🗺️ Product Roadmap

Core LMS: modules, exercises, assessments, certificates, batches, points system, teacher dashboards, assignments, peer reviews, gamification, AI coach, forum, battles, guardian portal, safety systems, email notifications, backups.

AI project consultant, personality profiles, career tracks + certificates, CV builder, mock interviews, job board, talent portal, project showcase, client projects, adaptive quizzes, SRS review, wellbeing suite, battle arena.

POST /student/switch-batch moves student into default batch permanently; switchers excluded from seats quota; 4-week leaderboard quarantine (digest, teacher insights, batch-stats); student+admin notifications.

consultantChat() accepts JSON bodies; frontend sends X-CSRF-Token and reads data.text. Chat was silently broken for all users before this.

Landing page: LIVE batch badge + seats-left (excludes switchers), official start date, 'Join Free' CTAs; all invite wording removed.

Login returns user to intended page (30-min window); partnerships page guests -> /register; dashboard daily_goals duplicate-key crash fixed (INSERT IGNORE).

Batch-overview deep-dive modal + GET /admin/batch-stats/{id} JSON; dashboard/batches/registration-queue linkified; users batch=none filter; 9 broken analytics links fixed.

Every flash error gets ERR-XXXXXX ref logged with context; 'Get help with this' prefills a high-priority support ticket; global exception handler logs URI/IP/user.

Province/institution double-submit data loss fixed (province_other, institution_uni/other field names + server merge); validation rejections logged; scripts/diagnose.php added.

23 required-assignment config rows copied to batch 4 (deadlines cleared); recommended-exercises widget query fixed (order_num<=1001).

No invite code required; all registrations forced into default batch (4, cap 500); auto-approve; seats-left badge; sections 3/4/5/9 required; 20/IP/day rate limit.

log_activity() now demotes non-numeric entity ids to NULL (activity_log.entity_id is INT; quiz start passed a UUID -> 1366 -> 500, user 356). Assessment recommendations now flatten AI career-path objects before strtolower (TypeError -> assessments page 500, user 355). Both marked solved on /status — page back to all-operational. Lesson recorded: exception titles truncate at 120 chars when resolving.

Solved issues removed from /status entirely (clean "All systems operational" state when nothing is open). Exception titles sanitized for the public — no SQL, column/table names, or file paths; shown as "Database error"/"Application error", technical detail visible to admins only. Issues appear automatically as errors happen (cache 120s). Marked leftover test flash as not-a-bug.

All 24 known issue groups pre-marked Solved with accurate notes (fixed bugs vs not-a-bug validations). Status page is now a pure status list. Email capture (notify-when-fixed) moved onto the error message itself — shows with every error ref, pre-fills the logged-in user email, works for guests. Verified e2e.

/status lists known issues live (grouped from error log with counts + first/last seen); users subscribe by email per issue; admin Marks solved inline -> issue moves to bottom Solved section with note and all pending subscribers get a fixed-notification email. Error flash now links to the status page. Verified end-to-end: subscribe -> resolve -> email sent -> moved to Solved.

generateReportCard() query rewrote GROUP BY a.type as MAX(id) latest-row subquery — report card generation 500d for students with assessments (caught live by the new error-alert emails, user 335 hit it 4x).

error_alerts table records every alert email (type, recipients, counts, details, pointer). Heartbeat setting error_alert_last_run proves the 10-min watcher runs. diagnose.php now shows the alert trail + last run. Mail credentials remain in settings (mail_* keys).

Team gets email when users hit issues: instant alert for uncaught exceptions (grouped, max 1/run) + daily 21:00 digest of user-facing errors and registration validation rejections. scripts/cron_error_alerts.php on a 10-min cron, pointer-based, Mailjet via Mailer::sendRaw. Settings: error_alert_enabled, error_alert_emails.

Session lifetime matched to 7-day cookie (gc_maxlifetime 1440s->604800 in fpm+cli; fixes idle logout bounce-outs and most CSRF Invalid-request failures). combined_profiles.assessments_json column added — personality combined-profile save works for the first time. $assessmentTotal dashboard warning (706x) and demo.php correct-key warnings fixed.

UN SDG tagging for modules/tracks/batches with reasons. 17 goals seeded; 221 module + 24 track + 9 batch auto-mappings by category_group. Chips on student module cards + public curriculum/course-detail; detail line "Supports SDG N - reason". Admin matrix at /admin/sdg with bulk group-apply.

Hand-holding earning system: 6 guided paths with auto+manual steps, earnings ledger + aggregate counter, 6-stage freelance playbook with AI gig-writer, AI proposal-writer, 15 reply scripts, negotiation gym (curated roleplay workouts), curated tips library. +50 XP per completed path.

The mobile deploy set wlms_sess2 to SameSite=None; older browsers (Android WebViews, pre-Chrome-76) reject None cookies outright, causing an infinite login-bounce for affected users (real case: user 254 logged in successfully but every next request was guest). None was unnecessary: play./m. are the same registrable domain (maahir.io), so Lax is sent on all subdomain requests AND accepted by every browser. Verified: login -> wizard -> dashboard holds; m.maahir.io proxy + CSRF endpoint still working.

Passwordless one-time login: login page has an email-me-a-link form; clicking the emailed link logs in directly (15-min one-time token), clears any login lock, honors intended-URL return. Lock message now static text offering reset OR magic link (minute-countdown removed — it spawned a new status group every minute). Password reset also clears the lock.

Login lockout now keys on IP + account (shared campus WiFi/CGNAT users no longer block each other), the failure count decays after 30 idle minutes (was: lifetime accumulation), and the block message shows remaining minutes + offers immediate password reset instead of waiting.

Login errors now render INSIDE the login card (red panel) right above the form with a contextual action button (Reset my password / Create a free account) — previously the message only appeared at the top of the page where users missed it. Proactive fix for stuck user: password-reset email sent to the reported account.

500 pages rebuilt: friendly card with Refresh-page button, /status link, back-home link, and an ERR-ref (exceptions now log ref=ERR-XXXXXX) so even hard crashes are quotable/support-traceable. Login CSRF message says refresh-the-page; login Having-trouble box gained a Refresh link.

Every login failure now has a specific, actionable message: empty fields, expired form (CSRF), deleted account (previously deleted users could log in and bounce-loop with no explanation), plus v11.7.3 wrong-password/no-account/pending/suspended. Login card gained a persistent Having-trouble box (reset password / create account / check status).

Login failures now say WHY: wrong password for an existing account (points to Forgot password) vs no account found (points to register) vs pending/suspended (existing specific messages). /status shows an aggregate "N login difficulties (24h)" badge (no accounts exposed) so stuck users like ref ERR-B82E0B are visible without noise-tickets. Also fixed: resolve/noise error_key length guard (VARCHAR 100 overflow on long titles).

A live student failed registration twice with a >255-char institution name (String data right truncated). processRegister now clamps every free-text field to its column size (institution/degree/company/district/etc.) and the form adds maxlength attrs. Verified: 455-char input registers, stored at 255.

Solved issues that recur re-open on /status with "Recurred after solve" badge, prior fix note/date, same ticket number. Timezone-safe epoch resolved_ts. Admin can re-solve or noise-mark (hide forever) — 17 expected-churn classes noise-marked. Also fixed live: /student/teams + team-workspace 500 (bare Auth:: in views, user 365).

Every /status issue now carries a stable ticket number (ISS-XXXXX, deterministic from the issue key). Fixed BattleController:689 and AdaptiveQuizController:406 calling nonexistent Database::lastInsertId() — team creation and AI question-bank saving were 500ing (caught live on /status, user 365). All resolved; page all-operational.

ProfileWizard choice() now returns NULL for invalid/missing enum values (device_type/internet_access "" crashed strict mode — same class as the mobile register bug). /status resolved-map LIMIT raised 50->500 (a marker fell off page 1 and its issue re-showed as open). Mobile takeover: AGENTS.md written in both repos, e2e mobile login verified (bareera account, proxy chain, session persists), leftover sw.js build committed.

Real root cause of the persistent login-bounce (user 254, Firefox/Win, kept failing after the SameSite fix): the mobile deploy changed cookie domain from host-only to .maahir.io, so long-time users hold TWO wlms_sess2 cookies (stale host-only + fresh dot-domain); some browsers send the stale one first and PHP reads it -> authenticated session shadowed -> endless guest loop. Renaming forces ONE clean cookie for everyone (one-time logout for active sessions). Duplicate-cookie detector logs occurrences for confirmation.

External privacy report verified accurate. Forum profiles: guests login-redirected, noindex,nofollow, self-canonical + og:type=profile removed (layout suppresses canonical on noindex pages), city never shown, child-tier profiles 404 for everyone except self/admin, teen noindex. Public project gallery/showcase detail: noindex. Talent portal: permanently excludes child-tier authors + deleted users. Public profile page: child tier can never be public regardless of consent flags. Leaderboard already noindex. Tier-3 (opaque slugs replacing numeric IDs) deferred.

Sdg::chipCss() returned a full <style> element nested inside the modules page style block — the inner </style> closed it early and all subsequent page CSS rendered as visible text. chipCss() now returns bare CSS; standalone call sites (curriculum, course-detail) wrap it themselves. Verified: 1 style block, all CSS inside, chips styled everywhere.

Batch 1 granted all 16 module groups (batches 1-4 now identical full catalog). Batch creation hardened for the future: admin create defaults to ALL groups when none selected; campaign-wizard batches auto-seed the full catalog.

Batch 2 (WE DEL) now has all 16 module groups — freelance_entrepreneur and every specialization accessible (verified live for a batch-2 student via hasModuleAccess). Batch 3/4 already had them; batch 1 intentionally left limited. Batch 4 required assignments: staggered Monday deadlines 4/4/4/4/4/3 across Oct 19 - Nov 23.

cron_welcome_default_batch.php (hourly): welcomes every new default-batch student within 72h of registration (batch name, start date, WhatsApp group, module-1 link) — 69 sent on first run. cron_onboarding_emails.php (daily 10:00): day-1/3/7 lifecycle emails with completion conditions and notification-prefs respect — 2 sent on first run. Dead batch-3 welcome cron (5-min, window-expired since July) removed from crontab.

Three JSON endpoints for mobile: POST /api/v1/auth/forgot-password and POST /api/v1/auth/magic-link (JSON {email}, X-CSRF-Token, anti-enumeration responses, 5/hour/IP+email file-counter rate limit; emails deep-link the WEB reset/magic endpoints — the shared .maahir.io cookie carries the session across both apps) and POST /api/v1/error-subscribe (JSON body with error_ref/error_title naming or classic ref/msg form, CSRF via header or JSON _csrf). /api/v1/status rewritten on a new shared model ErrorNotifyController::collectStatusData() — the web /status page and the JSON API now read the exact same grouping/resolved/recurrence/noise/sanitize/ticket logic (open-only, ISS tickets, login_attempts badge, admin-gated admin_title; resolved-map LIMIT 500) instead of a stale fork that leaked raw exception titles. /api/v1/public/landing gains the live batch announcement (seats exclude batch_switchers, identical to the homepage). mobile_actions: forgot-password-json, magic-link-json, status-v2, landing-announcement — the mobile app should now consume these JSON endpoints natively.

English Tutor: 4-mode AI chat (Free Talk/Drills/Interview/Email) with 📝✅❌💡 coaching block per reply, Roman Urdu input + 'urdu' re-explain, mistake-pattern tracking. AI Guide: /student/ai-guide 'What should I practice today?' — 3 deterministic picks from earn-path progress, roleplay weak skills (<60 avg), English practice staleness, profile state, today's exercises. SkillXP: parallel per-skill XP table (Novice/Practitioner/Expert/Master), auto-awarded on roleplay completion (top-2 skills) and exercise completion (category_group); PointManager untouched.

