tools remain visible". 5.4.6 fixed the settings form, but nothing read the setting where tools actually appear. The course's learning space ignored the admin's global selection entirely, and an empty course selection ("every tool off") was read as "no selection" and showed all eight. Both levels now apply: the admin's selection, narrowed by the course's. With nothing left, the Tools tab disappears, and the dashboard drops its tools link when the admin has switched every tool off. After saving in the course administration the learning space updates without a reload. The unit tests for the learning space had carried their own copy of the old logic instead of calling the component, which is why they stayed green; they now test the component, and a rendering test counts the tools a learner sees. Verified in a browser on Nextcloud 33.0.9 with MariaDB 10.11, before and after.
• The pool rules dialog showed every pool as required. The server sends the flag as 0/1, and the dialog read 0 as "required", so the checkbox was ticked for supplementary pools too — and saving any other rule in that dialog marked the pool required again. Found while adding the option below, which depends on that flag being right.

Added

• Practice exams from required pools only. Follow-up on #9: a course may hold supplementary pools for self-study that should stay out of the exam simulation. The practice exam settings have a new option, Use required pools only, which draws questions only from pools marked Required in the pool rules. If the option is on but no pool is marked, instructors see a warning in the settings and learners get a clear message instead of "no questions". Tested on a fresh install and on upgrades from 5.5.0, on MariaDB 10.11 and PostgreSQL 16.

Requested on #9 by a team preparing aviation radio courses: until now the exam mode assumed an IT certification.

Added

• Practice exams per course. Requested on #9 for training outside IT certification: the exam mode only knew the fixed CompTIA presets (90 questions/90 minutes and 45/45, pass at 720/900). Instructors can now offer a practice exam in a course's Administration tab and set the number of questions, a time limit or none, and the pass mark in percent. Learners start it themselves from its own tab — no pool to pick first — and every attempt draws a fresh random set from all of the course's pools. Afterwards they get a review with the explanations. The CompTIA presets stay as they were; the practice exam tab shows even where the preset exam is switched off.

Practice exams never count towards a certificate: they are marked separately, and the pass evaluation reads only the other exams. For the same reason they are left out of the locks that keep an exam from being used as an answer key — an untimed one left open would otherwise block training and explanations on its pools indefinitely. The reverse direction is guarded: while a certificate-relevant exam runs in the course, a practice exam cannot start, and an old one withholds its review.

The pass verdict is decided on the server against the threshold stored when the attempt began, in integer arithmetic (74.6 % does not pass 75 %), so a later change by the instructor does not rewrite past attempts. Tested on fresh installs and on upgrades from 5.4.6, on MariaDB 10.11 and PostgreSQL 16.

Both reports came from the same install on Hetzner Storage Share: no shell, no occ, and MariaDB. #7 found a course view that failed and tool selectors that never showed their state; #8 found a false audit alarm and a certificate setup that required a command the host does not offer.

Added

• Certificates can be activated from the admin page. Signed certificates need an issuer signing key, and until now the only way to create it was occ learning:cert:init-issuer — unreachable on managed hosting without shell access, where certificates could therefore never be enabled. Reported on #8 from Hetzner Storage Share. The certificates notice now has a Generate signing key button.

It only ever creates the first key: if one exists it refuses with 409, because an existing key may already have signed certificates. Rotation stays occ-only. Creation runs under an exclusive lock, so a double-click cannot leave two active keys — a guard the occ path now shares.

Fixed

• "Checkpoint overdue" on installs with nothing to checkpoint. Reported on #8: the warning appeared next to "No checkpoint yet" and "Events since last checkpoint: 0". Overdue was measured from the last checkpoint, and a missing one counts as timestamp 0, so every fresh install was overdue from the start. The same false alarm followed every quiet week, because the weekly job deliberately skips when no new audit events exist. Overdue now means an audit event has waited more than 8 days for a checkpoint — which still catches a job that is not running.

The warning also pointed to occ learning:audit:verify, which checks the chain but creates no checkpoint. It now names the actual cause: a missing signing key (checkpoints are signed with it), or background jobs that are not running. - Tool selections appeared not to save. The selectors bound :model-value on native <input type="checkbox"> elements, which have no such prop — Vue rendered it as an inert attribute, so the boxes never showed the stored state. Every tool looked unchecked, clicking an already-enabled one changed nothing, and saving wrote all eight back. Reported on #7; four occurrences fixed. - Fresh installs never received three course tables. Version009900 does its work in postSchemaChange(), but a fresh install executes only changeSchema() and then records every migration as done — so it never ran and could never be revisited. Version010100 creates the tables in changeSchema() and copies any legacy rows afterwards. This is the likely reason a course view failed on the reporter's install, and why reinstalling the app reproduced the problem instead of fixing it. - The certification toggle always saved the previous value. It listened for @update:checked, which @nextcloud/vue 9 components no longer emit. - The active exam slot never displayed. The view read res.data.slot; the controller returns exam_slot. - Two buttons missed by 5.4.5. Both passed a styling value through a dynamic :type binding, which the new guard did not yet check. It now covers dynamic bindings too. - A missing database table no longer takes down an entire course view. Reported on #7 from an install on managed hosting, where oc_learning_course_curriculum_scopes did not exist. That table comes from a rename migration (Version009900) which deliberately aborts rather than creating an empty table over existing data — so an install can legitimately end up without it, and the app treated that as fatal. Curriculum scoping, paused-question overrides and announcements now fall back to "nothing configured" and log a warning naming the migration and the occ command that repairs it.

Writes are deliberately left throwing: reporting success for a save that stored nothing is the worse failure, and the caller has to be able to tell the user it failed.

The "is this table missing" check moved into Db\DbErrors rather than being copied — UninstallCommand has needed the same predicate since v5.3.0. It stays narrow on purpose: anything not positively identified as a missing table is rethrown, so a genuine database outage cannot turn into silently empty results.

This limits the damage. Why the table was absent is the "three course tables" entry above.

Reported in #7 by an external user on macOS, reproducible in both Safari and Chrome. The report was precise and its diagnosis correct — it just described one button out of 244.

Fixed

• "Upload image" saved the question before a file was picked. The Vue 3 migration (380dd9a, 2026-04-03) moved the app from @nextcloud/vue 8 to 9, which swapped the meaning of two NcButton props: styling moved from type to variant, and type became the native <button type> attribute. native-type was dropped entirely. The v8 spelling was never migrated, so every button passed a styling value such as "secondary" to the native attribute — and HTML's invalid-value-default turns an unknown button type into submit. Inside a <form>, every one of those buttons submitted.
• "Cancel" in the question editor saved the question instead of discarding it. Same cause (type="tertiary"), not in the report, arguably worse than the reported symptom.
• The three save buttons only worked by accident. They carried type="primary" plus a native-type="submit" that v9 ignores; they submitted because the styling value was invalid, not because they asked to. They now say type="submit" explicitly.
• All 244 NcButton instances were migrated to variant (the 222 outside forms were a visual-only defect: with variant never set, every button in the app had been rendering in the default secondary style for 5.5 months).

Added

• tests/unit/NcButtonTypeProp.test.js — pins the v9 prop contract against a real NcButton render, and scans every .vue file so the v8 spelling cannot return. The four existing gates could not see this class of defect: it is valid Vue, valid JS and valid HTML.
• tests/unit/QuestionFormSubmit.test.js — mounts the real form with real buttons and clicks them, asserting which ones reach a submit. Reverting the fix turns it red, on the submit count rather than on an attribute. Note the precondition the report already implied with "open an existing question for editing": while the required fields are empty, constraint validation suppresses submission on its own and hides the defect entirely.

Reported in #6 by the administrator piloting Learning in Vinnytsia. Two of the three questions turned out to describe real defects rather than gaps in understanding.

Fixed

• The assistant rendered German text inside a Ukrainian interface. VirtuProf does not translate through Nextcloud's t(); it resolves against its own bundled catalogue, and 161 of its 343 reachable strings had drifted out of that catalogue — including every FAQ answer body. translateVirtuProf() then fell back to the raw source string, which is German for most of them. 63 of the 161 were already translated in l10n/uk.json and simply never made it into the catalogue; the remaining 105 are new and now exist in all six languages.
• The AI assistant was told to answer Ukrainian and French users in English. The system prompt's language map only knew German, English, Russian and Arabic, so anything else produced the instruction "If unsure, default to English". It now covers all six languages.
• The assistant ignored the Nextcloud interface language. It derived the response language from the opt-in content-language setting alone, with a hard English fallback. It now falls back to the user's Nextcloud interface language, then the instance default.
• Choosing Arabic as content language did nothing. The dropdown has offered it for months and the request sent it, but the server's whitelist did not include ar, so the value was silently replaced with the empty string and the request still answered 200.
• "Create summary" wrote an English note for a Ukrainian user. NoteGeneratorService, which the assistant reaches through its file-intent path, carried its own copy of both the language lookup and the language-name map — and its copy was missing French and Ukrainian in exactly the same way. Both now come from one shared resolver.
• The assistant panel header rendered three empty strings. Its translate helper passed the key where the function expects the language, so the panel label was blank and both the minimise and close buttons had an empty accessible name — in every language, German included.

