Learning - Releases

Administrators, please act after the update: enter your operator details. The imprint and privacy pages no longer name a fixed operator. Enter name, postal address and contact email under Administration settings → Learning → Operator details (imprint and privacy notice). Until you do, both pages show a neutral note instead of an operator, and Learning no longer sets the Nextcloud imprint and privacy links (Theming). Links that already point to Learning's pages are kept and lead to that note until the details are entered.

Fixes from a full code audit of the app.

Security

• Learners no longer receive the answer key with the questions. Correct-answer flags, explanations and interactive (PBQ) solutions in question lists, search results and translations now go only to the pool's owner, users it was shared with as Can edit, and the course's instructors. Learners and read-only shares no longer get them. Practice modes (training, spaced repetition, bot games) still show the correct answer after each answer, as before.
• Exams no longer leak solutions through side paths. During a graded exam the question APIs withhold the solution of every PBQ type, including the grading data of command-line and multi-panel PBQs, and the cheat sheet leaves out pools with an open graded exam.
• Adventure skill checks only use questions the player may see. They draw only from published pools the player has access to, accept only the questions they offered, and neither draw from nor reveal answers for a pool with a running graded exam.
• Duel and Gameshow accept only answers to the current question, and the Gameshow sprint time bonus is measured on the server clock and capped at 500 points.
• Course archiving and reading archive snapshots are limited to the course's instructors and Nextcloud administrators.
• CSV exports of at-risk learners and the class summary neutralise cell contents that a spreadsheet program would run as a formula.

Changed

• Operator details are an admin setting (see the note above). The imprint and privacy pages use only what the administrator entered.
• Bot mode in Duel and Gameshow grades your answer on the server, because the browser no longer knows the correct answer.
• Exams: answers that arrive with the automatic submission up to 30 seconds after the time limit are still accepted, and the exam submits itself 5 seconds before the end. Before, all answers of a timed-out exam could be lost (0 %).
• Gameshow: when the 15 seconds run out, a missing answer counts as wrong and the game moves on for everyone. Before, Sprint and Elimination could stop on a question nobody answered.
• Required Vimeo and YouTube videos report their progress. After the learner's consent the page loads the provider's player script, which tells Learning which parts were watched, so such a video can be completed and unlocks the course quiz. Before, it could never be completed. Nothing is loaded from the provider before consent; the privacy page lists the new category.
• The nightly XP consistency check never lowers XP or the level. It used to reset XP from single training questions, streak bonuses, Leitner reviews, missions, goals and Gameshows overnight. XP already lost this way cannot be restored.

Fixed

• Team lead dashboard: members with a valid certificate (without expiry or expiring in more than 30 days) are no longer listed as missing; expired certificates show as expired, with a reminder button; the newest certificate counts. Due and expiry dates show as dates.
• Exam mode: Enter on a focused button or navigation dot activates it instead of skipping the question, and keeps its hotkey meaning after a mouse click; the next PBQ in an exam starts with its own empty answer; pool editors keep the solutions and their explanation translations during their own exam.
• Required videos from Nextcloud Files send only the newly watched seconds, so they can reach completion.
• Unified search works on PostgreSQL.
• Course material search (RAG) keeps Cyrillic, Arabic and accented keywords and keeps the text directly under a Markdown heading; a sub-heading directly under a heading names the chunk.
• Imports: pool_name is read as the pool's name; question type multiple_choice becomes single or multiple choice by the number of correct answers; the occ dry run counts only what the import would store.
• Adventure mode: skill-check questions work on MySQL/MariaDB; a new skill check starts with an empty answer batch; bot-correction scenes no longer list the correct option first.
• Games and leagues: a duel forfeit goes to the player who stayed; co-op players who were ready first leave the lobby when the game starts; ranking PBQs are scored in the spaced-repetition queue.
• Leitner: switching the language during a review keeps the queue and the current card.
• Course feed: "Load more" loads the next entries.
• Exam reminders find exam dates saved with a time.
• Maintenance mode can be switched by co-instructors.
• Material scan detects duplicates per course instead of across all courses.
• PBQ builder: applying an existing PBQ keeps the fields the builder does not edit.
• Navigation: a pool opened from a course keeps its course context; the app works when Nextcloud runs in a subdirectory or with index.php in its URLs.
• Calm display: the switch shows ON when animations are off, and the setting applies after every page load.
• Learning profile: the history trend reads sessions newest first.
• Onboarding: "Skip" on the Jumpstart screen declines the selected starter pool.
• VirtuProf: auto-read and chat scrolling react to new messages.
• AI errors of the note generator and the weekly plan are reported by cause (not configured, rate limit, temporarily unavailable) instead of a generic server error.
• Admin settings: an exam cooldown of 0 minutes is shown and saved as 0.
• Tools: the subnet trainer accepts IPv6 answers in any valid notation; the VLAN frame preview puts the 802.1Q tag after the source MAC.

Reported on GitHub #34 by a self-hosting administrator who could not find where questions are added and whose JSON file did not import.

Fixed

• Pasted JSON was read as CSV. Pasted text that is valid JSON now switches the import dialog to JSON by itself; broken JSON stays on the CSV tab with a note that quotes the JSON error. Uploaded files are read by their extension (.json/.csv) first, so a .csv starting with [Network] … no longer goes to the JSON reader.
• Many common JSON shapes were refused or crashed the import. The import now also reads answers as plain strings (options, choices) with the correct one named on the question (answer, correct, correct_index counting from 0, correct_number counting from 1, a letter or the answer text), the documented pool file with one pool, and numbers where text was expected. A marker that names no answer skips the question with the reason in the import report.
• The pool format lost its metadata in the interface. The pool's chapter fields, exam_key_prefix and the _meta defaults now apply to the questions in the order question > pool > _meta, the same rule as occ learning:import-pool-json.
• CSV with line breaks inside quoted fields (as spreadsheet programs write it) was torn apart. Quoted fields may now contain line breaks, the separator and "".
• An export did not come back complete. The JSON export now carries difficulty, chapter, handbook and exam key, and the subtype and configuration of interactive questions (PBQ), so it re-imports without losses through the interface or occ; ranking PBQs can now be imported. An exported multi question with one correct answer stays multiple choice. The CSV export (also the course statistics export) is plain RFC 4180 now, the format the import reads, so a backslash before a quote no longer breaks the re-import.
• An empty pool was a dead end. It now opens in Manage for everyone who may edit it, and Training offers Add questions.
• Wrong answers could be marked correct. A correct answer after the eighth was cut off before it was looked up, so the first answer was marked instead; a correct-answer list naming the same answer twice (such as [1, 0, 1, 0] or ["B", 1]) was silently merged. Such questions are now skipped with the reason, as are questions with more than 50 answers and correct-answer lists longer than the question's answers.
• An unknown question type failed the whole pool. In occ learning:import-pool-json and the pool import, the dry run counted a type such as multiple_choice_extended as importable, then the real import refused the entire pool, valid questions included. Only single, multi, open and pbq are accepted now (any letter case; true_false reads as single, the historical multiple as multi). Any other type skips that one question with the reason, in the dry run, the import and the question import of the interface. Creating or editing a question refuses an unknown type; a question that already carries one can still be saved unchanged.
• Out-of-range values. A difficulty longer than 20 characters failed the whole import with a server error; it is now cut to 20 characters. A chapter_order outside 1–9999 is dropped, in the interface and in occ alike. Answer texts over 2,000 characters are still cut, but the import report now warns. A CSV header row no longer counts towards the 500-question limit.
• _meta.default_question_type: "pbq" no longer turns a question with several correct answers into an interactive question. Interactive questions accept text, question and frage as the question text, not only question_text.
• Import errors from the server are shown in the reader's language.

Changed

• The Manage tab follows the pool's edit rights. The pool's owner and users it was shared with as Can edit see it, also without the instructor role. Creating a pool still needs the instructor role.
• The student view is visible. While it is on, a banner on every page says so and offers Leave student view; a role that could not be loaded is reported instead of silently showing the learner view.
• The import shows a preview, for JSON and CSV, of how many questions can be imported, and why the others cannot, before anything is saved.
• occ learning:import-pool-json reads an export directly: a plain question list, or {"name", "description", "_meta", "questions"}, becomes one new pool, named by the new option --pool-name, else by the file's name, else by the file name. The command now also imports PBQs, and a question's own chapter wins over the pool's.
• Manual and import guide describe who sees Manage, all accepted import formats and the round trip export → import.

Added

• Import pools in the Pools tab. Instructors can import a JSON file with one or more pools (the format of occ learning:import-pool-json, also a plain question list or an export, which becomes one pool named after the file) in one step, each pool owned by them. A preview from a server-side dry run lists every pool with how many questions can be imported and why the others cannot, before anything is saved. Each pool is saved on its own: a refused question is skipped, a pool that cannot be saved is rolled back completely, and the other pools stay. Up to 50 pools and 5,000 questions per file, with the same file-size setting and rate limit as the question import. New endpoint POST /api/pools/import (instructors only, dry_run for the check run).
• occ learning:import-pool-json and the new import share one implementation, so a file gives the same pools either way. The occ dry run now checks every question and lists the ones that would be skipped, and a pool that cannot be saved is rolled back as a whole, with the technical reason written to the Nextcloud log instead of the output.

Fixed

• "DevCloud" no longer appears in the interface. The name of the author's own server was hard-coded in the onboarding ("Welcome to DevCloud!"), the imprint and privacy pages, the personal settings and the VirtuProf privacy hint, in all six languages. The texts are neutral now ("this server", "the learning platform"); the PWA guide no longer names a fixed server address.
• The streak and user state failed on SQLite (/api/v1/user/state answered 500): the query used MySQL's FROM_UNIXTIME. SQLite now uses its own date function. PostgreSQL and MariaDB were not affected.
• Audit checkpoint anchoring had a default host. Without a configured Forgejo URL it fell back to the author's server. It now skips the anchor instead. Anchoring stays off by default.

Changed

• Notifications (toasts) come from @nextcloud/dialogs 8: accessible, and shown at the bottom start of the page.
• Development tooling: PHPStan 2, PHPUnit 13 (tests only; the app still runs on PHP 8.1+).

The AI features (VirtuProf, weekly study note, learning plan, course narrative, story narrator, pool generator) work as before, with Gemini or a local Ollama server. What changed is how consent works and how a request leaves the server. No new AI providers yet; they follow later.

Changed

• Consent names the recipient. A learner's consent now covers the current consent text and the AI recipient the admin has configured (Gemini or a named Ollama server). If the admin switches the recipient or the consent text changes, each learner is asked once more before anything is sent; the dialog says what changed. After the upgrade every learner who used AI sees the dialog once, headed "revised".
• One way out. Every AI request goes through a single gateway. Right before sending it checks again that AI is switched on, that the learner's consent still holds for this exact recipient and that the limits allow it. Consent revoked or recipient changed in the meantime: nothing is sent, also not by the weekly job that may already be running.
• Real revocation. Learners can withdraw consent in their settings. It takes effect at once.
• Limits per learner (10 requests a minute, 100 a day, 3 at the same time) and a daily total for the server, counted in the database so parallel requests cannot slip past them.

Added

• Accessible consent dialog in all six languages, with keyboard focus kept inside the dialog and right-to-left layout for Arabic. It is the only place where consent is written.
• Connection test for admins: sends one fixed test message to Gemini or Ollama, nothing from any learner.
• Data export lists the AI consent and the stored chat summaries. The public privacy page names the configured recipient.

Security and privacy

• The Gemini key is stored encrypted; the upgrade moves an existing plain-text key over.
• Requests go only to the configured address: no redirects, no automatic retries, the address is resolved once and pinned. Link-local addresses (such as the cloud metadata address 169.254.169.254) are refused for every provider, also for an Ollama server in the local network.
• Frontend dependencies updated for known vulnerabilities (Vue, axios, DOMPurify via @nextcloud/vue, PostCSS, nanoid, form-data, among others).
• Prompts, answers, keys and provider error texts no longer reach nextcloud.log or the audit table. The upgrade removes such content from older audit rows.
• Contributions of other learners are only put into a prompt when the recipient is a local server.
• Account deletion also removes the learner's AI limit counters.

Upgrade

• AI tasks left over from 5.5 are cleaned up; old task IDs report as expired. The upgrade stops with an error instead of continuing half done, and resumes after a crash.

Fixed

• An exported pool lost its multiple-choice and open questions when imported again. occ learning:export-pool writes the question type as type, but occ learning:import-pool-json only read question_type. Every question without that key was treated as single choice, so multiple-choice questions (more than one correct answer) and open questions (one model answer) were rejected and skipped with a warning. The command now reads question_type, type and typ, like the pool import in the interface. Without any type, several correct answers make the question multiple choice, as the import documentation always said.
• % and _ in a search word for course material matched too much. The keyword search behind the AI assistant's course material passed them to the database as wildcards, so a search for 50% also found 500. They are now matched as plain characters, like in every other search of the app.