10 multi-step roleplay story arcs (client journey, interview gauntlet, angry client, first sale, founder journey, deposit battle, raise negotiation, campus-to-career, 2 AI Changemaker consults with 8 new Pakistani-context scenarios 2512-2519). Series list + timeline detail pages, per-step completion tracking, series XP bonus + notification on finishing all steps, mobile API GET /api/v1/student/roleplay/series.

AI-generated via 5 parallel shard processes across 49 topics covering: 7 pitch variants (freelance/startup/small-biz/B2B/investor/WhatsApp/elevator), sales+marketing (cold outreach, objections, closing, viral clients, briefs), operations+support (deadline slips, angry customers, scope creep), startup (cofounder, first hire, investor grilling, pricing pivot), women home business (stitching, cooking, salon, crafts, Daraz disputes, safety), job seeking (technical/HR rounds, salary calls, follow-ups), leadership/CEO (imposter syndrome, promotions, first-time manager, hard conversations, firing, crisis, town-hall, women-in-leadership), campus (FYP defense, group projects), daily life (landlord, bazaar), region-specific (GCC/US/UK/EU client culture). All tagged to skill/context/role/profession/sdg/region facets. Governance queue: 558 rows.

Six JSON tag columns added to roleplay_scenarios and backfilled for all 1,952 active scenarios (skill: type->canonical-skill map + evaluation_criteria keys; context: scenario_bank domain/category join + keyword scan, cap 3; role/profession: keyword scans, cap 3; sdg: derived ints incl. 3 health/4 education/5 home_entrepreneur/8 decent work/10 inequalities/16 justice; region: GCC/US/UK/EU keywords). /student/roleplay reworked as a faceted index (skill/context/role/profession/sdg/region/difficulty/q filters, 24/page, facet counts computed excluding each facet's own active filter — standard faceted search). GET /api/v1/student/roleplay reshaped to {ok, items[], facets{}, total, page, per_page} with per-item tags — mobile: faceted roleplay UI, see api contract + mobile_actions[roleplay-facets]. New content_governance review-queue table (ContentGovernance::queue() insert helper) for the coming AI content waves — admin UI deferred. mobile_actions note: mobile app should rebuild the roleplay section as a faceted browser off the new API contract.

10 profession packs for digital gig careers — graphic-designer 🎨, video-editor 🎬, virtual-assistant 📋, social-media-manager 📣, content-writer ✍️, web-developer 💻, online-tutor 🧑‍🏫, customer-support 🎧 (BPO, huge in Pakistan), translator 🌐 (Urdu↔English), data-annotation 🏷️ (new field). Each pack ships 5 hand-written (not AI-generated) roleplay scenarios — 50 total — with Pakistani context: 17th-revision clients, AI logo price wars, Rs 500 design rates, Daraz-clone budgets, night-shift call centers, per-word translation rates, piece-rate annotation bargaining. Scenarios carry profession_tags=[pack slug], role_tags=[freelancer], sdg_tags=[8] and integrate with the existing roleplay engine (points, AI scoring, series). Pack detail pages cross-link related idea_library entries (profession/keyword match), Saheli guides (keyword match) and micro_cards (skill match).

Wave 2 of the role-play content engine: ~430 AI-drafted scenarios across 43 topics in 9 clusters — finance deep (8: family budgeting, bank loans, payslips, car instalments, recovery agents, JazzCash/Easypaisa setup, compound interest, emergency funds), family dynamics (6: freelancing vs government job, startup support, in-law expectations, sibling in business, marriage vs career timing, explaining online work), kids earning online (5: YouTube pitch with parental consent, crafts selling, shop digitization, tutoring, earnings report — all age-appropriate), education (5: scholarship interview, professor help, thesis defense, recommendation letter, timeline extension), digital life (5: viral mistakes, harassment reporting, content theft, fake accounts, privacy settings), health & wellbeing (4: mental health leave, burnout, midnight-client boundaries, supporting colleagues), English interview practice (5), women re-entry (3), cloud kitchen/franchise (2). Sharded generator with cross-wave dedup; governance audit rows queued. NEW public /sdg impact page: 17 SDG cards (icon, name, scenario count, module count) with Explore links into /student/roleplay?sdg={id}.

200 pre-written 5-minute educational cards across 34 skills: Business English (40: greetings, email craft, negotiation emails, contract language...), 12 soft skills (communication, negotiation, leadership, resilience, confidence, time management, ethics, teamwork, critical thinking, emotional intelligence, networking, problem solving), 10 technical skills (prompt engineering, Canva, Excel, WordPress, digital payments incl. Raast/JazzCash/Payoneer, AI tools, typing, digital literacy, social media, email), 10 daily-life/rights topics (money, tenant/employee/consumer/women's/freelancer rights, cyber safety incl. PECA/FIA, family legal/NADRA, health, daily life). Each card: title, 3-5 sentences of real teaching, one concrete practice prompt, difficulty, est 2-5 min, XP 5/8/10. Daily pick = random incomplete card in the user's most-relevant skill (skill_xp first, then recent module categories, then daily rotation). Completion idempotent via micro_progress UNIQUE(user_id, card_id); awards PointManager points + SkillXP. Web: /student/micro page with confetti celebration, per-skill browse, dashboard widget. Mobile: 4 JSON endpoints.

New Business Toolbox (ToolboxController + /student/toolbox hub) for students: 7 business AI generators (Elevator Pitch with English + Roman Urdu versions, 8-slide Pitch Deck Outline, 3-tier Pricing Calculator in PKR, WhatsApp-ready Quotation + email version, Lean Business Plan canvas, SWOT + competitor positioning, 30-day Marketing Plan, 3-step Payment Reminder Ladder calibrated to Pakistani business culture), a Legal Toolkit section (NDA, Freelance Agreement, MoU templates in plain English — every output prefixed with '⚠️ This is a template for learning purposes. Consult a qualified lawyer for legally binding documents.'), and a Student Gig Analyzer (paste a Fiverr/Upwork gig → structured {title, skills_needed, estimated_budget_pkr, timeline, difficulty, tips}; read-only, creates no client_projects row). All 12 tools run through AI::chatTask('general_chat', …, max_tokens 1200) with Pakistani-context system prompts (PKR, WhatsApp-first, JazzCash/Easypaisa) and save each output to new table toolbox_outputs (user_id, tool_key, input_summary, output, created_at; idx_user(user_id, tool_key)). History pages: /student/toolbox/history (web, last 20, expandable + copy) and GET /api/v1/student/toolbox/history (mobile). API surface: GET /api/v1/student/toolbox (tool list + field schemas), POST /api/v1/student/toolbox/{tool} (wildcard for all 12), CSRF via X-CSRF-Token, JSON or form bodies. Web routes: GET /toolbox (hub cards), GET /toolbox/history, POST /toolbox/{tool} x12. Nav: 'Business Toolbox' added under 💡 Projects. Part 1 of v11.14.0 — micro-learning (part 2) ships separately.

Opportunity Finder: 'Tell us who you are' (free text + profession/role quick-pick chips) -> AI generates EXACTLY 5 personalized PKR-context ideas (title, description, why_you, build_steps, earning_range, difficulty, sdg). Rate limit 10/day/user via file counter. Idea Library: 100 pre-written ideas seeded into new idea_library table, searchable + filterable (profession, difficulty), collapsible build steps. Roadmap/What's-New page handled separately in part 2.

Public /roadmap page (RoadmapController) with three columns: Now (current version + last 5 history entries from platform_manifest.json), Next (contracted upcoming: Business Toolbox v11.14.0, Micro-Learning Engine v11.15.0, Content Wave 2 v11.16.0, Profession Packs + Maahir Works v11.17.0, WOW Onboarding v11.18.0), Later (vision: global search, credentials wallet, feedback boards, Urdu UI, voice practice, kids payout rails). Layout gains a What's-New modal for logged-in users that appears once per version change (session key last_seen_version vs Version::get()) showing the 3 newest manifest history entries with a View-full-roadmap link. Student changelog (/student/changelog via ChangelogTraits) now replaces generic 'Platform Update — vX' titles with the matching manifest history title (exact version match, then latest same major.minor; unmatched titles kept). Roadmap link added to sidebar bottom + public footer. History[] normalized to newest-first ordering.

Profession Packs Wave B (professional services): 8 new packs — Lawyer ⚖️, Doctor & Clinic 🏥, Pharmacist 💊, Childcare & Daycare 🧸, Engineer ⚙️, Journalist 📰, Agriculture & Farming 🌾, Social Worker & NGO 🤝 — each with 5 hand-written Pakistani-context roleplay scenarios (no-docs property clients, fee-dodgers, AI-invented case citations, antibiotic demands, Urdu diagnosis explanations, prescription-refusal ethics, biting incidents, egg-allergy dismissal, mid-construction plan changes, scaffold safety stops, spiked stories, source retractions, mandi-price trust, drip-irrigation pitches, forecast failures, thin case files, volunteer burnout…). profession_tags is now reserved for pack slugs: 17 legacy single-tag lawyer/healthcare facet rows cleared so pack pages show exactly the curated 5. Missing assessments: startup_readiness (risk tolerance, opportunity recognition, resourcefulness, resilience, market awareness) and freelance_business (client acquisition, pricing strategy, contract awareness, payment management, portfolio building) — 10 likert questions each, engine-native {text,cat,dir} shape with categories/reverse_questions/type_labels/bands scoring_logic (the shared engine supports likert + ab_choice only, so the item format follows the 30+ existing likert assessments rather than literal 4-option MCQ). Capstone system (CapstoneController + capstone_projects table): each student's capstone auto-creates with type inferred from their onboarding goal; artifacts are evidenced from real work (business-plan/pitch-deck/quotation/freelance-agreement toolbox_outputs, proof_uploads for portfolio, issued/skill certificates for certification); submit is gated on all artifacts done; admin review (/admin/capstone/manage) approves or requests changes with notes; approval awards the 'Capstone Complete' 🎓 badge (user_achievements, idempotent), +200 XP via PointManager (ledger-safe), a capstone_approved notification, and a one-time hero_reached notification when Journey stage 8 thresholds (2+ certs, 5+ badges) are met — the Hero status upgrade path. Nav: 🎯 Career → 🎓 Capstone (student, NEW badge 14 days), 💡 Projects → 🎓 Capstone Reviews (admin).

Multiplayer Role-Play (MultiplayerRoleplayController + student.roleplay-multiplayer view): two learners play opposite sides of a scenario (client↔freelancer / buyer↔seller) in a shared room created with a 6-char code (unambiguous alphabet); join is an atomic guest claim; chat runs on 3-second AJAX polling of GET /roleplay/multiplayer/poll/{id}?after={id} (no WebSockets) with own messages right / opponent left and a scenario-context header; neutral AI observer (GET /roleplay/multiplayer/spectate/{id}) gives live notes + per-player live scores to spectators (staff) and players; End & Score requires BOTH players to agree (hidden marker rows in multiplayer_messages; atomic status claim prevents double evaluation) after which the AI judge scores each side 0-100 with strengths/improvements, declares winner or draw, awards 15 XP each + 10 winner bonus via PointManager and notifies both (multiplayer_complete). Maahir Works (MaahirWorksController + student/admin views): real paid projects from local businesses/NGOs — students browse budget/skills/timeline cards and propose (why me + approach + timeline, one per project); admins post projects, assign a student + optional Hero mentor (auto-accepts the winner's proposal, rejects the rest) and track open→assigned→in_progress→delivered→paid; setting Paid records the payout in student_earnings (source_type maahir_works, amount budget_max||budget_min), awards +50 XP and sends the outcome notification; student deliver action (POST /works/{id}/complete with delivery notes) notifies mentor+creator. Seeded 5 real-world sample projects (Lahore bakery website Rs 15-25k/2w WordPress, Karachi clinic WhatsApp chatbot Rs 20-35k/3w no-code, Islamabad boutique social setup Rs 10-15k/1w, Peshawar hardware store Sheets+Apps Script tracker Rs 25-40k/3w, Multan exporter English product copy Rs 8-12k/1w). Conversation Replays: ai_roleplay_sessions completing with score ≥ 80 are auto-archived PRIVATE into roleplay_replays (unique session_id); the results view shows '🏆 Great score! Share this conversation to help others learn?' with an opt-in button (POST /roleplay/share/{id} flips is_public); the public gallery GET /roleplay/replays lists only opted-in 80+ conversations with expandable transcripts. Nav: ⚔️ Multiplayer + 🎬 Replays under 🤖 Practice, 💼 Maahir Works under 💡 Projects (+ admin nav), all NEW-badged until 2026-10-13.