Added

• An instructor group setting in the administration page. Members of that Nextcloud group may create courses and question pools without Nextcloud administrator rights. The mechanism is not new — it has been learning-instructors all along — but nothing named it: the admin page referred to "the configured instructor group" without saying which, and the manual claimed the instructor role was per-course only, which is wrong for creating a course in the first place.
• The five textbook fields in the pool dialog now explain themselves. They are optional and only pay off when a pool mirrors one chapter of a book; the dialog says so, and each field describes what belongs in it.
• A fifth i18n gate (scripts/gen-virtuprof-strings.mjs --check). The VirtuProf catalogue is now generated from l10n/*.json rather than hand-maintained, and the gate fails when the two disagree or when a reachable assistant string exists in no language file. Verified: removing a VirtuProf key from all six language files leaves gates 1–4 green and turns this one red. The catalogue grew from 252 to 429 keys and lost none — keys reached through vt(<expression>), which no literal scan can resolve, are carried forward until they leave l10n/de.json. --list-indirect names the 22 call sites this protects.

Documentation

• New manual section 2.3 on letting teachers create courses and pools, a corrected role description in section 1, a field-by-field table with a worked example for the pool dialog in 3.1, and two new troubleshooting entries.

Internal

• deploy-prod.sh --stage-gate now copies appinfo/ into the analysis copy. Without it ClassResolutionTest — the regression test written after the AIController/AiController outage — errored out instead of running.

Found by clicking through the 5.4.2 deployment: the wizard's "Skip" button sat at top: 16px, directly underneath the Nextcloud header, whose avatar button swallowed every click. The splash screen carries its own skip link at the bottom, so the first step looked fine — but from step two onwards there was no reachable way out of the introduction at all.

This is not new in 5.4.2; it has been there as long as the redesigned wizard. It is the sharper half of what #5 describes: users could not get rid of the introduction even when they tried.

Fixed

• The wizard's skip button clears the Nextcloud header and can actually be clicked from every step. Verified in the browser: a click on the button's own centre used to be delivered to the header's avatar.

Added

• Two browser tests that would have caught this: one walks a new account through the introduction and asserts it stays gone after clearing site data, the other asserts the skip button — not the header — receives a click aimed at it.

Reported by the same administrator piloting Learning in Vinnytsia (#5): the help wizard reappeared for users who had already been through it, and its introductory questions ("How many bits are in one byte?") were beside the point for staff in occupational safety or HR.

The reappearance turned out to be three separate defects, not a missing setting.

Fixed

• The assistant's introduction never honoured "no thanks". It read that setting from a response which does not contain it — /api/profile/telos/status returns the completion flag and nothing else — so the check was always false and the introduction started again on every single page load. The setting had been saved correctly the whole time.
• Whether the wizard had been seen lived in browser storage alone. That is scoped to one browser on one machine, so a second computer, a different browser, a private window or cleared site data all brought it back. The server is authoritative now; browser storage remains only as an offline fallback.
• Skipping the wizard recorded nothing on the server. It counts as a decision now, like completing it.
• Instructors were shown two introductions in a row — the wizard, and the slide tour the moment it closed. One introduction, one decision.
• Existing users are marked as done during the upgrade, so the update itself does not send a whole instance back through the introduction.

Changed

• Instructors now see the full nine-slide tour inside the wizard. It used to follow the wizard as a second, separate introduction; folding it in keeps the content while removing the duplication. OnboardingIntro is unreachable for now and becomes the voluntary tour in 5.5.0.
• Declining the assistant's introduction now puts the assistant in its reduced mode instead of leaving it in an undetermined state.

The introductory content itself is being reworked for 5.5.0.

Reported by the same administrator piloting Learning in Vinnytsia (#4): one error and one warning in the Nextcloud log. The warning was what it looked like. The error was the visible edge of a defect that had been silently discarding onboarding results since v4.2.0 (4 April 2026) — seventeen releases.

Fixed

• The onboarding wizard could not save a profile, and lost two more things while failing. OnboardingRedesign.vue built its own request body instead of using the shared payload builder, and posted '' for the list fields where every other caller posts an array. TelosController::saveTelos() declared those parameters ?array, so PHP raised a TypeError inside Nextcloud's Dispatcher — before the controller body ran, which is why the controller's own try/catch never saw it and the user got a bare 500.

The damage was three times the reported symptom, because finalize() ran three steps inside one try with an empty catch: 1. the learning profile was never stored — onboarding_completed stayed false, so VirtuProf kept asking for a profile the user had already filled in; 2. the AI consent was never stored, even for users who explicitly opted in. Since the universal consent gate in v5.2.1, that locks every AI feature behind consent_required for them; 3. the selected starter pool was never imported — the wizard offers a pool, the user picks one, and nothing arrives.

None of it was logged. Three fixes, at three different levels: - OnboardingRedesign.vue now builds its payload with createTelosForm() / buildTelosPayload() — the same util PersonalSettings.vue and VirtuProf.vue use, so there is one payload shape in the app instead of two that can drift apart again. - finalize() settles each step independently and logs a failure to the console instead of swallowing it, so one failing step can never cancel the other two. - saveTelos() / updateTelos() accept array|string|null for the list fields and split a string on the same separators as the frontend (, ; newline). A malformed telos payload now answers 400 instead of raising an uncatchable dispatcher TypeError.

No migration is needed and no data was corrupted — nothing was written, rather than something wrong being written. Affected users recover on their own: the profile can be filled in under Settings → Personal or through VirtuProf, the consent dialog reappears when an AI feature is used, and a starter pool can be imported from the pool list.

• Activity\Provider::parse() threw the deprecated \InvalidArgumentException. Nextcloud replaced that contract with \OCP\Activity\Exceptions\UnknownActivityException in NC 30; until then every activity-stream load logged a deprecation warning, and from NC 39 it will be logged as an error. Both throw sites migrated.

Notification\Notifier had already been moved to UnknownNotificationException — the same NC 30 cohort — and this provider was simply missed. Each throw site now has a test, so the pair cannot drift apart again.

Tests

• tests/Unit/Activity/ProviderTest.php (new), tests/unit/onboardingTelosPayload.test.js (new, covering both the payload shape and the step isolation in finalize()), and seven cases added to tests/Unit/Controller/TelosControllerTest.php.
• Every one of them was verified to fail against the pre-fix code before being kept — the controller cases reproduce the reporter's exact TypeError, and the finalize() case fails with expected [ 'telos' ] to deeply equal [ 'telos', 'consent', 'pool' ].
• tests/Support/PhpUnitStubs.php gained OCP\Activity\IEvent, IProvider and UnknownActivityException; the PHPUnit bootstrap deliberately does not load Composer's autoloader, so OCP types live there.

Also fixed — found by auditing for the same bug class

Codeberg #4 was one instance of a pattern: a frontend that posts a body the controller does not read. Nextcloud's dispatcher does not reject unknown keys and fills the missing parameter with its default, so the request succeeds and the app quietly does the wrong thing. PHPStan cannot see across the HTTP boundary and service tests start after it, so nothing caught these. An adversarial audit of every such call site turned up four more.

• Saving a course schedule deleted it. CourseController::setSchedule() takes entries; the curriculum tab sent schedule. $entries stayed at its [] default, and ScheduleService reads that as "replace the schedule with nothing" — it deleted every row, inserted none, and answered 200, which the UI reported as saved. An instructor editing a curriculum schedule lost it, with a success message.
• Reported questions lost their identity. SupportTicketController::create() reads questionId/poolId/courseId out of context; VirtuProf's "report this question" sent them at the top level, so the ticket's structured columns were stored as NULL and the question was identifiable only through the subject line. The same component already built the correct shape for its other ticket call.
• "Explain the question I just got wrong" did not load that question. The chat request sent questionId; the controller declares lastWrongQuestionId. The value was dropped, so the retrieval context never included it. The richer questionContext usually masked the defect.
• Two icon URLs were relative where Nextcloud requires absolute — Activity\Provider::setIcon() and Dashboard\LearningWidget::getIconUrl() (whose interface says so explicitly). Desktop and mobile clients do not share the web root, so those icons did not render there. Notification\Notifier had already been doing this correctly.

Each of these is now pinned by a request-boundary test in tests/unit/requestPayloadContracts.test.js, verified to fail against the pre-fix components.

Also fixed — in the profile endpoint itself

• An emptied help-topics list was silently preserved. saveTelos() forwarded the list only when it was non-empty, so [] and '' both meant "omit" rather than "clear". Emptying the textarea and saving kept the old value — and since help topics are published to classmates through the classbook at course or public visibility, a user could not withdraw a topic once shared. An omitted field (null) still means "leave as is"; a supplied empty one now clears, matching what updateTelos() already did.
• A malformed updateTelos() payload could half-save. Skipping a non-array telos and carrying on meant {"telos": "oops", "bio": "changed"} stored the bio and answered 200 — a worse outcome than the TypeError it replaced. It is now rejected before any other field is touched.

Known limitations

• List values are not round-trip safe: a topic containing a comma, semicolon or newline is split on reload, because the frontend has always joined and split on those characters and there is no escaping scheme. The string path added above follows the same convention rather than introducing a second one.
• Users whose onboarding failed before this release keep a local "onboarding seen" flag while the server has no profile. They can fill the profile at any time, and the assistant prompts students who have it enabled, but there is no automatic reconciliation for instructors or for users with the assistant switched off.

Prompted by a report from a system administrator piloting Learning at a manufacturing company in Vinnytsia, Ukraine (#3), who raised two problems: parts of the interface appear only in English or German, and there is no manual. Both turned out to be real defects, and the first one was considerably larger than the report suggested.