Added

• Scenario / info text before a question (Codeberg #10). Every question has a new optional field "Scenario / info" for the case, situation or background a learner should read before answering. It is shown above the question in training, exam and exam review, Leitner, the smart queue, the daily challenge, duel, gameshow and adventure skill checks, and in the question list of the pool. It is plain text with line breaks kept, up to 10 000 characters, and it can be translated together with the question. Because questions are shuffled in every mode, the scenario belongs to the question it introduces: for a case with several questions, give each of them the same scenario.
• JSON import reads the scenario from scenario (also szenario, context or info), JSON export writes it, and occ learning:import-pool-json accepts scenario per question. A scenario longer than 10 000 characters is never cut off: the import skips that question and names it in the error list. CSV import and export keep their fixed columns.

Fixed

• An existing question with two answers could not be saved. The edit form adds empty answer slots up to four, and all of them were mandatory, so the browser refused to save until they were filled or removed. Only the first two answers are mandatory now; empty slots are dropped on save as before.

Fixed

• Passing a course and issuing certificates failed on fresh installs. Every compliance event is chained to the one before it, and the chain starts from a first entry that the database update was supposed to create. Nextcloud skips that part of an update when an app is installed for the first time, so on every fresh install since 5.2 the chain had no start: "course passed", issuing or revoking a certificate and completing a mandatory training ended with a server error. The first entry is now created on install and on update. Where the chain already holds entries but its start record is missing, nothing is created automatically, because a new start would hide the gap; the admin log says so instead.
• Question translations did not work on fresh installs. The translation tables were renamed in 3.5, but the rename also ran only on updates, so fresh installs kept the old names and every translated question failed to load. The tables are now created where they are missing.

Instances that were updated from an older version, rather than installed fresh, were not affected.

Security

• The weekly study note was sent to the AI provider without consent. A background job runs once a week for everyone who studied in the last 60 days. It sent their weakest topic and the questions they got wrong to the configured AI provider to write a summary note, and it never checked whether the learner had agreed to AI processing. It now skips anyone without valid consent before reading their learning data, and the note generator refuses on its own so no other path can bypass it. This only affected instances with AI enabled.
• Outdated consent counted as consent. The server accepted any stored consent version; only the VirtuProf chat window compared it with the current consent text. The server now requires the current version on every AI path, and the VirtuProf chat and the course summary narrative no longer use their own weaker check. The course summary narrative is also rate limited now.
• A failed consent save was treated as consent. If saving the consent failed, VirtuProf closed the dialog and sent the waiting message anyway, although the server had no consent on record. The dialog now stays open with an error message and nothing is sent until the save succeeds.
• Follow-up requests are checked too. Chat-memory compression and the pool generator send further requests after the first one; each now checks consent right before sending. If the server reports missing consent, VirtuProf asks again instead of showing a generic error.

A larger rework of AI consent follows in 5.6.0: consent will name the actual AI provider, the consent text will describe exactly what is sent, and everyone will be asked once to confirm the corrected text.

Fixed

• The app icon stood out in the app menu. Learning used a coloured icon where Nextcloud expects the same monochrome glyph as every other app. The coloured logo is still used on certificates when the instance has no logo of its own.

Fixed

• Tool selections were saved but never applied. Reported again on #7 after 5.4.6: "regardless of the selection, all tools remain visible". 5.4.6 fixed the settings form, but nothing read the setting where tools actually appear. The course's learning space ignored the admin's global selection entirely, and an empty course selection ("every tool off") was read as "no selection" and showed all eight. Both levels now apply: the admin's selection, narrowed by the course's. With nothing left, the Tools tab disappears, and the dashboard drops its tools link when the admin has switched every tool off. After saving in the course administration the learning space updates without a reload. The unit tests for the learning space had carried their own copy of the old logic instead of calling the component, which is why they stayed green; they now test the component, and a rendering test counts the tools a learner sees. Verified in a browser on Nextcloud 33.0.9 with MariaDB 10.11, before and after.
• The pool rules dialog showed every pool as required. The server sends the flag as 0/1, and the dialog read 0 as "required", so the checkbox was ticked for supplementary pools too — and saving any other rule in that dialog marked the pool required again. Found while adding the option below, which depends on that flag being right.

Added

• Practice exams from required pools only. Follow-up on #9: a course may hold supplementary pools for self-study that should stay out of the exam simulation. The practice exam settings have a new option, Use required pools only, which draws questions only from pools marked Required in the pool rules. If the option is on but no pool is marked, instructors see a warning in the settings and learners get a clear message instead of "no questions". Tested on a fresh install and on upgrades from 5.5.0, on MariaDB 10.11 and PostgreSQL 16.

Requested on #9 by a team preparing aviation radio courses: until now the exam mode assumed an IT certification.

Added

• Practice exams per course. Requested on #9 for training outside IT certification: the exam mode only knew the fixed CompTIA presets (90 questions/90 minutes and 45/45, pass at 720/900). Instructors can now offer a practice exam in a course's Administration tab and set the number of questions, a time limit or none, and the pass mark in percent. Learners start it themselves from its own tab — no pool to pick first — and every attempt draws a fresh random set from all of the course's pools. Afterwards they get a review with the explanations. The CompTIA presets stay as they were; the practice exam tab shows even where the preset exam is switched off.

Practice exams never count towards a certificate: they are marked separately, and the pass evaluation reads only the other exams. For the same reason they are left out of the locks that keep an exam from being used as an answer key — an untimed one left open would otherwise block training and explanations on its pools indefinitely. The reverse direction is guarded: while a certificate-relevant exam runs in the course, a practice exam cannot start, and an old one withholds its review.

The pass verdict is decided on the server against the threshold stored when the attempt began, in integer arithmetic (74.6 % does not pass 75 %), so a later change by the instructor does not rewrite past attempts. Tested on fresh installs and on upgrades from 5.4.6, on MariaDB 10.11 and PostgreSQL 16.

Both reports came from the same install on Hetzner Storage Share: no shell, no occ, and MariaDB. #7 found a course view that failed and tool selectors that never showed their state; #8 found a false audit alarm and a certificate setup that required a command the host does not offer.

Added

• Certificates can be activated from the admin page. Signed certificates need an issuer signing key, and until now the only way to create it was occ learning:cert:init-issuer — unreachable on managed hosting without shell access, where certificates could therefore never be enabled. Reported on #8 from Hetzner Storage Share. The certificates notice now has a Generate signing key button.

It only ever creates the first key: if one exists it refuses with 409, because an existing key may already have signed certificates. Rotation stays occ-only. Creation runs under an exclusive lock, so a double-click cannot leave two active keys — a guard the occ path now shares.

Fixed

• "Checkpoint overdue" on installs with nothing to checkpoint. Reported on #8: the warning appeared next to "No checkpoint yet" and "Events since last checkpoint: 0". Overdue was measured from the last checkpoint, and a missing one counts as timestamp 0, so every fresh install was overdue from the start. The same false alarm followed every quiet week, because the weekly job deliberately skips when no new audit events exist. Overdue now means an audit event has waited more than 8 days for a checkpoint — which still catches a job that is not running.

The warning also pointed to occ learning:audit:verify, which checks the chain but creates no checkpoint. It now names the actual cause: a missing signing key (checkpoints are signed with it), or background jobs that are not running. - Tool selections appeared not to save. The selectors bound :model-value on native <input type="checkbox"> elements, which have no such prop — Vue rendered it as an inert attribute, so the boxes never showed the stored state. Every tool looked unchecked, clicking an already-enabled one changed nothing, and saving wrote all eight back. Reported on #7; four occurrences fixed. - Fresh installs never received three course tables. Version009900 does its work in postSchemaChange(), but a fresh install executes only changeSchema() and then records every migration as done — so it never ran and could never be revisited. Version010100 creates the tables in changeSchema() and copies any legacy rows afterwards. This is the likely reason a course view failed on the reporter's install, and why reinstalling the app reproduced the problem instead of fixing it. - The certification toggle always saved the previous value. It listened for @update:checked, which @nextcloud/vue 9 components no longer emit. - The active exam slot never displayed. The view read res.data.slot; the controller returns exam_slot. - Two buttons missed by 5.4.5. Both passed a styling value through a dynamic :type binding, which the new guard did not yet check. It now covers dynamic bindings too. - A missing database table no longer takes down an entire course view. Reported on #7 from an install on managed hosting, where oc_learning_course_curriculum_scopes did not exist. That table comes from a rename migration (Version009900) which deliberately aborts rather than creating an empty table over existing data — so an install can legitimately end up without it, and the app treated that as fatal. Curriculum scoping, paused-question overrides and announcements now fall back to "nothing configured" and log a warning naming the migration and the occ command that repairs it.

Writes are deliberately left throwing: reporting success for a save that stored nothing is the worse failure, and the caller has to be able to tell the user it failed.

The "is this table missing" check moved into Db\DbErrors rather than being copied — UninstallCommand has needed the same predicate since v5.3.0. It stays narrow on purpose: anything not positively identified as a missing table is rethrown, so a genuine database outage cannot turn into silently empty results.

This limits the damage. Why the table was absent is the "three course tables" entry above.

Reported in #7 by an external user on macOS, reproducible in both Safari and Chrome. The report was precise and its diagnosis correct — it just described one button out of 244.

Fixed

• "Upload image" saved the question before a file was picked. The Vue 3 migration (380dd9a, 2026-04-03) moved the app from @nextcloud/vue 8 to 9, which swapped the meaning of two NcButton props: styling moved from type to variant, and type became the native <button type> attribute. native-type was dropped entirely. The v8 spelling was never migrated, so every button passed a styling value such as "secondary" to the native attribute — and HTML's invalid-value-default turns an unknown button type into submit. Inside a <form>, every one of those buttons submitted.
• "Cancel" in the question editor saved the question instead of discarding it. Same cause (type="tertiary"), not in the report, arguably worse than the reported symptom.
• The three save buttons only worked by accident. They carried type="primary" plus a native-type="submit" that v9 ignores; they submitted because the styling value was invalid, not because they asked to. They now say type="submit" explicitly.
• All 244 NcButton instances were migrated to variant (the 222 outside forms were a visual-only defect: with variant never set, every button in the app had been rendering in the default secondary style for 5.5 months).

Added

• tests/unit/NcButtonTypeProp.test.js — pins the v9 prop contract against a real NcButton render, and scans every .vue file so the v8 spelling cannot return. The four existing gates could not see this class of defect: it is valid Vue, valid JS and valid HTML.
• tests/unit/QuestionFormSubmit.test.js — mounts the real form with real buttons and clicks them, asserting which ones reach a submit. Reverting the fix turns it red, on the submit count rather than on an attribute. Note the precondition the report already implied with "open an existing question for editing": while the required fields are empty, constraint validation suppresses submission on its own and hides the defect entirely.

Reported in #6 by the administrator piloting Learning in Vinnytsia. Two of the three questions turned out to describe real defects rather than gaps in understanding.

Fixed

• The assistant rendered German text inside a Ukrainian interface. VirtuProf does not translate through Nextcloud's t(); it resolves against its own bundled catalogue, and 161 of its 343 reachable strings had drifted out of that catalogue — including every FAQ answer body. translateVirtuProf() then fell back to the raw source string, which is German for most of them. 63 of the 161 were already translated in l10n/uk.json and simply never made it into the catalogue; the remaining 105 are new and now exist in all six languages.
• The AI assistant was told to answer Ukrainian and French users in English. The system prompt's language map only knew German, English, Russian and Arabic, so anything else produced the instruction "If unsure, default to English". It now covers all six languages.
• The assistant ignored the Nextcloud interface language. It derived the response language from the opt-in content-language setting alone, with a hard English fallback. It now falls back to the user's Nextcloud interface language, then the instance default.
• Choosing Arabic as content language did nothing. The dropdown has offered it for months and the request sent it, but the server's whitelist did not include ar, so the value was silently replaced with the empty string and the request still answered 200.
• "Create summary" wrote an English note for a Ukrainian user. NoteGeneratorService, which the assistant reaches through its file-intent path, carried its own copy of both the language lookup and the language-name map — and its copy was missing French and Ukrainian in exactly the same way. Both now come from one shared resolver.
• The assistant panel header rendered three empty strings. Its translate helper passed the key where the function expects the language, so the panel label was blank and both the minimise and close buttons had an empty accessible name — in every language, German included.

Added

• An instructor group setting in the administration page. Members of that Nextcloud group may create courses and question pools without Nextcloud administrator rights. The mechanism is not new — it has been learning-instructors all along — but nothing named it: the admin page referred to "the configured instructor group" without saying which, and the manual claimed the instructor role was per-course only, which is wrong for creating a course in the first place.
• The five textbook fields in the pool dialog now explain themselves. They are optional and only pay off when a pool mirrors one chapter of a book; the dialog says so, and each field describes what belongs in it.
• A fifth i18n gate (scripts/gen-virtuprof-strings.mjs --check). The VirtuProf catalogue is now generated from l10n/*.json rather than hand-maintained, and the gate fails when the two disagree or when a reachable assistant string exists in no language file. Verified: removing a VirtuProf key from all six language files leaves gates 1–4 green and turns this one red. The catalogue grew from 252 to 429 keys and lost none — keys reached through vt(<expression>), which no literal scan can resolve, are carried forward until they leave l10n/de.json. --list-indirect names the 22 call sites this protects.

Documentation

• New manual section 2.3 on letting teachers create courses and pools, a corrected role description in section 1, a field-by-field table with a worked example for the pool dialog in 3.1, and two new troubleshooting entries.

