🗺️ Product Roadmap

Core LMS: modules, exercises, assessments, certificates, batches, points system, teacher dashboards, assignments, peer reviews, gamification, AI coach, forum, battles, guardian portal, safety systems, email notifications, backups.

AI project consultant, personality profiles, career tracks + certificates, CV builder, mock interviews, job board, talent portal, project showcase, client projects, adaptive quizzes, SRS review, wellbeing suite, battle arena.

POST /student/switch-batch moves student into default batch permanently; switchers excluded from seats quota; 4-week leaderboard quarantine (digest, teacher insights, batch-stats); student+admin notifications.

consultantChat() accepts JSON bodies; frontend sends X-CSRF-Token and reads data.text. Chat was silently broken for all users before this.

Landing page: LIVE batch badge + seats-left (excludes switchers), official start date, 'Join Free' CTAs; all invite wording removed.

Login returns user to intended page (30-min window); partnerships page guests -> /register; dashboard daily_goals duplicate-key crash fixed (INSERT IGNORE).

Batch-overview deep-dive modal + GET /admin/batch-stats/{id} JSON; dashboard/batches/registration-queue linkified; users batch=none filter; 9 broken analytics links fixed.

Every flash error gets ERR-XXXXXX ref logged with context; 'Get help with this' prefills a high-priority support ticket; global exception handler logs URI/IP/user.

Province/institution double-submit data loss fixed (province_other, institution_uni/other field names + server merge); validation rejections logged; scripts/diagnose.php added.

23 required-assignment config rows copied to batch 4 (deadlines cleared); recommended-exercises widget query fixed (order_num<=1001).

No invite code required; all registrations forced into default batch (4, cap 500); auto-approve; seats-left badge; sections 3/4/5/9 required; 20/IP/day rate limit.

log_activity() now demotes non-numeric entity ids to NULL (activity_log.entity_id is INT; quiz start passed a UUID -> 1366 -> 500, user 356). Assessment recommendations now flatten AI career-path objects before strtolower (TypeError -> assessments page 500, user 355). Both marked solved on /status — page back to all-operational. Lesson recorded: exception titles truncate at 120 chars when resolving.

Solved issues removed from /status entirely (clean "All systems operational" state when nothing is open). Exception titles sanitized for the public — no SQL, column/table names, or file paths; shown as "Database error"/"Application error", technical detail visible to admins only. Issues appear automatically as errors happen (cache 120s). Marked leftover test flash as not-a-bug.

All 24 known issue groups pre-marked Solved with accurate notes (fixed bugs vs not-a-bug validations). Status page is now a pure status list. Email capture (notify-when-fixed) moved onto the error message itself — shows with every error ref, pre-fills the logged-in user email, works for guests. Verified e2e.

/status lists known issues live (grouped from error log with counts + first/last seen); users subscribe by email per issue; admin Marks solved inline -> issue moves to bottom Solved section with note and all pending subscribers get a fixed-notification email. Error flash now links to the status page. Verified end-to-end: subscribe -> resolve -> email sent -> moved to Solved.

generateReportCard() query rewrote GROUP BY a.type as MAX(id) latest-row subquery — report card generation 500d for students with assessments (caught live by the new error-alert emails, user 335 hit it 4x).

error_alerts table records every alert email (type, recipients, counts, details, pointer). Heartbeat setting error_alert_last_run proves the 10-min watcher runs. diagnose.php now shows the alert trail + last run. Mail credentials remain in settings (mail_* keys).

Team gets email when users hit issues: instant alert for uncaught exceptions (grouped, max 1/run) + daily 21:00 digest of user-facing errors and registration validation rejections. scripts/cron_error_alerts.php on a 10-min cron, pointer-based, Mailjet via Mailer::sendRaw. Settings: error_alert_enabled, error_alert_emails.

Session lifetime matched to 7-day cookie (gc_maxlifetime 1440s->604800 in fpm+cli; fixes idle logout bounce-outs and most CSRF Invalid-request failures). combined_profiles.assessments_json column added — personality combined-profile save works for the first time. $assessmentTotal dashboard warning (706x) and demo.php correct-key warnings fixed.

UN SDG tagging for modules/tracks/batches with reasons. 17 goals seeded; 221 module + 24 track + 9 batch auto-mappings by category_group. Chips on student module cards + public curriculum/course-detail; detail line "Supports SDG N - reason". Admin matrix at /admin/sdg with bulk group-apply.

Hand-holding earning system: 6 guided paths with auto+manual steps, earnings ledger + aggregate counter, 6-stage freelance playbook with AI gig-writer, AI proposal-writer, 15 reply scripts, negotiation gym (curated roleplay workouts), curated tips library. +50 XP per completed path.

The mobile deploy set wlms_sess2 to SameSite=None; older browsers (Android WebViews, pre-Chrome-76) reject None cookies outright, causing an infinite login-bounce for affected users (real case: user 254 logged in successfully but every next request was guest). None was unnecessary: play./m. are the same registrable domain (maahir.io), so Lax is sent on all subdomain requests AND accepted by every browser. Verified: login -> wizard -> dashboard holds; m.maahir.io proxy + CSRF endpoint still working.

Passwordless one-time login: login page has an email-me-a-link form; clicking the emailed link logs in directly (15-min one-time token), clears any login lock, honors intended-URL return. Lock message now static text offering reset OR magic link (minute-countdown removed — it spawned a new status group every minute). Password reset also clears the lock.

Login lockout now keys on IP + account (shared campus WiFi/CGNAT users no longer block each other), the failure count decays after 30 idle minutes (was: lifetime accumulation), and the block message shows remaining minutes + offers immediate password reset instead of waiting.

Login errors now render INSIDE the login card (red panel) right above the form with a contextual action button (Reset my password / Create a free account) — previously the message only appeared at the top of the page where users missed it. Proactive fix for stuck user: password-reset email sent to the reported account.

500 pages rebuilt: friendly card with Refresh-page button, /status link, back-home link, and an ERR-ref (exceptions now log ref=ERR-XXXXXX) so even hard crashes are quotable/support-traceable. Login CSRF message says refresh-the-page; login Having-trouble box gained a Refresh link.

Every login failure now has a specific, actionable message: empty fields, expired form (CSRF), deleted account (previously deleted users could log in and bounce-loop with no explanation), plus v11.7.3 wrong-password/no-account/pending/suspended. Login card gained a persistent Having-trouble box (reset password / create account / check status).

Login failures now say WHY: wrong password for an existing account (points to Forgot password) vs no account found (points to register) vs pending/suspended (existing specific messages). /status shows an aggregate "N login difficulties (24h)" badge (no accounts exposed) so stuck users like ref ERR-B82E0B are visible without noise-tickets. Also fixed: resolve/noise error_key length guard (VARCHAR 100 overflow on long titles).

A live student failed registration twice with a >255-char institution name (String data right truncated). processRegister now clamps every free-text field to its column size (institution/degree/company/district/etc.) and the form adds maxlength attrs. Verified: 455-char input registers, stored at 255.

Solved issues that recur re-open on /status with "Recurred after solve" badge, prior fix note/date, same ticket number. Timezone-safe epoch resolved_ts. Admin can re-solve or noise-mark (hide forever) — 17 expected-churn classes noise-marked. Also fixed live: /student/teams + team-workspace 500 (bare Auth:: in views, user 365).

Every /status issue now carries a stable ticket number (ISS-XXXXX, deterministic from the issue key). Fixed BattleController:689 and AdaptiveQuizController:406 calling nonexistent Database::lastInsertId() — team creation and AI question-bank saving were 500ing (caught live on /status, user 365). All resolved; page all-operational.

ProfileWizard choice() now returns NULL for invalid/missing enum values (device_type/internet_access "" crashed strict mode — same class as the mobile register bug). /status resolved-map LIMIT raised 50->500 (a marker fell off page 1 and its issue re-showed as open). Mobile takeover: AGENTS.md written in both repos, e2e mobile login verified (bareera account, proxy chain, session persists), leftover sw.js build committed.

Real root cause of the persistent login-bounce (user 254, Firefox/Win, kept failing after the SameSite fix): the mobile deploy changed cookie domain from host-only to .maahir.io, so long-time users hold TWO wlms_sess2 cookies (stale host-only + fresh dot-domain); some browsers send the stale one first and PHP reads it -> authenticated session shadowed -> endless guest loop. Renaming forces ONE clean cookie for everyone (one-time logout for active sessions). Duplicate-cookie detector logs occurrences for confirmation.

External privacy report verified accurate. Forum profiles: guests login-redirected, noindex,nofollow, self-canonical + og:type=profile removed (layout suppresses canonical on noindex pages), city never shown, child-tier profiles 404 for everyone except self/admin, teen noindex. Public project gallery/showcase detail: noindex. Talent portal: permanently excludes child-tier authors + deleted users. Public profile page: child tier can never be public regardless of consent flags. Leaderboard already noindex. Tier-3 (opaque slugs replacing numeric IDs) deferred.

Sdg::chipCss() returned a full <style> element nested inside the modules page style block — the inner </style> closed it early and all subsequent page CSS rendered as visible text. chipCss() now returns bare CSS; standalone call sites (curriculum, course-detail) wrap it themselves. Verified: 1 style block, all CSS inside, chips styled everywhere.

Batch 1 granted all 16 module groups (batches 1-4 now identical full catalog). Batch creation hardened for the future: admin create defaults to ALL groups when none selected; campaign-wizard batches auto-seed the full catalog.

Batch 2 (WE DEL) now has all 16 module groups — freelance_entrepreneur and every specialization accessible (verified live for a batch-2 student via hasModuleAccess). Batch 3/4 already had them; batch 1 intentionally left limited. Batch 4 required assignments: staggered Monday deadlines 4/4/4/4/4/3 across Oct 19 - Nov 23.

cron_welcome_default_batch.php (hourly): welcomes every new default-batch student within 72h of registration (batch name, start date, WhatsApp group, module-1 link) — 69 sent on first run. cron_onboarding_emails.php (daily 10:00): day-1/3/7 lifecycle emails with completion conditions and notification-prefs respect — 2 sent on first run. Dead batch-3 welcome cron (5-min, window-expired since July) removed from crontab.