Added

• Ukrainian interface language (uk) — the sixth language, complete at 2,940 keys in the main catalogue plus 252 in the VirtuProf runtime catalogue. Plural form is the three-form Slavic rule, not the two-form default.
• This is a first pass and has not been reviewed by a native speaker. It is labelled as such in the manual, with instructions for submitting corrections without touching code.
• docs/MANUAL.md — a user and administrator manual covering the chain the reporter asked for: course → learning materials → pool → questions → students → test attempt → results → completion, plus admin setup, the occ commands, mandatory training and compliance, the AI consent model, and how to add or fix a translation.
• Linked from README.md and from a new <documentation> element in info.xml. That element was absent, so the App Store listing offered no documentation link at all — the direct reason the reporter could not find any.
• Two new i18n gates, both wired into check-i18n-parity.sh:
• scripts/check-i18n-coverage.py compares the source against the catalogue. Gates 1–3 all compare the language files against each other, so a string missing from all of them at once passes every one of them. Verified by reconstructing the defect: removing a key from all six files leaves gates 1–3 green and turns this one red. It covers JS/Vue t()/n(), PHP $l->t() and the indirect toolCatalog.js keys.
• scripts/check-i18n-placeholders.py asserts that every translated value carries the same placeholders ({n}, %1$s, …) as its German source, and that no value is written in the wrong script. With six languages and machine-assisted translation, a dropped placeholder became the likeliest remaining defect.

Fixed

• 635 interface strings were absent from the translation catalogue entirely. They were passed through t() but had no entry in de.json, so Nextcloud's l10n fell back to the source string and rendered them in German in every language, including English.
• 618 came from JS/Vue, 10 from PHP $l->t() calls (notification subjects, the legal notice and privacy links), and 7 from toolCatalog.js, which reaches t() through a variable and is invisible to any literal scan.
• The most-used casualties: the course materials tab almost in full, parts of course administration, and the answer-type selector in the question form — Einzelauswahl / Mehrfachauswahl / Freitext, the three options every author picks between when writing a question.
• All 635 are now in the catalogue and translated into all six languages.
• VirtuProf keeps its own 252-key runtime catalogue (src/l10n/virtuprof-strings.js) which is separate from l10n/*.json and was not covered by any gate. A language added to the main catalogue alone would leave the assistant speaking German or English. It now carries a uk dictionary, and virtuprof-i18n.js lists it.
• VirtuProf's backend language allow-list silently discarded valid choices. VirtuProfController::ALLOWED_INTERFACE_LANGUAGES did not contain fr, although the frontend has offered French all along; normalizeInterfaceLanguage() coerces anything unlisted to '' and returns no error, so a French user's choice was dropped without a trace. Both fr and uk are now listed, with a comment naming the three places that must stay in sync.
• scripts/deploy-prod.sh synced a hard-coded five-language list. A new language would have been generated, guarded and committed — and then never copied to the server. Now six, alongside l10n_js_sync.py and check-i18n-parity.sh.

Known limits

• Some strings still reach t() through variables that the coverage gate cannot enumerate (onboarding slide definitions, dashboard tiles, a few config objects). Run python3 scripts/check-i18n-coverage.py --list-indirect to see the remaining call sites. Those were not audited in this pass.
• The content language layer — optional parallel translations of question text, held in learning_q_translations / learning_a_translations — still accepts only de, en, ru, ar. Adding uk means a DB migration against a CHECK constraint and a re-test on both PostgreSQL and MariaDB, so it is deliberately out of scope here. It is not a blocker for Ukrainian use: questions authored directly in Ukrainian are stored and displayed unchanged, because the base question row has no language constraint.

Fixed

• Every AI endpoint returned HTTP 500 instead of working (#3). Nextcloud derives the controller class from the route name, so 'name' => 'ai#available' resolves to OCA\Learning\Controller\AiController. The file was named AIController.php and declared class AIController; because PSR-4 autoloading is case-sensitive, the class was never found and the App Framework threw QueryNotFoundException before the request reached any of our code. All five ai#* routes — available, generate, status, import and explain — have been broken this way since they were introduced in v2.7.0.
• Visible effect was mostly log noise: the callers in QuestionList.vue, LeitnerMode.vue and TrainingMode.vue swallow the failure and fall back to aiAvailable = false, so the AI buttons simply never appeared. Nothing was lost, but nothing worked either, and every page that asked wrote a stack trace to nextcloud.log.

• The class-resolution failure happens before the authentication middleware, which is why the endpoint answered 500 to anonymous callers where every healthy route answers 401. That difference is what pinned the diagnosis.

• Four SQL queries referenced columns that do not exist, each failing with SQLSTATE 42703 every time it ran. All four were invisible to PHPStan — the defect lives in a string — and each sat behind a catch (\Throwable) that turned the error into a 500 or an empty result.

• LernprofilService: c.name on learning_courses, which has title. In enrichPoolsWithCourseData this broke /api/profile/skill-map outright (since 2026-04-09); the identical mistake in the cheat-sheet query hit only users who actually had wrong answers to report, so it stayed hidden behind an empty-result early return on fresh accounts.
• RagContextService and CourseSummaryService: ua.user_id on learning_user_answers, which has no user column at all — the user hangs off the session. Both now join learning_sessions the way NoteGeneratorService already did. User weaknesses and trouble spots never loaded; they threw.
• CourseSummaryService additionally compared the boolean is_correct against the integer 1, a type error on PostgreSQL. It now tests the column directly, which is portable across PostgreSQL and MariaDB.
• NoteGeneratorService: chapter_ref on learning_pools, a column that never existed (the chapter columns are chapter_key / chapter_title / chapter_order). Every authorised POST /api/notes/generate died in this query, before reaching the model at all.
• RagContextService: name on learning_courses. This is the first query buildContext() runs once a course is set, and a shared catch aborted the whole build after it — so VirtuProf answered without any course context (no chunks, pool questions, Leitner stats or weaknesses) and without reporting an error.
• CourseSummaryService: winner_uid on learning_duel_sessions. That column only exists on the league tables; a duel's winner follows from the scores. This query is on the ordinary course-summary path, so it took summaries, snapshots, narratives and CSV exports down with it. Wins are now counted from the scores of finished duels — and so is the total, because a duel that is still waiting for an opponent or expired unplayed has no winner and would otherwise sit in the denominator of win_rate.
• FeedController reported no course names. It called getName() on the course entity, which only has getTitle(); the surrounding catch turned that into course_name: null for every feed item rather than an error.
• Skill map and cheat sheet exposed courses the user is not in. enrichPoolsWithCourseData accepted a user id and then ignored it, so it returned every course any accessible pool had been added to. An instructor can attach a pool that was merely edit-shared with them, which handed the pool's owner the id and title of a course they are not a member of. Both queries now apply the same membership test the rest of the service already used, and both order their results — a pool can belong to several courses and the mapping keeps the first row, which without an explicit order was whatever the database happened to return first.
• LernprofilController logged nothing when it failed. All five catch (\Throwable) blocks returned a 500 without touching the logger, which is why nextcloud.log held no trace of an endpoint that had been broken since April 2026. They now log the exception before returning.

Security

• Duels and gameshows could be started on any pool. DuelService::createDuel and GameshowService::createSession only checked pool access when a courseId was supplied, and both endpoints accept none — so two cooperating users could start a session on an arbitrary pool id and read its questions, its answer options, and after answering the correct answer id. TrainingService has always gated its equivalent path. Both now call the same check, which is made public on QuestionService rather than copied a sixth time. Verified live in both directions: a pool the caller cannot reach is refused, one they can reach still works.
• The Wissensturm category endpoint had the same hole from a different angle: it took any pool id as the chosen category and read a question from it. It is now authorised against the session — the pool the session was created with, or any pool of its course — rather than against the caller's own pool access, because players who join a session legitimately are not required to have access to its pool.
• POST /api/courses/{id}/summary/snapshot did not check course access. Every other endpoint in SummaryController passes through CourseService::findById() first; this one called the service directly, so any logged-in user could snapshot an arbitrary course id and read the result back through their own snapshot. It now applies the same gate and answers 403.

Added

• scripts/check-sql-columns.py — resolves every alias-qualified column reference in app/lib against the live database schema. It found all four SQL defects above in one run.
• ClassResolutionTest — walks both places where Nextcloud builds a class name from a string (appinfo/routes.php route names and the FQCNs in appinfo/info.xml) and asserts each one resolves to a file whose name matches exactly, plus that the file declares the class name the router will ask for. Neither PHPStan nor the controllers' own unit tests can catch this: those tests use the real class name, so they load and pass while HTTP is broken.

Changed

• .githooks/pre-push now runs PHPUnit and the SQL column check. Neither the PHP test suite nor any schema check ran in a mandatory gate before, which is the reason both classes of defect survived for months. Note that the versioned hook was not the active one — core.hooksPath pointed at a stale copy in .git/hooks.
• The API test for /api/profile/skill-map asserts 200 and a payload shape; it accepted 500 before, and so reported a hard SQL error as passing for four months.
• The API test for /api/ai/available asserts 200 and a boolean payload. It previously accepted 200 or 500, which is what let a total outage ship through 23 tagged releases over five months — the endpoint always answers 200 with {available:bool}, including when no API key is configured, so a 500 was never an acceptable outcome.

