Learning - Releases

Changed — UX-Navigation Struktur

• Instructor Tab Groups: 17 instructor tabs organized into 5 logical groups (Lernraum, Teilnehmer, Kommunikation, Wettbewerb, Verwaltung) with visual separators.
• Abenteuer Standalone: Adventure mode promoted from Arena sub-mode to its own CourseDetail tab, independently gatable via mode_config.
• Arena Submode Gating: Each Arena mode (Duel, Gameshow, Oldschool) individually hideable per course rules. Arena tab disappears when all sub-modes disabled.

Changed — Code-Hygiene & Settings

• Settings Split: Instructors now see two sub-tabs in Settings: "Kurs-Verwaltung" (admin) and "Meine Einstellungen" (personal). Students see only personal settings.
• Zeitreise Removed: Removed 1270+ lines of dead Zeitreise/HackThroughTime frontend code (component, characters, navigation, mode_config key).
• German Labels: All UI-visible labels now go through t() translation. ModeIdentityBanner labels localized.

Added — Simulator-Praxis-Sessions

• Practicum Engine: Pure-JS state machine for guided session management with localStorage persistence and browser-reload recovery.
• 11 Practicum Sessions: Real-world IT scenarios across all 7 simulators (42 steps total). Firewall, DNS, and Routing get 2 sessions each.
• PracticumRunner UI: New "Praxis" tab in every simulator with step-by-step instructions, context explanations, progress bar ("Schritt X von Y"), and score summary.

Added — Student Dashboard

• Heute Screen: New default landing page for students with SmartQueue widget (due cards count + "Jetzt lernen"), Daily Challenge card, streak display, and daily progress.
• Global Feed: Aggregates announcements from all enrolled courses chronologically with course-name badges and pagination.
• Pools Navigation: Direct "Pools" tab in student main navigation — one click to PoolList.

Added — DevCloud Integration & Leitner

• Talk Room Link: Instructors can set a Talk room token per course. Clickable link appears in course header, opens NC Talk in new tab.
• Materials for Students: Students now see the Materialien tab (read-only) when a course has a material folder set.
• Buddy Matching: New "Lernpartner" tab shows who can help with your topics and whom you can help, based on Telos help_offer/help_wanted data.
• Course-Aware Tools: Werkzeuge tab filters simulators based on active course's enabled_tools. No course active = all tools visible.
• Sprint Intervals: Instructors can activate sprint mode per course (4h/12h/1d/2d instead of 1d/3d/7d/14d Leitner intervals) for intensive courses.

Fixed

• Badge Duplicate Crash: Session completion no longer fails with 400 when badge already exists. Fixed catch to use OCP\DB\Exception (NC 30 wraps Doctrine exceptions).

Added — Story RPG "Abenteuer" Mode

• Story Engine: Full campaign-based RPG learning mode with branching narratives, skill checks, and character classes (Architect, Security, SysAdmin, Helpdesk). 20 campaigns across CompTIA Network+, Security+, CySA+, Linux+, and A+.
• KI-Erzähler: Gemini-powered dynamic narrator with freetext player actions, NPC dialog generation, and role-based prompts. Fallback to static text when AI unavailable.
• Skill Checks: In-story quiz phases with 3 questions per check, batch submission, pass/fail branching to different scenes.
• 20 Campaigns: Real-world IT incident scenarios — SolarWinds, WannaCry, Log4Shell, Colonial Pipeline, Equifax, plus 6 Security+ exam-oriented campaigns (Phishing, Zero Trust, Crypto, Compliance, IR, Cloud) and an AI Security campaign.
• Coop Mode: Infrastructure for multiplayer campaign sessions (UI placeholder, backend ready).

Added — "Zeitreise" Hack Through Time

• 7 Epoch Campaign System: Phone Phreaking (1960s), WarGames (1980s), The Worm (1990s), Bobby Tables (2000s), Shadow Brokers (2010s), Supply Chain (2020s), Quantum Dawn (Future).
• Period-Accurate CSS Themes: Each epoch has its own visual theme (terminal-green, amber-on-black, retro-web, etc.).
• CHRONOS Guide: AI narrator character that guides players through hacking history.
• Museum Facts: Historical sidebars with real dates, events, and technical details.
• Character Classes: Epoch-specific roles (Phreaker, Hacker, Script Kiddie, Analyst, etc.).

Added — Visual Identity System

• Design Tokens: CSS custom property layer (--lnc-*) with dark/light scopes and motion utilities.
• 13 Character Registry: SVG silhouette avatars with emotion states (idle, celebrate, alert) for all NPCs.
• Campaign Intro Animation: Full-screen intro with title, difficulty badge, and character reveal.
• Dialogue Stage: NPC dialog component with portrait, speech bubble, and emotion tags.
• Paper & Circuits Narrative Skin: Dark theme for adventure mode with subtle circuit-board patterns.

Added — RAG & Document Intelligence (v4.1)

• Document Upload & Extraction: Instructors can link Nextcloud folders as course material, scan for files, and extract text from PDF/Markdown.
• Chunking Pipeline: Automatic text chunking with keyword extraction for semantic search.
• Multi-Source RAG Context: VirtuProf answers now cite course materials with [Quelle: filename, Kap. X] format.
• 4000-Token Budget: Smart context window management prioritizing relevant chunks.

Added — Oldschool Board Games (v5.0)

• Lernwürfel: "Mensch ärgere dich nicht" inspired board game with dice rolls and question challenges.
• Wissensturm: Trivial Pursuit tower game with category-based progression.

Added — Personal Learning Bot (v4.0)

• GeminiService: 5-layer security stack (API key isolation, input sanitization, output filtering, rate limiting, audit logging).
• VirtuProf Chat: AI-powered learning assistant with chat-first UI, language auto-detection, and chat memory.
• Note Generator: Gemini-based topic summaries saved to Nextcloud Files.
• Lernprofil: Passive user learning profile with weekly study plan generation.
• Auto-Triggers: Exam auto-notes, wrong-answer threshold alerts, weekly plan background job.
• Ticket Triage: AI-powered support ticket classification and draft FAQ responses.
• AI Consent: Opt-in consent overlay before first AI interaction, GDPR-compliant.

Added — Tools

• Subnet Calculator: Browser-based IPv4 subnet calculator with CIDR/mask input, binary display, and VLSM planner.
• Subnetting Question Pool: 50+ subnet calculation practice questions.

Added — Quality & Testing

• ESLint: Vue/JS linting with no-v-html error rule, 0 errors enforced.
• Pre-Push Hook: 4-gate quality check (Security scan, ESLint, Vitest 67 tests, PHPStan Level 5).
• Playwright Browser Tests: 67 automated checks covering navigation, campaigns, time travel, tools, VirtuProf, security. 52 PASS / 11 FAIL / 4 SKIP.
• PHPUnit: 12 service-level unit tests (Training, Leitner, Analytics, Course).
• Test Strategy: 4-gate pyramid documented in CLAUDE.md.

Fixed

• Campaign skill-checks now always use pre-loaded questions from scene response (no separate API call).
• Campaign start always creates fresh session (no stale resume from previous play).
• Missing Abenteuer/Oldschool/Zeitreise toggles in course mode settings.
• WannaCry campaign: corrected from email dropper to SMB worm narrative.
• PBQ subtype auto-detection from config structure when pbq_subtype not set.
• Empty skill-check pools handled gracefully (skip to next scene instead of crash).
• Narrative garbage fallback when Gemini returns malformed text.
• AI rate-limits on VirtuProf available()/status() endpoints.
• ESLint: empty catch blocks, v-if with v-for separation, escaped quotes in templates.

Security

• Gemini language mirroring prevention (no prompt echo).
• Story mode injection guards on freetext actions.
• Story mode rate-limits (10 starts/min, 60 scenes/min).
• Pre-push security scan for hardcoded secrets.

Added

• Calendar Token: Per-user ICS subscription token for external calendar apps. GET /api/v1/user/calendar-token returns token + subscription URL. POST /api/v1/user/calendar-token/regenerate invalidates old token. Token stored in NC preferences (never expires until regenerated).
• Public ICS Feed: GET /api/v1/calendar/{token}.ics — unauthenticated ICS endpoint for calendar subscriptions. Uses token-to-user reverse lookup via oc_preferences.
• Calendar Sync in Personal Settings: ICS URL field with one-click copy and regenerate button.
• ICS UID domain fix: UID fields now use actual NC hostname (parse_url(getBaseUrl(), PHP_URL_HOST)) instead of literal @nextcloud.
• AI Explain button: POST /api/ai/explain schedules a text2text task explaining why an answer is correct/incorrect. "💡 Explain this" button appears after answering in LeitnerMode and TrainingMode (only shown when AI is available).
• At-Risk CSV Export: GET /api/courses/{courseId}/at-risk/export/csv — downloads at-risk student list as CSV (Name, Risk Level, Risk Reasons, Accuracy, Last Active). Export button in course progress tab.
• Batch Pool Assignment: Add-pool modal in CourseDetail now supports multi-select (checkboxes) — select multiple pools and add them all with one click.

