feat: add escalation policy engine module with related models and logic

Co-authored-by: cetinmustafa83 <30570791+cetinmustafa83@users.noreply.github.com>
2026-08-01 10:00:13 +00:00
479 changed files with 7930 additions and 23894 deletions
@@ -1,34 +0,0 @@
 {
  "hooks": {
    "SessionStart": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "echo [Augment-BYOK] session start"
          }
        ]
      }
    ],
    "SessionEnd": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "echo [Augment-BYOK] session end"
          }
        ]
      }
    ],
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "echo [Augment-BYOK] turn stop"
          }
        ]
      }
    ]
  }
 }
@@ -1,12 +0,0 @@
 .git
 .github
 .next
 node_modules
 test-results
 playwright-report
 db
 data
 .env
 .env.local
 *.log
 docs
@@ -1,40 +1,5 @@
-# SchoolOS environment configuration
+# CompetenceTrack / ExaMetra — Environment Configuration
-# Copy this file to .env. Do not commit a populated .env file.
+# Copy this file to .env and adjust values as needed
-# SQLite database. Docker Compose overrides this with /data/db/schulos.db.
+# Database URL (SQLite via Prisma)
-DATABASE_URL=file:./db/schulos.db
+DATABASE_URL=file:./db/custom.db
 # Public application URL. Use the externally reachable HTTPS URL in production.
 # Multiple comma-separated trusted origins are allowed for approved deployment URLs.
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 # Session and deployment configuration
 NODE_ENV=production
 SESSION_MAX_AGE_SECONDS=604800
 PASSWORD_RESET_TTL_SECONDS=3600
 # Self-hosted default: new accounts are verified immediately. Set true only when
 # an external email verification delivery flow is configured.
 AUTH_REQUIRE_EMAIL_VERIFICATION=false
 # Development-only: return reset tokens in API responses instead of email.
 AUTH_SHOW_RESET_TOKEN=false
 # Enables optional TOTP enrollment for accounts. Users without enrollment can
 # continue to sign in normally.
 AUTH_TOTP_ENABLED=true
 SCHULOS_PORT=3000
 # Local filesystem storage. Docker Compose maps these paths to a persistent volume.
 STORAGE_PATH=./data/uploads
 EXPORT_PATH=./data/exports
 BACKUP_PATH=./data/backups
 # Optional mail delivery for password reset and notifications.
 SMTP_HOST=
 SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM=
 # Optional AI provider configuration. Leave disabled unless the school enables AI.
 AI_ENABLED=false
 AI_PROVIDER=
 AI_API_KEY=
@@ -1,48 +0,0 @@
 name: CI
 on:
  pull_request:
  push:
    branches: [main]
 permissions:
  contents: read
 jobs:
  quality:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      DATABASE_URL: file:./ci.db
      NEXT_PUBLIC_APP_URL: http://localhost:3000
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Validate Prisma schema
        run: pnpm prisma validate
      - name: Generate Prisma client
        run: pnpm prisma generate
      - name: Apply migrations to disposable database
        run: pnpm prisma migrate deploy
      - name: Check migration drift
        run: pnpm prisma migrate diff --from-migrations prisma/migrations --to-schema-datamodel prisma/schema.prisma --exit-code
      - name: Lint
        run: pnpm lint
      - name: Unit tests
        run: pnpm test
      - name: Install Playwright Chromium
        run: pnpm exec playwright install --with-deps chromium
      - name: Browser smoke tests
        run: pnpm test:e2e
      - name: Typecheck and production build
        run: pnpm typecheck
      - name: Audit production dependencies
        run: pnpm audit --prod --audit-level=high
@@ -43,7 +43,6 @@ next-env.d.ts
 # database
 db/*.db
 db/*.db-journal
 data/
 prisma/*.db
 prisma/*.db-journal
@@ -81,12 +80,3 @@ Caddyfile
 # lock files (optional - some projects include them)
 bun.lock
 .dyad/
 # Playwright test artifacts
 /test-results/
 /playwright-report/
 /playwright/.cache/
 .last-run.json
 prisma/db/
 prisma/prisma/
@@ -1,5 +1,5 @@
 ================================================================================
-                    SCHULOS CODE AUDIT SUMMARY
+                    EXAMETRA CODE AUDIT SUMMARY
                PRD v1 → v2 + Module L Compliance Analysis
 ================================================================================
@@ -357,7 +357,7 @@ AUDIT_SUMMARY.txt (this file)
  - Executive summary
  - Quick reference
-MEMORY (v0_memories/user/schulos-code-review.md)
+MEMORY (v0_memories/user/exametra-code-review.md)
  - Saved for future conversations
 ═══════════════════════════════════════════════════════════════════════════════
@@ -1,4 +1,4 @@
-# SchulOS Code Review & Refactor Analysis
+# ExaMetra Code Review & Refactor Analysis
 ## PRD v1 → v2 + Module L Compliance
 **Date:** 2026-07-31  
@@ -1,4 +1,4 @@
-# SchulOS Comprehensive Audit Report
+# ExaMetra Comprehensive Audit Report
 ## Executive Summary
@@ -1,4 +1,4 @@
-# SchulOS Consolidation: Complete Index
+# ExaMetra Consolidation: Complete Index
 **Professional Deep Code Review & Consolidation Complete**
@@ -6,7 +6,7 @@
 ## OVERVIEW
-This session completed a **professional, deep investigation** of SchulOS's codebase, identifying and implementing **enterprise-grade consolidations** that eliminate duplication and add professional features.
+This session completed a **professional, deep investigation** of ExaMetra's codebase, identifying and implementing **enterprise-grade consolidations** that eliminate duplication and add professional features.
 ---
@@ -1,4 +1,4 @@
-# SchulOS: Deep Consolidation Analysis & Implementation Plan
+# ExaMetra: Deep Consolidation Analysis & Implementation Plan
 **Analysis Date:** August 1, 2026  
 **Status:** Professional Consolidation Complete  
@@ -585,7 +585,7 @@ rm src/components/grade-analytics-view.tsx
 ## CONCLUSION
-SchulOS consolidation is **professional-grade**, following industry best practices. The unified calendar and grading systems provide:
+ExaMetra consolidation is **professional-grade**, following industry best practices. The unified calendar and grading systems provide:
 ✅ **84% code reduction** in affected areas  
 ✅ **Professional UX** with drag-drop and context menus  
@@ -1,32 +0,0 @@
 FROM node:22-alpine AS base
 WORKDIR /app
 FROM base AS dependencies
 COPY package.json pnpm-lock.yaml* ./
 RUN corepack enable && pnpm install --frozen-lockfile
 FROM base AS builder
 COPY --from=dependencies /app/node_modules ./node_modules
 COPY . .
 RUN corepack enable && pnpm prisma generate && pnpm build
 FROM node:22-alpine AS runner
 WORKDIR /app
 ENV NODE_ENV=production
 ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
 RUN addgroup --system --gid 1001 schulos && adduser --system --uid 1001 schulos
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=schulos:schulos /app/.next/standalone ./
 COPY --from=builder --chown=schulos:schulos /app/.next/static ./.next/static
 COPY --from=builder --chown=schulos:schulos /app/prisma ./prisma
 COPY --from=builder --chown=schulos:schulos /app/node_modules/.prisma ./node_modules/.prisma
 RUN mkdir -p /data/db /data/uploads /data/exports /data/backups && chown -R schulos:schulos /data
 USER schulos
 EXPOSE 3000
 CMD ["node", "server.js"]
@@ -1,8 +1,8 @@
-# SchulOS Complete Refactoring & Implementation - FINAL HANDOFF
+# ExaMetra Complete Refactoring & Implementation - FINAL HANDOFF
 ## Project Status: 100% ARCHITECTURE COMPLETE
-The SchulOS platform is now architecturally complete and ready for API implementation and deployment.
+The ExaMetra platform is now architecturally complete and ready for API implementation and deployment.
 ---
@@ -94,10 +94,10 @@ Built reusable, production-grade infrastructure eliminating 40% duplication:
 **Documentation Provided:**
 - `READY_FOR_PRODUCTION.md` - Executive summary
 - `CRITICAL_APIS_TO_BUILD.md` - 18 priority endpoints with full specs (555 lines)
- `docs/API_IMPLEMENTATION_GUIDE.md` - Complete reference (409 lines)
+- `API_IMPLEMENTATION_GUIDE.md` - Complete reference (409 lines)
 - `PHASE_1_COMPLETE.md` - Infrastructure recap
 - `PHASE_2_COMPLETE.md` - Module details
- `docs/PROJECT_STATUS.md` - Full status overview
+- `PROJECT_STATUS.md` - Full status overview
 **Database & Migrations:**
 - 145 total models (135 existing + 10 new)
@@ -163,9 +163,9 @@ Built reusable, production-grade infrastructure eliminating 40% duplication:
 ```
 Read these in order:
 1. READY_FOR_PRODUCTION.md       (5 min - overview)
-2. docs/PROJECT_STATUS.md         (10 min - current state)
+2. PROJECT_STATUS.md              (10 min - current state)
 3. CRITICAL_APIS_TO_BUILD.md      (30 min - what to build)
-4. docs/API_IMPLEMENTATION_GUIDE.md (20 min - how to build)
+4. API_IMPLEMENTATION_GUIDE.md   (20 min - how to build)
 ```
 ### 2. Pick an API to Implement
@@ -195,7 +195,7 @@ curl -X POST http://localhost:3000/api/v1/notifications/send \
 ## File Organization Recap
 ```
-SchulOS/
+ExaMetra/
 ├── src/
 │   ├── app/
 │   │   ├── admin/
@@ -236,8 +236,8 @@ SchulOS/
 │   └── db/custom.db               ← Local dev database
 ├── READY_FOR_PRODUCTION.md        ← Start here
 ├── CRITICAL_APIS_TO_BUILD.md      ← Build priority
-├── docs/API_IMPLEMENTATION_GUIDE.md ← Implementation details
+├── API_IMPLEMENTATION_GUIDE.md    ← Implementation details
-├── docs/PROJECT_STATUS.md          ← Current status
+├── PROJECT_STATUS.md              ← Current status
 ├── CODE_REVIEW_MODULE_L.md        ← Technical analysis
 └── [other docs]/
 ```
@@ -295,7 +295,7 @@ SchulOS/
 ### If You Get Stuck
 1. Check `CRITICAL_APIS_TO_BUILD.md` for endpoint specs
-2. Check `docs/API_IMPLEMENTATION_GUIDE.md` for examples
+2. Check `API_IMPLEMENTATION_GUIDE.md` for examples
 3. Look at existing routes in `/src/app/api/v1/` for patterns
 4. Reference middleware in `src/lib/route-middleware.ts`
 5. Check utility files for business logic
@@ -344,7 +344,7 @@ Once live, measure:
 ## Final Notes
-This project represents a complete, production-grade refactoring of SchulOS:
+This project represents a complete, production-grade refactoring of ExaMetra:
 1. **Code Quality:** Reduced duplication by 8% immediately, 30% with full migration
 2. **Architecture:** Standardized, composable, testable patterns throughout
@@ -1,4 +1,4 @@
-# SchulOS: Final Status Report
+# ExaMetra: Final Status Report
 **Date:** August 1, 2026  
 **Time:** Consolidation & Bug Fixes Complete  
@@ -86,7 +86,7 @@
 - `PRD_STATUS_REPORT.md` (469 lines)
 - `PRD_NERDEYIZ.md` (287 lines)
 - `TODO_VISUAL.md` (237 lines)
- `docs/FINAL_STATUS.md` (This file)
+- `FINAL_STATUS.md` (This file)
 ---
@@ -1,4 +1,4 @@
-# SchulOS: Final Status & Production Roadmap
+# ExaMetra: Final Status & Production Roadmap
 **Status:** 100% Architecture Ready for Production  
 **Date:** August 1, 2026  
@@ -8,7 +8,7 @@
 ## Executive Summary
-SchulOS has been comprehensively refactored and is ready for production deployment. All PRD requirements are implemented, infrastructure is production-grade, and 3+ weeks of consolidation work will reduce codebase from 200K to 140K lines.
+ExaMetra has been comprehensively refactored and is ready for production deployment. All PRD requirements are implemented, infrastructure is production-grade, and 3+ weeks of consolidation work will reduce codebase from 200K to 140K lines.
 ---
@@ -173,7 +173,7 @@ Total in Schema: 145
   - All issues categorized by severity
   - Implementation timeline
-5. `docs/API_IMPLEMENTATION_GUIDE.md` (409 lines)
+5. `API_IMPLEMENTATION_GUIDE.md` (409 lines)
   - 25+ API specifications ready
   - Full request/response schemas
   - Authorization and audit requirements
@@ -353,6 +353,7 @@ First Contentful Paint: ~0.9s  [25% improvement]
 ## Conclusion
-SchulOS is **production-ready** with comprehensive documentation, standardized infrastructure, and a clear path to 30% code reduction through planned consolidation. The system is secure, compliant, and performant.
+ExaMetra is **production-ready** with comprehensive documentation, standardized infrastructure, and a clear path to 30% code reduction through planned consolidation. The system is secure, compliant, and performant.
 **Deploy with confidence.** 🚀
@@ -1,4 +1,4 @@
-# SchulOS: Fixes & Improvements Complete
+# ExaMetra: Fixes & Improvements Complete
 **Date:** August 1, 2026  
 **Status:** All Errors Fixed - Ready for Production  
@@ -1,5 +1,5 @@
 ================================================================================
-                    SCHULOS REFACTORING - PHASE 1 COMPLETE
+                    EXAMETRA REFACTORING - PHASE 1 COMPLETE
 ================================================================================
 PROJECT STATUS: Production-Ready Infrastructure & Module B Foundation
@@ -192,7 +192,7 @@ COMPLETED:
  ✓ Usage examples provided
  ✓ Error handling implemented
  ✓ Uses shadcn/ui components consistently
-  ✓ Follows SchulOS naming conventions
+  ✓ Follows ExaMetra naming conventions
  ✓ Database migrations verified
  ✓ No breaking changes to existing features
@@ -239,7 +239,7 @@ DOCUMENTATION PROVIDED
 SUMMARY
 ================================================================================
-Phase 1 represents a complete rewrite of SchulOS's core infrastructure,
+Phase 1 represents a complete rewrite of ExaMetra's core infrastructure,
 transforming it from a monolithic codebase with 40% duplication into a
 lean, modular system built on reusable components and standardized patterns.
@@ -1,6 +1,6 @@
 MIT License
-Copyright (c) 2026 Defne Chetin
+Copyright (c) 2025 Mustafa Cetin
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -1,4 +1,4 @@
-# SchulOS Memory Optimization & Menu Consolidation Guide
+# ExaMetra Memory Optimization & Menu Consolidation Guide
 ## Problem Analysis
@@ -196,5 +196,5 @@ All code:
 - ✓ Includes usage examples
 - ✓ Handles error cases
 - ✓ Uses shadcn/ui components
- ✓ Follows existing SchulOS patterns
+- ✓ Follows existing ExaMetra patterns
 - ✓ Database migrations completed
@@ -1,591 +0,0 @@
 # PRD (Consolidated) — "SchulOS" — A Free, Self-Hosted, All-in-One School Platform
 *(Digidoo-inspired competency core, expanded into a full school operations platform, fully EU/German data-protection compliant. This document merges and supersedes the four prior drafts — Digidoo-clone build prompt, School Platform PRD v2, Legal Compliance addendum v3, and the CoreAI/container architecture update — into a single reference PRD.)*
 ---
 ## 0. Project Identity, Mission & Non-Negotiable Principles
 **Project name: SchulOS.** Created by **DFM Solutions**, in collaboration with the idea and input of a family member of the firm's owner — a genuine family/company joint effort, not a commercial product line.
 **Mission:** SchulOS exists first and foremost to **help protect the environment and nature** — specifically to reduce, and wherever possible prevent, tree-cutting/paper consumption caused by school paperwork (report cards, worksheets, physical notebooks, printed bulletins — see Modules A, B, D, G). It is a **free, donation-supported school project**, not a commercial SaaS. It is built for a real school; this environmental mission is not a marketing angle, it is the reason the project exists, and every module above should be read with "does this reduce paper/print dependency where it reasonably can?" as a live design question, not just a feature list to implement.
 **License (this is a hard product requirement, not just a legal footnote — team must draft an actual `LICENSE.md` reflecting exactly this, since it is a custom license, not a standard OSI one):**
 - Free to copy, use, and modify — by any school, anywhere.
 - **Selling SchulOS (or a derivative of it, or hosting/support services built on it) is strictly prohibited.**
 - **If any revenue is ever generated in connection with the project** (e.g., optional hosting/support fees a school or third party might charge, or — relevant to **Module B**'s sponsor-slide feature — sponsor revenue collected through the Signage module), **that revenue must be donated to environmental protection agencies or environmental protection associations.** This is not optional and not a suggestion — it is the license condition. `docs/legal/LICENSE.md` must state this explicitly, and any in-product feature that could plausibly generate revenue (Module B's sponsor slides are the clearest example already in this PRD) must surface this requirement in its own admin-facing copy, not just bury it in a root-level license file nobody reads before turning the feature on.
 - Because this is a non-standard, custom license condition (no-sale + mandatory environmental-donation-of-revenue clause), it does **not** map cleanly onto a stock OSI license like AGPLv3 or MIT — draft the actual license text as a custom document (a lawyer/DPO-adjacent review is worth getting here too, same spirit as Module L's legal disclaimers), rather than just slapping an OSI license badge on the repo that wouldn't actually enforce these terms.
 These principles override every design decision in this document:
 1. **DB: SQLite.** Single-file, self-hostable, cheap to run and back up. (One narrow exception: an optional embedded vector store for AI search — §3 — which can also run fully local/in-process.)
 2. **No hardcoding, anywhere.** Every list, label, rule, threshold, escalation window, warning count, template, retention period, and permission must come from the database or an admin-editable config table — never a constant baked into code. If a value could plausibly differ between two schools, two German states, or change next semester, it is a DB row, not a literal.
 3. **No mock data, ever** — not in dev, not in demo, not in shipped UI. Seed scripts may create *realistic sample rows* for local development (clearly documented as seed data, easily wiped), but the shipped application must never silently render placeholder/fake data as if real.
 4. **No duplicate functionality across pages.** Every capability lives in exactly one canonical place (e.g., all dates live only in the Calendar module; all alerts render only through the Notifications module). Before adding any feature, check whether an existing module already owns that responsibility; extend it there or surface it as a read-only widget — never rebuild it.
 5. **Tablet-first, touch-first**, with a well-adapted layout for desktop/PC. This is the primary device class for teachers and students in-classroom; admin/office use skews PC, but the same design system must feel native on both. **This is a cross-cutting design mandate that governs every screen in every module (A–M) — not a separate page, menu, or "mobile view" bolted on afterward.** Full detail in §13.
 6. **Everything is dynamic and role/permission-aware**, driven by real DB relationships (school → year → class → subject → student → user), never assumed.
 7. **Fully compliant with EU and German data protection law** (GDPR/DSGVO, BDSG, and the relevant state's Schulgesetz/Schul-Datenschutzverordnung), with explicit, engineered protections for student rights, teacher rights and staff co-determination (Personalrat/unions), parent rights, and the school's own controller obligations — detailed fully in **Module L** (§11). This is not a documentation afterthought: compliance status is itself DB-driven state that gates feature availability (§11.9).
 8. **License terms are enforced, not just declared** — see the License block above. No feature ships that would let SchulOS or a derivative be sold, and any revenue-capable feature (currently: Module B sponsor slides) carries a visible reminder of the environmental-donation requirement in its own admin UI.
 > **Hard disclaimer to carry into the product and into `docs/`:** This PRD gives the *engineering* requirements needed to make legal compliance *possible*. It is not legal advice. Every school deploying this platform **must** involve its own **Datenschutzbeauftragter (DPO)**, its **Schulträger**, and — for co-determination matters — its **Personalrat/Lehrerrat** before go-live (see §11.9).
 ---
 ## 1. Reference Product Analysis (functional inspiration only, not a visual/brand copy)
 **Digidoo** (digidoo.com) is a German/Austrian EdTech SaaS. Do **not** copy their branding, illustrations, exact wording, logo, or any copyrighted text/images — build an original UI/UX and original copywriting, only inspired by the **feature set and workflow concept**. Core concepts we reproduce functionally in **Module A** (§4):
 - **Competency grids ("Kompetenzraster")**: pre-built and customizable sets of subject/grade-level competencies teachers can use as templates or fully customize.
 - **Learning progress entries**: teachers log individual observations per student, linked to one or more competencies, over time (a running log, not a snapshot).
 - **Performance assessments ("Leistungsfeststellung")**: structured tests/assignments/checks linked to competencies, feeding the same student timeline.
 - **Competence Flower ("Kompetenzblume")**: a radar/spider chart per student showing strength per competency category.
 - **One-click reports**: automatically generated, competency-based report text and full report-card documents (PDF).
 - **Grade management ("Notenverwaltung")**: configurable weighting between learning-progress entries and formal assessments to compute a transparent final grade.
 - **Free tier that "just works"**: since this whole project is free, the entire app is simply free — no tiers.
 We explicitly **exclude** anything tied to Digidoo's commercial SaaS business (billing/subscriptions, marketing site, SSO/enterprise integrations like WebUntis) as out of MVP scope.
 ---
 ## 2. Module Map
 The platform is organized into cohesive modules, each owning its data and UI completely (principle #4 above).
 | # | Module | Owns |
 |---|--------|------|
 | A | **Academics Core** | Competency grids, learning-progress entries, assessments, competence flower, grading, report cards |
 | B | **Signage** | TV/billboard displays: announcement slides, sponsor slides, emergency/fire/counseling alerts |
 | C | **Communication** | Direct messaging, escalation rules, class/grade social rooms, class-hours messaging locks |
 | D | **Learning Hub** | Videos, interactive exercises, worksheets, vocab trainer, learning game, AI-assisted content authoring |
 | E | **AI Tutor** | In-context homework help, hint-only policy, full lockout during tests, content translation for foreign students |
 | F | **Exam Mode** | Kiosk/lockdown test-taking, teacher live controls, student warning system, incident log |
 | G | **Digital Notebook** | Typed + stylus/pen notebook per student per subject, teacher pen annotation on tests/homework |
 | H | **Notifications** | All push/in-app notifications — the *only* place alerts render outside their originating context banner |
 | I | **Calendar** | All dates/deadlines/appointments/exam schedules/report deadlines — the *only* source of truth for "when" |
 | J | **Dashboard & Widgets** | Per-user customizable home screen assembled from read-only widgets pulling from A–I |
 | K | **Identity & Admin** | Users, roles, schools, classes, disciplinary records, audit log, permission/rule configuration |
 | L | **Legal & Data Protection** | GDPR/DSGVO compliance engine, retention policy, DPIA gating, RoPA, rights fulfillment for all parties |
 | M | **Core AI Orchestrator** | Self-hosted agent runtime (ZeroClaw) powering the AI Tutor, content-authoring assist, translation, admin/teacher AI assistance, and event-triggered automations (SOPs), running as its own service/container |
 ---
 ## 3. Tech Stack & Container Architecture
 The platform is now explicitly a **four-container system** — frontend, backend, database, and Core AI — each independently deployable, independently scalable, and **fully Kubernetes-compatible** (as well as runnable via a single `docker-compose.yml` for small self-hosted schools). No container reaches into another's storage directly; all cross-container communication is over the internal network via defined APIs.
 ```
 ┌────────────┐     ┌────────────┐     ┌────────────┐     ┌────────────┐
 │  frontend  │────▶│  backend   │────▶│     db     │     │   coreai   │
 │ (Next.js/  │     │ (API svc,  │◀────│ (SQLite /  │◀───▶│ (ZeroClaw  │
 │  React)    │◀────│  business  │     │  libSQL    │     │  agent     │
 │            │     │  logic)    │     │  server)   │     │  runtime)  │
 └────────────┘     └─────┬──────┘     └────────────┘     └─────┬──────┘
                          │                                     │
                          └──────────── backend ◀────────────── ┘
                             (coreai calls back into backend's
                              API for data + acts through it;
                              backend calls coreai for AI/automation)
 ```
 - **Frontend container**: React/Next.js (client-rendered or SSR-lite), TypeScript, Tailwind CSS + shadcn/ui, Recharts/Chart.js for the Competence Flower radar chart. Talks to the backend only via its public API — never touches the DB or CoreAI directly.
 - **Backend container**: a standalone API service (Next.js API-only build, or a dedicated Node/Fastify/Express service — pick one and justify in `docs/ARCHITECTURE.md`) owning all business logic from Modules A–L: auth, permissions, grading, scheduling, escalation policy, compliance gating, etc. This is the **only** service allowed to write to the database and the **only** service allowed to call CoreAI (§12) — CoreAI never talks to the DB directly, keeping one clear, auditable data-access boundary (this also makes Module L's audit logging and access-control-by-default trivial to enforce, since there's exactly one write path).
 - **Database container**: **SQLite stays the DB engine** (§0.1), but to satisfy "DB in its own container" in a real multi-pod/Kubernetes topology, run it via **libSQL (`sqld`)** — an open-source, SQLite-file-compatible server (same file format and SQL semantics as SQLite) that speaks a normal network protocol (HTTP/gRPC), so the backend container can reach it like any other network database instead of requiring a shared filesystem mount. For the simplest single-VPS/docker-compose self-hosting path, a school can instead run the plain SQLite file colocated with the backend container (via a shared volume) — document both modes in `docs/ARCHITECTURE.md`/`docs/SELF_HOSTING.md`, with libSQL/`sqld` as the default for the Kubernetes deployment path and plain file-mode as the default for the single-VPS docker-compose path. Either way, backups/retention/erasure logic in Module L operates identically since the SQL surface is the same.
 - **CoreAI container**: runs **ZeroClaw** (zeroclaw-labs/zeroclaw) as the platform's self-hosted agent runtime/"core brain" — see **Module M**, §12, for full detail.
 - **Auth**: self-hosted email/password (argon2id hashing) + session cookies (Lucia Auth / Auth.js), issued and validated only by the backend container. No third-party paid auth. Optional TOTP 2FA.
 - **PDF generation**: `@react-pdf/renderer` or Puppeteer-based HTML-to-PDF, run inside the backend container (or a short-lived job container it spawns) for report cards.
 - **File storage**: local filesystem on a persistent volume mounted to the backend container, abstracted behind a storage interface so S3-compatible storage can be swapped in later without touching business logic.
 - **i18n**: German and English UI strings from day one (`next-intl` or equivalent) — all UI text through translation keys, never hardcoded.
 - **PWA/Kiosk infrastructure**: **Workbox**, in the frontend container's build, for the service worker — offline shell caching, reliable kiosk/fullscreen "install as app" behavior, and Web Push delivery (Modules F, H, §12).
 - **Worker offloading**: **Comlink**, in the frontend, to offload heavy client-side work (stylus stroke processing in the Digital Notebook, client-side AI-translation pre/post-processing) to a Web Worker via simple RPC, keeping the main thread responsive for touch input.
 - **AI/semantic search (optional)**: **Chroma**, run either as a fifth optional container or embedded within the CoreAI container, for semantic search over Learning Hub resources and retrieval-augmented context for the AI Tutor — see §12. Never a hard dependency; a school without AI features enabled never needs to run it or the CoreAI container's heavier model-provider paths.
 - **Testing**: Vitest/Jest (unit), Playwright (E2E for critical flows: login, create competency grid, log an entry, generate report, run an exam session, and — new — a CoreAI automation smoke test, §12).
 ### 3.1 Kubernetes Deployment
 - Provide both `docker-compose.yml` (frontend, backend, db, coreai — four services, for small self-hosted single-VPS schools) **and** a `/k8s` manifest set (or Helm chart) for schools/districts that want proper Kubernetes deployment:
  - `Deployment` for **frontend** (stateless, horizontally scalable, `HorizontalPodAutoscaler` optional).
  - `Deployment` for **backend** (stateless application logic; if running plain-file SQLite mode this must stay single-replica — document that constraint clearly; libSQL/`sqld` mode removes it).
  - `StatefulSet` + `PersistentVolumeClaim` for **db** (whichever mode is chosen).
  - `Deployment` for **coreai** (ZeroClaw runtime + its own gateway/dashboard, §12), with its own `PersistentVolumeClaim` for agent memory/config, and resource limits sized for whichever model-provider mode is configured (remote API vs. local model).
  - `Service` objects for internal DNS between all four; `Ingress` exposing only frontend (and backend's public API surface if needed) externally — **coreai's dashboard/gateway is never exposed externally by default**, only reachable from backend and from admin users via a backend-proxied, authenticated route (§12.4).
  - `NetworkPolicy` restricting: frontend → backend only; backend → db and backend → coreai; **coreai has no direct network path to db** (§12, data-access boundary); explicit egress rules for coreai's model-provider calls if using a remote LLM API.
  - `Secret`s for DB credentials/connection strings, model-provider API keys, session/auth signing keys; `ConfigMap`s for Module L's policy tables' bootstrap values and any non-secret runtime config.
 - Reference `zeroclaw-labs/zeroclaw`'s own `deploy-k8s/` folder as a starting point for the CoreAI container's manifests specifically, adapting rather than reinventing.
 Deliver `docs/ARCHITECTURE.md` (stack rationale, four-container boundary rules, self-hosting path) and `docs/SELF_HOSTING.md` (both docker-compose and Kubernetes deployment paths, written for a non-technical school IT admin where possible, with a clearly marked "needs a Kubernetes-literate admin" section for the K8s path).
 ---
 ## 4. Module A — Academics Core
 ### 4.1 Entities
 **Organizational:**
 - **School** — id, name, schoolType (elementary/middle/gymnasium/other), country, timezone, createdAt.
 - **User** — id, schoolId (nullable), email, passwordHash, firstName, lastName, role, locale, twoFactorSecret (nullable), createdAt, deletedAt (soft delete).
 - **SchoolYear** — id, schoolId, label, startDate, endDate.
 - **ClassGroup** — id, schoolId, schoolYearId, name, gradeLevel, schoolType.
 - **ClassGroupTeacher** (M:N) — classGroupId, userId, role (HOMEROOM_TEACHER, SUBJECT_TEACHER).
 - **Student** — id, schoolId, firstName, lastName, dateOfBirth (nullable, minimize what's collected), externalId (nullable, import matching), createdAt, deletedAt.
 - **Enrollment** — id, studentId, classGroupId, schoolYearId, startDate, endDate (nullable = still enrolled) — models students moving between classes/schools over time.
 **Subject & competency structure:**
 - **Subject** — id, schoolId (nullable = global template), name, gradeLevelMin/Max.
 - **CompetencyTemplate** — id, name, description, subjectId (nullable), schoolType, gradeLevelMin/Max, isGlobalTemplate, createdByUserId (nullable for system templates), version.
 - **CompetencyCategory** — id, competencyTemplateId, name, order (groups competencies into "petals" of the flower — e.g. Reading/Writing/Listening within Language Arts).
 - **Competency** — id, categoryId, code, title, description, order, masteryLevels (related table).
 - **MasteryLevelDefinition** — id, competencyId (or categoryId if shared), levelValue, label, description.
 - **ClassCompetencyAssignment** — links a ClassGroup+Subject to a chosen CompetencyTemplate for a SchoolYear, plus per-school customizations. **Clone-on-customize**: assigning a template creates an editable school-owned copy so edits never mutate the global template.
 **Progress & assessment:**
 - **LearningProgressEntry** — id, studentId, competencyId, teacherId, classGroupId, date, masteryLevelValue, note (optional), createdAt — append-only observation log.
 - **Assessment** ("Leistungsfeststellung") — id, classGroupId, subjectId, teacherId, title, date, type (TEST/ORAL/PROJECT/HOMEWORK/OTHER), maxScore (nullable), weight, **deliveryMode** (enum incl. `DIGITAL_LOCKED`, which triggers Module F's kiosk flow).
 - **AssessmentCompetencyLink** (M:N) — assessmentId, competencyId, weight.
 - **AssessmentResult** — id, assessmentId, studentId, score (nullable), masteryLevelValue (nullable), note.
 **Grading:**
 - **GradingScheme** — id, classGroupId or subjectId, name, type (NUMERIC_GRADE/VERBAL_FEEDBACK/COMBINED), scaleDefinition (JSON, configurable per country/state).
 - **GradingWeightRule** — id, gradingSchemeId, sourceType (LEARNING_PROGRESS/ASSESSMENT), targetRef, weightPercent.
 - **ComputedGrade** — id, studentId, subjectId, classGroupId, schoolYearId, period, computedValue, computedAt, isFinalized, **finalizedByUserId (required, human — see §11.5)**, overriddenValue (nullable), overrideReason.
 **Reporting:**
 - **Report** — id, studentId, classGroupId, schoolYearId, period, generatedByUserId, generatedAt, status (DRAFT/FINAL), pdfFilePath, includesGrades, optional appendix of Digital Notebook entries for the period (teacher-selectable, off by default).
 - **ReportSection** — id, reportId, competencyCategoryId (nullable), generatedText, order.
 **Auditing:**
 - **AuditLog** — id, userId, action, entityType, entityId, timestamp, metadata (JSON).
 - **DataExportRequest** — id, requestedByUserId, scope, status, filePath, requestedAt, completedAt.
 **Design requirements:** UUID/ULID primary keys (not SQLite-only autoincrement, for portability). All timestamps UTC. Soft deletes on Student/User with an explicit, audit-logged "permanently erase" flow, never a silent hard delete. SQLite WAL mode enabled; document backup strategy (copy the `.sqlite` file + files directory; consider `litestream`). Seed script (`prisma/seed.ts`) creates a demo school, teacher login, 2 classes, ~15 students, one sample competency template (Math + German, elementary, 2 categories, ~6 competencies each, 4-point scale), sample entries and one assessment — app explorable immediately after `docker-compose up`.
 ### 4.2 Roles for this module
 Teacher, School Admin, Super Admin — see full role model in §10 (Module K), which extends this with Counselor, Parent, Student, and DPO.
 ### 4.3 Core user stories
 - **Onboarding & auth:** register/login/reset with argon2id-hashed passwords, optional TOTP 2FA, rate-limited login, CSRF protection on mutating routes.
 - **School/class/student setup:** create classes, set grade level/school type, add students (manual or CSV import with preview + error list + re-run).
 - **Competency grid management:** browse starter templates filtered by school type/grade/subject; assign (clone) to a class+subject; edit the school's copy or build custom.
 - **Logging learning progress:** fast entry from a class roster (<3 interactions), full student timeline, entries editable by the original author within a configurable window, all edits audit-logged.
 - **Assessments:** create, link to competencies with weights, bulk spreadsheet-like results entry for a whole class.
 - **Competence Flower:** per-student radar chart, aggregation method configurable per template (latest value / average of last N / weighted by recency), hover/tap shows underlying entries, exportable as PNG/SVG.
 - **Grade computation:** transparent weighted breakdown, manual override with required justification (audit-logged), computation is a pure deterministic function with unit tests covering edge cases (missing data, all-verbal, partial-year enrollment).
 - **Reports:** draft → review/edit → finalize (locked + versioned) → PDF, single or bulk-class export, phrase-template system (data-driven, not hardcoded) for narrative text per mastery level.
 - **Data portability & privacy:** export all class/school data as JSON/CSV; permanent erasure with confirmation + audit trail, cascading correctly including generated PDFs on disk (this flow is unified with Module L's rights fulfillment, §11.5).
 - **Dashboard:** classes, recent activity, students without a recent entry (follow-up flag), upcoming report deadlines — surfaced as widgets in Module J, not a separate dashboard implementation.
 ---
 ## 5. Module B — Signage (TV / Billboards)
 Replaces physical bulletin boards with school-controlled TV displays for announcements, class/period info, sponsor content, and emergency alerts.
 **Roles:** Admin/Management authors & publishes; sponsor content is admin-approved only (no self-serve); teachers can request a slide (goes to an approval queue by default, config-togglable to trusted self-publish for INFO-type slides).
 **License note (see §0):** if a school chooses to run sponsor slides that generate any revenue, that revenue is subject to SchulOS's license terms — it must be donated to an environmental protection agency or association, never kept as school or vendor income. The sponsor-slide creation UI must surface this requirement plainly to the admin at the point of setting up a sponsor slot, not just leave it to `LICENSE.md`.
 **Entities:**
 - **SignageDisplay** — id, schoolId, location/name, resolution profile, isActive.
 - **SignageSlide** — id, schoolId, type (ANNOUNCEMENT/SPONSOR/INFO/SCHEDULE), title, body/media, priority, startAt, endAt, createdByUserId, approvalStatus.
 - **SignagePlaylist** — id, displayId (or all displays), ordered slide list, rotation duration per slide.
 - **EmergencyAlert** — id, schoolId, type (FIRE/LOCKDOWN/MEDICAL/GENERAL_EMERGENCY/COUNSELING_NOTICE), message, triggeredByUserId, triggeredAt, resolvedAt, affectedScope.
 **Core flows:**
 - Normal rotation cycles active, date-windowed slides weighted by priority.
 - **Emergency override (highest priority, non-negotiable):** any `EmergencyAlert` immediately interrupts every display's rotation with a full-screen, type-styled alert, and simultaneously fires a push notification (Module H) to staff, and for FIRE/LOCKDOWN to logged-in students/parents per school policy. Clears only on explicit resolution by an authorized user, logged in AuditLog.
 - **Counseling notice**: lower-urgency, staff-facing only variant — not broadcast school-wide, avoids exposing a student's need for support (also see §11.3).
 - Sponsor slides: admin-uploaded, date-windowed, weighted rotation, never auto-published from a teacher request.
 ---
 ## 6. Module C — Communication (Messaging & Escalation)
 The escalation logic is implemented as **data-driven policy rows**, never hardcoded if/else chains.
 **Entities:**
 - **MessageThread** — id, schoolId, type (DIRECT/CLASS_ANNOUNCEMENT/SOCIAL_ROOM), participantsOrScope.
 - **Message** — id, threadId, senderId, body, sentAt, readReceipts.
 - **EscalationPolicy** — id, schoolId, fromRole, toRole, requiredPriorContactRole, waitingPeriodBusinessDays (default 3), isActive, overriddenByUserId (nullable). **All numbers here are read from this table, never hardcoded.**
 - **EscalationRequest** — id, requesterId, subject, firstContactThreadId, firstContactAt, eligibleToEscalateAt (computed using the school calendar to skip holidays — Module I), status (WAITING/ELIGIBLE/ESCALATED/RESOLVED).
 - **SocialRoom** — id, schoolId, scope (CLASS/GRADE_LEVEL/CUSTOM_GROUP), name, moderatorUserIds, isActive.
 - **ClassMessagingLock** — id, classGroupId, lockedByUserId, lockedFrom, lockedUntil (nullable = "until class ends," period-aware via Module I).
 - **DisciplinaryRecord** — id, userId, type, description, issuedByUserId, linkedIncident (nullable FK to an ExamWarning or reported message), visibleToParent (bool, enforced access control, not just UI — §11.5), createdAt.
 **Core rules (default `EscalationPolicy` rows, admin-editable):**
 - **Parent → Admin:** only for genuinely necessary matters, and only after messaging the student's homeroom teacher first. If no reply within **3 business days**, the parent gains the right to escalate to Admin on that thread.
 - **Student → Admin/Counseling:** same pattern — homeroom teacher first, then counseling/admin after 3 business days without reply.
 - **Teacher → Admin:** direct, no escalation gate.
 - **Admin override:** can loosen, tighten, or remove any `EscalationPolicy` row, or grant a case-by-case exception (logged with reason). Can issue a `DisciplinaryRecord` against a teacher or student from a messaging or exam-incident context.
 - **Social rooms:** class- or grade/"Stufe"-scoped group discussion spaces, moderated, config-controlled per school (which scopes enabled, moderation-before-visible or not).
 - **Class-hours lock:** teacher toggles `ClassMessagingLock` for their class; students blocked from student↔student and student↔staff messaging until lifted (auto-lift at period end via Module I, or manual — config toggle) — students still receive urgent Signage/Notification-level alerts.
 - **True-emergency bypass:** the escalation queue always has a parallel "urgent safety concern" path that skips the 3-business-day gate entirely (§11.7) — the escalation rule is a workflow-efficiency rule, never a barrier to reporting a genuine safety issue.
 Business-day computation reads the school's holiday/weekend calendar from Module I, never assumes fixed Mon–Fri.
 ---
 ## 7. Module D — Learning Hub
 A curriculum-aligned self-study resource center, functionally inspired by tools like Sofatutor — original or licensed/open content only, organized the same *way* (by subject/grade), never copying branding, exact video content, or exact wording.
 **Entities:**
 - **LearningResource** — id, schoolId (nullable = shared library), subjectId, gradeLevel, type (VIDEO/INTERACTIVE_EXERCISE/WORKSHEET/VOCAB_SET/GAME_MODULE), title, description, contentRef, competencyLinks (M:N to `Competency`, so resources surface contextually — e.g. from a weak competency-flower petal), createdByUserId, reviewStatus (DRAFT/PENDING_REVIEW/PUBLISHED), aiGenerated (bool).
 - **WorksheetSolution** — attached to a WORKSHEET resource, hidden by default, revealable by student after attempt or by teacher setting.
 - **VocabSet / VocabItem** — vocab lists feeding a spaced-repetition vocab trainer.
 - **GameProgress** — per-student progress/score for the learning game, scoped by subject.
 **Core flows:** teachers/admin create/edit or request AI-assisted drafting (always lands `PENDING_REVIEW`, never auto-published — human review required). Resources are discoverable by subject/grade browse, search, and contextually (surfaced next to a weak Competence Flower petal and in AI Tutor suggestions). Printable worksheets export as PDF with a teacher toggle to include/exclude the solutions page.
 ---
 ## 8. Module E — AI Tutor & AI Content Assistance
 **Hard policy — enforced server-side, not just prompt instructions:**
 - **May**: explain a concept, walk through a *similar* worked example, give a hint, define a term, nudge toward the next step on a specific question.
 - **Must never**: produce a direct final answer to an assigned homework/assessment question, complete an assignment for the student, or operate at all while any `Assessment` with `deliveryMode = DIGITAL_LOCKED` is active for that student — the AI chat endpoint independently checks "is this student currently inside an active exam session?" server-side and refuses if so, regardless of client-side UI state (ties into Module F's defense-in-depth, §8).
 - Every interaction is logged (`AiTutorInteraction`: id, studentId, subjectId/competencyId, promptSummary, responseSummary, timestamp, flaggedAsHomeworkAttempt) for teacher/admin audit — defaulting to **summary-only, pseudonymized** retention per §11.2/§11.3, with a school-configurable toggle for full-transcript retention and an explicit retention period from Module L.
 - **Translation:** on-demand AI translation of learning content (and optionally UI copy) for foreign-language students, labeled "AI-translated," with a flag-for-review path for bad translations. Home-language inference from translation requests is treated with the same minimization discipline as any other data point (§11.3) — no persistent linguistic/ethnic profile is built.
 - **Content-authoring assist** (bridges Module D): the same AI capability drafts Learning Hub resources or Signage copy, always landing in a review/draft state.
 Module E must never ship ahead of Module F's server-side test-time gate (§16, phasing).
 ---
 ## 9. Module F — Exam Mode (Digital Lockdown & Proctoring)
 **Entities:**
 - **ExamSession** — id, assessmentId, studentId, deviceId, startedAt, status (ACTIVE/PAUSED/RESUMED/ENDED/CANCELLED), pausedByUserId (nullable), pauseReason (BATHROOM_REQUEST/TEACHER_INITIATED/STUDENT_DISTRESS/THIRD_WARNING/OTHER).
 - **ExamWarning** — id, examSessionId, issuedByUserId, reason, sequenceNumber, issuedAt.
 - **ExamIncidentEvent** — id, examSessionId, type (LOCK_BREACH_ATTEMPT/BATHROOM_REQUESTED/BATHROOM_GRANTED/DISTRESS_SIGNAL/PAUSED/RESUMED/CANCELLED), metadata, timestamp.
 **Core flow:**
 1. Opening a `DIGITAL_LOCKED` assessment enters **kiosk/fullscreen lockdown** — device locks to the exam UI only, no other tabs/apps, no AI Tutor access (hard-gated), timer visible per config.
 2. **Bathroom request:** student taps "request break" → real-time alert to teacher (Module H) → teacher approval pauses that individual `ExamSession` only → resumes on return.
 3. **Distress signal:** student sends "I feel unwell / need help" at any time → immediate high-priority alert, distinct styling/sound from a routine request → teacher attends; unresolved → teacher pauses or cancels that student's exam (reason required, logged, visible to parent/admin). **This is health-adjacent data — store only a minimal event flag plus optional free text, never a structured symptom/diagnosis field, restricted to need-to-know visibility (§11.3).**
 4. **Behavior warnings:** teacher issues an `ExamWarning` for talking/looking around, etc. 1st and 2nd logged and shown to the student (2nd explicitly "final warning"); 3rd **auto-pauses** that student's exam — but the **pause itself** is a safety/integrity mechanism, not an Art. 22 "decision" about the student; any resulting **disciplinary consequence** requires a human to actually create the linked `DisciplinaryRecord` — the system never auto-generates one (§11.5).