Goal Picker: full-screen 'What do you want to achieve?' experience (GET /student/onboarding, new fullscreen layout + public_nav) with 6 tap-to-select goal cards — Get a Job, Become a Freelancer, Start/Grow a Business, Grow My Home Business, I'm a Student, Explore Everything — each with icon, 3-line description and practice chips; 'Start My Journey →' CTA stores the goal in new user_onboarding_goals table (+10pt first-time bonus, ledger-safe via PointManager) and redirects to the matching starter path (job→ai-guide, freelancer→freelance-playbook, business→toolbox, home_business→earn, student→micro, explore→ai-guide). Dashboard redirects profile-complete students with no goal to the picker once per session (wow_goal_prompted flag kills loops). Journey Map: GET /student/journey renders the 9-stage Zero-to-Hero timeline (metro-line style, done ✓+dates / current ● 'You are here' / future ○) with per-stage progress bars, expandable what-to-do + related-XP details, 'What's next?' with 3 AI Guide picks, and a gold MAAHIR HERO card at Stage 8 (certificates, badges, capstone claims, mentor eligibility + opt-in to /student/mentors/apply). Stage engine getStageProgress(): 0 profile_completed, 1 ≥5 exercises, 2 ≥1 cert + ≥10 roleplays, 3 goal set, 4 ≥3 track modules, 5 ≥2 series, 6 ≥3 toolbox outputs, 7 ≥1 student_earning, 8 ≥2 certs + ≥5 badges. Dashboard gets a '🗺️ My Journey' hero card (uncached stage compute). Legacy onboarding checklist moved to /student/onboarding/checklist (dashboard 'Finish setup' link updated). Mobile JSON: GET /student/onboarding, POST /student/onboarding/goal (X-CSRF-Token + JSON body), GET /student/journey.

Final completeness wave. MOBILE PARITY: 4 missing pages built (/partners with 106 partner directory + detail, /ai-economy 7-pillar page, /industries 39 industries, /library 26 free resources) — mobile now at full parity, 159/159 API + 102/102 pages. PARTNER IMPACT: monthly cron (1st of each month, 9 AM) sends each partner their aligned content counts + live platform stats via email; dry-run verified; contact_email column ready. CONTENT GAPS: Public Speaking module (Marketing M9, 10 exercises: anxiety, structure, PowerPoint, Q&A, body language, virtual presenting) + Business Writing module (SMM M8, 10 exercises: email, WhatsApp, proposals, reports, formal letters) + 6 more healthcare-admin scenarios + 6 more teaching scenarios (both tracks now 12 scenarios each) + 21 SDG mappings (SDG 3, 4, 16 now have module coverage). CERTIFICATES: mastery track completion certificate generator (Playwright PDF, issued_certificates with verification codes, tested on user 5 with Customer Success track — 37.9KB PDF verified). SITEMAP: regenerated with 202 URLs (22 static + 35 tracks + 39 industries + 106 partners), valid XML.

NEW TRACK Hospitality Mastery (8 modules/80 exercises, group hosm, SDG 8, icon hotel, color #f59e0b): M1 Hospitality Career Map (hotel vs restaurant vs travel, L1-L5 ladders commis-to-owner / receptionist-to-GM / guide-to-destination-manager, Pakistan market PC-Serena-Marriott + QSR + cloud kitchens + Umrah operators, honest PKR salary bands) · M2 Front Office & Guest Experience (5-stage guest cycle, Booking.com/Agoda OTA management, LEARN complaints, VIP handling, upselling, night audit with occupancy/ADR/RevPAR, telephone etiquette) · M3 F&B Operations (service flow greeting-to-bill, KOT/pass coordination, menu engineering stars-plowhorses-puzzles-dogs, PFA/SFA food safety, room service, buffets, dietary/allergen protocol) · M4 Housekeeping & Facilities (10-point room inspection, laundry par system, work orders + OOO rooms, deep-clean calendar, PA rounds, pest control records, linen par math, pre-monsoon PM plan) · M5 Restaurant Business (30% food cost rule, supplier two-source discipline, staffing bands, POS controls/void log/Z-report, PFA-SFA inspections, foodpanda channel economics ~30% commission, cloud kitchen multi-brand, franchisor/franchisee diligence) · M6 Revenue & Sales (occupancy-ADR-RevPAR crunch, dynamic pricing calendar, corporate contracts, wedding BBO with guaranteed-minimum, social media, packages, low-season playbook) · M7 Travel & Tourism (Umrah operations factual: Nusuk-era visas, packages from Karachi/Lahore/Islamabad, group leader playbook, lost luggage protocol; Hunza/Skardu/Naran/Kaghan itineraries with drive-hour honesty and Plan B; tour operator costing; IATA/BSP ticketing; corporate travel; visa documentation; tour emergency protocols) · M8 Leadership (GM path rotations, restaurant owner journey, brand standards audits, NPS, staffing-at-scale ratios, revenue leadership, crisis command book, SOP writing, 90-day GM turnaround capstone). Plus hospitality-pro mini-pack (sort 52) with 6 scenarios (VIP early arrival, food complaint on a busy night, 500-guest wedding buffet changes, Umrah group lost luggage in Jeddah, PFA inspector walk-in, foodpanda surge) + 2 profession tools (menu-cost-calc: plate cost/food cost %/margin/30%-rule verdict/menu engineering slot; guest-complaint-resolver: response script/escalation/recovery options/follow-up) + 10 hospitality_skills micro-cards (Daily Life & Rights group, ladder/check-in/30% rule/inspection/upsell/wedding/Umrah/Hunza-Skardu/OTA/NPS). Mastery hub now 17 tracks.

Two new mastery tracks completing the full professional spectrum. Healthcare Administration Mastery (7 modules/70 ex, SDG 3): OPD flow, Sehat Sahulat Card, Healthcare Commission, hospital operations, HIS/EMR, healthcare HR + healthcare-admin-pro pack (6 scenarios) + opd-flow-optimizer + billing-compliance-check tools. Teaching and Education Mastery (7 modules/70 ex, SDG 4): lesson planning, classroom management, assessment, EdTech, curriculum, teacher leadership + teaching-mastery-pro pack (6 scenarios) + lesson-plan-builder + rubric-generator tools. 22 mastery tracks, 1,600 exercises, 57 packs, 169+ tools.

Two new mastery tracks completing the full professional spectrum. Healthcare Administration Mastery (7 modules/70 ex, SDG 3): OPD flow, Sehat Sahulat Card, Healthcare Commission, hospital operations, HIS/EMR, healthcare HR + healthcare-admin-pro pack (6 scenarios) + opd-flow-optimizer + billing-compliance-check tools. Teaching and Education Mastery (7 modules/70 ex, SDG 4): lesson planning, classroom management, assessment, EdTech, curriculum, teacher leadership + teaching-mastery-pro pack (6 scenarios) + lesson-plan-builder + rubric-generator tools. 22 mastery tracks, 1,600 exercises, 57 packs, 169+ tools.

(1) PartnerController: index (grouped directory, ?category= filter, empty-state safe), detail (404 on unknown slug), apiList (JSON for mobile). Content matching is LIVE per request: scenarios via focus_keywords LIKE title/description OR JSON_CONTAINS(sdg_tags, sdg); modules via sdg_mappings entity_type=module joined to published modules; micro_cards and ai_tool_directory via keyword LIKE; 3 sample scenarios per partner for the try-it section. Rows without focus_* columns fall back to SECTOR_DEFAULTS; short_name/color/icon derived when NULL; category derived from (partner_type, sector) so all seed waves (B1 dev/govt/energy/tech/foundation, B2 28 CSR, B3 foundations/energy/tech) render uniformly; pathway renders as structured Week 1-4 JSON or plain-text paragraph. (2) Views: public/partners.php (hero, horizontal category chips, SDG chips, card grid) and public/partner-detail.php (pitch, live stats, try-it, pathway, 4 Ways to Plug In, copy-able CSR paragraph, gap analysis, mailto CTAs, cross-links). (3) ensureSchema() mirrors seed DDL and additively ALTERs the 7 partner-directory columns onto pre-existing tables. Public, SEO index,follow, sitemap + Discover nav entry.

4 new mastery tracks (Hospitality/Supply Chain/Legal/Customer Success) bringing total to 20 tracks and 1,410 exercises. 106-partner Development Partner directory with live marketing pages at /partners. AKF-aligned content: Climate Action module, CHW pack, Rural Livelihoods, Teacher Pedagogy. Pakistan region tags, women-in-ai module, 4 new profession packs.

(1) PARSER FIX: AI occasionally returned two concatenated JSON objects which the greedy-regex parser could not decode, leaking raw JSON into chat bubbles. New 3-layer parseAiJson(): direct decode → escape-aware balanced-brace scanner merging all top-level objects → response-value regex salvage → final sanitizer guarantees no {…} skeleton ever renders (5-case unit tested). (2) SCENE BRIEFING: prominent panel above every chat — 👤 You are / 🤖 AI plays / 📋 Situation / 🎯 Your task — plus The-user-plays context so the AI addresses the learner in character; reverse mode explains its flipped roles. (3) user_role COLUMN + FULL BACKFILL: new VARCHAR column; 8,572/8,572 active scenarios labeled (95.7% by AI wave in ~24 min, 3.7% heuristic, 49 generic fallback); normalizeScenario whitelist updated to carry the field. Sample: #3060 now reads You are the master tailor deciding whether to copy the luxury lawn designs. (4) TRANSLATION IN ROLEPLAY (16 languages incl. Arabic + all Pakistani regional languages): sticky chip bar (EN/Roman Urdu/Urdu/Punjabi/Sindhi/Pashto/Saraiki/Balochi/Hindko/Kashmiri/Shina/Balti/Burushaski/Wakhi/Khowar/Arabic, defaults to the learner language_pref), per-bubble translate with show-original toggle and per(bubble,lang) cache, Translate-all (last 30 messages in ONE batched call), Auto-translate toggle for new AI replies, and Translate-briefing. Reuses the existing batch translate endpoint; NEW API alias POST /api/v1/student/roleplay/translate (JSON body + X-CSRF-Token) for the mobile app.

(1) CYBERSECURITY MASTERY — deep L1-to-CISO track (9 modules/90 exercises, group cym, SDG 8+16), grounded in current cert landscape (Security+ V7 now, V8 expected Nov 2026 with AI-risk coverage — verify-current noted): M1 Foundations & Career Map (three families defense/offense/GRC, Pakistan market honestly: SBP-mandated bank SOCs, PTA/SECP, MSSPs, remote export roles) · M2 Networking & OS gate (TCP/IP, DNS, firewalls, Windows/Linux security) · M3 SOC Analyst Bootcamp (triage tiers, log reading, SIEM vendor-neutral, phishing header analysis, escalation, handovers, first 90 days) · M4 Threats & Attacks (ransomware playbook, BEC/CEO fraud, OWASP Top-10 plain, kill chain + MITRE ATT&CK) · M5 Defensive Tooling (SIEM queries, EDR, Wireshark/Nmap labs, Nessus triage, CIS baselines, 3-2-1 backups) · M6 Ethical Hacking (AUTHORIZATION FIRST + PECA framing, PTES, Burp, SQLi/XSS/IDOR labs, CVSS, reporting, bug bounty from Pakistan) · M7 GRC & Frameworks (ISO 27001 walkthrough, NIST CSF, SBP ISMS, SECP/PTA, risk registers, SOC 2) · M8 Cloud & Modern (shared responsibility, IAM, containers, zero trust, AI-era threats incl. prompt injection + deepfake fraud) · M9 Career/Certs/Home-Lab (cert ladder honestly with costs, home lab on old laptop, TryHackMe/HTB, SOC interview prep, CISO track, remote arbitrage). Plus cyber-pro pack (6 scenarios: 2AM alert, CEO fraud during Eid, scan-without-authorization, auditor log gaps, family ransomware, insider exfil) + 10 cyber_careers cards + phish-analyzer and home-lab-roadmap tools. Nav: Cybersecurity Mastery added (12 items, All-16 label). (2) SDG DRILL-DOWNS: /sdg target counts now clickable — /sdg?target=4.4 lists 24 aligned scenarios (title/type/difficulty/preview) each linking to practice; goal-card scenario badges now link to /student/roleplay?sdg={id}; back-to-targets navigation.