Changed

• ExportController: Replaced anonymous class with DataDownloadResponse for ICS response (cleaner code, no custom render() override needed). ICS body extracted to buildIcsBody() — shared by authenticated and token-based endpoints.
• AIService::getTaskStatus() now includes output (raw text) in status response alongside questions array — needed for explain results.

Added

• Daily missions: mission progress model plus claim endpoint (GET /api/v1/missions, POST /api/v1/missions/{missionKey}/claim).
• Mission XP claims table: Migration Version002000 adds learning_user_mission_claims with one-claim-per-mission-per-day guarantee.
• Streak freeze tokens: weekly reset token support in streak calculation (streak_freeze_tokens, last_freeze_reset_week in learning_user_stats).
• Badge tiers: new bronze/silver/gold/platinum tiers for session count, mastery count, and streak milestones.
• Analytics UI updates: Daily mission cards with claim action and freeze-token visibility.

Changed

• Streak handling: streak computation can bridge one missed day when freeze token is available; token is consumed on activity-side calls.
• App version: bumped to 2.5.0.

Fixed

• Course Pool Access: Course members and instructors can now access pools assigned to their courses. Previously only pool owners and explicitly shared users had access, causing "Pool not found" errors for enrolled students.

Changed

• PoolService: Extracted findPoolRow() helper, added hasCoursePoolAccess() fallback in find() method
• 5 Services updated: LeitnerService, PoolService, QuestionService, TrainingService, TranslationService — all hasPoolAccess() methods now check course membership as a third access path

Technical

• 5 changed files, 165 insertions, 12 deletions
• No database migration needed — uses existing learning_course_pools and learning_course_members tables
• Course pool access grants read-only permission (permission: 'read')

Added

• Free Text Questions: New open question type — users type free-text answers instead of selecting from choices. Fuzzy matching (case-insensitive, Levenshtein distance ≤2 for short answers, substring matching for long answers)
• CSV/JSON Export: Download question pools as CSV or JSON files. Roundtrip-compatible with import — export then re-import produces identical questions
• ExportController.php: New controller with exportCsv() and exportJson() endpoints, DataDownloadResponse for browser download
• XP Streak Multipliers: Tier-based XP bonuses replace old linear formula — 1.5x at 3-day streak, 2x at 7-day, 3x at 30-day streak
• XP Multiplier Badge: Visible multiplier indicator (1.5x / 2x / 3x) in Pool List when streak bonus is active
• Open Question Import: CSV format question,model_answer,open and JSON "type": "open" with single model answer
• Open Question in all modes: Training, Leitner, Smart Queue, Exam (textarea + batch submit), Daily Challenge — SwipeMode filters out open questions

Changed

• XpService: getStreakMultiplier() and applyMultiplier() replace linear 1.0 + (streak * 0.01) formula
• LeitnerService: All XP awards (correct answer, mastery bonus, daily goal) now use streak multiplier via XpService
• UserStateController: state() response includes xp_multiplier field; answerChallenge() applies streak multiplier to challenge XP
• QuestionForm.vue: New "Free text" answer type option with model answer textarea
• QuestionList.vue: "Freitext" badge for open questions, model answer display, Export CSV/JSON dropdown
• ImportDialog.vue: Help text updated with open-question format examples for both CSV and JSON
• SwipeMode.vue: Filters out open questions (not compatible with swipe/tap interaction)
• routes.php: 2 new export routes (71 total)

Technical

• 1 new file (ExportController.php), 22 changed files
• No database migration needed — question_type VARCHAR(20) already supports open, answer_ids TEXT stores JSON
• QuestionService::isOpenAnswerCorrect() static helper used by TrainingService, LeitnerService, and UserStateController
• Rate limit on export endpoints: 10 requests per 60 seconds

Added

• Role-Based Navigation: Students start at Courses view (no Pools tab), instructors keep both tabs. App title simplified to "Lernen" for students
• Onboarding Hint System: 7 dismissible info cards (localStorage-based) explaining Smart Queue, Leitner boxes, Daily Goal, Daily Challenge, and welcome messages for both roles
• hintMixin.js: Reusable Vue mixin for localStorage-backed hint dismiss/check across all components
• Mode Descriptions: One-line explanation shown below the active mode selector (Training, Leitner, Wahr/Falsch, Exam, Stats, Manage)
• Pool-from-Course Navigation: "Back to Course" button when opening a pool from course context (instead of losing context by switching to Pools view)

Changed

• App.vue: Mode selector filtered by role — students see only Train/Leitner/Wahr-Falsch/Exam (no Stats, no Manage)
• PoolList.vue: Create Pool button, Share/Edit/Delete actions hidden for students. Better empty state text
• CourseList.vue: Student empty state now explains that the instructor enrolls them
• LeitnerMode.vue: Box labels improved — "Neu — taeglich wiederholen", "Lernphase — nach 1 Tag", "Bekannt — nach 3 Tagen", "Gut — nach 7 Tagen", "Gemeistert — nach 14 Tagen"
• SmartQueue.vue: Better empty state ("Open a pool and start the Leitner system"), ready state shows priority sorting info
• PoolList.vue: "Jetzt Lernen" → "Start learning", "Trouble Spots" → "Trouble spots" (consistency)
• de.json: ~60 new German translation keys for all hints, mode descriptions, empty states, and v1.8/v1.9 UI strings

Added

• AI Question Generator: Paste text (lecture notes, textbook excerpts) and let AI generate multiple-choice questions. Three-step workflow: input → AI generation → editable preview → bulk import into pool
• AIService.php: NC TaskProcessing API (NC 30+) with TextProcessing fallback (NC 29) — runtime detection, no app-level API key management
• AIController.php: 4 new endpoints — GET /api/ai/available, POST /api/ai/generate, GET /api/ai/status/{taskId}, POST /api/ai/import/{taskId}
• AIGenerator.vue: Full wizard with textarea input, question count slider (5-30), language selector, polling progress, editable preview with select/deselect all, inline editing of questions and answers
• At-Risk Early Warning: Instructors see which students are falling behind on the Course Progress tab. Rule-based risk scoring with 5 weighted signals (inactivity >7d, accuracy <50%, box-1 stall >60%, lost streak, <3 sessions in 14d)
• At-Risk API: GET /api/courses/{courseId}/at-risk — returns students with risk_level (high/medium), risk_reasons array, last_active, accuracy
• Remediation Queue: Focused practice on hardest questions (≥3 wrong answers, <30% accuracy, box ≤2). "Trouble Spots" button on Pool List with item count
• Remediation API: GET /api/leitner/remediation (items), GET /api/leitner/remediation/count (lightweight count)
• Daily Challenge: One random question per day from user's pools with +15 XP bonus for correct answers. Deterministic selection via crc32(userId + date) — same question per user per day
• Daily Challenge API: GET /api/v1/daily-challenge, POST /api/v1/daily-challenge/answer
• Migration V001600: Adds last_challenge_date (VARCHAR 10) and last_challenge_correct (BOOLEAN) to learning_user_stats

Changed

• QuestionList.vue: "Generate with AI" button visible when AI provider is configured (checks /api/ai/available)
• PoolList.vue: "Trouble Spots" button (orange, warning style) and inline Daily Challenge card with answer submission
• SmartQueue.vue: New mode prop (queue | remediation) with conditional API endpoint, titles, and empty states
• App.vue: Wires openRemediation event from PoolList to SmartQueue with mode="remediation", new smartQueueMode state
• CourseDetail.vue: At-Risk section on Progress tab — collapsible card grid with risk badges and reason tags
• routes.php: 9 new routes (ai: 4, leitner: 2, user_state: 2, course: 1) — 69 total

Security

• AI Rate Limits: generate endpoint limited to 5/min, import limited to 10/min
• AI Input Validation: Text length 50-50000 chars, word count capped at 3000 for LLM input
• AI User Isolation: Task status checks verify userId matches task owner
• At-Risk Access Control: Endpoint restricted to course instructors via validateInstructor()

Added

• ConsistencyCheckJob: Daily background job that reconciles learning_user_stats against source-of-truth tables — self-healing for XP, level, sessions, mastered counts, and streaks
• Composite Leitner indices: (user_id, box) and (user_id, next_review) on learning_leitner_items for faster aggregations and due-question queries (Migration Version001300)