 5. Teacher gets a live **class exam-monitor view**: every student's session status at a glance, one-tap pause/resume/cancel/warn.
 6. Lockdown enforcement is **defense-in-depth**: client-side kiosk/fullscreen API + Workbox service worker to intercept navigation attempts, **and** an independent server-side session flag blocking AI Tutor/Learning Hub/Messaging calls for the duration — never trust the client alone for an integrity feature.
 Module F is the highest integrity/device-sensitivity module — see phasing (§16): built last, after the touch/kiosk foundation (§3 tech stack) is mature.
 ---
 ## 10. Module G — Digital Notebook
 Digital replacement for the paper exercise notebook (explicit environmental motivation), supporting Germany's range of notebook/exercise-book conventions.
 **Entities:**
 - **NotebookTemplate** — id, schoolId (nullable = global), name, ruling type (lined/squared-Kariert/blank), gradeLevel/subject applicability.
 - **NotebookPage** — id, studentId, subjectId, classGroupId, templateId, createdAt, content (typed text blocks + vector "ink" strokes stored as SVG/stroke-JSON, not raster, so it stays editable/searchable/annotatable).
 - **NotebookAnnotation** — id, pageId (or linked Assessment submission), authorUserId, strokeData/comment, createdAt — non-destructive teacher correction marks, captured as its own layer so original student work is never overwritten.
 **Core flows:** students write via keyboard and/or stylus, both coexisting on a page. Teachers annotate directly on a digital test/notebook page with pen input (highlighting, circling, margin comments), mirroring paper red-pen correction. Pages organized per subject per student per school year, browsable page-by-page/date-by-date, exportable as PDF.
 ---
 ## 11. Cross-Cutting Modules H–K, and Module L (Legal & Data Protection)
 ### 11.1 Module H — Notifications (single source of alerts)
 Every push/in-app alert — messaging, exam warnings/bathroom requests, signage emergencies, escalation-eligibility notices, learning-hub review-queue items — routes through **one** `Notification` entity and **one** delivery pipeline (Web Push API via Workbox service worker + an in-app notification center). No module renders its own separate toast/badge system; every other module *emits into* Module H (per §0.4).
 `Notification` — id, recipientUserId, type, priority (NORMAL/URGENT/EMERGENCY), title, body, deepLinkRef, createdAt, readAt, deliveredChannels (JSON).
 ### 11.2 Module I — Calendar (single source of "when")
 All dates live here: class timetable/periods, exam schedules, report-card deadlines, school holiday calendar (feeds Module C's business-day math), signage slide date windows (read-only reflection of `SignageSlide.startAt/endAt`, not a duplicate field). Same non-duplication logic applies to every other module with a date.
 ### 11.3 Module J — Dashboard & Widgets
 Every role gets a customizable home dashboard: add/remove/reorder widgets from an approved catalog, each a thin read-only view into one owning module. Layout persists per user (`UserDashboardLayout` — userId, widgetInstances JSON: widgetType, position, size, config). Widgets never contain business logic beyond fetch/render — structurally enforcing §0.4.
 ### 11.4 Module K — Identity, Roles & Admin
 Roles: **Teacher**, **School Admin**, **Super Admin** (project/instance maintainer), **Counselor** ("Rehberlik" — receives escalated threads per Module C), **Parent** (read-only into their child's reports/grades/flower/visible disciplinary records, messaging per Module C), **Student** (Learning Hub, gated AI Tutor, Exam Mode, Digital Notebook, gated Communication), and **DPO** (Module L, §11.8 — compliance-surface read access + gate-approval power over high-risk modules). Sponsor is not a login role — sponsor content is admin-managed only. All escalation thresholds, warning limits, kiosk toggles, and messaging rules are exposed in a single **Admin Policy Console** so a non-technical admin can tune the entire rules engine without a code change.
 ### 11.5 Module L — Legal, Data Protection & Rights Compliance (EU/DE)
 This module governs every other module. It layers **EU GDPR (DSGVO)**, the **German Federal Data Protection Act (BDSG)**, and the **state-level School Acts (Landesschulgesetze) and School Data Protection Ordinances**, which vary across all 16 Bundesländer and often override/supplement the GDPR baseline for public schools — plus **Landespersonalvertretungsgesetz (LPVG)/BPersVG** for staff co-determination, and general child-rights principles (KJSG/UN-CRC).
 **Data protection by design & default (Art. 25), applied to every module:**
 - Data minimization at schema level — every optional field defaults to *not collected* (e.g., `Student.dateOfBirth` stays nullable, populated only if state rules actually require it).
 - Purpose limitation — each table documents its legal basis/purpose in `docs/DATA_MODEL.md` (e.g., `ExamWarning` → exam integrity & pedagogical record; legal basis: Schulgesetz duty of fair assessment).
 - Pseudonymization where feasible (e.g., `AiTutorInteraction` stores a pseudonymous reference by default).
 - Storage limitation — every personal-data entity has a `retentionPolicyRef` into `DataRetentionPolicy` (below), swept by a scheduled job, never a manual "someone remembers" process.
 - Access control defaults to deny — a Teacher's access to a student is scoped to classes currently taught; losing that assignment auto-narrows access.
 **Special-category / sensitive data (Art. 9) — explicit flags at every touchpoint:**
 - The Exam Mode **distress signal** (§8) is health-adjacent: minimal event flag only, restricted visibility, short default retention unless it escalates into a formal record.
 - `DisciplinaryRecord` — highly sensitive minor data even if not technically Art. 9; same need-to-know visibility model; `visibleToParent` is a real enforced access-control flag, never just a UI toggle.
 - Signage **counseling notices** (§5) never broadcast identifying detail school-wide.
 - No field anywhere in the schema for race/ethnicity/religion/sexual orientation/union membership/political opinion — explicitly out of scope, permanently.
 **Teacher rights & staff co-determination (Personalrat/unions):**
 - Any feature capable of monitoring staff behavior or performance (`AuditLog` on teacher actions, message read-receipts, exam-monitor response-time visibility, content-approval analytics, etc.) **triggers Personalrat co-determination rights** under the relevant state LPVG (or BPersVG) — analogous to § 87(1) No. 6 BetrVG in the private sector.
 - Before shipping to a real school, each such feature needs a **Dienstvereinbarung-ready spec sheet** (`docs/personalrat/<module>.md`): what's logged, who sees it, retention, and an explicit statement it won't be used for unilateral performance evaluation without Personalrat agreement.
 - Recommend looping in **GEW/VBE** and the Personalrat during rollout — surfaced as a required onboarding checklist item (§11.9) before enabling any monitoring-capable module.
 - Teachers get the same self-service data-export as students (reusing the one pipeline, §0.4), and a per-teacher "quiet hours" setting for non-urgent notifications (urgent/emergency alerts always bypass this by design).
 **Student rights:**
 - **Access (Art. 15):** full export via the one Module K export pipeline — competency entries, grades, notebook pages, messages, disciplinary records, AI Tutor interaction summaries.
 - **Rectification (Art. 16):** via existing audit-logged edit flows in Module A.
 - **Erasure (Art. 17), bounded by retention duties:** account/active data erasable on request or on leaving school, except records under an active `DataRetentionPolicy`; erasure response reports what was retained and why.
 - **No solely-automated decisions with legal/significant effect (Art. 22):** `ComputedGrade.isFinalized` cannot become `true` without a `finalizedByUserId` (a human). Exam Mode's third-strike **pause** may be automatic (safety mechanism), but any resulting `DisciplinaryRecord` requires a human actor — never auto-generated.
 - **No repurposing into a broader "risk score"** or similar — explicitly a forbidden feature (not just unbuilt), documented in `docs/ROADMAP.md`'s "will not build" section.
 **Retention periods — config-driven (extends §0.2):**
 - New entity **DataRetentionPolicy** — id, schoolId, dataCategory (LEARNING_PROGRESS/ASSESSMENT_RESULT/FINAL_REPORT/DISCIPLINARY_RECORD/EXAM_INCIDENT/MESSAGE/AI_TUTOR_LOG/NOTEBOOK_PAGE/SIGNAGE_LOG), retentionPeriodMonths, legalBasisNote (free text, filled by the school's DPO), reviewedByUserId, reviewedAt.
 - Ship **empty of defaults** for legally-mandated categories (forces the DPO to enter their state's actual correct numbers, never a guessed default); ship **modest editable defaults** for non-mandated, product-only categories (e.g., AI Tutor log summaries ~12 months).
 **Parent rights:**
 - **Information duty (Art. 13/14):** plain-language privacy notice generated from the same module documentation/retention config, so it can never drift from what the system actually does.
 - **Consultation/approval before rollout:** most state School Acts require **Schulkonferenz**/**Elternbeirat** consultation before new pupil-data software goes live — a literal onboarding checklist step (§11.9); no silent activation of high-impact modules (Signage emergency broadcast, Exam Mode, AI Tutor) without acknowledging this happened.
 - **Access to their child's records:** grades, reports, competence flower, `visibleToParent`-flagged disciplinary entries — never paywalled or admin-discretionary in a way that would violate this right.
 - **Messaging rights:** the escalation rule (§6) is a workflow-efficiency rule, never a barrier to a genuine safety concern — a parallel urgent path always bypasses the gate.
 **School's rights & obligations (controller responsibilities):**
 - **Controller vs. processor:** the school (via its Schulträger) is normally the data controller; a self-hosted instance run by the school itself simplifies Art. 28 needs, while a third-party-operated instance requires a signed **Art. 28 AVV** — ship a starting-draft template in `docs/legal/avv-template.md`, explicitly marked for the DPO/lawyer to finalize.
 - **Records of Processing Activities (Art. 30):** `docs/legal/verzeichnis-verarbeitungstaetigkeiten.md`, generated mechanically from each module's purpose+legal-basis notes.
 - **DPIA (Art. 35):** the platform plausibly meets mandatory-DPIA criteria (large-scale children's-data processing, systematic monitoring via Exam Mode, health-adjacent signals). **Modules E (AI Tutor) and F (Exam Mode) stay disabled in the Admin Policy Console until a `DpiaRecord`** (id, schoolId, moduleScope, completedAt, approvedByUserId, documentRef) exists.
 - **DPO role** (Module K extension): read access to RoPA, retention policy table, DPIA records, and school-wide audit logs, plus gate-approval power over high-risk modules.
 **Product-level compliance onboarding gate** — implemented as a required flow for every new school instance before real student data is usable:
 1. Enter Schulträger/DPO contact details.
 2. Select the Bundesland → auto-loads that state's known retention-period *prompts* (labels only, never assumed numbers) into `DataRetentionPolicy` for confirmation.
 3. Log Elternbeirat/Schulkonferenz consultation status per module before it can go live for real use.
 4. Log Personalrat consultation status for every monitoring-capable module.
 5. Complete/upload the DPIA before Modules E and F unlock.
 6. Only then does the Admin Policy Console allow those modules to leave "disabled" state.
 This makes compliance a DB-driven, enforced product flow, consistent with §0.2/§0.6 — never a one-time audit forgotten after launch.
 **On the `Klotzkette/claude-fuer-deutsches-recht` reference repository:** a large, community-maintained collection of Claude Code skills/prompts for German legal practice (labor, corporate, insolvency, data-protection, procedural law, plus Schulrecht/Hochschulrecht clusters), explicitly published as an experimental legal-drafting aid, not a certified compliance product. **Bounded recommended use:** consult its `datenschutzrecht` skill as a drafting assistant when preparing the AVV template, the RoPA structure, and the parent-facing privacy notice — a faster, correctly-structured first draft. **Never** treat its output (or this PRD's, or any AI's) as a substitute for sign-off by the school's actual DPO or legal counsel — every generated `docs/legal/*.md` file should carry that disclaimer as a literal header. It is a prompt/skill library, not a runtime dependency — keep it entirely out of the app's dependency tree.
 ---
 ## 12. Module M — Core AI Orchestrator (ZeroClaw)
 ### 12.1 Purpose
 A single, self-hosted **"core brain"** service that (a) powers every AI-driven capability already specified elsewhere in this PRD (AI Tutor §8, Learning Hub content-assist §7, translation §8, report-narrative drafting §4.3) through **one** implementation instead of scattered ad hoc AI calls — consistent with §0.4's no-duplication principle — and (b) adds **automations and an assistant surface for Admin, Teachers, and Students**, reachable through the web UI, plus **event-triggered background automations (SOPs)** that keep the school running without a human having to remember every routine task.
 Built on **ZeroClaw** (`zeroclaw-labs/zeroclaw`) — a self-hosted, provider-agnostic agent runtime (Rust) with: a gateway + web dashboard, pluggable LLM providers (Anthropic, OpenAI, local Ollama, ~20 others — so a school can choose a paid API or a fully local/free model), a security-first "supervised by default" autonomy model with sandboxing and cryptographic tool receipts on every action, and an event-triggered **SOP (Standard Operating Procedure) engine** (cron / webhook / MQTT-style triggers with approval gates and resumable runs). This maps cleanly onto what the school asked for: a core system that manages/oversees the project, helps admin, and helps teachers and students in various situations.
 ### 12.2 Non-negotiable boundary rules (extends §0 and Module L)
 1. **CoreAI never talks to the database directly.** All data it needs or writes flows through the **backend's API**, using scoped, audited service credentials — never a raw DB connection. This keeps the "one write path" property from §3 intact and means every CoreAI action is subject to the exact same permission/audit-log/retention rules as a human user's action (Module K/L).
 2. **CoreAI must independently enforce Module F's exam-lockdown gate.** Even though the backend already refuses AI Tutor calls during an active `DIGITAL_LOCKED` exam session (§8), CoreAI's own request handler checks the same "is this student in an active exam session?" flag before responding to any tutoring-style request — defense-in-depth, not trust-the-caller (§9's principle, restated here for the AI layer specifically).
 3. **No autonomous high-stakes actions.** CoreAI runs in ZeroClaw's `supervised` autonomy mode by default for this deployment, and the following actions are **hard-configured as always requiring human approval**, never auto-executed even in a future "trusted" mode: finalizing a `ComputedGrade`, creating a `DisciplinaryRecord`, triggering an `EmergencyAlert`, sending a school-wide broadcast notification, or modifying any `EscalationPolicy`/`DataRetentionPolicy`/other Module L policy row. This mirrors Module L's Art. 22 "no solely-automated decisions" requirement (§11.5) and extends it as an engineering constraint on the agent runtime itself, not just on the grading algorithm.
 4. **Every interaction is logged**, extending the existing `AiTutorInteraction` pattern (§8) into a general `CoreAiInteractionLog` (id, actorUserId, actorRole, requestType [TUTOR_HINT / CONTENT_DRAFT / TRANSLATION / ADMIN_ASSIST / TEACHER_ASSIST / SOP_RUN], promptSummary, responseSummary or actionTaken, timestamp), retained per a `DataRetentionPolicy` row like any other personal-data category (§11.5) — summary-only/pseudonymized by default, full-transcript retention as a school-configurable opt-in.
 5. **Version updates are pulled deliberately, not silently.** A scheduled job checks `zeroclaw-labs/zeroclaw` GitHub releases for the latest tagged version and opens an **update-available notice** in the Admin Policy Console (§11.4) — it never auto-replaces the running container image in production without an admin approving the upgrade (rebuild/redeploy), consistent with Module L's "no silent activation of a module" philosophy (§11.9). Pin the running version explicitly in `docker-compose.yml`/the K8s `Deployment` image tag; the update job only proposes a new pin.
 ### 12.3 Capabilities (mapped to existing modules — no new AI logic duplicated elsewhere)
 - **Student-facing (via Module E's existing hard-gated AI Tutor surface):** concept explanations, hints, translation of Learning Hub content — unchanged in policy from §8, now simply *implemented by* CoreAI instead of a bespoke integration.
 - **Teacher-facing assistant:** natural-language help drafting Learning Hub resources or Signage announcement copy (still lands in `PENDING_REVIEW`/admin-approval queues per §5/§7 — CoreAI drafts, a human publishes); summarizing a student's or class's recent competency/assessment trend on request (read-only, sourced via the backend API, never a new parallel analytics store — §0.4); answering "how do I…" product-usage questions about the platform itself.
 - **Admin-facing assistant:** natural-language queries over data the admin is already permitted to see via the backend API ("this week'in sınav uyarı sayısı ne kadar?", "hangi öğrenciler 30 gündür kayıt almadı?" — mirrors the existing dashboard follow-up-flag widget, §4.3), drafting (never sending) parent/staff communications, and surfacing Module L compliance status (DPIA/consultation checklist progress, §11.9) in plain language.
 - **Automations (SOP engine)** — background, event-triggered, still bounded by §12.2's approval rules for anything high-stakes:
  - Scheduled reminders: upcoming report-card deadlines (Module I), pending Learning Hub review-queue items (Module D), retention-sweep due dates (Module L).
  - Anomaly flags surfaced to admin/teacher for human review (never auto-actioned): a student with an unusually high count of `ExamWarning`s in a period, a class with no `LearningProgressEntry` activity in an unusually long window, an `EscalationRequest` that just became eligible (already needs a notification per Module C — CoreAI can be the mechanism that generates and files it via the Notifications module, H, rather than a second notification path).
  - DPIA/consultation-checklist nudges for the DPO/admin during onboarding (§11.9), so the compliance gate isn't just a form nobody remembers to finish.
 ### 12.4 Web interface & access
 - CoreAI's own ZeroClaw gateway/dashboard is **not** exposed publicly. It's reachable only from the backend container internally, and — for admin/DPO users who want direct visibility into agent memory, SOP runs, and tool-call receipts (useful for audit/trust, matching Module L's transparency goals) — through a **backend-proxied, authenticated route** embedded in the platform's own Admin section, inheriting the platform's existing auth/session/role checks rather than standing up a second login system.
 - Student- and teacher-facing AI features appear as ordinary parts of the existing frontend (AI Tutor panel, "draft with AI" buttons in Learning Hub/Signage authoring, admin assistant chat panel) — the person using them never needs to know or care that ZeroClaw is the engine underneath; this keeps the UI unified per §0.4, with CoreAI purely a backend implementation detail of Module M's capabilities.
 ### 12.5 Data flow summary
 `frontend → backend API → (backend decides: handle directly, or call coreai) → coreai (ZeroClaw agent loop, model-provider call, tool use if applicable) → response back to backend → backend applies permission/audit/approval rules → frontend`. CoreAI never receives more data than the specific request needs (principle of least data, §11.2), and never persists school records itself — its only local state is agent memory/config on its own volume plus the `CoreAiInteractionLog` it asks the backend to write on its behalf (same audited write path as everything else).
 ---
 ## 13. Global UI/UX Design System (Cross-Cutting — Not a Separate Page or Menu)
 **Read this section as a mandate that applies inside every module (A–M), not as a feature area of its own.** There is no "tablet view" screen or "mobile menu" anywhere in the product — every screen in the app *is* built from one shared, device-adaptive design system from the start. A module that renders its own one-off layout, spacing scale, or button style instead of using the shared system is a bug, under the same no-duplication principle as §0.4 (which forbids duplicate *functionality*; this section forbids duplicate *visual language*).
 ### 13.1 Device priority (who actually uses what)
 - **Tablet is the primary, default-designed-for surface** — teachers logging entries or running Exam Mode, students in the Learning Hub/Digital Notebook, all predominantly on tablets in a classroom.
 - **PC/desktop is fully supported and important**, especially for Admin/office workflows (Signage authoring, Module L compliance console, bulk grading review) — but it's not assumed to be *the* primary surface; the design system must feel equally native on both, not "tablet with a desktop afterthought" or "desktop squeezed onto tablet."
 - **Mobile phone** gets a constrained but fully functional layout (notifications, messaging, quick lookups) — not the design target, but never broken.
 - One responsive layout engine and one component library serve all three. The same `<Card>`, `<Button>`, `<DataTable>`, etc., adapt their density/spacing per breakpoint — they are never reimplemented per device class.
 ### 13.2 "Feels like a native app," not "a website you're viewing on a tablet"
 - Installable PWA (leveraging Workbox, §3) with a real app icon, splash screen, and standalone display mode — opening it should not look or feel like a browser tab.
 - App-like navigation: a persistent primary navigation (bottom tab bar on tablet/mobile touch contexts, a persistent side rail on desktop) rather than deep menu trees or breadcrumb-only navigation — a teacher moving between "my classes," "notifications," "calendar," and "messages" should never be more than one tap away from any of them.
 - Smooth, purposeful transitions between views (not jarring full-page reloads) and consistent, immediate feedback on every touch interaction (pressed/loading/success/error states defined once in the design system and reused everywhere — never a module-specific spinner or toast style).
 - Gesture support where it aids the primary tablet workflows (e.g., swipe to move between students in a class roster while logging entries) — but never as the *only* way to perform an action; always paired with an explicit tappable control for accessibility.
 - Genuinely large, confident touch targets (44×44pt minimum, larger on primary actions like exam controls and entry-logging buttons) and generous spacing at the tablet breakpoint; the desktop breakpoint is allowed to be denser (smaller controls, more columns, hover states, keyboard shortcuts) since a mouse/keyboard user has different ergonomics — same system, different calibration, documented explicitly per breakpoint in `docs/DESIGN_SYSTEM.md`.
 ### 13.3 Professional, modern, deliberate — not a generic admin-panel template
 - A real design-token set (color palette, type scale, spacing scale, elevation/shadow system, motion/easing curves, iconography) defined once and documented in `docs/DESIGN_SYSTEM.md`, not scattered inline Tailwind classes reinvented per screen.
 - Original visual identity — no reuse of Digidoo's illustrations, palette, or copy (§1); a distinct, warm, education-appropriate accent color and a typeface pairing chosen deliberately, not left at framework defaults. The result should read as a considered, purpose-built product, not an unstyled shadcn/ui scaffold or a generic SaaS-admin-template look.
 - Consistent empty states, loading states, and error states — designed once, reused everywhere (a new module never invents its own "no data yet" illustration or wording style).
 - Dark mode is a reasonable stretch goal (not MVP-required) but if built, is a token-level theme swap, not a second parallel set of hand-styled screens.
 - Full keyboard navigation and screen-reader labels (WCAG 2.1 AA target) built into the shared component library itself, so every module inherits accessibility correctly by construction rather than needing to re-implement it — extended specifically to Signage (legible from a distance) and Exam Mode (usable with assistive tech even inside lockdown, §9).
 ### 13.4 How this is enforced, not just aspired to
 - Ship a **shared component library** (shadcn/ui as the base, customized per §13.3's tokens) as its own package inside the frontend container's codebase; every module imports from it — no module-local component duplicates.
 - Maintain `docs/DESIGN_SYSTEM.md` as the single source of truth for tokens, breakpoints, and component usage patterns, and a component-preview environment (e.g., Storybook or an equivalent lightweight catalog) so contributors can see and reuse existing components before building a new one — checking this catalog before adding a component is a step in the same "check whether it already exists" discipline as §0.4.
 - Empty states and an onboarding checklist for a brand-new school ("1. Create your first class → 2. Assign a competency grid → 3. Add students → 4. Log your first entry") are themselves built from the shared empty-state/checklist components, not a bespoke one-off page.
 - Free browser push notifications via the Web Push API (no paid vendor required) follow the same shared notification-UI pattern everywhere they surface (Module H).
 - German and English complete from day one (`next-intl` or equivalent); default German (DACH audience), English complete since this is an open project others may adopt — all copy flows through the same i18n system so no module ships hardcoded, untranslated strings.
 ---
 ## 14. Non-Functional Requirements
 - **Self-hostability:** one `docker-compose.yml`, one `.env.example`, a `README.md` a non-expert school IT person can follow — target under 10 commands from `git clone` to a running app.
 - **Performance:** SQLite + server-rendered pages where sensible; paginate long lists (rosters, entry timelines).
 - **Backups:** documented, scripted daily backup (cron copying the SQLite file + files directory); consider `litestream`; document SQLite's concurrent-write limits and when a school should be advised to migrate to Postgres.
 - **Security:** Zod (or equivalent) input validation at every API boundary, parameterized queries only, secure cookie flags, rate limiting on auth endpoints, dependency vulnerability scanning in CI. Exam Mode integrity is defense-in-depth (Module F, §9). Emergency Alerts (§5) need the lowest possible latency path, treated as fire-drill-grade reliability, with explicit failure/retry testing.
 - **Data minimization:** AI Tutor logging defaults to summary-only (§8); Digital Notebook stroke data is exportable/erasable like any other student record (§11.5).
 - **Accessibility:** WCAG 2.1 AA across all modules.
 - **CI/CD:** GitHub Actions running lint, typecheck, unit tests, E2E smoke tests on every PR.
 ---
 ## 15. Project Structure (suggested — monorepo housing all four containers)
 ```
 /frontend            # React/Next.js container
  /app or /src
  /components         # shared design-system component library (§13.4) — every module imports from here
  /public
  Dockerfile
 /backend             # API/business-logic container — the only DB + CoreAI caller
  /src
    /api
    /db              # Prisma/Drizzle client, schema (talks to db container/SQLite-or-libSQL)
    /grading         # pure grading calculation functions + tests
    /reports         # report generation + PDF rendering
    /permissions     # authorization helpers
    /compliance      # retention sweeps, DPIA gate checks, RoPA generation, onboarding gate (§11.9)
    /coreai-client    # typed client for calling the coreai container's API (§12.5)
  /prisma (or /drizzle)
    schema.prisma
    seed.ts
    migrations/
  Dockerfile
 /db                   # SQLite-file mode config for docker-compose, OR libSQL/`sqld` server config for K8s mode
  Dockerfile (or reference upstream sqld image)
 /coreai               # ZeroClaw-based container (Module M)
  config/             # ZeroClaw TOML config (providers, agent aliases, SOPs, autonomy/risk profile)
  sops/                # SOP definitions (reminders, anomaly flags, DPIA nudges — §12.3)
  Dockerfile
 /k8s                  # Kubernetes manifests (or Helm chart) — Deployments/StatefulSet/Services/Ingress/NetworkPolicy per §3.1
  frontend/
  backend/
  db/
  coreai/
 /docs
  ARCHITECTURE.md      # four-container boundary rules, stack rationale, self-hosting + K8s paths
  SELF_HOSTING.md
  DATA_MODEL.md        # ER diagram + entity descriptions + purpose/legal-basis notes
  DESIGN_SYSTEM.md     # tokens, breakpoints, component usage patterns (§13.4)
  CONTRIBUTING.md
  ROADMAP.md            # incl. explicit "will not build" section
  /legal
    avv-template.md
    verzeichnis-verarbeitungstaetigkeiten.md
  /personalrat
    <module>.md          # co-determination spec sheets per monitoring-capable module
 /tests
  unit/
  e2e/                  # incl. cross-container flows: frontend → backend → coreai
 docker-compose.yml      # four services: frontend, backend, db, coreai
 .env.example
 README.md
 LICENSE                 # custom SchulOS license: free to copy/use, no-sale, revenue → environmental-protection donation (§0)
 ```
 ---
 ## 16. Revised MVP Phasing
 Given the scope, ship in **stages**, each fully functional and demo-able:
 **Stage 1 — Foundation:** Identity/roles/schools/classes/students, Module A (Academics Core) end-to-end, Calendar (Module I) as the shared date backbone, Notifications (Module H) skeleton, Dashboard/Widgets (Module J, 2–3 widgets), the **compliance foundation** (`DataRetentionPolicy` table, `docs/DATA_MODEL.md` purpose/legal-basis notes, onboarding gate skeleton — §11.9 steps 1–2), and the **four-container skeleton itself**: frontend/backend/db split into their own containers with the docker-compose (and a first-pass `/k8s` manifest set) working end-to-end for Stage 1's features before any other module is added — this is the point to validate the container/network boundaries (§3, §3.1) are right, since every later stage builds on them.
 **Stage 2 — Communication & Signage:** Module C in full (messaging, escalation policy engine, social rooms, class lock, the urgent-safety bypass path), Module B (signage, including Emergency Alert override), wired into Module H/I. Add onboarding gate steps 3–4 (Elternbeirat/Schulkonferenz and Personalrat consultation logging) since Module C introduces monitoring-adjacent surfaces (read receipts, audit trail).
 **Stage 3 — Learning, AI & CoreAI:** the **coreai container is introduced here** (Module M, §12) — bring it up with only the lowest-risk capabilities first: teacher/admin content-drafting assist (§7) and simple scheduled reminders (§12.3), both already human-review-gated by their owning modules. Then Module D (Learning Hub, manual authoring first, AI-assist fast-follow through CoreAI), then Module E (AI Tutor through CoreAI, with hard test-time gating enforced at **both** the backend and CoreAI layers from day one — never ship before Module F's gate exists, and never ship CoreAI's admin/teacher assistant capabilities that touch grading, discipline, or broadcast messaging before §12.2's approval-required rules are actually enforced in code). DPIA gate (§11.9 step 5) must be functional before Module E — or any CoreAI capability that processes student data — can be enabled for real use.
 **Stage 4 — Exam Mode & Digital Notebook:** Module F (kiosk lockdown, warnings, monitor view) and Module G (typed + stylus notebook, teacher annotation) — highest-integrity/most device-sensitive modules, saved for last so the touch/kiosk foundation is mature first, and gated behind the completed DPIA per §11.9.
 Each stage gets its own seed data, test-suite additions, and `docs/ROADMAP.md` entry.
 ---
 ## 17. Definition of Done (MVP + full platform)
 **Core functionality (per module, §4–10):**
 1. Auth (register/login/reset, optional 2FA) end-to-end.
 2. School → SchoolYear → ClassGroup → Student → Enrollment CRUD with CSV import.
 3. At least 2 seeded starter competency templates with categories, competencies, and a mastery scale.
 4. Template assign/clone + school-copy editing.
 5. Fast entry-logging UI from a class roster.
 6. Assessments with bulk grid entry.
 7. Competence Flower radar chart, computed from real data, configurable aggregation.
 8. Grading scheme + weight rules + computed grade with breakdown + manual override (human-finalized only, §11.5).
 9. Report generation (draft → final → PDF), single and bulk export.
 10. Data export (JSON/CSV) and erasure flow, audit-logged, unified across student/teacher/parent (§11.5).
 11. i18n scaffolding, DE + EN complete for implemented screens.
 12. Dockerized self-hosting + docs, seed script for demo data.
 13. Signage with working Emergency Alert override.
 14. Communication with the full escalation-policy engine and urgent-safety bypass.
 15. Learning Hub with at least manual (non-AI) content authoring functional.
 16. AI Tutor shipped only after Exam Mode's server-side gate exists and is tested.
 17. Exam Mode with the full bathroom/distress/warning flow and defense-in-depth enforcement.
 18. Digital Notebook with typed + stylus input and non-destructive teacher annotation.
 19. CoreAI (Module M) running as its own container, reachable only through the backend, with §12.2's approval-required action list actually enforced in code (verified by a specific test, not just documented), and the version-update job proposing (never silently applying) new ZeroClaw releases.
 20. Four-container architecture (frontend/backend/db/coreai) working via both `docker-compose.yml` and the `/k8s` manifest set, with `NetworkPolicy`/equivalent boundary rules from §3.1 actually in place, not just documented.
 21. Every screen across every module built from the single shared design-system component library (§13), with `docs/DESIGN_SYSTEM.md` accurate and a working component-preview catalog — spot-checked by picking three unrelated modules (e.g., Signage authoring, the AI Tutor panel, and Module L's compliance console) and confirming they share identical button/card/spacing/typography treatment, not three different visual languages.
 22. Test suite: unit tests for grading logic, permissions, and the escalation-policy business-day calculator specifically (not just an overall coverage %); Playwright E2E covering register → create class → assign template → add students → log entries → generate report, plus a signage-emergency-override smoke test, an exam-session lifecycle smoke test, and a CoreAI smoke test (a teacher content-draft request round-trips through backend → coreai → backend correctly, and an AI Tutor request during an active exam session is correctly refused by CoreAI even if a test double bypasses the backend's own gate).
 **Compliance (Module L, §11.5) — a school instance is not production-ready until:**
 - [ ] `docs/DATA_MODEL.md` has a purpose + legal-basis note for every personal-data entity.
 - [ ] `DataRetentionPolicy` rows exist (school-confirmed, not defaulted) for every legally-mandated category.
 - [ ] `docs/legal/verzeichnis-verarbeitungstaetigkeiten.md` (RoPA) generated and reviewed.
 - [ ] AVV signed (third-party-operated instance) or explicitly marked not-applicable (self-hosted-by-school).
 - [ ] DPIA completed and on file before Modules E or F are enabled.
 - [ ] Elternbeirat/Schulkonferenz consultation logged per module.
 - [ ] Personalrat consultation logged for every monitoring-capable module.
 - [ ] Student/parent/teacher self-service data-export flows tested end-to-end.
 - [ ] Privacy notice generator produces an accurate, plain-language notice matching actual configured retention periods (no drift between docs and DB config).
 `README.md` should state SchulOS's mission plainly: a free tool built by DFM Solutions and family, to help protect the environment and reduce paper/print dependency in schools; explain the license (free to use, no-sale, revenue-to-environmental-donation, §0); and explain how to contribute.
 ---
 ## 18. Phase 2 / Stretch Goals (out of scope for v1 — document in `docs/ROADMAP.md`)
 - SSO (OIDC) support for schools with existing identity providers.
 - Optional Postgres deployment mode for larger multi-school instances.
 - Native offline-first PWA mode for spotty classroom Wi-Fi.
 - **Explicitly forbidden, not just deferred (§11.5):** any feature that repurposes competency/AI-Tutor/behavioral data into a cross-context "student risk score" or similar profiling construct without a wholly separate legal basis and DPIA.
 ---
 ## 19. Instructions for the AI Coding Agent
 1. Produce `docs/ARCHITECTURE.md` and the **full** Prisma/Drizzle schema (all entities across §4–11) and get sign-off before writing app code — this schema is large enough that an early wrong decision is expensive.
 2. Build the shared **Policy/Config layer** (backing the Admin Policy Console, §11.4, and `DataRetentionPolicy`, §11.5) **before** implementing Module C's escalation logic or Module F's warning thresholds — both must read from it, proving "no hardcoding" structurally, not just by discipline.
 3. Build Module H (Notifications) and Module I (Calendar) early, in Stage 1, precisely because every later module depends on them — prevents each module from inventing its own notification/date logic.
 4. When implementing Module F, write the **server-side session-gating check** before the kiosk UI — the security/integrity property must not depend on the UI shipping correctly.
 5. Flag explicitly, in `docs/DATA_MODEL.md`, every place a rule/threshold/retention-period is read from a policy table, and every entity's purpose + legal basis (so a future compliance audit can confirm zero hardcoded business rules and a complete RoPA).
 6. Never enable Module E or F for a school instance until the corresponding onboarding-gate step (§11.9) is satisfied — build this as an actual code-level check, not a documented process someone might skip.
 7. Keep commits small and descriptive; maintain a CHANGELOG. After each feature, write its unit/E2E tests before moving to the next.
 8. Flag any point where a competency/grading/retention policy varies by German Bundesland — expose it as configuration, never hardcode one state's rules, and note the assumption in `docs/DATA_MODEL.md`.
 9. Remember throughout: **this is a free, non-commercial, donation-supported school project.** Prefer boring, dependency-light, self-hostable solutions over anything introducing a paid third-party service or vendor lock-in — and treat every compliance requirement in §11 as a hard constraint, not a stretch goal.
 10. When implementing Module M (§12), build the backend↔coreai API contract and the **approval-required action list (§12.2)** before wiring up any actual model-provider call — the boundary/safety layer must exist before the "smart" part does, mirroring instruction #4's approach to Module F.
 11. Pull `zeroclaw-labs/zeroclaw` at a pinned, explicitly-chosen release tag — never track `master`/latest automatically in a running deployment (§12.2's version-update rule) — and adapt its `deploy-k8s/` reference manifests for the coreai container rather than writing Kubernetes YAML from scratch.
 12. Build the shared design-system component library (§13.4) — tokens, breakpoints, the base component set — **before** building any individual module's screens, and build every module's UI exclusively from it. Treat a module that introduces its own one-off button/card/spacing style as a defect to fix immediately, not a style-guide suggestion for later.
@@ -1,4 +1,4 @@
-# SchulOS PRD: Nerede Olduğumuz ve Eksiklerimiz
+# ExaMetra PRD: Nerede Olduğumuz ve Eksiklerimiz
 **Tarih:** 1 Ağustos 2026  
 **Durum:** 30% tamamlanmış, 70% eksik
@@ -7,7 +7,7 @@
 ## Özet
-SchulOS PRD'ye göre **12 modül** tanımlanmış. Bugünkü konsolidasyonda **Takvim** ve **Notlandırma** sistemini birleştirdik, ama **10 modül hala yapılacak**.
+ExaMetra PRD'ye göre **12 modül** tanımlanmış. Bugünkü konsolidasyonda **Takvim** ve **Notlandırma** sistemini birleştirdik, ama **10 modül hala yapılacak**.
 ---
@@ -1,7 +1,7 @@
-# SchulOS PRD Status Report
+# ExaMetra PRD Status Report
-**Date:** August 1, 2026
+**Date:** August 1, 2026  
-**PRD Reference:** SchulOS Consolidated PRD (12 Modules: A-L)
+**PRD Reference:** SchoolOS Consolidated PRD (12 Modules: A-L)  
 **Current Status:** 25-30% implementation complete
 ---
@@ -457,7 +457,7 @@ AccessLog
 ## Conclusion
-SchulOS is **30% complete** against the 12-module PRD. Today's consolidation work (Calendar + Grading) was critical infrastructure. To reach **100% PRD compliance in 8 weeks**, the team must:
+ExaMetra is **30% complete** against the 12-module PRD. Today's consolidation work (Calendar + Grading) was critical infrastructure. To reach **100% PRD compliance in 8 weeks**, the team must:
 1. Complete Module A (Academics Core) — foundation for all others
 2. Build Module L (GDPR compliance) in parallel — non-negotiable
@@ -1,4 +1,4 @@
-# SchulOS: Professional Consolidation Complete ✨
+# ExaMetra: Professional Consolidation Complete ✨
 **Status:** Production Ready with Enterprise Features  
 **Date:** August 1, 2026  
@@ -1,4 +1,4 @@
-# SchulOS: Professional Consolidation Complete ✨
+# ExaMetra: Professional Consolidation Complete ✨
 **Status:** Production Ready with Enterprise Features  
 **Date:** August 1, 2026  
@@ -1,4 +1,4 @@
-# SchulOS Project Status Report
+# ExaMetra Project Status Report
 ## Executive Summary
@@ -201,7 +201,7 @@ All endpoints follow middleware pattern and include:
 ## Key Files for Reference
 **Architecture & Documentation:**
- `docs/PROJECT_STATUS.md` - This file
+- `/PROJECT_STATUS.md` - This file
 - `/PHASE_1_COMPLETE.md` - Infrastructure work
 - `/PHASE_2_COMPLETE.md` - Module implementation details
 - `/CODE_REVIEW_MODULE_L.md` - Detailed code analysis
@@ -217,7 +217,7 @@ All endpoints follow middleware pattern and include:
 ## Contact & Support
- **Architect:** SchulOS Core Team
+- **Architect:** ExaMetra Core Team
 - **Last Updated:** July 31, 2026
 - **Next Review:** After Phase 2 API implementation
@@ -1,347 +1,155 @@
-# Schulos - Competence & Grading Platform
+# ExaMetra
-**Free & open-source competence & grading platform for schools**  
+**Free & open-source competence & grading platform for schools**
 *Kompetenzorientierte Beurteilung für alle*
-## Overview
+_Kompetenzorientierte Beurteilung fur alle_
-Schulos is a comprehensive educational platform designed for schools to manage competence-based assessment, grading, and academic progress tracking. The system supports modern educational workflows with features for teachers, students, and administrators.
+---
-## Key Features
+## What is ExaMetra?
-### 🎓 **Competence-Based Assessment**
+ExaMetra is a comprehensive, free, and open-source web application designed for schools to track student competencies, manage assessments, compute grades, and generate reports. Built with modern web technologies, it provides a rich, professional interface for teachers, school administrators, students, and parents.
 - Skill-oriented evaluation framework
 - Mastery matrix for tracking progress
 - Competency templates and standards
 - Progressive assessment stages
-### 👥 **Multi-Role Access**
+## Features
 - **Super Admin**: Full system administration
 - **School Admin**: School-level management
 - **Teacher**: Class and student management
 - **Student**: Progress tracking and self-assessment
 - **Parent**: Child progress visibility
 - **DPO**: Data protection and compliance
-### 📊 **Comprehensive Analytics**
+### Core Modules
- Individual student progress tracking
+- **Dashboard** — Overview with KPIs, trends, recent activity, and quick actions
- Class and school-wide performance metrics
+- **Classes & Students** — Manage classes, enrollments, seating order, and student profiles
- Trend analysis and reporting
+- **Competency Grids** — Assign and track competency templates per class and subject
- Export capabilities (PDF, CSV, Excel)
+- **Progress Entries** — Record and visualize student learning progress over time
 - **Competence Flower** — Radar chart visualization of student competencies per subject
 - **Mastery Matrix** — Grid view of student mastery levels across all competencies
 - **Assessments** — Create and manage tests, oral exams, projects, and homework
 - **Grading** — Compute grades with configurable weight rules, overrides, and breakdowns
 - **Reports** — Generate narrative report cards with phrase templates
 - **Attendance** — Track student attendance with sessions, stats, and calendar heatmap
 - **Calendar** — Unified calendar view of assessments, attendance, and deadlines
 - **Lesson Plans** — Plan and manage lessons with objectives, materials, and reflections
 - **Analytics** — Insights with mastery trends, risk detection, and competency analysis
-### 🛡️ **Security & Compliance**
+### Additional Features
- Role-based access control (RBAC)
+- **Parent Communication** — Message system for parent-teacher communication
- GDPR compliance features
+- **Behavior Tracking** — Incident logging with categories, severity, and follow-up
- Data protection officer (DPO) controls
+- **Rubric Library** — Create and share analytic/holistic rubrics
- Audit logging
+- **Comment Bank** — Reusable comment templates for report cards
- Two-factor authentication (2FA)
+- **Curriculum Coverage** — Track which competencies have been assessed
 - **Settings** — Admin panel with user management, demo accounts, audit logs, and data export
 - **Student Detail** — Comprehensive student profile with journey timeline, grades, and export
-### 🔄 **Workflow Management**
+### Technical Features
- Lesson planning and delivery
+- **Keyboard Shortcuts** — Cmd+K command palette, Cmd+1-9 view switching, Cmd+/ shortcuts dialog
- Assessment creation and grading
+- **Batch Operations** — Batch deletion of progress entries
- Homework and assignments
+- **Drag-and-Drop** — Student seating order reordering
- Attendance tracking
+- **Custom Color Palette** — 7 preset colors + custom picker for competence flower
- Behavior incident management
+- **Notification System** — Deadline reminders and missing observation alerts
 - **Onboarding Tour** — Guided tour for new users
 - **CSV Export** — Export student data as CSV
 - **Print Support** — Print-optimized CSS for report generation
 - **Dark Mode** — Full light/dark mode support with next-themes
 - **i18n** — 700+ translation keys in German and English
 - **Responsive Design** — Mobile-first responsive layout
-## Technical Architecture
+## Tech Stack
-### Technology Stack
+- **Framework**: Next.js 16 (App Router)
- **Frontend**: Next.js 16, React 19, TypeScript
+- **Language**: TypeScript 5
- **Backend**: Node.js, PostgreSQL/SQLite
+- **Styling**: Tailwind CSS 4 + shadcn/ui
- **Authentication**: NextAuth.js with session management
+- **Database**: Prisma ORM + SQLite
- **Security**: Argon2 password hashing, TOTP 2FA
+- **State**: Zustand + React Query
- **Database**: Prisma ORM with PostgreSQL/SQLite support
+- **Charts**: Recharts (Radar, Bar, Line)
- **Real-time**: WebSocket connections
+- **Auth**: Cookie-based sessions + bcryptjs
- **Caching**: Redis and memory caching
+- **Icons**: Lucide React (no emojis)
- **Deployment**: Docker, Kubernetes support
+- **Animations**: Framer Motion
-### Data Model
+## Getting Started
 - **Students**: Academic profiles, goals, progress
 - **Teachers**: Class assignments, grading, lesson plans
 - **Schools**: Districts, buildings, departments
 - **Competencies**: Skills, standards, assessment criteria
 - **Assessments**: Tests, quizzes, projects, rubrics
 ## Quick Start
 ### Prerequisites
 - Node.js 18+ or Bun
 - npm, yarn, or bun
 ### Installation
 ```bash
-# Clone repository
+# Clone the repository
-https://github.com/cetinmustafa83/schulos
+git clone https://github.com/cetinmustafa83/exametra.git
 cd exametra
 # Install dependencies
-npm install  # or pnpm install
+npm install
 # or: bun install
-# Environment variables
+# Set up environment
-# Copy .env.example to .env and configure:
+cp .env.example .env
-# - Database connection
+
-# - Email settings (if needed)
+# Push database schema
-# - Security configuration
+npm run db:push
-```
+
 # Generate Prisma client
 npm run db:generate
 # Seed demo data
 npm run db:seed
 ### Development Setup
 ```bash
 # Start development server
 npm run dev
 # Database setup
 npm run db:generate          # Generate Prisma client
 npm run db:migrate           # Create migrations
 npm run db:seed              # Load demo data
 # Type checking
 npm run typecheck
 # Linting
 npm run lint
 ```
-### Production Deployment
+### Demo Accounts
 ```bash
 # Build for production
 npm run build
-# Start production server
+After seeding, you can log in with these demo accounts:
 npm run start
-# Database setup (production)
+| Role | Email | Password |
-npm run db:push          # Push schema to database
+|------|-------|----------|
-npm run db:setup-demo   # Set up demo environment
+| Admin | `demo@competencetrack.org` | `Demo2025!` |
 | Teacher | `demo.teacher@competencetrack.org` | `Demo2025!` |
 | Student | `demo.student@competencetrack.org` | `Demo2025!` |
 | Parent | `demo.parent@competencetrack.org` | `Demo2025!` |
-# Docker deployment (recommended)
+## Project Structure
-docker-compose up -d
+
 ```
 exametra/
  src/
    app/              # Next.js App Router pages & API routes
      api/            # 34+ API endpoint directories
      globals.css     # Global styles & animations
      layout.tsx      # Root layout
      page.tsx        # Entry point (SPA)
    components/       # 26 React components
      auth-view.tsx
      dashboard-view.tsx
      classes-view.tsx
      competence-flower-view.tsx
      ...
    hooks/            # Custom React hooks
    lib/              # Utilities
      api.ts          # API client functions
      auth.ts         # Auth helpers
      db.ts           # Prisma client
      i18n.ts         # Internationalization (700+ keys)
      store.ts        # Zustand state management
      utils.ts        # Utility functions
  prisma/
    schema.prisma     # 30+ database models
    seed.ts           # Demo data seed script
  public/
    logo.svg          # App logo
 ```
-## API Documentation
+## License
-### Authentication
+MIT License — see [LICENSE](./LICENSE) for details.