(1) /sdg REBUILT as the donor-facing impact page: outcomes hero with LIVE platform numbers (451 approved learners, women % live, 7,600+ completions, 47 certificates, 44 districts, 8,600+ scenarios, 51 professions), 8 PRIORITY SDG TARGETS with UN codes/indicators/platform-alignment statements and keyword-derived aligned-content counts (4.3, 4.4 ICT skills 4,645 scenarios, 5.5 women, 8.5, 8.6 NEET, 8.8 safe work, 10.2 inclusion, 17.17 partnerships), all-17-goals grid retained, published METHODOLOGY note (transparency: keyword-mapping approximation, self-reported demographics, refreshed per page load), partner CTAs to SDG Practice track and /ai-economy. New Sdg::TARGETS const + targetCounts(); /api/v1/public/sdg now returns targets + live outcomes for mobile. (2) NAV rearranged: Mastery section 17 items trimmed to 11 (Hub, All Professions, 8 flagship tracks, All-15 link) — everything remains reachable via the hub which lists all 15 tracks with progress. (3) /tracks page GROUPED: the 24 mixed training tracks now split into Mastery Tracks (12) and AI Career Tracks (12) with section headers; mobile /tracks grouped the same way. (4) MOBILE (m.maahir.io, separate commits 936d0f0/86aedee): new /mastery hub screen (15-track grid), new /build-defense viva screen (start/chat/verdict/sessions against the live API), me-page Mastery link — tsc+build+qa pass, smoke 153/153.

The freelance knowledge that was scattered (277 scenarios, 426 MCQs, 25 cards, Playbook tools) now has a structured ladder. NEW TRACK Freelance Mastery (8 modules/80 exercises, group flm, SDG 8): M1 Mindset & Niche (hybrid path, 3-month rule, 12 high-demand Pakistani niches) · M2 Rates & Getting Paid in Pakistan (rate formula, hourly/fixed/retainer, Payoneer vs Wise vs Deel, filer + IT export basics, PSEB registration) · M3 Upwork & Fiverr Deep (JSS protection, connects economy, 20/10/5 fees, sub-200-word proposals, gig SEO, seller levels, first-5-reviews strategy) · M4 Beyond the Big Two (Toptal 5-stage vetting, Contra 0%, PeoplePerHour/Guru/99designs, Turing/Deel/Remote stable roles, specialized platforms by skill) · M5 Winning Clients Off-Platform (LinkedIn connect-engage-offer, cold email + cadence, local PK businesses, first-10-clients ladder, referrals) · M6 Professional Operations (contracts, 30-50% deposits, scope-creep change orders, late-payment ladder, difficult-client scripts, time tracking) · M7 Growth: Rates to Retainers to Agency (raise scripts, project-to-retainer conversion, firing 80/20 clients, subcontractors, white-label, SMC upgrade, cross-links Entrepreneurship Mastery) · M8 Products & Content Income (digital products on Gumroad/Etsy/Envato, mini-courses, YouTube monetization Pakistan CPM reality, affiliates, Preply/iTalki tutoring, services-fund-products honesty, cross-links Entrepreneurship). Plus freelancer-pro mini-pack with 6 scenarios (JSS crash recovery, ghosted-after-delivery escalation, rate-raise conversation, retainer pitch, the 17th scope-creep change, first subcontractor ethics). Entrepreneurship Mastery unchanged (Option A) with bidirectional cross-links in M7/M8. Mastery hub now 15 tracks.

Operationalizes the national AI agenda as training. NEW TRACK Pakistan AI Economy (7 modules/70 exercises, group aiem) — one module per pillar: M1 AI Adoption & Productivity in IT Companies (adoption ladder, honest productivity metrics, pilot-to-scale, PKR budgets) · M2 AI Products & Agentic AI (exportable products, moat vs thin wrapper, agents = LLM+tools+loop, MCP basics, build a simple agent, pricing) · M3 Responsible & Secure AI Governance (bias/hallucination/IP risk, PECA + GDPR duties, company AI usage policy, prompt injection, human review gates) · M4 AI Skills & Industry-Academia (skills gap map, FYP-to-startup, internships, curriculum co-design) · M5 AI Use Cases for Global Industries (healthcare, fintech, cybersecurity, BPO, software engineering — anatomy, data, first project, failure modes) · M6 International Customers, Investors & Partners (export ladders, Built-in-Pakistan positioning, investor metrics for AI, cloud/model partner programs, GITEX) · M7 Pakistan as Global AI Hub (honest strengths/gaps, India/Bangladesh/Egypt lessons, personal 5-year plan). Plus 6 scenarios (team refuses AI, agent goes rogue, GDPR client call, FYP startup mentorship, hospital board pitch, investor moat question), 10 ai_economy cards (7 pillars one-card, adoption ladder, agentic AI, prompt injection, PECA vs GDPR, FYP checklist, use-case anatomy, export channels, moat thinking), 2 tools ai-adoption-auditor + agent-designer. NEW PUBLIC PAGE /ai-economy: the 7 pillars with live platform stats, each linking to its module + related packs (software-house-pro, exhibition-pro, systems-builder) + Build Defense — the page for partners and policymakers. Mastery hub now 14 tracks; nav additions.

Four parallel builds. (1) BUILD REAL SYSTEMS WITH AI track (9 modules/90 exercises, group buildm): Think Before Prompt, Data First, guided builds — E-Commerce (COD/JazzCash), CMS, Booking/POS/Inventory, ERP-lite (school/clinic/HR), AI-Powered Apps (OCR/Urdu honesty, image tools, voice/IVR, chatbots), Ads & Social Systems (ROAS tools, schedulers, dashboards), Ship-Secure-Price + systems-builder pack (6 scenarios: simple Daraz client, Urdu OCR promise, rude 3AM bot, ROAS promise, auth-check audit, 2AM data loss) + 14 system blueprint cards. (2) BUILD DEFENSE interactive AI cross-examiner: new build_defense_sessions chat flow (tutor-pattern multi-session), 11 system types with ~15 Pakistani-context seed questions each, ONE escalating question per turn (8-10 rounds), per-answer evaluation with score chips, verdict with understanding score /100, AI-dependency risk, gaps, next-study links into the track; web page + toolbox banner; wired for mobile via API. (3) COMMUNITY IMPACT & DIGITAL SYSTEMS track (7 modules/70 exercises, group comim, SDG 2/4/17-mapped): community development foundations, Kitchen Gardening Pakistan — regional season/city calendars (Punjab, Sindh/Karachi, Potohar, KPK-north, Balochistan; 4 sowing windows; fruit zones), garden practice (rooftop/compost/bottle-drip), building garden communities, digitize-the-community (cross-links Build Systems), Surveys That Matter (KoboToolbox/ODK, school/WASH/IT surveys), Data-to-Impact (M&E, donor reports) + community-organizer scenarios (6) + 10 community_gardening cards + tools garden-planner-pk (hand-written regional calendar) and survey-designer. (4) SDG & DEVELOPMENT PRACTICE track (7 modules/70 exercises, group sdgm): SDG foundations (goals-targets-indicators), How Donors Actually Work (World Bank/ADB/GIZ/JICA/UNDP/USAID/FCDO Pakistan priorities + instruments), project design (logframe/Theory of Change/results frameworks), M&E, Maahir own SDG story (4.4/4.3/5.5/8.5/8.6/8.8/10.2 mapping with learner evidence), Writing for Donors, Partnerships & Compliance (CSO registration, due diligence, safeguarding/PSEA) + development-practice scenarios (6) + 10 sdg_practice cards + tools sdg-mapper and logframe-builder. (5) Batch card UX: profile now always shows batch state — Move card (non-default), current-batch confirmation (default), not-in-batch. Platform: 13 mastery tracks, 50 packs, 137 tools, +24 micro-card skills.

Part 6/7 of the v1.6 master reference. EXHIBITION-PRO PACK (Part 6.16 built in full): 12 trade-show scenarios (3-second stand rule, BANT qualification, 90-second pitch, demo failure recovery, Pakistan Pavilion at GITEX, Ramadan stand hours, golden 48h follow-up), 3 tools (stand-pitch-builder, lead-capture-sheet with hot/warm/cold scoring, expo-budget-planner with cost-per-lead), 10 exhibition_skills cards incl. regional etiquette and Carnet ATA. LIFE-SKILLS LIBRARIES (Part 6): 40 micro-cards across 4 new skills — remote_jobs 10 (WeWorkRemotely/Remotive/Himalayas/Turing/Deel, Loom intros, Payoneer vs Wise), personal_finance_deep 10 (emergency funds, mutual funds from PKR 500, National Savings, PSX basics, scam spotting), freelance_platforms 10 (Upwork connects/JSS/fees, Fiverr gig SEO and levels, Toptal, Contra 0% fee, specialized platforms), business_risk 10 (7 risk types, reversible decisions, client concentration, udhaar credit risk). OVERSEAS LICENSING (Part 7): 6 pathway scenarios (PLAB decision, fake recruiter refusal, attestation chain, contract changed at airport, NCSHIFT nights, reintegration) + 10 overseas_licensing cards (USMLE, PLAB/GMC, Gulf Prometric, NCLEX, IELTS vs OET, attestation chain, Bureau of Emigration verification, contract checklist, red flags, RDA) — all verify-with-regulator framed.

Executed the Master Industry & Role Track Reference architecture. FOUR new mastery tracks completing Phase 1 + Data (Phase 2): FINANCE & ACCOUNTING MASTERY (6 modules/60 exercises, L1-L5 ladder: bookkeeping → AP/AR+bank recon+FBR tax → financial statements → tax & compliance Pakistan → management accounts → systems+ACCA/ICAP career; +6 accountant scenarios incl. the missing Rs 200k ethics, FBR notice; +2 tools recon-checklist, monthly-close-planner; +10 finance_skills cards). OPERATIONS & ADMINISTRATION MASTERY (6/60, the social-mobility flagship: office foundations → admin engine room → SOPs & process → facilities & assets → vendors & procurement → ops leadership COO track; +6 scenarios; +2 tools sop-writer, vendor-comparison-matrix; +10 operations_skills cards). ENTREPRENEURSHIP MASTERY (6/60, L1 side-hustle → L5 serial: idea validation → SECP/FBR legal setup → money discipline → first customers (WhatsApp/Daraz) → first team & systems → scale/invest/exit; +6 founder scenarios; +2 tools validation-sprint-planner, founder-cash-calendar; +10 cards). DATA & ANALYTICS MASTERY (6/60: Excel bootcamp → analyst thinking → SQL for everyone → dashboards Power BI/Looker → statistics without tears → Python & career with PKR salary honesty; +6 data-analyst scenarios; +2 tools kpi-selector, analysis-brief-builder; +10 data_skills cards). INDUSTRY LIBRARY (Part 1 of the reference, public and SEO-indexed): new industries table with 39 verticals across 10 sectors (tech 5, healthcare 4, finance 4, commerce 4, built 3, energy 4, creative 4, hospitality 3, education 4, public 4) — each with overview, key departments, dominant roles, Pakistan context and AUTO-LINKED practice content (role-play scenario matching, MCQ category counts, profession packs). Public /industries + /industries/{slug}. Pack-to-track links wired (accountant→finance, front-office→operations, founder→entrepreneurship). Mastery hub now 10 tracks. Nav: Mastery section 11 items, Industries in Discover.