Fixed

• HIGH: LeitnerService::answerQuestion() now wraps box update, stats update, XP increment, and badge award in a single DB transaction — prevents partial writes on crashes
• HIGH: Optimistic concurrency control on Leitner item update (WHERE box = :oldBox AND correct_count = :old AND incorrect_count = :old) — detects and rejects concurrent modifications including Box-5→5 lost updates
• HIGH: Box-5 mastery bonus (+25 XP, +1 mastered, badge check) now only awarded on actual promotion (Box <5→5), not on repeated correct answers in Box 5 — prevents XP/stats inflation
• HIGH: Badge notifications and Activity events now dispatched after transaction commit — prevents ghost notifications on rollback
• MEDIUM: Demotion fallback (updateUserStats()) moved after Leitner item update — recalc now sees correct box value instead of overcounting
• MEDIUM: syncLevel() deferred to after transaction commit — eliminates lock contention under concurrent reviews
• MEDIUM: Cache invalidation moved after transaction commit (was inside write sequence, could serve stale data on rollback)
• LOW: Multi-select answer validation uses batch IN query instead of N+1 per-answer queries

Performance

• Leitner box aggregations (stats, mastery counts) use composite index instead of full table scan
• Due-question queries benefit from (user_id, next_review) index — faster Leitner review loading
• ConsistencyCheckJob processes max 500 users per run, oldest-updated first — all users eventually reconciled
• ConsistencyCheckJob logs progress and catches per-user errors without aborting the batch

Added

• Consolidated User State API: GET /api/v1/user/state — single endpoint replaces 4 separate calls (XP, streak, badges, progress)
• Denormalized learning_user_stats table: O(1) reads for XP, level, streak, sessions, mastered counts (Migration Version001200)
• Background Notification Job: NotificationJob (TimedJob every 4h) replaces widget-triggered notifications
• Activity-App Integration: Badge unlock events appear in Nextcloud Activity stream with toggle in Activity settings
• Timezone-aware badges: Night Owl and Early Bird badges respect user's Nextcloud timezone setting
• XpService: Dedicated service for XP calculation, session XP increment, level computation
• Response caching: User state endpoint cached for 30s per user via ICacheFactory
• Composite index on learning_sessions(user_id, completed_at) for faster XP/streak queries
• time_limit_seconds column on learning_sessions for Speed Demon badge support

Changed

• BadgeService refactored from 430 to ~200 lines — XP/streak methods extracted to XpService
• Dashboard Widget is now pure read-only (~140 lines) — no longer sends notifications as side-effect
• AnalyticsDashboard.vue: 4 API calls consolidated to 1, with fallback to legacy endpoints for rolling deploys
• countUp.js: Respects prefers-reduced-motion — immediately shows final value without animation
• BadgeUnlock.vue: Added aria-live="polite" region for screenreader announcements
• LeitnerService: Box-5 promotion updates denormalized total_mastered counter
• TrainingService: Session completion updates denormalized stats via XpService

Fixed

• HIGH: Leitner XP now synced to learning_user_stats — correct answers award 5 XP, Box-5 mastery awards 25 XP bonus
• HIGH: Race condition in stats UPSERT — all INSERT paths wrapped in UniqueConstraintViolationException catch with UPDATE retry
• HIGH: SQL injection in incrementSessionXp — $currentStreak now uses createNamedParameter() instead of string concatenation
• HIGH: NotificationJob memory exhaustion — fetchAll() replaced with streaming fetch() loop; N+1 due-count queries replaced with single batch query
• HIGH: Level-race in XpService — stale getTotalXpFromStats() read eliminated; syncLevel() is monotonic (AND current_level < :newLevel) to prevent concurrent stale-level overwrites
• HIGH: Stats INSERT fallback uses updateUserStats() full recalc — preserves historical XP, sessions, and mastered counts for first-write users
• HIGH: total_mastered demotion — Box 5→1 transition now decrements total_mastered counter with updateUserStats() fallback for missing stats rows
• MEDIUM: User state cache invalidated on every Leitner answer (not just correct), after share-badge awards, and at END of completeSession() (after all badge/streak writes)
• MEDIUM: Migration backfill is per-step idempotent — each INSERT...SELECT skips existing users via NOT IN clause (safe for partial re-runs)
• MEDIUM: Migration backfill includes Leitner-only users (no completed sessions but have reviewed cards)
• MEDIUM: Frontend fallback triggers on any error (not just 404) for rolling-deploy resilience
• LOW: Removed dead $totalMastered variable in LeitnerService (computed but never used)

Performance

• Dashboard load: 4 XHR → 1 XHR for gamification data
• XP calculation: O(n) SQL aggregate → O(1) stats table read
• Notifications: synchronous widget side-effect → async background job
• NotificationJob: filters to users active in last 30 days (skips dormant accounts on large instances)

Added

• Achievements / Badges: 14 badges across 6 categories (sessions, performance, mastery, streak, social, fun)
• XP & Levels: Experience points calculated from sessions, Leitner reviews, accuracy bonuses, and streak multiplier
• Badge Unlock Overlay: Animated full-screen overlay with confetti when earning a badge
• Analytics Dashboard: Achievements grid with earned/locked status, badge progress bars, XP level bar
• Session Juice: Animated score count-up (countUp.js), Personal Best detection, improvement vs. average display
• XP display: "+X XP" shown on all results screens (Training, Exam, Swipe, Leitner)
• Nextcloud Notifications: Badge unlock notifications, streak-at-risk warnings, due card reminders
• Badge progress tracking: API endpoint showing progress towards unearned badges
• New DB table learning_user_badges (Migration Version001100)
• 2 new API endpoints: GET /api/badges, GET /api/badges/progress

Changed

• Training complete response now includes newly_earned_badges, xp_earned, is_personal_best, improvement, average_accuracy
• Leitner answer response now includes newly_earned_badges when card reaches Box 5
• Share creation now triggers badge check for "Sharing is Caring"
• Streak endpoint now triggers streak badge checks
• Dashboard widget sends streak warning and due reminder notifications

Security

• CRITICAL: Close training-session oracle — startSession(exam) auto-completes open training sessions on same pool
• CRITICAL: Defense-in-depth in submitAnswer/submitBatch — suppress correct_answer fields via cross-session check
• HIGH: Strip explanation field from Question API during active exam to prevent indirect answer leakage
• Rate-limits on ShareController and TranslationController write endpoints

Fixed

• Leitner feedback shows hint when correct answers are suppressed during active exam

Changed — UX-Navigation Struktur

• Instructor Tab Groups: 17 instructor tabs organized into 5 logical groups (Lernraum, Teilnehmer, Kommunikation, Wettbewerb, Verwaltung) with visual separators.
• Abenteuer Standalone: Adventure mode promoted from Arena sub-mode to its own CourseDetail tab, independently gatable via mode_config.
• Arena Submode Gating: Each Arena mode (Duel, Gameshow, Oldschool) individually hideable per course rules. Arena tab disappears when all sub-modes disabled.

Changed — Code-Hygiene & Settings

• Settings Split: Instructors now see two sub-tabs in Settings: "Kurs-Verwaltung" (admin) and "Meine Einstellungen" (personal). Students see only personal settings.
• Zeitreise Removed: Removed 1270+ lines of dead Zeitreise/HackThroughTime frontend code (component, characters, navigation, mode_config key).
• German Labels: All UI-visible labels now go through t() translation. ModeIdentityBanner labels localized.

Added — Simulator-Praxis-Sessions

• Practicum Engine: Pure-JS state machine for guided session management with localStorage persistence and browser-reload recovery.
• 11 Practicum Sessions: Real-world IT scenarios across all 7 simulators (42 steps total). Firewall, DNS, and Routing get 2 sessions each.
• PracticumRunner UI: New "Praxis" tab in every simulator with step-by-step instructions, context explanations, progress bar ("Schritt X von Y"), and score summary.

Added — Student Dashboard

• Heute Screen: New default landing page for students with SmartQueue widget (due cards count + "Jetzt lernen"), Daily Challenge card, streak display, and daily progress.
• Global Feed: Aggregates announcements from all enrolled courses chronologically with course-name badges and pagination.
• Pools Navigation: Direct "Pools" tab in student main navigation — one click to PoolList.

Added — DevCloud Integration & Leitner

• Talk Room Link: Instructors can set a Talk room token per course. Clickable link appears in course header, opens NC Talk in new tab.
• Materials for Students: Students now see the Materialien tab (read-only) when a course has a material folder set.
• Buddy Matching: New "Lernpartner" tab shows who can help with your topics and whom you can help, based on Telos help_offer/help_wanted data.
• Course-Aware Tools: Werkzeuge tab filters simulators based on active course's enabled_tools. No course active = all tools visible.
• Sprint Intervals: Instructors can activate sprint mode per course (4h/12h/1d/2d instead of 1d/3d/7d/14d Leitner intervals) for intensive courses.

Fixed

• Badge Duplicate Crash: Session completion no longer fails with 400 when badge already exists. Fixed catch to use OCP\DB\Exception (NC 30 wraps Doctrine exceptions).