Added

• occ learning:uninstall — removes everything this app leaves in the database, so the app can be uninstalled cleanly (#1). Dry run by default; --execute is required to change anything.
• Drops all learning_* tables, including the legacy names from both historical rename waves, and clears the rows left in migrations, appconfig, preferences, jobs, notifications, activity and activity_mq.
• Deletes the metadata rows before dropping the tables. Leaving the oc_migrations rows behind makes a later reinstall skip every migration and boot broken, so if a run dies between the two phases, this order leaves the recoverable state.
• Refuses to run when issuer/certificate data exists unless --keep-certificates or --drop-certificates is chosen: the Ed25519 issuer key is unrecoverable, and losing it makes every certificate ever issued permanently unverifiable.
• Refuses to run when any table cannot be read. An unreadable table is never mistaken for an empty one — every guess here is destructive.
• Reports rather than touches what it cannot safely change: the theming legal links (rewritten by Application::boot() on every request, so they can only be cleared after app:remove — the command prints the statement), the Dashboard layout row, and the files the app created under /Learning/ in users' homes.
• Tables carrying the learning_ prefix that this version does not know about are reported, not dropped.
• scripts/db-uninstall-probe.php — runs the real command against a throwaway MariaDB and PostgreSQL, covering platform behaviour no unit test or PostgreSQL-only dev instance can reach.

Fixed

• occ learning:import-pool-json no longer drops valid open questions. The pre-check demanded at least two answers for every question, which is right for multiple choice but wrong for open (fill-in) questions — those carry exactly one model answer and were skipped silently. The check now mirrors what QuestionService::create already enforced.

Changed

• The privacy and imprint pages name the operating company, with the registration details an imprint requires, instead of a private individual.

Notes

• No repair step is used for uninstall. Nextcloud executes <repair-steps><uninstall> from AppManager::disableApp(), so it also fires when an admin merely disables the app — a drop there would let one mis-click destroy every course, pool and certificate. The reasoning, including why a marker-armed variant was rejected, is recorded in UninstallCommand's class docblock.

A whole-app security audit (8 review lanes) followed by an adversarial multi-model pre-live review. Every finding was verified against the actual code before fixing; fixes shipping to the public App Store were themselves re-reviewed. No functional/feature changes — hardening only.

Security — Access control (IDOR)

• Course-scoped authorization on RAG import/list/delete/moderate endpoints (an instructor of course A could previously touch course B's shared RAG pool); course-membership gates on RAG contribution and on listing one's own contributions.
• Answer-key exports (CSV/JSON) require export-level access (owner, edit-share, or the instructor of a course the pool is attached to) — not plain read access; enrolled students can no longer pull answer keys.
• Course-access gates on document index/material-folder and course feed endpoints (previously cross-course content/PII could leak).

Security — Exam integrity (oracle prevention)

• During an active exam, explanations, correct answers, PBQ solution config and translated explanations are withheld across all surfaces that emit question-derived data (training/exam payloads, translation endpoints, the spaced-repetition due-queue, and VirtuProf's RAG + client-supplied question context).
• Starting an exam no longer auto-completes an existing exam by switching course context; correct PBQ answers now increment the exam score even when per-question feedback is suppressed.

Security — AI / GDPR

• Per-user AI consent is now enforced on every user-triggered LLM path (VirtuProf chat/interview, course summary, AI question generation, note generation, AI explanations) — the admin ai_enabled toggle alone is no longer sufficient. The frontend catches the consent-required response and points the user to the in-app consent dialog.
• Stored chat memory is NFKC-normalized and injection-filtered before re-entering the system prompt (a payload stripped on turn 1 could previously reappear on turn 2); the injection sanitizer now covers the same role-change / prompt-leak / jailbreak markers as the detector.
• File-intent note generation and chat-memory compression now count against the shared AI rate limit.

Security — Data-layer robustness

• Repair migration for course-feature table-name drift (curriculum scopes, question overrides, announcements) — cross-DB safe (PostgreSQL 16 / MariaDB / SQLite), identifier-quoted, fail-fast on platform-detection error, and it aborts rather than orphaning legacy data if a rename fails.
• Prefix-agnostic insert ids (exam slots, announcements) instead of a hardcoded oc_ sequence name; entity model aligned with the shipped schema.

Database

• Version009900: idempotent, data-preserving repair of legacy learning_curriculum_scopes / learning_q_overrides / learning_announcements → learning_course_*. Verified on PostgreSQL 16.

Versions 4.4.8 and 4.4.9 were internal migration-vehicle bumps and were never released; this entry covers everything since 4.4.7.

Added

• Signed completion certificates. A course can define pass criteria (score threshold, validity period). When a learner passes, the app mints a cryptographically signed certificate — a W3C Verifiable Credential (Ed25519 / VC-JWT) bound to the learner and the course.
• did:web issuer identity. Each instance is its own credential issuer via a path-based did:web derived from the server URL; the public key is published at the app's did.json. Issuer keys are generated with occ learning:cert:init-issuer, stored encrypted at rest (ICrypto), and can be rotated without invalidating previously issued certificates.
• Public verification portal. Anyone can verify a certificate by its ID / QR code on a public page. Signature, key status, claim binding, revocation and expiry are checked as an AND-chain; unknown IDs leak no personal data. Course owners can revoke certificates.
• Compliance report. Per-course completion/compliance report for instructors and admins (who passed, when, certificate status).
• Certificate view. A printable, A4-ready certificate with QR code, a prominent Certificate ID and a verification link.

Changed

• Avatars overhauled. The default assistant Nova is now a full chibi character with emotion-aware expressions (neutral / happy / sad / surprised / sleep / celebrate) instead of an abstract shape. The three scholar skins (Theoretiker / Kosmologe / Astrophysik-Popularisierer) were polished — gradient shading, larger eyes, brighter signature accents.

Setup

• Certificates need a one-time key. Run occ learning:cert:init-issuer once per server to generate the issuer signing key. Until it exists, the admin settings page shows a reminder and no certificate is minted when a learner passes. See README → Installation → Certificates setup.

Database

• Version009100 creates learning_cert_keys and learning_certificates; Version009200 adds revoked_at. Verified on PostgreSQL 16 and MariaDB (the credential_json / secret_key_enc TEXT columns are intentionally unindexed to avoid the utf8mb4 key-length limit).

Fixed

• learning_user_stats had no primary key (#24). Reported by @haecks on a fresh NC 33.0.5 install: Nextcloud logged "Table 'oc_learning_user_stats' has no primary key and therefore will not behave sane in clustered setups. This will throw an exception and not be installable in a future version of Nextcloud." The table was created back in Version001200 with only a unique index (learn_ustats_user_uniq) on user_id, never a primary key. Since there is exactly one stats row per user and every access path addresses the table by user_id, user_id is the natural primary key. A new migration (Version008000) drops the now-redundant unique index and promotes user_id to the primary key. The migration is idempotent (guards for missing table/column and an already-present primary key) so it is safe on existing installs and re-runs. Verified live on PostgreSQL 16 and independently on MariaDB 11.4 with utf8mb4 (the varchar(64) key stays well under InnoDB's index-length limit).

Fixed

• v4.4.5 shipped without the data/ directory (starter pools, campaigns, simulator scenarios, privacy-info.json, PWA guide, course materials — 77 files). The release build followed a cp file-list that omitted data/, so on a clean v4.4.5 install the "Add starter pool" feature, campaigns, the practicum/simulator scenarios and the privacy page had no backing data. v4.4.6 restores data/ (verified: tarball file-set now matches the last-known-good v4.4.4 manifest). The i18n content of v4.4.5 (#21 + #19) is unchanged and included.

Changed — UX-Navigation Struktur

• Instructor Tab Groups: 17 instructor tabs organized into 5 logical groups (Lernraum, Teilnehmer, Kommunikation, Wettbewerb, Verwaltung) with visual separators.
• Abenteuer Standalone: Adventure mode promoted from Arena sub-mode to its own CourseDetail tab, independently gatable via mode_config.
• Arena Submode Gating: Each Arena mode (Duel, Gameshow, Oldschool) individually hideable per course rules. Arena tab disappears when all sub-modes disabled.

Changed — Code-Hygiene & Settings

• Settings Split: Instructors now see two sub-tabs in Settings: "Kurs-Verwaltung" (admin) and "Meine Einstellungen" (personal). Students see only personal settings.
• Zeitreise Removed: Removed 1270+ lines of dead Zeitreise/HackThroughTime frontend code (component, characters, navigation, mode_config key).
• German Labels: All UI-visible labels now go through t() translation. ModeIdentityBanner labels localized.

Added — Simulator-Praxis-Sessions

• Practicum Engine: Pure-JS state machine for guided session management with localStorage persistence and browser-reload recovery.
• 11 Practicum Sessions: Real-world IT scenarios across all 7 simulators (42 steps total). Firewall, DNS, and Routing get 2 sessions each.
• PracticumRunner UI: New "Praxis" tab in every simulator with step-by-step instructions, context explanations, progress bar ("Schritt X von Y"), and score summary.

Added — Student Dashboard

• Heute Screen: New default landing page for students with SmartQueue widget (due cards count + "Jetzt lernen"), Daily Challenge card, streak display, and daily progress.
• Global Feed: Aggregates announcements from all enrolled courses chronologically with course-name badges and pagination.
• Pools Navigation: Direct "Pools" tab in student main navigation — one click to PoolList.

Added — DevCloud Integration & Leitner

• Talk Room Link: Instructors can set a Talk room token per course. Clickable link appears in course header, opens NC Talk in new tab.
• Materials for Students: Students now see the Materialien tab (read-only) when a course has a material folder set.
• Buddy Matching: New "Lernpartner" tab shows who can help with your topics and whom you can help, based on Telos help_offer/help_wanted data.
• Course-Aware Tools: Werkzeuge tab filters simulators based on active course's enabled_tools. No course active = all tools visible.
• Sprint Intervals: Instructors can activate sprint mode per course (4h/12h/1d/2d instead of 1d/3d/7d/14d Leitner intervals) for intensive courses.