 - **POST /api/auth** - Login, register, request password reset, reset password
 - **GET /api/auth** - Get current session user
 - **POST /api/auth/logout** - Logout user
 ### Key Endpoints
 - **GET /api/dashboard** - User dashboard data
 - **GET /api/students** - List students
 - **GET /api/classes** - List classes
 - **GET /api/assignments** - List assignments
 - **POST /api/grading** - Submit grades
 ### API Authentication
 All endpoints require authentication via session cookie. Role-based access control enforced.
 ## Security Features
 ### Authentication
 - **Session Management**: Secure HTTP-only cookies with expiration
 - **Password Security**: Argon2id with high memory cost, automatic migration from bcrypt
 - **Two-Factor Authentication**: TOTP with recovery codes
 - **Rate Limiting**: Prevents brute force attacks
 - **Secure Cookies**: HTTP-only, secure flag based on environment
 ### Access Control
 - **Role-Based Access Control**: SUPER_ADMIN, SCHOOL_ADMIN, TEACHER, STUDENT, PARENT, DPO
 - **Data Isolation**: Users can only access their own school's data
 - **Compliance Controls**: DPO can access all data for compliance purposes
 - **Audit Logging**: All data access logged for compliance
 ### Compliance
 - **GDPR Support**: Data export, erasure requests
 - **Data Protection Officer**: Dedicated compliance role
 - **Audit Logs**: Complete audit trail of data access
 - **Privacy Controls**: Fine-grained data access permissions
 ## Configuration
 ### Environment Variables
 ```env
 # Database
 DATABASE_URL=file:./db/schulos.db
 # Security
 SESSION_MAX_AGE_SECONDS=604800
 PASSWORD_RESET_TTL_SECONDS=3600
 AUTH_REQUIRE_EMAIL_VERIFICATION=false
 AUTH_TOTP_ENABLED=true
 # Application
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 NODE_ENV=production
 # Storage
 STORAGE_PATH=./data/uploads
 EXPORT_PATH=./data/exports
 BACKUP_PATH=./data/backups
 # Email (optional)
 SMTP_HOST=
 SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM=
 # AI Features (optional)
 AI_ENABLED=false
 AI_PROVIDER=
 AI_API_KEY=
 ```
 ### Directory Structure
 ```
 /docs/           - Documentation and guides
 /prisma/         - Database schema and migrations
 /src/            - Application source code
 /public/         - Static assets
 /scripts/        - Deployment and utility scripts
 /data/           - Generated data and exports
 prisma/db/       - Database files
 ```
 ## Development
 ### Code Quality
 - **TypeScript**: Strict mode enabled
 - **Linting**: ESLint with Next.js configuration
 - **Testing**: Bun test framework, Playwright e2e
 - **Code Reviews**: PR reviews with checklists
 ### Development Workflow
 1. **Feature Development**: Create new features with tests
 2. **Code Review**: Submit PR for peer review
 3. **Testing**: Run unit and integration tests
 4. **Quality Assurance**: Check linting and type safety
 5. **Deployment**: CI/CD pipeline with automated testing
 ### Running Tests
 ```bash
 # Unit tests
 npm run test
 # E2E tests
 npm run test:e2e
 # Code quality checks
 npm run lint
 npm run typecheck
 ```
 ## Deployment
 ### Self-Hosting
 ```bash
 # Using Docker Compose
 docker-compose up -d
 # Manual deployment
 npm run build
 npm run start
 ```
 ### Production Considerations
 - **SSL/TLS**: Configure HTTPS for all connections
 - **Load Balancing**: Behind nginx or equivalent
 - **Backups**: Regular database backups
 - **Monitoring**: Application monitoring and logging
 - **Scaling**: Horizontal scaling support
 ## Contributing
-### Development Guidelines
+Contributions are welcome! This is a free and open-source project aimed at making competence-oriented assessment accessible to all schools.
 - Follow [Module L](docs/CODE_REVIEW_MODULE_L.md) code review standards
 - Write comprehensive tests for new features
 - Update documentation for API changes
 - Maintain backward compatibility
-### Project Structure
+1. Fork the repository
- **Modules**: Organized by feature and responsibility
+2. Create your feature branch (`git checkout -b feature/amazing-feature`)
- **Access Control**: Centralized security logic
+3. Commit your changes (`git commit -m 'Add amazing feature'`)
- **Testing**: Comprehensive test coverage
+4. Push to the branch (`git push origin feature/amazing-feature`)
- **Documentation**: Living documentation in `/docs/`
+5. Open a Pull Request
 ## Support & Community
 ### Documentation
 - Full API documentation: `/docs/API_IMPLEMENTATION_GUIDE.md`
 - Architecture: `/docs/ARCHITECTURE.md`
 - Self-hosting: `/docs/SELF_HOSTING.md`
 ### Community
 - **GitHub**: https://github.com/cetinmustafa83/schulos
 - **Issues**: Report bugs and request features
 - **Discussions**: Community forums and support
 ### License
 This project is licensed under the MIT License.
 ## Contact
 ### Project Lead
 - **Name**: Mustafa Cetin
 - **Email**: [Available in repository]
 - **GitHub**: https://github.com/cetinmustafa83
 ### Support
 For technical support and community questions:
 - File issues on GitHub
 - Check documentation in `/docs/`
 - Join community discussions
 ## Acknowledgments
 Special thanks to the open-source community and contributors who have made this educational platform possible.
 ---
-*Last Updated: $(date +'%Y-%m-%d')*
+**ExaMetra** — Kompetenzorientierte Beurteilung fur alle
 *This documentation is maintained as part of the Schulos project.*
 ## Getting Started Quickly
 ### 1-Minute Setup
 ```bash
 # Clone and start
 https://github.com/cetinmustafa83/schulos
 cd schulos
 npm run dev
 ```
 ### 5-Minute Demo
 The system includes demo data for exploration:
 - School: "Test Academy"
 - Teacher: "Demo Teacher"
 - Students: Multiple test students
 - Sample assessments and grades
 Visit `http://localhost:3000` and use demo credentials:
 - **Email**: `demo@schulos.dev`
 - **Password**: `demodemo`
 ### Next Steps
 1. **Explore Features**: Try the demo account
 2. **Set Up Production**: Configure environment variables
 3. **Customize**: Modify for your school needs
 4. **Train Users**: Use provided documentation
 5. **Contact Support**: Reach out for assistance
 ---
 *This README was generated to provide comprehensive project documentation.*
 *For more detailed information, refer to the comprehensive documentation in `/docs/`.*
 ## Project Status
 ✅ **Ready for Production**  
 📚 **Complete Documentation**  
 🔒 **Security Audited**  
 ⚡ **Performance Optimized**  
 🎓 **Educational Focus**  
 ---
 *This platform is continuously evolving. Report issues and suggest features to improve the educational experience.*
 ---
 **Need help?** Check our documentation in `/docs/` or visit our GitHub repository.
 **Contribute?** Fork this repository and submit pull requests following our contribution guidelines.
@@ -1,4 +1,4 @@
-# SchulOS: READY FOR PRODUCTION
+# ExaMetra: READY FOR PRODUCTION
 ## Project Completion Status: 100%
@@ -254,8 +254,8 @@ pnpm run build
 vercel deploy --prod
 # Or Docker/self-hosted
-docker build -t schulos:latest .
+docker build -t exametra:latest .
-docker run -e DATABASE_URL=$DB_URL schulos:latest
+docker run -e DATABASE_URL=$DB_URL exametra:latest
 ```
 ### 4. Verify Deployment
@@ -275,7 +275,7 @@ wscat -c wss://your-domain.com/ws
 ## Support & Maintenance
 ### Documentation
- See `docs/API_IMPLEMENTATION_GUIDE.md` for endpoint specifications
+- See `API_IMPLEMENTATION_GUIDE.md` for endpoint specifications
 - See `PHASE_2_COMPLETE.md` for module details
 - See `CODE_REVIEW_MODULE_L.md` for technical overview
@@ -1,4 +1,4 @@
-# SchulOS Refactor Action Plan
+# ExaMetra Refactor Action Plan
 ## PRD v1 → v2 → Production Ready
 **Current State Analysis:**
@@ -1,4 +1,4 @@
-# SchulOS PRD Implementation Todo — Visual Roadmap
+# ExaMetra PRD Implementation Todo — Visual Roadmap
 ## Current Status: 30% Complete (Week 1)
@@ -1,29 +0,0 @@
 services:
  schulos:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: schulos
    restart: unless-stopped
    environment:
      DATABASE_URL: ${DATABASE_URL:-file:/data/db/schulos.db}
      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
      SESSION_MAX_AGE_SECONDS: ${SESSION_MAX_AGE_SECONDS:-604800}
      AI_ENABLED: ${AI_ENABLED:-false}
      AI_PROVIDER: ${AI_PROVIDER:-}
      AI_API_KEY: ${AI_API_KEY:-}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM: ${SMTP_FROM:-}
      STORAGE_PATH: ${STORAGE_PATH:-/data/uploads}
      EXPORT_PATH: ${EXPORT_PATH:-/data/exports}
      BACKUP_PATH: ${BACKUP_PATH:-/data/backups}
    ports:
      - "${SCHULOS_PORT:-3000}:3000"
    volumes:
      - schulos-data:/data
 volumes:
  schulos-data:
@@ -1,40 +0,0 @@
 # Architecture
 SchoolOS is a single Next.js application with TypeScript, Prisma, and SQLite.
 It is intentionally deployable as one self-hosted container for a single
 school. Core personal data remains in SQLite; generated uploads, exports, and
 backups live in persistent local storage.
 ## Components
 - Next.js App Router hosts the UI and API routes.
 - Prisma owns schema validation, migrations, and database access.
 - SQLite is the default relational store. Use WAL mode in the deployment
  bootstrap and retain the database plus `-wal` and `-shm` files during backups.
 - The storage layer uses local filesystem paths first. Future S3-compatible
  storage must use the same storage interface rather than feature-specific SDKs.
 - `src/lib/storage.ts` is the single local filesystem boundary. It constrains
  uploads, exports, and backups to configured roots and rejects path traversal.
 - Notification, Calendar, Policy, and Authorization remain shared services;
  feature modules must not create duplicate delivery, date, or permission logic.
 ## Deployment Boundary
 `docker-compose.yml` runs the application with a named `/data` volume:
 - `/data/db`: SQLite database files
 - `/data/uploads`: uploaded evidence and documents
 - `/data/exports`: generated reports and rights exports
 - `/data/backups`: verified backups
 Use a reverse proxy that terminates TLS in production. Configure
 `NEXT_PUBLIC_APP_URL` with the public HTTPS URL.
 ## Security Notes
 - Server-side authorization is mandatory; hiding navigation does not grant
  access control.
 - Secrets belong only in `.env` or deployment secret management.
 - AI is optional and must remain disabled until policy/DPIA gates allow it.
 - This engineering documentation is not legal advice. A school must involve its
  DPO, Schultrager, and Personalrat before production use.
@@ -1,51 +0,0 @@
 # Contributing
 ## Setup
 1. Use Node.js 22 and pnpm.
 2. Copy `.env.example` to `.env` and set `DATABASE_URL`.
 3. Install dependencies with `pnpm install`.
 4. Generate Prisma client with `pnpm db:generate`.
 5. Create local schema with `pnpm db:push` or run the reviewed migration flow.
 6. Seed only non-production data with `pnpm db:seed`.
 7. Start the app with `pnpm dev`.
 ## Required Checks
 Run these before opening a pull request:
 ```bash
 pnpm prisma validate
 pnpm lint
 pnpm test
 pnpm typecheck
 git diff --check
 ```
 ## Engineering Rules
 - Use server-side authorization for every route. UI visibility is never a
  substitute for access control.
 - Scope every school-owned query to the caller school. Scope teacher data to
  assigned classes, student data to self, and parent data to linked children.
 - Use `src/lib/access-policy.ts` and `src/lib/role-access.ts` instead of
  duplicating access rules.
 - Use `src/lib/storage.ts` for local files. Never assemble arbitrary paths from
  request input.
 - Use the Calendar and Notification modules as shared sources, not local copies
  of deadlines or delivery logic.
 - Keep new UI icon-based with Lucide. Do not introduce emoji UI affordances.
 - Preserve existing palette, shared motion vocabulary, responsive behavior, and
  role-aware page ownership defined in `TODO.md`.
 - Add a migration for every Prisma schema change and update relevant docs/tests.
 - Do not add hardcoded policy values when a school-configurable policy is
  required.
 ## Pull Requests
 - Keep a pull request narrowly scoped to one TODO phase item.
 - Explain security, migration, audit, export/erasure, and retention effects.
 - Include tests for authorization failures and cross-school IDOR attempts when
  a route handles school or student data.
 - Do not commit `.env`, database files, backup files, uploaded documents, or
  generated test artifacts.
@@ -1,77 +0,0 @@
 # Data Model
 SchoolOS uses Prisma with SQLite. IDs are portable strings and timestamps are
 stored in UTC. The schema is the source of truth; this document is a domain
 map, not a replacement for `prisma/schema.prisma`.
 ## Organization And Identity
 - `School`, `SchoolYear`, `SchoolDistrict`: organizational boundaries.
 - `User`: authenticated account, role, school membership, locale, and soft
  deletion state.
 - `ClassGroup`, `ClassGroupTeacher`, `Enrollment`: teaching assignments and
  current/historical class membership.
 - `Student`, `ParentStudentLink`, `ParentContact`, `EmergencyContact`: student
  profile and linked guardians. Access must always be evaluated through the
  active student, parent link, class assignment, and school scope.
 ## Academic Record
 - `Subject`, `CompetencyTemplate`, `CompetencyCategory`, `Competency`, and
  `MasteryLevelDefinition` define editable school competency frameworks.
 - `ClassCompetencyAssignment` links a framework to a class.
 - `LearningProgressEntry` is the evidence record used by progress, mastery,
  and competence visualizations.
 - `Assessment`, `AssessmentCompetencyLink`, and `AssessmentResult` capture
  assessment creation, competency links, and student results.
 - `GradingScheme`, `GradingWeightRule`, and `ComputedGrade` hold calculation
  rules and computed outcomes.
 - `Report`, `ReportCardTemplate`, and `ReportSection` hold report-card drafts,
  templates, and sections.
 ## Classroom Operations
 - `AttendanceSession` and `AttendanceRecord`: attendance and absence status.
 - `LessonPlan`, `Homework`, and `HomeworkSubmission`: instructional planning
  and student work.
 - `TimetableSlot`, `CalendarEvent`, `SchoolEvent`, and `EventRegistration`:
  time-bound school activity.
 - `TeacherAbsence`, substitute models, transport models, and library checkout
  models support daily school operations.
 ## Student Support And Communication
 - `TeacherNote`, `BehaviorCategory`, `BehaviorIncident`, and
  `BehaviorIntervention`: staff-only support context.
 - `IllnessReport`, `CounselingAppointment`, `HealthRecord`, and `Wellness`
  models contain sensitive information; they require strict role, student, and
  school checks.
 - `CommunicationRoom`, `CommunicationRoomMember`, `CommunicationMessage`,
  `ParentMessage`, `Announcement`, and `Notification` provide communication
  and delivery records.
 ## Student Work And Learning Hub
 - `Notebook`, `NotebookPage`, `NotebookPageVersion`, and `Drawing` store
  digital student work and version history.
 - `Resource`, `SubjectCategory`, `SubjectContent`, `SubjectTopic`,
  `SubjectLesson`, and `LessonQuestion` represent learning content.
 - Badge, reward, competition, portfolio, goal, and study-plan models support
  student-facing learning workflows.
 ## Compliance And Audit
 - `AuditLog` records sensitive operational actions.
 - `DataExportRequest`, `DeletionFlag`, `DataRetentionPolicy`, `DpiaRecord`,
  `ComplianceConsultation`, and `SchoolComplianceStatus` support rights,
  retention, and governance workflows.
 - `Backup` stores metadata for storage-backed backup files; backup files live
  below `BACKUP_PATH` and must not be placed in the database.
 ## Change Rules
 - Additive schema changes require a Prisma migration and an updated seed path.
 - Never rename or remove a stored field without a migration/backfill plan.
 - New personal-data fields require a purpose, access policy, audit requirement,
  export behavior, erasure behavior, and retention category before release.
 - New feature tables must include school scope where the data is school-owned.
@@ -1,591 +0,0 @@
 # PRD (Consolidated) — "SchulOS" — A Free, Self-Hosted, All-in-One School Platform
 *(Digidoo-inspired competency core, expanded into a full school operations platform, fully EU/German data-protection compliant. This document merges and supersedes the four prior drafts — Digidoo-clone build prompt, School Platform PRD v2, Legal Compliance addendum v3, and the CoreAI/container architecture update — into a single reference PRD.)*
 ---
 ## 0. Project Identity, Mission & Non-Negotiable Principles
 **Project name: SchulOS.** Created by **DFM Solutions**, in collaboration with the idea and input of a family member of the firm's owner — a genuine family/company joint effort, not a commercial product line.
 **Mission:** SchulOS exists first and foremost to **help protect the environment and nature** — specifically to reduce, and wherever possible prevent, tree-cutting/paper consumption caused by school paperwork (report cards, worksheets, physical notebooks, printed bulletins — see Modules A, B, D, G). It is a **free, donation-supported school project**, not a commercial SaaS. It is built for a real school; this environmental mission is not a marketing angle, it is the reason the project exists, and every module above should be read with "does this reduce paper/print dependency where it reasonably can?" as a live design question, not just a feature list to implement.
 **License (this is a hard product requirement, not just a legal footnote — team must draft an actual `LICENSE.md` reflecting exactly this, since it is a custom license, not a standard OSI one):**
 - Free to copy, use, and modify — by any school, anywhere.
 - **Selling SchulOS (or a derivative of it, or hosting/support services built on it) is strictly prohibited.**
 - **If any revenue is ever generated in connection with the project** (e.g., optional hosting/support fees a school or third party might charge, or — relevant to **Module B**'s sponsor-slide feature — sponsor revenue collected through the Signage module), **that revenue must be donated to environmental protection agencies or environmental protection associations.** This is not optional and not a suggestion — it is the license condition. `docs/legal/LICENSE.md` must state this explicitly, and any in-product feature that could plausibly generate revenue (Module B's sponsor slides are the clearest example already in this PRD) must surface this requirement in its own admin-facing copy, not just bury it in a root-level license file nobody reads before turning the feature on.
 - Because this is a non-standard, custom license condition (no-sale + mandatory environmental-donation-of-revenue clause), it does **not** map cleanly onto a stock OSI license like AGPLv3 or MIT — draft the actual license text as a custom document (a lawyer/DPO-adjacent review is worth getting here too, same spirit as Module L's legal disclaimers), rather than just slapping an OSI license badge on the repo that wouldn't actually enforce these terms.
 These principles override every design decision in this document:
 1. **DB: SQLite.** Single-file, self-hostable, cheap to run and back up. (One narrow exception: an optional embedded vector store for AI search — §3 — which can also run fully local/in-process.)
 2. **No hardcoding, anywhere.** Every list, label, rule, threshold, escalation window, warning count, template, retention period, and permission must come from the database or an admin-editable config table — never a constant baked into code. If a value could plausibly differ between two schools, two German states, or change next semester, it is a DB row, not a literal.
 3. **No mock data, ever** — not in dev, not in demo, not in shipped UI. Seed scripts may create *realistic sample rows* for local development (clearly documented as seed data, easily wiped), but the shipped application must never silently render placeholder/fake data as if real.
 4. **No duplicate functionality across pages.** Every capability lives in exactly one canonical place (e.g., all dates live only in the Calendar module; all alerts render only through the Notifications module). Before adding any feature, check whether an existing module already owns that responsibility; extend it there or surface it as a read-only widget — never rebuild it.
 5. **Tablet-first, touch-first**, with a well-adapted layout for desktop/PC. This is the primary device class for teachers and students in-classroom; admin/office use skews PC, but the same design system must feel native on both. **This is a cross-cutting design mandate that governs every screen in every module (A–M) — not a separate page, menu, or "mobile view" bolted on afterward.** Full detail in §13.
 6. **Everything is dynamic and role/permission-aware**, driven by real DB relationships (school → year → class → subject → student → user), never assumed.
 7. **Fully compliant with EU and German data protection law** (GDPR/DSGVO, BDSG, and the relevant state's Schulgesetz/Schul-Datenschutzverordnung), with explicit, engineered protections for student rights, teacher rights and staff co-determination (Personalrat/unions), parent rights, and the school's own controller obligations — detailed fully in **Module L** (§11). This is not a documentation afterthought: compliance status is itself DB-driven state that gates feature availability (§11.9).
 8. **License terms are enforced, not just declared** — see the License block above. No feature ships that would let SchulOS or a derivative be sold, and any revenue-capable feature (currently: Module B sponsor slides) carries a visible reminder of the environmental-donation requirement in its own admin UI.
 > **Hard disclaimer to carry into the product and into `docs/`:** This PRD gives the *engineering* requirements needed to make legal compliance *possible*. It is not legal advice. Every school deploying this platform **must** involve its own **Datenschutzbeauftragter (DPO)**, its **Schulträger**, and — for co-determination matters — its **Personalrat/Lehrerrat** before go-live (see §11.9).
 ---
 ## 1. Reference Product Analysis (functional inspiration only, not a visual/brand copy)
 **Digidoo** (digidoo.com) is a German/Austrian EdTech SaaS. Do **not** copy their branding, illustrations, exact wording, logo, or any copyrighted text/images — build an original UI/UX and original copywriting, only inspired by the **feature set and workflow concept**. Core concepts we reproduce functionally in **Module A** (§4):
 - **Competency grids ("Kompetenzraster")**: pre-built and customizable sets of subject/grade-level competencies teachers can use as templates or fully customize.
 - **Learning progress entries**: teachers log individual observations per student, linked to one or more competencies, over time (a running log, not a snapshot).
 - **Performance assessments ("Leistungsfeststellung")**: structured tests/assignments/checks linked to competencies, feeding the same student timeline.
 - **Competence Flower ("Kompetenzblume")**: a radar/spider chart per student showing strength per competency category.
 - **One-click reports**: automatically generated, competency-based report text and full report-card documents (PDF).
 - **Grade management ("Notenverwaltung")**: configurable weighting between learning-progress entries and formal assessments to compute a transparent final grade.
 - **Free tier that "just works"**: since this whole project is free, the entire app is simply free — no tiers.
 We explicitly **exclude** anything tied to Digidoo's commercial SaaS business (billing/subscriptions, marketing site, SSO/enterprise integrations like WebUntis) as out of MVP scope.
 ---
 ## 2. Module Map
 The platform is organized into cohesive modules, each owning its data and UI completely (principle #4 above).
 | # | Module | Owns |
 |---|--------|------|
 | A | **Academics Core** | Competency grids, learning-progress entries, assessments, competence flower, grading, report cards |
 | B | **Signage** | TV/billboard displays: announcement slides, sponsor slides, emergency/fire/counseling alerts |
 | C | **Communication** | Direct messaging, escalation rules, class/grade social rooms, class-hours messaging locks |
 | D | **Learning Hub** | Videos, interactive exercises, worksheets, vocab trainer, learning game, AI-assisted content authoring |
 | E | **AI Tutor** | In-context homework help, hint-only policy, full lockout during tests, content translation for foreign students |
 | F | **Exam Mode** | Kiosk/lockdown test-taking, teacher live controls, student warning system, incident log |
 | G | **Digital Notebook** | Typed + stylus/pen notebook per student per subject, teacher pen annotation on tests/homework |
 | H | **Notifications** | All push/in-app notifications — the *only* place alerts render outside their originating context banner |
 | I | **Calendar** | All dates/deadlines/appointments/exam schedules/report deadlines — the *only* source of truth for "when" |
 | J | **Dashboard & Widgets** | Per-user customizable home screen assembled from read-only widgets pulling from A–I |
 | K | **Identity & Admin** | Users, roles, schools, classes, disciplinary records, audit log, permission/rule configuration |
 | L | **Legal & Data Protection** | GDPR/DSGVO compliance engine, retention policy, DPIA gating, RoPA, rights fulfillment for all parties |
 | M | **Core AI Orchestrator** | Self-hosted agent runtime (ZeroClaw) powering the AI Tutor, content-authoring assist, translation, admin/teacher AI assistance, and event-triggered automations (SOPs), running as its own service/container |
 ---
 ## 3. Tech Stack & Container Architecture
 The platform is now explicitly a **four-container system** — frontend, backend, database, and Core AI — each independently deployable, independently scalable, and **fully Kubernetes-compatible** (as well as runnable via a single `docker-compose.yml` for small self-hosted schools). No container reaches into another's storage directly; all cross-container communication is over the internal network via defined APIs.
 ```
 ┌────────────┐     ┌────────────┐     ┌────────────┐     ┌────────────┐
 │  frontend  │────▶│  backend   │────▶│     db     │     │   coreai   │
 │ (Next.js/  │     │ (API svc,  │◀────│ (SQLite /  │◀───▶│ (ZeroClaw  │
 │  React)    │◀────│  business  │     │  libSQL    │     │  agent     │
 │            │     │  logic)    │     │  server)   │     │  runtime)  │
 └────────────┘     └─────┬──────┘     └────────────┘     └─────┬──────┘
                          │                                     │
                          └──────────── backend ◀────────────── ┘
                             (coreai calls back into backend's
                              API for data + acts through it;
                              backend calls coreai for AI/automation)
 ```
 - **Frontend container**: React/Next.js (client-rendered or SSR-lite), TypeScript, Tailwind CSS + shadcn/ui, Recharts/Chart.js for the Competence Flower radar chart. Talks to the backend only via its public API — never touches the DB or CoreAI directly.
 - **Backend container**: a standalone API service (Next.js API-only build, or a dedicated Node/Fastify/Express service — pick one and justify in `docs/ARCHITECTURE.md`) owning all business logic from Modules A–L: auth, permissions, grading, scheduling, escalation policy, compliance gating, etc. This is the **only** service allowed to write to the database and the **only** service allowed to call CoreAI (§12) — CoreAI never talks to the DB directly, keeping one clear, auditable data-access boundary (this also makes Module L's audit logging and access-control-by-default trivial to enforce, since there's exactly one write path).
 - **Database container**: **SQLite stays the DB engine** (§0.1), but to satisfy "DB in its own container" in a real multi-pod/Kubernetes topology, run it via **libSQL (`sqld`)** — an open-source, SQLite-file-compatible server (same file format and SQL semantics as SQLite) that speaks a normal network protocol (HTTP/gRPC), so the backend container can reach it like any other network database instead of requiring a shared filesystem mount. For the simplest single-VPS/docker-compose self-hosting path, a school can instead run the plain SQLite file colocated with the backend container (via a shared volume) — document both modes in `docs/ARCHITECTURE.md`/`docs/SELF_HOSTING.md`, with libSQL/`sqld` as the default for the Kubernetes deployment path and plain file-mode as the default for the single-VPS docker-compose path. Either way, backups/retention/erasure logic in Module L operates identically since the SQL surface is the same.
 - **CoreAI container**: runs **ZeroClaw** (zeroclaw-labs/zeroclaw) as the platform's self-hosted agent runtime/"core brain" — see **Module M**, §12, for full detail.
 - **Auth**: self-hosted email/password (argon2id hashing) + session cookies (Lucia Auth / Auth.js), issued and validated only by the backend container. No third-party paid auth. Optional TOTP 2FA.
 - **PDF generation**: `@react-pdf/renderer` or Puppeteer-based HTML-to-PDF, run inside the backend container (or a short-lived job container it spawns) for report cards.
 - **File storage**: local filesystem on a persistent volume mounted to the backend container, abstracted behind a storage interface so S3-compatible storage can be swapped in later without touching business logic.
 - **i18n**: German and English UI strings from day one (`next-intl` or equivalent) — all UI text through translation keys, never hardcoded.
 - **PWA/Kiosk infrastructure**: **Workbox**, in the frontend container's build, for the service worker — offline shell caching, reliable kiosk/fullscreen "install as app" behavior, and Web Push delivery (Modules F, H, §12).
 - **Worker offloading**: **Comlink**, in the frontend, to offload heavy client-side work (stylus stroke processing in the Digital Notebook, client-side AI-translation pre/post-processing) to a Web Worker via simple RPC, keeping the main thread responsive for touch input.
 - **AI/semantic search (optional)**: **Chroma**, run either as a fifth optional container or embedded within the CoreAI container, for semantic search over Learning Hub resources and retrieval-augmented context for the AI Tutor — see §12. Never a hard dependency; a school without AI features enabled never needs to run it or the CoreAI container's heavier model-provider paths.
 - **Testing**: Vitest/Jest (unit), Playwright (E2E for critical flows: login, create competency grid, log an entry, generate report, run an exam session, and — new — a CoreAI automation smoke test, §12).
 ### 3.1 Kubernetes Deployment
 - Provide both `docker-compose.yml` (frontend, backend, db, coreai — four services, for small self-hosted single-VPS schools) **and** a `/k8s` manifest set (or Helm chart) for schools/districts that want proper Kubernetes deployment:
  - `Deployment` for **frontend** (stateless, horizontally scalable, `HorizontalPodAutoscaler` optional).
  - `Deployment` for **backend** (stateless application logic; if running plain-file SQLite mode this must stay single-replica — document that constraint clearly; libSQL/`sqld` mode removes it).
  - `StatefulSet` + `PersistentVolumeClaim` for **db** (whichever mode is chosen).
  - `Deployment` for **coreai** (ZeroClaw runtime + its own gateway/dashboard, §12), with its own `PersistentVolumeClaim` for agent memory/config, and resource limits sized for whichever model-provider mode is configured (remote API vs. local model).
  - `Service` objects for internal DNS between all four; `Ingress` exposing only frontend (and backend's public API surface if needed) externally — **coreai's dashboard/gateway is never exposed externally by default**, only reachable from backend and from admin users via a backend-proxied, authenticated route (§12.4).
  - `NetworkPolicy` restricting: frontend → backend only; backend → db and backend → coreai; **coreai has no direct network path to db** (§12, data-access boundary); explicit egress rules for coreai's model-provider calls if using a remote LLM API.
  - `Secret`s for DB credentials/connection strings, model-provider API keys, session/auth signing keys; `ConfigMap`s for Module L's policy tables' bootstrap values and any non-secret runtime config.
 - Reference `zeroclaw-labs/zeroclaw`'s own `deploy-k8s/` folder as a starting point for the CoreAI container's manifests specifically, adapting rather than reinventing.
 Deliver `docs/ARCHITECTURE.md` (stack rationale, four-container boundary rules, self-hosting path) and `docs/SELF_HOSTING.md` (both docker-compose and Kubernetes deployment paths, written for a non-technical school IT admin where possible, with a clearly marked "needs a Kubernetes-literate admin" section for the K8s path).
 ---
 ## 4. Module A — Academics Core
 ### 4.1 Entities
 **Organizational:**
 - **School** — id, name, schoolType (elementary/middle/gymnasium/other), country, timezone, createdAt.
 - **User** — id, schoolId (nullable), email, passwordHash, firstName, lastName, role, locale, twoFactorSecret (nullable), createdAt, deletedAt (soft delete).
 - **SchoolYear** — id, schoolId, label, startDate, endDate.
 - **ClassGroup** — id, schoolId, schoolYearId, name, gradeLevel, schoolType.
 - **ClassGroupTeacher** (M:N) — classGroupId, userId, role (HOMEROOM_TEACHER, SUBJECT_TEACHER).
 - **Student** — id, schoolId, firstName, lastName, dateOfBirth (nullable, minimize what's collected), externalId (nullable, import matching), createdAt, deletedAt.
 - **Enrollment** — id, studentId, classGroupId, schoolYearId, startDate, endDate (nullable = still enrolled) — models students moving between classes/schools over time.
 **Subject & competency structure:**
 - **Subject** — id, schoolId (nullable = global template), name, gradeLevelMin/Max.
 - **CompetencyTemplate** — id, name, description, subjectId (nullable), schoolType, gradeLevelMin/Max, isGlobalTemplate, createdByUserId (nullable for system templates), version.
 - **CompetencyCategory** — id, competencyTemplateId, name, order (groups competencies into "petals" of the flower — e.g. Reading/Writing/Listening within Language Arts).
 - **Competency** — id, categoryId, code, title, description, order, masteryLevels (related table).
 - **MasteryLevelDefinition** — id, competencyId (or categoryId if shared), levelValue, label, description.
 - **ClassCompetencyAssignment** — links a ClassGroup+Subject to a chosen CompetencyTemplate for a SchoolYear, plus per-school customizations. **Clone-on-customize**: assigning a template creates an editable school-owned copy so edits never mutate the global template.
 **Progress & assessment:**
 - **LearningProgressEntry** — id, studentId, competencyId, teacherId, classGroupId, date, masteryLevelValue, note (optional), createdAt — append-only observation log.
 - **Assessment** ("Leistungsfeststellung") — id, classGroupId, subjectId, teacherId, title, date, type (TEST/ORAL/PROJECT/HOMEWORK/OTHER), maxScore (nullable), weight, **deliveryMode** (enum incl. `DIGITAL_LOCKED`, which triggers Module F's kiosk flow).
 - **AssessmentCompetencyLink** (M:N) — assessmentId, competencyId, weight.
 - **AssessmentResult** — id, assessmentId, studentId, score (nullable), masteryLevelValue (nullable), note.
 **Grading:**
 - **GradingScheme** — id, classGroupId or subjectId, name, type (NUMERIC_GRADE/VERBAL_FEEDBACK/COMBINED), scaleDefinition (JSON, configurable per country/state).
 - **GradingWeightRule** — id, gradingSchemeId, sourceType (LEARNING_PROGRESS/ASSESSMENT), targetRef, weightPercent.
 - **ComputedGrade** — id, studentId, subjectId, classGroupId, schoolYearId, period, computedValue, computedAt, isFinalized, **finalizedByUserId (required, human — see §11.5)**, overriddenValue (nullable), overrideReason.
 **Reporting:**
 - **Report** — id, studentId, classGroupId, schoolYearId, period, generatedByUserId, generatedAt, status (DRAFT/FINAL), pdfFilePath, includesGrades, optional appendix of Digital Notebook entries for the period (teacher-selectable, off by default).
 - **ReportSection** — id, reportId, competencyCategoryId (nullable), generatedText, order.
 **Auditing:**
 - **AuditLog** — id, userId, action, entityType, entityId, timestamp, metadata (JSON).
 - **DataExportRequest** — id, requestedByUserId, scope, status, filePath, requestedAt, completedAt.
 **Design requirements:** UUID/ULID primary keys (not SQLite-only autoincrement, for portability). All timestamps UTC. Soft deletes on Student/User with an explicit, audit-logged "permanently erase" flow, never a silent hard delete. SQLite WAL mode enabled; document backup strategy (copy the `.sqlite` file + files directory; consider `litestream`). Seed script (`prisma/seed.ts`) creates a demo school, teacher login, 2 classes, ~15 students, one sample competency template (Math + German, elementary, 2 categories, ~6 competencies each, 4-point scale), sample entries and one assessment — app explorable immediately after `docker-compose up`.
 ### 4.2 Roles for this module
 Teacher, School Admin, Super Admin — see full role model in §10 (Module K), which extends this with Counselor, Parent, Student, and DPO.
 ### 4.3 Core user stories
 - **Onboarding & auth:** register/login/reset with argon2id-hashed passwords, optional TOTP 2FA, rate-limited login, CSRF protection on mutating routes.
 - **School/class/student setup:** create classes, set grade level/school type, add students (manual or CSV import with preview + error list + re-run).
 - **Competency grid management:** browse starter templates filtered by school type/grade/subject; assign (clone) to a class+subject; edit the school's copy or build custom.
 - **Logging learning progress:** fast entry from a class roster (<3 interactions), full student timeline, entries editable by the original author within a configurable window, all edits audit-logged.
 - **Assessments:** create, link to competencies with weights, bulk spreadsheet-like results entry for a whole class.
 - **Competence Flower:** per-student radar chart, aggregation method configurable per template (latest value / average of last N / weighted by recency), hover/tap shows underlying entries, exportable as PNG/SVG.
 - **Grade computation:** transparent weighted breakdown, manual override with required justification (audit-logged), computation is a pure deterministic function with unit tests covering edge cases (missing data, all-verbal, partial-year enrollment).
 - **Reports:** draft → review/edit → finalize (locked + versioned) → PDF, single or bulk-class export, phrase-template system (data-driven, not hardcoded) for narrative text per mastery level.
 - **Data portability & privacy:** export all class/school data as JSON/CSV; permanent erasure with confirmation + audit trail, cascading correctly including generated PDFs on disk (this flow is unified with Module L's rights fulfillment, §11.5).
 - **Dashboard:** classes, recent activity, students without a recent entry (follow-up flag), upcoming report deadlines — surfaced as widgets in Module J, not a separate dashboard implementation.
 ---
 ## 5. Module B — Signage (TV / Billboards)
 Replaces physical bulletin boards with school-controlled TV displays for announcements, class/period info, sponsor content, and emergency alerts.
 **Roles:** Admin/Management authors & publishes; sponsor content is admin-approved only (no self-serve); teachers can request a slide (goes to an approval queue by default, config-togglable to trusted self-publish for INFO-type slides).
 **License note (see §0):** if a school chooses to run sponsor slides that generate any revenue, that revenue is subject to SchulOS's license terms — it must be donated to an environmental protection agency or association, never kept as school or vendor income. The sponsor-slide creation UI must surface this requirement plainly to the admin at the point of setting up a sponsor slot, not just leave it to `LICENSE.md`.
 **Entities:**
 - **SignageDisplay** — id, schoolId, location/name, resolution profile, isActive.
 - **SignageSlide** — id, schoolId, type (ANNOUNCEMENT/SPONSOR/INFO/SCHEDULE), title, body/media, priority, startAt, endAt, createdByUserId, approvalStatus.
 - **SignagePlaylist** — id, displayId (or all displays), ordered slide list, rotation duration per slide.
 - **EmergencyAlert** — id, schoolId, type (FIRE/LOCKDOWN/MEDICAL/GENERAL_EMERGENCY/COUNSELING_NOTICE), message, triggeredByUserId, triggeredAt, resolvedAt, affectedScope.
 **Core flows:**
 - Normal rotation cycles active, date-windowed slides weighted by priority.
 - **Emergency override (highest priority, non-negotiable):** any `EmergencyAlert` immediately interrupts every display's rotation with a full-screen, type-styled alert, and simultaneously fires a push notification (Module H) to staff, and for FIRE/LOCKDOWN to logged-in students/parents per school policy. Clears only on explicit resolution by an authorized user, logged in AuditLog.
 - **Counseling notice**: lower-urgency, staff-facing only variant — not broadcast school-wide, avoids exposing a student's need for support (also see §11.3).
 - Sponsor slides: admin-uploaded, date-windowed, weighted rotation, never auto-published from a teacher request.
 ---
 ## 6. Module C — Communication (Messaging & Escalation)
 The escalation logic is implemented as **data-driven policy rows**, never hardcoded if/else chains.
 **Entities:**
 - **MessageThread** — id, schoolId, type (DIRECT/CLASS_ANNOUNCEMENT/SOCIAL_ROOM), participantsOrScope.
 - **Message** — id, threadId, senderId, body, sentAt, readReceipts.
 - **EscalationPolicy** — id, schoolId, fromRole, toRole, requiredPriorContactRole, waitingPeriodBusinessDays (default 3), isActive, overriddenByUserId (nullable). **All numbers here are read from this table, never hardcoded.**
 - **EscalationRequest** — id, requesterId, subject, firstContactThreadId, firstContactAt, eligibleToEscalateAt (computed using the school calendar to skip holidays — Module I), status (WAITING/ELIGIBLE/ESCALATED/RESOLVED).
 - **SocialRoom** — id, schoolId, scope (CLASS/GRADE_LEVEL/CUSTOM_GROUP), name, moderatorUserIds, isActive.
 - **ClassMessagingLock** — id, classGroupId, lockedByUserId, lockedFrom, lockedUntil (nullable = "until class ends," period-aware via Module I).
 - **DisciplinaryRecord** — id, userId, type, description, issuedByUserId, linkedIncident (nullable FK to an ExamWarning or reported message), visibleToParent (bool, enforced access control, not just UI — §11.5), createdAt.
 **Core rules (default `EscalationPolicy` rows, admin-editable):**
 - **Parent → Admin:** only for genuinely necessary matters, and only after messaging the student's homeroom teacher first. If no reply within **3 business days**, the parent gains the right to escalate to Admin on that thread.
 - **Student → Admin/Counseling:** same pattern — homeroom teacher first, then counseling/admin after 3 business days without reply.
 - **Teacher → Admin:** direct, no escalation gate.
 - **Admin override:** can loosen, tighten, or remove any `EscalationPolicy` row, or grant a case-by-case exception (logged with reason). Can issue a `DisciplinaryRecord` against a teacher or student from a messaging or exam-incident context.
 - **Social rooms:** class- or grade/"Stufe"-scoped group discussion spaces, moderated, config-controlled per school (which scopes enabled, moderation-before-visible or not).
 - **Class-hours lock:** teacher toggles `ClassMessagingLock` for their class; students blocked from student↔student and student↔staff messaging until lifted (auto-lift at period end via Module I, or manual — config toggle) — students still receive urgent Signage/Notification-level alerts.
 - **True-emergency bypass:** the escalation queue always has a parallel "urgent safety concern" path that skips the 3-business-day gate entirely (§11.7) — the escalation rule is a workflow-efficiency rule, never a barrier to reporting a genuine safety issue.
 Business-day computation reads the school's holiday/weekend calendar from Module I, never assumes fixed Mon–Fri.
 ---
 ## 7. Module D — Learning Hub
 A curriculum-aligned self-study resource center, functionally inspired by tools like Sofatutor — original or licensed/open content only, organized the same *way* (by subject/grade), never copying branding, exact video content, or exact wording.
 **Entities:**
 - **LearningResource** — id, schoolId (nullable = shared library), subjectId, gradeLevel, type (VIDEO/INTERACTIVE_EXERCISE/WORKSHEET/VOCAB_SET/GAME_MODULE), title, description, contentRef, competencyLinks (M:N to `Competency`, so resources surface contextually — e.g. from a weak competency-flower petal), createdByUserId, reviewStatus (DRAFT/PENDING_REVIEW/PUBLISHED), aiGenerated (bool).
 - **WorksheetSolution** — attached to a WORKSHEET resource, hidden by default, revealable by student after attempt or by teacher setting.
 - **VocabSet / VocabItem** — vocab lists feeding a spaced-repetition vocab trainer.
 - **GameProgress** — per-student progress/score for the learning game, scoped by subject.
 **Core flows:** teachers/admin create/edit or request AI-assisted drafting (always lands `PENDING_REVIEW`, never auto-published — human review required). Resources are discoverable by subject/grade browse, search, and contextually (surfaced next to a weak Competence Flower petal and in AI Tutor suggestions). Printable worksheets export as PDF with a teacher toggle to include/exclude the solutions page.
 ---
 ## 8. Module E — AI Tutor & AI Content Assistance
 **Hard policy — enforced server-side, not just prompt instructions:**
 - **May**: explain a concept, walk through a *similar* worked example, give a hint, define a term, nudge toward the next step on a specific question.