Added — Story RPG "Abenteuer" Mode

• Story Engine: Full campaign-based RPG learning mode with branching narratives, skill checks, and character classes (Architect, Security, SysAdmin, Helpdesk). 20 campaigns across CompTIA Network+, Security+, CySA+, Linux+, and A+.
• KI-Erzähler: Gemini-powered dynamic narrator with freetext player actions, NPC dialog generation, and role-based prompts. Fallback to static text when AI unavailable.
• Skill Checks: In-story quiz phases with 3 questions per check, batch submission, pass/fail branching to different scenes.
• 20 Campaigns: Real-world IT incident scenarios — SolarWinds, WannaCry, Log4Shell, Colonial Pipeline, Equifax, plus 6 Security+ exam-oriented campaigns (Phishing, Zero Trust, Crypto, Compliance, IR, Cloud) and an AI Security campaign.
• Coop Mode: Infrastructure for multiplayer campaign sessions (UI placeholder, backend ready).

Added — "Zeitreise" Hack Through Time

• 7 Epoch Campaign System: Phone Phreaking (1960s), WarGames (1980s), The Worm (1990s), Bobby Tables (2000s), Shadow Brokers (2010s), Supply Chain (2020s), Quantum Dawn (Future).
• Period-Accurate CSS Themes: Each epoch has its own visual theme (terminal-green, amber-on-black, retro-web, etc.).
• CHRONOS Guide: AI narrator character that guides players through hacking history.
• Museum Facts: Historical sidebars with real dates, events, and technical details.
• Character Classes: Epoch-specific roles (Phreaker, Hacker, Script Kiddie, Analyst, etc.).

Added — Visual Identity System

• Design Tokens: CSS custom property layer (--lnc-*) with dark/light scopes and motion utilities.
• 13 Character Registry: SVG silhouette avatars with emotion states (idle, celebrate, alert) for all NPCs.
• Campaign Intro Animation: Full-screen intro with title, difficulty badge, and character reveal.
• Dialogue Stage: NPC dialog component with portrait, speech bubble, and emotion tags.
• Paper & Circuits Narrative Skin: Dark theme for adventure mode with subtle circuit-board patterns.

Added — RAG & Document Intelligence (v4.1)

• Document Upload & Extraction: Instructors can link Nextcloud folders as course material, scan for files, and extract text from PDF/Markdown.
• Chunking Pipeline: Automatic text chunking with keyword extraction for semantic search.
• Multi-Source RAG Context: VirtuProf answers now cite course materials with [Quelle: filename, Kap. X] format.
• 4000-Token Budget: Smart context window management prioritizing relevant chunks.

Added — Oldschool Board Games (v5.0)

• Lernwürfel: "Mensch ärgere dich nicht" inspired board game with dice rolls and question challenges.
• Wissensturm: Trivial Pursuit tower game with category-based progression.

Added — Personal Learning Bot (v4.0)

• GeminiService: 5-layer security stack (API key isolation, input sanitization, output filtering, rate limiting, audit logging).
• VirtuProf Chat: AI-powered learning assistant with chat-first UI, language auto-detection, and chat memory.
• Note Generator: Gemini-based topic summaries saved to Nextcloud Files.
• Lernprofil: Passive user learning profile with weekly study plan generation.
• Auto-Triggers: Exam auto-notes, wrong-answer threshold alerts, weekly plan background job.
• Ticket Triage: AI-powered support ticket classification and draft FAQ responses.
• AI Consent: Opt-in consent overlay before first AI interaction, GDPR-compliant.

Added — Tools

• Subnet Calculator: Browser-based IPv4 subnet calculator with CIDR/mask input, binary display, and VLSM planner.
• Subnetting Question Pool: 50+ subnet calculation practice questions.

Added — Quality & Testing

• ESLint: Vue/JS linting with no-v-html error rule, 0 errors enforced.
• Pre-Push Hook: 4-gate quality check (Security scan, ESLint, Vitest 67 tests, PHPStan Level 5).
• Playwright Browser Tests: 67 automated checks covering navigation, campaigns, time travel, tools, VirtuProf, security. 52 PASS / 11 FAIL / 4 SKIP.
• PHPUnit: 12 service-level unit tests (Training, Leitner, Analytics, Course).
• Test Strategy: 4-gate pyramid documented in CLAUDE.md.

Fixed

• Campaign skill-checks now always use pre-loaded questions from scene response (no separate API call).
• Campaign start always creates fresh session (no stale resume from previous play).
• Missing Abenteuer/Oldschool/Zeitreise toggles in course mode settings.
• WannaCry campaign: corrected from email dropper to SMB worm narrative.
• PBQ subtype auto-detection from config structure when pbq_subtype not set.
• Empty skill-check pools handled gracefully (skip to next scene instead of crash).
• Narrative garbage fallback when Gemini returns malformed text.
• AI rate-limits on VirtuProf available()/status() endpoints.
• ESLint: empty catch blocks, v-if with v-for separation, escaped quotes in templates.

Security

• Gemini language mirroring prevention (no prompt echo).
• Story mode injection guards on freetext actions.
• Story mode rate-limits (10 starts/min, 60 scenes/min).
• Pre-push security scan for hardcoded secrets.

Added

• Calendar Token: Per-user ICS subscription token for external calendar apps. GET /api/v1/user/calendar-token returns token + subscription URL. POST /api/v1/user/calendar-token/regenerate invalidates old token. Token stored in NC preferences (never expires until regenerated).
• Public ICS Feed: GET /api/v1/calendar/{token}.ics — unauthenticated ICS endpoint for calendar subscriptions. Uses token-to-user reverse lookup via oc_preferences.
• Calendar Sync in Personal Settings: ICS URL field with one-click copy and regenerate button.
• ICS UID domain fix: UID fields now use actual NC hostname (parse_url(getBaseUrl(), PHP_URL_HOST)) instead of literal @nextcloud.
• AI Explain button: POST /api/ai/explain schedules a text2text task explaining why an answer is correct/incorrect. "💡 Explain this" button appears after answering in LeitnerMode and TrainingMode (only shown when AI is available).
• At-Risk CSV Export: GET /api/courses/{courseId}/at-risk/export/csv — downloads at-risk student list as CSV (Name, Risk Level, Risk Reasons, Accuracy, Last Active). Export button in course progress tab.
• Batch Pool Assignment: Add-pool modal in CourseDetail now supports multi-select (checkboxes) — select multiple pools and add them all with one click.

Changed

• ExportController: Replaced anonymous class with DataDownloadResponse for ICS response (cleaner code, no custom render() override needed). ICS body extracted to buildIcsBody() — shared by authenticated and token-based endpoints.
• AIService::getTaskStatus() now includes output (raw text) in status response alongside questions array — needed for explain results.

Added

• Daily missions: mission progress model plus claim endpoint (GET /api/v1/missions, POST /api/v1/missions/{missionKey}/claim).
• Mission XP claims table: Migration Version002000 adds learning_user_mission_claims with one-claim-per-mission-per-day guarantee.
• Streak freeze tokens: weekly reset token support in streak calculation (streak_freeze_tokens, last_freeze_reset_week in learning_user_stats).
• Badge tiers: new bronze/silver/gold/platinum tiers for session count, mastery count, and streak milestones.
• Analytics UI updates: Daily mission cards with claim action and freeze-token visibility.

Changed

• Streak handling: streak computation can bridge one missed day when freeze token is available; token is consumed on activity-side calls.
• App version: bumped to 2.5.0.

Fixed

• Course Pool Access: Course members and instructors can now access pools assigned to their courses. Previously only pool owners and explicitly shared users had access, causing "Pool not found" errors for enrolled students.

Changed

• PoolService: Extracted findPoolRow() helper, added hasCoursePoolAccess() fallback in find() method
• 5 Services updated: LeitnerService, PoolService, QuestionService, TrainingService, TranslationService — all hasPoolAccess() methods now check course membership as a third access path

Technical

• 5 changed files, 165 insertions, 12 deletions
• No database migration needed — uses existing learning_course_pools and learning_course_members tables
• Course pool access grants read-only permission (permission: 'read')

Added

• Free Text Questions: New open question type — users type free-text answers instead of selecting from choices. Fuzzy matching (case-insensitive, Levenshtein distance ≤2 for short answers, substring matching for long answers)
• CSV/JSON Export: Download question pools as CSV or JSON files. Roundtrip-compatible with import — export then re-import produces identical questions
• ExportController.php: New controller with exportCsv() and exportJson() endpoints, DataDownloadResponse for browser download
• XP Streak Multipliers: Tier-based XP bonuses replace old linear formula — 1.5x at 3-day streak, 2x at 7-day, 3x at 30-day streak
• XP Multiplier Badge: Visible multiplier indicator (1.5x / 2x / 3x) in Pool List when streak bonus is active
• Open Question Import: CSV format question,model_answer,open and JSON "type": "open" with single model answer
• Open Question in all modes: Training, Leitner, Smart Queue, Exam (textarea + batch submit), Daily Challenge — SwipeMode filters out open questions