Internal

• deploy-prod.sh --stage-gate now copies appinfo/ into the analysis copy. Without it ClassResolutionTest — the regression test written after the AIController/AiController outage — errored out instead of running.

Found by clicking through the 5.4.2 deployment: the wizard's "Skip" button sat at top: 16px, directly underneath the Nextcloud header, whose avatar button swallowed every click. The splash screen carries its own skip link at the bottom, so the first step looked fine — but from step two onwards there was no reachable way out of the introduction at all.

This is not new in 5.4.2; it has been there as long as the redesigned wizard. It is the sharper half of what #5 describes: users could not get rid of the introduction even when they tried.

Fixed

• The wizard's skip button clears the Nextcloud header and can actually be clicked from every step. Verified in the browser: a click on the button's own centre used to be delivered to the header's avatar.

Added

• Two browser tests that would have caught this: one walks a new account through the introduction and asserts it stays gone after clearing site data, the other asserts the skip button — not the header — receives a click aimed at it.

Reported by the same administrator piloting Learning in Vinnytsia (#5): the help wizard reappeared for users who had already been through it, and its introductory questions ("How many bits are in one byte?") were beside the point for staff in occupational safety or HR.

The reappearance turned out to be three separate defects, not a missing setting.

Fixed

• The assistant's introduction never honoured "no thanks". It read that setting from a response which does not contain it — /api/profile/telos/status returns the completion flag and nothing else — so the check was always false and the introduction started again on every single page load. The setting had been saved correctly the whole time.
• Whether the wizard had been seen lived in browser storage alone. That is scoped to one browser on one machine, so a second computer, a different browser, a private window or cleared site data all brought it back. The server is authoritative now; browser storage remains only as an offline fallback.
• Skipping the wizard recorded nothing on the server. It counts as a decision now, like completing it.
• Instructors were shown two introductions in a row — the wizard, and the slide tour the moment it closed. One introduction, one decision.
• Existing users are marked as done during the upgrade, so the update itself does not send a whole instance back through the introduction.

Changed

• Instructors now see the full nine-slide tour inside the wizard. It used to follow the wizard as a second, separate introduction; folding it in keeps the content while removing the duplication. OnboardingIntro is unreachable for now and becomes the voluntary tour in 5.5.0.
• Declining the assistant's introduction now puts the assistant in its reduced mode instead of leaving it in an undetermined state.

The introductory content itself is being reworked for 5.5.0.

Reported by the same administrator piloting Learning in Vinnytsia (#4): one error and one warning in the Nextcloud log. The warning was what it looked like. The error was the visible edge of a defect that had been silently discarding onboarding results since v4.2.0 (4 April 2026) — seventeen releases.

Fixed

• The onboarding wizard could not save a profile, and lost two more things while failing. OnboardingRedesign.vue built its own request body instead of using the shared payload builder, and posted '' for the list fields where every other caller posts an array. TelosController::saveTelos() declared those parameters ?array, so PHP raised a TypeError inside Nextcloud's Dispatcher — before the controller body ran, which is why the controller's own try/catch never saw it and the user got a bare 500.

The damage was three times the reported symptom, because finalize() ran three steps inside one try with an empty catch: 1. the learning profile was never stored — onboarding_completed stayed false, so VirtuProf kept asking for a profile the user had already filled in; 2. the AI consent was never stored, even for users who explicitly opted in. Since the universal consent gate in v5.2.1, that locks every AI feature behind consent_required for them; 3. the selected starter pool was never imported — the wizard offers a pool, the user picks one, and nothing arrives.

None of it was logged. Three fixes, at three different levels: - OnboardingRedesign.vue now builds its payload with createTelosForm() / buildTelosPayload() — the same util PersonalSettings.vue and VirtuProf.vue use, so there is one payload shape in the app instead of two that can drift apart again. - finalize() settles each step independently and logs a failure to the console instead of swallowing it, so one failing step can never cancel the other two. - saveTelos() / updateTelos() accept array|string|null for the list fields and split a string on the same separators as the frontend (, ; newline). A malformed telos payload now answers 400 instead of raising an uncatchable dispatcher TypeError.

No migration is needed and no data was corrupted — nothing was written, rather than something wrong being written. Affected users recover on their own: the profile can be filled in under Settings → Personal or through VirtuProf, the consent dialog reappears when an AI feature is used, and a starter pool can be imported from the pool list.

• Activity\Provider::parse() threw the deprecated \InvalidArgumentException. Nextcloud replaced that contract with \OCP\Activity\Exceptions\UnknownActivityException in NC 30; until then every activity-stream load logged a deprecation warning, and from NC 39 it will be logged as an error. Both throw sites migrated.

Notification\Notifier had already been moved to UnknownNotificationException — the same NC 30 cohort — and this provider was simply missed. Each throw site now has a test, so the pair cannot drift apart again.

Tests

• tests/Unit/Activity/ProviderTest.php (new), tests/unit/onboardingTelosPayload.test.js (new, covering both the payload shape and the step isolation in finalize()), and seven cases added to tests/Unit/Controller/TelosControllerTest.php.
• Every one of them was verified to fail against the pre-fix code before being kept — the controller cases reproduce the reporter's exact TypeError, and the finalize() case fails with expected [ 'telos' ] to deeply equal [ 'telos', 'consent', 'pool' ].
• tests/Support/PhpUnitStubs.php gained OCP\Activity\IEvent, IProvider and UnknownActivityException; the PHPUnit bootstrap deliberately does not load Composer's autoloader, so OCP types live there.

Also fixed — found by auditing for the same bug class

Codeberg #4 was one instance of a pattern: a frontend that posts a body the controller does not read. Nextcloud's dispatcher does not reject unknown keys and fills the missing parameter with its default, so the request succeeds and the app quietly does the wrong thing. PHPStan cannot see across the HTTP boundary and service tests start after it, so nothing caught these. An adversarial audit of every such call site turned up four more.

• Saving a course schedule deleted it. CourseController::setSchedule() takes entries; the curriculum tab sent schedule. $entries stayed at its [] default, and ScheduleService reads that as "replace the schedule with nothing" — it deleted every row, inserted none, and answered 200, which the UI reported as saved. An instructor editing a curriculum schedule lost it, with a success message.
• Reported questions lost their identity. SupportTicketController::create() reads questionId/poolId/courseId out of context; VirtuProf's "report this question" sent them at the top level, so the ticket's structured columns were stored as NULL and the question was identifiable only through the subject line. The same component already built the correct shape for its other ticket call.
• "Explain the question I just got wrong" did not load that question. The chat request sent questionId; the controller declares lastWrongQuestionId. The value was dropped, so the retrieval context never included it. The richer questionContext usually masked the defect.
• Two icon URLs were relative where Nextcloud requires absolute — Activity\Provider::setIcon() and Dashboard\LearningWidget::getIconUrl() (whose interface says so explicitly). Desktop and mobile clients do not share the web root, so those icons did not render there. Notification\Notifier had already been doing this correctly.

Each of these is now pinned by a request-boundary test in tests/unit/requestPayloadContracts.test.js, verified to fail against the pre-fix components.

Also fixed — in the profile endpoint itself

• An emptied help-topics list was silently preserved. saveTelos() forwarded the list only when it was non-empty, so [] and '' both meant "omit" rather than "clear". Emptying the textarea and saving kept the old value — and since help topics are published to classmates through the classbook at course or public visibility, a user could not withdraw a topic once shared. An omitted field (null) still means "leave as is"; a supplied empty one now clears, matching what updateTelos() already did.
• A malformed updateTelos() payload could half-save. Skipping a non-array telos and carrying on meant {"telos": "oops", "bio": "changed"} stored the bio and answered 200 — a worse outcome than the TypeError it replaced. It is now rejected before any other field is touched.

Known limitations

• List values are not round-trip safe: a topic containing a comma, semicolon or newline is split on reload, because the frontend has always joined and split on those characters and there is no escaping scheme. The string path added above follows the same convention rather than introducing a second one.
• Users whose onboarding failed before this release keep a local "onboarding seen" flag while the server has no profile. They can fill the profile at any time, and the assistant prompts students who have it enabled, but there is no automatic reconciliation for instructors or for users with the assistant switched off.

Prompted by a report from a system administrator piloting Learning at a manufacturing company in Vinnytsia, Ukraine (#3), who raised two problems: parts of the interface appear only in English or German, and there is no manual. Both turned out to be real defects, and the first one was considerably larger than the report suggested.

Added

• Ukrainian interface language (uk) — the sixth language, complete at 2,940 keys in the main catalogue plus 252 in the VirtuProf runtime catalogue. Plural form is the three-form Slavic rule, not the two-form default.
• This is a first pass and has not been reviewed by a native speaker. It is labelled as such in the manual, with instructions for submitting corrections without touching code.
• docs/MANUAL.md — a user and administrator manual covering the chain the reporter asked for: course → learning materials → pool → questions → students → test attempt → results → completion, plus admin setup, the occ commands, mandatory training and compliance, the AI consent model, and how to add or fix a translation.
• Linked from README.md and from a new <documentation> element in info.xml. That element was absent, so the App Store listing offered no documentation link at all — the direct reason the reporter could not find any.
• Two new i18n gates, both wired into check-i18n-parity.sh:
• scripts/check-i18n-coverage.py compares the source against the catalogue. Gates 1–3 all compare the language files against each other, so a string missing from all of them at once passes every one of them. Verified by reconstructing the defect: removing a key from all six files leaves gates 1–3 green and turns this one red. It covers JS/Vue t()/n(), PHP $l->t() and the indirect toolCatalog.js keys.
• scripts/check-i18n-placeholders.py asserts that every translated value carries the same placeholders ({n}, %1$s, …) as its German source, and that no value is written in the wrong script. With six languages and machine-assisted translation, a dropped placeholder became the likeliest remaining defect.

Fixed

• 635 interface strings were absent from the translation catalogue entirely. They were passed through t() but had no entry in de.json, so Nextcloud's l10n fell back to the source string and rendered them in German in every language, including English.
• 618 came from JS/Vue, 10 from PHP $l->t() calls (notification subjects, the legal notice and privacy links), and 7 from toolCatalog.js, which reaches t() through a variable and is invisible to any literal scan.
• The most-used casualties: the course materials tab almost in full, parts of course administration, and the answer-type selector in the question form — Einzelauswahl / Mehrfachauswahl / Freitext, the three options every author picks between when writing a question.
• All 635 are now in the catalogue and translated into all six languages.
• VirtuProf keeps its own 252-key runtime catalogue (src/l10n/virtuprof-strings.js) which is separate from l10n/*.json and was not covered by any gate. A language added to the main catalogue alone would leave the assistant speaking German or English. It now carries a uk dictionary, and virtuprof-i18n.js lists it.
• VirtuProf's backend language allow-list silently discarded valid choices. VirtuProfController::ALLOWED_INTERFACE_LANGUAGES did not contain fr, although the frontend has offered French all along; normalizeInterfaceLanguage() coerces anything unlisted to '' and returns no error, so a French user's choice was dropped without a trace. Both fr and uk are now listed, with a comment naming the three places that must stay in sync.
• scripts/deploy-prod.sh synced a hard-coded five-language list. A new language would have been generated, guarded and committed — and then never copied to the server. Now six, alongside l10n_js_sync.py and check-i18n-parity.sh.

Known limits

• Some strings still reach t() through variables that the coverage gate cannot enumerate (onboarding slide definitions, dashboard tiles, a few config objects). Run python3 scripts/check-i18n-coverage.py --list-indirect to see the remaining call sites. Those were not audited in this pass.
• The content language layer — optional parallel translations of question text, held in learning_q_translations / learning_a_translations — still accepts only de, en, ru, ar. Adding uk means a DB migration against a CHECK constraint and a re-test on both PostgreSQL and MariaDB, so it is deliberately out of scope here. It is not a blocker for Ukrainian use: questions authored directly in Ukrainian are stored and displayed unchanged, because the base question row has no language constraint.

Fixed

• Every AI endpoint returned HTTP 500 instead of working (#3). Nextcloud derives the controller class from the route name, so 'name' => 'ai#available' resolves to OCA\Learning\Controller\AiController. The file was named AIController.php and declared class AIController; because PSR-4 autoloading is case-sensitive, the class was never found and the App Framework threw QueryNotFoundException before the request reached any of our code. All five ai#* routes — available, generate, status, import and explain — have been broken this way since they were introduced in v2.7.0.
• Visible effect was mostly log noise: the callers in QuestionList.vue, LeitnerMode.vue and TrainingMode.vue swallow the failure and fall back to aiAvailable = false, so the AI buttons simply never appeared. Nothing was lost, but nothing worked either, and every page that asked wrote a stack trace to nextcloud.log.

• The class-resolution failure happens before the authentication middleware, which is why the endpoint answered 500 to anonymous callers where every healthy route answers 401. That difference is what pinned the diagnosis.

• Four SQL queries referenced columns that do not exist, each failing with SQLSTATE 42703 every time it ran. All four were invisible to PHPStan — the defect lives in a string — and each sat behind a catch (\Throwable) that turned the error into a 500 or an empty result.