 - **Must never**: produce a direct final answer to an assigned homework/assessment question, complete an assignment for the student, or operate at all while any `Assessment` with `deliveryMode = DIGITAL_LOCKED` is active for that student — the AI chat endpoint independently checks "is this student currently inside an active exam session?" server-side and refuses if so, regardless of client-side UI state (ties into Module F's defense-in-depth, §8).
 - Every interaction is logged (`AiTutorInteraction`: id, studentId, subjectId/competencyId, promptSummary, responseSummary, timestamp, flaggedAsHomeworkAttempt) for teacher/admin audit — defaulting to **summary-only, pseudonymized** retention per §11.2/§11.3, with a school-configurable toggle for full-transcript retention and an explicit retention period from Module L.
 - **Translation:** on-demand AI translation of learning content (and optionally UI copy) for foreign-language students, labeled "AI-translated," with a flag-for-review path for bad translations. Home-language inference from translation requests is treated with the same minimization discipline as any other data point (§11.3) — no persistent linguistic/ethnic profile is built.
 - **Content-authoring assist** (bridges Module D): the same AI capability drafts Learning Hub resources or Signage copy, always landing in a review/draft state.
 Module E must never ship ahead of Module F's server-side test-time gate (§16, phasing).
 ---
 ## 9. Module F — Exam Mode (Digital Lockdown & Proctoring)
 **Entities:**
 - **ExamSession** — id, assessmentId, studentId, deviceId, startedAt, status (ACTIVE/PAUSED/RESUMED/ENDED/CANCELLED), pausedByUserId (nullable), pauseReason (BATHROOM_REQUEST/TEACHER_INITIATED/STUDENT_DISTRESS/THIRD_WARNING/OTHER).
 - **ExamWarning** — id, examSessionId, issuedByUserId, reason, sequenceNumber, issuedAt.
 - **ExamIncidentEvent** — id, examSessionId, type (LOCK_BREACH_ATTEMPT/BATHROOM_REQUESTED/BATHROOM_GRANTED/DISTRESS_SIGNAL/PAUSED/RESUMED/CANCELLED), metadata, timestamp.
 **Core flow:**
 1. Opening a `DIGITAL_LOCKED` assessment enters **kiosk/fullscreen lockdown** — device locks to the exam UI only, no other tabs/apps, no AI Tutor access (hard-gated), timer visible per config.
 2. **Bathroom request:** student taps "request break" → real-time alert to teacher (Module H) → teacher approval pauses that individual `ExamSession` only → resumes on return.
 3. **Distress signal:** student sends "I feel unwell / need help" at any time → immediate high-priority alert, distinct styling/sound from a routine request → teacher attends; unresolved → teacher pauses or cancels that student's exam (reason required, logged, visible to parent/admin). **This is health-adjacent data — store only a minimal event flag plus optional free text, never a structured symptom/diagnosis field, restricted to need-to-know visibility (§11.3).**
 4. **Behavior warnings:** teacher issues an `ExamWarning` for talking/looking around, etc. 1st and 2nd logged and shown to the student (2nd explicitly "final warning"); 3rd **auto-pauses** that student's exam — but the **pause itself** is a safety/integrity mechanism, not an Art. 22 "decision" about the student; any resulting **disciplinary consequence** requires a human to actually create the linked `DisciplinaryRecord` — the system never auto-generates one (§11.5).
 5. Teacher gets a live **class exam-monitor view**: every student's session status at a glance, one-tap pause/resume/cancel/warn.
 6. Lockdown enforcement is **defense-in-depth**: client-side kiosk/fullscreen API + Workbox service worker to intercept navigation attempts, **and** an independent server-side session flag blocking AI Tutor/Learning Hub/Messaging calls for the duration — never trust the client alone for an integrity feature.
 Module F is the highest integrity/device-sensitivity module — see phasing (§16): built last, after the touch/kiosk foundation (§3 tech stack) is mature.
 ---
 ## 10. Module G — Digital Notebook
 Digital replacement for the paper exercise notebook (explicit environmental motivation), supporting Germany's range of notebook/exercise-book conventions.
 **Entities:**
 - **NotebookTemplate** — id, schoolId (nullable = global), name, ruling type (lined/squared-Kariert/blank), gradeLevel/subject applicability.
 - **NotebookPage** — id, studentId, subjectId, classGroupId, templateId, createdAt, content (typed text blocks + vector "ink" strokes stored as SVG/stroke-JSON, not raster, so it stays editable/searchable/annotatable).
 - **NotebookAnnotation** — id, pageId (or linked Assessment submission), authorUserId, strokeData/comment, createdAt — non-destructive teacher correction marks, captured as its own layer so original student work is never overwritten.
 **Core flows:** students write via keyboard and/or stylus, both coexisting on a page. Teachers annotate directly on a digital test/notebook page with pen input (highlighting, circling, margin comments), mirroring paper red-pen correction. Pages organized per subject per student per school year, browsable page-by-page/date-by-date, exportable as PDF.
 ---
 ## 11. Cross-Cutting Modules H–K, and Module L (Legal & Data Protection)
 ### 11.1 Module H — Notifications (single source of alerts)
 Every push/in-app alert — messaging, exam warnings/bathroom requests, signage emergencies, escalation-eligibility notices, learning-hub review-queue items — routes through **one** `Notification` entity and **one** delivery pipeline (Web Push API via Workbox service worker + an in-app notification center). No module renders its own separate toast/badge system; every other module *emits into* Module H (per §0.4).
 `Notification` — id, recipientUserId, type, priority (NORMAL/URGENT/EMERGENCY), title, body, deepLinkRef, createdAt, readAt, deliveredChannels (JSON).
 ### 11.2 Module I — Calendar (single source of "when")
 All dates live here: class timetable/periods, exam schedules, report-card deadlines, school holiday calendar (feeds Module C's business-day math), signage slide date windows (read-only reflection of `SignageSlide.startAt/endAt`, not a duplicate field). Same non-duplication logic applies to every other module with a date.
 ### 11.3 Module J — Dashboard & Widgets
 Every role gets a customizable home dashboard: add/remove/reorder widgets from an approved catalog, each a thin read-only view into one owning module. Layout persists per user (`UserDashboardLayout` — userId, widgetInstances JSON: widgetType, position, size, config). Widgets never contain business logic beyond fetch/render — structurally enforcing §0.4.
 ### 11.4 Module K — Identity, Roles & Admin
 Roles: **Teacher**, **School Admin**, **Super Admin** (project/instance maintainer), **Counselor** ("Rehberlik" — receives escalated threads per Module C), **Parent** (read-only into their child's reports/grades/flower/visible disciplinary records, messaging per Module C), **Student** (Learning Hub, gated AI Tutor, Exam Mode, Digital Notebook, gated Communication), and **DPO** (Module L, §11.8 — compliance-surface read access + gate-approval power over high-risk modules). Sponsor is not a login role — sponsor content is admin-managed only. All escalation thresholds, warning limits, kiosk toggles, and messaging rules are exposed in a single **Admin Policy Console** so a non-technical admin can tune the entire rules engine without a code change.
 ### 11.5 Module L — Legal, Data Protection & Rights Compliance (EU/DE)
 This module governs every other module. It layers **EU GDPR (DSGVO)**, the **German Federal Data Protection Act (BDSG)**, and the **state-level School Acts (Landesschulgesetze) and School Data Protection Ordinances**, which vary across all 16 Bundesländer and often override/supplement the GDPR baseline for public schools — plus **Landespersonalvertretungsgesetz (LPVG)/BPersVG** for staff co-determination, and general child-rights principles (KJSG/UN-CRC).
 **Data protection by design & default (Art. 25), applied to every module:**
 - Data minimization at schema level — every optional field defaults to *not collected* (e.g., `Student.dateOfBirth` stays nullable, populated only if state rules actually require it).
 - Purpose limitation — each table documents its legal basis/purpose in `docs/DATA_MODEL.md` (e.g., `ExamWarning` → exam integrity & pedagogical record; legal basis: Schulgesetz duty of fair assessment).
 - Pseudonymization where feasible (e.g., `AiTutorInteraction` stores a pseudonymous reference by default).
 - Storage limitation — every personal-data entity has a `retentionPolicyRef` into `DataRetentionPolicy` (below), swept by a scheduled job, never a manual "someone remembers" process.
 - Access control defaults to deny — a Teacher's access to a student is scoped to classes currently taught; losing that assignment auto-narrows access.
 **Special-category / sensitive data (Art. 9) — explicit flags at every touchpoint:**
 - The Exam Mode **distress signal** (§8) is health-adjacent: minimal event flag only, restricted visibility, short default retention unless it escalates into a formal record.
 - `DisciplinaryRecord` — highly sensitive minor data even if not technically Art. 9; same need-to-know visibility model; `visibleToParent` is a real enforced access-control flag, never just a UI toggle.
 - Signage **counseling notices** (§5) never broadcast identifying detail school-wide.
 - No field anywhere in the schema for race/ethnicity/religion/sexual orientation/union membership/political opinion — explicitly out of scope, permanently.
 **Teacher rights & staff co-determination (Personalrat/unions):**
 - Any feature capable of monitoring staff behavior or performance (`AuditLog` on teacher actions, message read-receipts, exam-monitor response-time visibility, content-approval analytics, etc.) **triggers Personalrat co-determination rights** under the relevant state LPVG (or BPersVG) — analogous to § 87(1) No. 6 BetrVG in the private sector.
 - Before shipping to a real school, each such feature needs a **Dienstvereinbarung-ready spec sheet** (`docs/personalrat/<module>.md`): what's logged, who sees it, retention, and an explicit statement it won't be used for unilateral performance evaluation without Personalrat agreement.
 - Recommend looping in **GEW/VBE** and the Personalrat during rollout — surfaced as a required onboarding checklist item (§11.9) before enabling any monitoring-capable module.
 - Teachers get the same self-service data-export as students (reusing the one pipeline, §0.4), and a per-teacher "quiet hours" setting for non-urgent notifications (urgent/emergency alerts always bypass this by design).
 **Student rights:**
 - **Access (Art. 15):** full export via the one Module K export pipeline — competency entries, grades, notebook pages, messages, disciplinary records, AI Tutor interaction summaries.
 - **Rectification (Art. 16):** via existing audit-logged edit flows in Module A.
 - **Erasure (Art. 17), bounded by retention duties:** account/active data erasable on request or on leaving school, except records under an active `DataRetentionPolicy`; erasure response reports what was retained and why.
 - **No solely-automated decisions with legal/significant effect (Art. 22):** `ComputedGrade.isFinalized` cannot become `true` without a `finalizedByUserId` (a human). Exam Mode's third-strike **pause** may be automatic (safety mechanism), but any resulting `DisciplinaryRecord` requires a human actor — never auto-generated.
 - **No repurposing into a broader "risk score"** or similar — explicitly a forbidden feature (not just unbuilt), documented in `docs/ROADMAP.md`'s "will not build" section.
 **Retention periods — config-driven (extends §0.2):**
 - New entity **DataRetentionPolicy** — id, schoolId, dataCategory (LEARNING_PROGRESS/ASSESSMENT_RESULT/FINAL_REPORT/DISCIPLINARY_RECORD/EXAM_INCIDENT/MESSAGE/AI_TUTOR_LOG/NOTEBOOK_PAGE/SIGNAGE_LOG), retentionPeriodMonths, legalBasisNote (free text, filled by the school's DPO), reviewedByUserId, reviewedAt.
 - Ship **empty of defaults** for legally-mandated categories (forces the DPO to enter their state's actual correct numbers, never a guessed default); ship **modest editable defaults** for non-mandated, product-only categories (e.g., AI Tutor log summaries ~12 months).
 **Parent rights:**
 - **Information duty (Art. 13/14):** plain-language privacy notice generated from the same module documentation/retention config, so it can never drift from what the system actually does.
 - **Consultation/approval before rollout:** most state School Acts require **Schulkonferenz**/**Elternbeirat** consultation before new pupil-data software goes live — a literal onboarding checklist step (§11.9); no silent activation of high-impact modules (Signage emergency broadcast, Exam Mode, AI Tutor) without acknowledging this happened.
 - **Access to their child's records:** grades, reports, competence flower, `visibleToParent`-flagged disciplinary entries — never paywalled or admin-discretionary in a way that would violate this right.
 - **Messaging rights:** the escalation rule (§6) is a workflow-efficiency rule, never a barrier to a genuine safety concern — a parallel urgent path always bypasses the gate.
 **School's rights & obligations (controller responsibilities):**
 - **Controller vs. processor:** the school (via its Schulträger) is normally the data controller; a self-hosted instance run by the school itself simplifies Art. 28 needs, while a third-party-operated instance requires a signed **Art. 28 AVV** — ship a starting-draft template in `docs/legal/avv-template.md`, explicitly marked for the DPO/lawyer to finalize.
 - **Records of Processing Activities (Art. 30):** `docs/legal/verzeichnis-verarbeitungstaetigkeiten.md`, generated mechanically from each module's purpose+legal-basis notes.
 - **DPIA (Art. 35):** the platform plausibly meets mandatory-DPIA criteria (large-scale children's-data processing, systematic monitoring via Exam Mode, health-adjacent signals). **Modules E (AI Tutor) and F (Exam Mode) stay disabled in the Admin Policy Console until a `DpiaRecord`** (id, schoolId, moduleScope, completedAt, approvedByUserId, documentRef) exists.
 - **DPO role** (Module K extension): read access to RoPA, retention policy table, DPIA records, and school-wide audit logs, plus gate-approval power over high-risk modules.
 **Product-level compliance onboarding gate** — implemented as a required flow for every new school instance before real student data is usable:
 1. Enter Schulträger/DPO contact details.
 2. Select the Bundesland → auto-loads that state's known retention-period *prompts* (labels only, never assumed numbers) into `DataRetentionPolicy` for confirmation.
 3. Log Elternbeirat/Schulkonferenz consultation status per module before it can go live for real use.
 4. Log Personalrat consultation status for every monitoring-capable module.
 5. Complete/upload the DPIA before Modules E and F unlock.
 6. Only then does the Admin Policy Console allow those modules to leave "disabled" state.
 This makes compliance a DB-driven, enforced product flow, consistent with §0.2/§0.6 — never a one-time audit forgotten after launch.
 **On the `Klotzkette/claude-fuer-deutsches-recht` reference repository:** a large, community-maintained collection of Claude Code skills/prompts for German legal practice (labor, corporate, insolvency, data-protection, procedural law, plus Schulrecht/Hochschulrecht clusters), explicitly published as an experimental legal-drafting aid, not a certified compliance product. **Bounded recommended use:** consult its `datenschutzrecht` skill as a drafting assistant when preparing the AVV template, the RoPA structure, and the parent-facing privacy notice — a faster, correctly-structured first draft. **Never** treat its output (or this PRD's, or any AI's) as a substitute for sign-off by the school's actual DPO or legal counsel — every generated `docs/legal/*.md` file should carry that disclaimer as a literal header. It is a prompt/skill library, not a runtime dependency — keep it entirely out of the app's dependency tree.
 ---
 ## 12. Module M — Core AI Orchestrator (ZeroClaw)
 ### 12.1 Purpose
 A single, self-hosted **"core brain"** service that (a) powers every AI-driven capability already specified elsewhere in this PRD (AI Tutor §8, Learning Hub content-assist §7, translation §8, report-narrative drafting §4.3) through **one** implementation instead of scattered ad hoc AI calls — consistent with §0.4's no-duplication principle — and (b) adds **automations and an assistant surface for Admin, Teachers, and Students**, reachable through the web UI, plus **event-triggered background automations (SOPs)** that keep the school running without a human having to remember every routine task.
 Built on **ZeroClaw** (`zeroclaw-labs/zeroclaw`) — a self-hosted, provider-agnostic agent runtime (Rust) with: a gateway + web dashboard, pluggable LLM providers (Anthropic, OpenAI, local Ollama, ~20 others — so a school can choose a paid API or a fully local/free model), a security-first "supervised by default" autonomy model with sandboxing and cryptographic tool receipts on every action, and an event-triggered **SOP (Standard Operating Procedure) engine** (cron / webhook / MQTT-style triggers with approval gates and resumable runs). This maps cleanly onto what the school asked for: a core system that manages/oversees the project, helps admin, and helps teachers and students in various situations.
 ### 12.2 Non-negotiable boundary rules (extends §0 and Module L)
 1. **CoreAI never talks to the database directly.** All data it needs or writes flows through the **backend's API**, using scoped, audited service credentials — never a raw DB connection. This keeps the "one write path" property from §3 intact and means every CoreAI action is subject to the exact same permission/audit-log/retention rules as a human user's action (Module K/L).
 2. **CoreAI must independently enforce Module F's exam-lockdown gate.** Even though the backend already refuses AI Tutor calls during an active `DIGITAL_LOCKED` exam session (§8), CoreAI's own request handler checks the same "is this student in an active exam session?" flag before responding to any tutoring-style request — defense-in-depth, not trust-the-caller (§9's principle, restated here for the AI layer specifically).
 3. **No autonomous high-stakes actions.** CoreAI runs in ZeroClaw's `supervised` autonomy mode by default for this deployment, and the following actions are **hard-configured as always requiring human approval**, never auto-executed even in a future "trusted" mode: finalizing a `ComputedGrade`, creating a `DisciplinaryRecord`, triggering an `EmergencyAlert`, sending a school-wide broadcast notification, or modifying any `EscalationPolicy`/`DataRetentionPolicy`/other Module L policy row. This mirrors Module L's Art. 22 "no solely-automated decisions" requirement (§11.5) and extends it as an engineering constraint on the agent runtime itself, not just on the grading algorithm.
 4. **Every interaction is logged**, extending the existing `AiTutorInteraction` pattern (§8) into a general `CoreAiInteractionLog` (id, actorUserId, actorRole, requestType [TUTOR_HINT / CONTENT_DRAFT / TRANSLATION / ADMIN_ASSIST / TEACHER_ASSIST / SOP_RUN], promptSummary, responseSummary or actionTaken, timestamp), retained per a `DataRetentionPolicy` row like any other personal-data category (§11.5) — summary-only/pseudonymized by default, full-transcript retention as a school-configurable opt-in.
 5. **Version updates are pulled deliberately, not silently.** A scheduled job checks `zeroclaw-labs/zeroclaw` GitHub releases for the latest tagged version and opens an **update-available notice** in the Admin Policy Console (§11.4) — it never auto-replaces the running container image in production without an admin approving the upgrade (rebuild/redeploy), consistent with Module L's "no silent activation of a module" philosophy (§11.9). Pin the running version explicitly in `docker-compose.yml`/the K8s `Deployment` image tag; the update job only proposes a new pin.
 ### 12.3 Capabilities (mapped to existing modules — no new AI logic duplicated elsewhere)
 - **Student-facing (via Module E's existing hard-gated AI Tutor surface):** concept explanations, hints, translation of Learning Hub content — unchanged in policy from §8, now simply *implemented by* CoreAI instead of a bespoke integration.
 - **Teacher-facing assistant:** natural-language help drafting Learning Hub resources or Signage announcement copy (still lands in `PENDING_REVIEW`/admin-approval queues per §5/§7 — CoreAI drafts, a human publishes); summarizing a student's or class's recent competency/assessment trend on request (read-only, sourced via the backend API, never a new parallel analytics store — §0.4); answering "how do I…" product-usage questions about the platform itself.
 - **Admin-facing assistant:** natural-language queries over data the admin is already permitted to see via the backend API ("this week'in sınav uyarı sayısı ne kadar?", "hangi öğrenciler 30 gündür kayıt almadı?" — mirrors the existing dashboard follow-up-flag widget, §4.3), drafting (never sending) parent/staff communications, and surfacing Module L compliance status (DPIA/consultation checklist progress, §11.9) in plain language.
 - **Automations (SOP engine)** — background, event-triggered, still bounded by §12.2's approval rules for anything high-stakes:
  - Scheduled reminders: upcoming report-card deadlines (Module I), pending Learning Hub review-queue items (Module D), retention-sweep due dates (Module L).
  - Anomaly flags surfaced to admin/teacher for human review (never auto-actioned): a student with an unusually high count of `ExamWarning`s in a period, a class with no `LearningProgressEntry` activity in an unusually long window, an `EscalationRequest` that just became eligible (already needs a notification per Module C — CoreAI can be the mechanism that generates and files it via the Notifications module, H, rather than a second notification path).
  - DPIA/consultation-checklist nudges for the DPO/admin during onboarding (§11.9), so the compliance gate isn't just a form nobody remembers to finish.
 ### 12.4 Web interface & access
 - CoreAI's own ZeroClaw gateway/dashboard is **not** exposed publicly. It's reachable only from the backend container internally, and — for admin/DPO users who want direct visibility into agent memory, SOP runs, and tool-call receipts (useful for audit/trust, matching Module L's transparency goals) — through a **backend-proxied, authenticated route** embedded in the platform's own Admin section, inheriting the platform's existing auth/session/role checks rather than standing up a second login system.
 - Student- and teacher-facing AI features appear as ordinary parts of the existing frontend (AI Tutor panel, "draft with AI" buttons in Learning Hub/Signage authoring, admin assistant chat panel) — the person using them never needs to know or care that ZeroClaw is the engine underneath; this keeps the UI unified per §0.4, with CoreAI purely a backend implementation detail of Module M's capabilities.
 ### 12.5 Data flow summary
 `frontend → backend API → (backend decides: handle directly, or call coreai) → coreai (ZeroClaw agent loop, model-provider call, tool use if applicable) → response back to backend → backend applies permission/audit/approval rules → frontend`. CoreAI never receives more data than the specific request needs (principle of least data, §11.2), and never persists school records itself — its only local state is agent memory/config on its own volume plus the `CoreAiInteractionLog` it asks the backend to write on its behalf (same audited write path as everything else).
 ---
 ## 13. Global UI/UX Design System (Cross-Cutting — Not a Separate Page or Menu)
 **Read this section as a mandate that applies inside every module (A–M), not as a feature area of its own.** There is no "tablet view" screen or "mobile menu" anywhere in the product — every screen in the app *is* built from one shared, device-adaptive design system from the start. A module that renders its own one-off layout, spacing scale, or button style instead of using the shared system is a bug, under the same no-duplication principle as §0.4 (which forbids duplicate *functionality*; this section forbids duplicate *visual language*).
 ### 13.1 Device priority (who actually uses what)
 - **Tablet is the primary, default-designed-for surface** — teachers logging entries or running Exam Mode, students in the Learning Hub/Digital Notebook, all predominantly on tablets in a classroom.
 - **PC/desktop is fully supported and important**, especially for Admin/office workflows (Signage authoring, Module L compliance console, bulk grading review) — but it's not assumed to be *the* primary surface; the design system must feel equally native on both, not "tablet with a desktop afterthought" or "desktop squeezed onto tablet."
 - **Mobile phone** gets a constrained but fully functional layout (notifications, messaging, quick lookups) — not the design target, but never broken.
 - One responsive layout engine and one component library serve all three. The same `<Card>`, `<Button>`, `<DataTable>`, etc., adapt their density/spacing per breakpoint — they are never reimplemented per device class.
 ### 13.2 "Feels like a native app," not "a website you're viewing on a tablet"
 - Installable PWA (leveraging Workbox, §3) with a real app icon, splash screen, and standalone display mode — opening it should not look or feel like a browser tab.
 - App-like navigation: a persistent primary navigation (bottom tab bar on tablet/mobile touch contexts, a persistent side rail on desktop) rather than deep menu trees or breadcrumb-only navigation — a teacher moving between "my classes," "notifications," "calendar," and "messages" should never be more than one tap away from any of them.
 - Smooth, purposeful transitions between views (not jarring full-page reloads) and consistent, immediate feedback on every touch interaction (pressed/loading/success/error states defined once in the design system and reused everywhere — never a module-specific spinner or toast style).
 - Gesture support where it aids the primary tablet workflows (e.g., swipe to move between students in a class roster while logging entries) — but never as the *only* way to perform an action; always paired with an explicit tappable control for accessibility.
 - Genuinely large, confident touch targets (44×44pt minimum, larger on primary actions like exam controls and entry-logging buttons) and generous spacing at the tablet breakpoint; the desktop breakpoint is allowed to be denser (smaller controls, more columns, hover states, keyboard shortcuts) since a mouse/keyboard user has different ergonomics — same system, different calibration, documented explicitly per breakpoint in `docs/DESIGN_SYSTEM.md`.
 ### 13.3 Professional, modern, deliberate — not a generic admin-panel template
 - A real design-token set (color palette, type scale, spacing scale, elevation/shadow system, motion/easing curves, iconography) defined once and documented in `docs/DESIGN_SYSTEM.md`, not scattered inline Tailwind classes reinvented per screen.
 - Original visual identity — no reuse of Digidoo's illustrations, palette, or copy (§1); a distinct, warm, education-appropriate accent color and a typeface pairing chosen deliberately, not left at framework defaults. The result should read as a considered, purpose-built product, not an unstyled shadcn/ui scaffold or a generic SaaS-admin-template look.
 - Consistent empty states, loading states, and error states — designed once, reused everywhere (a new module never invents its own "no data yet" illustration or wording style).
 - Dark mode is a reasonable stretch goal (not MVP-required) but if built, is a token-level theme swap, not a second parallel set of hand-styled screens.
 - Full keyboard navigation and screen-reader labels (WCAG 2.1 AA target) built into the shared component library itself, so every module inherits accessibility correctly by construction rather than needing to re-implement it — extended specifically to Signage (legible from a distance) and Exam Mode (usable with assistive tech even inside lockdown, §9).
 ### 13.4 How this is enforced, not just aspired to
 - Ship a **shared component library** (shadcn/ui as the base, customized per §13.3's tokens) as its own package inside the frontend container's codebase; every module imports from it — no module-local component duplicates.
 - Maintain `docs/DESIGN_SYSTEM.md` as the single source of truth for tokens, breakpoints, and component usage patterns, and a component-preview environment (e.g., Storybook or an equivalent lightweight catalog) so contributors can see and reuse existing components before building a new one — checking this catalog before adding a component is a step in the same "check whether it already exists" discipline as §0.4.
 - Empty states and an onboarding checklist for a brand-new school ("1. Create your first class → 2. Assign a competency grid → 3. Add students → 4. Log your first entry") are themselves built from the shared empty-state/checklist components, not a bespoke one-off page.
 - Free browser push notifications via the Web Push API (no paid vendor required) follow the same shared notification-UI pattern everywhere they surface (Module H).
 - German and English complete from day one (`next-intl` or equivalent); default German (DACH audience), English complete since this is an open project others may adopt — all copy flows through the same i18n system so no module ships hardcoded, untranslated strings.
 ---
 ## 14. Non-Functional Requirements
 - **Self-hostability:** one `docker-compose.yml`, one `.env.example`, a `README.md` a non-expert school IT person can follow — target under 10 commands from `git clone` to a running app.
 - **Performance:** SQLite + server-rendered pages where sensible; paginate long lists (rosters, entry timelines).
 - **Backups:** documented, scripted daily backup (cron copying the SQLite file + files directory); consider `litestream`; document SQLite's concurrent-write limits and when a school should be advised to migrate to Postgres.
 - **Security:** Zod (or equivalent) input validation at every API boundary, parameterized queries only, secure cookie flags, rate limiting on auth endpoints, dependency vulnerability scanning in CI. Exam Mode integrity is defense-in-depth (Module F, §9). Emergency Alerts (§5) need the lowest possible latency path, treated as fire-drill-grade reliability, with explicit failure/retry testing.
 - **Data minimization:** AI Tutor logging defaults to summary-only (§8); Digital Notebook stroke data is exportable/erasable like any other student record (§11.5).
 - **Accessibility:** WCAG 2.1 AA across all modules.
 - **CI/CD:** GitHub Actions running lint, typecheck, unit tests, E2E smoke tests on every PR.
 ---
 ## 15. Project Structure (suggested — monorepo housing all four containers)
 ```
 /frontend            # React/Next.js container
  /app or /src
  /components         # shared design-system component library (§13.4) — every module imports from here
  /public
  Dockerfile
 /backend             # API/business-logic container — the only DB + CoreAI caller
  /src
    /api
    /db              # Prisma/Drizzle client, schema (talks to db container/SQLite-or-libSQL)
    /grading         # pure grading calculation functions + tests
    /reports         # report generation + PDF rendering
    /permissions     # authorization helpers
    /compliance      # retention sweeps, DPIA gate checks, RoPA generation, onboarding gate (§11.9)
    /coreai-client    # typed client for calling the coreai container's API (§12.5)
  /prisma (or /drizzle)
    schema.prisma
    seed.ts
    migrations/
  Dockerfile
 /db                   # SQLite-file mode config for docker-compose, OR libSQL/`sqld` server config for K8s mode
  Dockerfile (or reference upstream sqld image)
 /coreai               # ZeroClaw-based container (Module M)
  config/             # ZeroClaw TOML config (providers, agent aliases, SOPs, autonomy/risk profile)
  sops/                # SOP definitions (reminders, anomaly flags, DPIA nudges — §12.3)
  Dockerfile
 /k8s                  # Kubernetes manifests (or Helm chart) — Deployments/StatefulSet/Services/Ingress/NetworkPolicy per §3.1
  frontend/
  backend/
  db/
  coreai/
 /docs
  ARCHITECTURE.md      # four-container boundary rules, stack rationale, self-hosting + K8s paths
  SELF_HOSTING.md
  DATA_MODEL.md        # ER diagram + entity descriptions + purpose/legal-basis notes
  DESIGN_SYSTEM.md     # tokens, breakpoints, component usage patterns (§13.4)
  CONTRIBUTING.md
  ROADMAP.md            # incl. explicit "will not build" section
  /legal
    avv-template.md
    verzeichnis-verarbeitungstaetigkeiten.md
  /personalrat
    <module>.md          # co-determination spec sheets per monitoring-capable module
 /tests
  unit/
  e2e/                  # incl. cross-container flows: frontend → backend → coreai
 docker-compose.yml      # four services: frontend, backend, db, coreai
 .env.example
 README.md
 LICENSE                 # custom SchulOS license: free to copy/use, no-sale, revenue → environmental-protection donation (§0)
 ```
 ---
 ## 16. Revised MVP Phasing
 Given the scope, ship in **stages**, each fully functional and demo-able:
 **Stage 1 — Foundation:** Identity/roles/schools/classes/students, Module A (Academics Core) end-to-end, Calendar (Module I) as the shared date backbone, Notifications (Module H) skeleton, Dashboard/Widgets (Module J, 2–3 widgets), the **compliance foundation** (`DataRetentionPolicy` table, `docs/DATA_MODEL.md` purpose/legal-basis notes, onboarding gate skeleton — §11.9 steps 1–2), and the **four-container skeleton itself**: frontend/backend/db split into their own containers with the docker-compose (and a first-pass `/k8s` manifest set) working end-to-end for Stage 1's features before any other module is added — this is the point to validate the container/network boundaries (§3, §3.1) are right, since every later stage builds on them.
 **Stage 2 — Communication & Signage:** Module C in full (messaging, escalation policy engine, social rooms, class lock, the urgent-safety bypass path), Module B (signage, including Emergency Alert override), wired into Module H/I. Add onboarding gate steps 3–4 (Elternbeirat/Schulkonferenz and Personalrat consultation logging) since Module C introduces monitoring-adjacent surfaces (read receipts, audit trail).
 **Stage 3 — Learning, AI & CoreAI:** the **coreai container is introduced here** (Module M, §12) — bring it up with only the lowest-risk capabilities first: teacher/admin content-drafting assist (§7) and simple scheduled reminders (§12.3), both already human-review-gated by their owning modules. Then Module D (Learning Hub, manual authoring first, AI-assist fast-follow through CoreAI), then Module E (AI Tutor through CoreAI, with hard test-time gating enforced at **both** the backend and CoreAI layers from day one — never ship before Module F's gate exists, and never ship CoreAI's admin/teacher assistant capabilities that touch grading, discipline, or broadcast messaging before §12.2's approval-required rules are actually enforced in code). DPIA gate (§11.9 step 5) must be functional before Module E — or any CoreAI capability that processes student data — can be enabled for real use.
 **Stage 4 — Exam Mode & Digital Notebook:** Module F (kiosk lockdown, warnings, monitor view) and Module G (typed + stylus notebook, teacher annotation) — highest-integrity/most device-sensitive modules, saved for last so the touch/kiosk foundation is mature first, and gated behind the completed DPIA per §11.9.
 Each stage gets its own seed data, test-suite additions, and `docs/ROADMAP.md` entry.
 ---
 ## 17. Definition of Done (MVP + full platform)
 **Core functionality (per module, §4–10):**
 1. Auth (register/login/reset, optional 2FA) end-to-end.
 2. School → SchoolYear → ClassGroup → Student → Enrollment CRUD with CSV import.
 3. At least 2 seeded starter competency templates with categories, competencies, and a mastery scale.
 4. Template assign/clone + school-copy editing.
 5. Fast entry-logging UI from a class roster.
 6. Assessments with bulk grid entry.
 7. Competence Flower radar chart, computed from real data, configurable aggregation.
 8. Grading scheme + weight rules + computed grade with breakdown + manual override (human-finalized only, §11.5).
 9. Report generation (draft → final → PDF), single and bulk export.
 10. Data export (JSON/CSV) and erasure flow, audit-logged, unified across student/teacher/parent (§11.5).
 11. i18n scaffolding, DE + EN complete for implemented screens.
 12. Dockerized self-hosting + docs, seed script for demo data.
 13. Signage with working Emergency Alert override.
 14. Communication with the full escalation-policy engine and urgent-safety bypass.
 15. Learning Hub with at least manual (non-AI) content authoring functional.
 16. AI Tutor shipped only after Exam Mode's server-side gate exists and is tested.
 17. Exam Mode with the full bathroom/distress/warning flow and defense-in-depth enforcement.
 18. Digital Notebook with typed + stylus input and non-destructive teacher annotation.
 19. CoreAI (Module M) running as its own container, reachable only through the backend, with §12.2's approval-required action list actually enforced in code (verified by a specific test, not just documented), and the version-update job proposing (never silently applying) new ZeroClaw releases.
 20. Four-container architecture (frontend/backend/db/coreai) working via both `docker-compose.yml` and the `/k8s` manifest set, with `NetworkPolicy`/equivalent boundary rules from §3.1 actually in place, not just documented.
 21. Every screen across every module built from the single shared design-system component library (§13), with `docs/DESIGN_SYSTEM.md` accurate and a working component-preview catalog — spot-checked by picking three unrelated modules (e.g., Signage authoring, the AI Tutor panel, and Module L's compliance console) and confirming they share identical button/card/spacing/typography treatment, not three different visual languages.
 22. Test suite: unit tests for grading logic, permissions, and the escalation-policy business-day calculator specifically (not just an overall coverage %); Playwright E2E covering register → create class → assign template → add students → log entries → generate report, plus a signage-emergency-override smoke test, an exam-session lifecycle smoke test, and a CoreAI smoke test (a teacher content-draft request round-trips through backend → coreai → backend correctly, and an AI Tutor request during an active exam session is correctly refused by CoreAI even if a test double bypasses the backend's own gate).
 **Compliance (Module L, §11.5) — a school instance is not production-ready until:**
 - [ ] `docs/DATA_MODEL.md` has a purpose + legal-basis note for every personal-data entity.
 - [ ] `DataRetentionPolicy` rows exist (school-confirmed, not defaulted) for every legally-mandated category.
 - [ ] `docs/legal/verzeichnis-verarbeitungstaetigkeiten.md` (RoPA) generated and reviewed.
 - [ ] AVV signed (third-party-operated instance) or explicitly marked not-applicable (self-hosted-by-school).
 - [ ] DPIA completed and on file before Modules E or F are enabled.
 - [ ] Elternbeirat/Schulkonferenz consultation logged per module.
 - [ ] Personalrat consultation logged for every monitoring-capable module.
 - [ ] Student/parent/teacher self-service data-export flows tested end-to-end.
 - [ ] Privacy notice generator produces an accurate, plain-language notice matching actual configured retention periods (no drift between docs and DB config).
 `README.md` should state SchulOS's mission plainly: a free tool built by DFM Solutions and family, to help protect the environment and reduce paper/print dependency in schools; explain the license (free to use, no-sale, revenue-to-environmental-donation, §0); and explain how to contribute.
 ---
 ## 18. Phase 2 / Stretch Goals (out of scope for v1 — document in `docs/ROADMAP.md`)
 - SSO (OIDC) support for schools with existing identity providers.
 - Optional Postgres deployment mode for larger multi-school instances.
 - Native offline-first PWA mode for spotty classroom Wi-Fi.
 - **Explicitly forbidden, not just deferred (§11.5):** any feature that repurposes competency/AI-Tutor/behavioral data into a cross-context "student risk score" or similar profiling construct without a wholly separate legal basis and DPIA.
 ---
 ## 19. Instructions for the AI Coding Agent
 1. Produce `docs/ARCHITECTURE.md` and the **full** Prisma/Drizzle schema (all entities across §4–11) and get sign-off before writing app code — this schema is large enough that an early wrong decision is expensive.
 2. Build the shared **Policy/Config layer** (backing the Admin Policy Console, §11.4, and `DataRetentionPolicy`, §11.5) **before** implementing Module C's escalation logic or Module F's warning thresholds — both must read from it, proving "no hardcoding" structurally, not just by discipline.
 3. Build Module H (Notifications) and Module I (Calendar) early, in Stage 1, precisely because every later module depends on them — prevents each module from inventing its own notification/date logic.
 4. When implementing Module F, write the **server-side session-gating check** before the kiosk UI — the security/integrity property must not depend on the UI shipping correctly.
 5. Flag explicitly, in `docs/DATA_MODEL.md`, every place a rule/threshold/retention-period is read from a policy table, and every entity's purpose + legal basis (so a future compliance audit can confirm zero hardcoded business rules and a complete RoPA).
 6. Never enable Module E or F for a school instance until the corresponding onboarding-gate step (§11.9) is satisfied — build this as an actual code-level check, not a documented process someone might skip.
 7. Keep commits small and descriptive; maintain a CHANGELOG. After each feature, write its unit/E2E tests before moving to the next.
 8. Flag any point where a competency/grading/retention policy varies by German Bundesland — expose it as configuration, never hardcode one state's rules, and note the assumption in `docs/DATA_MODEL.md`.
 9. Remember throughout: **this is a free, non-commercial, donation-supported school project.** Prefer boring, dependency-light, self-hostable solutions over anything introducing a paid third-party service or vendor lock-in — and treat every compliance requirement in §11 as a hard constraint, not a stretch goal.
 10. When implementing Module M (§12), build the backend↔coreai API contract and the **approval-required action list (§12.2)** before wiring up any actual model-provider call — the boundary/safety layer must exist before the "smart" part does, mirroring instruction #4's approach to Module F.
 11. Pull `zeroclaw-labs/zeroclaw` at a pinned, explicitly-chosen release tag — never track `master`/latest automatically in a running deployment (§12.2's version-update rule) — and adapt its `deploy-k8s/` reference manifests for the coreai container rather than writing Kubernetes YAML from scratch.
 12. Build the shared design-system component library (§13.4) — tokens, breakpoints, the base component set — **before** building any individual module's screens, and build every module's UI exclusively from it. Treat a module that introduces its own one-off button/card/spacing style as a defect to fix immediately, not a style-guide suggestion for later.
@@ -1,155 +0,0 @@
 # SchulOS
 **Free & open-source competence & grading platform for schools**
 _Kompetenzorientierte Beurteilung fur alle_
 ---
 ## What is SchulOS?
 SchulOS is a comprehensive, free, and open-source web application designed for schools to track student competencies, manage assessments, compute grades, and generate reports. Built with modern web technologies, it provides a rich, professional interface for teachers, school administrators, students, and parents.
 ## Features
 ### Core Modules
 - **Dashboard** — Overview with KPIs, trends, recent activity, and quick actions
 - **Classes & Students** — Manage classes, enrollments, seating order, and student profiles
 - **Competency Grids** — Assign and track competency templates per class and subject
 - **Progress Entries** — Record and visualize student learning progress over time
 - **Competence Flower** — Radar chart visualization of student competencies per subject
 - **Mastery Matrix** — Grid view of student mastery levels across all competencies
 - **Assessments** — Create and manage tests, oral exams, projects, and homework
 - **Grading** — Compute grades with configurable weight rules, overrides, and breakdowns
 - **Reports** — Generate narrative report cards with phrase templates
 - **Attendance** — Track student attendance with sessions, stats, and calendar heatmap
 - **Calendar** — Unified calendar view of assessments, attendance, and deadlines
 - **Lesson Plans** — Plan and manage lessons with objectives, materials, and reflections
 - **Analytics** — Insights with mastery trends, risk detection, and competency analysis
 ### Additional Features
 - **Parent Communication** — Message system for parent-teacher communication
 - **Behavior Tracking** — Incident logging with categories, severity, and follow-up
 - **Rubric Library** — Create and share analytic/holistic rubrics
 - **Comment Bank** — Reusable comment templates for report cards
 - **Curriculum Coverage** — Track which competencies have been assessed
 - **Settings** — Admin panel with user management, demo accounts, audit logs, and data export
 - **Student Detail** — Comprehensive student profile with journey timeline, grades, and export
 ### Technical Features
 - **Keyboard Shortcuts** — Cmd+K command palette, Cmd+1-9 view switching, Cmd+/ shortcuts dialog
 - **Batch Operations** — Batch deletion of progress entries
 - **Drag-and-Drop** — Student seating order reordering
 - **Custom Color Palette** — 7 preset colors + custom picker for competence flower
 - **Notification System** — Deadline reminders and missing observation alerts
 - **Onboarding Tour** — Guided tour for new users
 - **CSV Export** — Export student data as CSV
 - **Print Support** — Print-optimized CSS for report generation
 - **Dark Mode** — Full light/dark mode support with next-themes
 - **i18n** — 700+ translation keys in German and English
 - **Responsive Design** — Mobile-first responsive layout
 ## Tech Stack
 - **Framework**: Next.js 16 (App Router)
 - **Language**: TypeScript 5
 - **Styling**: Tailwind CSS 4 + shadcn/ui
 - **Database**: Prisma ORM + SQLite
 - **State**: Zustand + React Query
 - **Charts**: Recharts (Radar, Bar, Line)
 - **Auth**: Cookie-based sessions + bcryptjs
 - **Icons**: Lucide React (no emojis)
 - **Animations**: Framer Motion
 ## Getting Started
 ### Prerequisites
 - Node.js 18+ or Bun
 - npm, yarn, or bun
 ### Installation
 ```bash
 # Clone the repository
 git clone https://github.com/cetinmustafa83/schulos.git
 cd schulos
 # Install dependencies
 npm install
 # or: bun install
 # Set up environment
 cp .env.example .env
 # Push database schema
 npm run db:push
 # Generate Prisma client
 npm run db:generate
 # Seed demo data
 npm run db:seed
 # Start development server
 npm run dev
 ```
 ### Demo Accounts
 After seeding, you can log in with these demo accounts:
 | Role | Email | Password |
 |------|-------|----------|
 | Admin | `demo@competencetrack.org` | `Demo2025!` |
 | Teacher | `demo.teacher@competencetrack.org` | `Demo2025!` |
 | Student | `demo.student@competencetrack.org` | `Demo2025!` |
 | Parent | `demo.parent@competencetrack.org` | `Demo2025!` |
 ## Project Structure
 ```
 schulos/
  src/
    app/              # Next.js App Router pages & API routes
      api/            # 34+ API endpoint directories
      globals.css     # Global styles & animations
      layout.tsx      # Root layout
      page.tsx        # Entry point (SPA)
    components/       # 26 React components
      auth-view.tsx
      dashboard-view.tsx
      classes-view.tsx
      competence-flower-view.tsx
      ...
    hooks/            # Custom React hooks
    lib/              # Utilities
      api.ts          # API client functions
      auth.ts         # Auth helpers
      db.ts           # Prisma client
      i18n.ts         # Internationalization (700+ keys)
      store.ts        # Zustand state management
      utils.ts        # Utility functions
  prisma/
    schema.prisma     # 30+ database models
    seed.ts           # Demo data seed script
  public/
    logo.svg          # App logo
 ```
 ## License
 MIT License — see [LICENSE](../LICENSE) for details.
 ## Contributing
 Contributions are welcome! This is a free and open-source project aimed at making competence-oriented assessment accessible to all schools.
 1. Fork the repository
 2. Create your feature branch (`git checkout -b feature/amazing-feature`)
 3. Commit your changes (`git commit -m 'Add amazing feature'`)
 4. Push to the branch (`git push origin feature/amazing-feature`)
 5. Open a Pull Request
 ---
 **SchulOS** — Kompetenzorientierte Beurteilung fur alle
@@ -1,31 +0,0 @@
 # Roadmap
 The execution roadmap is maintained in the root `TODO.md` checklist. This file
 is the public summary of its delivery order.
 ## In Progress
 - Delivery and security baseline: Docker, CI baseline, Argon2id, origin checks,
  local storage, WAL, and verified online backups.
 ## Next
 1. Complete account lifecycle security: reset tokens, verification, optional
   TOTP, and auth-related end-to-end tests.
 2. Build the school policy engine: configurable escalation, holidays, retention,
   communication locks, quiet hours, and module gates.
 3. Consolidate navigation into canonical module owners and tabbed pages; build
   role-aware Bento dashboards without duplicate workflows.