Fixed

• Badge Duplicate Crash: Session completion no longer fails with 400 when badge already exists. Fixed catch to use OCP\DB\Exception (NC 30 wraps Doctrine exceptions).

Added — Story RPG "Abenteuer" Mode

• Story Engine: Full campaign-based RPG learning mode with branching narratives, skill checks, and character classes (Architect, Security, SysAdmin, Helpdesk). 20 campaigns across CompTIA Network+, Security+, CySA+, Linux+, and A+.
• KI-Erzähler: Gemini-powered dynamic narrator with freetext player actions, NPC dialog generation, and role-based prompts. Fallback to static text when AI unavailable.
• Skill Checks: In-story quiz phases with 3 questions per check, batch submission, pass/fail branching to different scenes.
• 20 Campaigns: Real-world IT incident scenarios — SolarWinds, WannaCry, Log4Shell, Colonial Pipeline, Equifax, plus 6 Security+ exam-oriented campaigns (Phishing, Zero Trust, Crypto, Compliance, IR, Cloud) and an AI Security campaign.
• Coop Mode: Infrastructure for multiplayer campaign sessions (UI placeholder, backend ready).

Added — "Zeitreise" Hack Through Time

• 7 Epoch Campaign System: Phone Phreaking (1960s), WarGames (1980s), The Worm (1990s), Bobby Tables (2000s), Shadow Brokers (2010s), Supply Chain (2020s), Quantum Dawn (Future).
• Period-Accurate CSS Themes: Each epoch has its own visual theme (terminal-green, amber-on-black, retro-web, etc.).
• CHRONOS Guide: AI narrator character that guides players through hacking history.
• Museum Facts: Historical sidebars with real dates, events, and technical details.
• Character Classes: Epoch-specific roles (Phreaker, Hacker, Script Kiddie, Analyst, etc.).

Added — Visual Identity System

• Design Tokens: CSS custom property layer (--lnc-*) with dark/light scopes and motion utilities.
• 13 Character Registry: SVG silhouette avatars with emotion states (idle, celebrate, alert) for all NPCs.
• Campaign Intro Animation: Full-screen intro with title, difficulty badge, and character reveal.
• Dialogue Stage: NPC dialog component with portrait, speech bubble, and emotion tags.
• Paper & Circuits Narrative Skin: Dark theme for adventure mode with subtle circuit-board patterns.

Added — RAG & Document Intelligence (v4.1)

• Document Upload & Extraction: Instructors can link Nextcloud folders as course material, scan for files, and extract text from PDF/Markdown.
• Chunking Pipeline: Automatic text chunking with keyword extraction for semantic search.
• Multi-Source RAG Context: VirtuProf answers now cite course materials with [Quelle: filename, Kap. X] format.
• 4000-Token Budget: Smart context window management prioritizing relevant chunks.

Added — Oldschool Board Games (v5.0)

• Lernwürfel: "Mensch ärgere dich nicht" inspired board game with dice rolls and question challenges.
• Wissensturm: Trivial Pursuit tower game with category-based progression.

Added — Personal Learning Bot (v4.0)

• GeminiService: 5-layer security stack (API key isolation, input sanitization, output filtering, rate limiting, audit logging).
• VirtuProf Chat: AI-powered learning assistant with chat-first UI, language auto-detection, and chat memory.
• Note Generator: Gemini-based topic summaries saved to Nextcloud Files.
• Lernprofil: Passive user learning profile with weekly study plan generation.
• Auto-Triggers: Exam auto-notes, wrong-answer threshold alerts, weekly plan background job.
• Ticket Triage: AI-powered support ticket classification and draft FAQ responses.
• AI Consent: Opt-in consent overlay before first AI interaction, GDPR-compliant.

Added — Tools

• Subnet Calculator: Browser-based IPv4 subnet calculator with CIDR/mask input, binary display, and VLSM planner.
• Subnetting Question Pool: 50+ subnet calculation practice questions.

Added — Quality & Testing

• ESLint: Vue/JS linting with no-v-html error rule, 0 errors enforced.
• Pre-Push Hook: 4-gate quality check (Security scan, ESLint, Vitest 67 tests, PHPStan Level 5).
• Playwright Browser Tests: 67 automated checks covering navigation, campaigns, time travel, tools, VirtuProf, security. 52 PASS / 11 FAIL / 4 SKIP.
• PHPUnit: 12 service-level unit tests (Training, Leitner, Analytics, Course).
• Test Strategy: 4-gate pyramid documented in CLAUDE.md.

Fixed

• Campaign skill-checks now always use pre-loaded questions from scene response (no separate API call).
• Campaign start always creates fresh session (no stale resume from previous play).
• Missing Abenteuer/Oldschool/Zeitreise toggles in course mode settings.
• WannaCry campaign: corrected from email dropper to SMB worm narrative.
• PBQ subtype auto-detection from config structure when pbq_subtype not set.
• Empty skill-check pools handled gracefully (skip to next scene instead of crash).
• Narrative garbage fallback when Gemini returns malformed text.
• AI rate-limits on VirtuProf available()/status() endpoints.
• ESLint: empty catch blocks, v-if with v-for separation, escaped quotes in templates.

Security

• Gemini language mirroring prevention (no prompt echo).
• Story mode injection guards on freetext actions.
• Story mode rate-limits (10 starts/min, 60 scenes/min).
• Pre-push security scan for hardcoded secrets.

Added

• Calendar Token: Per-user ICS subscription token for external calendar apps. GET /api/v1/user/calendar-token returns token + subscription URL. POST /api/v1/user/calendar-token/regenerate invalidates old token. Token stored in NC preferences (never expires until regenerated).
• Public ICS Feed: GET /api/v1/calendar/{token}.ics — unauthenticated ICS endpoint for calendar subscriptions. Uses token-to-user reverse lookup via oc_preferences.
• Calendar Sync in Personal Settings: ICS URL field with one-click copy and regenerate button.
• ICS UID domain fix: UID fields now use actual NC hostname (parse_url(getBaseUrl(), PHP_URL_HOST)) instead of literal @nextcloud.
• AI Explain button: POST /api/ai/explain schedules a text2text task explaining why an answer is correct/incorrect. "💡 Explain this" button appears after answering in LeitnerMode and TrainingMode (only shown when AI is available).
• At-Risk CSV Export: GET /api/courses/{courseId}/at-risk/export/csv — downloads at-risk student list as CSV (Name, Risk Level, Risk Reasons, Accuracy, Last Active). Export button in course progress tab.
• Batch Pool Assignment: Add-pool modal in CourseDetail now supports multi-select (checkboxes) — select multiple pools and add them all with one click.

Changed

• ExportController: Replaced anonymous class with DataDownloadResponse for ICS response (cleaner code, no custom render() override needed). ICS body extracted to buildIcsBody() — shared by authenticated and token-based endpoints.
• AIService::getTaskStatus() now includes output (raw text) in status response alongside questions array — needed for explain results.

Added

• Daily missions: mission progress model plus claim endpoint (GET /api/v1/missions, POST /api/v1/missions/{missionKey}/claim).
• Mission XP claims table: Migration Version002000 adds learning_user_mission_claims with one-claim-per-mission-per-day guarantee.
• Streak freeze tokens: weekly reset token support in streak calculation (streak_freeze_tokens, last_freeze_reset_week in learning_user_stats).
• Badge tiers: new bronze/silver/gold/platinum tiers for session count, mastery count, and streak milestones.
• Analytics UI updates: Daily mission cards with claim action and freeze-token visibility.

Changed

• Streak handling: streak computation can bridge one missed day when freeze token is available; token is consumed on activity-side calls.
• App version: bumped to 2.5.0.

Fixed

• Course Pool Access: Course members and instructors can now access pools assigned to their courses. Previously only pool owners and explicitly shared users had access, causing "Pool not found" errors for enrolled students.

Changed

• PoolService: Extracted findPoolRow() helper, added hasCoursePoolAccess() fallback in find() method
• 5 Services updated: LeitnerService, PoolService, QuestionService, TrainingService, TranslationService — all hasPoolAccess() methods now check course membership as a third access path

Technical

• 5 changed files, 165 insertions, 12 deletions
• No database migration needed — uses existing learning_course_pools and learning_course_members tables
• Course pool access grants read-only permission (permission: 'read')

Added

• Free Text Questions: New open question type — users type free-text answers instead of selecting from choices. Fuzzy matching (case-insensitive, Levenshtein distance ≤2 for short answers, substring matching for long answers)
• CSV/JSON Export: Download question pools as CSV or JSON files. Roundtrip-compatible with import — export then re-import produces identical questions
• ExportController.php: New controller with exportCsv() and exportJson() endpoints, DataDownloadResponse for browser download
• XP Streak Multipliers: Tier-based XP bonuses replace old linear formula — 1.5x at 3-day streak, 2x at 7-day, 3x at 30-day streak
• XP Multiplier Badge: Visible multiplier indicator (1.5x / 2x / 3x) in Pool List when streak bonus is active
• Open Question Import: CSV format question,model_answer,open and JSON "type": "open" with single model answer
• Open Question in all modes: Training, Leitner, Smart Queue, Exam (textarea + batch submit), Daily Challenge — SwipeMode filters out open questions

Changed

• XpService: getStreakMultiplier() and applyMultiplier() replace linear 1.0 + (streak * 0.01) formula
• LeitnerService: All XP awards (correct answer, mastery bonus, daily goal) now use streak multiplier via XpService
• UserStateController: state() response includes xp_multiplier field; answerChallenge() applies streak multiplier to challenge XP
• QuestionForm.vue: New "Free text" answer type option with model answer textarea
• QuestionList.vue: "Freitext" badge for open questions, model answer display, Export CSV/JSON dropdown
• ImportDialog.vue: Help text updated with open-question format examples for both CSV and JSON
• SwipeMode.vue: Filters out open questions (not compatible with swipe/tap interaction)
• routes.php: 2 new export routes (71 total)