Three JSON endpoints for mobile: POST /api/v1/auth/forgot-password and POST /api/v1/auth/magic-link (JSON {email}, X-CSRF-Token, anti-enumeration responses, 5/hour/IP+email file-counter rate limit; emails deep-link the WEB reset/magic endpoints — the shared .maahir.io cookie carries the session across both apps) and POST /api/v1/error-subscribe (JSON body with error_ref/error_title naming or classic ref/msg form, CSRF via header or JSON _csrf). /api/v1/status rewritten on a new shared model ErrorNotifyController::collectStatusData() — the web /status page and the JSON API now read the exact same grouping/resolved/recurrence/noise/sanitize/ticket logic (open-only, ISS tickets, login_attempts badge, admin-gated admin_title; resolved-map LIMIT 500) instead of a stale fork that leaked raw exception titles. /api/v1/public/landing gains the live batch announcement (seats exclude batch_switchers, identical to the homepage). mobile_actions: forgot-password-json, magic-link-json, status-v2, landing-announcement — the mobile app should now consume these JSON endpoints natively.

English Tutor: 4-mode AI chat (Free Talk/Drills/Interview/Email) with 📝✅❌💡 coaching block per reply, Roman Urdu input + 'urdu' re-explain, mistake-pattern tracking. AI Guide: /student/ai-guide 'What should I practice today?' — 3 deterministic picks from earn-path progress, roleplay weak skills (<60 avg), English practice staleness, profile state, today's exercises. SkillXP: parallel per-skill XP table (Novice/Practitioner/Expert/Master), auto-awarded on roleplay completion (top-2 skills) and exercise completion (category_group); PointManager untouched.

10 multi-step roleplay story arcs (client journey, interview gauntlet, angry client, first sale, founder journey, deposit battle, raise negotiation, campus-to-career, 2 AI Changemaker consults with 8 new Pakistani-context scenarios 2512-2519). Series list + timeline detail pages, per-step completion tracking, series XP bonus + notification on finishing all steps, mobile API GET /api/v1/student/roleplay/series.

AI-generated via 5 parallel shard processes across 49 topics covering: 7 pitch variants (freelance/startup/small-biz/B2B/investor/WhatsApp/elevator), sales+marketing (cold outreach, objections, closing, viral clients, briefs), operations+support (deadline slips, angry customers, scope creep), startup (cofounder, first hire, investor grilling, pricing pivot), women home business (stitching, cooking, salon, crafts, Daraz disputes, safety), job seeking (technical/HR rounds, salary calls, follow-ups), leadership/CEO (imposter syndrome, promotions, first-time manager, hard conversations, firing, crisis, town-hall, women-in-leadership), campus (FYP defense, group projects), daily life (landlord, bazaar), region-specific (GCC/US/UK/EU client culture). All tagged to skill/context/role/profession/sdg/region facets. Governance queue: 558 rows.

Six JSON tag columns added to roleplay_scenarios and backfilled for all 1,952 active scenarios (skill: type->canonical-skill map + evaluation_criteria keys; context: scenario_bank domain/category join + keyword scan, cap 3; role/profession: keyword scans, cap 3; sdg: derived ints incl. 3 health/4 education/5 home_entrepreneur/8 decent work/10 inequalities/16 justice; region: GCC/US/UK/EU keywords). /student/roleplay reworked as a faceted index (skill/context/role/profession/sdg/region/difficulty/q filters, 24/page, facet counts computed excluding each facet's own active filter — standard faceted search). GET /api/v1/student/roleplay reshaped to {ok, items[], facets{}, total, page, per_page} with per-item tags — mobile: faceted roleplay UI, see api contract + mobile_actions[roleplay-facets]. New content_governance review-queue table (ContentGovernance::queue() insert helper) for the coming AI content waves — admin UI deferred. mobile_actions note: mobile app should rebuild the roleplay section as a faceted browser off the new API contract.

10 profession packs for digital gig careers — graphic-designer 🎨, video-editor 🎬, virtual-assistant 📋, social-media-manager 📣, content-writer ✍️, web-developer 💻, online-tutor 🧑‍🏫, customer-support 🎧 (BPO, huge in Pakistan), translator 🌐 (Urdu↔English), data-annotation 🏷️ (new field). Each pack ships 5 hand-written (not AI-generated) roleplay scenarios — 50 total — with Pakistani context: 17th-revision clients, AI logo price wars, Rs 500 design rates, Daraz-clone budgets, night-shift call centers, per-word translation rates, piece-rate annotation bargaining. Scenarios carry profession_tags=[pack slug], role_tags=[freelancer], sdg_tags=[8] and integrate with the existing roleplay engine (points, AI scoring, series). Pack detail pages cross-link related idea_library entries (profession/keyword match), Saheli guides (keyword match) and micro_cards (skill match).

Wave 2 of the role-play content engine: ~430 AI-drafted scenarios across 43 topics in 9 clusters — finance deep (8: family budgeting, bank loans, payslips, car instalments, recovery agents, JazzCash/Easypaisa setup, compound interest, emergency funds), family dynamics (6: freelancing vs government job, startup support, in-law expectations, sibling in business, marriage vs career timing, explaining online work), kids earning online (5: YouTube pitch with parental consent, crafts selling, shop digitization, tutoring, earnings report — all age-appropriate), education (5: scholarship interview, professor help, thesis defense, recommendation letter, timeline extension), digital life (5: viral mistakes, harassment reporting, content theft, fake accounts, privacy settings), health & wellbeing (4: mental health leave, burnout, midnight-client boundaries, supporting colleagues), English interview practice (5), women re-entry (3), cloud kitchen/franchise (2). Sharded generator with cross-wave dedup; governance audit rows queued. NEW public /sdg impact page: 17 SDG cards (icon, name, scenario count, module count) with Explore links into /student/roleplay?sdg={id}.

200 pre-written 5-minute educational cards across 34 skills: Business English (40: greetings, email craft, negotiation emails, contract language...), 12 soft skills (communication, negotiation, leadership, resilience, confidence, time management, ethics, teamwork, critical thinking, emotional intelligence, networking, problem solving), 10 technical skills (prompt engineering, Canva, Excel, WordPress, digital payments incl. Raast/JazzCash/Payoneer, AI tools, typing, digital literacy, social media, email), 10 daily-life/rights topics (money, tenant/employee/consumer/women's/freelancer rights, cyber safety incl. PECA/FIA, family legal/NADRA, health, daily life). Each card: title, 3-5 sentences of real teaching, one concrete practice prompt, difficulty, est 2-5 min, XP 5/8/10. Daily pick = random incomplete card in the user's most-relevant skill (skill_xp first, then recent module categories, then daily rotation). Completion idempotent via micro_progress UNIQUE(user_id, card_id); awards PointManager points + SkillXP. Web: /student/micro page with confetti celebration, per-skill browse, dashboard widget. Mobile: 4 JSON endpoints.

New Business Toolbox (ToolboxController + /student/toolbox hub) for students: 7 business AI generators (Elevator Pitch with English + Roman Urdu versions, 8-slide Pitch Deck Outline, 3-tier Pricing Calculator in PKR, WhatsApp-ready Quotation + email version, Lean Business Plan canvas, SWOT + competitor positioning, 30-day Marketing Plan, 3-step Payment Reminder Ladder calibrated to Pakistani business culture), a Legal Toolkit section (NDA, Freelance Agreement, MoU templates in plain English — every output prefixed with '⚠️ This is a template for learning purposes. Consult a qualified lawyer for legally binding documents.'), and a Student Gig Analyzer (paste a Fiverr/Upwork gig → structured {title, skills_needed, estimated_budget_pkr, timeline, difficulty, tips}; read-only, creates no client_projects row). All 12 tools run through AI::chatTask('general_chat', …, max_tokens 1200) with Pakistani-context system prompts (PKR, WhatsApp-first, JazzCash/Easypaisa) and save each output to new table toolbox_outputs (user_id, tool_key, input_summary, output, created_at; idx_user(user_id, tool_key)). History pages: /student/toolbox/history (web, last 20, expandable + copy) and GET /api/v1/student/toolbox/history (mobile). API surface: GET /api/v1/student/toolbox (tool list + field schemas), POST /api/v1/student/toolbox/{tool} (wildcard for all 12), CSRF via X-CSRF-Token, JSON or form bodies. Web routes: GET /toolbox (hub cards), GET /toolbox/history, POST /toolbox/{tool} x12. Nav: 'Business Toolbox' added under 💡 Projects. Part 1 of v11.14.0 — micro-learning (part 2) ships separately.

Opportunity Finder: 'Tell us who you are' (free text + profession/role quick-pick chips) -> AI generates EXACTLY 5 personalized PKR-context ideas (title, description, why_you, build_steps, earning_range, difficulty, sdg). Rate limit 10/day/user via file counter. Idea Library: 100 pre-written ideas seeded into new idea_library table, searchable + filterable (profession, difficulty), collapsible build steps. Roadmap/What's-New page handled separately in part 2.

Public /roadmap page (RoadmapController) with three columns: Now (current version + last 5 history entries from platform_manifest.json), Next (contracted upcoming: Business Toolbox v11.14.0, Micro-Learning Engine v11.15.0, Content Wave 2 v11.16.0, Profession Packs + Maahir Works v11.17.0, WOW Onboarding v11.18.0), Later (vision: global search, credentials wallet, feedback boards, Urdu UI, voice practice, kids payout rails). Layout gains a What's-New modal for logged-in users that appears once per version change (session key last_seen_version vs Version::get()) showing the 3 newest manifest history entries with a View-full-roadmap link. Student changelog (/student/changelog via ChangelogTraits) now replaces generic 'Platform Update — vX' titles with the matching manifest history title (exact version match, then latest same major.minor; unmatched titles kept). Roadmap link added to sidebar bottom + public footer. History[] normalized to newest-first ordering.