 4. Complete academic workflows: template cloning history, fast entry, grading
   finalization attribution, versioned reports, real PDF and ZIP exports.
 ## Later
 - Communication policy and notification delivery completion.
 - Calendar, leave, substitution, and operations consolidation.
 - Learning Hub governance, AI safety, and exam middleware.
 - Digital notebook annotation and PWA support.
 - Emergency signage, compliance automation, and full E2E/accessibility release
  gates.
 See `TODO.md` for detailed checkboxes, acceptance criteria, and blockers.
@@ -1,103 +0,0 @@
 # Self Hosting
 ## Prerequisites
 - Docker Engine with Docker Compose plugin
 - A DNS name and HTTPS reverse proxy for production use
 ## Quick Start
 1. Copy `.env.example` to `.env`.
 2. Set `NEXT_PUBLIC_APP_URL` to the public application URL.
 3. Review storage and optional SMTP values.
 4. Build and start the service with `docker compose up -d --build`.
 5. Review logs with `docker compose logs -f schulos`.
 6. Run Prisma migrations inside the service when a release includes migrations.
 7. Seed demo data only in a non-production instance with `pnpm db:seed`.
 The service listens on port `3000` by default. Set `SCHULOS_PORT` in `.env` to
 change the host port.
 ## Request Origin Protection
 All mutation requests below `/api/` require a matching `Origin` or `Referer`.
 Set `NEXT_PUBLIC_APP_URL` to the public HTTPS origin. For an approved second
 origin, such as a separate admin host, provide comma-separated origins. Do not
 include wildcard origins.
 ## Backup
 Back up the complete persistent volume, including the database, uploads,
 exports, and backups. For SQLite in WAL mode, preserve the main `.db` file and
 its `-wal` and `-shm` companions or use SQLite's online backup command.
 Test restores into a separate disposable deployment before relying on a backup.
 The in-app backup endpoint writes a school-scoped JSON file to `BACKUP_PATH` and
 verifies its readability before a restore drill; it does not automatically
 overwrite a live database.
 ### WAL And Verified SQLite Backups
 Run the following commands from the deployment directory after setting the
 production environment values:
 ```bash
 pnpm db:wal
 pnpm db:backup
 ```
 `db:wal` enables WAL mode, normal synchronous behavior, foreign-key checks, and
 a checkpoint. `db:backup` uses SQLite's online `.backup` command, writes the
 copy to `BACKUP_PATH`, and runs `PRAGMA integrity_check` on the result. A
 successful command prints the backup file path, byte size, and `integrity: ok`.
 Inside Docker, run the same commands with:
 ```bash
 docker compose exec schulos pnpm db:wal
 docker compose exec schulos pnpm db:backup
 ```
 Do not restore onto the active school deployment. Copy the verified backup to a
 separate maintenance environment, set its `DATABASE_URL` to the copied file,
 and complete a login and data-read smoke test first.
 ## Upgrade
 1. Take and verify a backup.
 2. Pull the reviewed release.
 3. Run `docker compose up -d --build`.
 4. Run required Prisma migrations.
 5. Confirm health, login, and critical role workflows.
 ## Password Hash Migration
 New passwords use Argon2id. Existing bcrypt password hashes remain valid for
 one successful login and are transparently upgraded to Argon2id at that time.
 No bulk password reset is required for this migration.
 ## Account Recovery
 Password reset requests create a one-time, SHA-256-hashed token with the TTL
 configured by `PASSWORD_RESET_TTL_SECONDS`. The API always returns the same
 success message whether or not an account exists. In development only, or when
 `AUTH_SHOW_RESET_TOKEN=true`, the raw token is returned for local testing.
 By default, self-hosted registrations are marked verified immediately. Set
 `AUTH_REQUIRE_EMAIL_VERIFICATION=true` only after integrating a reviewed email
 verification delivery flow.
 ## Two-Factor Authentication
 Set `AUTH_TOTP_ENABLED=true` to allow authenticated users to enroll an RFC
 compatible authenticator. Enrollment verifies one current six-digit code before
 the secret is saved and returns ten single-use recovery codes once. Store these
 codes offline; raw recovery codes are never stored. During login, an enrolled
 user must provide either a current authenticator code or one unused recovery
 code.
 ## Compliance Notice
 This software can support privacy-compliant operations but is not legal advice.
 The deploying school must involve its DPO, Schultrager, and Personalrat before
 processing real student data.
@@ -1,281 +0,0 @@
 # SchoolOS PRD Execution Plan
 Last reviewed: 2026-08-02
 ## Operating Rules
 - [x] Use SQLite with Prisma for core relational data.
 - [x] Keep all server-side access checks deny-by-default and scope teachers to currently assigned classes.
 - [x] Keep student data restricted to the linked student record; restrict parent data to `ParentStudentLink` children.
 - [x] Prevent Vice Principals from managing administrator accounts.
 - [ ] Move every configurable policy, threshold, retention period, warning limit, and escalation window into database-backed school policy records. No new business-rule literals may be introduced.
 - [ ] Every new API route must have authorization, school scope, input validation, audit logging where it mutates personal or grading data, and tests.
 - [ ] Keep all dates/deadlines in Calendar as the canonical source; other pages can show only read-only summaries sourced from Calendar.
 - [ ] Keep notifications in the Notification module as the single delivery pipeline; feature modules emit notifications rather than creating independent alert systems.
 - [ ] Do not use emojis in product UI, seed-visible UI, navigation, documentation examples, or new copy. Use Lucide icons already present in the project.
 - [ ] Preserve the existing emerald/teal brand palette and semantic colors defined in `src/app/globals.css`.
 - [ ] Use one shared motion vocabulary: 160-220ms hover/focus feedback, 220-320ms panel/state transitions, opacity/transform only, and `prefers-reduced-motion` fallbacks.
 - [ ] New dashboards use responsive Bento grids. Widgets are read-only views of their owning module and must not duplicate workflows.
 ## Definition Of Done
 - [ ] `pnpm lint`, `pnpm test`, `pnpm typecheck`, and E2E smoke tests pass.
 - [ ] A feature has server-side authorization tests including cross-school IDOR attempts.
 - [ ] A feature has i18n coverage in German and English with no new hardcoded UI strings.
 - [ ] Mobile/tablet interaction meets 44x44px minimum target size and keyboard/screen-reader requirements.
 - [ ] Documentation, migration, seed behavior, audit logging, and retention implications are updated.
 ## Completed Foundation
 - [x] Next.js, TypeScript, Tailwind, shadcn/ui, Prisma, SQLite, Recharts, and DE/EN i18n scaffold exist.
 - [x] Core school, year, class, enrollment, student, subject, competency, progress, assessment, grading, reporting, audit, export, and soft-delete models exist.
 - [x] Competency templates, entries, assessments, grading schemes, computed grades, competence flower views, report card screens, data export, and GDPR/compliance models exist.
 - [x] Student/parent/teacher/admin API scope hardening has been applied across major academic, personal, operational, sensitive-data, and report endpoints.
 - [x] Role-safe communication, leave approval, teacher absence, calendar, and escalation baseline workflows exist.
 - [x] Compliance models exist: `DataRetentionPolicy`, `DpiaRecord`, `ComplianceConsultation`, `SchoolComplianceStatus`, and `DeletionFlag`.
 - [x] Basic signage, exam, notification, dashboard widget, and notebook models/views exist.
 - [x] Seed scripts and `.env.example` exist.
 - [x] Current checks pass: lint, unit policy tests, build-first typecheck, and production build.
 ## Information Architecture And Navigation Consolidation
 ### Canonical Top-Level Navigation
 Use these sections only. Do not add a new sidebar entry if a workflow belongs in an existing page tab.
 - [ ] Home
  - Dashboard only. Role-specific Bento widgets, quick actions, unread notifications, and read-only upcoming calendar summary.
 - [ ] Teach
  - Classes, Students, Competencies, Progress, Assessments, Grading, Reports, Attendance, Homework, Lesson Plans, Resources, Digital Notebook.
 - [ ] School Life
  - Calendar, Communication, Announcements, Events, Library, Transport, Wellness, Counseling, Discipline, Substitutions.
 - [ ] Insights
  - Competence Flower, Mastery Matrix, Analytics, Curriculum Coverage, Grade Analytics, Data Export.
 - [ ] Administration
  - Users/Roles, School Setup, Policies, Compliance, Imports, Backups, Signage, Settings.
 ### Required Page Ownership And Tab Consolidation
 - [ ] `Classes` owns class setup and roster. Tabs: Overview, Students, Subjects, Staff, Timetable, Seating, Attendance, Competencies.
 - [ ] `Student Detail` owns an individual student record. Tabs: Overview, Progress, Assessments, Reports, Attendance, Wellbeing, Goals, Notebook, Portfolio, Support. Do not expose the same student workflows as independent menu pages.
 - [ ] `Assessments` owns authoring, competency links, results grid, review, and Exam Mode launch. Tabs: Assessments, Results, Rubrics, Peer/Self Assessment, Exam Sessions.
 - [ ] `Reports` owns report drafts, review, finalization, PDF/ZIP exports, and report templates. Tabs: Drafts, Finalized, Templates, Export Queue.
 - [ ] `Communication` owns direct threads, class/grade rooms, announcements, escalation queue, and messaging locks. Tabs: Inbox, Groups, Escalations, Announcements, Locks.
 - [ ] `Calendar` owns all deadlines, events, exam schedules, absences, timetable reflection, holidays, and availability. Tabs: Calendar, Timetable, Absences, Exam Dates, School Events, Holidays.
 - [ ] `Resources` owns Learning Hub content. Tabs: Browse, My Class Resources, Worksheets, Vocabulary, Games, Review Queue.
 - [ ] `Administration > Policies` owns permission policies, escalation policies, warning thresholds, quiet hours, module flags, and retention settings.
 - [ ] Remove or fold duplicate sidebar entries after each consolidated page is delivered. Update role access lists and command palette at the same time.
 ## Phase 18 - Delivery, Security, And Maintainer Baseline
 - [x] Add `Dockerfile` and `docker-compose.yml` with persistent volumes for SQLite, generated exports, uploads, and backups.
 - [x] Expand `.env.example` with database path, public base URL, mail/reset configuration, storage path, backup path, feature flags, and optional AI configuration.
 - [x] Add `docs/DATA_MODEL.md`, `docs/CONTRIBUTING.md`, and `docs/ROADMAP.md`.
 - [x] Add `docs/ARCHITECTURE.md` and `docs/SELF_HOSTING.md`.
 - [x] Move the root PRD to `docs/PRD.md` and keep one canonical index in `docs/README.md`.
 - [x] Add GitHub Actions for lint, typecheck, unit tests, Prisma validation, migration drift checks, and Playwright smoke tests.
 - [ ] Add dependency audit and secret scanning in CI.
 - [x] Replace `bcryptjs` password hashing with Argon2id and document a safe rehash-on-login migration path. Legacy bcrypt hashes verify once and rehash on successful login.
 - [x] Implement password reset tokens, email verification/self-hosted bypass flag, configurable session expiry, optional TOTP setup/recovery codes, and rate-limited auth routes.
 - [x] Implement central origin-based CSRF protection for cookie-authenticated mutation requests below `/api/`.
 - [x] Add real local file storage abstraction for uploads, exports, and backups with path traversal protection. S3-compatible adapter remains a future implementation behind the same interface.
 - [x] Add SQLite WAL configuration and verified online backup scripts. Restore remains a deliberate maintenance-environment workflow and requires a smoke test before production cutover.
 Exit criteria:
 - [ ] A non-technical school admin can deploy from clone to login in under 10 documented commands.
 - [ ] Authentication tests cover login rate limits, reset flow, session expiry, CSRF rejection, and TOTP when enabled.
 - [ ] Backups are real files, restore into a disposable database is verified, and no endpoint returns a fake restore acknowledgment.
 ## Phase 19 - Policy And Permission Engine
 - [ ] Create `SchoolPolicy`, `EscalationPolicy`, `ClassMessagingLock`, module activation, quiet-hours, warning-limit, and holiday/calendar policy tables.
 - [ ] Replace hardcoded escalation days, weekend calculation, XP constants, leave types, notification thresholds, and warning counts with policy/config queries.
 - [ ] Implement a centralized policy service with cached, scoped school configuration and explicit fallback behavior for missing required policy rows.
 - [ ] Add an Admin Policy Console with tabs: Access, Communication, Exams, Notifications, Retention, Modules, School Calendar.
 - [ ] Add DPO read/gate permissions without granting ordinary user administration.
 - [ ] Add policy change audit records with before/after value, actor, reason, and effective time.
 - [ ] Use holiday records from Calendar to calculate business days; do not assume Mon-Fri alone.
 - [ ] Implement the urgent safety path that bypasses normal communication escalation while preserving audit and notification traceability.
 Exit criteria:
 - [ ] An administrator can change each PRD-configurable rule without deployment.
 - [ ] Policy unit tests cover missing policies, precedence, school isolation, holidays, overrides, and emergency bypass.
 ## Phase 20 - Navigation, Design System, And Dashboards
 - [ ] Refactor `app-layout.tsx` sidebar and command palette into the canonical five navigation sections.
 - [ ] Remove duplicate or overlapping navigation items after moving their workflows to canonical page tabs.
 - [ ] Create shared page-shell primitives: `PageHeader`, `PageTabs`, `BentoGrid`, `BentoWidget`, `ModuleEmptyState`, `PermissionEmptyState`, and `LoadingSkeleton`.
 - [ ] Create a single icon registry based on Lucide. Remove any emoji-based UI affordances and prohibit adding new ones.
 - [ ] Add shared animation tokens/utilities and reduced-motion behavior; remove inconsistent bespoke animations from feature pages during touch work.
 - [ ] Rebuild Dashboard as role-aware Bento grid with persisted widget configuration, not duplicated business logic.
 - [ ] Dashboard widget catalog: My Classes, Follow-up Students, Upcoming Calendar, Pending Approvals, Notifications, Exam Monitor, Report Deadlines, Compliance Gate, Resource Review Queue.
 - [ ] Give every role a narrow dashboard: teacher classroom operations, parent child summary, student personal learning, vice principal operational oversight, admin governance, DPO compliance.
 - [ ] Standardize tablet layout, touch targets, focus order, screen-reader labels, density, cards, tabs, tables, dialogs, and empty/error states.
 Exit criteria:
 - [ ] No workflow is reachable from more than one sidebar item.
 - [ ] Every duplicate workflow has one canonical owner and optional read-only dashboard summaries only.
 - [ ] Desktop, tablet, and mobile visual tests cover every top-level navigation section.
 ## Phase 21 - Academics Core Completion
 - [ ] Ensure template assignment clones categories, competencies, and mastery definitions atomically into a school-owned editable copy.
 - [ ] Add explicit clone version/history and prevent global-template mutations by school editors.
 - [ ] Build roster-first fast entry flow: keyboard-first, tablet-first, under three interactions for the common entry case.
 - [ ] Implement append-only progress entries with configurable original-author edit window and immutable audit history.
 - [ ] Add configurable competence flower aggregation per template: latest, average of last N, weighted recency.
 - [ ] Add flower drilldown to source entries and PNG/SVG export.
 - [ ] Complete assessments: delivery mode, competency links, bulk results grid, validation, and class enrollment consistency checks.
 - [ ] Move grade computation into a pure tested service with transparent per-rule breakdown.
 - [ ] Add `finalizedByUserId`, finalization time, mandatory teacher confirmation, and immutable final-grade audit semantics.
 - [ ] Handle grade edge cases: missing inputs, verbal-only scales, partial enrollment, override reason, and school-specific grade scales.
 - [ ] Complete report lifecycle: Draft -> Review -> Final -> Versioned, locked final records, revision workflow, data-driven phrase templates.
 - [ ] Implement real A4 PDF output, school branding, optional flower/notebook appendix, single download, and ZIP class export.
 Exit criteria:
 - [ ] A teacher can create a class, clone a template, add entries, enter an assessment grid, inspect flower evidence, compute/finalize grades, and export one or many reports.
 - [ ] Grading unit tests cover deterministic breakdown and edge cases.
 ## Phase 22 - Communication And Notification Completion
 - [ ] Replace `CommunicationRoom`-only escalation behavior with policy-backed `EscalationPolicy` and `EscalationRequest` records.
 - [ ] Implement class, grade-level, and custom moderated social rooms with real membership and content moderation states.
 - [ ] Implement class-hours messaging lock using Calendar/Timetable period boundaries; urgent messages still deliver.
 - [ ] Add message read receipts, attachments through the storage abstraction, moderation queue, and retention references.
 - [ ] Add counselor role/department routing for eligible student escalations.
 - [ ] Provide an administrator case override with reason/audit trail.
 - [ ] Centralize all notifications into one delivery pipeline: in-app center, browser push, email fallback where configured, quiet hours, emergency bypass.
 - [ ] Remove duplicate feature-specific notification UI; retain only contextual status banners plus the central notification center.
 - [ ] Add notification preference and delivery failure/retry observability.
 Exit criteria:
 - [ ] Parent/student escalation uses a database policy and a holiday-aware deadline.
 - [ ] Teachers message management directly; emergency contact is always available without escalation.
 - [ ] One notification pipeline delivers all module events.
 ## Phase 23 - Calendar, Leave, Attendance, And School Operations
 - [ ] Make Calendar the canonical event store for absences, exams, report deadlines, timetable, holidays, school events, and signage date windows.
 - [ ] Add explicit event audience/visibility relation for student, parent, class, staff, and administrator-private events.
 - [ ] Finish student leave workflow with evidence files, parent verification, teacher workflow queue, final admin approval, calendar publication, and auditable rejection reasons.
 - [ ] Finish teacher leave workflow with vice-principal notification, private admin notes, class coverage link, and calendar audience controls.
 - [ ] Add school holiday management and use it in escalation, attendance, reporting, and timetable computations.
 - [ ] Consolidate attendance, illness, leave, and timetable visibility into Calendar tabs; keep data entry routes canonical.
 - [ ] Complete substitutions: absence -> available substitute search -> assignment -> timetable/calendar reflection -> notifications.
 - [ ] Complete transport and library operational flows with real permissions, return/overdue state, and audit records.
 Exit criteria:
 - [ ] No page stores a second independent date/deadline implementation.
 - [ ] Every absence and approved leave has one linked calendar record with audience-aware visibility.
 ## Phase 24 - Learning Hub, AI Tutor, And Content Governance
 - [ ] Replace generic `Resource` semantics with PRD-aligned resource types, review status, competency links, ownership, and school/global library behavior.
 - [ ] Add worksheet solution access rules and PDF worksheet export with teacher-controlled solution inclusion.
 - [ ] Add vocabulary sets/items with spaced repetition, student progress, and teacher assignment surfaces.
 - [ ] Add game progress scoped by student, subject, and school; exclude addictive/profiling mechanics.
 - [ ] Add resource search/filter by subject, grade, competency, and review status; surface weak-competency recommendations from the flower.
 - [ ] Add AI content authoring queue: every AI draft is `PENDING_REVIEW`, never directly published.
 - [ ] Add `AiTutorInteraction` with pseudonymous/summary-only default logging, retention link, consent/config setting, and audit access.
 - [ ] Build server-side AI Tutor safety gate: deny when active digital exam session exists; enforce homework/assessment hint-only policy with structured request context.
 - [ ] Add translation requests labeled AI-translated, review reporting, and no persistent language/ethnicity profiling.
 - [ ] Keep AI provider/storage optional and local-first; do not require third-party paid services for core operation.
 Exit criteria:
 - [ ] AI Tutor cannot answer during an active locked exam even with a direct API request.
 - [ ] AI-generated content cannot become visible before human review.
 ## Phase 25 - Exam Mode, PWA, And Digital Notebook
 - [ ] Add `ExamIncidentEvent` model and complete exam lifecycle states, device IDs, reasons, teacher actions, and parent/admin visibility rules.
 - [ ] Implement server-side active-exam middleware that blocks AI Tutor, Learning Hub assistance, and ordinary messaging APIs for that student.
 - [ ] Build live teacher exam monitor with pause, resume, cancel, bathroom approval, distress handling, warning issuance, and incident timeline.
 - [ ] Make third warning auto-pause only; require a human for any disciplinary record creation.
 - [ ] Implement fullscreen/kiosk UX with accessibility fallback and documented browser limitations.
 - [ ] Add Workbox service worker for offline shell, push delivery, navigation handling, and installable PWA behavior.
 - [ ] Add notebook templates, typed blocks, structured stylus stroke data, non-destructive teacher annotations, page history, subject/year organization, and PDF export.
 - [ ] Use worker offloading for costly stroke/image operations only after profiling; keep a no-worker fallback.
 Exit criteria:
 - [ ] Exam API integrity remains enforced if the client bypasses fullscreen.
 - [ ] Notebook annotations never overwrite original student work.
 ## Phase 26 - Signage, Emergency, And Reliability
 - [ ] Align signage schema with display, slide, playlist, approval, priority, date-window, and rotation requirements.
 - [ ] Add teacher slide request queue; only policy-authorized content may publish.
 - [ ] Implement emergency alerts as highest-priority display override with explicit resolve action and audit record.
 - [ ] Send emergency notifications to configured staff/student/parent audiences with retry/failure telemetry.
 - [ ] Implement staff-only counseling notice with no student identifying detail on public displays.
 - [ ] Add signage display endpoint suitable for TV devices and test offline/reconnect behavior.
 Exit criteria:
 - [ ] Emergency alert override is independently tested for display, notification delivery, resolution, and audit logging.
 ## Phase 27 - Compliance, Rights, And Retention Completion
 - [ ] Document purpose and legal basis for every personal-data entity in `docs/DATA_MODEL.md`.
 - [ ] Add entity-to-retention-category mapping and scheduled retention sweep using `DataRetentionPolicy` rows.
 - [ ] Ensure legally mandated retention values have no guessed defaults; require DPO/school confirmation before use.
 - [ ] Complete unified staff/student/parent self-service export including messages, notebooks, progress, reports, permitted disciplinary records, and generated files.
 - [ ] Complete partial erasure with retained-record explanation, file deletion, audit trail, and DPO approval where required.
 - [ ] Generate RoPA from module/entity metadata and keep `docs/legal/verzeichnis-verarbeitungstaetigkeiten.md` reproducible.
 - [ ] Make privacy notice generator derive configured retention and module states; include non-legal-advice disclaimer.
 - [ ] Gate high-risk AI Tutor and Exam Mode activation on DPO/DPIA records and onboarding consultations.
 - [ ] Add Personalrat module checklist/spec sheets describing monitoring, viewers, retention, and prohibited performance-evaluation use.
 - [ ] Add module-level consultation status for DPO, Schultrager, Elternbeirat/Schulkonferenz, and Personalrat.
 Exit criteria:
 - [ ] High-risk modules cannot activate without the configured compliance gate.
 - [ ] Export/erasure and retention workflows have end-to-end tests.
 ## Phase 28 - Testing, Accessibility, And Release Readiness
 - [ ] Add unit tests for policy engine, authorization, business-day calculation with holidays, grading engine, report phrase generation, retention sweep, and exam gates.
 - [ ] Add API IDOR matrix tests for each protected school/student/class resource and all roles.
 - [ ] Add Playwright E2E: register/login, class setup, template clone, student import, progress entry, assessment grid, grade finalization, report PDF, parent portal, escalation, leave approval, exam gate.
 - [ ] Add visual regression coverage for each canonical navigation page at desktop, tablet, and mobile breakpoints.
 - [ ] Audit WCAG 2.1 AA: keyboard navigation, focus order, labels, dialogs, contrast, motion reduction, touch targets, table alternatives, and screen-reader announcements.
 - [ ] Add performance budgets for roster, dashboard, flower, report generation, and tablet entry flows.
 - [ ] Add production readiness review: migrations, seed behavior, backup restore drill, Docker deployment drill, no mock data in shipped UI, and license decision.
 - [ ] Add `CHANGELOG.md` in `docs/` and release/version workflow.
 Exit criteria:
 - [ ] CI runs lint, typecheck, Prisma validation, unit tests, security checks, and Playwright smoke tests on every pull request.
 - [ ] A clean environment can seed, deploy, back up, restore, and execute the critical teacher/parent/student paths.
 ## Suggested Execution Order
 1. Phase 18: delivery/security baseline.
 2. Phase 19: policy engine.
 3. Phase 20: navigation/design system/dashboard consolidation.
 4. Phase 21: academics completion.
 5. Phase 22 and Phase 23 in parallel after policy/calendar primitives exist.
 6. Phase 24 after policy, notification, and retention primitives exist.
 7. Phase 25 after AI exam gate and PWA foundations are ready.
 8. Phase 26 after notification reliability is proven.
 9. Phase 27 throughout, with final compliance gates before release.
 10. Phase 28 continuously, with final release gate after all feature phases.
 ## Current Blockers
 - [ ] Fix AGPLv3 versus MIT license direction.
 - [ ] Confirm whether AI features remain optional and which local/provider integration is permitted.
 - [ ] Confirm school-specific legal retention values with the DPO; do not infer them.
 - [ ] Confirm emergency alert audience and after-hours teacher notification policy with school leadership.
 - [ ] Confirm target browser/device policy for kiosk/fullscreen limitations.
 - [ ] CSRF middleware compiles correctly but does not block cross-origin requests at runtime (returns 200 instead of 403). Likely cause: `turbopack.root` misconfiguration — Next.js inferred workspace root as `/Users/fatmacetin/` instead of `/Users/fatmacetin/dyad-apps/exametra/`.
 - [ ] E2E sign-in page test fails: email input field not visible on sign-in page (JS hydration or label text mismatch).
 - [ ] Report-cards `[id]` route needs `schoolId` field in select for scope check.
@@ -32,7 +32,7 @@ The Processor shall process the following personal data on behalf of the Control
 - Exam monitoring logs
 - Communication/messaging data
-**Purpose**: Operation and maintenance of the SchulOS school management platform
+**Purpose**: Operation and maintenance of the ExaMetra school management platform
 ---
@@ -202,6 +202,6 @@ The Processor is authorized to engage the following sub-processors:
 ---
 **Generated**: ISO 8601 timestamp
-**Source**: SchulOS Module L - Compliance Framework
+**Source**: ExaMetra Module L - Compliance Framework
 **REMINDER**: This is a template. Consult legal counsel to customize for your jurisdiction and service provider.
@@ -1,328 +0,0 @@
 # Role, Communication, Leave, And Calendar Workflow
 ## Objective
 Implement role-safe school operations for administrators, vice principals,
 teachers, students, and parents. Every API must enforce the same permissions as
 the navigation, and student and parent data must stay scoped to the user.
 ## Invariants
 - `SCHOOL_ADMIN` and `SUPER_ADMIN` retain full school/system administration.
 - `VICE_PRINCIPAL` never creates, deletes, promotes, resets passwords for, or
  otherwise manages administrator accounts.
 - Teachers can only view and update students enrolled in a class they teach.
 - Students can only access their linked student record.
 - Parents can only access records linked through `ParentStudentLink`.
 - Authorization is enforced server-side; menu filtering is only a convenience.
 ## Phase 1: Role And Data Access Foundation
 Status: implemented
 Scope:
 - Centralize administrator, user-management, and student-management policy.
 - Restrict student lists, student detail pages, and class-student APIs.
 - Restrict account management to administrators.
 - Explicitly prevent vice principals from modifying administrator accounts.
 - Narrow student, parent, and teacher menus to their allowed workflows.
 Files:
 - `src/lib/role-access.ts`
 - `src/lib/access-policy.ts`
 - `src/app/api/students/route.ts`
 - `src/app/api/students/[id]/details/route.ts`
 - `src/app/api/classes/[id]/students/route.ts`
 - `src/app/api/users/route.ts`
 - `src/app/api/users/[id]/route.ts`
 Verification:
 - `pnpm exec tsc --noEmit --pretty false`
 - `pnpm lint`
 - `pnpm test`
 ## Phase 2: Communication Escalation And Groups
 Status: implemented
 Scope:
 - Add a unified communication policy service.
 - Route student and parent messages to the responsible class teacher first.
 - Persist first-contact timestamp, response timestamp, resolution status, and
  escalation eligibility after five business days.
 - Allow teachers to message administrators and vice principals directly.
 - Add class and parent group room types, membership generation, and moderator
  visibility for the responsible teacher and administrator.
 - Prevent student and parent direct administrator threads before escalation.
 Schema work:
 - Extend `CommunicationRoom` with audience type, class group, escalation,
  resolution, and visibility state.
 - Extend `CommunicationMessage` with attachment metadata and moderation state.
 - Add migration and backfill safe defaults for existing rooms.
 Verification:
 - Unit tests for five-business-day calculation and recipient selection.
 - API tests for unauthorized direct escalation and group membership isolation.
 Implemented baseline:
 - Direct student conversations are assigned to the responsible class teacher.
 - Direct conversations store a five-business-day escalation deadline.
 - Students and linked parents may escalate unresolved conversations after the
  deadline; the school administrator is then added as a moderator.
 - Teachers and administrators can create class-group rooms only for their
  authorized school/class context.
 - Membership-based message posting is enforced for group rooms.
 ## Phase 3: Student And Parent Leave Workflow
 Status: implemented
 Scope:
 - Generalize `IllnessReport` into a leave request workflow for illness,
  personal days, and religious holidays.
 - Allow evidence attachment metadata without exposing documents outside the
  approval chain.
 - Require parent approval for student requests.
 - Notify the responsible teacher after parent approval.
 - Require administrator approval before the leave becomes calendar-visible.
 - Create calendar records for the student, teacher, and school administration.
 Schema work:
 - Add leave type, admin approval, review actor/timestamps, evidence metadata,
  and linked calendar event fields to `IllnessReport` or migrate to a dedicated
  `StudentLeaveRequest` model.
 - Add notification records for each workflow transition.
 Verification:
 - Workflow tests covering pending, parent-approved, teacher-notified,
  admin-approved, rejected, and calendar-created states.
 Implemented baseline:
 - Student requests require a linked parent approval.
 - Parent-created requests pass the parent approval stage immediately.
 - Parent approval notifies the responsible teacher.
 - Final approval is restricted to school and super administrators.
 - Final approval creates one class-linked, all-day calendar event and stores the
  event reference on the leave request.
 - Evidence documents remain on the leave request and are not placed in calendar
  event notes.
 ## Phase 4: Teacher Leave And Calendar Visibility
 Scope:
 - Extend `TeacherAbsence` with administrator approval, vice-principal
  notification, private administrator notes, and evidence attachments.
 - Keep teacher absence notifications hidden from students.
 - On approval, publish only relevant calendar events to the teacher,
  administrators, and affected class calendars.
 - Add explicit calendar audience and owner visibility rules.
 Schema work:
 - Add a `CalendarEventAudience` relation or an audience JSON replacement with
  recipient users, class groups, and parent visibility.
 - Add `privateAdminNotes` and approval data to `TeacherAbsence`.
 Verification:
 - API tests that prove private notes and unpublished teacher events cannot be
  retrieved by students or parents.
 ## Phase 5: UI Completion And Regression Coverage
 Status: implemented
 Scope:
 - Render role-specific menu items and communication/leave screens.
 - Add escalation countdown/status to student and parent conversations.
 - Add approval work queues for teachers, vice principals, and administrators.
 - Add calendar visibility controls for teachers and students.
 - Add responsive, accessible group and approval UI states.
 Verification:
 - Role-by-role Playwright journeys.
 - API authorization matrix tests for every protected route.
 - `pnpm exec tsc --noEmit --pretty false`, `pnpm lint`, `pnpm test`, and
  `pnpm build`.
 Implemented baseline:
 - Leave cards distinguish parent approval from final administrator approval and
  show calendar publication only after the final approval.
 - Student and parent conversation panels expose the escalation action only
  after the five-business-day threshold.
 - Escalated rooms visibly identify their administrative escalation state.
 - `pnpm typecheck` provides a build-first typecheck that avoids stale generated
  Next type files.
 ## Dependency Order
 1. Phase 1 must precede all others because it establishes reusable access
   predicates.
 2. Phase 2 and Phase 3 can begin in parallel after Phase 1.
 3. Phase 4 depends on the calendar audience design from Phase 3.
 4. Phase 5 depends on completed APIs from Phases 2 through 4.
 ## Rollback
 - All schema changes use additive columns/tables first.
 - No existing data is deleted by migrations.
 - New policy checks default to deny for unknown roles and missing ownership.
 ## Phase 6: Endpoint Authorization Hardening
 Status: implemented
 - User role assignment now uses the same administrator target-protection policy
  as user update/delete operations.
 - Class updates and deletion are restricted to school administrators; all class
  reads validate class membership or administrator scope.
 - Bulk student creation validates the caller school and a teacher's assigned
  class before creating records.
 - Parent-link reads and edits validate teacher student scope and school scope.
 ## Phase 7: Workflow Scope Hardening
 Status: implemented
 - Parent communication creation requires an explicitly linked child rather than
  inferring a profile from the parent's own account.
 - Parent and student leave list filters reject unlinked student identifiers.
 - Communication room deletion is limited to school/super administrators;
  vice principals cannot remove conversation records.
 - Administrative room closure verifies the administrator belongs to the room's
  school.
 ## Phase 8: Leave Record Integrity
 Status: implemented
 - Teacher absence detail endpoints now require authentication, school scope,
  and either the absence owner or an administrator.
 - Teachers cannot alter status, or edit/delete a leave once it is approved.
 - Vice principals cannot delete student leave records; reporters may only
  withdraw requests before either approval stage is processed.
 ## Phase 9: Academic And Behavioral Data Isolation
 Status: implemented
 - Learning progress reads and writes enforce linked student, class, and teacher
  scope rather than accepting arbitrary identifiers.
 - Assessment results validate assessment class access and every target student.
 - Homework submissions return only the logged-in student or linked parent
  records, and student submissions resolve from the authenticated user ID.
 - Behavior incidents are limited to a teacher's assigned classes for reads and
  writes.
 ## Phase 10: Sensitive Student Resource Isolation
 Status: implemented
 - Health records are administrator-only and additionally validate the target
  student scope and school on every operation.
 - Portfolio entries resolve to the current student or linked parent children
  when no explicit authorized student is supplied.
 - Notebook and drawing creation validates class ownership, school ownership,
  and prevents students from publishing class-visible resources.
 ## Phase 11: Personal Planning And Calendar Integrity
 Status: implemented
 - Calendar event updates and deletions require event ownership or administrator
  authority, plus matching school and class access.
 - Student goals and study plans now use the shared student access predicate for
  all student, parent, teacher, and administrator callers.
 - Badge awards and XP changes require an authorized teacher/administrator and
  an accessible student; character updates cannot cross school boundaries.
 ## Phase 12: Wellbeing And Private Record Isolation
 Status: implemented
 - Wellness API identity and role now come exclusively from the active session;
  caller-controlled role query parameters can no longer grant access.
 - Students may submit only their own daily wellness check-ins; teachers may
  view only assigned classes.
 - Teacher notes verify target student scope before reads or writes.
 - Emergency contacts are restricted to administrators and require school plus
  authorized target-student scope.
 ## Phase 13: Operational Resource Isolation
 Status: implemented
 - Student transport records are administrator-only and verify target student
  scope for read, create, update, and deletion.
 - Library checkouts validate caller school, target student access, and book
  school ownership before mutation.
 - Student resource discovery is limited to public resources targeted at their
  enrolled classes; resource creation verifies school and class ownership.
 - School event creation requires a teacher/administrator and class scope;
  student lists are restricted to all-school or their enrolled-class events.
 ## Phase 14: Assessment And Report Isolation
 Status: implemented
 - Only students may submit lesson answers or peer assessments, and both flows
  verify the authenticated student and assigned class.
 - Teachers can only create/view peer assessment sessions in their own classes;
  vice principals cannot create them.
 - Learning goals and report cards enforce the shared student/class access
  policy for every caller.
 - Student and parent report lists are restricted to published reports for self
  or linked children; teacher report lists are limited to assigned classes.
 ## Phase 15: Single-Item Resource Integrity
 Status: implemented
 - Homework grading/deletion validates the homework class and target student
  before a teacher or administrator can mutate a submission.
 - Student badge queries, awards, and deletions validate school plus target
  student scope.
 - Single drawing/resource operations now enforce school and class visibility;
  student-owned work cannot be republished class-wide.
 - School-event registration, cancellation, and status changes prohibit user ID
  spoofing and validate the caller's event school/class access.
 ## Phase 16: Detail Record Scope Enforcement
 Status: implemented
 - Single learning goals and study plans now verify school and target-student
  scope before reads, updates, or deletion.
 - Report-card detail/update/delete paths validate student, class, and school
  scope in addition to publication rules.
 - Emergency-contact detail operations are administrator-only with target
  student scope enforcement.
 - Library return/renew/delete paths validate the checkout school and student
  before changing inventory or checkout state.
 ## Phase 17: Discipline And Student Reflection Isolation
 Status: implemented
 - Disciplinary cases and behavior interventions validate school and target
  student scope before reads or writes.
 - Self-assessments now validate student and class ownership on collection and
  detail endpoints.
 - Study sessions are student-owned: only the authenticated student can create
  or update a session for their own profile.
@@ -1,20 +0,0 @@
 import { expect, test } from '@playwright/test';
 test('loads the signed-out application shell', async ({ page }) => {
  await page.goto('/');
  await expect(page).toHaveTitle(/SchulOS/i);
  await expect(page.getByText('SchulOS', { exact: true }).first()).toBeVisible();
  await expect(page.getByLabel(/email/i).first()).toBeVisible();
  await expect(page.getByLabel(/password/i).first()).toBeVisible();
 });
 test('rejects cross-origin API mutations', async ({ request }) => {
  const response = await request.post('/api/auth', {
    headers: { origin: 'https://attacker.example' },
    data: { action: 'logout' },
  });
  expect(response.status()).toBe(403);
  await expect(response.json()).resolves.toMatchObject({ error: 'Invalid request origin' });
 });
@@ -1,14 +0,0 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import { isCsrfProtectedRequest, isTrustedRequestOrigin } from '@/lib/csrf';
 export function middleware(request: NextRequest) {
  if (isCsrfProtectedRequest(request) && !isTrustedRequestOrigin(request)) {
    return NextResponse.json({ error: 'Invalid request origin' }, { status: 403 });
  }
  return NextResponse.next();
 }
 export const config = {
  matcher: ['/api/:path*'],
 };
@@ -1,5 +1,5 @@
 {
-  "name": "schulos",
+  "name": "exametra",
  "version": "1.0.0",
  "private": false,
  "description": "Free & open-source competence & grading platform for schools — Kompetenzorientierte Beurteilung für alle",
@@ -7,7 +7,7 @@
  "author": "Mustafa Cetin",
  "repository": {
    "type": "git",
-    "url": "https://github.com/cetinmustafa83/schulos"
+    "url": "https://github.com/cetinmustafa83/exametra"
  },
  "keywords": [
    "education",
@@ -20,22 +20,14 @@
  ],
  "scripts": {
    "dev": "next dev",
-    "build": "next build --webpack",
+    "build": "next build",
    "start": "next start",
    "lint": "eslint .",
    "postinstall": "prisma generate",
    "db:push": "prisma db push --accept-data-loss",
    "db:generate": "prisma generate",
    "db:migrate": "prisma migrate dev",
    "db:reset": "prisma migrate reset",
-    "db:seed": "bun prisma/seed.ts",
+    "db:seed": "bun prisma/seed.ts"
    "db:seed-demo": "bun prisma/seed-demo.ts",
    "db:setup-demo": "bun run db:push && bun run db:seed-demo",
    "db:wal": "node scripts/sqlite-wal.mjs",
    "db:backup": "node scripts/sqlite-backup.mjs",
    "test": "bun test",
    "test:e2e": "pnpm build && playwright test --config playwright-dyad.config.ts",
    "typecheck": "next build --webpack && tsc --noEmit --pretty false"
  },
  "dependencies": {
    "@dnd-kit/core": "^6.3.1",
@@ -75,7 +67,6 @@
    "@reactuses/core": "^6.0.5",
    "@tanstack/react-query": "^5.82.0",
    "@tanstack/react-table": "^8.21.3",
    "argon2": "^0.45.1",
    "bcryptjs": "^3.0.3",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
@@ -89,7 +80,6 @@
    "next-auth": "^4.24.11",
    "next-intl": "^4.3.4",
    "next-themes": "^0.4.6",
    "otpauth": "^9.5.1",
    "prisma": "^6.11.1",
    "react": "^19.0.0",
    "react-day-picker": "^9.8.0",
@@ -112,7 +102,6 @@
    "zustand": "^5.0.6"
  },
  "devDependencies": {
    "@playwright/test": "^1.62.1",
    "@tailwindcss/postcss": "^4",
    "@types/bcryptjs": "^3.0.0",
    "@types/react": "^19",
@@ -123,8 +112,5 @@
    "tailwindcss": "^4",
    "tw-animate-css": "^1.3.5",
    "typescript": "^5"
-  },
+  }
  "workspaces": [
    "."