• LernprofilService: c.name on learning_courses, which has title. In enrichPoolsWithCourseData this broke /api/profile/skill-map outright (since 2026-04-09); the identical mistake in the cheat-sheet query hit only users who actually had wrong answers to report, so it stayed hidden behind an empty-result early return on fresh accounts.
• RagContextService and CourseSummaryService: ua.user_id on learning_user_answers, which has no user column at all — the user hangs off the session. Both now join learning_sessions the way NoteGeneratorService already did. User weaknesses and trouble spots never loaded; they threw.
• CourseSummaryService additionally compared the boolean is_correct against the integer 1, a type error on PostgreSQL. It now tests the column directly, which is portable across PostgreSQL and MariaDB.
• NoteGeneratorService: chapter_ref on learning_pools, a column that never existed (the chapter columns are chapter_key / chapter_title / chapter_order). Every authorised POST /api/notes/generate died in this query, before reaching the model at all.
• RagContextService: name on learning_courses. This is the first query buildContext() runs once a course is set, and a shared catch aborted the whole build after it — so VirtuProf answered without any course context (no chunks, pool questions, Leitner stats or weaknesses) and without reporting an error.
• CourseSummaryService: winner_uid on learning_duel_sessions. That column only exists on the league tables; a duel's winner follows from the scores. This query is on the ordinary course-summary path, so it took summaries, snapshots, narratives and CSV exports down with it. Wins are now counted from the scores of finished duels — and so is the total, because a duel that is still waiting for an opponent or expired unplayed has no winner and would otherwise sit in the denominator of win_rate.
• FeedController reported no course names. It called getName() on the course entity, which only has getTitle(); the surrounding catch turned that into course_name: null for every feed item rather than an error.
• Skill map and cheat sheet exposed courses the user is not in. enrichPoolsWithCourseData accepted a user id and then ignored it, so it returned every course any accessible pool had been added to. An instructor can attach a pool that was merely edit-shared with them, which handed the pool's owner the id and title of a course they are not a member of. Both queries now apply the same membership test the rest of the service already used, and both order their results — a pool can belong to several courses and the mapping keeps the first row, which without an explicit order was whatever the database happened to return first.
• LernprofilController logged nothing when it failed. All five catch (\Throwable) blocks returned a 500 without touching the logger, which is why nextcloud.log held no trace of an endpoint that had been broken since April 2026. They now log the exception before returning.

Security

• Duels and gameshows could be started on any pool. DuelService::createDuel and GameshowService::createSession only checked pool access when a courseId was supplied, and both endpoints accept none — so two cooperating users could start a session on an arbitrary pool id and read its questions, its answer options, and after answering the correct answer id. TrainingService has always gated its equivalent path. Both now call the same check, which is made public on QuestionService rather than copied a sixth time. Verified live in both directions: a pool the caller cannot reach is refused, one they can reach still works.
• The Wissensturm category endpoint had the same hole from a different angle: it took any pool id as the chosen category and read a question from it. It is now authorised against the session — the pool the session was created with, or any pool of its course — rather than against the caller's own pool access, because players who join a session legitimately are not required to have access to its pool.
• POST /api/courses/{id}/summary/snapshot did not check course access. Every other endpoint in SummaryController passes through CourseService::findById() first; this one called the service directly, so any logged-in user could snapshot an arbitrary course id and read the result back through their own snapshot. It now applies the same gate and answers 403.

Added

• scripts/check-sql-columns.py — resolves every alias-qualified column reference in app/lib against the live database schema. It found all four SQL defects above in one run.
• ClassResolutionTest — walks both places where Nextcloud builds a class name from a string (appinfo/routes.php route names and the FQCNs in appinfo/info.xml) and asserts each one resolves to a file whose name matches exactly, plus that the file declares the class name the router will ask for. Neither PHPStan nor the controllers' own unit tests can catch this: those tests use the real class name, so they load and pass while HTTP is broken.

Changed

• .githooks/pre-push now runs PHPUnit and the SQL column check. Neither the PHP test suite nor any schema check ran in a mandatory gate before, which is the reason both classes of defect survived for months. Note that the versioned hook was not the active one — core.hooksPath pointed at a stale copy in .git/hooks.
• The API test for /api/profile/skill-map asserts 200 and a payload shape; it accepted 500 before, and so reported a hard SQL error as passing for four months.
• The API test for /api/ai/available asserts 200 and a boolean payload. It previously accepted 200 or 500, which is what let a total outage ship through 23 tagged releases over five months — the endpoint always answers 200 with {available:bool}, including when no API key is configured, so a 500 was never an acceptable outcome.

Added

• occ learning:uninstall — removes everything this app leaves in the database, so the app can be uninstalled cleanly (#1). Dry run by default; --execute is required to change anything.
• Drops all learning_* tables, including the legacy names from both historical rename waves, and clears the rows left in migrations, appconfig, preferences, jobs, notifications, activity and activity_mq.
• Deletes the metadata rows before dropping the tables. Leaving the oc_migrations rows behind makes a later reinstall skip every migration and boot broken, so if a run dies between the two phases, this order leaves the recoverable state.
• Refuses to run when issuer/certificate data exists unless --keep-certificates or --drop-certificates is chosen: the Ed25519 issuer key is unrecoverable, and losing it makes every certificate ever issued permanently unverifiable.
• Refuses to run when any table cannot be read. An unreadable table is never mistaken for an empty one — every guess here is destructive.
• Reports rather than touches what it cannot safely change: the theming legal links (rewritten by Application::boot() on every request, so they can only be cleared after app:remove — the command prints the statement), the Dashboard layout row, and the files the app created under /Learning/ in users' homes.
• Tables carrying the learning_ prefix that this version does not know about are reported, not dropped.
• scripts/db-uninstall-probe.php — runs the real command against a throwaway MariaDB and PostgreSQL, covering platform behaviour no unit test or PostgreSQL-only dev instance can reach.

Fixed

• occ learning:import-pool-json no longer drops valid open questions. The pre-check demanded at least two answers for every question, which is right for multiple choice but wrong for open (fill-in) questions — those carry exactly one model answer and were skipped silently. The check now mirrors what QuestionService::create already enforced.

Changed

• The privacy and imprint pages name the operating company, with the registration details an imprint requires, instead of a private individual.

Notes

• No repair step is used for uninstall. Nextcloud executes <repair-steps><uninstall> from AppManager::disableApp(), so it also fires when an admin merely disables the app — a drop there would let one mis-click destroy every course, pool and certificate. The reasoning, including why a marker-armed variant was rejected, is recorded in UninstallCommand's class docblock.

A whole-app security audit (8 review lanes) followed by an adversarial multi-model pre-live review. Every finding was verified against the actual code before fixing; fixes shipping to the public App Store were themselves re-reviewed. No functional/feature changes — hardening only.

Security — Access control (IDOR)

• Course-scoped authorization on RAG import/list/delete/moderate endpoints (an instructor of course A could previously touch course B's shared RAG pool); course-membership gates on RAG contribution and on listing one's own contributions.
• Answer-key exports (CSV/JSON) require export-level access (owner, edit-share, or the instructor of a course the pool is attached to) — not plain read access; enrolled students can no longer pull answer keys.
• Course-access gates on document index/material-folder and course feed endpoints (previously cross-course content/PII could leak).

Security — Exam integrity (oracle prevention)

• During an active exam, explanations, correct answers, PBQ solution config and translated explanations are withheld across all surfaces that emit question-derived data (training/exam payloads, translation endpoints, the spaced-repetition due-queue, and VirtuProf's RAG + client-supplied question context).
• Starting an exam no longer auto-completes an existing exam by switching course context; correct PBQ answers now increment the exam score even when per-question feedback is suppressed.

Security — AI / GDPR

• Per-user AI consent is now enforced on every user-triggered LLM path (VirtuProf chat/interview, course summary, AI question generation, note generation, AI explanations) — the admin ai_enabled toggle alone is no longer sufficient. The frontend catches the consent-required response and points the user to the in-app consent dialog.
• Stored chat memory is NFKC-normalized and injection-filtered before re-entering the system prompt (a payload stripped on turn 1 could previously reappear on turn 2); the injection sanitizer now covers the same role-change / prompt-leak / jailbreak markers as the detector.
• File-intent note generation and chat-memory compression now count against the shared AI rate limit.

Security — Data-layer robustness

• Repair migration for course-feature table-name drift (curriculum scopes, question overrides, announcements) — cross-DB safe (PostgreSQL 16 / MariaDB / SQLite), identifier-quoted, fail-fast on platform-detection error, and it aborts rather than orphaning legacy data if a rename fails.
• Prefix-agnostic insert ids (exam slots, announcements) instead of a hardcoded oc_ sequence name; entity model aligned with the shipped schema.

Database

• Version009900: idempotent, data-preserving repair of legacy learning_curriculum_scopes / learning_q_overrides / learning_announcements → learning_course_*. Verified on PostgreSQL 16.

Versions 4.4.8 and 4.4.9 were internal migration-vehicle bumps and were never released; this entry covers everything since 4.4.7.

Added

• Signed completion certificates. A course can define pass criteria (score threshold, validity period). When a learner passes, the app mints a cryptographically signed certificate — a W3C Verifiable Credential (Ed25519 / VC-JWT) bound to the learner and the course.
• did:web issuer identity. Each instance is its own credential issuer via a path-based did:web derived from the server URL; the public key is published at the app's did.json. Issuer keys are generated with occ learning:cert:init-issuer, stored encrypted at rest (ICrypto), and can be rotated without invalidating previously issued certificates.
• Public verification portal. Anyone can verify a certificate by its ID / QR code on a public page. Signature, key status, claim binding, revocation and expiry are checked as an AND-chain; unknown IDs leak no personal data. Course owners can revoke certificates.
• Compliance report. Per-course completion/compliance report for instructors and admins (who passed, when, certificate status).
• Certificate view. A printable, A4-ready certificate with QR code, a prominent Certificate ID and a verification link.

Changed

• Avatars overhauled. The default assistant Nova is now a full chibi character with emotion-aware expressions (neutral / happy / sad / surprised / sleep / celebrate) instead of an abstract shape. The three scholar skins (Theoretiker / Kosmologe / Astrophysik-Popularisierer) were polished — gradient shading, larger eyes, brighter signature accents.

Setup

• Certificates need a one-time key. Run occ learning:cert:init-issuer once per server to generate the issuer signing key. Until it exists, the admin settings page shows a reminder and no certificate is minted when a learner passes. See README → Installation → Certificates setup.

Database

• Version009100 creates learning_cert_keys and learning_certificates; Version009200 adds revoked_at. Verified on PostgreSQL 16 and MariaDB (the credential_json / secret_key_enc TEXT columns are intentionally unindexed to avoid the utf8mb4 key-length limit).

Fixed

• learning_user_stats had no primary key (#24). Reported by @haecks on a fresh NC 33.0.5 install: Nextcloud logged "Table 'oc_learning_user_stats' has no primary key and therefore will not behave sane in clustered setups. This will throw an exception and not be installable in a future version of Nextcloud." The table was created back in Version001200 with only a unique index (learn_ustats_user_uniq) on user_id, never a primary key. Since there is exactly one stats row per user and every access path addresses the table by user_id, user_id is the natural primary key. A new migration (Version008000) drops the now-redundant unique index and promotes user_id to the primary key. The migration is idempotent (guards for missing table/column and an already-present primary key) so it is safe on existing installs and re-runs. Verified live on PostgreSQL 16 and independently on MariaDB 11.4 with utf8mb4 (the varchar(64) key stays well under InnoDB's index-length limit).

Fixed

• v4.4.5 shipped without the data/ directory (starter pools, campaigns, simulator scenarios, privacy-info.json, PWA guide, course materials — 77 files). The release build followed a cp file-list that omitted data/, so on a clean v4.4.5 install the "Add starter pool" feature, campaigns, the practicum/simulator scenarios and the privacy page had no backing data. v4.4.6 restores data/ (verified: tarball file-set now matches the last-known-good v4.4.4 manifest). The i18n content of v4.4.5 (#21 + #19) is unchanged and included.

Administrators, please act after the update: enter your operator details. The imprint and privacy pages no longer name a fixed operator. Enter name, postal address and contact email under Administration settings → Learning → Operator details (imprint and privacy notice). Until you do, both pages show a neutral note instead of an operator, and Learning no longer sets the Nextcloud imprint and privacy links (Theming). Links that already point to Learning's pages are kept and lead to that note until the details are entered.

Fixes from a full code audit of the app.

Security

• Learners no longer receive the answer key with the questions. Correct-answer flags, explanations and interactive (PBQ) solutions in question lists, search results and translations now go only to the pool's owner, users it was shared with as Can edit, and the course's instructors. Learners and read-only shares no longer get them. Practice modes (training, spaced repetition, bot games) still show the correct answer after each answer, as before.
• Exams no longer leak solutions through side paths. During a graded exam the question APIs withhold the solution of every PBQ type, including the grading data of command-line and multi-panel PBQs, and the cheat sheet leaves out pools with an open graded exam.
• Adventure skill checks only use questions the player may see. They draw only from published pools the player has access to, accept only the questions they offered, and neither draw from nor reveal answers for a pool with a running graded exam.
• Duel and Gameshow accept only answers to the current question, and the Gameshow sprint time bonus is measured on the server clock and capped at 500 points.
• Course archiving and reading archive snapshots are limited to the course's instructors and Nextcloud administrators.
• CSV exports of at-risk learners and the class summary neutralise cell contents that a spreadsheet program would run as a formula.