Profession Packs Wave B (professional services): 8 new packs — Lawyer ⚖️, Doctor & Clinic 🏥, Pharmacist 💊, Childcare & Daycare 🧸, Engineer ⚙️, Journalist 📰, Agriculture & Farming 🌾, Social Worker & NGO 🤝 — each with 5 hand-written Pakistani-context roleplay scenarios (no-docs property clients, fee-dodgers, AI-invented case citations, antibiotic demands, Urdu diagnosis explanations, prescription-refusal ethics, biting incidents, egg-allergy dismissal, mid-construction plan changes, scaffold safety stops, spiked stories, source retractions, mandi-price trust, drip-irrigation pitches, forecast failures, thin case files, volunteer burnout…). profession_tags is now reserved for pack slugs: 17 legacy single-tag lawyer/healthcare facet rows cleared so pack pages show exactly the curated 5. Missing assessments: startup_readiness (risk tolerance, opportunity recognition, resourcefulness, resilience, market awareness) and freelance_business (client acquisition, pricing strategy, contract awareness, payment management, portfolio building) — 10 likert questions each, engine-native {text,cat,dir} shape with categories/reverse_questions/type_labels/bands scoring_logic (the shared engine supports likert + ab_choice only, so the item format follows the 30+ existing likert assessments rather than literal 4-option MCQ). Capstone system (CapstoneController + capstone_projects table): each student's capstone auto-creates with type inferred from their onboarding goal; artifacts are evidenced from real work (business-plan/pitch-deck/quotation/freelance-agreement toolbox_outputs, proof_uploads for portfolio, issued/skill certificates for certification); submit is gated on all artifacts done; admin review (/admin/capstone/manage) approves or requests changes with notes; approval awards the 'Capstone Complete' 🎓 badge (user_achievements, idempotent), +200 XP via PointManager (ledger-safe), a capstone_approved notification, and a one-time hero_reached notification when Journey stage 8 thresholds (2+ certs, 5+ badges) are met — the Hero status upgrade path. Nav: 🎯 Career → 🎓 Capstone (student, NEW badge 14 days), 💡 Projects → 🎓 Capstone Reviews (admin).

Multiplayer Role-Play (MultiplayerRoleplayController + student.roleplay-multiplayer view): two learners play opposite sides of a scenario (client↔freelancer / buyer↔seller) in a shared room created with a 6-char code (unambiguous alphabet); join is an atomic guest claim; chat runs on 3-second AJAX polling of GET /roleplay/multiplayer/poll/{id}?after={id} (no WebSockets) with own messages right / opponent left and a scenario-context header; neutral AI observer (GET /roleplay/multiplayer/spectate/{id}) gives live notes + per-player live scores to spectators (staff) and players; End & Score requires BOTH players to agree (hidden marker rows in multiplayer_messages; atomic status claim prevents double evaluation) after which the AI judge scores each side 0-100 with strengths/improvements, declares winner or draw, awards 15 XP each + 10 winner bonus via PointManager and notifies both (multiplayer_complete). Maahir Works (MaahirWorksController + student/admin views): real paid projects from local businesses/NGOs — students browse budget/skills/timeline cards and propose (why me + approach + timeline, one per project); admins post projects, assign a student + optional Hero mentor (auto-accepts the winner's proposal, rejects the rest) and track open→assigned→in_progress→delivered→paid; setting Paid records the payout in student_earnings (source_type maahir_works, amount budget_max||budget_min), awards +50 XP and sends the outcome notification; student deliver action (POST /works/{id}/complete with delivery notes) notifies mentor+creator. Seeded 5 real-world sample projects (Lahore bakery website Rs 15-25k/2w WordPress, Karachi clinic WhatsApp chatbot Rs 20-35k/3w no-code, Islamabad boutique social setup Rs 10-15k/1w, Peshawar hardware store Sheets+Apps Script tracker Rs 25-40k/3w, Multan exporter English product copy Rs 8-12k/1w). Conversation Replays: ai_roleplay_sessions completing with score ≥ 80 are auto-archived PRIVATE into roleplay_replays (unique session_id); the results view shows '🏆 Great score! Share this conversation to help others learn?' with an opt-in button (POST /roleplay/share/{id} flips is_public); the public gallery GET /roleplay/replays lists only opted-in 80+ conversations with expandable transcripts. Nav: ⚔️ Multiplayer + 🎬 Replays under 🤖 Practice, 💼 Maahir Works under 💡 Projects (+ admin nav), all NEW-badged until 2026-10-13.

Goal Picker: full-screen 'What do you want to achieve?' experience (GET /student/onboarding, new fullscreen layout + public_nav) with 6 tap-to-select goal cards — Get a Job, Become a Freelancer, Start/Grow a Business, Grow My Home Business, I'm a Student, Explore Everything — each with icon, 3-line description and practice chips; 'Start My Journey →' CTA stores the goal in new user_onboarding_goals table (+10pt first-time bonus, ledger-safe via PointManager) and redirects to the matching starter path (job→ai-guide, freelancer→freelance-playbook, business→toolbox, home_business→earn, student→micro, explore→ai-guide). Dashboard redirects profile-complete students with no goal to the picker once per session (wow_goal_prompted flag kills loops). Journey Map: GET /student/journey renders the 9-stage Zero-to-Hero timeline (metro-line style, done ✓+dates / current ● 'You are here' / future ○) with per-stage progress bars, expandable what-to-do + related-XP details, 'What's next?' with 3 AI Guide picks, and a gold MAAHIR HERO card at Stage 8 (certificates, badges, capstone claims, mentor eligibility + opt-in to /student/mentors/apply). Stage engine getStageProgress(): 0 profile_completed, 1 ≥5 exercises, 2 ≥1 cert + ≥10 roleplays, 3 goal set, 4 ≥3 track modules, 5 ≥2 series, 6 ≥3 toolbox outputs, 7 ≥1 student_earning, 8 ≥2 certs + ≥5 badges. Dashboard gets a '🗺️ My Journey' hero card (uncached stage compute). Legacy onboarding checklist moved to /student/onboarding/checklist (dashboard 'Finish setup' link updated). Mobile JSON: GET /student/onboarding, POST /student/onboarding/goal (X-CSRF-Token + JSON body), GET /student/journey.

Zoom recording of the third Fall session (Fri 16 Oct 8PM PKT coaching call) added per the Day 1/Day 2 pattern: Dropbox download byte-exact (121,436,965 bytes, no compression), md5 8a54c8e855dc0b0a100ab87789982433, ffprobe-verified h264/aac 1h18m51s. videos row id=7 'Maahir Fall Day 3 — Live Coaching Session — 16 October 2026', category Orientation, sort_order 1 (Day 2→2, Day 1→3), contexts dashboard. Verified: HTTP 200 + Range 206 on the asset, Videos hub lists Day 3 first, dashboard card shows Day3/2/1 + 'All Videos (7)'. scripts/day3_video_email.php (test-first, subject-dedupe, batches 1-4) — test sent to operator inbox; blast pending operator approval.

Operator clarified the grouping model: Batch → Class → Students; a class is ALSO an NGO cohort (NGO sends ~20 students → class → progress report, view-only). TA Hub upgraded to parity with teacher pages: today-at-a-glance strip (active today, exercises completed today, need-a-nudge), risk/progress/name sort chips (risk-first default for a check-in tool), and a 12-item recent-activity feed across the TA's students. TA Manager gains 'add a whole class' chips that bulk-fill the multi-assign picker (classes are the natural TA assignment unit). NEW NGO reporting: classes.org_name + classes.view_token columns; teacher class-view gets a share panel (create/regenerate/revoke token, copy link); public no-auth report at /ngo-report/{token} (noindex) shows org-branded summary + per-student progress — names and progress only, never emails/phones. Route note: /ngo/{slug} is the partnerships page, hence the /ngo-report prefix. E2E verified with reversible test data (test TA + 2 mentees, token on class 1) — all test rows reverted after verification (0 test pairs, 0 TAs, NULL token confirmed).

Attendance page: giant unsearchable student <select> replaced with a searchable typeahead picker (client-side over batch-scoped list, submits on pick, 'All Students' reset); Engine Stats tab (platform-wide AI route/provider cost data) now admin-only — hidden for teachers with a guard inside the panel too. Inactive report: standard page-header + severity count chips (3-6d / 7-13d / 14d+), live search, and the '💬 Nudge' dead-end fixed — it pointed to /student/chat?dm= (student-only page) and now opens the real teacher↔student thread /teacher/messages/{id}. Dashboard KPI cards linkified (roster, pending approvals filter, batch insights). student-activity.php's 5 tables wrapped in .table-wrap for mobile horizontal scroll. No controller/route changes; views only.

v12.5.2's 100-card grid replaced with a Gmail-style master-detail queue: dense 52px row list (thumb, student, exercise, age chip red when >7d) + sticky grading panel (big preview, auto-focused grade input, presets 90/75/50, optional feedback, AJAX save with zero reloads and auto-advance to next ungraded). j/k or arrows navigate, Enter grades, Esc closes; mobile panel is a bottom-sheet overlay. Toolbar: oldest/newest sort (oldest default), type filter chips (images/links/text), student search, pager 50/page. Header triage stats: waiting count, oldest age, >7d count, graded today. Mini student context (submissions, avg grade, recent grades) via on-demand endpoint. Fixes en route: view-fatal from duplicate 'page' render key (nav active-key collision — renamed to qpage); storage/logs/error.log was root-owned so web exceptions were never logged (chowned to www-data). E2E verified as teacher id=2 (3,117-item queue): filters, sort, search, paging, context JSON, AJAX grade + revert test with points-ledger invariant re-confirmed.