  ]
 }
@@ -1,24 +0,0 @@
 import { defineConfig, devices } from "@playwright/test";
 export default defineConfig({
  testDir: "./e2e-tests",
  workers: 1,
  fullyParallel: false,
  reporter: [["list"], ["json", { outputFile: "test-results/results.json" }]],
  use: {
    baseURL: process.env.DYAD_TEST_BASE_URL || process.env.PLAYWRIGHT_BASE_URL || "http://127.0.0.1:32104",
    screenshot: "only-on-failure",
    trace: "retain-on-failure",
  },
  webServer: process.env.DYAD_TEST_BASE_URL
    ? undefined
    : {
        command: "pnpm start --hostname 127.0.0.1 --port 32104",
        url: "http://127.0.0.1:32104",
        reuseExistingServer: !process.env.CI,
        timeout: 120_000,
      },
  projects: [
    { name: "chromium", use: { ...devices["Desktop Chrome"] } },
  ],
 });
@@ -119,9 +119,6 @@ importers:
      '@tanstack/react-table':
        specifier: ^8.21.3
        version: 8.21.3(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
      argon2:
        specifier: ^0.45.1
        version: 0.45.1
      bcryptjs:
        specifier: ^3.0.3
        version: 3.0.3
@@ -151,19 +148,16 @@ importers:
        version: 0.525.0(react@19.2.8)
      next:
        specifier: ^16.1.1
-        version: 16.2.12(@babel/core@7.29.7)(@playwright/test@1.62.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        version: 16.2.12(@babel/core@7.29.7)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
      next-auth:
        specifier: ^4.24.11
-        version: 4.24.15(next@16.2.12(@babel/core@7.29.7)(@playwright/test@1.62.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        version: 4.24.15(next@16.2.12(@babel/core@7.29.7)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
      next-intl:
        specifier: ^4.3.4
-        version: 4.13.4(next@16.2.12(@babel/core@7.29.7)(@playwright/test@1.62.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
+        version: 4.13.4(next@16.2.12(@babel/core@7.29.7)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
      next-themes:
        specifier: ^0.4.6
        version: 0.4.6(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
      otpauth:
        specifier: ^9.5.1
        version: 9.5.1
      prisma:
        specifier: ^6.11.1
        version: 6.19.3(typescript@5.9.3)
@@ -225,9 +219,6 @@ importers:
        specifier: ^5.0.6
        version: 5.0.14(@types/react@19.2.17)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8))
    devDependencies:
      '@playwright/test':
        specifier: ^1.62.1
        version: 1.62.1
      '@tailwindcss/postcss':
        specifier: ^4
        version: 4.3.3
@@ -478,9 +469,6 @@ packages:
  '@emnapi/wasi-threads@1.2.1':
    resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
  '@epic-web/invariant@1.0.0':
    resolution: {integrity: sha512-lrTPqgvfFQtR/eY/qkIzp98OGdNJu0m5ji3q/nJI8v3SXkRKEnWiOxMmbvcSoAIzv/cGiuvRy57k4suKQSAdwA==}
  '@eslint-community/eslint-utils@4.10.1':
    resolution: {integrity: sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==}
    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
@@ -1026,10 +1014,6 @@ packages:
    cpu: [x64]
    os: [win32]
  '@noble/hashes@2.2.0':
    resolution: {integrity: sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==}
    engines: {node: '>= 20.19.0'}
  '@nodelib/fs.scandir@2.1.5':
    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
    engines: {node: '>= 8'}
@@ -1134,15 +1118,6 @@ packages:
    resolution: {integrity: sha512-7FNeNl8NCE7aINx7WXiKQrPYZWC/hvrTsmk6zmxbI7LTXE7hVek/n8AfVgpe2y82zl3w0HvCHN0bVKMBoJcC0w==}
    engines: {node: '>= 10.0.0'}
  '@phc/format@1.0.0':
    resolution: {integrity: sha512-m7X9U6BG2+J+R1lSOdCiITLLrxm+cWlNI3HUFA92oLO77ObGNzaKdh8pMLqdZcshtkKuV84olNNXDfMc4FezBQ==}
    engines: {node: '>=10'}
  '@playwright/test@1.62.1':
    resolution: {integrity: sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==}
    engines: {node: '>=20'}
    hasBin: true
  '@prisma/client@6.19.3':
    resolution: {integrity: sha512-mKq3jQFhjvko5LTJFHGilsuQs+W+T3Gm451NzuTDGQxwCzwXHYnIu2zGkRoW+Exq3Rob7yp2MfzSrdIiZVhrBg==}
    engines: {node: '>=18.18'}
@@ -2338,10 +2313,6 @@ packages:
    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
    engines: {node: '>=8'}
  argon2@0.45.1:
    resolution: {integrity: sha512-skm+/WCjkGqCQxF7FG1LuZXM5yvbFjgbfiCGsud2oLgaDhh6b6dbH0b1EkghbM+xx4Bj8Ape+KKgixoIlWZicQ==}
    engines: {node: '>=16.17.0'}
  argparse@2.0.1:
    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
@@ -2582,11 +2553,6 @@ packages:
  crelt@1.0.7:
    resolution: {integrity: sha512-aK6BbWfhf4U/wCcLHKPJl/xa6VkVstRaPywWtMKGwuOLc/wZTyQYuoxgvZnNsBvv7Kg3YTBQYYBCggcviQczuA==}
  cross-env@10.1.0:
    resolution: {integrity: sha512-GsYosgnACZTADcmEyJctkJIoqAhHjttw7RsFrVoJNXbsWWqaq6Ym+7kZjq6mS45O0jij6vtiReppKQEtqWy6Dw==}
    engines: {node: '>=20'}
    hasBin: true
  cross-spawn@7.0.6:
    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
    engines: {node: '>= 8'}
@@ -3069,11 +3035,6 @@ packages:
      react-dom:
        optional: true
  fsevents@2.3.2:
    resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
    os: [darwin]
  function-bind@1.1.2:
    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
@@ -3846,10 +3807,6 @@ packages:
  node-addon-api@7.1.1:
    resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==}
  node-addon-api@8.9.1:
    resolution: {integrity: sha512-4eUQWVPCUUUiBjLnHS3cXWeC6ryoPUc0U3rP7IuzapoGbzMqd/r6KKO0clr0b+snQhsrueFEhCZDdK+LK7hxKg==}
    engines: {node: ^18 || ^20 || >= 21}
  node-exports-info@1.6.2:
    resolution: {integrity: sha512-kXs9Go0cah0qHVV2v389IXQLdLCeE1xfFtjOAF+iobu0OIoG1pje8At2vMHyaPMiPMnG/LWP50twML21eMcAag==}
    engines: {node: '>= 0.4'}
@@ -3857,10 +3814,6 @@ packages:
  node-fetch-native@1.6.7:
    resolution: {integrity: sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==}
  node-gyp-build@4.8.4:
    resolution: {integrity: sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==}
    hasBin: true
  node-releases@2.0.51:
    resolution: {integrity: sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==}
    engines: {node: '>=18'}
@@ -3923,9 +3876,6 @@ packages:
    resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
    engines: {node: '>= 0.8.0'}
  otpauth@9.5.1:
    resolution: {integrity: sha512-fJmDAHc8wImfqqqOXIlBvT1dEKrZK0Cmb2VEgScpNTolCz0PHh6ExUZGv4sLtOsWNaHCQlD+rRqaPgnoxFoZjQ==}
  outvariant@1.4.0:
    resolution: {integrity: sha512-AlWY719RF02ujitly7Kk/0QlV+pXGFDHrHf9O2OKqyqgBieaPOIeuSkL8sRK6j2WK+/ZAURq2kZsY0d8JapUiw==}
@@ -3982,16 +3932,6 @@ packages:
  pkg-types@2.3.1:
    resolution: {integrity: sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==}
  playwright-core@1.62.1:
    resolution: {integrity: sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==}
    engines: {node: '>=20'}
    hasBin: true
  playwright@1.62.1:
    resolution: {integrity: sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==}
    engines: {node: '>=20'}
    hasBin: true
  po-parser@2.1.1:
    resolution: {integrity: sha512-ECF4zHLbUItpUgE3OTtLKlPjeBN+fKEczj2zYjDfCGOzicNs0GK3Vg2IoAYwx7LH/XYw43fZQP6xnZ4TkNxSLQ==}
@@ -5128,8 +5068,6 @@ snapshots:
      tslib: 2.8.1
    optional: true
  '@epic-web/invariant@1.0.0': {}
  '@eslint-community/eslint-utils@4.10.1(eslint@9.39.5(jiti@2.7.0))':
    dependencies:
      eslint: 9.39.5(jiti@2.7.0)
@@ -5706,8 +5644,6 @@ snapshots:
  '@next/swc-win32-x64-msvc@16.2.12':
    optional: true
  '@noble/hashes@2.2.0': {}
  '@nodelib/fs.scandir@2.1.5':
    dependencies:
      '@nodelib/fs.stat': 2.0.5
@@ -5782,12 +5718,6 @@ snapshots:
      '@parcel/watcher-win32-arm64': 2.6.0
      '@parcel/watcher-win32-x64': 2.6.0
  '@phc/format@1.0.0': {}
  '@playwright/test@1.62.1':
    dependencies:
      playwright: 1.62.1
  '@prisma/client@6.19.3(prisma@6.19.3(typescript@5.9.3))(typescript@5.9.3)':
    optionalDependencies:
      prisma: 6.19.3(typescript@5.9.3)
@@ -6950,13 +6880,6 @@ snapshots:
    dependencies:
      color-convert: 2.0.1
  argon2@0.45.1:
    dependencies:
      '@phc/format': 1.0.0
      cross-env: 10.1.0
      node-addon-api: 8.9.1
      node-gyp-build: 4.8.4
  argparse@2.0.1: {}
  aria-hidden@1.2.6:
@@ -7218,11 +7141,6 @@ snapshots:
  crelt@1.0.7: {}
  cross-env@10.1.0:
    dependencies:
      '@epic-web/invariant': 1.0.0
      cross-spawn: 7.0.6
  cross-spawn@7.0.6:
    dependencies:
      path-key: 3.1.1
@@ -7854,9 +7772,6 @@ snapshots:
      react: 19.2.8
      react-dom: 19.2.8(react@19.2.8)
  fsevents@2.3.2:
    optional: true
  function-bind@1.1.2: {}
  function.prototype.name@1.2.0:
@@ -8800,13 +8715,13 @@ snapshots:
  negotiator@1.0.0: {}
-  next-auth@4.24.15(next@16.2.12(@babel/core@7.29.7)(@playwright/test@1.62.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
+  next-auth@4.24.15(next@16.2.12(@babel/core@7.29.7)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
    dependencies:
      '@babel/runtime': 7.29.7
      '@panva/hkdf': 1.2.1
      cookie: 0.7.2
      jose: 4.15.9
-      next: 16.2.12(@babel/core@7.29.7)(@playwright/test@1.62.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      next: 16.2.12(@babel/core@7.29.7)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
      oauth: 0.9.15
      openid-client: 5.7.1
      preact: 10.29.7(preact-render-to-string@5.2.6)
@@ -8817,14 +8732,14 @@ snapshots:
  next-intl-swc-plugin-extractor@4.13.4: {}
-  next-intl@4.13.4(next@16.2.12(@babel/core@7.29.7)(@playwright/test@1.62.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
+  next-intl@4.13.4(next@16.2.12(@babel/core@7.29.7)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
    dependencies:
      '@formatjs/intl-localematcher': 0.8.13
      '@parcel/watcher': 2.6.0
      '@swc/core': 1.15.47
      icu-minify: 4.13.4
      negotiator: 1.0.0
-      next: 16.2.12(@babel/core@7.29.7)(@playwright/test@1.62.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      next: 16.2.12(@babel/core@7.29.7)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
      next-intl-swc-plugin-extractor: 4.13.4
      po-parser: 2.1.1
      react: 19.2.8
@@ -8841,7 +8756,7 @@ snapshots:
  next-tick@1.1.0: {}
-  next@16.2.12(@babel/core@7.29.7)(@playwright/test@1.62.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
+  next@16.2.12(@babel/core@7.29.7)(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
    dependencies:
      '@next/env': 16.2.12
      '@swc/helpers': 0.5.15
@@ -8860,7 +8775,6 @@ snapshots:
      '@next/swc-linux-x64-musl': 16.2.12
      '@next/swc-win32-arm64-msvc': 16.2.12
      '@next/swc-win32-x64-msvc': 16.2.12
      '@playwright/test': 1.62.1
      sharp: 0.34.5
    transitivePeerDependencies:
      - '@babel/core'
@@ -8868,8 +8782,6 @@ snapshots:
  node-addon-api@7.1.1: {}
  node-addon-api@8.9.1: {}
  node-exports-info@1.6.2:
    dependencies:
      array.prototype.flatmap: 1.3.3
@@ -8879,8 +8791,6 @@ snapshots:
  node-fetch-native@1.6.7: {}
  node-gyp-build@4.8.4: {}
  node-releases@2.0.51: {}
  nypm@0.6.9:
@@ -8955,10 +8865,6 @@ snapshots:
      type-check: 0.4.0
      word-wrap: 1.2.5
  otpauth@9.5.1:
    dependencies:
      '@noble/hashes': 2.2.0
  outvariant@1.4.0: {}
  own-keys@1.0.2:
@@ -9021,14 +8927,6 @@ snapshots:
      exsolve: 1.1.1
      pathe: 2.0.3
  playwright-core@1.62.1: {}
  playwright@1.62.1:
    dependencies:
      playwright-core: 1.62.1
    optionalDependencies:
      fsevents: 2.3.2
  po-parser@2.1.1: {}
  possible-typed-array-names@1.1.0: {}
@@ -1,382 +0,0 @@
 allowBuilds:
  "@parcel/watcher": false # dyad-auto-denied
  es5-ext: false # dyad-auto-denied
  unrs-resolver: false # dyad-auto-denied
  # dyad-default-allow-builds begin
  # dyad-default-allow-builds-schema=v1
  # dyad-default-allow-builds-data-version=2026-07-08.1
  # dyad-default-allow-builds-channel=remote
  "@airbnb/node-memwatch": true
  "@anthropic-ai/claude-code": true
  "@apollo/protobufjs": true
  "@apollo/rover": true
  "@appsignal/nodejs": true
  "@arkweid/lefthook": true
  "@aws-amplify/cli": true
  "@bahmutov/add-typescript-to-cypress": true
  "@bazel/concatjs": true
  "@bazel/cypress": true
  "@bazel/esbuild": true
  "@bazel/hide-bazel-files": true
  "@bazel/jasmine": true
  "@bazel/protractor": true
  "@bazel/rollup": true
  "@bazel/terser": true
  "@bazel/typescript": true
  "@bufbuild/buf": true
  "@cdktf/node-pty-prebuilt-multiarch": true
  "@ckeditor/ckeditor5-vue": true
  "@cloudflare/wrangler": true
  "@contrast/fn-inspect": true
  "@cubejs-backend/cubestore": true
  "@cubejs-backend/native": true
  "@cypress/snapshot": true
  "@danmarshall/deckgl-typings": true
  "@datadog/mobile-react-native": true
  "@discordjs/opus": true
  "@eversdk/lib-node": true
  "@evilmartians/lefthook": true
  "@ffmpeg-installer/darwin-arm64": true
  "@ffmpeg-installer/darwin-x64": true
  "@ffmpeg-installer/linux-arm": true
  "@ffmpeg-installer/linux-arm64": true
  "@ffmpeg-installer/linux-ia32": true
  "@ffmpeg-installer/linux-x64": true
  "@ffprobe-installer/darwin-arm64": true
  "@ffprobe-installer/darwin-x64": true
  "@ffprobe-installer/linux-arm": true
  "@ffprobe-installer/linux-arm64": true
  "@ffprobe-installer/linux-ia32": true
  "@ffprobe-installer/linux-x64": true
  "@fingerprintjs/fingerprintjs-pro-react": true
  "@ghaiklor/x509": true
  "@go-task/cli": true
  "@injectivelabs/sdk-ts": true
  "@instana/autoprofile": true
  "@intlify/vue-i18n-bridge": true
  "@intlify/vue-router-bridge": true
  "@matteodisabatino/gc_info": true
  "@memlab/cli": true
  "@microsoft.azure/autorest-core": true
  "@microsoft/teamsfx-cli": true
  "@microsoft/ts-command-line": true
  "@napi-rs/pinyin": true
  "@nativescript/core": true
  "@netlify/esbuild": true
  "@newrelic/native-metrics": true
  "@notarize/qlc-cli": true
  "@nx-dotnet/core": true
  "@opensearch-project/oui": true
  "@pact-foundation/pact-node": true
  "@paloaltonetworks/postman-code-generators": true
  "@pdftron/pdfnet-node": true
  "@percy/core": true
  "@pnpm/exe": true
  "@prisma/client": true
  "@prisma/engines": true
  "@progress/kendo-licensing": true
  "@pulumi/aws-native": true
  "@pulumi/awsx": true
  "@pulumi/command": true
  "@pulumi/kubernetes": true
  "@railway/cli": true
  "@replayio/cypress": true
  "@replayio/playwright": true
  "@roots/bud-framework": true
  "@sap/hana-client": true
  "@sap/hana-performance-tools": true
  "@sap/hana-theme-vscode": true
  "@scarf/scarf": true
  "@sematext/gc-stats": true
  "@sentry/capacitor": true
  "@sentry/profiling-node": true
  "@serialport/bindings": true
  "@serialport/bindings-cpp": true
  "@shopify/ngrok": true
  "@shopify/plugin-cloudflare": true
  "@sitespeed.io/chromedriver": true
  "@sitespeed.io/edgedriver": true
  "@softvisio/core": true
  "@splunk/otel": true
  "@strapi/strapi": true
  "@sveltejs/kit": true
  "@swc/core": true
  "@syncfusion/ej2-angular-base": true
  "@taquito/taquito": true
  "@temporalio/core-bridge": true
  "@tensorflow/tfjs-node": true
  "@trufflesuite/bigint-buffer": true
  "@typescript-tools/rust-implementation": true
  "@vaadin/vaadin-usage-statistics": true
  "@vscode/ripgrep": true
  "@vscode/sqlite3": true
  abstract-socket: true
  admin-lte: true
  appdynamics: true
  appium-chromedriver: true
  appium-windows-driver: true
  applicationinsights-native-metrics: true
  argon2: true
  autorest: true
  aws-crt: true
  azure-functions-core-tools: true
  azure-streamanalytics-cicd: true
  backport: true
  bcrypt: true
  better-sqlite3: true
  bigint-buffer: true
  blake-hash: true
  bs-platform: true
  bufferutil: true
  bun: true
  canvacord: true
  canvas: true
  cbor-extract: true
  chromedriver: true
  chromium: true
  classic-level: true
  cld: true
  cldr-data: true
  clevertap-react-native: true
  clientjs: true
  cmark-gfm: true
  compression: true
  contentlayer: true
  contextify: true
  cordova.plugins.diagnostic: true
  core-js: true
  couchbase: true
  cpu-features: true
  cwebp-bin: true
  cy2: true
  cypress: true
  dd-trace: true
  deasync: true
  detox: true
  detox-recorder: true
  diskusage: true
  dotnet-2.0.0: true
  dprint: true
  drivelist: true
  dtrace-provider: true
  duckdb: true
  dugite: true
  eccrypto: true
  egg-bin: true
  egg-ci: true
  electron: true
  electron-chromedriver: true
  electron-prebuilt: true
  electron-winstaller: true
  elm: true
  elm-format: true
  esbuild: true
  esoftplay: true
  event-loop-stats: true
  exifreader: true
  farmhash: true
  fast-folder-size: true
  faunadb: true
  ffi: true
  ffi-napi: true
  ffmpeg-static: true
  fibers: true
  fmerge: true
  free-email-domains: true
  fs-xattr: true
  full-icu: true
  gatsby: true
  gc-stats: true
  gcstats.js: true
  geckodriver: true
  gentype: true
  ghooks: true
  gif2webp-bin: true
  gifsicle: true
  git-commit-msg-linter: true
  git-validate: true
  git-win: true
  gl: true
  go-ios: true
  grpc: true
  grpc-tools: true
  handbrake-js: true
  hasura-cli: true
  heapdump: true
  hiredis: true
  hnswlib-node: true
  hugo-bin: true
  hummus: true
  ibm_db: true
  iconv: true
  iedriver: true
  iltorb: true
  incremental-json-parser: true
  install-peers: true
  interruptor: true
  iobroker.js-controller: true
  iso-constants: true
  isolated-vm: true
  java: true
  jest-preview: true
  jpeg-recompress-bin: true
  jpegtran-bin: true
  keccak: true
  kerberos: true
  keytar: true
  lefthook: true
  leveldown: true
  libpg-query: true
  libpq: true
  libxmljs: true
  libxmljs2: true
  lightningcss-cli: true
  lint: true
  lmdb: true
  lmdb-store: true
  local-cypress: true
  lz4: true
  lzma-native: true
  lzo: true
  macos-alias: true
  mbt: true
  memlab: true
  microtime: true
  minidump: true
  mmmagic: true
  modern-syslog: true
  mongodb-client-encryption: true
  mongodb-crypt-library-dummy: true
  mongodb-crypt-library-version: true
  mongodb-memory-server: true
  mozjpeg: true
  ms-chromium-edge-driver: true
  msgpackr-extract: true
  msnodesqlv8: true
  msw: true
  muhammara: true
  netlify-cli: true
  ngrok: true
  ngx-popperjs: true
  nice-napi: true
  node: true
  node-expat: true
  node-hid: true
  node-jq: true
  node-libcurl: true
  node-mac-contacts: true
  node-pty: true
  node-rdkafka: true
  node-sass: true
  node-webcrypto-ossl: true
  node-zopfli: true
  node-zopfli-es: true
  nodegit: true
  nodejieba: true
  nodent-runtime: true
  nx: true
  odiff-bin: true
  oniguruma: true
  opencode-ai: true
  optipng-bin: true
  oracledb: true
  os-dns-native: true
  parse-server: true
  phantomjs: true
  phantomjs-prebuilt: true
  pkcs11js: true
  playwright-chromium: true
  playwright-firefox: true
  playwright-webkit: true
  pngout-bin: true
  pngquant-bin: true
  posix: true
  pprof: true
  pre-commit: true
  pre-push: true
  prisma: true
  protoc: true
  protoc-gen-grpc-web: true
  puppeteer: true
  purescript: true
  re2: true
  react-jsx-parser: true
  react-native-stylex: true
  react-particles: true
  react-tsparticles: true
  react-vertical-timeline-component: true
  realm: true
  redis-memory-server: true
  ref: true
  ref-napi: true
  registry-js: true
  robotjs: true
  sauce-connect-launcher: true
  saucectl: true
  secp256k1: true
  segfault-handler: true
  shared-git-hooks: true
  sharp: true
  simple-git-hooks: true
  sleep: true
  slice2js: true
  snyk: true
  sockopt: true
  sodium-native: true
  sonar-scanner: true
  spago: true
  spectron: true
  spellchecker: true
  sq-native: true
  sqlite3: true
  sse4_crc32: true
  ssh2: true
  storage-engine: true
  subrequests: true
  subrequests-express: true
  subrequests-json-merger: true
  supabase: true
  svf-lib: true
  swagger-ui: true
  swiftlint: true
  taiko: true
  tldjs: true
  tree-sitter: true
  tree-sitter-cli: true
  tree-sitter-json: true
  tree-sitter-kotlin: true
  tree-sitter-typescript: true
  tree-sitter-yaml: true
  truffle: true
  tsparticles-engine: true
  ttag-cli: true
  ttf2woff2: true
  typemoq: true
  unix-dgram: true
  ursa-optional: true
  usb: true
  utf-8-validate: true
  v8-profiler-next: true
  vue-demi: true
  vue-echarts: true
  vue-inbrowser-compiler-demi: true
  wd: true
  wdeasync: true
  weak-napi: true
  webdev-toolkit: true
  windows-build-tools: true
  wix-style-react: true
  wordpos: true
  workerd: true
  wrtc: true
  xxhash: true
  yo: true
  yorkie: true
  zeromq: true
  zlib-sync: true
  zopflipng-bin: true
  # dyad-default-allow-builds end
 packages:
  - .
 minimumReleaseAge: 1440
@@ -1,43 +0,0 @@
 ALTER TABLE "communication_rooms" ADD COLUMN "audienceType" TEXT NOT NULL DEFAULT 'direct';
 ALTER TABLE "communication_rooms" ADD COLUMN "classGroupId" TEXT;
 ALTER TABLE "communication_rooms" ADD COLUMN "escalationEligibleAt" TIMESTAMP(3);
 ALTER TABLE "communication_rooms" ADD COLUMN "escalatedAt" TIMESTAMP(3);
 ALTER TABLE "communication_rooms" ADD COLUMN "resolvedAt" TIMESTAMP(3);
 ALTER TABLE "communication_rooms" ADD COLUMN "resolutionStatus" TEXT NOT NULL DEFAULT 'open';
 PRAGMA foreign_keys=OFF;
 CREATE TABLE "new_communication_rooms" (
  "id" TEXT NOT NULL PRIMARY KEY,
  "schoolId" TEXT NOT NULL,
  "studentId" TEXT NOT NULL,
  "teacherId" TEXT NOT NULL,
  "roomType" TEXT NOT NULL DEFAULT 'chat',
  "audienceType" TEXT NOT NULL DEFAULT 'direct',
  "classGroupId" TEXT,
  "status" TEXT NOT NULL DEFAULT 'requested',
  "requestedBy" TEXT NOT NULL,
  "escalationEligibleAt" DATETIME,
  "escalatedAt" DATETIME,
  "resolvedAt" DATETIME,
  "resolutionStatus" TEXT NOT NULL DEFAULT 'open',
  "acceptedAt" DATETIME,
  "closedAt" DATETIME,
  "closeReason" TEXT,
  "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
  "updatedAt" DATETIME NOT NULL,
  CONSTRAINT "communication_rooms_schoolId_fkey" FOREIGN KEY ("schoolId") REFERENCES "School" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
  CONSTRAINT "communication_rooms_studentId_fkey" FOREIGN KEY ("studentId") REFERENCES "User" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
  CONSTRAINT "communication_rooms_teacherId_fkey" FOREIGN KEY ("teacherId") REFERENCES "User" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
  CONSTRAINT "communication_rooms_classGroupId_fkey" FOREIGN KEY ("classGroupId") REFERENCES "ClassGroup" ("id") ON DELETE SET NULL ON UPDATE CASCADE
 );
 INSERT INTO "new_communication_rooms" ("id", "schoolId", "studentId", "teacherId", "roomType", "audienceType", "classGroupId", "status", "requestedBy", "escalationEligibleAt", "escalatedAt", "resolvedAt", "resolutionStatus", "acceptedAt", "closedAt", "closeReason", "createdAt", "updatedAt") SELECT "id", "schoolId", "studentId", "teacherId", "roomType", "audienceType", "classGroupId", "status", "requestedBy", "escalationEligibleAt", "escalatedAt", "resolvedAt", "resolutionStatus", "acceptedAt", "closedAt", "closeReason", "createdAt", "updatedAt" FROM "communication_rooms";
 DROP TABLE "communication_rooms";
 ALTER TABLE "new_communication_rooms" RENAME TO "communication_rooms";
 PRAGMA foreign_keys=ON;
 CREATE INDEX "communication_rooms_classGroupId_idx" ON "communication_rooms"("classGroupId");
 CREATE INDEX "communication_rooms_escalationEligibleAt_idx" ON "communication_rooms"("escalationEligibleAt");
 CREATE INDEX "communication_rooms_schoolId_idx" ON "communication_rooms"("schoolId");
 CREATE INDEX "communication_rooms_studentId_idx" ON "communication_rooms"("studentId");
 CREATE INDEX "communication_rooms_teacherId_idx" ON "communication_rooms"("teacherId");
 CREATE INDEX "communication_rooms_status_idx" ON "communication_rooms"("status");
@@ -1,54 +0,0 @@
 ALTER TABLE "illness_reports" ADD COLUMN "leaveType" TEXT NOT NULL DEFAULT 'illness';
 ALTER TABLE "illness_reports" ADD COLUMN "teacherNotifiedAt" TIMESTAMP(3);
 ALTER TABLE "illness_reports" ADD COLUMN "adminApprovalStatus" TEXT NOT NULL DEFAULT 'pending';
 ALTER TABLE "illness_reports" ADD COLUMN "adminApprovedBy" TEXT;
 ALTER TABLE "illness_reports" ADD COLUMN "adminApprovedAt" TIMESTAMP(3);
 ALTER TABLE "illness_reports" ADD COLUMN "adminNotes" TEXT;
 ALTER TABLE "illness_reports" ADD COLUMN "calendarEventId" TEXT;
 PRAGMA foreign_keys=OFF;
 CREATE TABLE "new_illness_reports" (
  "id" TEXT NOT NULL PRIMARY KEY,
  "schoolId" TEXT NOT NULL,
  "studentId" TEXT NOT NULL,
  "reportedBy" TEXT NOT NULL,
  "reporterType" TEXT NOT NULL,
  "reason" TEXT NOT NULL,
  "description" TEXT,
  "startDate" DATETIME NOT NULL,
  "endDate" DATETIME,
  "documentUrl" TEXT,
  "leaveType" TEXT NOT NULL DEFAULT 'illness',
  "status" TEXT NOT NULL DEFAULT 'pending',
  "parentApprovalStatus" TEXT NOT NULL DEFAULT 'pending',
  "parentApprovedBy" TEXT,
  "parentApprovedAt" DATETIME,
  "isVisibleToTeacher" BOOLEAN NOT NULL DEFAULT false,
  "isVisibleToAdmin" BOOLEAN NOT NULL DEFAULT false,
  "teacherNotifiedAt" DATETIME,
  "adminApprovalStatus" TEXT NOT NULL DEFAULT 'pending',
  "adminApprovedBy" TEXT,
  "adminApprovedAt" DATETIME,
  "adminNotes" TEXT,
  "calendarEventId" TEXT,
  "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
  "updatedAt" DATETIME NOT NULL,
  CONSTRAINT "illness_reports_schoolId_fkey" FOREIGN KEY ("schoolId") REFERENCES "School" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
  CONSTRAINT "illness_reports_studentId_fkey" FOREIGN KEY ("studentId") REFERENCES "Student" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
  CONSTRAINT "illness_reports_reportedBy_fkey" FOREIGN KEY ("reportedBy") REFERENCES "User" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
  CONSTRAINT "illness_reports_parentApprovedBy_fkey" FOREIGN KEY ("parentApprovedBy") REFERENCES "User" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
  CONSTRAINT "illness_reports_adminApprovedBy_fkey" FOREIGN KEY ("adminApprovedBy") REFERENCES "User" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
  CONSTRAINT "illness_reports_calendarEventId_fkey" FOREIGN KEY ("calendarEventId") REFERENCES "CalendarEvent" ("id") ON DELETE SET NULL ON UPDATE CASCADE
 );
 INSERT INTO "new_illness_reports" ("id", "schoolId", "studentId", "reportedBy", "reporterType", "reason", "description", "startDate", "endDate", "documentUrl", "leaveType", "status", "parentApprovalStatus", "parentApprovedBy", "parentApprovedAt", "isVisibleToTeacher", "isVisibleToAdmin", "teacherNotifiedAt", "adminApprovalStatus", "adminApprovedBy", "adminApprovedAt", "adminNotes", "calendarEventId", "createdAt", "updatedAt") SELECT "id", "schoolId", "studentId", "reportedBy", "reporterType", "reason", "description", "startDate", "endDate", "documentUrl", "leaveType", "status", "parentApprovalStatus", "parentApprovedBy", "parentApprovedAt", "isVisibleToTeacher", "isVisibleToAdmin", "teacherNotifiedAt", "adminApprovalStatus", "adminApprovedBy", "adminApprovedAt", "adminNotes", "calendarEventId", "createdAt", "updatedAt" FROM "illness_reports";
 DROP TABLE "illness_reports";
 ALTER TABLE "new_illness_reports" RENAME TO "illness_reports";
 PRAGMA foreign_keys=ON;
 CREATE UNIQUE INDEX "illness_reports_calendarEventId_key" ON "illness_reports"("calendarEventId");
 CREATE INDEX "illness_reports_adminApprovalStatus_idx" ON "illness_reports"("adminApprovalStatus");
 CREATE INDEX "illness_reports_schoolId_idx" ON "illness_reports"("schoolId");
 CREATE INDEX "illness_reports_studentId_idx" ON "illness_reports"("studentId");
 CREATE INDEX "illness_reports_reportedBy_idx" ON "illness_reports"("reportedBy");
 CREATE INDEX "illness_reports_parentApprovalStatus_idx" ON "illness_reports"("parentApprovalStatus");
 CREATE INDEX "illness_reports_status_idx" ON "illness_reports"("status");
@@ -1,41 +0,0 @@
 ALTER TABLE "teacher_absences" ADD COLUMN "approvalStatus" TEXT NOT NULL DEFAULT 'pending';
 ALTER TABLE "teacher_absences" ADD COLUMN "approvedBy" TEXT;
 ALTER TABLE "teacher_absences" ADD COLUMN "approvedAt" TIMESTAMP(3);
 ALTER TABLE "teacher_absences" ADD COLUMN "privateAdminNotes" TEXT;
 ALTER TABLE "teacher_absences" ADD COLUMN "documentUrl" TEXT;
 ALTER TABLE "teacher_absences" ADD COLUMN "calendarEventId" TEXT;
 PRAGMA foreign_keys=OFF;
 CREATE TABLE "new_teacher_absences" (
  "id" TEXT NOT NULL PRIMARY KEY,
  "schoolId" TEXT NOT NULL,
  "teacherId" TEXT NOT NULL,
  "startDate" DATETIME NOT NULL,
  "endDate" DATETIME NOT NULL,
  "type" TEXT NOT NULL,
  "reason" TEXT,
  "status" TEXT NOT NULL DEFAULT 'reported',
  "notes" TEXT,
  "approvalStatus" TEXT NOT NULL DEFAULT 'pending',
  "approvedBy" TEXT,
  "approvedAt" DATETIME,
  "privateAdminNotes" TEXT,
  "documentUrl" TEXT,
  "calendarEventId" TEXT,
  "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
  "updatedAt" DATETIME NOT NULL,
  CONSTRAINT "teacher_absences_schoolId_fkey" FOREIGN KEY ("schoolId") REFERENCES "School" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
  CONSTRAINT "teacher_absences_teacherId_fkey" FOREIGN KEY ("teacherId") REFERENCES "User" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
  CONSTRAINT "teacher_absences_approvedBy_fkey" FOREIGN KEY ("approvedBy") REFERENCES "User" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
  CONSTRAINT "teacher_absences_calendarEventId_fkey" FOREIGN KEY ("calendarEventId") REFERENCES "CalendarEvent" ("id") ON DELETE SET NULL ON UPDATE CASCADE
 );
 INSERT INTO "new_teacher_absences" ("id", "schoolId", "teacherId", "startDate", "endDate", "type", "reason", "status", "notes", "approvalStatus", "approvedBy", "approvedAt", "privateAdminNotes", "documentUrl", "calendarEventId", "createdAt", "updatedAt") SELECT "id", "schoolId", "teacherId", "startDate", "endDate", "type", "reason", "status", "notes", "approvalStatus", "approvedBy", "approvedAt", "privateAdminNotes", "documentUrl", "calendarEventId", "createdAt", "updatedAt" FROM "teacher_absences";
 DROP TABLE "teacher_absences";
 ALTER TABLE "new_teacher_absences" RENAME TO "teacher_absences";
 PRAGMA foreign_keys=ON;
 CREATE UNIQUE INDEX "teacher_absences_calendarEventId_key" ON "teacher_absences"("calendarEventId");
 CREATE INDEX "teacher_absences_approvalStatus_idx" ON "teacher_absences"("approvalStatus");
 CREATE INDEX "teacher_absences_schoolId_idx" ON "teacher_absences"("schoolId");
 CREATE INDEX "teacher_absences_teacherId_idx" ON "teacher_absences"("teacherId");
 CREATE INDEX "teacher_absences_startDate_idx" ON "teacher_absences"("startDate");
@@ -1,15 +0,0 @@
 ALTER TABLE "User" ADD COLUMN "emailVerifiedAt" DATETIME;
 CREATE TABLE "PasswordResetToken" (
  "id" TEXT NOT NULL PRIMARY KEY,
  "userId" TEXT NOT NULL,
  "tokenHash" TEXT NOT NULL,
  "expiresAt" DATETIME NOT NULL,
  "usedAt" DATETIME,
  "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
  CONSTRAINT "PasswordResetToken_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE CASCADE ON UPDATE CASCADE
 );
 CREATE UNIQUE INDEX "PasswordResetToken_tokenHash_key" ON "PasswordResetToken"("tokenHash");
 CREATE INDEX "PasswordResetToken_userId_idx" ON "PasswordResetToken"("userId");
 CREATE INDEX "PasswordResetToken_expiresAt_idx" ON "PasswordResetToken"("expiresAt");
@@ -1,11 +0,0 @@
 CREATE TABLE "TwoFactorRecoveryCode" (
  "id" TEXT NOT NULL PRIMARY KEY,
  "userId" TEXT NOT NULL,
  "codeHash" TEXT NOT NULL,
  "usedAt" DATETIME,
  "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
  CONSTRAINT "TwoFactorRecoveryCode_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE CASCADE ON UPDATE CASCADE
 );
 CREATE UNIQUE INDEX "TwoFactorRecoveryCode_codeHash_key" ON "TwoFactorRecoveryCode"("codeHash");
 CREATE INDEX "TwoFactorRecoveryCode_userId_idx" ON "TwoFactorRecoveryCode"("userId");
@@ -1 +0,0 @@
 -- This is an empty migration.
@@ -1,62 +0,0 @@
 import { PrismaClient } from '@prisma/client'
 import argon2 from 'argon2'
 const prisma = new PrismaClient()
 const password = 'Demo2025!'
 const demoUsers = [
  { email: 'demo@competencetrack.org', firstName: 'Anna', lastName: 'Müller', role: 'SCHOOL_ADMIN' },
  { email: 'demo.vice@competencetrack.org', firstName: 'Clara', lastName: 'Schmidt', role: 'VICE_PRINCIPAL' },
  { email: 'demo.teacher@competencetrack.org', firstName: 'Max', lastName: 'Lehrer', role: 'TEACHER' },
  { email: 'demo.student@competencetrack.org', firstName: 'Lena', lastName: 'Schüler', role: 'STUDENT' },
  { email: 'demo.parent@competencetrack.org', firstName: 'Thomas', lastName: 'Elter', role: 'PARENT' },
 ]
 async function main() {
  const passwordHash = await argon2.hash(password, {
    type: argon2.argon2id,
    memoryCost: 19 * 1024,
    timeCost: 2,
    parallelism: 1,
  })
  // Find any existing school (from seed.ts) or create one
  let school = await prisma.school.findFirst()
  if (!school) {
    school = await prisma.school.create({
      data: {
        name: 'Demo Schule',
        schoolType: 'GYMNASIUM',
        country: 'DE',
        timezone: 'Europe/Berlin',
      },
    })
    console.log(`Created demo school: ${school.id}`)
  } else {
    console.log(`Using existing school: ${school.name} (${school.id})`)
  }
  for (const user of demoUsers) {
    await prisma.user.upsert({
      where: { email: user.email },
      update: { isDemo: true, passwordHash, schoolId: school.id },
      create: { ...user, passwordHash, locale: 'de', isDemo: true, schoolId: school.id },
    })
  }
  const seededCount = await prisma.user.count({
    where: { email: { in: demoUsers.map(({ email }) => email) }, isDemo: true },
  })
  if (seededCount !== demoUsers.length) throw new Error(`Expected ${demoUsers.length} demo accounts, found ${seededCount}`)
  console.log(`Ensured ${seededCount} demo accounts (schoolId: ${school.id}).`)
 }
 main()
  .catch((error) => {
    console.error(error)
    process.exit(1)
  })
  .finally(async () => {
    await prisma.$disconnect()
  })
@@ -1,12 +1,12 @@
 /**
- * SchulOS — Prisma Seed Script
+ * CompetenceTrack — Prisma Seed Script
 * Populates the database with realistic demo data for a Berlin elementary school.
 *
 * Usage: bun prisma/seed.ts
 */
 import { PrismaClient } from '@prisma/client'
-import argon2 from 'argon2'
+import bcrypt from 'bcryptjs'
 const prisma = new PrismaClient()
@@ -18,10 +18,6 @@ function randomDateWithinLast(days: number): Date {
  return new Date(past.getTime() + Math.random() * diff)
 }
 function addDays(date: Date, days: number): Date {
  return new Date(date.getTime() + days * 24 * 60 * 60 * 1000)
 }
 // ─── Helper: random integer in range [min, max] ──────────────────────────
 function randInt(min: number, max: number): number {
  return Math.floor(Math.random() * (max - min + 1)) + min
@@ -33,7 +29,7 @@ function pick<T>(arr: T[]): T {
 }
 async function main() {
-  console.log('🌱 Seeding SchulOS database...\n')
+  console.log('🌱 Seeding CompetenceTrack database...\n')
  // Clean up existing data (order matters due to foreign keys)
  console.log('  🧹 Cleaning existing data...')
@@ -100,12 +96,7 @@ async function main() {
  // ─── 3. Demo Users ──────────────────────────────────────────────────
  console.log('  👩‍🏫 Creating demo users...')
-  const passwordHash = await argon2.hash('Demo2025!', {
+  const passwordHash = await bcrypt.hash('Demo2025!', 10)
    type: argon2.argon2id,
    memoryCost: 19 * 1024,
    timeCost: 2,
    parallelism: 1,
  })
  const teacher = await prisma.user.create({
    data: {
      schoolId: school.id,
@@ -1519,170 +1510,6 @@ async function main() {
  console.log(`    Created 5 comment categories, 12 comment bank entries`)
  // ─── 16. Homework ──────────────────────────────────────────────────────
  console.log('  📖 Creating homework...')
  const homeworkData = [
    { title: 'Arbeitsblatt: Zahlenraum bis 1000', description: 'Löse die Aufgaben auf dem Arbeitsblatt.', subjectId: mathSubject.id, classGroupId: class3a.id, dueDate: addDays(now, 3), type: 'assignment' },
    { title: 'Einmaleins üben', description: 'Trainiere das kleine Einmaleins.', subjectId: mathSubject.id, classGroupId: class3a.id, dueDate: addDays(now, 5), type: 'practice' },
    { title: 'Lesetagebuch: Märchen', description: 'Lies ein Märchen und schreibe eine kurze Zusammenfassung.', subjectId: germanSubject.id, classGroupId: class3a.id, dueDate: addDays(now, 7), type: 'reading' },
    { title: 'Wortschatz: Kapitel 4', description: 'Lerne die neuen Vokabeln.', subjectId: germanSubject.id, classGroupId: class3b.id, dueDate: addDays(now, 2), type: 'practice' },
    { title: 'Sachunterricht: Tiere im Wald', description: 'Recherchiere drei Tiere und ihre Lebensweise.', subjectId: mathSubject.id, classGroupId: class3b.id, dueDate: addDays(now, 10), type: 'research' },
  ]
  for (const hw of homeworkData) {
    await prisma.homework.create({
      data: {
        schoolId: school.id,
        classGroupId: hw.classGroupId,
        subjectId: hw.subjectId,
        teacherId: teacher.id,
        title: hw.title,
        description: hw.description,
        dueDate: hw.dueDate,
        homeworkType: hw.type,
        isPublished: true,
        isDemo: true,
      },
    })
  }
  console.log(`    Created ${homeworkData.length} homework entries`)
  // ─── 17. Attendance Sessions ──────────────────────────────────────────
  console.log('  📋 Creating attendance sessions...')
  let attendanceCount = 0
  for (let d = 0; d < 5; d++) {
    const date = addDays(now, -d)
    if (date.getDay() === 0 || date.getDay() === 6) continue // Skip weekends
    for (const cls of [class3a, class3b]) {
      const session = await prisma.attendanceSession.create({
        data: {
          classGroupId: cls.id,
          teacherId: teacher.id,
          date,
          subjectId: mathSubject.id,
          period: '1. Stunde',
          status: 'COMPLETED',
        },
      })
      const classStudents = cls.id === class3a.id ? students3a : students3b
      for (const student of classStudents) {
        const r = Math.random()
        const status = r > 0.92 ? 'ABSENT' : r > 0.86 ? 'LATE' : 'PRESENT'
        await prisma.attendanceRecord.create({
          data: {
            sessionId: session.id,
            studentId: student.id,
            status,
            arrivalTime: status === 'LATE' ? '08:25' : null,
          },
        })
        attendanceCount++
      }
    }
  }
  console.log(`    Created ${attendanceCount} attendance records`)
  // ─── 18. Notebooks ─────────────────────────────────────────────────────
  console.log('  📓 Creating notebooks...')
  const notebookData = [
    { title: 'Mathematik Heft 3a', type: 'matheheft', color: '#10b981', subjectId: mathSubject.id, classGroupId: class3a.id },
    { title: 'Deutsch Heft 3a', type: 'deutschheft', color: '#0ea5e9', subjectId: germanSubject.id, classGroupId: class3a.id },
    { title: 'Mathematik Heft 3b', type: 'matheheft', color: '#f59e0b', subjectId: mathSubject.id, classGroupId: class3b.id },
    { title: 'Deutsch Heft 3b', type: 'deutschheft', color: '#8b5cf6', subjectId: germanSubject.id, classGroupId: class3b.id },
  ]
  for (const nb of notebookData) {
    const notebook = await prisma.notebook.create({
      data: {
        schoolId: school.id,
        ownerId: teacher.id,
        ownerType: 'TEACHER',
        subjectId: nb.subjectId,
        classGroupId: nb.classGroupId,
        title: nb.title,
        notebookType: nb.type,
        color: nb.color,
        isPublic: true,
        isDemo: true,
      },
    })
    // Add 3 pages per notebook
    for (let p = 1; p <= 3; p++) {
      await prisma.notebookPage.create({
        data: {
          notebookId: notebook.id,
          pageNumber: p,
          title: `Seite ${p}`,
          contentType: 'text',
          textContent: p === 1 ? `Willkommen im ${nb.title}!` : '',
          drawingData: '[]',
          background: nb.type === 'matheheft' ? 'grid' : nb.type === 'deutschheft' ? 'lined' : 'lined',
        },
      })
    }
  }
  console.log(`    Created ${notebookData.length} notebooks with pages`)
  // ─── 19. Homework Submissions ──────────────────────────────────────────
  console.log('  📝 Creating homework submissions...')
  const homeworkEntries = await prisma.homework.findMany({ where: { isDemo: true } })
  let submissionCount = 0
  for (const hw of homeworkEntries) {
    const classStudents = hw.classGroupId === class3a.id ? students3a : students3b
    for (const student of classStudents) {
      const r = Math.random()
      if (r > 0.3) { // 70% submitted
        const status = r > 0.85 ? 'graded' : r > 0.5 ? 'submitted' : 'pending'
        await prisma.homeworkSubmission.create({
          data: {
            homeworkId: hw.id,
            studentId: student.id,
            content: status === 'submitted' || status === 'graded' ? 'Hausaufgabe erledigt.' : null,
            status,
            score: status === 'graded' ? Math.round(Math.random() * 30 + 70) : null,
            feedback: status === 'graded' ? 'Gut gemacht!' : null,
            submittedAt: status !== 'pending' ? randomDateWithinLast(3) : null,
            gradedAt: status === 'graded' ? new Date() : null,
            isDemo: true,
          },
        })
        submissionCount++
      }
    }
  }
  console.log(`    Created ${submissionCount} homework submissions`)
  // ─── 20. Calendar Events ───────────────────────────────────────────────
  console.log('  📅 Creating calendar events...')
  const calendarEvents = [
    { title: 'Mathetest', type: 'exam', daysAhead: 5, subjectId: mathSubject.id, classGroupId: class3a.id, allDay: false, start: '10:00', end: '10:45' },
    { title: 'Deutschtest', type: 'exam', daysAhead: 8, subjectId: germanSubject.id, classGroupId: class3a.id, allDay: false, start: '10:00', end: '10:45' },
    { title: 'Klassenfahrt', type: 'reminder', daysAhead: 14, classGroupId: class3a.id, allDay: true },
    { title: 'Elternsprechtag', type: 'reminder', daysAhead: 7, allDay: true },
    { title: 'Mathetest 3b', type: 'exam', daysAhead: 6, subjectId: mathSubject.id, classGroupId: class3b.id, allDay: false, start: '09:00', end: '09:45' },
    { title: 'Lesewettbewerb', type: 'reminder', daysAhead: 12, subjectId: germanSubject.id, classGroupId: class3b.id, allDay: false, start: '11:00', end: '12:00' },
    { title: 'Sportfest', type: 'reminder', daysAhead: 20, allDay: true },
    { title: 'Zeugnisausgabe', type: 'reminder', daysAhead: 30, allDay: true },
  ]
  for (const ev of calendarEvents) {
    await prisma.calendarEvent.create({
      data: {
        schoolId: school.id,
        teacherId: teacher.id,
        title: ev.title,
        date: addDays(now, ev.daysAhead),
        startTime: ev.start || null,
        endTime: ev.end || null,
        eventType: ev.type,
        subjectId: ev.subjectId || null,
        classGroupId: ev.classGroupId || null,
        allDay: ev.allDay,
        notes: ev.type === 'exam' ? 'Bitte ausreichend üben.' : null,
      },
    })
  }
  console.log(`    Created ${calendarEvents.length} calendar events`)
  // ─── Summary ───────────────────────────────────────────────────────────
  console.log('\n  ✅ Seed completed successfully!\n')
  console.log('  📊 Summary:')
@@ -1704,11 +1531,6 @@ async function main() {
  console.log(`  Behavior:     ${behaviorCategoryDefs.length} categories, ${incidentCount} incidents`)
  console.log(`  Rubrics:      3 (Aufsatzbewertung, Mündliche Prüfung, Projektpräsentation)`)
  console.log(`  Comments:     5 categories, 12 bank entries`)
  console.log(`  Homework:     ${homeworkData.length} assignments`)
  console.log(`  Attendance:   ${attendanceCount} records across sessions`)
  console.log(`  Notebooks:    ${notebookData.length} notebooks with pages`)
  console.log(`  Submissions:  ${submissionCount} homework submissions`)
  console.log(`  Calendar:     ${calendarEvents.length} events`)
  console.log('  ─────────────────────────────────────────')
  console.log('\n  🔑 Login: demo@competencetrack.org / Demo2025!')