Changed

• Operator details are an admin setting (see the note above). The imprint and privacy pages use only what the administrator entered.
• Bot mode in Duel and Gameshow grades your answer on the server, because the browser no longer knows the correct answer.
• Exams: answers that arrive with the automatic submission up to 30 seconds after the time limit are still accepted, and the exam submits itself 5 seconds before the end. Before, all answers of a timed-out exam could be lost (0 %).
• Gameshow: when the 15 seconds run out, a missing answer counts as wrong and the game moves on for everyone. Before, Sprint and Elimination could stop on a question nobody answered.
• Required Vimeo and YouTube videos report their progress. After the learner's consent the page loads the provider's player script, which tells Learning which parts were watched, so such a video can be completed and unlocks the course quiz. Before, it could never be completed. Nothing is loaded from the provider before consent; the privacy page lists the new category.
• The nightly XP consistency check never lowers XP or the level. It used to reset XP from single training questions, streak bonuses, Leitner reviews, missions, goals and Gameshows overnight. XP already lost this way cannot be restored.

Fixed

• Team lead dashboard: members with a valid certificate (without expiry or expiring in more than 30 days) are no longer listed as missing; expired certificates show as expired, with a reminder button; the newest certificate counts. Due and expiry dates show as dates.
• Exam mode: Enter on a focused button or navigation dot activates it instead of skipping the question, and keeps its hotkey meaning after a mouse click; the next PBQ in an exam starts with its own empty answer; pool editors keep the solutions and their explanation translations during their own exam.
• Required videos from Nextcloud Files send only the newly watched seconds, so they can reach completion.
• Unified search works on PostgreSQL.
• Course material search (RAG) keeps Cyrillic, Arabic and accented keywords and keeps the text directly under a Markdown heading; a sub-heading directly under a heading names the chunk.
• Imports: pool_name is read as the pool's name; question type multiple_choice becomes single or multiple choice by the number of correct answers; the occ dry run counts only what the import would store.
• Adventure mode: skill-check questions work on MySQL/MariaDB; a new skill check starts with an empty answer batch; bot-correction scenes no longer list the correct option first.
• Games and leagues: a duel forfeit goes to the player who stayed; co-op players who were ready first leave the lobby when the game starts; ranking PBQs are scored in the spaced-repetition queue.
• Leitner: switching the language during a review keeps the queue and the current card.
• Course feed: "Load more" loads the next entries.
• Exam reminders find exam dates saved with a time.
• Maintenance mode can be switched by co-instructors.
• Material scan detects duplicates per course instead of across all courses.
• PBQ builder: applying an existing PBQ keeps the fields the builder does not edit.
• Navigation: a pool opened from a course keeps its course context; the app works when Nextcloud runs in a subdirectory or with index.php in its URLs.
• Calm display: the switch shows ON when animations are off, and the setting applies after every page load.
• Learning profile: the history trend reads sessions newest first.
• Onboarding: "Skip" on the Jumpstart screen declines the selected starter pool.
• VirtuProf: auto-read and chat scrolling react to new messages.
• AI errors of the note generator and the weekly plan are reported by cause (not configured, rate limit, temporarily unavailable) instead of a generic server error.
• Admin settings: an exam cooldown of 0 minutes is shown and saved as 0.
• Tools: the subnet trainer accepts IPv6 answers in any valid notation; the VLAN frame preview puts the 802.1Q tag after the source MAC.

Reported on GitHub #34 by a self-hosting administrator who could not find where questions are added and whose JSON file did not import.

Fixed

• Pasted JSON was read as CSV. Pasted text that is valid JSON now switches the import dialog to JSON by itself; broken JSON stays on the CSV tab with a note that quotes the JSON error. Uploaded files are read by their extension (.json/.csv) first, so a .csv starting with [Network] … no longer goes to the JSON reader.
• Many common JSON shapes were refused or crashed the import. The import now also reads answers as plain strings (options, choices) with the correct one named on the question (answer, correct, correct_index counting from 0, correct_number counting from 1, a letter or the answer text), the documented pool file with one pool, and numbers where text was expected. A marker that names no answer skips the question with the reason in the import report.
• The pool format lost its metadata in the interface. The pool's chapter fields, exam_key_prefix and the _meta defaults now apply to the questions in the order question > pool > _meta, the same rule as occ learning:import-pool-json.
• CSV with line breaks inside quoted fields (as spreadsheet programs write it) was torn apart. Quoted fields may now contain line breaks, the separator and "".
• An export did not come back complete. The JSON export now carries difficulty, chapter, handbook and exam key, and the subtype and configuration of interactive questions (PBQ), so it re-imports without losses through the interface or occ; ranking PBQs can now be imported. An exported multi question with one correct answer stays multiple choice. The CSV export (also the course statistics export) is plain RFC 4180 now, the format the import reads, so a backslash before a quote no longer breaks the re-import.
• An empty pool was a dead end. It now opens in Manage for everyone who may edit it, and Training offers Add questions.
• Wrong answers could be marked correct. A correct answer after the eighth was cut off before it was looked up, so the first answer was marked instead; a correct-answer list naming the same answer twice (such as [1, 0, 1, 0] or ["B", 1]) was silently merged. Such questions are now skipped with the reason, as are questions with more than 50 answers and correct-answer lists longer than the question's answers.
• An unknown question type failed the whole pool. In occ learning:import-pool-json and the pool import, the dry run counted a type such as multiple_choice_extended as importable, then the real import refused the entire pool, valid questions included. Only single, multi, open and pbq are accepted now (any letter case; true_false reads as single, the historical multiple as multi). Any other type skips that one question with the reason, in the dry run, the import and the question import of the interface. Creating or editing a question refuses an unknown type; a question that already carries one can still be saved unchanged.
• Out-of-range values. A difficulty longer than 20 characters failed the whole import with a server error; it is now cut to 20 characters. A chapter_order outside 1–9999 is dropped, in the interface and in occ alike. Answer texts over 2,000 characters are still cut, but the import report now warns. A CSV header row no longer counts towards the 500-question limit.
• _meta.default_question_type: "pbq" no longer turns a question with several correct answers into an interactive question. Interactive questions accept text, question and frage as the question text, not only question_text.
• Import errors from the server are shown in the reader's language.

Changed

• The Manage tab follows the pool's edit rights. The pool's owner and users it was shared with as Can edit see it, also without the instructor role. Creating a pool still needs the instructor role.
• The student view is visible. While it is on, a banner on every page says so and offers Leave student view; a role that could not be loaded is reported instead of silently showing the learner view.
• The import shows a preview, for JSON and CSV, of how many questions can be imported, and why the others cannot, before anything is saved.
• occ learning:import-pool-json reads an export directly: a plain question list, or {"name", "description", "_meta", "questions"}, becomes one new pool, named by the new option --pool-name, else by the file's name, else by the file name. The command now also imports PBQs, and a question's own chapter wins over the pool's.
• Manual and import guide describe who sees Manage, all accepted import formats and the round trip export → import.

Added

• Import pools in the Pools tab. Instructors can import a JSON file with one or more pools (the format of occ learning:import-pool-json, also a plain question list or an export, which becomes one pool named after the file) in one step, each pool owned by them. A preview from a server-side dry run lists every pool with how many questions can be imported and why the others cannot, before anything is saved. Each pool is saved on its own: a refused question is skipped, a pool that cannot be saved is rolled back completely, and the other pools stay. Up to 50 pools and 5,000 questions per file, with the same file-size setting and rate limit as the question import. New endpoint POST /api/pools/import (instructors only, dry_run for the check run).
• occ learning:import-pool-json and the new import share one implementation, so a file gives the same pools either way. The occ dry run now checks every question and lists the ones that would be skipped, and a pool that cannot be saved is rolled back as a whole, with the technical reason written to the Nextcloud log instead of the output.

Fixed

• "DevCloud" no longer appears in the interface. The name of the author's own server was hard-coded in the onboarding ("Welcome to DevCloud!"), the imprint and privacy pages, the personal settings and the VirtuProf privacy hint, in all six languages. The texts are neutral now ("this server", "the learning platform"); the PWA guide no longer names a fixed server address.
• The streak and user state failed on SQLite (/api/v1/user/state answered 500): the query used MySQL's FROM_UNIXTIME. SQLite now uses its own date function. PostgreSQL and MariaDB were not affected.
• Audit checkpoint anchoring had a default host. Without a configured Forgejo URL it fell back to the author's server. It now skips the anchor instead. Anchoring stays off by default.

Changed

• Notifications (toasts) come from @nextcloud/dialogs 8: accessible, and shown at the bottom start of the page.
• Development tooling: PHPStan 2, PHPUnit 13 (tests only; the app still runs on PHP 8.1+).

The AI features (VirtuProf, weekly study note, learning plan, course narrative, story narrator, pool generator) work as before, with Gemini or a local Ollama server. What changed is how consent works and how a request leaves the server. No new AI providers yet; they follow later.

Changed

• Consent names the recipient. A learner's consent now covers the current consent text and the AI recipient the admin has configured (Gemini or a named Ollama server). If the admin switches the recipient or the consent text changes, each learner is asked once more before anything is sent; the dialog says what changed. After the upgrade every learner who used AI sees the dialog once, headed "revised".
• One way out. Every AI request goes through a single gateway. Right before sending it checks again that AI is switched on, that the learner's consent still holds for this exact recipient and that the limits allow it. Consent revoked or recipient changed in the meantime: nothing is sent, also not by the weekly job that may already be running.
• Real revocation. Learners can withdraw consent in their settings. It takes effect at once.
• Limits per learner (10 requests a minute, 100 a day, 3 at the same time) and a daily total for the server, counted in the database so parallel requests cannot slip past them.

Added

• Accessible consent dialog in all six languages, with keyboard focus kept inside the dialog and right-to-left layout for Arabic. It is the only place where consent is written.
• Connection test for admins: sends one fixed test message to Gemini or Ollama, nothing from any learner.
• Data export lists the AI consent and the stored chat summaries. The public privacy page names the configured recipient.

Security and privacy

• The Gemini key is stored encrypted; the upgrade moves an existing plain-text key over.
• Requests go only to the configured address: no redirects, no automatic retries, the address is resolved once and pinned. Link-local addresses (such as the cloud metadata address 169.254.169.254) are refused for every provider, also for an Ollama server in the local network.
• Frontend dependencies updated for known vulnerabilities (Vue, axios, DOMPurify via @nextcloud/vue, PostCSS, nanoid, form-data, among others).
• Prompts, answers, keys and provider error texts no longer reach nextcloud.log or the audit table. The upgrade removes such content from older audit rows.
• Contributions of other learners are only put into a prompt when the recipient is a local server.
• Account deletion also removes the learner's AI limit counters.

Upgrade

• AI tasks left over from 5.5 are cleaned up; old task IDs report as expired. The upgrade stops with an error instead of continuing half done, and resumes after a crash.

Fixed

• An exported pool lost its multiple-choice and open questions when imported again. occ learning:export-pool writes the question type as type, but occ learning:import-pool-json only read question_type. Every question without that key was treated as single choice, so multiple-choice questions (more than one correct answer) and open questions (one model answer) were rejected and skipped with a warning. The command now reads question_type, type and typ, like the pool import in the interface. Without any type, several correct answers make the question multiple choice, as the import documentation always said.
• % and _ in a search word for course material matched too much. The keyword search behind the AI assistant's course material passed them to the database as wildcards, so a search for 50% also found 500. They are now matched as plain characters, like in every other search of the app.

Added

• Scenario / info text before a question (Codeberg #10). Every question has a new optional field "Scenario / info" for the case, situation or background a learner should read before answering. It is shown above the question in training, exam and exam review, Leitner, the smart queue, the daily challenge, duel, gameshow and adventure skill checks, and in the question list of the pool. It is plain text with line breaks kept, up to 10 000 characters, and it can be translated together with the question. Because questions are shuffled in every mode, the scenario belongs to the question it introduces: for a case with several questions, give each of them the same scenario.
• JSON import reads the scenario from scenario (also szenario, context or info), JSON export writes it, and occ learning:import-pool-json accepts scenario per question. A scenario longer than 10 000 characters is never cut off: the import skips that question and names it in the error list. CSV import and export keep their fixed columns.

Fixed

• An existing question with two answers could not be saved. The edit form adds empty answer slots up to four, and all of them were mandatory, so the browser refused to save until they were filled or removed. Only the first two answers are mandatory now; empty slots are dropped on save as before.

Fixed

• Passing a course and issuing certificates failed on fresh installs. Every compliance event is chained to the one before it, and the chain starts from a first entry that the database update was supposed to create. Nextcloud skips that part of an update when an app is installed for the first time, so on every fresh install since 5.2 the chain had no start: "course passed", issuing or revoking a certificate and completing a mandatory training ended with a server error. The first entry is now created on install and on update. Where the chain already holds entries but its start record is missing, nothing is created automatically, because a new start would hide the gap; the admin log says so instead.
• Question translations did not work on fresh installs. The translation tables were renamed in 3.5, but the rename also ran only on updates, so fresh installs kept the old names and every translated question failed to load. The tables are now created where they are missing.