Built from an enterprise functional matrix blueprint (9-track org: governance, revenue engine, product/QA, people ops, workplace services). FOUR additions: (1) CEO & Leadership Mastery Module 8 The C-Suite Map (10 exercises: CEO vision/M&A sign-off, CTO tech-debt governance, COO operations standardization, CFO capital allocation + multi-currency, CMO inbound engine, CLO compliance GDPR-SOC2-style + MSA review, decision rights, revenue org BDR->AE->Solutions Engineer->Account Director, paths into the C-suite, 150-person capstone) + 6 exec scenarios + 6 exec cards — track now 8 modules/80 exercises. (2) front-office-pro pack (12 scenarios: early VIP arrival, boardroom conflicts, contract runs, angry walk-ins, confidentiality, courier chains, career ladder office assistant->admin officer; 3 tools visitor-log-manager, meeting-room-planner, office-supplies-tracker; 10 office_pro cards). (3) facilities-pro pack (12 scenarios: load-shedding changeover, server-room HVAC, monsoon leaks, biometric failures, surveillance ethics refusing employee-monitoring, fire drills, generator fuel math, vendor management; 3 tools maintenance-scheduler, emergency-preparedness-planner, asset-log-builder; 10 facility_pro cards). (4) it-support-pro pack (12 scenarios: provisioning kits, phishing first response, everyone-is-admin lockdown, WhatsApp-to-ticket-system, backup rehearsals, helpdesk->sysadmin path; 3 tools ticket-triage, onboarding-it-checklist, incident-first-response; 20 cards — it_support 10 + enterprise_tools 10 covering Jira/Confluence/Figma/Slack/HubSpot/ServiceNow/Workday/Deel/Notion/Google Workspace, the tools named in Pakistani job postings). Platform: 47 packs, 121 tools, 8,494 scenarios, 740 micro-cards.

Research-grounded (software-house body of knowledge: service vs product vs freelancer vs staffing agency, 4 engagement models, credibility signals, 5-phase engagement, severity-tiered SLAs) build-out of the software-house career. ONE new profession pack: software-house-pro 🏢 'Software House Pro — run one, work in one, or hire one' (SDG 8, sort_order 44 — 44 packs total) with 12 hand-written Pakistani-context scenarios (Lahore/Karachi/Islamabad houses, PKR + USD deals, WhatsApp culture, P@SHA-aware): which-model-fits (T&M vs fixed steering), two-week MVP promise reset, sprint demo disaster recovery, change-request pricing, dedicated-team renewal defense with metrics, augmentation without a client tech lead, case study legal veto, screening a red-flag prospect, legacy modernization autopsy (rewrite vs strangler), SLA severity tiers, BA/PM/QA/senior-dev career fork, mid-project key-dev resignation continuity. profession_tools +3 (112 active total): engagement-model-selector, discovery-brief-builder, sla-draft-generator. micro_cards +10 under NEW skill_key software_house_ops (what a software house is, 4 engagement models, 7 roles, 5 phases, Pakistan-vs-offshore-vs-onshore rate benchmarks with honest $15-40/hr export context, vendor red flags, credibility signals, first-call prep, SLA tiers, fixed-vs-T&M tradeoff) — and software_house_ops IS added to the web SKILLS registry (MicroLearningController, group Business) unlike some earlier DB-only waves. Hard requirement honored: all strings English/Latin only — the seed carries a CJK guard (preg_match on U+4E00-9FFF, U+3040-30FF, U+FF00-FFEF) that dies before any write if violated. Seed self-verification: 5/5 checks.

Research-grounded (sales-engineering body of knowledge: consultative selling, ROI quantification gain-A-over-B-years-for-cost-C, POC discipline, SoW proposals) build-out of IT sales careers. TWO new profession packs: it-product-sales (12 scenarios — Hafeez Center price wars, PPRA bank tenders, OEM partner tiers, license renewals, RMA ethics, counterfeit alert, cloud-vs-server honesty; 3 tools tender-bid-checklist, license-renewal-tracker, spec-vs-budget-fit; 10 micro-cards it_product_sales) and it-services-sales (12 scenarios — scope-creep invoice standoff, fixed-price trap, AMC renewal, overseas clients, RFP go/no-go, pilot ladder, burned-CTO trust; 3 tools sow-draft-builder, pilot-proposal-writer, discovery-call-planner; 10 micro-cards it_services_sales). Sales Mastery extended to 10 modules / 100 exercises: M8 IT & Tech Sales, M9 New Business Hunting — How to Grab Business (100-account hunt lists, 21-day multi-channel cadence, first-meeting framework, trigger events, referral systems, chambers/expo networking), M10 Industry Sales Playbooks (pharma detailing, real estate, insurance+takaful respectfully, banking, automotive, edtech admissions, industrial B2B, FMCG trade, Daraz/foodpanda). Plus hunt-list-builder tool. Platform: 43 packs, 102 tools.

Every mastery track extended to 7 modules x 10 exercises (70 each, 420 total mastery exercises) after body-of-knowledge gap research. SALES +M6 Sales Operations & Forecasting (pipeline math, comp plans, territory, RFP/tenders, forecasting) +M7 Retail/Field/Channel Sales in Pakistan (FMCG beat plans, distributor management, merchandising, udhaar credit, Ramadan trade) +5 scenarios (forecast meeting, distributor exclusivity, udhaar recovery, shelf wars, kickback ethics) +forecast-builder tool. MARKETING +M6 Brand/PR/Traditional Media (brand architecture, press releases, TV/OOH mix, activations, agency management, crisis PR) +M7 Research/Insights/Product Marketing (budget research, focus groups, SEC segmentation, pricing psychology, Urdu copywriting) +5 scenarios +campaign-360-planner tool. CEO +M6 Governance/Legal/Deals (board duties, shareholder agreements, SECP, JV/M&A, IP) +M7 Family Business & CEO Operating System (three circles, succession, professional managers, weekly rhythm, decision journal) +5 scenarios +governance-checklist tool. PM +M6 Agile/Scrum/Tools (ceremonies, story points, Jira/Trello/Asana, hybrid contracts) +M7 Stakeholders/Budgets/Programs (RACI, sponsors, earned value, procurement, change management) +5 scenarios +stakeholder-mapper tool. SMM +M6 Paid Social & Influencer Management (Meta Ads structure, PKR budgets, ROAS benchmarks, influencer rates/contracts, fake-follower detection) +M7 Community/Crisis/Agency Craft (trolls, viral comment crisis, WhatsApp commerce, retainers, client onboarding) +5 scenarios +ads-budget-splitter tool. Plus 20 new micro-cards and 25 scenarios across the five packs.

Researched the HR body of knowledge (SHRM function model, HRM practice areas) against our HR Mastery track and filled the real gaps. Module 6 Payroll, Benefits and Compliance Operations (10 exercises): payroll cycle PKR, payslip anatomy, withholding tax filer/non-filer, EOBI in practice, gratuity vs provident fund calculations, leave rules, leave encashment, full-and-final settlement, fixing payroll errors, 5-person payroll capstone. Module 7 Employee Relations, Safety and the Wider Picture (10): workplace investigation playbook + evidence/confidentiality, unions and collective bargaining Pakistani context, grievances, workplace safety office+factory, accident first 24 hours, engagement surveys, culture and change, succession planning 9-box, bias-free hiring. Plus 6 role-play scenarios (shrunken paycheck, union committee at the gate, machine-guard incident, survey fallout, leaked 9-box, biased panel), 4 micro-cards, 1 tool payroll-explainer. HR Mastery now 7 modules / 70 exercises; hr-professional pack 18 scenarios; hr_skills 14 cards.

Dedicated Mastery section for full profession lifecycles. SIX mastery career tracks (5 modules x 10 exercises = 300 exercises total): Social Media Mastery (existing), NEW HR Mastery (full people lifecycle: hiring, JD writing, structured interviews, offers + salary negotiation, 90-day onboarding, appraisals, PIPs, harassment response, layoffs, exits, comp benchmarking PKR, people analytics), NEW Sales Mastery (prospecting, SPIN discovery, objections, PKR negotiation, closing, account management, selling to government/enterprise), NEW Marketing Mastery (positioning, Meta/Google/SEO/TikTok channels, copywriting, attribution, Ramadan campaigns, Rs 50k budgets), NEW CEO & Business Leadership Mastery (reading P&L, runway, delegation, annual planning, cash-crisis playbook, board management, succession), NEW Project Management Mastery (charters, WBS, estimation, sprints, scope-creep defense, UAT, retros, PM careers PKR). FOUR new profession packs linked to tracks: hr-professional, marketer, sales-professional, ceo-executive (48 role-play scenarios + 12 AI tools + 40 micro-cards across hr_skills/marketing_skills/sales_skills/executive_leadership); pack track-links wired for all 6 (incl. project-manager→pm-mastery, social-media-manager→smm). NEW Mastery hub page /student/mastery with per-track progress bars, module chips, linked pack role-play counts; NEW nav section with 7 entries + NEW badges. Platform totals: 41 packs, 96 tools, 8,380 scenarios, 636 micro-cards.

Investigated all 16 issues on /status. Found and fixed ONE live production bug: the capstone page (/student/capstone) fataled for every user since 29-Sep — the view referenced CapstoneController without the App\Controllers namespace (4 occurrences: TYPES, ARTIFACTS, XP_AWARD x2); now fully qualified and verified rendering (164KB). All other tickets triaged: 14 solved (transient dev-script errors from content-generation waves — column mismatches already fixed in the scripts, headers-sent warnings from CLI testing) and 6 marked noise (correct validation messages surfaced as issues: duplicate proposal, capstone review state, missing artifacts, CSRF retry, profession-pack 404, user-not-found). Login-difficulty signal (11 in 24h) analyzed: 9 distinct users, max 3 attempts/IP — mistyped passwords, rate limiter working, no brute-force pattern. Status page now shows 0 known issues.

The last mocked mobile screens become real. BATTLES API + MOBILE: /battles rewired to live data (challenge list with states, opponent search over approved students, create/accept/decline, W-L record, top-battlers board) and a new /battles/[id] play screen (live scoreboard you-vs-opponent, per-question countdown, speed-bonus scoring 50/25/10, explanations, finish states). Flow verified end-to-end: create → accept → questions generated → correct+fast answer scored 100 (50 base + 50 speed), wrong+slow 0, duplicates rejected. DAILY CHALLENGE API + MOBILE: /challenges rewired to the real daily challenge (shared date-seeded 5 questions, streak/best/total-today stats, timer, graded result with points; JSON bodies accepted for mobile, state endpoint added; fixed challenge_results column mismatch). SDG: new public GET /api/v1/public/sdg (17 goals with scenario+module counts) + mobile /sdg page with per-goal bars. CV PDF: GET /student/cv-builder/download renders the real CV paper and prints it to PDF server-side via Playwright/Chromium (scripts/print_pdf.js) — branded, clean A4, works from mobile where window.print does not.

Four job-landing features. (1) JOB-READY CHECKLIST: 6-step ladder (Profile Ready → Skills Assessed 3+ → Practice 10 MCQ/20 roleplay → Interview Ready 1 mock → Applied Somewhere job/works/showcase → Proven capstone/certificate), every step verified against real activity tables, dashboard progress strip with step chips + progress bar, dedicated page with per-step progress bars and Go buttons, nav entry with NEW badge. (2) MOCK INTERVIEW FULL REPORT: printable per-question breakdown (question, your answer, score pill, strengths, improvements, improved model answer) with overall band verdict and Print-to-PDF — at /student/mock-interview/report/{id}. (3) ALUMNI DIRECTORY: public /alumni listing HERO graduates (approved capstone + public profile enabled) with capstone titles, certificate counts, verifiable Skills Passport links; employer CTA to talent portal. (4) WEEKLY DIGEST UPGRADE: each student email now includes a job matched to their profession from the job board + one concrete next-step tip derived from their job-ready checklist gaps.