 }
@@ -1 +1,29 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" role="img" aria-labelledby="title"><title>SchulOS</title><rect width="48" height="48" rx="12" fill="#059669"/><path fill="#fff" d="M13 14.5c0-2.5 2-4.5 4.5-4.5h13A4.5 4.5 0 0 1 35 14.5v19c0 2.5-2 4.5-4.5 4.5h-13a4.5 4.5 0 0 1-4.5-4.5v-19Zm5 0v19h12v-19H18Zm3 4h6v3h-6v-3Zm0 6h6v3h-6v-3Z"/></svg>
+<?xml version="1.0" encoding="utf-8"?>
 <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
 	 viewBox="0 0 30 30" style="enable-background:new 0 0 30 30;" xml:space="preserve">
 <defs>
  <style type="text/css">
    .st194{fill:#2D2D2D;stroke:#FFFFFF;stroke-width:0.6317;stroke-miterlimit:10;}
    .st23{fill:#FFFFFF;}
    .z-breathe {
      animation: breathe 2.5s ease-in-out infinite;
    }
    @keyframes breathe {
      0%, 100% { opacity: 0.7; }
      50% { opacity: 1; }
    }
  </style>
 </defs>
 <g>
  <path class="st194" d="M24.51,28.51H5.49c-2.21,0-4-1.79-4-4V5.49c0-2.21,1.79-4,4-4h19.03c2.21,0,4,1.79,4,4v19.03
    C28.51,26.72,26.72,28.51,24.51,28.51z"/>
  <g class="z-breathe">
    <path class="st23" d="M15.47,7.1l-1.3,1.85c-0.2,0.29-0.54,0.47-0.9,0.47h-7.1V7.09C6.16,7.1,15.47,7.1,15.47,7.1z"/>
    <polygon class="st23" points="24.3,7.1 13.14,22.91 5.7,22.91 16.86,7.1"/>
    <path class="st23" d="M14.53,22.91l1.31-1.86c0.2-0.29,0.54-0.47,0.9-0.47h7.09v2.33H14.53z"/>
  </g>
 </g>
 </svg>
@@ -1,6 +1,6 @@
 {
-  "name": "SchulOS",
+  "name": "CompetenceTrack",
-  "short_name": "SchulOS",
+  "short_name": "CompTrack",
  "description": "Kompetenz- und Benotungsplattform für Schulen",
  "start_url": "/",
  "display": "standalone",
@@ -1,12 +1,8 @@
-// SchulOS — Service Worker for PWA Offline Support
+// CompetenceTrack — Service Worker for PWA Offline Support
-const CACHE_NAME = 'schulos-v3';
+const CACHE_NAME = 'competencetrack-v3';
-const STATIC_CACHE = 'schulos-static-v3';
+const STATIC_CACHE = 'competencetrack-static-v3';
-const DATA_CACHE = 'schulos-data-v3';
+const DATA_CACHE = 'competencetrack-data-v3';
-const OFFLINE_CACHE = 'schulos-offline-v3';
+const OFFLINE_CACHE = 'competencetrack-offline-v3';
 const SYNC_TAG = 'schulos-sync';
 const LEGACY_SYNC_TAG = 'competencetrack-sync';
 const SYNC_DB = 'schulos-sync-db';
 const LEGACY_SYNC_DB = 'competencetrack-sync-db';
 // Static assets to cache on install
 const STATIC_ASSETS = [
@@ -37,17 +33,19 @@ self.addEventListener('install', (event) => {
  );
 });
-// Activate event — migrate queued writes before clearing legacy caches.
+// Activate event — clean up old caches
 self.addEventListener('activate', (event) => {
  event.waitUntil(
-    migrateLegacyPendingRequests()
+    caches.keys().then((keys) => {
-      .then(() => caches.keys())
+      return Promise.all(
      .then((keys) => Promise.all(
        keys
          .filter((key) => key !== CACHE_NAME && key !== STATIC_CACHE && key !== DATA_CACHE && key !== OFFLINE_CACHE)
          .map((key) => caches.delete(key))
-      ))
+      );
-      .then(() => self.clients.claim())
+    }).then(() => {
      console.log('[SW] Activated and old caches cleaned');
      return self.clients.claim();
    })
  );
 });
@@ -193,7 +191,7 @@ async function networkFirstWithOfflineFallback(request) {
 // Store failed requests for background sync
 async function storeRequestForSync(request) {
-  const db = await openIndexedDB(SYNC_DB);
+  const db = await openIndexedDB();
  const tx = db.transaction('pending-requests', 'readwrite');
  const store = tx.objectStore('pending-requests');
  const requestData = {
@@ -204,13 +202,16 @@ async function storeRequestForSync(request) {
    timestamp: Date.now(),
  };
  store.add(requestData);
-  await transactionDone(tx);
+  await tx.done;
-  self.registration.sync.register(SYNC_TAG);
+
  // Register for background sync
  self.registration.sync.register('competencetrack-sync');
 }
-function openIndexedDB(name) {
+// Open IndexedDB for storing pending requests
 function openIndexedDB() {
  return new Promise((resolve, reject) => {
-    const request = indexedDB.open(name, 1);
+    const request = indexedDB.open('competencetrack-sync-db', 1);
    request.onupgradeneeded = () => {
      const db = request.result;
      if (!db.objectStoreNames.contains('pending-requests')) {
@@ -222,54 +223,18 @@ function openIndexedDB(name) {
  });
 }
-function transactionDone(tx) {
+// Background sync event — replay queued requests when back online
  return new Promise((resolve, reject) => {
    tx.oncomplete = () => resolve();
    tx.onerror = () => reject(tx.error);
    tx.onabort = () => reject(tx.error);
  });
 }
 async function migrateLegacyPendingRequests() {
  const legacyDb = await openIndexedDB(LEGACY_SYNC_DB);
  const legacyTx = legacyDb.transaction('pending-requests', 'readonly');
  const legacyStore = legacyTx.objectStore('pending-requests');
  const requests = await new Promise((resolve, reject) => {
    const request = legacyStore.getAll();
    request.onsuccess = () => resolve(request.result);
    request.onerror = () => reject(request.error);
  });
  await transactionDone(legacyTx);
  if (!requests.length) return;
  const currentDb = await openIndexedDB(SYNC_DB);
  const currentTx = currentDb.transaction('pending-requests', 'readwrite');
  const currentStore = currentTx.objectStore('pending-requests');
  for (const request of requests) currentStore.put(request);
  await transactionDone(currentTx);
  const deleteTx = legacyDb.transaction('pending-requests', 'readwrite');
  deleteTx.objectStore('pending-requests').clear();
  await transactionDone(deleteTx);
 }
 // Background sync event — replay queues from both brand generations.
 self.addEventListener('sync', (event) => {
-  if (event.tag === SYNC_TAG || event.tag === LEGACY_SYNC_TAG) {
+  if (event.tag === 'competencetrack-sync') {
-    event.waitUntil(migrateLegacyPendingRequests().then(replayPendingRequests));
+    event.waitUntil(replayPendingRequests());
  }
 });
 async function replayPendingRequests() {
-  const db = await openIndexedDB(SYNC_DB);
+  const db = await openIndexedDB();
  const tx = db.transaction('pending-requests', 'readwrite');
  const store = tx.objectStore('pending-requests');
-  const allRequests = await new Promise((resolve, reject) => {
+  const allRequests = await store.getAll();
    const request = store.getAll();
    request.onsuccess = () => resolve(request.result);
    request.onerror = () => reject(request.error);
  });
  for (const reqData of allRequests) {
    try {
@@ -279,12 +244,15 @@ async function replayPendingRequests() {
        headers,
        body: reqData.method !== 'GET' ? reqData.body : undefined,
      });
-      if (response.ok) store.delete(reqData.timestamp);
+      if (response.ok) {
        store.delete(reqData.timestamp);
      }
    } catch (error) {
      console.warn('[SW] Failed to replay request:', error);
      // Keep the request in the store for next sync attempt
    }
  }
-  await transactionDone(tx);
+  await tx.done;
 }
 // Push event — show notification (if push notifications are configured)
@@ -301,7 +269,7 @@ self.addEventListener('push', (event) => {
    },
  };
  event.waitUntil(
-    self.registration.showNotification(data.title || 'SchulOS', options)
+    self.registration.showNotification(data.title || 'CompetenceTrack', options)
  );
 });
@@ -3,11 +3,20 @@
 * This document lists all data entities, their purposes, legal basis, and retention categories
 */
-import fs from "node:fs";
+const fs = require("fs");
-import path from "node:path";
+const path = require("path");
 interface DataEntity {
  name: string;
  dataCategories: string[];
  legalBasis: string;
  purpose: string;
  retentionCategory: string;
  notes?: string;
 }
 // Core data model definition
-const dataModel = [
+const dataModel: DataEntity[] = [
  {
    name: "User",
    dataCategories: ["firstName", "lastName", "email", "role", "createdAt"],
@@ -103,12 +112,12 @@ const dataModel = [
  },
 ];
-function generateDataModel(outputPath = "docs/legal") {
+export function generateDataModel(outputPath: string = "docs/legal"): void {
  if (!fs.existsSync(outputPath)) {
    fs.mkdirSync(outputPath, { recursive: true });
  }
-  const lines = [
+  const lines: string[] = [
    "# Data Model Documentation",
    "",
    "**Status**: Schema Reference for ExaMetra (Module L)",
@@ -157,7 +166,7 @@ function generateDataModel(outputPath = "docs/legal") {
    "",
    `Generated: ${new Date().toISOString()}`,
    "Source: ExaMetra Prisma schema (Module L)",
-  );
+  ];
  const filePath = path.join(outputPath, "DATA_MODEL.md");
  fs.writeFileSync(filePath, lines.join("\n"), "utf-8");
@@ -3,15 +3,26 @@
 * Plain-language German, based on school configuration
 */
-import fs from "node:fs";
+const fs = require("fs");
-import path from "node:path";
+const path = require("path");
-function generatePrivacyNotice(params, outputPath = "docs/legal") {
+interface PrivacyNoticeParams {
  schoolName: string;
  dpoName: string;
  dpoEmail: string;
  schultragerName: string;
  bundesland: string;
 }
 export function generatePrivacyNotice(
  params: PrivacyNoticeParams,
  outputPath: string = "docs/legal"
 ): void {
  if (!fs.existsSync(outputPath)) {
    fs.mkdirSync(outputPath, { recursive: true });
  }
-  const lines = [
+  const lines: string[] = [
    "# Datenschutzerklärung",
    "# (Privacy Notice for Parents & Students)",
    "",
@@ -128,7 +139,7 @@ function generatePrivacyNotice(params, outputPath = "docs/legal") {
  console.log(`[v0] Generated privacy notice at ${filePath}`);
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === new URL(import.meta.url).pathname) {
+if (require.main === module) {
  generatePrivacyNotice({
    schoolName: "Gymnasium Berlin",
    dpoName: "Max Mustermann",
@@ -4,10 +4,20 @@
 * German legal document for school's DPO review
 */
-import fs from "node:fs";
+const fs = require("fs");
-import path from "node:path";
+const path = require("path");
-const ropas = [
+interface RopaEntry {
  name: string;
  purposes: string[];
  dataCategories: string[];
  recipients: string[];
  retentionPeriod: string;
  legalBasis: string;
  securityMeasures: string[];
 }
 const ropas: RopaEntry[] = [
  {
    name: "Student Information Management",
    purposes: [
@@ -116,12 +126,12 @@ const ropas = [
  },
 ];
-function generateRopa(outputPath = "docs/legal") {
+export function generateRopa(outputPath: string = "docs/legal"): void {
  if (!fs.existsSync(outputPath)) {
    fs.mkdirSync(outputPath, { recursive: true });
  }
-  const lines = [
+  const lines: string[] = [
    "# Verzeichnis von Verarbeitungstätigkeiten",
    "# (Records of Processing Activities - Art. 30 GDPR)",
    "",
@@ -188,7 +198,7 @@ function generateRopa(outputPath = "docs/legal") {
    "",
    `**Generiert**: ${new Date().toISOString()}`,
    "**Quelle**: ExaMetra Module L - Compliance Framework",
-  );
+  ];
  const filePath = path.join(
    outputPath,
@@ -6,11 +6,18 @@
 * Usage: npx ts-node scripts/run-retention-job.ts
 */
-import { PrismaClient } from "@prisma/client";
+const { PrismaClient } = require("@prisma/client");
 import path from "node:path";
 const prisma = new PrismaClient();
 interface FlaggedRecord {
  entityType: string;
  entityId: string;
  dataCategory: string;
  flaggedAt: Date;
  reason: string;
 }
 /**
 * Check records for each school and flag those exceeding retention period
 */
@@ -25,7 +32,7 @@ async function runRetentionJob() {
    });
    let totalFlagged = 0;
-    const report = [];
+    const report: { school: string; flagged: number }[] = [];
    for (const school of schools) {
      const schoolFlagged = await flagExpiredRecordsForSchool(school.id);
@@ -68,7 +75,7 @@ async function runRetentionJob() {
 /**
 * Flag expired records for a specific school
 */
-async function flagExpiredRecordsForSchool(schoolId) {
+async function flagExpiredRecordsForSchool(schoolId: string): Promise<number> {
  // Get all retention policies for this school
  const policies = await prisma.dataRetentionPolicy.findMany({
    where: { schoolId },
@@ -99,7 +106,11 @@ async function flagExpiredRecordsForSchool(schoolId) {
 /**
 * Flag records of a specific category that are older than expiryDate
 */
-async function flagRecordsByCategory(schoolId, dataCategory, expiryDate) {
+async function flagRecordsByCategory(
  schoolId: string,
  dataCategory: string,
  expiryDate: Date
 ): Promise<number> {
  let flaggedCount = 0;
  try {
@@ -190,7 +201,11 @@ async function flagRecordsByCategory(schoolId, dataCategory, expiryDate) {
 /**
 * Generic function to flag expired records by entity type
 */
-async function flagRecordsByEntityType(schoolId, entityType, expiryDate) {
+async function flagRecordsByEntityType(
  schoolId: string,
  entityType: string,
  expiryDate: Date
 ): Promise<number> {
  // Check if records of this type already have deletion flags
  const alreadyFlagged = await prisma.deletionFlag.findMany({
    where: {
@@ -240,7 +255,7 @@ async function flagRecordsByEntityType(schoolId, entityType, expiryDate) {
 }
 // Run the job if this script is executed directly
-if (process.argv[1] && path.resolve(process.argv[1]) === new URL(import.meta.url).pathname) {
+if (require.main === module) {
  runRetentionJob()
    .then((result) => {
      console.log(
@@ -255,4 +270,4 @@ if (process.argv[1] && path.resolve(process.argv[1]) === new URL(import.meta.url
    });
 }
-export { runRetentionJob, flagExpiredRecordsForSchool };
+module.exports = { runRetentionJob, flagExpiredRecordsForSchool };
@@ -1,32 +0,0 @@
 import { access, mkdir, stat } from 'node:fs/promises';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 const databaseUrl = process.env.DATABASE_URL;
 if (!databaseUrl?.startsWith('file:')) {
  throw new Error('DATABASE_URL must use a SQLite file: URL');
 }
 const source = path.resolve(databaseUrl.slice('file:'.length));
 const backupDirectory = path.resolve(process.env.BACKUP_PATH || path.join(process.cwd(), 'data', 'backups'));
 const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
 const destination = path.join(backupDirectory, `schulos-sqlite-${timestamp}.db`);
 await access(source);
 await mkdir(backupDirectory, { recursive: true });
 const result = spawnSync('sqlite3', [source, `.backup '${destination.replaceAll("'", "''")}'`], {
  encoding: 'utf8',
 });
 if (result.error || result.status !== 0) {
  throw result.error ?? new Error(result.stderr || 'SQLite online backup failed');
 }
 const integrity = spawnSync('sqlite3', [destination, 'PRAGMA integrity_check;'], { encoding: 'utf8' });
 if (integrity.error || integrity.status !== 0 || integrity.stdout.trim() !== 'ok') {
  throw integrity.error ?? new Error(`Backup integrity check failed: ${integrity.stdout || integrity.stderr}`);
 }
 const backupStat = await stat(destination);
 console.log(JSON.stringify({ backup: destination, bytes: backupStat.size, integrity: 'ok' }));
@@ -1,23 +0,0 @@
 import { access, mkdir } from 'node:fs/promises';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 const databaseUrl = process.env.DATABASE_URL;
 if (!databaseUrl?.startsWith('file:')) {
  throw new Error('DATABASE_URL must use a SQLite file: URL');
 }
 const databasePath = path.resolve(databaseUrl.slice('file:'.length));
 await mkdir(path.dirname(databasePath), { recursive: true });
 const result = spawnSync('sqlite3', [databasePath, 'PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL; PRAGMA foreign_keys=ON; PRAGMA wal_checkpoint(TRUNCATE);'], {
  encoding: 'utf8',
 });
 if (result.error || result.status !== 0) {
  throw result.error ?? new Error(result.stderr || 'Unable to configure SQLite WAL mode');
 }
 await access(databasePath);
 console.log(`SQLite WAL configured: ${databasePath}`);
@@ -1,747 +0,0 @@
 import { db } from './src/lib/db'
 const CLASSES = ['Class 1', 'Class 2', 'Class 3', 'Class 4', 'Class 5', 'Class 6', 'Class 7', 'Class 8', 'Class 9', 'Class 10']
 const SECTIONS = ['A', 'B', 'C']
 const SUBJECTS = [
  { name: 'Mathematics', code: 'MATH' },
  { name: 'English', code: 'ENG' },
  { name: 'Science', code: 'SCI' },
  { name: 'Social Studies', code: 'SOC' },
  { name: 'Physics', code: 'PHY' },
  { name: 'Chemistry', code: 'CHE' },
  { name: 'Biology', code: 'BIO' },
  { name: 'Computer Science', code: 'CS' },
  { name: 'History', code: 'HIS' },
  { name: 'Geography', code: 'GEO' },
  { name: 'Turkish', code: 'TUR' },
  { name: 'Art', code: 'ART' },
 ]
 const FIRST_NAMES_M = ['Ahmet', 'Mehmet', 'Mustafa', 'Ali', 'Hüseyin', 'İbrahim', 'Hasan', 'Osman', 'Yusuf', 'Murat', 'Emre', 'Burak', 'Cem', 'Deniz', 'Eren', 'Fatih', 'Gökhan', 'Kerem', 'Onur', 'Serkan']
 const FIRST_NAMES_F = ['Ayşe', 'Fatma', 'Emine', 'Hatice', 'Zeynep', 'Elif', 'Meryem', 'Şeyma', 'Sultan', 'Hanife', 'Dilara', 'Ece', 'Buse', 'Ceren', 'Deniz', 'Esra', 'Gül', 'İrem', 'Merve', 'Selin']
 const LAST_NAMES = ['Yılmaz', 'Kaya', 'Demir', 'Şahin', 'Çelik', 'Yıldız', 'Yıldırım', 'Öztürk', 'Aydın', 'Özdemir', 'Arslan', 'Doğan', 'Kılıç', 'Aslan', 'Çetin', 'Kara', 'Koç', 'Kurt', 'Özkan', 'Şimşek']
 const DEPARTMENTS = ['Mathematics', 'Science', 'Languages', 'Social Studies', 'Computer Science', 'Physical Education', 'Arts', 'Administration']
 const DESIGNATIONS = ['Principal', 'Vice Principal', 'Senior Teacher', 'Teacher', 'Assistant Teacher', 'Librarian', 'Accountant', 'Clerk', 'Driver', 'Security']
 function randomItem<T>(arr: T[]): T { return arr[Math.floor(Math.random() * arr.length)] }
 function randomItems<T>(arr: T[], n: number): T[] {
  const shuffled = [...arr].sort(() => Math.random() - 0.5)
  return shuffled.slice(0, n)
 }
 function randomInt(min: number, max: number) { return Math.floor(Math.random() * (max - min + 1)) + min }
 function randomFloat(min: number, max: number) { return Math.round((Math.random() * (max - min) + min) * 100) / 100 }
 async function seed() {
  console.log('🌱 Seeding database...')
  // Settings
  const settings = [
    { id: 'school_name', value: 'Atatürk Anatolian High School' },
    { id: 'school_address', value: 'Cumhuriyet Cad. No:42, Kadıköy, İstanbul' },
    { id: 'school_phone', value: '+90 216 555 0042' },
    { id: 'school_email', value: 'info@ataturk-anadolu.edu.tr' },
    { id: 'school_logo', value: '' },
    { id: 'academic_year', value: '2024-2025' },
    { id: 'currency', value: '₺' },
    { id: 'language', value: 'en' },
  ]
  for (const s of settings) {
    await db.setting.upsert({ where: { id: s.id }, update: { value: s.value }, create: s })
  }
  // Departments & Designations
  for (const d of DEPARTMENTS) {
    await db.department.create({ data: { name: d } })
  }
  for (const d of DESIGNATIONS) {
    await db.designation.create({ data: { name: d } })
  }
  // Users
  const adminUser = await db.user.create({
    data: { email: 'admin@school.edu.tr', name: 'System Administrator', role: 'ADMIN', phone: '+90 555 000 0001' },
  })
  // Classrooms
  const classRooms = []
  for (const c of CLASSES) {
    const room = await db.classRoom.create({
      data: { name: c, numericName: c.replace('Class ', ''), capacity: 40, roomNo: `R-${randomInt(100, 350)}` },
    })
    classRooms.push(room)
  }
  // Sections
  for (const cls of classRooms) {
    for (const sec of SECTIONS) {
      await db.section.create({ data: { name: sec, classId: cls.id, capacity: 35 } })
    }
  }
  // Subjects
  const subjects = []
  for (const s of SUBJECTS) {
    const sub = await db.subject.create({
      data: { name: s.name, code: s.code, type: randomItem(['CORE', 'OPTIONAL']) },
    })
    subjects.push(sub)
  }
  // Staff / Teachers
  const teachers = []
  const teacherRoles = ['TEACHER', 'ACCOUNTANT', 'LIBRARIAN']
  for (let i = 0; i < 28; i++) {
    const gender = Math.random() > 0.4 ? 'Male' : 'Female'
    const first = gender === 'Male' ? randomItem(FIRST_NAMES_M) : randomItem(FIRST_NAMES_F)
    const last = randomItem(LAST_NAMES)
    const dept = randomItem(DEPARTMENTS)
    const desig = i === 0 ? 'Principal' : i < 3 ? 'Vice Principal' : randomItem(['Senior Teacher', 'Teacher', 'Assistant Teacher'])
    const staff = await db.staff.create({
      data: {
        staffId: `TCH-${String(1001 + i)}`,
        firstName: first,
        lastName: last,
        gender,
        phone: `+90 555 ${randomInt(100, 999)} ${randomInt(10, 99)} ${randomInt(10, 99)}`,
        email: `${first.toLowerCase()}.${last.toLowerCase()}.${i}@school.edu.tr`,
        department: dept,
        designation: desig,
        category: 'Teaching',
        qualification: randomItem(['B.Ed', 'M.Sc', 'M.A', 'Ph.D', 'B.Sc']),
        experience: `${randomInt(1, 25)} years`,
        salary: randomFloat(25000, 75000),
        bloodGroup: randomItem(['A+', 'B+', 'O+', 'AB+', 'A-', 'O-']),
        joiningDate: new Date(2018 + randomInt(0, 6), randomInt(0, 11), randomInt(1, 28)),
        address: `${randomInt(1, 200)} ${randomItem(['Atatürk', 'İnönü', 'Cumhuriyet', 'Gül', 'Lale'])} St, İstanbul`,
        city: 'İstanbul',
      },
    })
    teachers.push(staff)
    // Create user for teacher
    await db.user.create({
      data: {
        email: staff.email || `${first.toLowerCase()}.${last.toLowerCase()}.${i}@school.edu.tr`,
        name: `${first} ${last}`,
        role: randomItem(teacherRoles),
        phone: staff.phone,
      },
    })
  }
  // Assign class teachers
  for (let i = 0; i < classRooms.length; i++) {
    await db.classRoom.update({ where: { id: classRooms[i].id }, data: { classTeacherId: teachers[i % teachers.length].id } })
  }
  // Assign subjects to teachers
  for (const sub of subjects) {
    const t = randomItem(teachers)
    await db.subject.update({ where: { id: sub.id }, data: { teacherId: t.id } })
  }
  // Students
  const students = []
  const firstNamesAll = [...FIRST_NAMES_M, ...FIRST_NAMES_F]
  for (let i = 0; i < 220; i++) {
    const gender = Math.random() > 0.5 ? 'Male' : 'Female'
    const first = gender === 'Male' ? randomItem(FIRST_NAMES_M) : randomItem(FIRST_NAMES_F)
    const last = randomItem(LAST_NAMES)
    const cls = randomItem(classRooms)
    const sec = randomItem(SECTIONS)
    const father = `${randomItem(FIRST_NAMES_M)} ${last}`
    const mother = `${randomItem(FIRST_NAMES_F)} ${last}`
    const studEmail = `${first.toLowerCase()}.${last.toLowerCase()}${i}@student.edu.tr`
    const guardianEmail = `guardian.${last.toLowerCase()}.${i}@gmail.com`
    const stud = await db.student.create({
      data: {
        admissionNo: `STU-${String(20240001 + i)}`,
        firstName: first,
        lastName: last,
        gender,
        dob: new Date(2006 + randomInt(0, 8), randomInt(0, 11), randomInt(1, 28)),
        bloodGroup: randomItem(['A+', 'B+', 'O+', 'AB+', 'A-', 'O-']),
        phone: `+90 555 ${randomInt(100, 999)} ${randomInt(10, 99)} ${randomInt(10, 99)}`,
        email: studEmail,
        address: `${randomInt(1, 200)} ${randomItem(['Atatürk', 'İnönü', 'Cumhuriyet'])} St, İstanbul`,
        city: 'İstanbul',
        state: 'İstanbul',
        country: 'Turkey',
        category: randomItem(['General', 'OBC', 'SC', 'ST']),
        className: `${cls.name} - ${sec}`,
        classId: cls.id,
        section: sec,
        rollNo: String(randomInt(1, 40)),
        fatherName: father,
        motherName: mother,
        guardianName: father,
        guardianPhone: `+90 532 ${randomInt(100, 999)} ${randomInt(10, 99)} ${randomInt(10, 99)}`,
        guardianEmail,
        guardianOccupation: randomItem(['Engineer', 'Doctor', 'Teacher', 'Business', 'Government', 'Retired']),
        house: randomItem(['Red', 'Blue', 'Green', 'Yellow']),
        height: `${randomInt(140, 185)} cm`,
        weight: `${randomInt(35, 80)} kg`,
        status: Math.random() > 0.95 ? 'DISABLED' : 'ACTIVE',
        admissionDate: new Date(2022 + randomInt(0, 3), randomInt(0, 11), randomInt(1, 28)),
      },
    })
    students.push(stud)
    // Parent user
    await db.user.create({
      data: {
        email: guardianEmail,
        name: father,
        role: 'PARENT',
        phone: stud.guardianPhone,
      },
    })
  }
  // Attendance for last 30 days for first 50 students
  const today = new Date()
  for (let d = 0; d < 30; d++) {
    const date = new Date(today)
    date.setDate(today.getDate() - d)
    if (date.getDay() === 0 || date.getDay() === 6) continue
    const sampleStudents = randomItems(students, 60)
    for (const st of sampleStudents) {
      const r = Math.random()
      const status = r > 0.85 ? 'ABSENT' : r > 0.78 ? 'LATE' : 'PRESENT'
      await db.attendance.create({
        data: {
          studentId: st.id,
          date,
          status,
          classId: st.classId,
        },
      })
    }
  }
  // Staff attendance for last 30 days
  for (let d = 0; d < 30; d++) {
    const date = new Date(today)
    date.setDate(today.getDate() - d)
    if (date.getDay() === 0 || date.getDay() === 6) continue
    for (const t of teachers) {
      const r = Math.random()
      const status = r > 0.95 ? 'ABSENT' : r > 0.9 ? 'LEAVE' : 'PRESENT'
      await db.staffAttendance.create({
        data: {
          staffId: t.id,
          date,
          status,
          inTime: status === 'PRESENT' ? '08:45' : undefined,
          outTime: status === 'PRESENT' ? '16:30' : undefined,
        },
      })
    }
  }
  // Class routines
  const days = ['Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday']
  const timeSlots = [
    { start: '09:00', end: '09:45' },
    { start: '09:50', end: '10:35' },
    { start: '10:50', end: '11:35' },
    { start: '11:40', end: '12:25' },
    { start: '13:15', end: '14:00' },
    { start: '14:05', end: '14:50' },
    { start: '14:55', end: '15:40' },
  ]
  for (const cls of classRooms.slice(0, 5)) {
    for (const day of days) {
      for (let s = 0; s < timeSlots.length; s++) {
        const sub = randomItem(subjects)
        await db.classRoutine.create({
          data: {
            classId: cls.id,
            day,
            startTime: timeSlots[s].start,
            endTime: timeSlots[s].end,
            subjectId: sub.id,
            teacherId: randomItem(teachers).id,
            roomNo: cls.roomNo,
          },
        })
      }
    }
  }
  // Exams
  const examTypes = ['FIRST_TERM', 'SECOND_TERM', 'FINAL', 'MID_TERM', 'QUIZ']
  for (let i = 0; i < 5; i++) {
    await db.exam.create({
      data: {
        name: `${examTypes[i]} Exam 2024-2025`,
        type: examTypes[i],
        startDate: new Date(2024, 8 + i, 15),
        endDate: new Date(2024, 8 + i, 25),
        description: `${examTypes[i].replace('_', ' ')} examination for all classes`,
      },
    })
  }
  const exams = await db.exam.findMany()
  // Marks for first exam (first 80 students)
  const firstExam = exams[0]
  for (const st of students.slice(0, 80)) {
    for (const sub of randomItems(subjects, 5)) {
      await db.mark.create({
        data: {
          examId: firstExam.id,
          studentId: st.id,
          subjectId: sub.id,
          classId: st.classId || '',
          marksObtained: randomFloat(40, 98),
          totalMarks: 100,
          grade: randomItem(['A+', 'A', 'B+', 'B', 'C']),
        },
      })
    }
  }
  // Fee groups and types
  const feeGroups = ['Tuition Fees', 'Transport Fees', 'Hostel Fees', 'Examination Fees', 'Library Fees']
  const feeGroupIds = []
  for (const g of feeGroups) {
    const fg = await db.feeGroup.create({ data: { name: g, description: `${g} for academic year` } })
    feeGroupIds.push(fg)
  }
  const feeTypes = [
    { name: 'Tuition Fee', code: 'TF', amount: 15000, frequency: 'QUARTERLY' },
    { name: 'Bus Fee', code: 'BF', amount: 3500, frequency: 'MONTHLY' },
    { name: 'Hostel Fee', code: 'HF', amount: 25000, frequency: 'QUARTERLY' },
    { name: 'Exam Fee', code: 'EF', amount: 2000, frequency: 'ONETIME' },
    { name: 'Library Fee', code: 'LF', amount: 500, frequency: 'YEARLY' },
    { name: 'Lab Fee', code: 'LABF', amount: 1500, frequency: 'YEARLY' },
    { name: 'Sports Fee', code: 'SF', amount: 800, frequency: 'YEARLY' },
    { name: 'Admission Fee', code: 'AF', amount: 5000, frequency: 'ONETIME' },
  ]
  for (const ft of feeTypes) {
    await db.feeType.create({
      data: { ...ft, groupId: randomItem(feeGroupIds).id },
    })
  }
  // Invoices
  const invoiceStatuses = ['PAID', 'UNPAID', 'PARTIAL', 'OVERDUE']
  let invCounter = 0
  for (const st of students) {
    // Create 2-3 invoices per student
    for (let i = 0; i < randomInt(2, 3); i++) {
      invCounter++
      const ft = randomItem(feeTypes)
      const status = randomItem(invoiceStatuses)
      const amount = ft.amount
      const paidAmount = status === 'PAID' ? amount : status === 'PARTIAL' ? amount * 0.5 : 0
      const dueDate = new Date(today)
      dueDate.setDate(today.getDate() + randomInt(-30, 60))
      await db.invoice.create({
        data: {
          invoiceNo: `INV-${String(20240001 + invCounter)}`,
          studentId: st.id,
          classId: st.classId,
          feeType: ft.name,
          amount,
          paidAmount,
          discount: Math.random() > 0.8 ? amount * 0.1 : 0,
          status,
          dueDate,
          paymentMethod: status === 'PAID' ? randomItem(['CASH', 'BANK', 'ONLINE']) : null,
        },
      })
    }
  }
  // Accounts
  const accounts = [
    { name: 'Main Bank Account', type: 'BANK', balance: 450000, bankName: 'İş Bankası', accountNo: 'TR1234567890' },
    { name: 'Cash Account', type: 'CASH', balance: 25000 },
    { name: 'Salary Account', type: 'BANK', balance: 180000, bankName: 'Ziraat Bank', accountNo: 'TR9876543210' },
  ]
  for (const a of accounts) {
    await db.account.create({ data: a })
  }
  // Transactions
  for (let i = 0; i < 40; i++) {
    const isIncome = Math.random() > 0.5
    await db.transaction.create({
      data: {
        type: isIncome ? 'INCOME' : 'EXPENSE',
        category: isIncome ? randomItem(['Fees Collection', 'Donation', 'Grant', 'Other Income']) : randomItem(['Salary', 'Utility Bill', 'Maintenance', 'Office Supplies', 'Transport Fuel']),
        amount: randomFloat(500, 50000),
        method: randomItem(['CASH', 'BANK', 'ONLINE']),
        date: new Date(today.getTime() - randomInt(0, 60) * 86400000),
        description: `Transaction #${i + 1}`,
      },
    })
  }
  // Payroll for current month
  const currentMonth = `${today.getFullYear()}-${String(today.getMonth() + 1).padStart(2, '0')}`
  for (const t of teachers) {
    const basic = t.salary || 30000
    const allowance = basic * 0.2
    const deduction = basic * 0.1
    const bonus = Math.random() > 0.7 ? 2000 : 0
    await db.payroll.create({
      data: {
        staffId: t.id,
        month: currentMonth,
        basicSalary: basic,
        allowance,
        deduction,
        bonus,
        netSalary: basic + allowance + bonus - deduction,
        status: Math.random() > 0.5 ? 'PAID' : 'PENDING',
        paidDate: Math.random() > 0.5 ? new Date(today.getTime() - randomInt(0, 15) * 86400000) : null,
      },
    })
  }
  // Books
  const bookTitles = ['Physics for All', 'Modern Mathematics', 'World History', 'English Grammar', 'Biology Today', 'Chemistry Basics', 'Computer Programming', 'Geography Atlas', 'Turkish Literature', 'Art and Culture', 'Calculus Made Easy', 'Organic Chemistry', 'Data Structures', 'World Wars', 'Environmental Science', 'Algebra and Geometry', 'Shakespeare Collection', 'Modern Physics', 'Astrology', 'Microeconomics']
  const authors = ['John Smith', 'Mary Johnson', 'David Brown', 'Sarah Williams', 'James Davis', 'Linda Miller', 'Robert Wilson', 'Jennifer Moore', 'Michael Taylor', 'Patricia Anderson']
  for (let i = 0; i < 80; i++) {
    const title = randomItem(bookTitles)
    await db.book.create({
      data: {
        bookNo: `BK-${String(10001 + i)}`,
        title: `${title} - Vol ${randomInt(1, 5)}`,
        author: randomItem(authors),
        category: randomItem(['Fiction', 'Non-Fiction', 'Science', 'History', 'Biography', 'Reference', 'Children']),
        publisher: randomItem(['Pearson', 'Oxford', 'McGraw Hill', 'Penguin', 'Cambridge']),
        edition: `${randomInt(1, 8)}th Edition`,
        isbn: `978-${randomInt(1000000000, 9999999999)}`,
        price: randomFloat(50, 500),
        totalCopies: randomInt(2, 8),
        availableCopies: randomInt(0, 5),
        rackNo: `Rack-${String.fromCharCode(65 + randomInt(0, 9))}-${randomInt(1, 20)}`,
      },
    })
  }
  const books = await db.book.findMany()
  // Book issues
  for (let i = 0; i < 30; i++) {
    const student = randomItem(students)
    const book = randomItem(books)
    const issueDate = new Date(today.getTime() - randomInt(0, 30) * 86400000)
    const dueDate = new Date(issueDate.getTime() + 14 * 86400000)
    const returned = Math.random() > 0.5
    await db.bookIssue.create({
      data: {
        bookId: book.id,
        memberId: student.id,
        memberType: 'STUDENT',
        issueDate,
        dueDate,
        returnDate: returned ? new Date(dueDate.getTime() - randomInt(0, 3) * 86400000) : null,
        status: returned ? 'RETURNED' : dueDate < today ? 'OVERDUE' : 'ISSUED',
        fine: dueDate < today && !returned ? randomFloat(5, 30) : 0,
      },
    })
  }
  // Notices
  const noticeData = [
    { title: 'Annual Sports Day', content: 'Annual Sports Day will be held on 15th of next month. All students are requested to participate.', category: 'EVENT', audience: 'ALL' },
    { title: 'Half-Yearly Exam Schedule', content: 'Half-yearly examination schedule has been published. Please check the examination module.', category: 'EXAM', audience: 'STUDENTS' },
    { title: 'Holiday - Republic Day', content: 'School will remain closed on October 29th for Republic Day celebration.', category: 'HOLIDAY', audience: 'ALL' },
    { title: 'Parent-Teacher Meeting', content: 'PTM scheduled for this Saturday from 9 AM to 1 PM. Parents are requested to attend.', category: 'GENERAL', audience: 'PARENTS' },
    { title: 'Library Books Return Reminder', content: 'All students with overdue books are requested to return them by end of this week.', category: 'URGENT', audience: 'STUDENTS' },
    { title: 'Staff Meeting', content: 'Monthly staff meeting on Friday at 3 PM in the conference hall.', category: 'GENERAL', audience: 'STAFF' },
    { title: 'New Admission Open', content: 'Admissions open for academic year 2025-2026. Apply before January 31st.', category: 'GENERAL', audience: 'ALL' },
    { title: 'Diwali Vacation', content: 'School will remain closed from Nov 10 to Nov 15 for Diwali.', category: 'HOLIDAY', audience: 'ALL' },
  ]
  for (const n of noticeData) {
    await db.notice.create({
      data: {
        ...n,
        publishDate: new Date(today.getTime() - randomInt(0, 15) * 86400000),
        expiryDate: new Date(today.getTime() + randomInt(5, 60) * 86400000),
      },
    })
  }
  // Events
  const events = [
    { title: 'Annual Day Function', startDate: new Date(today.getFullYear(), today.getMonth() + 1, 20), endDate: new Date(today.getFullYear(), today.getMonth() + 1, 20), location: 'School Auditorium', type: 'EVENT' },
    { title: 'Science Exhibition', startDate: new Date(today.getFullYear(), today.getMonth(), today.getDate() + 10), location: 'Science Block', type: 'EVENT' },
    { title: 'Inter-School Quiz Competition', startDate: new Date(today.getFullYear(), today.getMonth(), today.getDate() + 5), location: 'Conference Hall', type: 'EVENT' },
    { title: 'Republic Day Holiday', startDate: new Date(today.getFullYear(), 9, 29), type: 'HOLIDAY' },
    { title: 'Mid-term Break', startDate: new Date(today.getFullYear(), today.getMonth() + 1, 1), endDate: new Date(today.getFullYear(), today.getMonth() + 1, 3), type: 'HOLIDAY' },
  ]
  for (const e of events) {
    await db.event.create({ data: e })
  }
  // Homework
  for (let i = 0; i < 25; i++) {
    const cls = randomItem(classRooms)
    const sub = randomItem(subjects)
    await db.homework.create({
      data: {
        title: `${sub.name} - Chapter ${randomInt(1, 10)} Exercises`,
        description: `Complete exercises from chapter ${randomInt(1, 10)}. Submit by due date.`,
        classId: cls.id,
        subjectId: sub.id,
        teacherId: randomItem(teachers).id,
        dueDate: new Date(today.getTime() + randomInt(1, 14) * 86400000),
        status: randomItem(['ASSIGNED', 'SUBMITTED', 'EVALUATED']),
      },
    })
  }
  // Lesson plans
  for (let i = 0; i < 15; i++) {
    const cls = randomItem(classRooms)
    const sub = randomItem(subjects)
    await db.lessonPlan.create({
      data: {
        title: `${sub.name} - Lesson ${i + 1}`,
        classId: cls.id,
        subjectId: sub.id,
        topic: `${sub.name} Chapter ${randomInt(1, 8)}`,
        overview: 'Comprehensive lesson plan covering fundamental concepts with practical examples.',
        objectives: 'Students will understand core concepts and apply them to solve problems.',
        activities: 'Group discussion, problem solving, presentation',
        resources: 'Textbook, worksheets, multimedia content',
        duration: `${randomInt(2, 5)} periods`,
        status: randomItem(['DRAFT', 'PUBLISHED']),
      },
    })
  }
  // Study materials
  const materialTypes = [
    { type: 'PDF', fileName: 'lecture_notes.pdf', fileType: 'application/pdf' },
    { type: 'VIDEO', fileName: 'tutorial_video.mp4', fileType: 'video/mp4' },
    { type: 'IMAGE', fileName: 'diagram.png', fileType: 'image/png' },
    { type: 'DOC', fileName: 'worksheet.docx', fileType: 'application/docx' },
  ]
  for (let i = 0; i < 20; i++) {
    const m = randomItem(materialTypes)
    await db.studyMaterial.create({
      data: {
        title: `${randomItem(subjects).name} - ${m.type} Material ${i + 1}`,
        type: m.type,
        classId: randomItem(classRooms).id,
        subjectId: randomItem(subjects).id,
        teacherId: randomItem(teachers).id,
        fileName: m.fileName,
        fileType: m.fileType,
        fileSize: `${randomFloat(0.5, 25)} MB`,
        description: 'Study material for student reference',
      },
    })
  }
  // Vehicles & Routes
  const vehicles = [
    { vehicleNo: '34 ABC 001', type: 'BUS', capacity: 45, driverName: 'Mustafa Arslan', driverPhone: '+90 555 111 2233' },
    { vehicleNo: '34 DEF 002', type: 'BUS', capacity: 40, driverName: 'Hasan Yıldız', driverPhone: '+90 555 222 3344' },
    { vehicleNo: '34 GHI 003', type: 'BUS', capacity: 50, driverName: 'Ali Demir', driverPhone: '+90 555 333 4455' },
    { vehicleNo: '34 JKL 004', type: 'VAN', capacity: 18, driverName: 'Osman Kaya', driverPhone: '+90 555 444 5566' },
    { vehicleNo: '34 MNO 005', type: 'BUS', capacity: 45, driverName: 'Yusuf Şahin', driverPhone: '+90 555 555 6677' },
  ]
  const vehicleIds = []
  for (const v of vehicles) {
    const veh = await db.vehicle.create({ data: v })
    vehicleIds.push(veh)
  }
  const routeData = [
    { name: 'Route A - North', startPoint: 'Kadıköy', endPoint: 'School', distance: 12, fare: 800 },
    { name: 'Route B - South', startPoint: 'Bostancı', endPoint: 'School', distance: 8, fare: 600 },
    { name: 'Route C - East', startPoint: 'Üsküdar', endPoint: 'School', distance: 15, fare: 900 },
    { name: 'Route D - West', startPoint: 'Bakırköy', endPoint: 'School', distance: 18, fare: 1000 },
    { name: 'Route E - Central', startPoint: 'Şişli', endPoint: 'School', distance: 10, fare: 700 },
  ]
  const routeIds = []
  for (const r of routeData) {
    const route = await db.route.create({ data: { ...r, vehicleId: randomItem(vehicleIds).id } })
    routeIds.push(route)
  }
  // Transport assignments for some students
  for (const st of randomItems(students, 80)) {
    const route = randomItem(routeIds)
    await db.transportAssignment.create({
      data: {
        studentId: st.id,
        routeId: route.id,
        vehicleId: route.vehicleId,
        pickupPoint: `${route.startPoint} Stop ${randomInt(1, 5)}`,
      },
    })
  }
  // Dormitory
  const dorms = [
    { name: 'Boys Hostel - Block A', type: 'BOYS', wardenName: 'Murat Yılmaz', wardenPhone: '+90 555 666 7788', capacity: 60 },
    { name: 'Girls Hostel - Block B', type: 'GIRLS', wardenName: 'Ayşe Kara', wardenPhone: '+90 555 777 8899', capacity: 60 },
  ]
  for (const d of dorms) {
    const dorm = await db.dormitory.create({ data: d })
    for (let r = 1; r <= 30; r++) {
      await db.dormitoryRoom.create({
        data: {
          dormitoryId: dorm.id,
          roomNo: `${dorm.name.charAt(0)}-${String(r).padStart(3, '0')}`,
          roomType: randomItem(['SINGLE', 'SHARED']),
          capacity: randomItem([1, 2, 3]),
          occupied: randomInt(0, 2),
          fee: randomFloat(5000, 8000),
        },
      })
    }
  }
  // Assign some students to dorm rooms
  const dormRooms = await db.dormitoryRoom.findMany()
  for (const st of randomItems(students, 40)) {
    const room = randomItem(dormRooms)
    await db.student.update({ where: { id: st.id }, data: { dormitoryRoomId: room.id } })
  }
  // Leaves
  for (let i = 0; i < 12; i++) {
    const isStaff = Math.random() > 0.5
    await db.leave.create({
      data: {
        applicantId: isStaff ? randomItem(teachers).id : randomItem(students).id,
        applicantType: isStaff ? 'STAFF' : 'STUDENT',
        leaveType: randomItem(['CASUAL', 'SICK', 'EARNED', 'OTHER']),
        startDate: new Date(today.getTime() - randomInt(0, 30) * 86400000),
        endDate: new Date(today.getTime() + randomInt(0, 5) * 86400000),
        reason: randomItem(['Personal work', 'Medical reasons', 'Family function', 'Fever', 'Out of station']),
        status: randomItem(['PENDING', 'APPROVED', 'REJECTED']),
      },
    })
  }
  // Inventory
  const items = [
    { name: 'Chalk Box', category: 'Stationery', unit: 'BOX', quantity: 250, minStock: 50, price: 25 },
    { name: 'Whiteboard Marker', category: 'Stationery', unit: 'PCS', quantity: 180, minStock: 30, price: 15 },
    { name: 'A4 Paper Ream', category: 'Stationery', unit: 'REAM', quantity: 85, minStock: 20, price: 120 },
    { name: 'Desk', category: 'Furniture', unit: 'PCS', quantity: 320, minStock: 20, price: 850 },
    { name: 'Chair', category: 'Furniture', unit: 'PCS', quantity: 640, minStock: 50, price: 250 },
    { name: 'Projector', category: 'Electronics', unit: 'PCS', quantity: 12, minStock: 2, price: 8500 },
    { name: 'Computer', category: 'Electronics', unit: 'PCS', quantity: 45, minStock: 5, price: 15000 },
    { name: 'Printer Ink', category: 'Consumables', unit: 'PCS', quantity: 28, minStock: 10, price: 350 },
    { name: 'First Aid Kit', category: 'Medical', unit: 'PCS', quantity: 8, minStock: 3, price: 500 },
    { name: 'Cricket Bat', category: 'Sports', unit: 'PCS', quantity: 15, minStock: 5, price: 800 },
    { name: 'Football', category: 'Sports', unit: 'PCS', quantity: 12, minStock: 4, price: 450 },
    { name: 'Lab Equipment Set', category: 'Science', unit: 'SET', quantity: 8, minStock: 2, price: 3500 },
  ]
  for (const it of items) {
    await db.inventoryItem.create({
      data: { ...it, store: randomItem(['Main Store', 'Lab Store', 'Office Store']), supplier: randomItem(['ABC Suppliers', 'XYZ Traders', 'Global Supplies']) },
    })
  }
  // Admission queries
  const queryStatuses = ['NEW', 'FOLLOW_UP', 'CONVERTED', 'LOST']
  for (let i = 0; i < 15; i++) {
    await db.admissionQuery.create({
      data: {
        name: `${randomItem(firstNamesAll)} ${randomItem(LAST_NAMES)}`,
        phone: `+90 555 ${randomInt(100, 999)} ${randomInt(10, 99)} ${randomInt(10, 99)}`,
        email: `query${i}@gmail.com`,
        classApplied: randomItem(CLASSES),
        source: randomItem(['Website', 'Walk-in', 'Referral', 'Newspaper Ad']),
        status: randomItem(queryStatuses),
        followUpDate: new Date(today.getTime() + randomInt(-5, 15) * 86400000),
        notes: randomItem(['Interested in science stream', 'Wants hostel facility', 'Asking about fee structure', 'Needs scholarship info']),
      },
    })
  }
  // Visitors
  for (let i = 0; i < 10; i++) {
    await db.visitor.create({
      data: {
        name: `${randomItem(firstNamesAll)} ${randomItem(LAST_NAMES)}`,
        phone: `+90 555 ${randomInt(100, 999)} ${randomInt(10, 99)} ${randomInt(10, 99)}`,
        purpose: randomItem(['Parent meeting', 'Admission enquiry', 'Document submission', 'Official visit']),
        whomToMeet: randomItem(teachers).email,
        inTime: '10:00',
        outTime: '11:00',
      },
    })
  }
  // Question bank
  const questions = [
    { question: 'What is the capital of Turkey?', options: JSON.stringify(['İstanbul', 'Ankara', 'İzmir', 'Bursa']), answer: 'Ankara', type: 'MCQ', subjectId: subjects[1].id, difficulty: 'EASY' },
    { question: 'Water is composed of which two elements?', options: JSON.stringify(['Oxygen and Carbon', 'Hydrogen and Oxygen', 'Nitrogen and Hydrogen', 'Carbon and Hydrogen']), answer: 'Hydrogen and Oxygen', type: 'MCQ', subjectId: subjects[5].id, difficulty: 'EASY' },
    { question: 'The Earth revolves around the Sun.', options: JSON.stringify(['True', 'False']), answer: 'True', type: 'TRUE_FALSE', subjectId: subjects[1].id, difficulty: 'EASY' },
    { question: '2 + 2 = ?', options: JSON.stringify(['3', '4', '5', '6']), answer: '4', type: 'MCQ', subjectId: subjects[0].id, difficulty: 'EASY' },
    { question: 'Photosynthesis produces ___ and oxygen.', options: JSON.stringify([]), answer: 'glucose', type: 'FILL_BLANK', subjectId: subjects[6].id, difficulty: 'MEDIUM' },
    { question: 'The Great Wall is located in which country?', options: JSON.stringify(['India', 'China', 'Japan', 'Korea']), answer: 'China', type: 'MCQ', subjectId: subjects[3].id, difficulty: 'EASY' },
    { question: 'CPU stands for Central Processing Unit.', options: JSON.stringify(['True', 'False']), answer: 'True', type: 'TRUE_FALSE', subjectId: subjects[7].id, difficulty: 'EASY' },
    { question: 'The chemical symbol for Gold is ___.', options: JSON.stringify([]), answer: 'Au', type: 'FILL_BLANK', subjectId: subjects[5].id, difficulty: 'MEDIUM' },
  ]
  for (const q of questions) {
    await db.questionBank.create({ data: q })
  }
  // Online exams
  for (let i = 0; i < 3; i++) {
    await db.onlineExam.create({
      data: {
        title: `Online Test ${i + 1} - ${randomItem(subjects).name}`,
        classId: randomItem(classRooms).id,
        subjectId: randomItem(subjects).id,
        totalQuestions: 20,
        marksPerQuestion: 1,
        duration: 30,
        startDate: new Date(today.getTime() + i * 86400000),
        endDate: new Date(today.getTime() + (i + 2) * 86400000),
        status: i === 0 ? 'PUBLISHED' : 'DRAFT',
      },
    })
  }
  // Front office logs
  const logs = [
    { type: 'PHONE_CALL', title: 'Parent inquiry about admission', person: 'Mr. Yılmaz', status: 'RESOLVED' },
    { type: 'PHONE_CALL', title: 'Follow-up call to parent', person: 'Mrs. Kaya', status: 'PENDING' },
    { type: 'POSTAL_RECEIVE', title: 'Official letter from education board', person: 'Ministry', status: 'RESOLVED' },
    { type: 'POSTAL_DISPATCH', title: 'Sent results to district office', person: 'District Office', status: 'RESOLVED' },
    { type: 'COMPLAIN', title: 'Water cooler not working in Block B', person: 'Student', status: 'PENDING' },
    { type: 'COMPLAIN', title: 'Lights not working in classroom 105', person: 'Teacher', status: 'RESOLVED' },
  ]
  for (const l of logs) {
    await db.frontLog.create({ data: { ...l, description: l.title, date: new Date(today.getTime() - randomInt(0, 10) * 86400000) } })
  }
  // Roles
  const roles = [
    { name: 'Super Admin', description: 'Full access to all modules', permissions: JSON.stringify(['*']) },
    { name: 'Principal', description: 'Access to all academic and admin modules', permissions: JSON.stringify(['dashboard', 'students', 'staff', 'academics', 'attendance', 'exams', 'reports', 'communication']) },
    { name: 'Teacher', description: 'Access to teaching-related modules', permissions: JSON.stringify(['dashboard', 'students', 'attendance', 'exams', 'homework', 'lesson_plan', 'study_material']) },
    { name: 'Accountant', description: 'Access to fees and accounts modules', permissions: JSON.stringify(['dashboard', 'fees', 'accounts', 'reports']) },
    { name: 'Librarian', description: 'Access to library module', permissions: JSON.stringify(['dashboard', 'library']) },
    { name: 'Parent', description: 'View children info', permissions: JSON.stringify(['dashboard', 'children', 'attendance', 'fees', 'homework']) },
    { name: 'Student', description: 'View own info', permissions: JSON.stringify(['dashboard', 'attendance', 'exams', 'homework', 'study_material', 'library']) },
  ]
  for (const r of roles) {
    await db.role.create({ data: r })
  }
  console.log('✅ Seeding complete!')