Full-platform UI/UX audit executed. HOTFIXES: TeacherController::inactiveReport() missing batchScope() leaked all students to teachers; dashboard ungradedProofs count was system-wide (now batch-scoped + clickable); /admin/analytics + /admin/activity were platform-wide for teachers (now admin-only, teacher nav points to batch views); gradeProof now enforces batch access for teachers; TA nudge 24h throttle never fired (notify type mismatch). TA PACKAGE: TA Hub gets classroom toolbar (search, risk chips w/ counts, active-today filter, cards/table toggle remembered), bulk 'Nudge all at-risk', nudge moved to card footer (was covering activity dots), real empty state; TA student 'Message' deep-links ?dm= thread; TA Manager replaces 500-option selects with searchable typeahead + multi-assign + confirm on unassign; TA nav section moved below Learn with NEW badge and its own accent. EXERCISE: triple-FAB pile-up fixed (one Stuck FAB, repositioned); 'Don't get it?' merged into tutor quick-actions + Roshni box; reply-language consolidated to the single pill strip (removed hidden tutorLangSelect, help-box select, duplicate tutorLangNote id); header Report/Bookmark/Share collapsed into overflow menu. STUDENT DASHBOARD: assignment hero first (was under 3 promo cards); How-to Videos collapsed + lazy iframes + capped at 3 inline (was loading 6 YouTube embeds per visit); batch grid mobile-safe; For Employers removed from header. TEACHER: new grading queue /teacher/proofs (cross-student, batch-scoped, ungraded-first tabs, inline grade+next flow, graded-by-today count); teacher dashboard reordered (action items + pending approvals above gamification stats); roster live search; grading route namespaced /teacher/proof/{id}/grade (admin alias kept); student 'Ask Teacher' chat DMs now mirror into teacher_messages so they hit the teacher's real inbox + unread count; teacher DM notifications link to /teacher/messages. POLISH: sidebar deduped 87->84 links (Videos x2, Employer x2, Consultant x2, mental-wness typo); sectionColors refreshed for all current sections; tracks/track-detail adopt the standard page-header pattern; admin classroom-batch renders one view at a time (table built on first toggle) + filter chips show counts; shared mobile media queries for toolbars. Revert kit: storage/backups/revert_v12_5_2/.

Operator request from Classroom: promote strong students to TAs; they keep full student experience and gain a TA Hub. Built on mentor_matches (is_ta_pair flag). Admin TA Manager for promote/assign (cross-batch); TA can also self-add students by email. TA Hub: roster with risk lights + nudge; per-student mini-dossier with recent exercises, 14-day activity chart, private notes, logged ±points with notifications to students. E2E verified with temp accounts (promoted, assigned, nudged, points, notes, self-add; non-TA blocked; temp data cleaned).

Operator: admin menu was hard; wanted batch → students → classroom flow. New ClassroomAdminController + hub/batch views (zero new tables): /admin lands on Classroom hub with live batch cards; per-batch classroom shows the full roster as toggleable card grid or dense table with search, risk filters, 7-day activity dots and progress bars, each card opening the existing student dossier. Menu reorganized into 9 task-focused groups (Classroom, Insights, People, Admissions Funnel, Content, Projects, Careers, AI, Billing/Engagement/Comms/Safety/System tidied).

Operator enabled Gemini TTS after the 69-sample audition (9 Maahir languages × 3 models, ~$0.09). gemini-3.8-flash-lite-tts now powers every listen button: role-play personas keep the character voice map with speech_metadata styles; all other buttons use Kore/Sulafat natural narration including Urdu-script text (edge-tts demoted to fallback amid MS 403 bans). Dual WAV-master+MP3 cache = one API call per unique clip ever; 15/user/day cap; kill-switch retained. No batch pre-generation (operator: on-click only).

Interview Question Bank (300 questions in 10 banks, module 978 on Competency Paths track), 50 government schemes/scholarships tips (NAVTTC/PMYP/DigiSkills/TEVTA/HEC/PEEF/Akhuwat with verify-official framing), 30 fresh scam-pattern scenarios (voice-clone, loan apps, task apps, deepfake gurus). Then the operator's 68.7GB Dropbox source archive pulled (no-resume single stream, self-healing loop), 2,579 PDFs extracted to text (media excluded per operator), and mined: 295 HBR archive tips from 111 real issues, 290 Dummies+business-book tips + 10 scenarios, 8 work-abroad city scenarios + 28 tips. Zip+PDFs deleted after text extraction (operator instruction).

Competency Paths career_track id=150 (slug competency-paths) — 15 modules (order 1-15) via scripts/mega_v12_2_0/paths.php: Leadership, Sales, Marketing, Strategy, Communication, Personal Growth, Finance, Entrepreneurship, Management, AI Productivity, Freelance & Gig, Career Launch, Digital Safety, Productivity & Focus, Business English. Each path = 6 sequenced guided lessons (250-400 words, foundations to practice to mastery, synthesized from mindset_lessons categories incl. leadership_tips, sales_tips, marketing_tips, strategy_tips, communication_tips, personal_growth/wellbeing/life_skills, finance_tips/money_habits, business_models, management_tips, prompting_tips/ai_basics/digital_ai, upwork_fiverr/linkedin_tips, cv_interview/career_tips, phone_security/digital_privacy, self_management/time_energy/habit_formation, copywriting/email_marketing) + 4 quiz questions + 1 Pakistani-context capstone decision scenario. All inserts logged to storage/backups/revert_v12_2_0/manifest.tsv for one-command rollback.

Maahir becomes a skill-building engine: (1) Mastery Gates — module exercises locked until module quiz passed at 70%+ (setting mastery_gates, default ON; grandfathered users >=60% complete keep access; Focus Drill auto-remediation of 3 targeted questions on failure). (2) Role-play deliberate practice — per-criterion scores persisted (roleplay_criterion_scores), results page shows criterion bars + "Retry focusing on [lowest]" button + per-criterion progress page. (3) SRS everywhere — new srs_queue (micro/quiz/roleplay items; quiz 1/3/7d, roleplay 3/7/21d ladders), missed quiz questions + completed role-plays + micro cards auto-enqueued, "Practice Due Today" page + mobile API, cron_srs.php nightly backfill. (4) Skill Map — per-skill mastery grid on track pages + "Drill weakest skill" (3 targeted exercises). (5) Reflection Journal — "What did you learn?" prompts after exercise/scenario/role-play, reflections table, /student/journal, +5 first-of-day bonus. (6) Auto-Portfolio — practice projects passed at AI 60+ auto-added to portfolio (tagged project_submissions.future_improvements=auto-portfolio:v12). (7) AI Practice Partners — reusable chat partial + 4 personas (interview/negotiation/sales_objection/coding_tutor) wired on Career Launch, Sales Mastery and negotiation modules. (8) Cohort Weekly Challenges — cron_weekly_challenge.php Mondays 06:00 closes last week (top scorer +100 via points_log) + opens new week per active batch; banner on batch leaderboard; member notifications incl. WhatsApp group link. (9) Recall-First Quiz Mode — ~20% of adaptive-quiz questions served as free-text recall, fuzzy-matched (levenshtein + keyword overlap), MCQ reveal after submit (setting recall_mode, default ON). (10) Streak Protection — one repair token per 30 days auto-granted; dashboard "Repair streak?" button within 48h of a break restores the streak once.

Cyber Career (Pro) track id=148 (slug cyber-career-pro) first 5 modules via scripts/mega_v12_2_0/cyber_a.php: SOC Analyst Foundations; Blue Team Defense; Network Security Fundamentals; Web Application Security; Malware Analysis & Forensics Intro. 50 guided exercises (250-450 words each), 40 quiz questions, 12 decision scenarios (career/cyber), 10 role-plays. Pakistani global-career framing (night-shift SOC for US clients, IT support to SOC L1 to blue team path, honest salary guidance). Defensive-only ethics throughout. All inserts logged to storage/backups/revert_v12_2_0/manifest.tsv for one-command rollback.

4,000+ items from the operator's S4S Resources Library: new Cyber Career (Pro) track (10 modules from 62 InfoSec books), Leadership & Management track with recurring-cast Role-Play Dojo, 15 Competency Paths sequencing the tip library, Smart Tips exploded 261→3,004 (Summary.com full extraction, HBR unboxed works, BizModels/Funnel/BusinessExplained, internet packs), 36 new multi-step scenario chains via MiniMax AI generation, 102 audience-variant scenarios. Multi-agent orchestration with per-insert revert manifest (4,039 lines).

New practice feature: run a simulated Pakistani business day-by-day. 3 skins — dukaan (retail: price/stock/marketing/staff), artisan (produce/price/market-vs-online %/material quality), services (billable hours/rate/marketing/contractors). Deterministic economics (revenue = f(price elasticity, reputation, marketing, stock/capacity, season, random factor)) + weighted ~32-event pool (competitor opens, supplier hike, Ramadan rush, monsoon, theft attempt -> Safety Hub, staff conflict -> communication lesson, viral post, wholesale buyer, fake invoice -> phishing lesson, etc.) each cross-linked to a real Maahir lesson URL. One 'daily' event per real day, Eid demand spike days 45-60, monsoon disruption days 70-80, auto Business Reviews on days 28/56/84, badges at Day 30 (+50 pts raw) and Day 90 (+150 pts raw), bankruptcy closes the business. AI coach reviews each turn via chatTask('general_chat') with two personas from config/sim_coach.php — 'english' consultant and 'ustaad' Roman-Urdu-friendly Ustad-ji — toggleable per business (coach_style column); weekly review mode does a P&L walkthrough + one skill recommendation; rule-based fallback when AI is down. Engine app/Core/BusinessSim.php, controller SimController, views sim/landing + sim/game, migration scripts/mega_v12_0_0/sim/migrate.php, e2e 36/36 pass (incl. live AI coach), smoke 9/9. Revert kit: storage/backups/revert_v12_0_0/sim/REVERT.md.