Full removal of the v11.43.0 Chinese-for-Work feature: deleted 12 chinese_for_work micro-cards (+ any progress rows), 10 chinese_language roleplay scenarios, 3 chinese-workplace idea-library entries; reverted the chinese language option from registration, Roshni Chinese persona + CJK auto-detect, and the chinese->zh mapping; reverted CJK-guard exemptions back to cross_cultural only; seed script removed. Platform returns to the English-first content policy: 8,332 roleplay scenarios, 596 micro-cards, 106 ideas, 53 skill groups visible in micro-learning. Leak sweep clean (2 intentional cross-cultural keeps).

Chinese joins the platform as a first-class language: registration now offers 中文 (Chinese — with pinyin); Roshni replies in Simplified Chinese with pinyin + English gloss per sentence for learners; auto-detection recognizes Chinese input; MultilingualHelper maps chinese→zh. New learning content (characters are INTENTIONAL teaching payload, exempted from the CJK leak guard via skill markers): 12 micro-cards chinese_for_work (greetings, self-introduction, numbers/prices with the 万 10,000-unit trap, CPEC site vocabulary incl. 辛苦了, business dining etiquette, workplace requests, WeChat basics incl. 收到 acknowledgment, client meetings, time/deadlines, directions, supplier negotiation, 6-month HSK learning path); 10 hand-written roleplay scenarios tagged chinese_language (CPEC first day with Chinese site manager, WeChat supplier price negotiation, delay update to Chinese director, client dinner toasts, bilingual factory floor, bilingual-bridge raise negotiation, hosting Chinese investors, WeChat group mishap with face/guanxi dynamics, ordering at a Sichuan restaurant halal-safe, Urdu-Mandarin language exchange); 3 idea-library entries (CPEC translator liaison Rs 30k-80k/mo + allowance, sourcing agent for Chinese imports, two-way Urdu-Chinese tutoring). Platform totals: 8,342 roleplay scenarios, 608 micro-cards, 109 ideas.

The English Tutor previously kept exactly ONE conversation per user per mode — switching modes or wanting a fresh start overwrote history. Now: multiple saved chats per user (last 20 kept). New table english_tutor_chats (id, user_id, mode, title from first message, turns, mistake_patterns). Chats auto-titled from the first user message; per-chat mistake patterns preserved so drilling adapts per conversation. Legacy english_tutor_sessions rows migrate automatically into saved chats on first load (no history loss). Web UI: ＋ New chat button, Saved-chats drawer (mode icon, title, turn count, relative time, delete with confirm, active highlight), instant client-side switching, mode tabs jump to the most recent chat in that mode. Mobile /tutor: same feature set via bottom-sheet (list/switch/delete/new). progress() aggregates across all chats.

Full-platform non-Latin script sweep across 21,700+ content rows (roleplay 8,332, MCQ 4,534, micro-cards 596, exercises 3,370, modules 149, ideas 106, tools 84, packs 37, tracks 14, series 10). Repaired: roleplay #5386 Urdu opening converted to English (respectful-tone scenario keeps Roman-Urdu honorifics Janab/aap as Pakistanis write in business English); exercises #2256 Chinese 隔离→isolation and #2491 举报→report (same MiniMax leak class as v11.38.0 fixes). Intentional multilingual content preserved: cross_cultural guanxi cards (3 Urdu AI-prompting exercises #10/#56/#72 teach prompting AI in Urdu — core Pakistani skill). Final state: 0 accidental non-English rows platform-wide; ContentGovernance CJK guard + generator guards prevent recurrence.

Homepage (play.maahir.io) updated for the first time since the content explosion: hero stats now pull LIVE DB counts (13,400+ practice items = 8,332 roleplay + 4,534 MCQ + 596 micro-cards; 100 AI tools = 84 profession + 16 toolbox; 37 profession packs). New section Real Earnings Not Just Certificates (Maahir Works, Skills Passport, 100 AI Tools cards + verified student earnings line). New section 37 Career Paths One Platform (12 pack chips incl. Project Manager NEW badge + Social Media Mastery track line). What Happens Inside cards updated with live numbers. Mobile companion: m.maahir.io shipped /search (global search page, was API-orphaned) and /me/credentials (Skills Passport wallet with share link, certificates, earnings, badges) — mobile smoke 153/153.

Freelancer platform expansion: 45 AI-generated scenarios — 15 international platforms (PeoplePerHour, Toptal, 99designs, Freelancer.com, Guru, Contra, Kolabtree, ProFinder), 15 Pakistani platforms (Rozee.pk, WorkChest, Mustakbil, HerCareer, FPSC/PPSC, recruitment agencies, job fairs), 15 CLIENT-SIDE scenarios (user plays the hiring client: briefs, proposal evaluation, milestones, managing/firing freelancers, agency vs individual, white-label ethics — previously zero coverage). Plus hand-written: gig economy 12 scenarios (Careem/foodpanda/InDrive surge math, deactivation appeals, rider safety, tax thresholds) + micro-cards gig_economy 10; overseas pathway 10 scenarios (OEP verification, Gulf CV/interviews, attestation chain, embassy help, reintegration) + micro-cards overseas_career 8; remittances 6 scenarios (Payoneer/Wise/RDA, filer basics, hawala avoidance) + micro-cards international_money 6; 6 idea-library entries. All CJK-guarded (zero Chinese). Platform: 8,332 roleplay scenarios, 596+ micro-cards, 106 ideas.

Three parallel waves. (1) DELIVERY-ROLE PACKS: 3 new profession_packs (project-manager 📋, qa-tester 🐞, business-analyst 📊 — 37 packs total), 50 hand-written roleplay scenarios on the client↔PM↔developer triangle (spec translation, mid-sprint change requests, schedule-slip comms both directions, standups, retros, 2 AM incidents, technical debt to business), 10 new profession_tools (sprint-planner, user-story-writer, retrospective-facilitator, stakeholder-report, risk-register, burndown-explainer, test-case-generator, bug-report-formatter, requirements-doc-builder, gap-analysis-matrix — 84 tools total), 20 micro-cards (project_management 10, product_management 5, quality_assurance 5). (2) SOCIAL MEDIA MASTERY: new career track #14 social-media-mastery (📱, pink) with 5 modules × 10 exercises = 50 exercises (Foundations, Content Creation, Platform Strategy, Analytics & Growth, Monetization), 15 roleplay scenarios (algorithm drop, viral crisis, brand-deal negotiation in PKR, Ramadan/Eid content crunch), 4 new social-media-manager tools (content-calendar-generator, hashtag-research-pk, caption-writer, analytics-interpreter), 10 micro-cards (social_media_strategy). (3) JOB-SEEKER TOOLBOX: 4 new Business Toolbox generators in a new "jobs" section (cover-letter ✉️, jd-gap-analyzer 🎯 with fit-% + practice recommendations per gap, salary-benchmark 💵 PKR ranges by city/experience + negotiation anchors, linkedin-optimizer 🔗) — toolbox now 16 tools. Platform totals: 8259 roleplay scenarios, 572 micro-cards, 37 packs, 84 profession tools.

Bug report (room 25): messages saved correctly and appeared on page reload, but the 3-second poll never showed them live. Root cause: the play.maahir.io service worker's fetch handler was cache-first for ALL non-navigation GETs (comment claimed "only static assets" but the code matched everything) — the first empty poll response for a given ?after=N URL was cached by the SW and served forever, so polls never reached the network. Fix, three layers: (1) sw.js now caches only true static assets by extension (.css/.js/images/fonts/manifests, same-origin) — AJAX/JSON/poll URLs always hit the network; CACHE_NAME bumped to maahir-v11.37.1 so stale caches purge on activation; (2) every JSON response now sends Cache-Control: no-store (global json() helper + MultiplayerRoleplayController::jsonOut) — also protects the new GET /api/v1/student/scenario/next from any intermediary caching; (3) poll fetches append a &_=Date.now() cache-buster (room, waiting and spectator loops). nginx serves /sw.js with no-cache so the fixed worker propagates on each client's next navigation.

Mobile quiz flow: the m.maahir.io Practice hub linked to /coach/quiz which 404-ed since launch — page now built (random unattempted scenario, 4 scored options, consequence + lesson + points feedback, session streak). Backend: PersonalityController::getScenario/submitScenario now accept JSON bodies (php://input) as well as form posts via a shared input() helper (csrf_check already honours X-CSRF-Token), and three api/v1 routes expose the flow: GET /api/v1/student/scenario/next (safe idempotent GET, category/difficulty/filter params, returns one unattempted scenario with scores/correct/lesson stripped), POST /api/v1/student/scenario/get (direct fetch by scenario_id), POST /api/v1/student/scenario/submit ({scenario_id, selected_option} → correctness, consequence, lesson, points; full web parity: attempts table, PointManager award, streak, feed item, SRS auto-enroll, parent safety notifications). MCQ library stands at 4534 scenarios.

AI-converted government communication, financial literacy and startup checklist roleplay scenarios into MCQ decision scenarios with 5 dedicated new categories: government_protocols, business_registration, civic_rights, financial_literacy, startup_checklist (plus reuse of money_finance, legal_rights, startup_decisions, contracts_legal). MCQ library grows from 3,696 toward ~4,200; roleplay library at 8193. Also records manifest history for v11.28.0–v11.35.0 (committed to git but previously missing from platform_manifest.json) so the roadmap timeline and mobile sync contract are complete. Facet tags copied from source roleplay scenarios; ContentGovernance review entries queued for every conversion.

Government communication (300 scenarios): DC/secretary meetings, MNA visits, district hierarchy (patwari→tehsildar→AC→DC→Commissioner), SECP/FBR/NTN/STRN registration, SMEDA, Kamyab Jawan/Ignite schemes, PSQCA, EPA clearance, police rights and FIR filing, FIA cybercrime, land records, formal letter writing, protocol etiquette. Startup checklist (240 scenarios) across the 5-point framework: idea validation, market research, customer discovery, value proposition, startup capital, business bank account, accounting setup, financial projections, business structure, insurance, MVP, core team, advisors, digital presence, first 100 users, financial statements. 22 micro-cards: government_protocol (12) + financial_literacy (10). Roleplay library: 8,193.

550 roleplay scenarios covering banking/finance, import/export/supply chain, textile/garment, healthcare deep, agriculture tech, energy sector, telecom, creative writing, photography business, fitness coaching, restaurant/hotel management, travel, interior design, music education, career counseling, executive coaching, mediation, corporate training, grant writing, data science, cloud, DevOps, blockchain, game development.

460 roleplay scenarios (fear calming, AI literacy, adoption stages, one-person startup, vibe coding, WhatsApp AI, GEO, freelancer 2.0, women entrepreneurs, AI ethics/bias/privacy/copyright/deepfake) + 20 micro-cards (advocacy mindset + transformation frameworks).

580 roleplay scenarios: phone/email/WhatsApp etiquette, meeting skills, small talk, networking, managing up/down, office politics, body language, dress code, dining, cross-generational dynamics, feedback, difficult conversations, professional boundaries, assertiveness.

400 roleplay scenarios: board management, CEO transitions, joint ventures, cofounder hunting/vetting/risk appetite/exit, risk management (regulatory, currency, cybersecurity, customer concentration, key person), crisis (PR, data breach, supplier bankruptcy, social boycott), strategy (market entry, merger, budget, restructuring), people (star resignation, toxic executive, remote culture, C-level hiring), stakeholder management, ESG, DEI, down rounds, founder burnout, dignified shutdown. All Pakistani context preserved.