Changed

• XpService: getStreakMultiplier() and applyMultiplier() replace linear 1.0 + (streak * 0.01) formula
• LeitnerService: All XP awards (correct answer, mastery bonus, daily goal) now use streak multiplier via XpService
• UserStateController: state() response includes xp_multiplier field; answerChallenge() applies streak multiplier to challenge XP
• QuestionForm.vue: New "Free text" answer type option with model answer textarea
• QuestionList.vue: "Freitext" badge for open questions, model answer display, Export CSV/JSON dropdown
• ImportDialog.vue: Help text updated with open-question format examples for both CSV and JSON
• SwipeMode.vue: Filters out open questions (not compatible with swipe/tap interaction)
• routes.php: 2 new export routes (71 total)

Technical

• 1 new file (ExportController.php), 22 changed files
• No database migration needed — question_type VARCHAR(20) already supports open, answer_ids TEXT stores JSON
• QuestionService::isOpenAnswerCorrect() static helper used by TrainingService, LeitnerService, and UserStateController
• Rate limit on export endpoints: 10 requests per 60 seconds

Added

• Role-Based Navigation: Students start at Courses view (no Pools tab), instructors keep both tabs. App title simplified to "Lernen" for students
• Onboarding Hint System: 7 dismissible info cards (localStorage-based) explaining Smart Queue, Leitner boxes, Daily Goal, Daily Challenge, and welcome messages for both roles
• hintMixin.js: Reusable Vue mixin for localStorage-backed hint dismiss/check across all components
• Mode Descriptions: One-line explanation shown below the active mode selector (Training, Leitner, Wahr/Falsch, Exam, Stats, Manage)
• Pool-from-Course Navigation: "Back to Course" button when opening a pool from course context (instead of losing context by switching to Pools view)

Changed

• App.vue: Mode selector filtered by role — students see only Train/Leitner/Wahr-Falsch/Exam (no Stats, no Manage)
• PoolList.vue: Create Pool button, Share/Edit/Delete actions hidden for students. Better empty state text
• CourseList.vue: Student empty state now explains that the instructor enrolls them
• LeitnerMode.vue: Box labels improved — "Neu — taeglich wiederholen", "Lernphase — nach 1 Tag", "Bekannt — nach 3 Tagen", "Gut — nach 7 Tagen", "Gemeistert — nach 14 Tagen"
• SmartQueue.vue: Better empty state ("Open a pool and start the Leitner system"), ready state shows priority sorting info
• PoolList.vue: "Jetzt Lernen" → "Start learning", "Trouble Spots" → "Trouble spots" (consistency)
• de.json: ~60 new German translation keys for all hints, mode descriptions, empty states, and v1.8/v1.9 UI strings

Added

• AI Question Generator: Paste text (lecture notes, textbook excerpts) and let AI generate multiple-choice questions. Three-step workflow: input → AI generation → editable preview → bulk import into pool
• AIService.php: NC TaskProcessing API (NC 30+) with TextProcessing fallback (NC 29) — runtime detection, no app-level API key management
• AIController.php: 4 new endpoints — GET /api/ai/available, POST /api/ai/generate, GET /api/ai/status/{taskId}, POST /api/ai/import/{taskId}
• AIGenerator.vue: Full wizard with textarea input, question count slider (5-30), language selector, polling progress, editable preview with select/deselect all, inline editing of questions and answers
• At-Risk Early Warning: Instructors see which students are falling behind on the Course Progress tab. Rule-based risk scoring with 5 weighted signals (inactivity >7d, accuracy <50%, box-1 stall >60%, lost streak, <3 sessions in 14d)
• At-Risk API: GET /api/courses/{courseId}/at-risk — returns students with risk_level (high/medium), risk_reasons array, last_active, accuracy
• Remediation Queue: Focused practice on hardest questions (≥3 wrong answers, <30% accuracy, box ≤2). "Trouble Spots" button on Pool List with item count
• Remediation API: GET /api/leitner/remediation (items), GET /api/leitner/remediation/count (lightweight count)
• Daily Challenge: One random question per day from user's pools with +15 XP bonus for correct answers. Deterministic selection via crc32(userId + date) — same question per user per day
• Daily Challenge API: GET /api/v1/daily-challenge, POST /api/v1/daily-challenge/answer
• Migration V001600: Adds last_challenge_date (VARCHAR 10) and last_challenge_correct (BOOLEAN) to learning_user_stats

Changed

• QuestionList.vue: "Generate with AI" button visible when AI provider is configured (checks /api/ai/available)
• PoolList.vue: "Trouble Spots" button (orange, warning style) and inline Daily Challenge card with answer submission
• SmartQueue.vue: New mode prop (queue | remediation) with conditional API endpoint, titles, and empty states
• App.vue: Wires openRemediation event from PoolList to SmartQueue with mode="remediation", new smartQueueMode state
• CourseDetail.vue: At-Risk section on Progress tab — collapsible card grid with risk badges and reason tags
• routes.php: 9 new routes (ai: 4, leitner: 2, user_state: 2, course: 1) — 69 total

Security

• AI Rate Limits: generate endpoint limited to 5/min, import limited to 10/min
• AI Input Validation: Text length 50-50000 chars, word count capped at 3000 for LLM input
• AI User Isolation: Task status checks verify userId matches task owner
• At-Risk Access Control: Endpoint restricted to course instructors via validateInstructor()

Added

• ConsistencyCheckJob: Daily background job that reconciles learning_user_stats against source-of-truth tables — self-healing for XP, level, sessions, mastered counts, and streaks
• Composite Leitner indices: (user_id, box) and (user_id, next_review) on learning_leitner_items for faster aggregations and due-question queries (Migration Version001300)

Fixed

• HIGH: LeitnerService::answerQuestion() now wraps box update, stats update, XP increment, and badge award in a single DB transaction — prevents partial writes on crashes
• HIGH: Optimistic concurrency control on Leitner item update (WHERE box = :oldBox AND correct_count = :old AND incorrect_count = :old) — detects and rejects concurrent modifications including Box-5→5 lost updates
• HIGH: Box-5 mastery bonus (+25 XP, +1 mastered, badge check) now only awarded on actual promotion (Box <5→5), not on repeated correct answers in Box 5 — prevents XP/stats inflation
• HIGH: Badge notifications and Activity events now dispatched after transaction commit — prevents ghost notifications on rollback
• MEDIUM: Demotion fallback (updateUserStats()) moved after Leitner item update — recalc now sees correct box value instead of overcounting
• MEDIUM: syncLevel() deferred to after transaction commit — eliminates lock contention under concurrent reviews
• MEDIUM: Cache invalidation moved after transaction commit (was inside write sequence, could serve stale data on rollback)
• LOW: Multi-select answer validation uses batch IN query instead of N+1 per-answer queries

Performance

• Leitner box aggregations (stats, mastery counts) use composite index instead of full table scan
• Due-question queries benefit from (user_id, next_review) index — faster Leitner review loading
• ConsistencyCheckJob processes max 500 users per run, oldest-updated first — all users eventually reconciled
• ConsistencyCheckJob logs progress and catches per-user errors without aborting the batch

Added

• Consolidated User State API: GET /api/v1/user/state — single endpoint replaces 4 separate calls (XP, streak, badges, progress)
• Denormalized learning_user_stats table: O(1) reads for XP, level, streak, sessions, mastered counts (Migration Version001200)
• Background Notification Job: NotificationJob (TimedJob every 4h) replaces widget-triggered notifications
• Activity-App Integration: Badge unlock events appear in Nextcloud Activity stream with toggle in Activity settings
• Timezone-aware badges: Night Owl and Early Bird badges respect user's Nextcloud timezone setting
• XpService: Dedicated service for XP calculation, session XP increment, level computation
• Response caching: User state endpoint cached for 30s per user via ICacheFactory
• Composite index on learning_sessions(user_id, completed_at) for faster XP/streak queries
• time_limit_seconds column on learning_sessions for Speed Demon badge support

Changed

• BadgeService refactored from 430 to ~200 lines — XP/streak methods extracted to XpService
• Dashboard Widget is now pure read-only (~140 lines) — no longer sends notifications as side-effect
• AnalyticsDashboard.vue: 4 API calls consolidated to 1, with fallback to legacy endpoints for rolling deploys
• countUp.js: Respects prefers-reduced-motion — immediately shows final value without animation
• BadgeUnlock.vue: Added aria-live="polite" region for screenreader announcements
• LeitnerService: Box-5 promotion updates denormalized total_mastered counter
• TrainingService: Session completion updates denormalized stats via XpService