Technical

• 1 new file (ExportController.php), 22 changed files
• No database migration needed — question_type VARCHAR(20) already supports open, answer_ids TEXT stores JSON
• QuestionService::isOpenAnswerCorrect() static helper used by TrainingService, LeitnerService, and UserStateController
• Rate limit on export endpoints: 10 requests per 60 seconds

Added

• Role-Based Navigation: Students start at Courses view (no Pools tab), instructors keep both tabs. App title simplified to "Lernen" for students
• Onboarding Hint System: 7 dismissible info cards (localStorage-based) explaining Smart Queue, Leitner boxes, Daily Goal, Daily Challenge, and welcome messages for both roles
• hintMixin.js: Reusable Vue mixin for localStorage-backed hint dismiss/check across all components
• Mode Descriptions: One-line explanation shown below the active mode selector (Training, Leitner, Wahr/Falsch, Exam, Stats, Manage)
• Pool-from-Course Navigation: "Back to Course" button when opening a pool from course context (instead of losing context by switching to Pools view)

Changed

• App.vue: Mode selector filtered by role — students see only Train/Leitner/Wahr-Falsch/Exam (no Stats, no Manage)
• PoolList.vue: Create Pool button, Share/Edit/Delete actions hidden for students. Better empty state text
• CourseList.vue: Student empty state now explains that the instructor enrolls them
• LeitnerMode.vue: Box labels improved — "Neu — taeglich wiederholen", "Lernphase — nach 1 Tag", "Bekannt — nach 3 Tagen", "Gut — nach 7 Tagen", "Gemeistert — nach 14 Tagen"
• SmartQueue.vue: Better empty state ("Open a pool and start the Leitner system"), ready state shows priority sorting info
• PoolList.vue: "Jetzt Lernen" → "Start learning", "Trouble Spots" → "Trouble spots" (consistency)
• de.json: ~60 new German translation keys for all hints, mode descriptions, empty states, and v1.8/v1.9 UI strings

Added

• AI Question Generator: Paste text (lecture notes, textbook excerpts) and let AI generate multiple-choice questions. Three-step workflow: input → AI generation → editable preview → bulk import into pool
• AIService.php: NC TaskProcessing API (NC 30+) with TextProcessing fallback (NC 29) — runtime detection, no app-level API key management
• AIController.php: 4 new endpoints — GET /api/ai/available, POST /api/ai/generate, GET /api/ai/status/{taskId}, POST /api/ai/import/{taskId}
• AIGenerator.vue: Full wizard with textarea input, question count slider (5-30), language selector, polling progress, editable preview with select/deselect all, inline editing of questions and answers
• At-Risk Early Warning: Instructors see which students are falling behind on the Course Progress tab. Rule-based risk scoring with 5 weighted signals (inactivity >7d, accuracy <50%, box-1 stall >60%, lost streak, <3 sessions in 14d)
• At-Risk API: GET /api/courses/{courseId}/at-risk — returns students with risk_level (high/medium), risk_reasons array, last_active, accuracy
• Remediation Queue: Focused practice on hardest questions (≥3 wrong answers, <30% accuracy, box ≤2). "Trouble Spots" button on Pool List with item count
• Remediation API: GET /api/leitner/remediation (items), GET /api/leitner/remediation/count (lightweight count)
• Daily Challenge: One random question per day from user's pools with +15 XP bonus for correct answers. Deterministic selection via crc32(userId + date) — same question per user per day
• Daily Challenge API: GET /api/v1/daily-challenge, POST /api/v1/daily-challenge/answer
• Migration V001600: Adds last_challenge_date (VARCHAR 10) and last_challenge_correct (BOOLEAN) to learning_user_stats

Changed

• QuestionList.vue: "Generate with AI" button visible when AI provider is configured (checks /api/ai/available)
• PoolList.vue: "Trouble Spots" button (orange, warning style) and inline Daily Challenge card with answer submission
• SmartQueue.vue: New mode prop (queue | remediation) with conditional API endpoint, titles, and empty states
• App.vue: Wires openRemediation event from PoolList to SmartQueue with mode="remediation", new smartQueueMode state
• CourseDetail.vue: At-Risk section on Progress tab — collapsible card grid with risk badges and reason tags
• routes.php: 9 new routes (ai: 4, leitner: 2, user_state: 2, course: 1) — 69 total

Security

• AI Rate Limits: generate endpoint limited to 5/min, import limited to 10/min
• AI Input Validation: Text length 50-50000 chars, word count capped at 3000 for LLM input
• AI User Isolation: Task status checks verify userId matches task owner
• At-Risk Access Control: Endpoint restricted to course instructors via validateInstructor()

Added

• ConsistencyCheckJob: Daily background job that reconciles learning_user_stats against source-of-truth tables — self-healing for XP, level, sessions, mastered counts, and streaks
• Composite Leitner indices: (user_id, box) and (user_id, next_review) on learning_leitner_items for faster aggregations and due-question queries (Migration Version001300)

Fixed

• HIGH: LeitnerService::answerQuestion() now wraps box update, stats update, XP increment, and badge award in a single DB transaction — prevents partial writes on crashes
• HIGH: Optimistic concurrency control on Leitner item update (WHERE box = :oldBox AND correct_count = :old AND incorrect_count = :old) — detects and rejects concurrent modifications including Box-5→5 lost updates
• HIGH: Box-5 mastery bonus (+25 XP, +1 mastered, badge check) now only awarded on actual promotion (Box <5→5), not on repeated correct answers in Box 5 — prevents XP/stats inflation
• HIGH: Badge notifications and Activity events now dispatched after transaction commit — prevents ghost notifications on rollback
• MEDIUM: Demotion fallback (updateUserStats()) moved after Leitner item update — recalc now sees correct box value instead of overcounting
• MEDIUM: syncLevel() deferred to after transaction commit — eliminates lock contention under concurrent reviews
• MEDIUM: Cache invalidation moved after transaction commit (was inside write sequence, could serve stale data on rollback)
• LOW: Multi-select answer validation uses batch IN query instead of N+1 per-answer queries

Performance

• Leitner box aggregations (stats, mastery counts) use composite index instead of full table scan
• Due-question queries benefit from (user_id, next_review) index — faster Leitner review loading
• ConsistencyCheckJob processes max 500 users per run, oldest-updated first — all users eventually reconciled
• ConsistencyCheckJob logs progress and catches per-user errors without aborting the batch

Added

• Consolidated User State API: GET /api/v1/user/state — single endpoint replaces 4 separate calls (XP, streak, badges, progress)
• Denormalized learning_user_stats table: O(1) reads for XP, level, streak, sessions, mastered counts (Migration Version001200)
• Background Notification Job: NotificationJob (TimedJob every 4h) replaces widget-triggered notifications
• Activity-App Integration: Badge unlock events appear in Nextcloud Activity stream with toggle in Activity settings
• Timezone-aware badges: Night Owl and Early Bird badges respect user's Nextcloud timezone setting
• XpService: Dedicated service for XP calculation, session XP increment, level computation
• Response caching: User state endpoint cached for 30s per user via ICacheFactory
• Composite index on learning_sessions(user_id, completed_at) for faster XP/streak queries
• time_limit_seconds column on learning_sessions for Speed Demon badge support

Changed

• BadgeService refactored from 430 to ~200 lines — XP/streak methods extracted to XpService
• Dashboard Widget is now pure read-only (~140 lines) — no longer sends notifications as side-effect
• AnalyticsDashboard.vue: 4 API calls consolidated to 1, with fallback to legacy endpoints for rolling deploys
• countUp.js: Respects prefers-reduced-motion — immediately shows final value without animation
• BadgeUnlock.vue: Added aria-live="polite" region for screenreader announcements
• LeitnerService: Box-5 promotion updates denormalized total_mastered counter
• TrainingService: Session completion updates denormalized stats via XpService

Fixed

• HIGH: Leitner XP now synced to learning_user_stats — correct answers award 5 XP, Box-5 mastery awards 25 XP bonus
• HIGH: Race condition in stats UPSERT — all INSERT paths wrapped in UniqueConstraintViolationException catch with UPDATE retry
• HIGH: SQL injection in incrementSessionXp — $currentStreak now uses createNamedParameter() instead of string concatenation
• HIGH: NotificationJob memory exhaustion — fetchAll() replaced with streaming fetch() loop; N+1 due-count queries replaced with single batch query
• HIGH: Level-race in XpService — stale getTotalXpFromStats() read eliminated; syncLevel() is monotonic (AND current_level < :newLevel) to prevent concurrent stale-level overwrites
• HIGH: Stats INSERT fallback uses updateUserStats() full recalc — preserves historical XP, sessions, and mastered counts for first-write users
• HIGH: total_mastered demotion — Box 5→1 transition now decrements total_mastered counter with updateUserStats() fallback for missing stats rows
• MEDIUM: User state cache invalidated on every Leitner answer (not just correct), after share-badge awards, and at END of completeSession() (after all badge/streak writes)
• MEDIUM: Migration backfill is per-step idempotent — each INSERT...SELECT skips existing users via NOT IN clause (safe for partial re-runs)
• MEDIUM: Migration backfill includes Leitner-only users (no completed sessions but have reviewed cards)
• MEDIUM: Frontend fallback triggers on any error (not just 404) for rolling-deploy resilience
• LOW: Removed dead $totalMastered variable in LeitnerService (computed but never used)