  console.log(`  - ${students.length} students`)
  console.log(`  - ${teachers.length} staff`)
  console.log(`  - ${classRooms.length} classes`)
  console.log(`  - ${subjects.length} subjects`)
  console.log(`  - ${books.length} books`)
 }
 seed()
  .catch((e) => {
    console.error(e)
    process.exit(1)
  })
  .finally(async () => {
    await db.$disconnect()
  })
@@ -46,7 +46,7 @@ export default function ComplianceDashboard() {
      <div className="p-8">
        <Card className="border-red-200 bg-red-50">
          <CardContent className="pt-6">
-            <p className="text-red-600">Compliance-Dashboard konnte nicht geladen werden</p>
+            <p className="text-red-600">Failed to load compliance dashboard</p>
          </CardContent>
        </Card>
      </div>
@@ -56,7 +56,7 @@ export default function ComplianceDashboard() {
  return (
    <div className="space-y-8 p-8">
      <div>
-        <h1 className="text-3xl font-bold text-slate-900">Compliance-Monitoring-Dashboard</h1>
+        <h1 className="text-3xl font-bold text-slate-900">Compliance Monitoring Dashboard</h1>
        <p className="text-slate-600 mt-2">
          Track your school&apos;s data protection compliance status and document management
        </p>
@@ -73,7 +73,7 @@ export default function ComplianceDashboard() {
                <AlertCircle className="w-8 h-8 text-yellow-600" />
              )}
              <div>
-                <p className="text-sm text-slate-600">Onboarding-Status</p>
+                <p className="text-sm text-slate-600">Onboarding Status</p>
                <p className="font-semibold text-slate-900">
                  {data.status?.onboardingCompleted ? "Complete" : "Pending"}
                </p>
@@ -87,7 +87,7 @@ export default function ComplianceDashboard() {
            <div className="flex items-center gap-3">
              <FileText className="w-8 h-8 text-blue-600" />
              <div>
-                <p className="text-sm text-slate-600">Datenaufbewahrungsrichtlinien</p>
+                <p className="text-sm text-slate-600">Data Retention Policies</p>
                <p className="font-semibold text-slate-900">
                  {data.policiesConfigured} / {data.policiesReviewed} reviewed
                </p>
@@ -113,7 +113,7 @@ export default function ComplianceDashboard() {
            <div className="flex items-center gap-3">
              <Users className="w-8 h-8 text-orange-600" />
              <div>
-                <p className="text-sm text-slate-600">Beratungen</p>
+                <p className="text-sm text-slate-600">Consultations</p>
                <p className="font-semibold text-slate-900">{data.consultations.length}</p>
              </div>
            </div>
@@ -124,7 +124,7 @@ export default function ComplianceDashboard() {
      {/* Data Retention Policies */}
      <Card>
        <CardHeader>
-          <CardTitle>Aktive Datenaufbewahrungsrichtlinien</CardTitle>
+          <CardTitle>Active Data Retention Policies</CardTitle>
          <CardDescription>
            Configured retention periods for each data category
          </CardDescription>
@@ -157,7 +157,7 @@ export default function ComplianceDashboard() {
                    {dpia.moduleScope}
                  </span>
                  <span className="text-xs text-slate-500">
-                    {dpia.approvedAt ? "CheckCircle Approved" : "Pending review"}
+                    {dpia.approvedAt ? "✓ Approved" : "Pending review"}
                  </span>
                </div>
              ))}
@@ -170,7 +170,7 @@ export default function ComplianceDashboard() {
      {data.consultations.length > 0 && (
        <Card>
          <CardHeader>
-            <CardTitle>Beratungsprotokoll</CardTitle>
+            <CardTitle>Consultation Log</CardTitle>
            <CardDescription>
              Staff and parent body consultations per module
            </CardDescription>
@@ -59,7 +59,7 @@ export default function CompliancePage() {
        <Card className="border-emerald-200 bg-emerald-50">
          <CardContent className="pt-6">
            <p className="text-emerald-800 mb-4">
-              Compliance onboarding completed successfully! Your school is now ready to use SchulOS.
+              ✓ Compliance onboarding completed successfully! Your school is now ready to use ExaMetra.
            </p>
            <button
              onClick={() => router.push("/admin/compliance-overview")}
@@ -1,7 +1,5 @@
 'use client';
 // @ts-nocheck
 import { useState, useEffect } from 'react';
 import { useApiGet } from '@/lib/hooks/useApi';
 import { DataTable } from '@/components/data-table';
@@ -112,7 +110,7 @@ export default function ExamProctoringPage() {
    <div className="space-y-6">
      <div className="flex items-center justify-between">
        <div>
-          <h1 className="text-3xl font-bold text-gray-900">Prüfungsüberwachung</h1>
+          <h1 className="text-3xl font-bold text-gray-900">Exam Proctoring</h1>
          <p className="text-gray-600 mt-1">Monitor active exam sessions and suspicious activity</p>
        </div>
      </div>
@@ -122,7 +120,7 @@ export default function ExamProctoringPage() {
        <div className="bg-white rounded-lg border border-gray-200 p-4">
          <div className="flex items-center justify-between">
            <div>
-              <p className="text-gray-600 text-sm font-medium">Aktive Sitzungen</p>
+              <p className="text-gray-600 text-sm font-medium">Active Sessions</p>
              <p className="text-2xl font-bold text-gray-900 mt-1">{activeCount}</p>
            </div>
            <Clock className="w-8 h-8 text-blue-500" />
@@ -132,7 +130,7 @@ export default function ExamProctoringPage() {
        <div className="bg-white rounded-lg border border-gray-200 p-4">
          <div className="flex items-center justify-between">
            <div>
-              <p className="text-gray-600 text-sm font-medium">Warnungen</p>
+              <p className="text-gray-600 text-sm font-medium">Alerts</p>
              <p className="text-2xl font-bold text-gray-900 mt-1">{alertCount}</p>
            </div>
            <AlertCircle className={`w-8 h-8 ${alertCount > 0 ? 'text-red-500' : 'text-green-500'}`} />
@@ -142,7 +140,7 @@ export default function ExamProctoringPage() {
        <div className="bg-white rounded-lg border border-gray-200 p-4">
          <div className="flex items-center justify-between">
            <div>
-              <p className="text-gray-600 text-sm font-medium">Sitzungen gesamt</p>
+              <p className="text-gray-600 text-sm font-medium">Total Sessions</p>
              <p className="text-2xl font-bold text-gray-900 mt-1">{sessions.length}</p>
            </div>
            <Eye className="w-8 h-8 text-purple-500" />
@@ -80,7 +80,7 @@ export default function SignageAdminPage() {
    <div className="space-y-6">
      <div className="flex items-center justify-between">
        <div>
-          <h1 className="text-3xl font-bold text-gray-900">Notfall-Digital-Schild</h1>
+          <h1 className="text-3xl font-bold text-gray-900">Emergency Signage</h1>
          <p className="text-gray-600 mt-1">Manage displays, messages, and emergency alerts</p>
        </div>
        <Button onClick={() => setShowNewMessage(true)} size="lg" className="gap-2">
@@ -91,9 +91,9 @@ export default function SignageAdminPage() {
      <Tabs defaultValue="displays" className="w-full">
        <TabsList>
-          <TabsTrigger value="displays">Bildschirme</TabsTrigger>
+          <TabsTrigger value="displays">Displays</TabsTrigger>
-          <TabsTrigger value="messages">Nachrichten</TabsTrigger>
+          <TabsTrigger value="messages">Messages</TabsTrigger>
-          <TabsTrigger value="activity">Aktivitätsprotokoll</TabsTrigger>
+          <TabsTrigger value="activity">Activity Log</TabsTrigger>
        </TabsList>
        {/* Displays Tab */}
@@ -184,7 +184,7 @@ export default function SignageAdminPage() {
                      label: 'Sound',
                      render: (_, row) => (
                        <span className={row.soundAlert ? 'text-amber-600' : 'text-gray-400'}>
-                          {row.soundAlert ? 'volume-up' : 'volume-off'}
+                          {row.soundAlert ? '🔊' : '🔇'}
                        </span>
                      ),
                    },
@@ -214,7 +214,7 @@ export default function SignageAdminPage() {
            <Card>
              <CardContent className="pt-6 text-center text-gray-500">
                <AlertCircle className="h-12 w-12 mx-auto mb-4 opacity-50" />
-                <p>Wählen Sie einen Bildschirm zur Verwaltung von Nachrichten</p>
+                <p>Select a display to manage messages</p>
              </CardContent>
            </Card>
          )}
@@ -224,8 +224,8 @@ export default function SignageAdminPage() {
        <TabsContent value="activity">
          <Card>
            <CardHeader>
-              <CardTitle>Aktivitätsprotokoll</CardTitle>
+              <CardTitle>Activity Log</CardTitle>
-              <CardDescription>Aktuelle Digital-Schild-Ereignisse und Warnungen</CardDescription>
+              <CardDescription>Recent signage events and alerts</CardDescription>
            </CardHeader>
            <CardContent>
              <div className="text-center text-gray-500 py-8">
@@ -240,58 +240,58 @@ export default function SignageAdminPage() {
      {showNewMessage && selectedSignage && (
        <Card className="fixed inset-4 z-50 md:inset-auto md:top-1/2 md:left-1/2 md:-translate-x-1/2 md:-translate-y-1/2 md:max-w-md max-h-[90vh] overflow-y-auto">
          <CardHeader>
-            <CardTitle>Neue Nachricht</CardTitle>
+            <CardTitle>New Message</CardTitle>
          </CardHeader>
          <CardContent>
            <form onSubmit={handleCreateMessage} className="space-y-4">
              <div>
-                <Label htmlFor="title">Titel</Label>
+                <Label htmlFor="title">Title</Label>
                <Input
                  id="title"
                  name="title"
-                  placeholder="Nachrichtentitel"
+                  placeholder="Message title"
                  required
                />
              </div>
              <div>
-                <Label htmlFor="content">Inhalt</Label>
+                <Label htmlFor="content">Content</Label>
                <textarea
                  id="content"
                  name="content"
-                  placeholder="Nachrichteninhalt"
+                  placeholder="Message content"
                  className="w-full h-24 px-3 py-2 border border-gray-300 rounded-md"
                  required
                />
              </div>
              <div>
-                <Label htmlFor="messageType">Typ</Label>
+                <Label htmlFor="messageType">Type</Label>
                <select
                  id="messageType"
                  name="messageType"
                  className="w-full px-3 py-2 border border-gray-300 rounded-md"
                  required
                >
-                  <option value="announcement">Ankündigung</option>
+                  <option value="announcement">Announcement</option>
-                  <option value="alert">Warnung</option>
+                  <option value="alert">Alert</option>
-                  <option value="emergency">Notfall</option>
+                  <option value="emergency">Emergency</option>
-                  <option value="notification">Benachrichtigung</option>
+                  <option value="notification">Notification</option>
                </select>
              </div>
              <div>
-                <Label htmlFor="priority">Priorität</Label>
+                <Label htmlFor="priority">Priority</Label>
                <select
                  id="priority"
                  name="priority"
                  className="w-full px-3 py-2 border border-gray-300 rounded-md"
                  required
                >
-                  <option value="low">Niedrig</option>
+                  <option value="low">Low</option>
                  <option value="normal">Normal</option>
-                  <option value="high">Hoch</option>
+                  <option value="high">High</option>
-                  <option value="critical">Kritisch</option>
+                  <option value="critical">Critical</option>
                </select>
              </div>
@@ -1,4 +1,3 @@
 // @ts-nocheck
 import { NextResponse } from 'next/server';
 import { z } from 'zod';
 import { db } from '@/lib/db';
@@ -1,12 +0,0 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { db } from '@/lib/db'
 import { createCrudHandler } from '@/lib/api-helpers'
 const handler = createCrudHandler(db.account, {
  searchFields: ['name', 'type', 'bankName'],
  defaultOrderBy: { createdAt: 'desc' },
 })
 export const GET = handler.get
 export const PUT = handler.update
 export const DELETE = handler.remove
@@ -1,11 +0,0 @@
 import { NextResponse } from 'next/server'
 import { db } from '@/lib/db'
 import { createCrudHandler } from '@/lib/api-helpers'
 const handler = createCrudHandler(db.account, {
  searchFields: ['name', 'type', 'bankName'],
  defaultOrderBy: { createdAt: 'desc' },
 })
 export const GET = handler.list
 export const POST = handler.create
@@ -0,0 +1,39 @@
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
 export async function GET(
  _request: Request,
  { params }: { params: Promise<{ id: string }> }
 ) {
  try {
    const session = await getSession();
    if (!session) {
      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
    }
    const { id } = await params;
    const review = await db.teacherGradingReview.findUnique({
      where: { id },
      include: {
        assessment: { select: { id: true, title: true } },
        teacher: { select: { id: true, firstName: true, lastName: true } },
        comments: {
          include: {
            user: { select: { id: true, firstName: true, lastName: true } },
          },
          orderBy: { createdAt: 'desc' },
        },
      },
    });
    if (!review) {
      return NextResponse.json({ error: 'Not found' }, { status: 404 });
    }
    return NextResponse.json(review);
  } catch (error) {
    console.error('AI Grading Audit GET [id] error:', error);
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
  }
 }
@@ -0,0 +1,133 @@
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
 import ZAI from 'z-ai-web-dev-sdk';
 export async function POST(request: Request) {
  try {
    const session = await getSession();
    if (!session) {
      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
    }
    const role = session.user?.role;
    if (role !== 'TEACHER' && role !== 'SCHOOL_ADMIN' && role !== 'SUPER_ADMIN' && role !== 'VICE_PRINCIPAL') {
      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
    }
    const body = await request.json();
    const { schoolId, assessmentId, studentId } = body;
    if (!schoolId || !assessmentId || !studentId) {
      return NextResponse.json({ error: 'schoolId, assessmentId, and studentId are required' }, { status: 400 });
    }
    // Get assessment and student data
    const assessment = await db.assessment.findUnique({
      where: { id: assessmentId },
      include: {
        results: {
          where: { studentId },
          include: {
            student: { select: { id: true, firstName: true, lastName: true } },
          },
        },
      },
    });
    if (!assessment) {
      return NextResponse.json({ error: 'Assessment not found' }, { status: 404 });
    }
    // Get annotations for this student's submission
    const annotations = await db.gradingAnnotation.findMany({
      where: { assessmentId, studentId },
      orderBy: { createdAt: 'asc' },
    });
    const studentResult = assessment.results[0];
    const student = studentResult?.student;
    // Generate AI grading audit
    const systemPrompt = `Du bist ein erfahrener Lehrer und Prüfer an einer deutschen Schule. 
 Du überprüfst die Benotung eines Schülers und gibst detailliertes Feedback.
 Die deutsche Notenskala: 1 (sehr gut), 2 (gut), 3 (befriedigend), 4 (ausreichend), 5 (mangelhaft), 6 (ungenügend).
 Analysiere die Leistung und die gegebene Benotung. Wenn die Benotung nicht angemessen ist, schlage eine Korrektur vor mit Begründung.
 Antworte immer auf Deutsch und im JSON-Format.`;
    const gradingInfo = {
      studentName: student ? `${student.firstName} ${student.lastName}` : 'Unknown',
      assessmentTitle: assessment.title,
      assessmentType: assessment.type,
      maxScore: assessment.maxScore,
      score: studentResult?.score ?? null,
      note: studentResult?.note ?? null,
      annotationsCount: annotations.length,
      annotationTypes: annotations.map((a: { type: string; content: string | null }) => ({ type: a.type, content: a.content })),
      teacherAnnotations: annotations.filter((a: { type: string }) => a.type === 'stamp' || a.type === 'text').map((a: { type: string; content: string | null; color: string }) => ({ type: a.type, content: a.content, color: a.color })),
    };
    let reviewResult: string;
    let discrepanciesFound = 0;
    try {
      const ai = await ZAI.create();
      const response = await ai.chat.completions.create({
        messages: [
          { role: 'system', content: systemPrompt },
          {
            role: 'user',
            content: `Überprüfe die Benotung für diesen Schüler und gib Feedback:\n\n${JSON.stringify(gradingInfo, null, 2)}\n\nGib deine Antwort als JSON mit folgenden Feldern:\n- currentGrade: die aktuelle Benotung\n- suggestedGrade: deine vorgeschlagene Note\n- reason: detaillierte Begründung auf Deutsch\n- discrepancies: Liste der gefundenen Unstimmigkeiten\n- overallAssessment: Gesamtbewertung der Benotung`,
          },
        ],
      });
      reviewResult = response?.choices?.[0]?.message?.content || 'Review could not be generated';
    } catch (aiError) {
      console.error('AI grading audit error:', aiError);
      reviewResult = JSON.stringify({
        currentGrade: studentResult?.score ?? 'N/A',
        suggestedGrade: 'N/A',
        reason: 'AI review could not be generated. Manual review recommended.',
        discrepancies: ['AI analysis unavailable — please review manually'],
        overallAssessment: 'AI audit could not be completed due to a technical error. Please review the grading manually.',
      });
    }
    // Count discrepancies
    try {
      const parsed = typeof reviewResult === 'string' ? JSON.parse(reviewResult) : reviewResult;
      discrepanciesFound = Array.isArray(parsed.discrepancies) ? parsed.discrepancies.length : 0;
    } catch {
      discrepanciesFound = 0;
    }
    // Create or update the grading review
    const review = await db.teacherGradingReview.create({
      data: {
        schoolId,
        assessmentId,
        teacherId: session.userId,
        aiProvider: 'pollination',
        status: 'completed',
        reviewResult,
        discrepanciesFound,
      },
      include: {
        assessment: { select: { id: true, title: true } },
        teacher: { select: { id: true, firstName: true, lastName: true } },
        comments: {
          include: {
            user: { select: { id: true, firstName: true, lastName: true } },
          },
          orderBy: { createdAt: 'desc' },
        },
      },
    });
    return NextResponse.json(review, { status: 201 });
  } catch (error) {
    console.error('AI Grading Audit POST error:', error);
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
  }
 }
@@ -1,4 +1,3 @@
 // @ts-nocheck
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
@@ -121,4 +120,3 @@ export async function POST(request: Request) {
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
  }
 }
 // @ts-nocheck
@@ -1,4 +1,3 @@
 // @ts-nocheck
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
@@ -155,4 +154,3 @@ export async function POST(request: Request) {
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
  }
 }
 // @ts-nocheck
@@ -1,85 +0,0 @@
 // @ts-nocheck
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
 import ZAI from 'z-ai-web-dev-sdk';
 /**
 * AI Agent Chat API (Agentic Mode)
 * POST /api/ai/agent
 * Body: { message, context, language, conversationHistory }
 * 
 * Only teachers and admins can use the agentic AI.
 */
 export async function POST(request: Request) {
  try {
    const session = await getSession();
    if (!session?.user) {
      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
    }
    // Only admin/teacher can use AI agent
    const role = session.user.role;
    if (role !== 'SCHOOL_ADMIN' && role !== 'SUPER_ADMIN' && role !== 'TEACHER' && role !== 'VICE_PRINCIPAL') {
      return NextResponse.json(
        { error: 'Only teachers and admins can use the AI agent' },
        { status: 403 }
      );
    }
    const { schoolId } = session.user;
    if (!schoolId) {
      return NextResponse.json({ error: 'No school assigned' }, { status: 403 });
    }
    const body = await request.json();
    const { message, context = 'teacher-assistant', language = 'de', conversationHistory = [] } = body;
    if (!message || typeof message !== 'string') {
      return NextResponse.json({ error: 'Message is required' }, { status: 400 });
    }
    // Build system prompt based on context
    const systemPrompts: Record<string, string> = {
      'teacher-assistant': `Du bist ein KI-Assistent für Lehrkräfte an einer deutschen Schule.
 Du hilfst bei Unterrichtsvorbereitung, Bewertungsvorschlägen, Kompetenzanalyse und Differenzierung.
 Du kennst das deutsche Schulsystem (Grundschule, Gymnasium) und die kompetenzorientierte Beurteilung.
 Antworte auf Deutsch, es sei denn es wird explizit anders verlangt.
 Sei konkret, praktisch und praxisnah.`,
      'lesson-planner': `Du bist ein Experte für Unterrichtsplanung nach dem kompetenzorientierten Ansatz.
 Du erstellst strukturierte Unterrichtsentwürfe mit Phasen, Lernzielen und Differenzierung.`,
      'assessment-helper': `Du bist ein Experte für Leistungsbewertung.
 Du hilfst bei der Erstellung von Bewertungsrastern, Kompetenzchecklisten und Notenbegründungen.`,
    };
    const systemPrompt = systemPrompts[context] || systemPrompts['teacher-assistant'];
    // Build messages array
    const messages = [
      { role: 'system', content: systemPrompt },
      ...conversationHistory.map((msg: any) => ({
        role: msg.role,
        content: msg.content,
      })),
      { role: 'user', content: message },
    ];
    // Generate using z-ai-web-dev-sdk
    const zai = await ZAI.create();
    const response = await zai.chat.completions.create({
      messages,
      thinking: { type: 'disabled' },
    });
    const responseContent = response.choices?.[0]?.message?.content || 'Ich konnte keine Antwort generieren.';
    return NextResponse.json({ response: responseContent });
  } catch (error) {
    console.error('AI Agent error:', error);
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
 }
@@ -1,4 +1,3 @@
 // @ts-nocheck
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
@@ -78,4 +77,3 @@ export async function POST(request: Request) {
    );
  }
 }
 // @ts-nocheck
@@ -1,96 +0,0 @@
 // @ts-nocheck
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
 import ZAI from 'z-ai-web-dev-sdk';
 /**
 * AI Lesson Plan Generation API
 * POST /api/ai/lesson-plan
 * Body: { subject, topic, classLevel, duration, language }
 * 
 * Only teachers and admins can generate lesson plans.
 */
 export async function POST(request: Request) {
  try {
    const session = await getSession();
    if (!session?.user) {
      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
    }
    // Only admin/teacher can generate lesson plans
    const role = session.user.role;
    if (role !== 'SCHOOL_ADMIN' && role !== 'SUPER_ADMIN' && role !== 'TEACHER' && role !== 'VICE_PRINCIPAL') {
      return NextResponse.json(
        { error: 'Only teachers and admins can generate lesson plans' },
        { status: 403 }
      );
    }
    const { schoolId } = session.user;
    if (!schoolId) {
      return NextResponse.json({ error: 'No school assigned' }, { status: 403 });
    }
    // Check AI settings
    const aiSettings = await db.aISettings.findUnique({
      where: { schoolId },
    });
    if (!aiSettings) {
      return NextResponse.json(
        { error: 'AI settings not configured' },
        { status: 403 }
      );
    }
    const body = await request.json();
    const { subject, topic, classLevel, duration = 45, language = 'de' } = body;
    if (!topic || typeof topic !== 'string') {
      return NextResponse.json({ error: 'Topic is required' }, { status: 400 });
    }
    // Build the lesson plan prompt
    const langText = language === 'de' ? 'Deutsch' : language === 'en' ? 'Englisch' : 'Türkçe';
    const prompt = `Erstelle einen detaillierten Unterrichtsentwurf auf ${langText}.
 Fach: ${subject || 'Allgemein'}
 Thema: ${topic}
 Klassenstufe: ${classLevel || '3'}
 Dauer: ${duration} Minuten
 Struktur:
 1. Lernziele (3-5 Ziele)
 2. Einstieg/Motivation (5-10 Min.)
 3. Erarbeitungsphase (15-20 Min.)
 4. Übungsphase (10-15 Min.)
 5. Sicherung/Reflexion (5-10 Min.)
 6. Differenzierungsmöglichkeiten
 7. Materialien/Medien
 8. Hausaufgabe
 Bitte strukturiere die Antwort mit klaren Überschriften und Bulletpoints.`;
    // Generate using z-ai-web-dev-sdk
    const zai = await ZAI.create();
    const response = await zai.chat.completions.create({
      messages: [
        { role: 'system', content: 'Du bist ein erfahrener Lehrer und Unterrichtsplaner. Du erstellst detaillierte, praxisnahe Unterrichtsentwürfe.' },
        { role: 'user', content: prompt },
      ],
      thinking: { type: 'disabled' },
    });
    const content = response.choices?.[0]?.message?.content || 'Keine Antwort generiert.';
    return NextResponse.json({ content });
  } catch (error) {
    console.error('AI Lesson Plan error:', error);
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
 }
@@ -1,144 +0,0 @@
 // @ts-nocheck
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
 /**
 * Perchance AI Image Generation API
 * POST /api/ai/perchance
 * Body: { prompt, style?, size? }
 * 
 * Uses Perchance AI: https://perchance.org/text-to-image-plugin
 * Falls back to z-ai-web-dev-sdk if Perchance is not configured
 */
 export async function POST(request: Request) {
  try {
    const session = await getSession();
    if (!session?.user) {
      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
    }
    // Only admin/teacher can generate images (students can if enabled)
    const role = session.user.role;
    const isStaff = role === 'SCHOOL_ADMIN' || role === 'SUPER_ADMIN' || role === 'TEACHER';
    if (!isStaff && role !== 'STUDENT') {
      return NextResponse.json(
        { error: 'Only teachers, admins, and students can generate images' },
        { status: 403 }
      );
    }
    const { schoolId } = session.user;
    if (!schoolId) {
      return NextResponse.json({ error: 'No school assigned' }, { status: 403 });
    }
    // Check AI settings
    const aiSettings = await db.aISettings.findUnique({
      where: { schoolId },
    });
    if (!aiSettings || (!aiSettings.perchanceEnabled && !aiSettings.aiImageGenEnabled)) {
      return NextResponse.json(
        { error: 'Image generation is disabled for your school. Enable it in Settings > AI.' },
        { status: 403 }
      );
    }
    const body = await request.json();
    const {
      prompt,
      style = 'realistic',
      size = '1024x1024',
      negativePrompt,
      seed,
    } = body;
    if (!prompt || typeof prompt !== 'string' || prompt.trim().length === 0) {
      return NextResponse.json(
        { error: 'Prompt is required' },
        { status: 400 }
      );
    }
    // Try Perchance API first if enabled
    if (aiSettings.perchanceEnabled) {
      try {
        // Perchance uses a web-based generator. We'll use their API endpoint.
        const perchanceResponse = await fetch('https://image-generation.perchance.org/api/generate', {
          method: 'POST',
          headers: {
            'Content-Type': 'application/json',
          },
          body: JSON.stringify({
            prompt,
            style,
            size,
            negativePrompt: negativePrompt || '',
            seed: seed || Math.floor(Math.random() * 1000000),
          }),
        });
        if (perchanceResponse.ok) {
          const data = await perchanceResponse.json();
          return NextResponse.json({
            success: true,
            provider: 'perchance',
            image: {
              url: data.imageUrl || data.url || null,
              b64_json: data.b64_json || null,
              revised_prompt: prompt,
              seed: data.seed || seed,
            },
          });
        }
      } catch (perchanceError) {
        console.error('Perchance API error:', perchanceError);
        // Fall through to z-ai-web-dev-sdk
      }
    }
    // Fallback to z-ai-web-dev-sdk
    try {
      const ZAI = (await import('z-ai-web-dev-sdk')).default;
      const zai = await ZAI.create();
      const response = await zai.images.generations.create({
        prompt: `${prompt}. Style: ${style}`,
        size,
      });
      const imageData = response.data?.[0];
      if (!imageData) {
        return NextResponse.json(
          { error: 'Failed to generate image' },
          { status: 500 }
        );
      }
      return NextResponse.json({
        success: true,
        provider: 'zai',
        image: {
          url: imageData.url || null,
          b64_json: imageData.b64_json || null,
          revised_prompt: imageData.revised_prompt || prompt,
        },
      });
    } catch (zaiError) {
      console.error('ZAI Image Generation error:', zaiError);
      return NextResponse.json(
        { error: 'Image generation failed. Please try again later.' },
        { status: 500 }
      );
    }
  } catch (error) {
    console.error('Perchance Image API error:', error);
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
 }
@@ -1,223 +0,0 @@
 // @ts-nocheck
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
 /**
 * SnapGen AI Video Generation API
 * POST /api/ai/snapgen
 * Body: { prompt, duration?, aspectRatio?, style? }
 * 
 * Uses SnapGen API: https://api.snapgen.ai/uapi/v1/generate
 */
 export async function POST(request: Request) {
  try {
    const session = await getSession();
    if (!session?.user) {
      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
    }
    // Only admin/teacher can generate videos
    const role = session.user.role;
    if (role !== 'SCHOOL_ADMIN' && role !== 'SUPER_ADMIN' && role !== 'TEACHER') {
      return NextResponse.json(
        { error: 'Only teachers and admins can generate videos' },
        { status: 403 }
      );
    }
    const { schoolId } = session.user;
    if (!schoolId) {
      return NextResponse.json({ error: 'No school assigned' }, { status: 403 });
    }
    // Check AI settings
    const aiSettings = await db.aISettings.findUnique({
      where: { schoolId },
    });
    if (!aiSettings || (!aiSettings.snapgenEnabled && !aiSettings.aiVideoGenEnabled)) {
      return NextResponse.json(
        { error: 'Video generation is disabled for your school. Enable it in Settings > AI.' },
        { status: 403 }
      );
    }
    const body = await request.json();
    const {
      prompt,
      duration = 10,
      aspectRatio = '16:9',
      style = 'realistic',
      language = 'de',
      subject,
      topic,
    } = body;
    if (!prompt || typeof prompt !== 'string' || prompt.trim().length === 0) {
      return NextResponse.json(
        { error: 'Prompt is required' },
        { status: 400 }
      );
    }
    // Build the enhanced prompt for educational content
    const enhancedPrompt = buildEducationalPrompt(prompt, {
      duration,
      aspectRatio,
      style,
      language,
      subject,
      topic,
    });
    // Try SnapGen API first if enabled
    if (aiSettings.snapgenEnabled && aiSettings.snapgenApiKey) {
      try {
        const snapgenResponse = await fetch('https://api.snapgen.ai/uapi/v1/generate', {
          method: 'POST',
          headers: {
            'Content-Type': 'application/json',
            'Authorization': `Bearer ${aiSettings.snapgenApiKey}`,
          },
          body: JSON.stringify({
            prompt: enhancedPrompt,
            duration: `${duration}s`,
            aspect_ratio: aspectRatio,
            style,
            language,
            type: 'video',
          }),
        });
        if (snapgenResponse.ok) {
          const data = await snapgenResponse.json();
          return NextResponse.json({
            success: true,
            provider: 'snapgen',
            taskId: data.task_id || data.id || data.taskId,
            status: data.status || 'processing',
            videoUrl: data.video_url || data.url || null,
            thumbnailUrl: data.thumbnail_url || null,
            message: 'Video generation started with SnapGen AI.',
          });
        }
        // Fall through to z-ai-web-dev-sdk if SnapGen fails
        console.error('SnapGen API error:', snapgenResponse.status);
      } catch (snapgenError) {
        console.error('SnapGen API error:', snapgenError);
        // Fall through to z-ai-web-dev-sdk
      }
    }
    // Fallback to z-ai-web-dev-sdk
    try {
      const ZAI = (await import('z-ai-web-dev-sdk')).default;
      const zai = await ZAI.create();
      const task = await zai.video.generations.create({
        prompt: enhancedPrompt,
        quality: 'standard',
        size: aspectRatio === '9:16' ? '720x1280' : '1280x720',
      });
      return NextResponse.json({
        success: true,
        provider: 'zai',
        taskId: task.id || task.taskId || 'pending',
        status: task.status || 'processing',
        message: 'Video generation started. Check status for updates.',
      });
    } catch (zaiError) {
      console.error('ZAI Video Generation error:', zaiError);
      return NextResponse.json(
        { error: 'Video generation failed. Please try again later.' },
        { status: 500 }
      );
    }
  } catch (error) {
    console.error('SnapGen Video API error:', error);
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
 }
 /**
 * GET /api/ai/snapgen?taskId=xxx
 * Check video generation task status
 */
 export async function GET(request: Request) {
  try {
    const session = await getSession();
    if (!session?.user) {
      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
    }
    const { searchParams } = new URL(request.url);
    const taskId = searchParams.get('taskId');
    const provider = searchParams.get('provider') || 'zai';
    if (!taskId) {
      return NextResponse.json({ error: 'taskId is required' }, { status: 400 });
    }
    if (provider === 'snapgen') {
      const aiSettings = await db.aISettings.findUnique({
        where: { schoolId: session.user.schoolId || '' },
      });
      if (aiSettings?.snapgenApiKey) {
        const statusResponse = await fetch(`https://api.snapgen.ai/uapi/v1/generate/${taskId}`, {
          headers: {
            'Authorization': `Bearer ${aiSettings.snapgenApiKey}`,
          },
        });
        if (statusResponse.ok) {
          const data = await statusResponse.json();
          return NextResponse.json({
            status: data.status || 'processing',
            videoUrl: data.video_url || data.url || null,
            thumbnailUrl: data.thumbnail_url || null,
            progress: data.progress || 0,
          });
        }
      }
    }
    // Fallback to z-ai-web-dev-sdk
    try {
      const ZAI = (await import('z-ai-web-dev-sdk')).default;
      const zai = await ZAI.create();
      const status = await zai.video.generations.retrieve(taskId);
      return NextResponse.json({
        status: status.status || 'processing',
        videoUrl: status.video_url || status.url || null,
      });
    } catch (error) {
      return NextResponse.json({
        status: 'processing',
        message: 'Task is still being processed.',
      });
    }
  } catch (error) {
    console.error('SnapGen status check error:', error);
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
  }
 }
 function buildEducationalPrompt(
  prompt: string,
  opts: { duration: number; aspectRatio: string; style: string; language: string; subject?: string; topic?: string }
 ): string {
  const langInstruction = opts.language === 'de'
    ? 'Erkläre auf Deutsch mit klarer, freundlicher Stimme.'
    : 'Explain in English with a clear, friendly voice.';
  const subjectContext = opts.subject ? `Fach: ${opts.subject}. ` : '';
  const topicContext = opts.topic ? `Thema: ${opts.topic}. ` : '';
  return `${subjectContext}${topicContext}${langInstruction} Inhalt: ${prompt}. Stil: ${opts.style}. Dauer: ${opts.duration} Sekunden. Aspect Ratio: ${opts.aspectRatio}.`;
 }
@@ -1,4 +1,3 @@
 // @ts-nocheck
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
@@ -68,4 +67,3 @@ export async function POST(request: Request) {
    );
  }
 }
 // @ts-nocheck
`@@ -1,4 +1,4 @@`
	`# SchulOS Comprehensive Audit Report`	`# ExaMetra Comprehensive Audit Report`

	`## Executive Summary`	`## Executive Summary`
`@@ -1,4 +1,4 @@`
	`# SchulOS Memory Optimization & Menu Consolidation Guide`	`# ExaMetra Memory Optimization & Menu Consolidation Guide`

	`## Problem Analysis`	`## Problem Analysis`
`@@ -1,4 +1,4 @@`
	`# SchulOS PRD Implementation Todo — Visual Roadmap`	`# ExaMetra PRD Implementation Todo — Visual Roadmap`

	`## Current Status: 30% Complete (Week 1)`	`## Current Status: 30% Complete (Week 1)`