Fixed

• HIGH: Leitner XP now synced to learning_user_stats — correct answers award 5 XP, Box-5 mastery awards 25 XP bonus
• HIGH: Race condition in stats UPSERT — all INSERT paths wrapped in UniqueConstraintViolationException catch with UPDATE retry
• HIGH: SQL injection in incrementSessionXp — $currentStreak now uses createNamedParameter() instead of string concatenation
• HIGH: NotificationJob memory exhaustion — fetchAll() replaced with streaming fetch() loop; N+1 due-count queries replaced with single batch query
• HIGH: Level-race in XpService — stale getTotalXpFromStats() read eliminated; syncLevel() is monotonic (AND current_level < :newLevel) to prevent concurrent stale-level overwrites
• HIGH: Stats INSERT fallback uses updateUserStats() full recalc — preserves historical XP, sessions, and mastered counts for first-write users
• HIGH: total_mastered demotion — Box 5→1 transition now decrements total_mastered counter with updateUserStats() fallback for missing stats rows
• MEDIUM: User state cache invalidated on every Leitner answer (not just correct), after share-badge awards, and at END of completeSession() (after all badge/streak writes)
• MEDIUM: Migration backfill is per-step idempotent — each INSERT...SELECT skips existing users via NOT IN clause (safe for partial re-runs)
• MEDIUM: Migration backfill includes Leitner-only users (no completed sessions but have reviewed cards)
• MEDIUM: Frontend fallback triggers on any error (not just 404) for rolling-deploy resilience
• LOW: Removed dead $totalMastered variable in LeitnerService (computed but never used)

Performance

• Dashboard load: 4 XHR → 1 XHR for gamification data
• XP calculation: O(n) SQL aggregate → O(1) stats table read
• Notifications: synchronous widget side-effect → async background job
• NotificationJob: filters to users active in last 30 days (skips dormant accounts on large instances)

Added

• Achievements / Badges: 14 badges across 6 categories (sessions, performance, mastery, streak, social, fun)
• XP & Levels: Experience points calculated from sessions, Leitner reviews, accuracy bonuses, and streak multiplier
• Badge Unlock Overlay: Animated full-screen overlay with confetti when earning a badge
• Analytics Dashboard: Achievements grid with earned/locked status, badge progress bars, XP level bar
• Session Juice: Animated score count-up (countUp.js), Personal Best detection, improvement vs. average display
• XP display: "+X XP" shown on all results screens (Training, Exam, Swipe, Leitner)
• Nextcloud Notifications: Badge unlock notifications, streak-at-risk warnings, due card reminders
• Badge progress tracking: API endpoint showing progress towards unearned badges
• New DB table learning_user_badges (Migration Version001100)
• 2 new API endpoints: GET /api/badges, GET /api/badges/progress

Changed

• Training complete response now includes newly_earned_badges, xp_earned, is_personal_best, improvement, average_accuracy
• Leitner answer response now includes newly_earned_badges when card reaches Box 5
• Share creation now triggers badge check for "Sharing is Caring"
• Streak endpoint now triggers streak badge checks
• Dashboard widget sends streak warning and due reminder notifications

Security

• CRITICAL: Close training-session oracle — startSession(exam) auto-completes open training sessions on same pool
• CRITICAL: Defense-in-depth in submitAnswer/submitBatch — suppress correct_answer fields via cross-session check
• HIGH: Strip explanation field from Question API during active exam to prevent indirect answer leakage
• Rate-limits on ShareController and TranslationController write endpoints

Fixed

• Leitner feedback shows hint when correct answers are suppressed during active exam

Changed — UX-Navigation Struktur

• Instructor Tab Groups: 17 instructor tabs organized into 5 logical groups (Lernraum, Teilnehmer, Kommunikation, Wettbewerb, Verwaltung) with visual separators.
• Abenteuer Standalone: Adventure mode promoted from Arena sub-mode to its own CourseDetail tab, independently gatable via mode_config.
• Arena Submode Gating: Each Arena mode (Duel, Gameshow, Oldschool) individually hideable per course rules. Arena tab disappears when all sub-modes disabled.

Changed — Code-Hygiene & Settings

• Settings Split: Instructors now see two sub-tabs in Settings: "Kurs-Verwaltung" (admin) and "Meine Einstellungen" (personal). Students see only personal settings.
• Zeitreise Removed: Removed 1270+ lines of dead Zeitreise/HackThroughTime frontend code (component, characters, navigation, mode_config key).
• German Labels: All UI-visible labels now go through t() translation. ModeIdentityBanner labels localized.

Added — Simulator-Praxis-Sessions

• Practicum Engine: Pure-JS state machine for guided session management with localStorage persistence and browser-reload recovery.
• 11 Practicum Sessions: Real-world IT scenarios across all 7 simulators (42 steps total). Firewall, DNS, and Routing get 2 sessions each.
• PracticumRunner UI: New "Praxis" tab in every simulator with step-by-step instructions, context explanations, progress bar ("Schritt X von Y"), and score summary.

Added — Student Dashboard

• Heute Screen: New default landing page for students with SmartQueue widget (due cards count + "Jetzt lernen"), Daily Challenge card, streak display, and daily progress.
• Global Feed: Aggregates announcements from all enrolled courses chronologically with course-name badges and pagination.
• Pools Navigation: Direct "Pools" tab in student main navigation — one click to PoolList.

Added — DevCloud Integration & Leitner

• Talk Room Link: Instructors can set a Talk room token per course. Clickable link appears in course header, opens NC Talk in new tab.
• Materials for Students: Students now see the Materialien tab (read-only) when a course has a material folder set.
• Buddy Matching: New "Lernpartner" tab shows who can help with your topics and whom you can help, based on Telos help_offer/help_wanted data.
• Course-Aware Tools: Werkzeuge tab filters simulators based on active course's enabled_tools. No course active = all tools visible.
• Sprint Intervals: Instructors can activate sprint mode per course (4h/12h/1d/2d instead of 1d/3d/7d/14d Leitner intervals) for intensive courses.

Fixed

• Badge Duplicate Crash: Session completion no longer fails with 400 when badge already exists. Fixed catch to use OCP\DB\Exception (NC 30 wraps Doctrine exceptions).

Added — Story RPG "Abenteuer" Mode

• Story Engine: Full campaign-based RPG learning mode with branching narratives, skill checks, and character classes (Architect, Security, SysAdmin, Helpdesk). 20 campaigns across CompTIA Network+, Security+, CySA+, Linux+, and A+.
• KI-Erzähler: Gemini-powered dynamic narrator with freetext player actions, NPC dialog generation, and role-based prompts. Fallback to static text when AI unavailable.
• Skill Checks: In-story quiz phases with 3 questions per check, batch submission, pass/fail branching to different scenes.
• 20 Campaigns: Real-world IT incident scenarios — SolarWinds, WannaCry, Log4Shell, Colonial Pipeline, Equifax, plus 6 Security+ exam-oriented campaigns (Phishing, Zero Trust, Crypto, Compliance, IR, Cloud) and an AI Security campaign.
• Coop Mode: Infrastructure for multiplayer campaign sessions (UI placeholder, backend ready).

Added — "Zeitreise" Hack Through Time

• 7 Epoch Campaign System: Phone Phreaking (1960s), WarGames (1980s), The Worm (1990s), Bobby Tables (2000s), Shadow Brokers (2010s), Supply Chain (2020s), Quantum Dawn (Future).
• Period-Accurate CSS Themes: Each epoch has its own visual theme (terminal-green, amber-on-black, retro-web, etc.).
• CHRONOS Guide: AI narrator character that guides players through hacking history.
• Museum Facts: Historical sidebars with real dates, events, and technical details.
• Character Classes: Epoch-specific roles (Phreaker, Hacker, Script Kiddie, Analyst, etc.).

Added — Visual Identity System

• Design Tokens: CSS custom property layer (--lnc-*) with dark/light scopes and motion utilities.
• 13 Character Registry: SVG silhouette avatars with emotion states (idle, celebrate, alert) for all NPCs.
• Campaign Intro Animation: Full-screen intro with title, difficulty badge, and character reveal.
• Dialogue Stage: NPC dialog component with portrait, speech bubble, and emotion tags.
• Paper & Circuits Narrative Skin: Dark theme for adventure mode with subtle circuit-board patterns.

Added — RAG & Document Intelligence (v4.1)

• Document Upload & Extraction: Instructors can link Nextcloud folders as course material, scan for files, and extract text from PDF/Markdown.
• Chunking Pipeline: Automatic text chunking with keyword extraction for semantic search.
• Multi-Source RAG Context: VirtuProf answers now cite course materials with [Quelle: filename, Kap. X] format.
• 4000-Token Budget: Smart context window management prioritizing relevant chunks.

Added — Oldschool Board Games (v5.0)

• Lernwürfel: "Mensch ärgere dich nicht" inspired board game with dice rolls and question challenges.
• Wissensturm: Trivial Pursuit tower game with category-based progression.

Added — Personal Learning Bot (v4.0)

• GeminiService: 5-layer security stack (API key isolation, input sanitization, output filtering, rate limiting, audit logging).
• VirtuProf Chat: AI-powered learning assistant with chat-first UI, language auto-detection, and chat memory.
• Note Generator: Gemini-based topic summaries saved to Nextcloud Files.
• Lernprofil: Passive user learning profile with weekly study plan generation.
• Auto-Triggers: Exam auto-notes, wrong-answer threshold alerts, weekly plan background job.
• Ticket Triage: AI-powered support ticket classification and draft FAQ responses.
• AI Consent: Opt-in consent overlay before first AI interaction, GDPR-compliant.