Performance

• Dashboard load: 4 XHR → 1 XHR for gamification data
• XP calculation: O(n) SQL aggregate → O(1) stats table read
• Notifications: synchronous widget side-effect → async background job
• NotificationJob: filters to users active in last 30 days (skips dormant accounts on large instances)

Added

• Achievements / Badges: 14 badges across 6 categories (sessions, performance, mastery, streak, social, fun)
• XP & Levels: Experience points calculated from sessions, Leitner reviews, accuracy bonuses, and streak multiplier
• Badge Unlock Overlay: Animated full-screen overlay with confetti when earning a badge
• Analytics Dashboard: Achievements grid with earned/locked status, badge progress bars, XP level bar
• Session Juice: Animated score count-up (countUp.js), Personal Best detection, improvement vs. average display
• XP display: "+X XP" shown on all results screens (Training, Exam, Swipe, Leitner)
• Nextcloud Notifications: Badge unlock notifications, streak-at-risk warnings, due card reminders
• Badge progress tracking: API endpoint showing progress towards unearned badges
• New DB table learning_user_badges (Migration Version001100)
• 2 new API endpoints: GET /api/badges, GET /api/badges/progress

Changed

• Training complete response now includes newly_earned_badges, xp_earned, is_personal_best, improvement, average_accuracy
• Leitner answer response now includes newly_earned_badges when card reaches Box 5
• Share creation now triggers badge check for "Sharing is Caring"
• Streak endpoint now triggers streak badge checks
• Dashboard widget sends streak warning and due reminder notifications

Security

• CRITICAL: Close training-session oracle — startSession(exam) auto-completes open training sessions on same pool
• CRITICAL: Defense-in-depth in submitAnswer/submitBatch — suppress correct_answer fields via cross-session check
• HIGH: Strip explanation field from Question API during active exam to prevent indirect answer leakage
• Rate-limits on ShareController and TranslationController write endpoints

Fixed

• Leitner feedback shows hint when correct answers are suppressed during active exam

Changed — UX-Navigation Struktur

• Instructor Tab Groups: 17 instructor tabs organized into 5 logical groups (Lernraum, Teilnehmer, Kommunikation, Wettbewerb, Verwaltung) with visual separators.
• Abenteuer Standalone: Adventure mode promoted from Arena sub-mode to its own CourseDetail tab, independently gatable via mode_config.
• Arena Submode Gating: Each Arena mode (Duel, Gameshow, Oldschool) individually hideable per course rules. Arena tab disappears when all sub-modes disabled.

Changed — Code-Hygiene & Settings

• Settings Split: Instructors now see two sub-tabs in Settings: "Kurs-Verwaltung" (admin) and "Meine Einstellungen" (personal). Students see only personal settings.
• Zeitreise Removed: Removed 1270+ lines of dead Zeitreise/HackThroughTime frontend code (component, characters, navigation, mode_config key).
• German Labels: All UI-visible labels now go through t() translation. ModeIdentityBanner labels localized.

Added — Simulator-Praxis-Sessions

• Practicum Engine: Pure-JS state machine for guided session management with localStorage persistence and browser-reload recovery.
• 11 Practicum Sessions: Real-world IT scenarios across all 7 simulators (42 steps total). Firewall, DNS, and Routing get 2 sessions each.
• PracticumRunner UI: New "Praxis" tab in every simulator with step-by-step instructions, context explanations, progress bar ("Schritt X von Y"), and score summary.

Added — Student Dashboard

• Heute Screen: New default landing page for students with SmartQueue widget (due cards count + "Jetzt lernen"), Daily Challenge card, streak display, and daily progress.
• Global Feed: Aggregates announcements from all enrolled courses chronologically with course-name badges and pagination.
• Pools Navigation: Direct "Pools" tab in student main navigation — one click to PoolList.

Added — DevCloud Integration & Leitner

• Talk Room Link: Instructors can set a Talk room token per course. Clickable link appears in course header, opens NC Talk in new tab.
• Materials for Students: Students now see the Materialien tab (read-only) when a course has a material folder set.
• Buddy Matching: New "Lernpartner" tab shows who can help with your topics and whom you can help, based on Telos help_offer/help_wanted data.
• Course-Aware Tools: Werkzeuge tab filters simulators based on active course's enabled_tools. No course active = all tools visible.
• Sprint Intervals: Instructors can activate sprint mode per course (4h/12h/1d/2d instead of 1d/3d/7d/14d Leitner intervals) for intensive courses.

Fixed

• Badge Duplicate Crash: Session completion no longer fails with 400 when badge already exists. Fixed catch to use OCP\DB\Exception (NC 30 wraps Doctrine exceptions).

Added — Story RPG "Abenteuer" Mode

• Story Engine: Full campaign-based RPG learning mode with branching narratives, skill checks, and character classes (Architect, Security, SysAdmin, Helpdesk). 20 campaigns across CompTIA Network+, Security+, CySA+, Linux+, and A+.
• KI-Erzähler: Gemini-powered dynamic narrator with freetext player actions, NPC dialog generation, and role-based prompts. Fallback to static text when AI unavailable.
• Skill Checks: In-story quiz phases with 3 questions per check, batch submission, pass/fail branching to different scenes.
• 20 Campaigns: Real-world IT incident scenarios — SolarWinds, WannaCry, Log4Shell, Colonial Pipeline, Equifax, plus 6 Security+ exam-oriented campaigns (Phishing, Zero Trust, Crypto, Compliance, IR, Cloud) and an AI Security campaign.
• Coop Mode: Infrastructure for multiplayer campaign sessions (UI placeholder, backend ready).

Added — "Zeitreise" Hack Through Time

• 7 Epoch Campaign System: Phone Phreaking (1960s), WarGames (1980s), The Worm (1990s), Bobby Tables (2000s), Shadow Brokers (2010s), Supply Chain (2020s), Quantum Dawn (Future).
• Period-Accurate CSS Themes: Each epoch has its own visual theme (terminal-green, amber-on-black, retro-web, etc.).
• CHRONOS Guide: AI narrator character that guides players through hacking history.
• Museum Facts: Historical sidebars with real dates, events, and technical details.
• Character Classes: Epoch-specific roles (Phreaker, Hacker, Script Kiddie, Analyst, etc.).

Added — Visual Identity System

• Design Tokens: CSS custom property layer (--lnc-*) with dark/light scopes and motion utilities.
• 13 Character Registry: SVG silhouette avatars with emotion states (idle, celebrate, alert) for all NPCs.
• Campaign Intro Animation: Full-screen intro with title, difficulty badge, and character reveal.
• Dialogue Stage: NPC dialog component with portrait, speech bubble, and emotion tags.
• Paper & Circuits Narrative Skin: Dark theme for adventure mode with subtle circuit-board patterns.

Added — RAG & Document Intelligence (v4.1)

• Document Upload & Extraction: Instructors can link Nextcloud folders as course material, scan for files, and extract text from PDF/Markdown.
• Chunking Pipeline: Automatic text chunking with keyword extraction for semantic search.
• Multi-Source RAG Context: VirtuProf answers now cite course materials with [Quelle: filename, Kap. X] format.
• 4000-Token Budget: Smart context window management prioritizing relevant chunks.

Added — Oldschool Board Games (v5.0)

• Lernwürfel: "Mensch ärgere dich nicht" inspired board game with dice rolls and question challenges.
• Wissensturm: Trivial Pursuit tower game with category-based progression.

Added — Personal Learning Bot (v4.0)

• GeminiService: 5-layer security stack (API key isolation, input sanitization, output filtering, rate limiting, audit logging).
• VirtuProf Chat: AI-powered learning assistant with chat-first UI, language auto-detection, and chat memory.
• Note Generator: Gemini-based topic summaries saved to Nextcloud Files.
• Lernprofil: Passive user learning profile with weekly study plan generation.
• Auto-Triggers: Exam auto-notes, wrong-answer threshold alerts, weekly plan background job.
• Ticket Triage: AI-powered support ticket classification and draft FAQ responses.
• AI Consent: Opt-in consent overlay before first AI interaction, GDPR-compliant.

Added — Tools

• Subnet Calculator: Browser-based IPv4 subnet calculator with CIDR/mask input, binary display, and VLSM planner.
• Subnetting Question Pool: 50+ subnet calculation practice questions.

Added — Quality & Testing

• ESLint: Vue/JS linting with no-v-html error rule, 0 errors enforced.
• Pre-Push Hook: 4-gate quality check (Security scan, ESLint, Vitest 67 tests, PHPStan Level 5).
• Playwright Browser Tests: 67 automated checks covering navigation, campaigns, time travel, tools, VirtuProf, security. 52 PASS / 11 FAIL / 4 SKIP.
• PHPUnit: 12 service-level unit tests (Training, Leitner, Analytics, Course).
• Test Strategy: 4-gate pyramid documented in CLAUDE.md.

Fixed

• Campaign skill-checks now always use pre-loaded questions from scene response (no separate API call).
• Campaign start always creates fresh session (no stale resume from previous play).
• Missing Abenteuer/Oldschool/Zeitreise toggles in course mode settings.
• WannaCry campaign: corrected from email dropper to SMB worm narrative.
• PBQ subtype auto-detection from config structure when pbq_subtype not set.
• Empty skill-check pools handled gracefully (skip to next scene instead of crash).
• Narrative garbage fallback when Gemini returns malformed text.
• AI rate-limits on VirtuProf available()/status() endpoints.
• ESLint: empty catch blocks, v-if with v-for separation, escaped quotes in templates.