300 new roleplay scenarios (idea validation, MVP, fundraising mechanics, exits, SECP/IP, operations/supply chain/quality/inventory). 10 founder AI tools (equity-vesting-calc, cap-table-sim, runway-calc, tam-sam-som, investor-update, term-sheet-decoder, mvp-scope-cutter, pitch-story-builder, accelerator-application, dignified-shutdown). Founder profession pack (34 packs total). 40 founder micro-cards across 4 new skill_keys (startup_legal, fundraising_mechanics, operations_basics, exit_strategies). Seeded idempotently by scripts/seed_founder_tools.php.

260 new micro-cards (200→460; 2-minute reads, ~130 wpm pacing). 12 new skill_keys (public_speaking, mental_health, money_conversations, client_management, interviews, cross_cultural, pakistani_daily_life, women_workplace, ai_ethics, crisis_management, parenting, startup) plus deepened 16 existing skills to 15+ cards each. Every card is Pakistani-context (PKR, cities, WhatsApp culture).

825 AI-generated MCQ decision scenarios across 20 new categories (public speaking, confidence, teamwork, mental health, money, legal, leadership, cross-cultural, industry sales, HR, parenting, crisis, startup, interviews, English practice, client management, daily Pakistani life, digital safety, women workplace, AI ethics). MCQ library grew to 3,696; combined practice items ~9,054 at the time. All rows carry pakistani_context=1, difficulty spread easy/medium/hard, 4 scored options with consequences, facet tags (skill/context/role/profession/sdg), and ContentGovernance queue review entries.

Wave D profession pack: Startup Founder 🚀 (profession_packs row, slug 'founder', sdg 8, sort_order 34, no track link — 34 packs total). (1) FOUNDER TOOLS: 10 new profession_tools with profession_tag='founder' (70 tools, 36 professions total): equity-vesting-calc ⚖️ (splits + vesting + cliff/leaver scenarios), cap-table-sim 📊 (2 rounds + ESOP dilution table in plain English), runway-calc ⏱️ (runway, break-even, PKR cut list when runway < 6 months), tam-sam-som 📏 (Pakistani market sizing with visible calculation logic), investor-update 📧 (sub-300-word monthly update with metrics table), term-sheet-decoder 🔍 (plain-English clause-by-clause + red flags + lawyer-review disclaimer), mvp-scope-cutter ✂️ (ruthless cut to 3-5 features with add-back timing), pitch-story-builder 🎤 (hook-villain-hero script, English + Roman Urdu), accelerator-application 🚀 (Nest I/O / Plan9 / NIC style with Pakistani market numbers), dignified-shutdown 🏳️ (2-4 week plan, scripts for employees/users/investors/vendors, Pakistani severance basics). (2) FOUNDER SCENARIOS: 5 hand-written roleplay_scenarios, profession_tags=['founder'], role_tags=['founder'], sdg_tags=[8] — The 2 AM Cofounder Call (teamwork/hard), Choosing Between Two Investors (negotiation/hard), Telling Your Parents You Left Your Job (communication/medium), The Customer Who Wants to Pay But You are Not Ready (boundaries/medium), The Competitor Copy Decision (resilience/hard). (3) FOUNDER MICRO-CARDS: 40 hand-written cards in 4 NEW micro_cards skill_keys (10 each): startup_legal (SECP structures, IPO trademarks, founder agreement, IP assignment, PECA, bank accounts, NDAs, NTN/STRN/filer, employment + EOBI, LOIs/MOUs), fundraising_mechanics (pipeline math, term sheet's 7 clauses, pre/post-money, dilution math, liquidation preferences, SAFEs vs notes, pipeline CRM, warm intros, data room, investor updates), operations_basics (ops triangle, EOQ + safety stock, supplier evaluation, acceptance sampling, process mapping, Karachi/Lahore routing, SOP 5 elements, 10x scaling breaks, vendor lock-in, 70% cost-cut rule), exit_strategies (acquisition vs acqui-hire vs merger, timing signals, 12-month diligence checklist, earn-outs, team/user comms scripts, final investor letter, asset sales, acquisition vesting, life after exit) — 500 micro_cards total. No new routes/controllers/tables: content rows only, surfaced by existing pack/tool/micro endpoints and pages. New skill_keys are DB-seeded like the v11.21 mega-wave skills (web SKILLS-registry grid unchanged).

Four new practice formats. (1) BRANCHING STORIES: branching_stories/nodes/options + branching_progress tables; BranchingController (index/play/choose) at /student/branching — choose-your-adventure with typed endings + lessons, endings-found tracking, +3 XP per new ending, +10 XP all-endings bonus, path backtracking ("Try a Different Path" rewinds to the last decision node); 10 hand-written stories seeded. (2) TIMED CHALLENGES: roleplay_scenarios.time_limit_seconds column; TimedChallengeController at /student/timed — same chat engine as role-play plus a countdown bar/clock (red pulse <10s), auto-submit on timeout via force_end (empty drafts record a timeout placeholder), ⚡ +5 XP speed bonus when finishing with 30%+ remaining (time_remaining posted by the client and validated server-side against the scenario limit); 20 scenarios seeded (5×30/60/90/120s); JSON twin on the start endpoint for mobile. (3) REVERSE ROLE-PLAY: roleplay_scenarios.is_reverse column; /student/roleplay/reverse lists 20 scenarios where the user plays the difficult character and the AI plays the Pakistani freelancer/employee — respond() builds an INVERTED system prompt (stay professional, handle demands, evaluate the user on realism-as-difficult-character + testing thoroughness); the session view shows a 🔄 Reverse badge + role-flip hints; transcript labels swap accordingly. (4) SCENARIO CHAINS: scenario_chains + scenario_chain_steps tables; ScenarioChainController (index/detail/completeChainStep) at /student/chains — ordered 5-step storylines with recurring characters (Ahmed, Sitara, Bilal, the Daraz store, first-job 90 days), steps unlock strictly in order, full completion awards +15 XP once + notification (wired into respond() alongside series completion); 25 new linked scenarios + 5 chains seeded. Nav: 4 new Practice entries (Branching Stories 🧭, Timed Challenges ⏱️, Reverse Roleplay 🔄, Story Chains ⛓️) with NEW badges until 2026-10-13. Verified: php -l clean, seeds idempotent, smoke 9/9, CLI suite scripts/test_format_innovations.php 17/17 (branching play-through incl. backtrack + no-double-XP, timed force_end + speed bonus + timeout placeholder, reverse inversion with real AI, chain locking/order/completion bonus, zero points-ledger drift before and after cleanup), HTTP routes 302-auth-gated on play.maahir.io.

scripts/generate_wave4_hr_legal_culture.php (NEW, sharded wave-1 pattern, roleplay_scenarios): 14 topic-groups x 10 = 140 AI-drafted, deduped, governance-audited roleplay scenarios. HR deep (+50, type communication/ethics/career): hard HR outcomes with dignity (negative review of long-tenured employee, layoffs/severance, promotion denial, PIP), harassment & discrimination (victim-side reporting, HR-side investigation, gender/age/regional bias), managing friction (senior-employee mediation, toxic high-performer, Gen Z generational gap, invisible remote employee), awkward conversations (hygiene, chronic lateness, damaging social posts, romance disclosure, substance abuse, competitor moonlighting), HR-side career talks (star exit interview, returning-mother flex work, HR-side salary negotiation) — skill difficult_conversations/leadership/empathy/conflict_resolution, context workplace, role manager, sdg [8,5]. Legal system (+40, type communication/negotiation/career): FIR filing, traffic stop rights, raid/search rights, false complaint, bail; civil court plaintiff, witness, legal notice, cheque bounce S.138, consumer court; landlord-tenant, encroachment, property transfer, guardianship, child custody; SECP registration, court marriage, NADRA CNIC, FBR notice, workplace injury — skill legal_awareness/rights_advocacy/official_communication, context daily_life, sdg [16]; every legal description carries the disclaimer \u0027For educational purposes. Always consult a qualified lawyer.\u0027. Cross-cultural China/CPEC (+30): Alibaba sourcing & face culture, payment terms/guanxi, quality disputes, CPEC engineer communication styles, Pakistani-reporting-to-Chinese-manager, work-culture misunderstandings, relationship-first partnerships, delegation hosting/protocol/gift-giving, investment-committee proposal, business-dinner etiquette — skill cultural_intelligence/negotiation/business_communication, context business, role founder+professional, sdg [8], region_tags [china] (first region-tagged roleplay set since wave 1 GCC/US/UK/EU). Parenting & Eldercare (+20): online safety with a 10-year-old, teen screen time, peer pressure, alternative career path, financial limits; role-reversal eldercare talk, sibling care disputes, divorce impact on children, doctor refusal, career/presence balance — skill family_communication/empathy/boundaries, context home, sdg [3,4]. Ops: generator supports resume (skips topic-groups already at 10 via content_governance meta tally); run max 3 shards (AI provider concurrency limit). INCIDENT NOTE: a parallel session ran 3 sibling wave-4 generators concurrently (generate_wave4_mental_public/interview_sales/teamwork_money, ~460 rows, separate scopes with their own tags) against the single-operator rule; this session killed its own shards, waited for drain, then reran with exclusive logs (wave4_hlc_s*.log) — no duplicate titles across all 170 overlap-tagged rows. roleplay_scenarios 3,133 -> 3,273 from this script.

PART 1 — MultiplayerRoleplayController gained a MOBILE API v1 section (apiCreate/apiJoin/apiRoom/apiSend/apiPoll/apiEnd/apiCancel) wired into public/api_v1.php under /api/v1/student/multiplayer/*: 6-char room codes from the unambiguous alphabet, atomic guest-claim join (status waiting→active), 2000-char capped messages, 3-second polling with after={message_id} + opponent_online presence (last_active_at < 5 min), end-by-both-players handshake via END_MARKER messages with AI judging on communication/persuasion/problem_solving/professionalism (0-100 each + overall), ai_scores + winner_id stored, 15 XP each + 10 winner bonus (base points; PointManager multipliers still apply), cancel with opponent notification. The web endpoints keep their exact response shapes; the shared judge prompt now emits the four criteria fields (web result panel continues to use overall score/strengths/improvements). PART 2 — MaahirWorksController::suggest(userId) ranks up to 3 open projects (excluding ones already proposed on) by matching skills_needed against the student's top-5 skill_xp keys, professions from completed ai_roleplay_sessions→roleplay_scenarios.profession_tags, and their user_onboarding_goals earn goal (light stemmer: writer≈writing); exposed as GET /api/v1/student/works/suggest (admins may pass ?user_id=), rendered as a 🎯 Recommended for You card row above the project grid on /student/works, plus an admin POST /api/v1/admin/works/auto-match that notifies the best-matching (score ≥ 10) student who has not proposed per open project (idempotent per project+student via activity_log). Verified end-to-end: CLI create→join→4-msg chat→poll→both end→real AI verdict (winner=guest, criteria scores), base XP 15/15/+10 in points_log with zero ledger drift; HTTP E2E 17/18 (all functional; the points delta note reflects platform random multipliers), auto-match seeded run matched project 3→user 4 (score 24, reason "Matches your top skills: Content Creation, Canva") and a second run matched 0 new.