Two products. (A) Real-Business Consultant (AI-disclaimered): GET /consultant onboarding form (Urdu-friendly labels: business name, what you sell, monthly sales/costs, stock value, staff, top challenge) -> POST /api/consultant/analyze computes deterministic metrics (gross margin %, stock turns/month estimate = sales/stock, staff cost per sale [35%-of-costs assumption], break-even sales [70/30 variable/fixed split assumption], 0-100 rule-based health score), saves raw numbers to biz_consultations FIRST, then asks AI (chatTask general_chat, strict-JSON system prompt, track catalog injected) for 3 issues + 3 recommendations, each recommendation deterministically linked to a Maahir track (catalog slugs validated, keyword fallback matcher) as lesson_url /tracks/{slug}. Deterministic rule-based fallback diagnosis when AI unavailable. MANDATORY disclaimer ('This guidance comes from AI...verify with your accountant/trusted advisor') on page top, every diagnosis footer, and embedded in every recommendation. GET /consultant/history page + 'Update your numbers' monthly check-in (form prefilled from last consultation). V1: POST /api/v1/student/consultant/analyze, GET /api/v1/student/consultant/history. (B) Employer Dashboard MVP: student creates employer account ('For Employers' button on dashboard + nav Jobs & Money) via POST /api/employer/register -> employer_accounts; adds staff by email/name search of approved students (POST /api/employer/staff/add, upsert semantics: re-call updates track assignment) -> employer_staff with assigned_tracks_json + auto-enrolls into user_tracks; POST /api/employer/staff/remove; GET /api/employer/progress per staff member: assigned tracks (per-track completed/total published exercises + pct, counted via BOTH track_modules and modules.track_id links), avg completion, exercises done, quiz avg (quiz_sessions correct/asked), last activity; GET /api/employer/export CSV. Dashboard view: stats (team size, avg completion, exercises done, quiz avg), team table with progress bars, add-staff modal, assign-tracks modal (catalog picker), export button. All mutations csrf-checked (form + X-CSRF-Token). Track catalog query fixed in both controllers: EXISTS via track_modules OR modules.track_id (Mastery tracks link through modules.track_id only). Revert kit: storage/backups/revert_v12_0_0/consultant_employer/ (REVERT.md + .baks of index.php/api_v1.php/navigation.php/dashboard.php/platform_manifest.json; DB twin scripts/mega_v12_0_0/consultant/REVERT.md). NOTE: platform_version stays 12.1.0 — shared with the business_sim stream in the same release window.

488 new items via 5 parallel generation agents: International Business track +6 modules (payments, marketplaces, GSP+/trade agreements with Oct 2026 verified status, export finance, IT exports, scam defense); Customer Success & Service Mastery +13 modules (outbound sales, upsell/retention, commission life, accent, inbound service mastery, insurance campaigns with 2026 enrollment calendars, compliance with Sept 2026 TCPA changes, home-services & telecom/B2B campaign playbooks, night shift wellbeing, scam-proof job hunting, chat/email non-voice, team leader ladder); Healthcare Administration Mastery +2 modules (claims deep dive CMS-1500/UB-04/CARC denials/appeals/ERA, AR calling night-shift RCM job). Sidebar: Jobs & Money gains 'Customer Success' entry. Two-track-system junction fix documented in revert kit.

Operator decision: play.maahir.io is more stable, so the Next.js mobile app service was stopped and disabled, and the m.maahir.io nginx vhost now 301-redirects all traffic to https://play.maahir.io/ (only /tracks/* paths preserved — web serves them identically). TLS/certbot untouched. Web app is fully mobile-responsive PWA. Revert kit restores proxy vhost + re-enables service in 60s.

Added gts: engine to Tts.php wrapping gemini-3.8-flash-tts with speech_metadata style control, keyword->voice map (scammer->Algenib menacing, interviewer->Charon, teacher->Sulafat warm, elder->Gacrux, officials->Orus), dual WAV-master+MP3-serving cache so the API is billed once per unique clip ever, Urdu-script auto-split to edge-tts, 15/user/day cap, kill-switch OFF pending operator audition of 6 samples at /assets/tts-samples/gemini/.

Videos moved from the auto-hiding Getting Started card (beginner-only) to a permanent home: /student/videos hub with categories + watch marks, own sidebar section + Learn entry, always-visible dashboard card for every student regardless of starter-lesson progress/profile completion (fixes: advanced users like user 306 could never see the how-to videos), and link-only contextual hints on exercise/scenario/assignment/assessment pages. New tables videos + video_views; public JSON API for mobile. No embeds outside the hub/dashboard.

2 new tracks (2 training / 2 career) x 2 modules each, for founders and business owners with no finance or strategy background. Business Thinking & Acumen: the business-machine model (time+effort in, value+money out), 4 core concepts incl. the sustainability intersection ("don't be in the Scam section"), the 8-question founder checklist (1-page business plan, co-founders/skills/assets, who will pay, delivery cost, competition, failure plan, unfair advantage, review rhythm) and charge-more pricing psychology; P&L and cash-flow decoding (revenue vs profit vs cash, gross margin, unit economics with a cost-per-cup example, break-even math, full-order-book cash deaths, weekly dashboard, investor metrics). Systems & Strategic Thinking: game theory without math (prisoner's dilemma pricing wars, win-win vs zero-sum, repeated games and trust, signaling, negotiation as sequential game, backward induction, second-order consequences) and Theory of Constraints + critical thinking (5 focusing steps, optimize the constraint, QDI questioning with "So what?", Einstein's 55-minute rule, narrative writing culture, written-plan review effect, reversible vs irreversible decisions). Generated: 40 exercises, 40 quiz questions, 20 decision scenarios (domain business, options carry synthetic ids opt0-3 per v11.89.1), 12 role-plays. All ContentGovernance-queued, pakistani_context=1, PKR examples.

Content release: (A) NEW library book "The Complete Guide — Earning, Learning & Staying Safe in Pakistan" (library_books id 30, slug complete-guide-earning-learning-safety, category Life Skills NEW — catalog FIELD ordering updated in StudentController::library and ApiV1Controller::studentLibrary to put Life Skills first) with 24 chapters (~28.3k words, 958-1379 words each, ~147 reading minutes) covering triage, home/online earning, skills, money/loans, scam safety, single mothers, villages, 90-day plan, mindset, family learning, cyber safety, resource directory, full-cycle job/business/freelance/funding guides, field-by-field map, remote paths by background, women networks, personal brand, compounding habits, grooming (both genders, modesty-respectful), quick checklist. ContentGovernance-checked (CJK-free), NCCIA branding, verify-official phrasing for laws/schemes/helplines, no AI brand names. (B) Pack sample expansion: 40 new items (B1-B7 freelance, C1-C7 safety, D1-D7 single mother, E1-E7 business, G1-G6 money scam, I1-I6 cyber) in storage/pack/parts_sample.md ingested via scripts/mega_v12_0_0/ingest_pack.php into scenario_bank categories pack_freelance(4)/pack_safety(5)/pack_single_mother(4)/pack_business(5)/pack_money_scam(6)/pack_cyber(5) + roleplay_scenarios x11; all options carry opt0-2 ids; 40 content_governance rows queued (stream pack_ingest). HOTFIX in ingest_pack.php: title regex was swallowing body into title (pack_jobs seed rows 7281-7286 + 4 seed roleplays repaired via SUBSTRING_INDEX); category now derived PER ITEM from part letter (was whole-file from first item). Revert kit: scripts/mega_v12_0_0/guide_pack/REVERT.md (+ controller .baks in storage/backups/revert_v12_0_0/guide_pack/).

One-go unattended mega release. CONTENT: 63 modules / ~1,790 items across sales (×4 PK+West+GCC), international business (×2), business thinking (×2), systems thinking (×2), communication & presence (×6), destinations (Gulf×2+USA+UK+EU), bank+hospital cyber (×2), nursing+domestic workers (×2), Arabic (×2), math, construction, grooming (×4), expo (×2), Business English (×4), industries (×13: BPO×2, banking, pharma-rep, textile, aviation, FMCG, REVA, med-billing, mechanic, CCTV, solar, nutrition), Field Notes (×3), small modules (×5). PLUS: The Complete Guide library book (24 chapters). FEATURES: Business Sim (3 skins: dukaan/artisan/services, 32-event pool, dual-persona AI coach, milestones, XSS-hardened). Real-Business Consultant (AI disclaimered, deterministic metrics + AI analysis, lesson-linked recommendations). Employer Dashboard (team management, progress tracking, CSV export). SKILL ENGINE (10 upgrades: mastery gates, practice loop, SRS-everywhere, skill map, reflection journal, auto-portfolio, AI practice partners, cohort challenges, recall-mode quizzes, streak protection). Pack: 50 curated scenarios ingested from 1,400-item corpus. Platform: 101 tracks / 787 modules / 9,349 exercises / 7,461 scenarios / 10,924 role-plays / 30 books / 200 projects.

Content release: (A) Sales Mastery track (sales-mastery, id 31) extended with 4 modules sm-mod1..sm-mod4 (Module 11 Sales Techniques & Methodologies, 12 Objection Handling & Closing Drills, 13 Selling to US/UK/EU Clients, 14 Selling to GCC Clients; order_num 6062-6077, track_modules sort 11-14). (B) NEW track International Business from Pakistan (career_tracks+training_tracks slug international-business, sort_order 1350, category_group international_business, flag ib_gen) with modules ib-m1 Exporting Goods from Pakistan and ib-m2 Services Business for Foreign Clients. Per module: 10 exercises, 10 question_bank questions, 5 scenario_bank decisions (options opt0-3 with correct+score+consequence; adult; pakistani_context=1; domains business), 3 roleplay_scenarios (AI plays PK retailer / US buyer / UK client / EU agency / GCC trader personas; prefixes SM: / IB:; context_tags sm_gen/ib_gen). Totals: 6 modules, 60 exercises, 60 questions, 30 scenarios, 18 role-plays, 2 track rows; 60/60 exercise MP3s pre-cached (en-US-AriaNeural). No schema/route changes. Revert kit: scripts/mega_v12_0_0/sales_intl/REVERT.md (slug-scoped one-shot deletes).

Tts.php gains an Orator engine (UpliftAI api.upliftai.org, key in .env): role-play listen buttons now speak in character-matched native Pakistani voices (82-voice catalog; keyword map ai_role/title/type -> voiceId in config/tts_voices.php — scammer/gruff male, warm female teachers/coaches, measured professionals, default educational v_8eelc901). Scoped to role-play only; lessons/scenarios/exercises remain edge-tts. Guards: settings tts_orator_enabled kill-switch, orator_daily_cap_per_user (default 20; cached clips never re-count; usage log per day). Whitelisted voice param on /api/tts + /api/v1/tts; fallback Orator->edge-tts.