Instances that were updated from an older version, rather than installed fresh, were not affected.

Security

• The weekly study note was sent to the AI provider without consent. A background job runs once a week for everyone who studied in the last 60 days. It sent their weakest topic and the questions they got wrong to the configured AI provider to write a summary note, and it never checked whether the learner had agreed to AI processing. It now skips anyone without valid consent before reading their learning data, and the note generator refuses on its own so no other path can bypass it. This only affected instances with AI enabled.
• Outdated consent counted as consent. The server accepted any stored consent version; only the VirtuProf chat window compared it with the current consent text. The server now requires the current version on every AI path, and the VirtuProf chat and the course summary narrative no longer use their own weaker check. The course summary narrative is also rate limited now.
• A failed consent save was treated as consent. If saving the consent failed, VirtuProf closed the dialog and sent the waiting message anyway, although the server had no consent on record. The dialog now stays open with an error message and nothing is sent until the save succeeds.
• Follow-up requests are checked too. Chat-memory compression and the pool generator send further requests after the first one; each now checks consent right before sending. If the server reports missing consent, VirtuProf asks again instead of showing a generic error.

A larger rework of AI consent follows in 5.6.0: consent will name the actual AI provider, the consent text will describe exactly what is sent, and everyone will be asked once to confirm the corrected text.

Fixed

• The app icon stood out in the app menu. Learning used a coloured icon where Nextcloud expects the same monochrome glyph as every other app. The coloured logo is still used on certificates when the instance has no logo of its own.

Fixed

• Tool selections were saved but never applied. Reported again on #7 after 5.4.6: "regardless of the selection, all tools remain visible". 5.4.6 fixed the settings form, but nothing read the setting where tools actually appear. The course's learning space ignored the admin's global selection entirely, and an empty course selection ("every tool off") was read as "no selection" and showed all eight. Both levels now apply: the admin's selection, narrowed by the course's. With nothing left, the Tools tab disappears, and the dashboard drops its tools link when the admin has switched every tool off. After saving in the course administration the learning space updates without a reload. The unit tests for the learning space had carried their own copy of the old logic instead of calling the component, which is why they stayed green; they now test the component, and a rendering test counts the tools a learner sees. Verified in a browser on Nextcloud 33.0.9 with MariaDB 10.11, before and after.
• The pool rules dialog showed every pool as required. The server sends the flag as 0/1, and the dialog read 0 as "required", so the checkbox was ticked for supplementary pools too — and saving any other rule in that dialog marked the pool required again. Found while adding the option below, which depends on that flag being right.

Added

• Practice exams from required pools only. Follow-up on #9: a course may hold supplementary pools for self-study that should stay out of the exam simulation. The practice exam settings have a new option, Use required pools only, which draws questions only from pools marked Required in the pool rules. If the option is on but no pool is marked, instructors see a warning in the settings and learners get a clear message instead of "no questions". Tested on a fresh install and on upgrades from 5.5.0, on MariaDB 10.11 and PostgreSQL 16.

Requested on #9 by a team preparing aviation radio courses: until now the exam mode assumed an IT certification.

Added

• Practice exams per course. Requested on #9 for training outside IT certification: the exam mode only knew the fixed CompTIA presets (90 questions/90 minutes and 45/45, pass at 720/900). Instructors can now offer a practice exam in a course's Administration tab and set the number of questions, a time limit or none, and the pass mark in percent. Learners start it themselves from its own tab — no pool to pick first — and every attempt draws a fresh random set from all of the course's pools. Afterwards they get a review with the explanations. The CompTIA presets stay as they were; the practice exam tab shows even where the preset exam is switched off.

Practice exams never count towards a certificate: they are marked separately, and the pass evaluation reads only the other exams. For the same reason they are left out of the locks that keep an exam from being used as an answer key — an untimed one left open would otherwise block training and explanations on its pools indefinitely. The reverse direction is guarded: while a certificate-relevant exam runs in the course, a practice exam cannot start, and an old one withholds its review.

The pass verdict is decided on the server against the threshold stored when the attempt began, in integer arithmetic (74.6 % does not pass 75 %), so a later change by the instructor does not rewrite past attempts. Tested on fresh installs and on upgrades from 5.4.6, on MariaDB 10.11 and PostgreSQL 16.

Both reports came from the same install on Hetzner Storage Share: no shell, no occ, and MariaDB. #7 found a course view that failed and tool selectors that never showed their state; #8 found a false audit alarm and a certificate setup that required a command the host does not offer.

Added

• Certificates can be activated from the admin page. Signed certificates need an issuer signing key, and until now the only way to create it was occ learning:cert:init-issuer — unreachable on managed hosting without shell access, where certificates could therefore never be enabled. Reported on #8 from Hetzner Storage Share. The certificates notice now has a Generate signing key button.

It only ever creates the first key: if one exists it refuses with 409, because an existing key may already have signed certificates. Rotation stays occ-only. Creation runs under an exclusive lock, so a double-click cannot leave two active keys — a guard the occ path now shares.

Fixed

• "Checkpoint overdue" on installs with nothing to checkpoint. Reported on #8: the warning appeared next to "No checkpoint yet" and "Events since last checkpoint: 0". Overdue was measured from the last checkpoint, and a missing one counts as timestamp 0, so every fresh install was overdue from the start. The same false alarm followed every quiet week, because the weekly job deliberately skips when no new audit events exist. Overdue now means an audit event has waited more than 8 days for a checkpoint — which still catches a job that is not running.

The warning also pointed to occ learning:audit:verify, which checks the chain but creates no checkpoint. It now names the actual cause: a missing signing key (checkpoints are signed with it), or background jobs that are not running. - Tool selections appeared not to save. The selectors bound :model-value on native <input type="checkbox"> elements, which have no such prop — Vue rendered it as an inert attribute, so the boxes never showed the stored state. Every tool looked unchecked, clicking an already-enabled one changed nothing, and saving wrote all eight back. Reported on #7; four occurrences fixed. - Fresh installs never received three course tables. Version009900 does its work in postSchemaChange(), but a fresh install executes only changeSchema() and then records every migration as done — so it never ran and could never be revisited. Version010100 creates the tables in changeSchema() and copies any legacy rows afterwards. This is the likely reason a course view failed on the reporter's install, and why reinstalling the app reproduced the problem instead of fixing it. - The certification toggle always saved the previous value. It listened for @update:checked, which @nextcloud/vue 9 components no longer emit. - The active exam slot never displayed. The view read res.data.slot; the controller returns exam_slot. - Two buttons missed by 5.4.5. Both passed a styling value through a dynamic :type binding, which the new guard did not yet check. It now covers dynamic bindings too. - A missing database table no longer takes down an entire course view. Reported on #7 from an install on managed hosting, where oc_learning_course_curriculum_scopes did not exist. That table comes from a rename migration (Version009900) which deliberately aborts rather than creating an empty table over existing data — so an install can legitimately end up without it, and the app treated that as fatal. Curriculum scoping, paused-question overrides and announcements now fall back to "nothing configured" and log a warning naming the migration and the occ command that repairs it.

Writes are deliberately left throwing: reporting success for a save that stored nothing is the worse failure, and the caller has to be able to tell the user it failed.

The "is this table missing" check moved into Db\DbErrors rather than being copied — UninstallCommand has needed the same predicate since v5.3.0. It stays narrow on purpose: anything not positively identified as a missing table is rethrown, so a genuine database outage cannot turn into silently empty results.

This limits the damage. Why the table was absent is the "three course tables" entry above.

Reported in #7 by an external user on macOS, reproducible in both Safari and Chrome. The report was precise and its diagnosis correct — it just described one button out of 244.

Fixed

• "Upload image" saved the question before a file was picked. The Vue 3 migration (380dd9a, 2026-04-03) moved the app from @nextcloud/vue 8 to 9, which swapped the meaning of two NcButton props: styling moved from type to variant, and type became the native <button type> attribute. native-type was dropped entirely. The v8 spelling was never migrated, so every button passed a styling value such as "secondary" to the native attribute — and HTML's invalid-value-default turns an unknown button type into submit. Inside a <form>, every one of those buttons submitted.
• "Cancel" in the question editor saved the question instead of discarding it. Same cause (type="tertiary"), not in the report, arguably worse than the reported symptom.
• The three save buttons only worked by accident. They carried type="primary" plus a native-type="submit" that v9 ignores; they submitted because the styling value was invalid, not because they asked to. They now say type="submit" explicitly.
• All 244 NcButton instances were migrated to variant (the 222 outside forms were a visual-only defect: with variant never set, every button in the app had been rendering in the default secondary style for 5.5 months).

Added

• tests/unit/NcButtonTypeProp.test.js — pins the v9 prop contract against a real NcButton render, and scans every .vue file so the v8 spelling cannot return. The four existing gates could not see this class of defect: it is valid Vue, valid JS and valid HTML.
• tests/unit/QuestionFormSubmit.test.js — mounts the real form with real buttons and clicks them, asserting which ones reach a submit. Reverting the fix turns it red, on the submit count rather than on an attribute. Note the precondition the report already implied with "open an existing question for editing": while the required fields are empty, constraint validation suppresses submission on its own and hides the defect entirely.

Reported in #6 by the administrator piloting Learning in Vinnytsia. Two of the three questions turned out to describe real defects rather than gaps in understanding.

Fixed

• The assistant rendered German text inside a Ukrainian interface. VirtuProf does not translate through Nextcloud's t(); it resolves against its own bundled catalogue, and 161 of its 343 reachable strings had drifted out of that catalogue — including every FAQ answer body. translateVirtuProf() then fell back to the raw source string, which is German for most of them. 63 of the 161 were already translated in l10n/uk.json and simply never made it into the catalogue; the remaining 105 are new and now exist in all six languages.
• The AI assistant was told to answer Ukrainian and French users in English. The system prompt's language map only knew German, English, Russian and Arabic, so anything else produced the instruction "If unsure, default to English". It now covers all six languages.
• The assistant ignored the Nextcloud interface language. It derived the response language from the opt-in content-language setting alone, with a hard English fallback. It now falls back to the user's Nextcloud interface language, then the instance default.
• Choosing Arabic as content language did nothing. The dropdown has offered it for months and the request sent it, but the server's whitelist did not include ar, so the value was silently replaced with the empty string and the request still answered 200.
• "Create summary" wrote an English note for a Ukrainian user. NoteGeneratorService, which the assistant reaches through its file-intent path, carried its own copy of both the language lookup and the language-name map — and its copy was missing French and Ukrainian in exactly the same way. Both now come from one shared resolver.
• The assistant panel header rendered three empty strings. Its translate helper passed the key where the function expects the language, so the panel label was blank and both the minimise and close buttons had an empty accessible name — in every language, German included.

Added

• An instructor group setting in the administration page. Members of that Nextcloud group may create courses and question pools without Nextcloud administrator rights. The mechanism is not new — it has been learning-instructors all along — but nothing named it: the admin page referred to "the configured instructor group" without saying which, and the manual claimed the instructor role was per-course only, which is wrong for creating a course in the first place.
• The five textbook fields in the pool dialog now explain themselves. They are optional and only pay off when a pool mirrors one chapter of a book; the dialog says so, and each field describes what belongs in it.
• A fifth i18n gate (scripts/gen-virtuprof-strings.mjs --check). The VirtuProf catalogue is now generated from l10n/*.json rather than hand-maintained, and the gate fails when the two disagree or when a reachable assistant string exists in no language file. Verified: removing a VirtuProf key from all six language files leaves gates 1–4 green and turns this one red. The catalogue grew from 252 to 429 keys and lost none — keys reached through vt(<expression>), which no literal scan can resolve, are carried forward until they leave l10n/de.json. --list-indirect names the 22 call sites this protects.

Documentation

• New manual section 2.3 on letting teachers create courses and pools, a corrected role description in section 1, a field-by-field table with a worked example for the pool dialog in 3.1, and two new troubleshooting entries.

Internal

• deploy-prod.sh --stage-gate now copies appinfo/ into the analysis copy. Without it ClassResolutionTest — the regression test written after the AIController/AiController outage — errored out instead of running.

Found by clicking through the 5.4.2 deployment: the wizard's "Skip" button sat at top: 16px, directly underneath the Nextcloud header, whose avatar button swallowed every click. The splash screen carries its own skip link at the bottom, so the first step looked fine — but from step two onwards there was no reachable way out of the introduction at all.

This is not new in 5.4.2; it has been there as long as the redesigned wizard. It is the sharper half of what #5 describes: users could not get rid of the introduction even when they tried.

Fixed

• The wizard's skip button clears the Nextcloud header and can actually be clicked from every step. Verified in the browser: a click on the button's own centre used to be delivered to the header's avatar.

Added

• Two browser tests that would have caught this: one walks a new account through the introduction and asserts it stays gone after clearing site data, the other asserts the skip button — not the header — receives a click aimed at it.

Reported by the same administrator piloting Learning in Vinnytsia (#5): the help wizard reappeared for users who had already been through it, and its introductory questions ("How many bits are in one byte?") were beside the point for staff in occupational safety or HR.

The reappearance turned out to be three separate defects, not a missing setting.