PART 1 - Impact Analytics: new admin-only page /admin/impact (ImpactAnalyticsController::page -> admin.impact-analytics view) with 4 stat cards (total students, active today/week/month, Rs earned, exercises done), 30-day enrollment trend CSS bar chart, engagement funnel (registered->logged in->first exercise->first roleplay->first earning with step conversion), learning outcomes per batch + avg session scores + module completion bars, earning outcomes by source/batch from student_earnings, SDG 17-goal grid (completions, learners, scenario catalog) + distribution bars, skill growth (top 10 by skill_xp XP + fastest-growing this week from 7-day roleplay skill_tags and micro card completions), at-risk table (inactive 3+ days, batch + last activity + actions). All data from real DB queries; route added in admin-only group next to /student-risk. PART 2 - Kid Entrepreneurship: EarnHubController::paths() gains 7th path kid_earning 'Kid Creator' (5 manual steps, pocket-money est) with age_tier gating - children see only kid_earning, non-children never see it (pathsWithStatus 3rd param + toggleStep 403 on cross-tier); earn.php hero swaps copy for kids; scripts/seed_kid_scenarios.php seeds 10 kid roleplay_scenarios (consent-aware YouTube pitch, family-dawat art sales, shop price-list digitization, scam spotting, ask-before-download, stranger-info defense, cyberbullying disclosure, savings goal, password secrecy, first business report) with difficulty easy, context_tags [education,home], role_tags [student], sdg_tags [4]; idempotent by title. PART 3 - Feedback Boards: new feedback_items + feedback_votes tables (UNIQUE user+item; upvotes recomputed from votes on every toggle so counts cannot drift), FeedbackController page/submit/upvote for students (filter by type+status, sort top/new, one-vote-per-user toggle) and adminIndex/updateStatus triage (open->planned->in_progress->shipped/declined + public admin_response shown on student cards); views student.feedback + admin.feedback-manage; nav: 'Feedback' under student Community + 'Feedback Board' under admin Safety & Support + 'Impact Analytics' under admin Insights; scripts/seed_feedback_boards.php seeds 5 Pakistani-context items with realistic upvotes/statuses; schema record database/migration_feedback_boards.sql. No /api/v1 routes changed.

PART 1 — Global Search: new grouped SearchController::search() (GET /student/search?format=json + GET /api/v1/student/search, min 2 chars, 5 per type, exact→prefix→LIKE relevance, active/published rows only) across roleplay_scenarios, scenario_bank, modules, idea_library, ToolboxController::TOOLS, micro_cards, sahelii_databank, roleplay_series, profession_packs. Full search page resources/views/student/search.php (autofocus input, 300ms-debounced live AJAX, skeleton, quick-filter chips per type, empty state, / hotkey with capture-phase override so it wins over the sidebar nav filter). Old flat universal search preserved as SearchController::legacy() behind /api/search (sidebar dropdown unchanged). PART 2 — Credentials Wallet: CredentialsWalletController (page/public/api) aggregates skill_xp grouped into soft/professional/technical families via MicroLearningController::SKILLS (Novice 0-99 / Practitioner 100-499 / Expert 500-1499 / Master 1500+ with next-level bars), issued_certificates (module certs, /verify/{code}) + skill_certificates (track certs, /verify-cert/{token}), user_achievements, capstone_projects (artifacts done/total), RolePlayController::seriesWithProgress, student_earnings (total + by source), ai_roleplay_sessions stats (sessions/completed/avg/best scenario type), completed assessments, profession-pack practice (JSON_CONTAINS on profession_tags). Views: student/credentials.php (hero + share-link copy + print CSS) and public/credentials.php (noindex, referral-code gated on public_profile_enabled/_forced, zero contact info — verified no email/phone/city in output). Routes: /student/search, /student/credentials, /student/credentials/{code} → 302 /credentials/{code}, public /credentials/{code}. Nav: 'Search' (🔍, top of 📚 Learn) + 'Credentials' (🛂, 🎯 Career) + sidebar 'Search everything →' link; both flagged NEW until 2026-10-13. No DB schema changes — reads existing tables only.

PART 1 — public/why-maahir.php comparison table: removed the Upwork/Fiverr and Rozee.pk columns (9+1 -> 7+1 columns: Capability, Coursera, YouTube, ChatGPT alone, DigiSkills, eRozgaar, IT Academies, Maahir), foreach indices [1..8] -> [1..6], footer note reworded, table min-width 1100px -> 800px so the highlighted Maahir column is visible without horizontal scroll on a 1024px viewport. Verified: 21 rows x 8 cells, zero Upwork/Rozee strings in rendered HTML. PART 2 — scripts/seed_startup_deep.php inserts 40 roleplay_scenarios rows (NOT scenario_bank) covering the full Pakistani startup cycle: pitching/fundraising (12), pricing/business model (10), cofounder/team (10), operations (8); idempotent by title; tags role_tags=[founder], context_tags=[business,career], sdg_tags=[8]. PART 3 — student/learning-guide.php (/student/guide): time expectations rewritten to a flexible model (2-3 hours/day ideal, one module per week at a comfortable pace or faster, all activity types count toward progress, suggested pace not a requirement); rigid DAY 1 / 1-module-per-day schedule softened; MORNING/AFTERNOON/EVENING badges generalized to LEARN/PRACTICE/APPLY. No API routes, auth, or schema changes in this release.

PART 1 — /student/scenarios rebuilt as a server-side faceted browse (same engine pattern as RolePlayController::facetedBrowse): five JSON tag columns added to scenario_bank (skill/context/role/profession/sdg) and backfilled for all 1,826 legacy rows via scripts/backfill_scenario_tags.php (domain→context, category→skill+role+profession maps, tags varchar merged into skills, domain+female→sdg; idempotent — already-tagged rows skipped). PersonalityController::scenarios() now runs facetedScenarios(): skill/context/role/profession/sdg/difficulty/q/page filters (JSON_CONTAINS WHERE builder, 24/page, ORDER BY FIELD(difficulty easy→hard), title), per-facet counts excluding the facet's own filter, age_tier + ?filter= gender scope preserved, legacy $categories/$domainCats kept only as the no-filter 'browse by domain' default state (domain cards click into context filters). View student/scenarios.php replaced with the roleplay-index design: search + difficulty/context/skill(top-15)/role chips, domain-card default state, card grid (scene emoji, difficulty badge, context/role emoji badges, tags, Play →), pagination, empty state, and an in-page MCQ player fed by POST /api/scenario/get which now accepts scenario_id for direct fetch (legacy random-by-category unchanged). New API: GET /api/v1/student/scenarios → {ok, items, facets, total, page, per_page}. PART 2 — Content Wave 3 via scripts/generate_wave3_scenarios.php (sharded, wave-1 pattern, scenario_bank MCQ shape: 4 options {id,text,score 0|3|5|10,correct,consequence}, lesson, scene_emoji, Pakistani context): 350 new scenarios across 35 topics — deepens freelancing(+30), workplace_survival(+20), interview_prep(+20), first_job(+20), critical_thinking(+30), money_basics(+30 incl. halal finance), personal_safety(+20), ethics_dilemmas(+20) and introduces 8 categories: client_communication, startup_decisions, negotiation_daily (life_skills), english_workplace, leadership_basics, remote_work (career), time_management (foundation), digital_marketing (business). Generator inserts curated facet tags at insert time; backfill re-run confirmed 2,176/2,176 active rows tagged. Ops note: AI provider concurrency limit is 3 — run generators with 3 shards max.

Profession Packs Wave C: 15 new packs for hands-on and vocational livelihoods — Auto & Motorcycle Mechanic 🔧, Professional Painter 🎨, Electrician ⚡, Plumber 🚿, Carpenter & Furniture Maker 🪵, Chef & Caterer 👨‍🍳, Beautician & Salon Professional 💅, Professional Tailor & Designer 🧵, Ride-hailing & Delivery Rider 🏍️, Retail & Kirana Shopkeeper 🏪, Property Dealer 🏠, Professional Photographer 📸, Wedding & Event Planner 🎪, Mobile Repair Technician 📱, Construction Contractor 🏗️. Each pack ships 3 hand-written (not AI-generated) Pakistani-context roleplay scenarios — 45 total — covering comeback warranties and counterfeit brake parts, thinned-paint price wars and scope creep, 7/29 wiring refusals and midnight emergency rates, seepage blame games, Pinterest impossibilities and timber inflation, valima guest-count cuts, skin-reaction complaints and midnight bridal changes, designer-dress counterfeits and Eid machine failures, fare dodgers and false suspension appeals, supplier margin squeeze, structural-defect liability and hide-the-defect ethics, wedding-gallery refund demands and uncredited commercial use, venue cancellations 48 hours out, intake-photo damage disputes and half-price refurbished competitors, post-slab design changes, vanished labour and stalled payments. Plus 15 new profession_tools (1 per pack): repair-estimate, paint-quote, wiring-safety-check, plumbing-diagnosis, furniture-quote, menu-costing, salon-price-list, fabric-estimate, trip-log, inventory-sheet, property-listing, photo-package, event-checklist, repair-diagnosis, material-estimate — 60 tools total. Legacy cleanup: 40 old chef/photographer facet-tag rows cleared/stripped so pack pages show exactly their curated scenarios. Nav unchanged — 'Professions' already live under 🎯 Career (roadmap/nav handled in part 1).

New profession_tools table + ProfessionToolController: every profession pack gets 2-3 dedicated AI generators that solve its REAL daily problems (45 tools across 20 professions — the 18 packs plus teacher and accountant; customer-support rounds out full pack coverage). Highlights: lawyer (legal notice drafter, contract analyzer, case timeline), healthcare (patient education Roman Urdu/English, referral letter, clinic SOP), pharmacist (generic finder with PKR prices, dosage card), childcare (lesson planner, WhatsApp parent update), engineer (spec summarizer, site report, BOQ formatter), journalist (fact-check framework that never gives a verdict, headline optimizer), agriculture (crop advisory, mandi analysis), social worker (anonymized case reports, donor impact reports), teacher (report card comments, lesson plans, parent meeting prep), accountant (chart of accounts, FBR tax checklist), plus tools for designer, VA, SMM, translator, data annotation, web dev, content writer, video editor, online tutor and customer support (response templates, de-escalation script, CSAT recovery). Each tool = input_fields JSON schema + Pakistani-context system_prompt in DB (seeded idempotently by scripts/seed_profession_tools.php). Generation engine: POST reads fields per the JSON schema, validates required inputs (422 'Please fill: …'), builds the prompt, calls AI::chatTask('general_chat', max_tokens 1200) with plan-limit gating, saves to existing toolbox_outputs under the tool_key (shared Toolbox history) and logs profession_tool_generated. Wired in three places: (1) profession pack detail page '🔧 Professional Tools' section with modal forms (same pattern as Toolbox hub); (2) Toolbox page new '💼 By Profession' tab with grouped grids — general/profession tabs, both sharing one modal builder with per-tool endpoint base; (3) mobile API. Legal-flavored lawyer tools instruct the AI to prefix learning disclaimers.

New public /why-maahir page (WhyMaahirController + view public/why-maahir.php, no auth): the world's-first Learn→Practice→Earn pitch for Pakistan with every claim backed by a live DB number. Live stats block computes on every request: active roleplay_scenarios, published modules, active micro_cards, idea_library entries, active profession_packs, assessments taken, approved students, SUM(student_earnings.amount_pkr) as total Rs earned, verified student_outcomes, published student_testimonials, and seats left in settings.default_batch_id (same taken-seat formula as the homepage, excluding batch_switches). Page sections: (1) hero with live seat counter + Join Free CTA; (2) The Engine — 5-stage pipeline DISCOVER→LEARN→PRACTICE→PRODUCE→EARN, each card with live count badge; (3) See the Difference — 15-row comparison table across 🎓 Coursera | 📺 YouTube | 💼 Upwork/Fiverr | 🤖 ChatGPT alone | 🎓 Maahir with ✅/🟡/✗ marks (Pakistan context, AI-scored conversation practice, Roman Urdu→Business English, legal rights, regional playbooks, earning ledger, personal opportunity maps, free forever, kids-through-CEOs, conversation arcs, multiplayer, supervised client work, SDG impact, offline PWA, status transparency); (4) Only-at-Maahir wall — 18 unique features each with a live proof metric; (5) six audience strips (student/freelancer/business owner/home business/professional/teen) with 3-step paths; (6) proof section with live stat grid, top 3 verified outcomes (top 5 fetched), top 3 published testimonials, /sdg link; (7) 5-item FAQ accordion; (8) final 'Start free — no credit card, no catch' CTA. SEO: title 'Why Maahir — Learn, Practice, Earn. Built for Pakistan | Free Forever', index,follow, meta description with live counts baked in, OG tags type=website. Links added: public_nav first item, public_footer Platform column, homepage hero CTA row.