Security

• Gemini language mirroring prevention (no prompt echo).
• Story mode injection guards on freetext actions.
• Story mode rate-limits (10 starts/min, 60 scenes/min).
• Pre-push security scan for hardcoded secrets.

Added

• Calendar Token: Per-user ICS subscription token for external calendar apps. GET /api/v1/user/calendar-token returns token + subscription URL. POST /api/v1/user/calendar-token/regenerate invalidates old token. Token stored in NC preferences (never expires until regenerated).
• Public ICS Feed: GET /api/v1/calendar/{token}.ics — unauthenticated ICS endpoint for calendar subscriptions. Uses token-to-user reverse lookup via oc_preferences.
• Calendar Sync in Personal Settings: ICS URL field with one-click copy and regenerate button.
• ICS UID domain fix: UID fields now use actual NC hostname (parse_url(getBaseUrl(), PHP_URL_HOST)) instead of literal @nextcloud.
• AI Explain button: POST /api/ai/explain schedules a text2text task explaining why an answer is correct/incorrect. "💡 Explain this" button appears after answering in LeitnerMode and TrainingMode (only shown when AI is available).
• At-Risk CSV Export: GET /api/courses/{courseId}/at-risk/export/csv — downloads at-risk student list as CSV (Name, Risk Level, Risk Reasons, Accuracy, Last Active). Export button in course progress tab.
• Batch Pool Assignment: Add-pool modal in CourseDetail now supports multi-select (checkboxes) — select multiple pools and add them all with one click.

Changed

• ExportController: Replaced anonymous class with DataDownloadResponse for ICS response (cleaner code, no custom render() override needed). ICS body extracted to buildIcsBody() — shared by authenticated and token-based endpoints.
• AIService::getTaskStatus() now includes output (raw text) in status response alongside questions array — needed for explain results.

Added

• Daily missions: mission progress model plus claim endpoint (GET /api/v1/missions, POST /api/v1/missions/{missionKey}/claim).
• Mission XP claims table: Migration Version002000 adds learning_user_mission_claims with one-claim-per-mission-per-day guarantee.
• Streak freeze tokens: weekly reset token support in streak calculation (streak_freeze_tokens, last_freeze_reset_week in learning_user_stats).
• Badge tiers: new bronze/silver/gold/platinum tiers for session count, mastery count, and streak milestones.
• Analytics UI updates: Daily mission cards with claim action and freeze-token visibility.

Changed

• Streak handling: streak computation can bridge one missed day when freeze token is available; token is consumed on activity-side calls.
• App version: bumped to 2.5.0.

Fixed

• Course Pool Access: Course members and instructors can now access pools assigned to their courses. Previously only pool owners and explicitly shared users had access, causing "Pool not found" errors for enrolled students.

Changed

• PoolService: Extracted findPoolRow() helper, added hasCoursePoolAccess() fallback in find() method
• 5 Services updated: LeitnerService, PoolService, QuestionService, TrainingService, TranslationService — all hasPoolAccess() methods now check course membership as a third access path

Technical

• 5 changed files, 165 insertions, 12 deletions
• No database migration needed — uses existing learning_course_pools and learning_course_members tables
• Course pool access grants read-only permission (permission: 'read')

Added

• Free Text Questions: New open question type — users type free-text answers instead of selecting from choices. Fuzzy matching (case-insensitive, Levenshtein distance ≤2 for short answers, substring matching for long answers)
• CSV/JSON Export: Download question pools as CSV or JSON files. Roundtrip-compatible with import — export then re-import produces identical questions
• ExportController.php: New controller with exportCsv() and exportJson() endpoints, DataDownloadResponse for browser download
• XP Streak Multipliers: Tier-based XP bonuses replace old linear formula — 1.5x at 3-day streak, 2x at 7-day, 3x at 30-day streak
• XP Multiplier Badge: Visible multiplier indicator (1.5x / 2x / 3x) in Pool List when streak bonus is active
• Open Question Import: CSV format question,model_answer,open and JSON "type": "open" with single model answer
• Open Question in all modes: Training, Leitner, Smart Queue, Exam (textarea + batch submit), Daily Challenge — SwipeMode filters out open questions

Changed

• XpService: getStreakMultiplier() and applyMultiplier() replace linear 1.0 + (streak * 0.01) formula
• LeitnerService: All XP awards (correct answer, mastery bonus, daily goal) now use streak multiplier via XpService
• UserStateController: state() response includes xp_multiplier field; answerChallenge() applies streak multiplier to challenge XP
• QuestionForm.vue: New "Free text" answer type option with model answer textarea
• QuestionList.vue: "Freitext" badge for open questions, model answer display, Export CSV/JSON dropdown
• ImportDialog.vue: Help text updated with open-question format examples for both CSV and JSON
• SwipeMode.vue: Filters out open questions (not compatible with swipe/tap interaction)
• routes.php: 2 new export routes (71 total)

Technical

• 1 new file (ExportController.php), 22 changed files
• No database migration needed — question_type VARCHAR(20) already supports open, answer_ids TEXT stores JSON
• QuestionService::isOpenAnswerCorrect() static helper used by TrainingService, LeitnerService, and UserStateController
• Rate limit on export endpoints: 10 requests per 60 seconds

Added

• Role-Based Navigation: Students start at Courses view (no Pools tab), instructors keep both tabs. App title simplified to "Lernen" for students
• Onboarding Hint System: 7 dismissible info cards (localStorage-based) explaining Smart Queue, Leitner boxes, Daily Goal, Daily Challenge, and welcome messages for both roles
• hintMixin.js: Reusable Vue mixin for localStorage-backed hint dismiss/check across all components
• Mode Descriptions: One-line explanation shown below the active mode selector (Training, Leitner, Wahr/Falsch, Exam, Stats, Manage)
• Pool-from-Course Navigation: "Back to Course" button when opening a pool from course context (instead of losing context by switching to Pools view)

Changed

• App.vue: Mode selector filtered by role — students see only Train/Leitner/Wahr-Falsch/Exam (no Stats, no Manage)
• PoolList.vue: Create Pool button, Share/Edit/Delete actions hidden for students. Better empty state text
• CourseList.vue: Student empty state now explains that the instructor enrolls them
• LeitnerMode.vue: Box labels improved — "Neu — taeglich wiederholen", "Lernphase — nach 1 Tag", "Bekannt — nach 3 Tagen", "Gut — nach 7 Tagen", "Gemeistert — nach 14 Tagen"
• SmartQueue.vue: Better empty state ("Open a pool and start the Leitner system"), ready state shows priority sorting info
• PoolList.vue: "Jetzt Lernen" → "Start learning", "Trouble Spots" → "Trouble spots" (consistency)
• de.json: ~60 new German translation keys for all hints, mode descriptions, empty states, and v1.8/v1.9 UI strings

Added

• AI Question Generator: Paste text (lecture notes, textbook excerpts) and let AI generate multiple-choice questions. Three-step workflow: input → AI generation → editable preview → bulk import into pool
• AIService.php: NC TaskProcessing API (NC 30+) with TextProcessing fallback (NC 29) — runtime detection, no app-level API key management
• AIController.php: 4 new endpoints — GET /api/ai/available, POST /api/ai/generate, GET /api/ai/status/{taskId}, POST /api/ai/import/{taskId}
• AIGenerator.vue: Full wizard with textarea input, question count slider (5-30), language selector, polling progress, editable preview with select/deselect all, inline editing of questions and answers
• At-Risk Early Warning: Instructors see which students are falling behind on the Course Progress tab. Rule-based risk scoring with 5 weighted signals (inactivity >7d, accuracy <50%, box-1 stall >60%, lost streak, <3 sessions in 14d)
• At-Risk API: GET /api/courses/{courseId}/at-risk — returns students with risk_level (high/medium), risk_reasons array, last_active, accuracy
• Remediation Queue: Focused practice on hardest questions (≥3 wrong answers, <30% accuracy, box ≤2). "Trouble Spots" button on Pool List with item count
• Remediation API: GET /api/leitner/remediation (items), GET /api/leitner/remediation/count (lightweight count)
• Daily Challenge: One random question per day from user's pools with +15 XP bonus for correct answers. Deterministic selection via crc32(userId + date) — same question per user per day
• Daily Challenge API: GET /api/v1/daily-challenge, POST /api/v1/daily-challenge/answer
• Migration V001600: Adds last_challenge_date (VARCHAR 10) and last_challenge_correct (BOOLEAN) to learning_user_stats

Changed

• QuestionList.vue: "Generate with AI" button visible when AI provider is configured (checks /api/ai/available)
• PoolList.vue: "Trouble Spots" button (orange, warning style) and inline Daily Challenge card with answer submission
• SmartQueue.vue: New mode prop (queue | remediation) with conditional API endpoint, titles, and empty states
• App.vue: Wires openRemediation event from PoolList to SmartQueue with mode="remediation", new smartQueueMode state
• CourseDetail.vue: At-Risk section on Progress tab — collapsible card grid with risk badges and reason tags
• routes.php: 9 new routes (ai: 4, leitner: 2, user_state: 2, course: 1) — 69 total

Security

• AI Rate Limits: generate endpoint limited to 5/min, import limited to 10/min
• AI Input Validation: Text length 50-50000 chars, word count capped at 3000 for LLM input
• AI User Isolation: Task status checks verify userId matches task owner
• At-Risk Access Control: Endpoint restricted to course instructors via validateInstructor()