Fixed

• The assistant's introduction never honoured "no thanks". It read that setting from a response which does not contain it — /api/profile/telos/status returns the completion flag and nothing else — so the check was always false and the introduction started again on every single page load. The setting had been saved correctly the whole time.
• Whether the wizard had been seen lived in browser storage alone. That is scoped to one browser on one machine, so a second computer, a different browser, a private window or cleared site data all brought it back. The server is authoritative now; browser storage remains only as an offline fallback.
• Skipping the wizard recorded nothing on the server. It counts as a decision now, like completing it.
• Instructors were shown two introductions in a row — the wizard, and the slide tour the moment it closed. One introduction, one decision.
• Existing users are marked as done during the upgrade, so the update itself does not send a whole instance back through the introduction.

Changed

• Instructors now see the full nine-slide tour inside the wizard. It used to follow the wizard as a second, separate introduction; folding it in keeps the content while removing the duplication. OnboardingIntro is unreachable for now and becomes the voluntary tour in 5.5.0.
• Declining the assistant's introduction now puts the assistant in its reduced mode instead of leaving it in an undetermined state.

The introductory content itself is being reworked for 5.5.0.

Reported by the same administrator piloting Learning in Vinnytsia (#4): one error and one warning in the Nextcloud log. The warning was what it looked like. The error was the visible edge of a defect that had been silently discarding onboarding results since v4.2.0 (4 April 2026) — seventeen releases.

Fixed

• The onboarding wizard could not save a profile, and lost two more things while failing. OnboardingRedesign.vue built its own request body instead of using the shared payload builder, and posted '' for the list fields where every other caller posts an array. TelosController::saveTelos() declared those parameters ?array, so PHP raised a TypeError inside Nextcloud's Dispatcher — before the controller body ran, which is why the controller's own try/catch never saw it and the user got a bare 500.

The damage was three times the reported symptom, because finalize() ran three steps inside one try with an empty catch: 1. the learning profile was never stored — onboarding_completed stayed false, so VirtuProf kept asking for a profile the user had already filled in; 2. the AI consent was never stored, even for users who explicitly opted in. Since the universal consent gate in v5.2.1, that locks every AI feature behind consent_required for them; 3. the selected starter pool was never imported — the wizard offers a pool, the user picks one, and nothing arrives.

None of it was logged. Three fixes, at three different levels: - OnboardingRedesign.vue now builds its payload with createTelosForm() / buildTelosPayload() — the same util PersonalSettings.vue and VirtuProf.vue use, so there is one payload shape in the app instead of two that can drift apart again. - finalize() settles each step independently and logs a failure to the console instead of swallowing it, so one failing step can never cancel the other two. - saveTelos() / updateTelos() accept array|string|null for the list fields and split a string on the same separators as the frontend (, ; newline). A malformed telos payload now answers 400 instead of raising an uncatchable dispatcher TypeError.

No migration is needed and no data was corrupted — nothing was written, rather than something wrong being written. Affected users recover on their own: the profile can be filled in under Settings → Personal or through VirtuProf, the consent dialog reappears when an AI feature is used, and a starter pool can be imported from the pool list.

• Activity\Provider::parse() threw the deprecated \InvalidArgumentException. Nextcloud replaced that contract with \OCP\Activity\Exceptions\UnknownActivityException in NC 30; until then every activity-stream load logged a deprecation warning, and from NC 39 it will be logged as an error. Both throw sites migrated.

Notification\Notifier had already been moved to UnknownNotificationException — the same NC 30 cohort — and this provider was simply missed. Each throw site now has a test, so the pair cannot drift apart again.

Tests

• tests/Unit/Activity/ProviderTest.php (new), tests/unit/onboardingTelosPayload.test.js (new, covering both the payload shape and the step isolation in finalize()), and seven cases added to tests/Unit/Controller/TelosControllerTest.php.
• Every one of them was verified to fail against the pre-fix code before being kept — the controller cases reproduce the reporter's exact TypeError, and the finalize() case fails with expected [ 'telos' ] to deeply equal [ 'telos', 'consent', 'pool' ].
• tests/Support/PhpUnitStubs.php gained OCP\Activity\IEvent, IProvider and UnknownActivityException; the PHPUnit bootstrap deliberately does not load Composer's autoloader, so OCP types live there.

Also fixed — found by auditing for the same bug class

Codeberg #4 was one instance of a pattern: a frontend that posts a body the controller does not read. Nextcloud's dispatcher does not reject unknown keys and fills the missing parameter with its default, so the request succeeds and the app quietly does the wrong thing. PHPStan cannot see across the HTTP boundary and service tests start after it, so nothing caught these. An adversarial audit of every such call site turned up four more.

• Saving a course schedule deleted it. CourseController::setSchedule() takes entries; the curriculum tab sent schedule. $entries stayed at its [] default, and ScheduleService reads that as "replace the schedule with nothing" — it deleted every row, inserted none, and answered 200, which the UI reported as saved. An instructor editing a curriculum schedule lost it, with a success message.
• Reported questions lost their identity. SupportTicketController::create() reads questionId/poolId/courseId out of context; VirtuProf's "report this question" sent them at the top level, so the ticket's structured columns were stored as NULL and the question was identifiable only through the subject line. The same component already built the correct shape for its other ticket call.
• "Explain the question I just got wrong" did not load that question. The chat request sent questionId; the controller declares lastWrongQuestionId. The value was dropped, so the retrieval context never included it. The richer questionContext usually masked the defect.
• Two icon URLs were relative where Nextcloud requires absolute — Activity\Provider::setIcon() and Dashboard\LearningWidget::getIconUrl() (whose interface says so explicitly). Desktop and mobile clients do not share the web root, so those icons did not render there. Notification\Notifier had already been doing this correctly.

Each of these is now pinned by a request-boundary test in tests/unit/requestPayloadContracts.test.js, verified to fail against the pre-fix components.

Also fixed — in the profile endpoint itself

• An emptied help-topics list was silently preserved. saveTelos() forwarded the list only when it was non-empty, so [] and '' both meant "omit" rather than "clear". Emptying the textarea and saving kept the old value — and since help topics are published to classmates through the classbook at course or public visibility, a user could not withdraw a topic once shared. An omitted field (null) still means "leave as is"; a supplied empty one now clears, matching what updateTelos() already did.
• A malformed updateTelos() payload could half-save. Skipping a non-array telos and carrying on meant {"telos": "oops", "bio": "changed"} stored the bio and answered 200 — a worse outcome than the TypeError it replaced. It is now rejected before any other field is touched.

Known limitations

• List values are not round-trip safe: a topic containing a comma, semicolon or newline is split on reload, because the frontend has always joined and split on those characters and there is no escaping scheme. The string path added above follows the same convention rather than introducing a second one.
• Users whose onboarding failed before this release keep a local "onboarding seen" flag while the server has no profile. They can fill the profile at any time, and the assistant prompts students who have it enabled, but there is no automatic reconciliation for instructors or for users with the assistant switched off.

Prompted by a report from a system administrator piloting Learning at a manufacturing company in Vinnytsia, Ukraine (#3), who raised two problems: parts of the interface appear only in English or German, and there is no manual. Both turned out to be real defects, and the first one was considerably larger than the report suggested.

Added

• Ukrainian interface language (uk) — the sixth language, complete at 2,940 keys in the main catalogue plus 252 in the VirtuProf runtime catalogue. Plural form is the three-form Slavic rule, not the two-form default.
• This is a first pass and has not been reviewed by a native speaker. It is labelled as such in the manual, with instructions for submitting corrections without touching code.
• docs/MANUAL.md — a user and administrator manual covering the chain the reporter asked for: course → learning materials → pool → questions → students → test attempt → results → completion, plus admin setup, the occ commands, mandatory training and compliance, the AI consent model, and how to add or fix a translation.
• Linked from README.md and from a new <documentation> element in info.xml. That element was absent, so the App Store listing offered no documentation link at all — the direct reason the reporter could not find any.
• Two new i18n gates, both wired into check-i18n-parity.sh:
• scripts/check-i18n-coverage.py compares the source against the catalogue. Gates 1–3 all compare the language files against each other, so a string missing from all of them at once passes every one of them. Verified by reconstructing the defect: removing a key from all six files leaves gates 1–3 green and turns this one red. It covers JS/Vue t()/n(), PHP $l->t() and the indirect toolCatalog.js keys.
• scripts/check-i18n-placeholders.py asserts that every translated value carries the same placeholders ({n}, %1$s, …) as its German source, and that no value is written in the wrong script. With six languages and machine-assisted translation, a dropped placeholder became the likeliest remaining defect.

Fixed

• 635 interface strings were absent from the translation catalogue entirely. They were passed through t() but had no entry in de.json, so Nextcloud's l10n fell back to the source string and rendered them in German in every language, including English.
• 618 came from JS/Vue, 10 from PHP $l->t() calls (notification subjects, the legal notice and privacy links), and 7 from toolCatalog.js, which reaches t() through a variable and is invisible to any literal scan.
• The most-used casualties: the course materials tab almost in full, parts of course administration, and the answer-type selector in the question form — Einzelauswahl / Mehrfachauswahl / Freitext, the three options every author picks between when writing a question.
• All 635 are now in the catalogue and translated into all six languages.
• VirtuProf keeps its own 252-key runtime catalogue (src/l10n/virtuprof-strings.js) which is separate from l10n/*.json and was not covered by any gate. A language added to the main catalogue alone would leave the assistant speaking German or English. It now carries a uk dictionary, and virtuprof-i18n.js lists it.
• VirtuProf's backend language allow-list silently discarded valid choices. VirtuProfController::ALLOWED_INTERFACE_LANGUAGES did not contain fr, although the frontend has offered French all along; normalizeInterfaceLanguage() coerces anything unlisted to '' and returns no error, so a French user's choice was dropped without a trace. Both fr and uk are now listed, with a comment naming the three places that must stay in sync.
• scripts/deploy-prod.sh synced a hard-coded five-language list. A new language would have been generated, guarded and committed — and then never copied to the server. Now six, alongside l10n_js_sync.py and check-i18n-parity.sh.

Known limits

• Some strings still reach t() through variables that the coverage gate cannot enumerate (onboarding slide definitions, dashboard tiles, a few config objects). Run python3 scripts/check-i18n-coverage.py --list-indirect to see the remaining call sites. Those were not audited in this pass.
• The content language layer — optional parallel translations of question text, held in learning_q_translations / learning_a_translations — still accepts only de, en, ru, ar. Adding uk means a DB migration against a CHECK constraint and a re-test on both PostgreSQL and MariaDB, so it is deliberately out of scope here. It is not a blocker for Ukrainian use: questions authored directly in Ukrainian are stored and displayed unchanged, because the base question row has no language constraint.

Fixed

• Every AI endpoint returned HTTP 500 instead of working (#3). Nextcloud derives the controller class from the route name, so 'name' => 'ai#available' resolves to OCA\Learning\Controller\AiController. The file was named AIController.php and declared class AIController; because PSR-4 autoloading is case-sensitive, the class was never found and the App Framework threw QueryNotFoundException before the request reached any of our code. All five ai#* routes — available, generate, status, import and explain — have been broken this way since they were introduced in v2.7.0.
• Visible effect was mostly log noise: the callers in QuestionList.vue, LeitnerMode.vue and TrainingMode.vue swallow the failure and fall back to aiAvailable = false, so the AI buttons simply never appeared. Nothing was lost, but nothing worked either, and every page that asked wrote a stack trace to nextcloud.log.

• The class-resolution failure happens before the authentication middleware, which is why the endpoint answered 500 to anonymous callers where every healthy route answers 401. That difference is what pinned the diagnosis.

• Four SQL queries referenced columns that do not exist, each failing with SQLSTATE 42703 every time it ran. All four were invisible to PHPStan — the defect lives in a string — and each sat behind a catch (\Throwable) that turned the error into a 500 or an empty result.

• LernprofilService: c.name on learning_courses, which has title. In enrichPoolsWithCourseData this broke /api/profile/skill-map outright (since 2026-04-09); the identical mistake in the cheat-sheet query hit only users who actually had wrong answers to report, so it stayed hidden behind an empty-result early return on fresh accounts.
• RagContextService and CourseSummaryService: ua.user_id on learning_user_answers, which has no user column at all — the user hangs off the session. Both now join learning_sessions the way NoteGeneratorService already did. User weaknesses and trouble spots never loaded; they threw.
• CourseSummaryService additionally compared the boolean is_correct against the integer 1, a type error on PostgreSQL. It now tests the column directly, which is portable across PostgreSQL and MariaDB.
• NoteGeneratorService: chapter_ref on learning_pools, a column that never existed (the chapter columns are chapter_key / chapter_title / chapter_order). Every authorised POST /api/notes/generate died in this query, before reaching the model at all.
• RagContextService: name on learning_courses. This is the first query buildContext() runs once a course is set, and a shared catch aborted the whole build after it — so VirtuProf answered without any course context (no chunks, pool questions, Leitner stats or weaknesses) and without reporting an error.
• CourseSummaryService: winner_uid on learning_duel_sessions. That column only exists on the league tables; a duel's winner follows from the scores. This query is on the ordinary course-summary path, so it took summaries, snapshots, narratives and CSV exports down with it. Wins are now counted from the scores of finished duels — and so is the total, because a duel that is still waiting for an opponent or expired unplayed has no winner and would otherwise sit in the denominator of win_rate.
• FeedController reported no course names. It called getName() on the course entity, which only has getTitle(); the surrounding catch turned that into course_name: null for every feed item rather than an error.
• Skill map and cheat sheet exposed courses the user is not in. enrichPoolsWithCourseData accepted a user id and then ignored it, so it returned every course any accessible pool had been added to. An instructor can attach a pool that was merely edit-shared with them, which handed the pool's owner the id and title of a course they are not a member of. Both queries now apply the same membership test the rest of the service already used, and both order their results — a pool can belong to several courses and the mapping keeps the first row, which without an explicit order was whatever the database happened to return first.
• LernprofilController logged nothing when it failed. All five catch (\Throwable) blocks returned a 500 without touching the logger, which is why nextcloud.log held no trace of an endpoint that had been broken since April 2026. They now log the exception before returning.