39 new modules across 8 new tracks: Hospitality Safety & Security (4 + front-desk & guest QR sheets), Pre-Marriage Preparation (2, incl. jahez boundary-setting), Teen Life School (5, incl. Matric/Inter/O-A-Level pathways), Teacher Safety Kits (6 classroom packs), Farmer Digital Skills (3), Media Professional Safety (2), Women Artisans Handicraft Business School (9, incl. Pakistan craft map, branding, selling, funding), Women's Health Awareness (1, awareness-only). Plus into existing tracks: Work Abroad op-m2/m3 + Before-You-Fly sheet, Caregiving mw-m7, Men's Mind mw-m8, Media Literacy & Deepfakes cs-m13, Traffic & Driving ar-m6 (incl. women drivers), Airport & Transit tp-m2. FEATURES: /initiatives partner hub (5 programs, partnership_leads + admin queue, 5 printable one-pagers); Women's Health FEMALE-ONLY gating (visible menu, gated content — web pages + v1 APIs return gated:female_only; FemaleContent core); English Tutor voice (Sunno buttons on AI replies + coach cards, web + mobile); v1 english-tutor/chat/save endpoint; API normalization (hub cert-guide {slug} route, absolute TTS urls, hub path steps enriched with course_title/url); assessment prompt no longer appends Best Careers to wellness/emotional check-ins. Menu: Hospitality+Media Safety under Safety, Pre-Marriage/Women's Health/Women Artisans/Teen Life under Family & Life, Teacher Kits under Learn, Work Abroad under Jobs & Money. Audio ~280 new mp3s; Urdu pass running.

Phase 1 partner-facing pages for MoU conversations: /initiatives hub + 5 program pages (women-at-home, ability, cyber-safe-pakistan, rural-digital-skills, ai-for-business) with curated 'What's inside' lists carrying LIVE module counts from training_tracks/modules/learning_courses/scam_reports, delivery model (batches + WhatsApp + Sunno Sabaq audio + Urdu), who-it-serves, live platform impact totals, and 'potential partners' org lists (named orgs only, no logos, explicit no-endorsement framing). Lead capture: POST /api/initiatives/inquire (form or JSON body, CSRF via X-CSRF-Token header or _csrf field, honeypot 'website') stores to NEW table partnership_leads (status new/contacted/closed). Admin queue: GET/POST /admin/partnership-leads with status tabs + inline update. 5 printable A4 one-pagers added to /sheets (initiative-women-at-home, initiative-ability, initiative-cyber-safe, initiative-rural, initiative-ai-business). Nav: student Explore section 'Our Programs' -> /initiatives after Partners (NEW badge 14d). Sitemap: +6 URLs. Revert kit: storage/backups/revert_v11.90.0/initiatives/.

21 new modules / ~590 items: Special Parenting track (7 mods, counseling-depth incl. 'what after school?'/'what after me?'), Her Path — Single Woman's Guide (8 mods: rights, khula/divorce, custody, domestic-abuse safety planning, money, mind & stigma, rebuild), Maahir Ability expansion di-m2..m6 (screen readers, assistive employment, accessibility, rights, injured-in-service retraining), Rural Home Income (gw-m6 in gig-worker). UX: shelves-first redesign for Role-Play + Decisions (Continue/For You via AI Guide/Start Here/themed shelves; facets behind Filters sheet) — web + mobile. Nav: new 'Family & Life' sidebar section; catalog groups Family & Life (14 slugs) + Money (3). Cross-links: Safety Hub Women->Her Path, Kids->Special Parenting. Toolbox #53 AI Readiness Diagnostic (deterministic) + fixed v11.87 numeric-key bug (all 53 JSON tools now runnable) + 3 AI case-study sheets. Audio pre-gen 168 files; Urdu priority pass for new tracks running. POLICY: play.maahir.io no longer pushes mobile — banner informational only.

43 new tracks / 285 new modules / ~2,800 exercises / ~2,800 quiz questions / ~1,550 scenarios / ~900 role-plays / 4 assessments / 1,248 Urdu translations / 200 practice projects / Learning Hub (64 providers, 285 courses, 20 paths, 30 cert guides) / Safety Hub 6 audiences / Scam Radar (25 seeds + AI checker) / BC Register / Sunno Sabaq audio mode (default voice; Urdu TTS exists but HIDDEN until operator flips) / 10 cheat sheets / 10 finance toolbox tools / 66 PK scam scenarios incl. BNPL traps. New schools: Digital Parenting 30 mods, Cyber Safety 12, Career Launch 11 (incl. PMYP schemes), Student Success 8, IELTS/Study Abroad 8, Vocational x3 (18), Personal Finance 6, Mental Wellness 6, Gig 5, Kids Coding 6, Women's Re-entry 5, Seniors 5, Paisa Bachao 14 (gold/National Savings/Islamic/property/MLM/HYIP/committee-fraud/red-flags/single-mother/donation-fraud/Ghar-ka-Budget/legacy), Adulting & Rights 5, Health Scams 2, Insurance-Pension 2, Disaster 1, Overseas Pakistanis 1, Digital Inclusion 1, Travel-Pilgrimage Safety 1, 9 career tracks, 12 DigiSkills tracks. Also: creator monetization x4, freelancer pack x4, entrepreneurship +3 (MVP/launch/SECP), freelancer tax module.

Maahir AI for Business initiative. (1) TOOL #53 ai-readiness-diagnostic appended to database/toolbox_mega_tools.json: 20 select questions (Yes=2/Sometimes=1/No=0) across 5 areas (Operations, Customer Support, Marketing & Sales, Data & Reporting, Automation & Mindset — 4 each, max 40). Scoring is FULLY DETERMINISTIC in PHP (ToolboxController::scoreAiReadiness) — no AI call, instant response: total maps to tiers 0-15 AI-Curious Beginner / 16-25 Getting Started / 26-32 AI-Ready / 33-40 AI-Leader; per-area breakdown, weakest-area detection with tie handling, recommendations mapped to Maahir tracks (ai-operations, business-systems, marketing-mastery, data-mastery, pm-mastery, platform-playbooks) and a per-tier 90-day starter roadmap. Pakistani SME/dukaan framing. (2) BUGFIX in tools(): JSON mega tools were merged with NUMERIC keys since v11.87.0, so apiTools listed them but tools()[key] lookups 404d on run — all 52+1 mega tools now runnable (re-keyed by their key field; hardcoded keys win; pre-existing duplicate JSON key nda (Mutual NDA) deduped in favor of hardcoded NDA Template). (3) THREE printable case-study sheets (public, A4, sheets pattern, composite examples — no real names, illustrative PKR ranges, any-AI-tool framing): ai-case-retail (Karachi clothing shop: WhatsApp Business catalog + AI descriptions + inventory sheet), ai-case-services (Lahore HR consultancy: AI-drafted reports, meeting summaries, email triage), ai-case-manufacturing (Sialkot sports goods maker: AI product photos/descriptions for export inquiries + demand sheet).

New chat was appending to the most recent chat in the mode because the web client never sent new_chat. Now: first message of a fresh session (page load or New chat click) sends new_chat=true and creates its own row. Chats appear in the web Saved list ONLY after clicking the new Save button (saved flag); every visit starts a fresh session. Mobile pattern (no chat_id) unchanged — still continues most recent chat per mode.

Fixed: mock-interview AJAX CSRF field name (419), logged-in users saw marketing landing on /, decision scenarios stuck when options lacked id (959 rows — synthetic opt{i} ids on fetch+submit), mobile track enroll 500 (user_tracks has no id column), daily-challenge TypeError on JSON array bodies, playground ai_query_stats HY093 (named params), ai-guide pickMeta destructure warnings.

Integrated the operator's 29-book Business Explained library (2,394 pages, licensed to operator) into Maahir as a three-stream learning experience. (1) READING LIBRARY: new library_books + library_chapters + library_reading_progress tables. /student/library page shows 29 books in 7 categories with chapter accordion reader, per-chapter 'mark as read' (+5 XP), and progress tracking. 589 chapters imported from scraped full text. Sidebar link 'Book Library' added under Learn. (2) BUSINESS MASTERY TRACK: training_tracks + career_tracks entry, 29 modules (one per book) with 145 exercises + 290 quiz questions generated from book chapter text via AI. Shows in /student/courses catalog. (3) SCENARIOS + ROLE-PLAYS: 349 decision scenarios (mastery_ tagged, 12+ per book) in scenario_bank + 174 forward role-plays + 87 reverse role-plays (user plays the antagonist) in roleplay_scenarios. 87 micro-cards (3 key frameworks per book) in micro_cards. DB schema note: scenario_bank.category column extended from VARCHAR(50) to VARCHAR(64) to accommodate long book slug categories (revert kit at storage/backups/revert_v11.88.0_scenario_category/). Generated by 6 parallel agents. English-only, TranslationService converts on demand.

Operator-directed single-session mega-release ('all in one go, not phases'), generated by a 9-agent parallel fleet through the ContentGovernance pipeline. SOURCES (verified open, ideas->original content): BusinessBalls, AllBusiness (41K-URL crawl incl. 27.5K-term Barron's spec), Bplans (550 sample plans spec), BBC Learning English, First Round Review, startups.com, Harvard PON, Forbes/Entrepreneur/Inc; CC layer OpenStax/Saylor/Wikipedia. English-only, TranslationService converts on demand. CONTENT LANDED: (1) THREE SCHOOLS as tracks (career_tracks + training_tracks + track_modules mirrored): Leadership & Management (12 modules/60 exercises/120 quiz Qs), Creator School - YouTube/TikTok/Instagram monetization with dos&donts (4/30/40), Founder & Funding School incl. Investor Grill (5/30/50). (2) PLATFORM PLAYBOOKS track - 16 modules (Upwork, Fiverr, Freelancer.com, Amazon FBA/KDP, Daraz, Shopify dropshipping, Etsy, Direct Clients, eBay, YT/TikTok/IG quick paths, PeoplePerHour+, POD, Stock content, Remote jobs) with exercises + quizzes. (3) 300 decision scenarios (managers-desk, getting-paid, hiring-hr, contracts-nda, money-taxes, platform-work). (4) 150 role-plays incl. signature packs (Both Chairs, Investor Grill 65-Q). (5) 501 dictionary flashcards (10 domains x 50, Barron's-inspired). (6) 49 management-model cards. (7) 25 swipe decks (290 cards). (8) 365 daily motivations (DB-backed rotation; dashboard API reads it). (9) 6 new assessments (30 Qs, 5 profiles each; conflict/negotiation/time already existed so new: tuckman, grow-self, founder-readiness, delegation, presentation-confidence, feedback). (10) 42 NEW Toolbox AI tools (35 doc templates with AI fill, 6 finance tools, business-plan builder with 23 industries) loaded from database/toolbox_mega_tools.json. TOTAL ~2,250 items. MENU INTEGRITY: config/navigation.php byte-identical (md5 gate passed) - all content lives in existing surfaces (courses catalog via track_categories append, earn hub, toolbox, micro). DB schema notes: training_tracks.difficulty column added; exercises autoslug trigger trg_exercises_autoslug (fills slug when empty - pre-existing rows unaffected); content_governance.content_type enum extended (+roleplay/assessment/track_module/dictionary_pack); career_tracks mirror rows. Full backup worklms_full_2026-10-07.tar.gz; git tag pre-content-mega both repos; content revert sweep at scripts/mega_release/revert_content.sql; governance rows queued for /admin/content-qa spot review.