Added — Tools

• Subnet Calculator: Browser-based IPv4 subnet calculator with CIDR/mask input, binary display, and VLSM planner.
• Subnetting Question Pool: 50+ subnet calculation practice questions.

Added — Quality & Testing

• ESLint: Vue/JS linting with no-v-html error rule, 0 errors enforced.
• Pre-Push Hook: 4-gate quality check (Security scan, ESLint, Vitest 67 tests, PHPStan Level 5).
• Playwright Browser Tests: 67 automated checks covering navigation, campaigns, time travel, tools, VirtuProf, security. 52 PASS / 11 FAIL / 4 SKIP.
• PHPUnit: 12 service-level unit tests (Training, Leitner, Analytics, Course).
• Test Strategy: 4-gate pyramid documented in CLAUDE.md.

Fixed

• Campaign skill-checks now always use pre-loaded questions from scene response (no separate API call).
• Campaign start always creates fresh session (no stale resume from previous play).
• Missing Abenteuer/Oldschool/Zeitreise toggles in course mode settings.
• WannaCry campaign: corrected from email dropper to SMB worm narrative.
• PBQ subtype auto-detection from config structure when pbq_subtype not set.
• Empty skill-check pools handled gracefully (skip to next scene instead of crash).
• Narrative garbage fallback when Gemini returns malformed text.
• AI rate-limits on VirtuProf available()/status() endpoints.
• ESLint: empty catch blocks, v-if with v-for separation, escaped quotes in templates.

Security

• Gemini language mirroring prevention (no prompt echo).
• Story mode injection guards on freetext actions.
• Story mode rate-limits (10 starts/min, 60 scenes/min).
• Pre-push security scan for hardcoded secrets.

Added

• Calendar Token: Per-user ICS subscription token for external calendar apps. GET /api/v1/user/calendar-token returns token + subscription URL. POST /api/v1/user/calendar-token/regenerate invalidates old token. Token stored in NC preferences (never expires until regenerated).
• Public ICS Feed: GET /api/v1/calendar/{token}.ics — unauthenticated ICS endpoint for calendar subscriptions. Uses token-to-user reverse lookup via oc_preferences.
• Calendar Sync in Personal Settings: ICS URL field with one-click copy and regenerate button.
• ICS UID domain fix: UID fields now use actual NC hostname (parse_url(getBaseUrl(), PHP_URL_HOST)) instead of literal @nextcloud.
• AI Explain button: POST /api/ai/explain schedules a text2text task explaining why an answer is correct/incorrect. "💡 Explain this" button appears after answering in LeitnerMode and TrainingMode (only shown when AI is available).
• At-Risk CSV Export: GET /api/courses/{courseId}/at-risk/export/csv — downloads at-risk student list as CSV (Name, Risk Level, Risk Reasons, Accuracy, Last Active). Export button in course progress tab.
• Batch Pool Assignment: Add-pool modal in CourseDetail now supports multi-select (checkboxes) — select multiple pools and add them all with one click.

Changed

• ExportController: Replaced anonymous class with DataDownloadResponse for ICS response (cleaner code, no custom render() override needed). ICS body extracted to buildIcsBody() — shared by authenticated and token-based endpoints.
• AIService::getTaskStatus() now includes output (raw text) in status response alongside questions array — needed for explain results.

Added

• Daily missions: mission progress model plus claim endpoint (GET /api/v1/missions, POST /api/v1/missions/{missionKey}/claim).
• Mission XP claims table: Migration Version002000 adds learning_user_mission_claims with one-claim-per-mission-per-day guarantee.
• Streak freeze tokens: weekly reset token support in streak calculation (streak_freeze_tokens, last_freeze_reset_week in learning_user_stats).
• Badge tiers: new bronze/silver/gold/platinum tiers for session count, mastery count, and streak milestones.
• Analytics UI updates: Daily mission cards with claim action and freeze-token visibility.

Changed

• Streak handling: streak computation can bridge one missed day when freeze token is available; token is consumed on activity-side calls.
• App version: bumped to 2.5.0.

Fixed

• Course Pool Access: Course members and instructors can now access pools assigned to their courses. Previously only pool owners and explicitly shared users had access, causing "Pool not found" errors for enrolled students.

Changed

• PoolService: Extracted findPoolRow() helper, added hasCoursePoolAccess() fallback in find() method
• 5 Services updated: LeitnerService, PoolService, QuestionService, TrainingService, TranslationService — all hasPoolAccess() methods now check course membership as a third access path

Technical

• 5 changed files, 165 insertions, 12 deletions
• No database migration needed — uses existing learning_course_pools and learning_course_members tables
• Course pool access grants read-only permission (permission: 'read')

Added

• Free Text Questions: New open question type — users type free-text answers instead of selecting from choices. Fuzzy matching (case-insensitive, Levenshtein distance ≤2 for short answers, substring matching for long answers)
• CSV/JSON Export: Download question pools as CSV or JSON files. Roundtrip-compatible with import — export then re-import produces identical questions
• ExportController.php: New controller with exportCsv() and exportJson() endpoints, DataDownloadResponse for browser download
• XP Streak Multipliers: Tier-based XP bonuses replace old linear formula — 1.5x at 3-day streak, 2x at 7-day, 3x at 30-day streak
• XP Multiplier Badge: Visible multiplier indicator (1.5x / 2x / 3x) in Pool List when streak bonus is active
• Open Question Import: CSV format question,model_answer,open and JSON "type": "open" with single model answer
• Open Question in all modes: Training, Leitner, Smart Queue, Exam (textarea + batch submit), Daily Challenge — SwipeMode filters out open questions

Changed

• XpService: getStreakMultiplier() and applyMultiplier() replace linear 1.0 + (streak * 0.01) formula
• LeitnerService: All XP awards (correct answer, mastery bonus, daily goal) now use streak multiplier via XpService
• UserStateController: state() response includes xp_multiplier field; answerChallenge() applies streak multiplier to challenge XP
• QuestionForm.vue: New "Free text" answer type option with model answer textarea
• QuestionList.vue: "Freitext" badge for open questions, model answer display, Export CSV/JSON dropdown
• ImportDialog.vue: Help text updated with open-question format examples for both CSV and JSON
• SwipeMode.vue: Filters out open questions (not compatible with swipe/tap interaction)
• routes.php: 2 new export routes (71 total)

Technical

• 1 new file (ExportController.php), 22 changed files
• No database migration needed — question_type VARCHAR(20) already supports open, answer_ids TEXT stores JSON
• QuestionService::isOpenAnswerCorrect() static helper used by TrainingService, LeitnerService, and UserStateController
• Rate limit on export endpoints: 10 requests per 60 seconds

Added

• Role-Based Navigation: Students start at Courses view (no Pools tab), instructors keep both tabs. App title simplified to "Lernen" for students
• Onboarding Hint System: 7 dismissible info cards (localStorage-based) explaining Smart Queue, Leitner boxes, Daily Goal, Daily Challenge, and welcome messages for both roles
• hintMixin.js: Reusable Vue mixin for localStorage-backed hint dismiss/check across all components
• Mode Descriptions: One-line explanation shown below the active mode selector (Training, Leitner, Wahr/Falsch, Exam, Stats, Manage)
• Pool-from-Course Navigation: "Back to Course" button when opening a pool from course context (instead of losing context by switching to Pools view)

Changed

• App.vue: Mode selector filtered by role — students see only Train/Leitner/Wahr-Falsch/Exam (no Stats, no Manage)
• PoolList.vue: Create Pool button, Share/Edit/Delete actions hidden for students. Better empty state text
• CourseList.vue: Student empty state now explains that the instructor enrolls them
• LeitnerMode.vue: Box labels improved — "Neu — taeglich wiederholen", "Lernphase — nach 1 Tag", "Bekannt — nach 3 Tagen", "Gut — nach 7 Tagen", "Gemeistert — nach 14 Tagen"
• SmartQueue.vue: Better empty state ("Open a pool and start the Leitner system"), ready state shows priority sorting info
• PoolList.vue: "Jetzt Lernen" → "Start learning", "Trouble Spots" → "Trouble spots" (consistency)
• de.json: ~60 new German translation keys for all hints, mode descriptions, empty states, and v1.8/v1.9 UI strings