Security

• Duels and gameshows could be started on any pool. DuelService::createDuel and GameshowService::createSession only checked pool access when a courseId was supplied, and both endpoints accept none — so two cooperating users could start a session on an arbitrary pool id and read its questions, its answer options, and after answering the correct answer id. TrainingService has always gated its equivalent path. Both now call the same check, which is made public on QuestionService rather than copied a sixth time. Verified live in both directions: a pool the caller cannot reach is refused, one they can reach still works.
• The Wissensturm category endpoint had the same hole from a different angle: it took any pool id as the chosen category and read a question from it. It is now authorised against the session — the pool the session was created with, or any pool of its course — rather than against the caller's own pool access, because players who join a session legitimately are not required to have access to its pool.
• POST /api/courses/{id}/summary/snapshot did not check course access. Every other endpoint in SummaryController passes through CourseService::findById() first; this one called the service directly, so any logged-in user could snapshot an arbitrary course id and read the result back through their own snapshot. It now applies the same gate and answers 403.

Added

• scripts/check-sql-columns.py — resolves every alias-qualified column reference in app/lib against the live database schema. It found all four SQL defects above in one run.
• ClassResolutionTest — walks both places where Nextcloud builds a class name from a string (appinfo/routes.php route names and the FQCNs in appinfo/info.xml) and asserts each one resolves to a file whose name matches exactly, plus that the file declares the class name the router will ask for. Neither PHPStan nor the controllers' own unit tests can catch this: those tests use the real class name, so they load and pass while HTTP is broken.

Changed

• .githooks/pre-push now runs PHPUnit and the SQL column check. Neither the PHP test suite nor any schema check ran in a mandatory gate before, which is the reason both classes of defect survived for months. Note that the versioned hook was not the active one — core.hooksPath pointed at a stale copy in .git/hooks.
• The API test for /api/profile/skill-map asserts 200 and a payload shape; it accepted 500 before, and so reported a hard SQL error as passing for four months.
• The API test for /api/ai/available asserts 200 and a boolean payload. It previously accepted 200 or 500, which is what let a total outage ship through 23 tagged releases over five months — the endpoint always answers 200 with {available:bool}, including when no API key is configured, so a 500 was never an acceptable outcome.

Added

• occ learning:uninstall — removes everything this app leaves in the database, so the app can be uninstalled cleanly (#1). Dry run by default; --execute is required to change anything.
• Drops all learning_* tables, including the legacy names from both historical rename waves, and clears the rows left in migrations, appconfig, preferences, jobs, notifications, activity and activity_mq.
• Deletes the metadata rows before dropping the tables. Leaving the oc_migrations rows behind makes a later reinstall skip every migration and boot broken, so if a run dies between the two phases, this order leaves the recoverable state.
• Refuses to run when issuer/certificate data exists unless --keep-certificates or --drop-certificates is chosen: the Ed25519 issuer key is unrecoverable, and losing it makes every certificate ever issued permanently unverifiable.
• Refuses to run when any table cannot be read. An unreadable table is never mistaken for an empty one — every guess here is destructive.
• Reports rather than touches what it cannot safely change: the theming legal links (rewritten by Application::boot() on every request, so they can only be cleared after app:remove — the command prints the statement), the Dashboard layout row, and the files the app created under /Learning/ in users' homes.
• Tables carrying the learning_ prefix that this version does not know about are reported, not dropped.
• scripts/db-uninstall-probe.php — runs the real command against a throwaway MariaDB and PostgreSQL, covering platform behaviour no unit test or PostgreSQL-only dev instance can reach.

Fixed

• occ learning:import-pool-json no longer drops valid open questions. The pre-check demanded at least two answers for every question, which is right for multiple choice but wrong for open (fill-in) questions — those carry exactly one model answer and were skipped silently. The check now mirrors what QuestionService::create already enforced.

Changed

• The privacy and imprint pages name the operating company, with the registration details an imprint requires, instead of a private individual.

Notes

• No repair step is used for uninstall. Nextcloud executes <repair-steps><uninstall> from AppManager::disableApp(), so it also fires when an admin merely disables the app — a drop there would let one mis-click destroy every course, pool and certificate. The reasoning, including why a marker-armed variant was rejected, is recorded in UninstallCommand's class docblock.

A whole-app security audit (8 review lanes) followed by an adversarial multi-model pre-live review. Every finding was verified against the actual code before fixing; fixes shipping to the public App Store were themselves re-reviewed. No functional/feature changes — hardening only.

Security — Access control (IDOR)

• Course-scoped authorization on RAG import/list/delete/moderate endpoints (an instructor of course A could previously touch course B's shared RAG pool); course-membership gates on RAG contribution and on listing one's own contributions.
• Answer-key exports (CSV/JSON) require export-level access (owner, edit-share, or the instructor of a course the pool is attached to) — not plain read access; enrolled students can no longer pull answer keys.
• Course-access gates on document index/material-folder and course feed endpoints (previously cross-course content/PII could leak).

Security — Exam integrity (oracle prevention)

• During an active exam, explanations, correct answers, PBQ solution config and translated explanations are withheld across all surfaces that emit question-derived data (training/exam payloads, translation endpoints, the spaced-repetition due-queue, and VirtuProf's RAG + client-supplied question context).
• Starting an exam no longer auto-completes an existing exam by switching course context; correct PBQ answers now increment the exam score even when per-question feedback is suppressed.

Security — AI / GDPR

• Per-user AI consent is now enforced on every user-triggered LLM path (VirtuProf chat/interview, course summary, AI question generation, note generation, AI explanations) — the admin ai_enabled toggle alone is no longer sufficient. The frontend catches the consent-required response and points the user to the in-app consent dialog.
• Stored chat memory is NFKC-normalized and injection-filtered before re-entering the system prompt (a payload stripped on turn 1 could previously reappear on turn 2); the injection sanitizer now covers the same role-change / prompt-leak / jailbreak markers as the detector.
• File-intent note generation and chat-memory compression now count against the shared AI rate limit.

Security — Data-layer robustness

• Repair migration for course-feature table-name drift (curriculum scopes, question overrides, announcements) — cross-DB safe (PostgreSQL 16 / MariaDB / SQLite), identifier-quoted, fail-fast on platform-detection error, and it aborts rather than orphaning legacy data if a rename fails.
• Prefix-agnostic insert ids (exam slots, announcements) instead of a hardcoded oc_ sequence name; entity model aligned with the shipped schema.

Database

• Version009900: idempotent, data-preserving repair of legacy learning_curriculum_scopes / learning_q_overrides / learning_announcements → learning_course_*. Verified on PostgreSQL 16.

Versions 4.4.8 and 4.4.9 were internal migration-vehicle bumps and were never released; this entry covers everything since 4.4.7.

Added

• Signed completion certificates. A course can define pass criteria (score threshold, validity period). When a learner passes, the app mints a cryptographically signed certificate — a W3C Verifiable Credential (Ed25519 / VC-JWT) bound to the learner and the course.
• did:web issuer identity. Each instance is its own credential issuer via a path-based did:web derived from the server URL; the public key is published at the app's did.json. Issuer keys are generated with occ learning:cert:init-issuer, stored encrypted at rest (ICrypto), and can be rotated without invalidating previously issued certificates.
• Public verification portal. Anyone can verify a certificate by its ID / QR code on a public page. Signature, key status, claim binding, revocation and expiry are checked as an AND-chain; unknown IDs leak no personal data. Course owners can revoke certificates.
• Compliance report. Per-course completion/compliance report for instructors and admins (who passed, when, certificate status).
• Certificate view. A printable, A4-ready certificate with QR code, a prominent Certificate ID and a verification link.

Changed

• Avatars overhauled. The default assistant Nova is now a full chibi character with emotion-aware expressions (neutral / happy / sad / surprised / sleep / celebrate) instead of an abstract shape. The three scholar skins (Theoretiker / Kosmologe / Astrophysik-Popularisierer) were polished — gradient shading, larger eyes, brighter signature accents.

Setup

• Certificates need a one-time key. Run occ learning:cert:init-issuer once per server to generate the issuer signing key. Until it exists, the admin settings page shows a reminder and no certificate is minted when a learner passes. See README → Installation → Certificates setup.

Database

• Version009100 creates learning_cert_keys and learning_certificates; Version009200 adds revoked_at. Verified on PostgreSQL 16 and MariaDB (the credential_json / secret_key_enc TEXT columns are intentionally unindexed to avoid the utf8mb4 key-length limit).

Fixed

• learning_user_stats had no primary key (#24). Reported by @haecks on a fresh NC 33.0.5 install: Nextcloud logged "Table 'oc_learning_user_stats' has no primary key and therefore will not behave sane in clustered setups. This will throw an exception and not be installable in a future version of Nextcloud." The table was created back in Version001200 with only a unique index (learn_ustats_user_uniq) on user_id, never a primary key. Since there is exactly one stats row per user and every access path addresses the table by user_id, user_id is the natural primary key. A new migration (Version008000) drops the now-redundant unique index and promotes user_id to the primary key. The migration is idempotent (guards for missing table/column and an already-present primary key) so it is safe on existing installs and re-runs. Verified live on PostgreSQL 16 and independently on MariaDB 11.4 with utf8mb4 (the varchar(64) key stays well under InnoDB's index-length limit).

Fixed

• v4.4.5 shipped without the data/ directory (starter pools, campaigns, simulator scenarios, privacy-info.json, PWA guide, course materials — 77 files). The release build followed a cp file-list that omitted data/, so on a clean v4.4.5 install the "Add starter pool" feature, campaigns, the practicum/simulator scenarios and the privacy page had no backing data. v4.4.6 restores data/ (verified: tarball file-set now matches the last-known-good v4.4.4 manifest). The i18n content of v4.4.5 (#21 + #19) is unchanged and included.

Changed — UX-Navigation Struktur

• Instructor Tab Groups: 17 instructor tabs organized into 5 logical groups (Lernraum, Teilnehmer, Kommunikation, Wettbewerb, Verwaltung) with visual separators.
• Abenteuer Standalone: Adventure mode promoted from Arena sub-mode to its own CourseDetail tab, independently gatable via mode_config.
• Arena Submode Gating: Each Arena mode (Duel, Gameshow, Oldschool) individually hideable per course rules. Arena tab disappears when all sub-modes disabled.

Changed — Code-Hygiene & Settings

• Settings Split: Instructors now see two sub-tabs in Settings: "Kurs-Verwaltung" (admin) and "Meine Einstellungen" (personal). Students see only personal settings.
• Zeitreise Removed: Removed 1270+ lines of dead Zeitreise/HackThroughTime frontend code (component, characters, navigation, mode_config key).
• German Labels: All UI-visible labels now go through t() translation. ModeIdentityBanner labels localized.

Added — Simulator-Praxis-Sessions

• Practicum Engine: Pure-JS state machine for guided session management with localStorage persistence and browser-reload recovery.
• 11 Practicum Sessions: Real-world IT scenarios across all 7 simulators (42 steps total). Firewall, DNS, and Routing get 2 sessions each.
• PracticumRunner UI: New "Praxis" tab in every simulator with step-by-step instructions, context explanations, progress bar ("Schritt X von Y"), and score summary.

Added — Student Dashboard

• Heute Screen: New default landing page for students with SmartQueue widget (due cards count + "Jetzt lernen"), Daily Challenge card, streak display, and daily progress.
• Global Feed: Aggregates announcements from all enrolled courses chronologically with course-name badges and pagination.
• Pools Navigation: Direct "Pools" tab in student main navigation — one click to PoolList.

Added — DevCloud Integration & Leitner

• Talk Room Link: Instructors can set a Talk room token per course. Clickable link appears in course header, opens NC Talk in new tab.
• Materials for Students: Students now see the Materialien tab (read-only) when a course has a material folder set.
• Buddy Matching: New "Lernpartner" tab shows who can help with your topics and whom you can help, based on Telos help_offer/help_wanted data.
• Course-Aware Tools: Werkzeuge tab filters simulators based on active course's enabled_tools. No course active = all tools visible.
• Sprint Intervals: Instructors can activate sprint mode per course (4h/12h/1d/2d instead of 1d/3d/7d/14d Leitner intervals) for intensive courses.

Fixed

• Badge Duplicate Crash: Session completion no longer fails with 400 when badge already exists. Fixed catch to use OCP\DB\Exception (NC 30 wraps Doctrine exceptions).