Operator approved all four follow-ups. (1) MOBILE ASSIGNMENTS: web studentSubmit refactored into shared AssignmentController::processSubmission (also fixes a latent bug: keep-existing-file loop read an undefined $subData, silently dropping previously uploaded files on resubmit). New API: GET /student/assignments (required + library + my status + stats), GET /student/assignments/{id} (deliverables, guidance, my submission + 3-agent AI reviews), POST /student/assignments/{id}/submit (multipart deliverable_N fields/files; same core as web: 3-agent AI review advisory, approve-on-first-attempt, XP, certificates). New mobile pages /assignments + /assignments/[id] with deliverable forms (text/url/file-camera); home assignment card links restored. (2) REAL PROOF UPLOADS: POST /student/exercises/{id}/proof (multipart) with the web validation (ext allowlist + real MIME + size cap), saves to uploads/proofs, proof_uploads row, proof-bonus points, AI eval queued; does NOT auto-complete (mobile submit+auto-forward follows). Mobile /practice/[id] now keeps the real File and uploads before submit (was: local blob URL sent as a string — proof never reached the server). (3) LEADERBOARD PARITY: GET /student/leaderboard extended with ?type=daily|xp|exercises|streaks|weekly and ?batch={id} (default own batch, 0=all Pakistan) mirroring web rankings; response adds type/selected_batch/my_batch/batches[] and per-item value/value_label; default call backward-compatible. Mobile /social/leaderboard gets tab chips + batch chips (own batch starred). (4) dashboard.php $userId defined before first use (was line ~498 after use at 428 — PHP warning in logs).

Operator reported m.maahir.io/learn/33 error. Root cause: studentModuleDetail returned a minimal shape while the mobile page expects the LIST endpoint's richer fields — track_name/points/est_minutes/progress_pct missing (card rendered '+ pts', ' min', no progress) and exercises sent my_status instead of completed (ticks never showed). QA sweep of every student GET /api/v1 endpoint (as a real student) then found the same class of bug elsewhere: (1) module detail enriched to full shape (joins training_tracks + exercise aggregates + per-exercise completed flag, my_status kept). (2) dashboard recommendations lacked est_minutes/points (mobile Continue-Learning card showed blanks) — added. (3) dashboard pending_assignments lacked subject/due_at keys the mobile card uses — aliased. (4) daily_motivation + upcoming_milestone were dormant mobile features the API never sent — ACTIVATED: deterministic daily motivation rotation (10 messages by day-of-year) + next-500-XP milestone card (title/description/reward_points/progress). (5) mobile home assignment cards linked to /assignments/{id} which does not exist on mobile — converted to plain cards until a mobile assignments page ships (PARITY follow-up). Mobile learn page also got defensive guards (hide absent fields; completed || my_status fallback).

Operator: 'I need feedback from time to time — simple, what needs improvement / features / courses next, checkable in admin' + 'detect mobile browsers and offer m.maahir.io'. FEEDBACK: feedback_items type ENUM gains 'improvement'; new table feedback_prompts tracks daily picks. FeedbackController::pickDaily() (lazy, first dashboard load after midnight) selects EXACTLY 2 random eligible students/day (approved, active, no feedback in 30d, not picked in 14d — fresh voices; settings-key day lock + unique pair = race-safe). Picked students get a one-time popup on the dashboard, firing 30-120s into the session ('sudden'), with one textarea + 3 chips (Needs improvement / Feature I want / Course I want next) → POST /student/feedback/quick (new; title auto-derived, logged to the existing board) or 'Not now' → POST /student/feedback/prompt/dismiss (pick consumed either way). Admin Feedback Board (/admin/feedback/manage) gains the 💡 Improvement label, Course/Content relabel, and a picks/responded stats line (today + 7 days). MOBILE BANNER: partials/mobile_switch_banner.php in the shared layout — UA-sniffed (Mobile/Android/iPhone/iPad/Opera Mini/IEMobile), shown to ANONYMOUS visitors too; dismissible permanently (localStorage); logged-in deep-links to the matching m.maahir.io page (exercise/{id}→/practice/{id}, courses, roleplay→/coach/roleplay, leaderboard→/social/leaderboard, forum→/social/forum, else /home); anonymous /login,/register map to the same mobile paths. Session carries via the shared .maahir.io cookie. Note: View::partial has its own scope — the partial uses Auth::check() not $currentUser.

Operator-approved broadcast announcing the simplification wave (v11.72-11.83): new Getting Started guide + Learn AI-first dashboard, auto-forward on exercises, mastery tracks, experience features (role-play/decisions/business English/AI teachers), the XP system (streaks/combos/multipliers/levels/rankings), 9-language support, the referral program (personal link per recipient + 10,000 bonus at friend's 10k XP + 10% lifetime commission), Fall WhatsApp group (with summer-link rejoin note), how-to videos from Oct 10. TEST send to mmunaf@gmail.com reviewed and approved by operator first. Sent via scripts/send_announcement_simple_20261004.php (Mailer::sendRaw, 150ms throttle, dedup by email_log template_key announcement_simple_20261004): 450 sent / 0 failed. Data change: user 311 (Sohail Khan) approved pending->approved (row dump in storage/backups/revert_announcement_20261004/). 4 missing referral codes backfilled (MAA+7).

Operator: '10000 points for referrals; each XP they gain you get 10% — someone gets 1000XP you get 100XP as well; bonus lands after the friend gains 10,000 XP by any means; applies to existing referred users; include it in the welcome email.' Mechanics: (1) COMMISSION — every PointManager::award to a user with referred_by pays the referrer exactly floor(referral_commission_pct%, default 10) of the friend's post-multiplier points, awarded RAW (no multipliers/combo — a true 10%), min 1pt, skipped when the award < 10pts, never recursive, demo users excluded. Works for web + mobile automatically (single points funnel). (2) ONE-TIME BONUS — when a referred user's XP balance (users.points, the leaderboard number) crosses referral_bonus_xp_threshold (default 10000), the referrer gets points_per_referral (10000) + in-app notification; tracked in new table referral_bonuses (UNIQUE referrer+referred pair — idempotent and race-safe). Verified none of the 7 existing referred users are near the threshold (max 575 XP). (3) WELCOME EMAIL — batch welcome cron now includes each student's personal invite link (play.maahir.io/register?code={S4S code}) + both rewards. Invite-code attribution confirmed already wired (invite_codes.created_by sets referred_by at registration, RegistrationController:410).

m.maahir.io /practice/[id] (from /home) submitted via POST /api/v1/student/exercises/{id}/submit which ran a simplified completion (no streak/SkillXP/achievements/credit, points_earnED column left 0) and returned no next-exercise info — students bounced back to the module list. The endpoint now routes through the shared StudentController::completeExerciseFor() core (made public): identical pipeline to play.maahir.io (points+multipliers, streak, SkillXP, achievement checks, credit score, activity feed, dashboard cache bust). Module access now matches web rules (auto-grant module 1/kids; locked non-foundation modules -> 403 module_locked) + demo-limiter check. Response ADDS next_exercise_id/next_title (or is_last+module_id) on both fresh and already_completed submissions — additive, non-breaking. Repeat submissions still award 0 (mobile behavior preserved). Mobile app update ships in the mobile repo (auto-forward UI).

Operator: 'whenever I click English Tutor it should open a NEW chat, and make a subject easy to continue; from time to time tell the user they can use role-play/scenario/reverse role-play to strengthen this — like a popup'. (1) /student/english-tutor now opens a FRESH chat every visit (was: auto-resumed the most recent chat); a saved chat opens only via ?chat=N. (2) Empty state shows a one-tap '↩ Continue: {title}' button for the most recent chat; the drawer list (already with mode icon, turns count, relative time) stays the resume surface. Mode switching no longer auto-jumps into an old chat — it applies to the current context. (3) Light nudges (kept un-bothersome per operator): after the 3rd AI reply in a session, at most once per 3 days (localStorage), a small dismissible bottom toast that auto-hides in 12s: rotating tips linking Role-Play, Decisions, Reverse-interview Role-Play, and Micro (mode-aware pool: drill users get interview-flip first); never the same tip twice in a row.

Operator: 'are we logging AI English Tutor / roleplay / scenario usage per person, and what category they practiced?' Data was logged all along (english_tutor_chats with turns+mistake patterns, ai_roleplay_sessions with scenario_type+score, scenario_attempts joined to scenario_bank domains, ai_requests) but NO admin/teacher surface showed it per student. Added AdminController::practiceUsageData() + a shared partial rendered in the admin Student Dossier (after Module Progress) AND the teacher Student Activity page (/attendance/student/{id}): three cards (English Tutor chats/turns/modes/mistake-pattern chips, Role-Play sessions/completed/avg-score/category chips, Scenarios attempts/avg/lessons/domain chips) + a recent-20 unified log. CSV export: GET /teacher/practice-log/{id} and /admin/practice-log/{id} (up to 1000 rows: Date, Feature, Item, Category, Score, Completed); teachers restricted to students in their own batches (batch_teachers guard, 403 otherwise). Fix along the way: english_tutor_chats is utf8mb4_0900_ai_ci while the practice tables are utf8mb4_unicode_ci — UNION required explicit CONVERT(... ) COLLATE utf8mb4_unicode_ci on title/mode.