Added

• AI Question Generator: Paste text (lecture notes, textbook excerpts) and let AI generate multiple-choice questions. Three-step workflow: input → AI generation → editable preview → bulk import into pool
• AIService.php: NC TaskProcessing API (NC 30+) with TextProcessing fallback (NC 29) — runtime detection, no app-level API key management
• AIController.php: 4 new endpoints — GET /api/ai/available, POST /api/ai/generate, GET /api/ai/status/{taskId}, POST /api/ai/import/{taskId}
• AIGenerator.vue: Full wizard with textarea input, question count slider (5-30), language selector, polling progress, editable preview with select/deselect all, inline editing of questions and answers
• At-Risk Early Warning: Instructors see which students are falling behind on the Course Progress tab. Rule-based risk scoring with 5 weighted signals (inactivity >7d, accuracy <50%, box-1 stall >60%, lost streak, <3 sessions in 14d)
• At-Risk API: GET /api/courses/{courseId}/at-risk — returns students with risk_level (high/medium), risk_reasons array, last_active, accuracy
• Remediation Queue: Focused practice on hardest questions (≥3 wrong answers, <30% accuracy, box ≤2). "Trouble Spots" button on Pool List with item count
• Remediation API: GET /api/leitner/remediation (items), GET /api/leitner/remediation/count (lightweight count)
• Daily Challenge: One random question per day from user's pools with +15 XP bonus for correct answers. Deterministic selection via crc32(userId + date) — same question per user per day
• Daily Challenge API: GET /api/v1/daily-challenge, POST /api/v1/daily-challenge/answer
• Migration V001600: Adds last_challenge_date (VARCHAR 10) and last_challenge_correct (BOOLEAN) to learning_user_stats

Changed

• QuestionList.vue: "Generate with AI" button visible when AI provider is configured (checks /api/ai/available)
• PoolList.vue: "Trouble Spots" button (orange, warning style) and inline Daily Challenge card with answer submission
• SmartQueue.vue: New mode prop (queue | remediation) with conditional API endpoint, titles, and empty states
• App.vue: Wires openRemediation event from PoolList to SmartQueue with mode="remediation", new smartQueueMode state
• CourseDetail.vue: At-Risk section on Progress tab — collapsible card grid with risk badges and reason tags
• routes.php: 9 new routes (ai: 4, leitner: 2, user_state: 2, course: 1) — 69 total

Security

• AI Rate Limits: generate endpoint limited to 5/min, import limited to 10/min
• AI Input Validation: Text length 50-50000 chars, word count capped at 3000 for LLM input
• AI User Isolation: Task status checks verify userId matches task owner
• At-Risk Access Control: Endpoint restricted to course instructors via validateInstructor()

Added

• ConsistencyCheckJob: Daily background job that reconciles learning_user_stats against source-of-truth tables — self-healing for XP, level, sessions, mastered counts, and streaks
• Composite Leitner indices: (user_id, box) and (user_id, next_review) on learning_leitner_items for faster aggregations and due-question queries (Migration Version001300)

Fixed

• HIGH: LeitnerService::answerQuestion() now wraps box update, stats update, XP increment, and badge award in a single DB transaction — prevents partial writes on crashes
• HIGH: Optimistic concurrency control on Leitner item update (WHERE box = :oldBox AND correct_count = :old AND incorrect_count = :old) — detects and rejects concurrent modifications including Box-5→5 lost updates
• HIGH: Box-5 mastery bonus (+25 XP, +1 mastered, badge check) now only awarded on actual promotion (Box <5→5), not on repeated correct answers in Box 5 — prevents XP/stats inflation
• HIGH: Badge notifications and Activity events now dispatched after transaction commit — prevents ghost notifications on rollback
• MEDIUM: Demotion fallback (updateUserStats()) moved after Leitner item update — recalc now sees correct box value instead of overcounting
• MEDIUM: syncLevel() deferred to after transaction commit — eliminates lock contention under concurrent reviews
• MEDIUM: Cache invalidation moved after transaction commit (was inside write sequence, could serve stale data on rollback)
• LOW: Multi-select answer validation uses batch IN query instead of N+1 per-answer queries

Performance

• Leitner box aggregations (stats, mastery counts) use composite index instead of full table scan
• Due-question queries benefit from (user_id, next_review) index — faster Leitner review loading
• ConsistencyCheckJob processes max 500 users per run, oldest-updated first — all users eventually reconciled
• ConsistencyCheckJob logs progress and catches per-user errors without aborting the batch

Added

• Consolidated User State API: GET /api/v1/user/state — single endpoint replaces 4 separate calls (XP, streak, badges, progress)
• Denormalized learning_user_stats table: O(1) reads for XP, level, streak, sessions, mastered counts (Migration Version001200)
• Background Notification Job: NotificationJob (TimedJob every 4h) replaces widget-triggered notifications
• Activity-App Integration: Badge unlock events appear in Nextcloud Activity stream with toggle in Activity settings
• Timezone-aware badges: Night Owl and Early Bird badges respect user's Nextcloud timezone setting
• XpService: Dedicated service for XP calculation, session XP increment, level computation
• Response caching: User state endpoint cached for 30s per user via ICacheFactory
• Composite index on learning_sessions(user_id, completed_at) for faster XP/streak queries
• time_limit_seconds column on learning_sessions for Speed Demon badge support

Changed

• BadgeService refactored from 430 to ~200 lines — XP/streak methods extracted to XpService
• Dashboard Widget is now pure read-only (~140 lines) — no longer sends notifications as side-effect
• AnalyticsDashboard.vue: 4 API calls consolidated to 1, with fallback to legacy endpoints for rolling deploys
• countUp.js: Respects prefers-reduced-motion — immediately shows final value without animation
• BadgeUnlock.vue: Added aria-live="polite" region for screenreader announcements
• LeitnerService: Box-5 promotion updates denormalized total_mastered counter
• TrainingService: Session completion updates denormalized stats via XpService

Fixed

• HIGH: Leitner XP now synced to learning_user_stats — correct answers award 5 XP, Box-5 mastery awards 25 XP bonus
• HIGH: Race condition in stats UPSERT — all INSERT paths wrapped in UniqueConstraintViolationException catch with UPDATE retry
• HIGH: SQL injection in incrementSessionXp — $currentStreak now uses createNamedParameter() instead of string concatenation
• HIGH: NotificationJob memory exhaustion — fetchAll() replaced with streaming fetch() loop; N+1 due-count queries replaced with single batch query
• HIGH: Level-race in XpService — stale getTotalXpFromStats() read eliminated; syncLevel() is monotonic (AND current_level < :newLevel) to prevent concurrent stale-level overwrites
• HIGH: Stats INSERT fallback uses updateUserStats() full recalc — preserves historical XP, sessions, and mastered counts for first-write users
• HIGH: total_mastered demotion — Box 5→1 transition now decrements total_mastered counter with updateUserStats() fallback for missing stats rows
• MEDIUM: User state cache invalidated on every Leitner answer (not just correct), after share-badge awards, and at END of completeSession() (after all badge/streak writes)
• MEDIUM: Migration backfill is per-step idempotent — each INSERT...SELECT skips existing users via NOT IN clause (safe for partial re-runs)
• MEDIUM: Migration backfill includes Leitner-only users (no completed sessions but have reviewed cards)
• MEDIUM: Frontend fallback triggers on any error (not just 404) for rolling-deploy resilience
• LOW: Removed dead $totalMastered variable in LeitnerService (computed but never used)

Performance

• Dashboard load: 4 XHR → 1 XHR for gamification data
• XP calculation: O(n) SQL aggregate → O(1) stats table read
• Notifications: synchronous widget side-effect → async background job
• NotificationJob: filters to users active in last 30 days (skips dormant accounts on large instances)

Added

• Achievements / Badges: 14 badges across 6 categories (sessions, performance, mastery, streak, social, fun)
• XP & Levels: Experience points calculated from sessions, Leitner reviews, accuracy bonuses, and streak multiplier
• Badge Unlock Overlay: Animated full-screen overlay with confetti when earning a badge
• Analytics Dashboard: Achievements grid with earned/locked status, badge progress bars, XP level bar
• Session Juice: Animated score count-up (countUp.js), Personal Best detection, improvement vs. average display
• XP display: "+X XP" shown on all results screens (Training, Exam, Swipe, Leitner)
• Nextcloud Notifications: Badge unlock notifications, streak-at-risk warnings, due card reminders
• Badge progress tracking: API endpoint showing progress towards unearned badges
• New DB table learning_user_badges (Migration Version001100)
• 2 new API endpoints: GET /api/badges, GET /api/badges/progress

Changed

• Training complete response now includes newly_earned_badges, xp_earned, is_personal_best, improvement, average_accuracy
• Leitner answer response now includes newly_earned_badges when card reaches Box 5
• Share creation now triggers badge check for "Sharing is Caring"
• Streak endpoint now triggers streak badge checks
• Dashboard widget sends streak warning and due reminder notifications

Security

• CRITICAL: Close training-session oracle — startSession(exam) auto-completes open training sessions on same pool
• CRITICAL: Defense-in-depth in submitAnswer/submitBatch — suppress correct_answer fields via cross-session check
• HIGH: Strip explanation field from Question API during active exam to prevent indirect answer leakage
• Rate-limits on ShareController and TranslationController write endpoints

Fixed

• Leitner feedback shows hint when correct answers are suppressed during active exam