Operator: 'URL submitted, answered, but didn't move to next — why isn't there a NEXT when they submit?' Root causes found: (1) The proof forms (Submit URL / Upload / Add Note) are plain POSTs to uploadProof() which saved the proof and redirected BACK to the same page — completing required a second click on 'Mark Complete'. Now uploadProof() auto-completes the exercise in the same request (full XP + streak + achievements via the shared completeExerciseFor() core) when it isn't completed yet, then redirects with ?done=1; the exercise page auto-shows the next-overlay (auto-forward 3s) on load. One click total. Demo-limited users keep the old behavior; completion failure falls back gracefully (proof still saved). (2) REAL BUG (pre-existing, this is why Next never showed anywhere): the exercise fetch JOINs modules and selected m.order_num which SHADOWED e.*.order_num (exercises.order_num) in the fetched row — prev/next queries compared against the module's order (1001+) instead of the exercise's (1-100), so prev/next returned nothing and the bottom Next -> button + completed-banner Next Exercise -> never rendered. Fixed with e.order_num AS ex_order_num in both exercise() and completeExerciseFor(). Refactor: completion core extracted to completeExerciseFor() shared by the endpoint and uploadProof (endpoint response unchanged, additive fields from 11.79.0).

Operator: 'after completing one exercise there should be a NEXT option — they are going back and forth; add xp and next question link and auto-forward to 2'. XP was already awarded on completion (PointManager: base + proof bonus + AI bonus + SkillXP + streak). What changed: (1) POST /student/exercise/{id}/complete response now includes next_id/next_url/next_title (same module, next order_num, published — identical rule the page nav uses) or next_url:null + module_url when it was the module's last exercise. (2) Classic mode: blocking alert+reload replaced by a success overlay — '+X points!', up-next title, Continue button, 3s countdown auto-forward, 'Stay on this page' (reload shows the completed banner + rating). (3) Guided/Roshni mode: the 'Loading next...' message was a lie — it reloaded the SAME page; now it truthfully forwards to data.next_url via the same overlay. Last-exercise case shows a 'module complete' card linking back to the module.

Operator: WhatsApp invite link was showing the Summer group. (1) DB data change: batches.id=4 (AI Pakistan - Fall 2026) whatsapp_group_url updated DvVr7h6s9pd6cMbpXD170z -> EFHKeWowBSQ5XDvkHd0Pn1 (operator-supplied current link; row dump + revert SQL in storage/backups/revert_v11.78.1/batch4_row.sql). Dashboard Getting Started card, profile page, and welcome-email cron all read this column per user batch — no code change needed there; they now serve the correct Fall link to batch-4 students. (2) Bug fix: /student/guide (Start Guide) had the Summer link HARDCODED in the view (learning-guide.php line 4); learningGuide() now computes wa_url from the user's batch (fallback: default_batch_id batch) and the view renders it — batches with no link get a 'will be shared' note instead of a dead button. Batch 3 (Summer) keeps its own link by design.

Housekeeping. (1) Removed JobRunner's processQuizGen() stub and its dispatcher arm — the 'Sprint 5 TODO' was dead code: nothing ever enqueued a quiz_gen job (0 rows ever in ai_job_queue; the chatTask('quiz_gen') calls in AdaptiveQuizController are AI route keys, unrelated to the job queue). Left a pointer comment at the removal site. (2) Docs de-drift: ARCHITECTURE.md brought from v10.6 to current reality (29 Core classes, 94 controllers, 436 views, 1,191 routes = 178 top-level + 869 across 6 web groups + 144 /api/v1, 316 DB tables); API.md and DATABASE.md headers corrected with staleness notes; CHANGELOG.md regenerated for v11.12.0-v11.78.0 from this manifest (the authoritative ledger). Revert kit: storage/backups/revert_v11.78.0/.

Completes the Rankings page (follow-up to 11.75.0). (1) Batch selector chips above the toggle: 'All Pakistan' (?batch=0) + every active batch (?batch=<id>), default = user's own batch (marked with a star). Selecting All Pakistan hides the batch/global toggle and defaults to the global board. (2) New 'Daily' tab: today-only top scorers from points_log (global + batch, top 20). (3) Bug fix: the batch streak board was a no-op — it filtered streakGlobal by its own user IDs (always all rows); now filters by actual members of the selected batch. All batch-scoped queries (XP, exercises, streaks, daily, weekly, own-rank, batch name) now follow ?batch=. Revert kit: storage/backups/revert_v11.77.0/.

Operator feedback: (1) 'whatsapp message to join group got missed please add that' — moved WA card out of 'Explore more' collapse back to always-visible (the very first block in Getting Started); (2) 'No need for weekly quest' — Weekly Quests section wrapped in if(false) comment-out, kept for easy revert; (3) 'Your Batch stats can come after getting started' — widget moved from after Daily Challenge to right after Getting Started (verified: Getting Started → Your Batch → Daily Challenge); (4) 'should share person XP that this is your XP and level' — added '📊 Your progress X XP · Beginner (Level 0) · Next level in X pts' line in the widget using $stats['total_points'] + $levelInfo['name'] + $levelInfo['level'] + $ptsToNext. Removed duplicate widget block created during reorder. Smoke 9/9, div-balance 0.

Operator: 'how can we make it competing like x person from this batch completed this today top scorer etc... maybe daily will be nice and a full page for full leadership exercise roleplay scenario XP etc etc in detail page which can be in my maahir.' Also: 'getting started can it shrink a bit.' (1) Dashboard 'Your Batch' widget: daily leaderboard (top3 scorers today, batch filtered from points_log) + activity feed (last3 completed exercises today, batch filtered from exercise_progress) + your rank + 'keep going!' nudge. Placed between Daily Challenge and Weekly Quests. 'View full rankings →' link. (2) /student/leaderboard rankings page: 4 tabs (XP, Exercises, Streaks, Weekly) with batch/global toggle, top 20 each, 'beat the person above' nudge. Nav: My Maahir → 🏆 Rankings. (3) Getting Started card shrunk: Steps 2-3 + WA card collapsed behind 'Explore more' <details> toggle — card ~380px (was ~984px). Step 1 always visible. Bug fix: dashboard query had ambiguous SUM(points) in subquery joining points_log + users — fixed SUM(pl.points). Verified: dashboard shows Getting Started (shrunk, collapsible) + Your Batch widget + Daily Challenge + Weekly Quests; Rankings page shows 4 tabs + toggle + 135 rows; nav item live; div-balance 0; smoke 9/9.

Operator: 'just learn AI is the key' + check dashboard for 'what is not needed'. Dashboard cleaned for beginners. Removed: (1) Recommended For You (arbitrary suggestions — platform has only 10 total track enrollments); (2) Real-World Skills lazy section (advanced — accessible via Practice menu); (3) showSurprise function + surprise bonus checker JS (rendered ${title} as visible HTML — the popup's template literal appeared outside <script> context due to browser HTML parsing of template content); lucky-double claim now uses showToast. Result: 31.9KB → dashboard is now: greeting → Getting Started (HERO, impossible to miss) → Daily Challenge → Daily Check-in (asks questions) → Weekly Quests (collapsed) → Assignments (conditional). 6 clean sections, no competing CTAs, beginner-first. ${title} bug confirmed fixed in rendered HTML. Smoke 9/9.

Operator: 'onboarding — learn AI should be centerpiece which is not there.' Added 'learn_ai' goal to OnboardingController::$goals as the FIRST entry (11 goals total). Goal picker renders it full-width with primary styling (grid-column:1/-1, primary border + glow + shadow). Selecting it redirects to /student/foundation. WelcomeController: goalLabels + goalCTA synced for learn_ai. Verified: goal picker shows 11 cards, Learn AI first + full-width class, smoke 9/9.

Operator: 'move saheli after know yourself in nav.' Removed the special top-level sidebar link for Saheli (Women) from app.php; added it to the 📚 Learn group in config/navigation.php after 'Know Yourself'. Same URL (/student/empowerment). Verified: Saheli renders once in the Learn group at the correct position (after Know Yourself, before Certificates); no duplicate top-level link; smoke 9/9.

Operator: 'yes to both' — catalog expanded always, Change my goal prominent. (1) Explore section: removed display:none conditional — catalog visible for all users (fresh or with goal). (2) All 5 sections (Business & Freelance, Tech & AI, Jobs & Professions, Community & Pakistan, Core Courses) have open attribute — expanded by default. (3) 'Change my goal' button added as a standalone pill-shaped link between Your Path and Explore — visible when goal is set. Verified: fresh user sees gate + expanded catalog (5/5 sections open); user with goal sees Your Path + Change my goal + expanded catalog; no gate rendered when goal set; div-balance 0; smoke 9/9.

Operator: 'wouldnt it better if I start from there what I wanna do and then this page comes'. When no goal is set, /student/courses is a full-screen goal gate (Learn AI subtitle + Start button + 6 goal buttons + 'Just let me explore' skip link). Explore Everything hidden until goal picked or skipped. After goal pick: compact Start Here (adaptive progress) + Your Path (recommended tracks filtered by goal, 8 shown, next-step highlight) + Explore (5 groups + Core Courses, collapsed, search). Gate skip shows Explore without setting a goal. Goal picker forms POST to /student/onboarding/set-goal with redirect_to=/student/courses. Verified: fresh user sees gate with 6 buttons + skip; goal pick → path shows with 8 recommended tracks; Explore hidden when gate shown; width normal; zero JS errors; smoke 9/9.

Operator: 'leave everything to your decision for this page' + earlier direction: 'our core is AI Foundation — rest is developing/experience-sharing; think like a 12-year-old non-IT kid.' Redesigned /student/courses as a path page (not a catalog). Page: (1) START HERE — Learn AI card + subtitle + Start/Continue button (adaptive to progress %); (2) 6 goal buttons (Get a Job / Start a Business / Freelance / Learn AI Tools / Teaching / Just Curious) — each submits goal via POST /student/onboarding/set-goal with redirect_to=/student/courses (OnboardingController::setGoal now accepts redirect_to param); (3) YOUR PATH section (shown only when goal set) — recommended tracks filtered by goal group from config/track_categories.php (first unstarted highlighted as 'your next step', 8 shown, change-goal link); (4) EXPLORE EVERYTHING — 5 collapsible sections (4 track groups + Core Courses) with live search across all 43 rows. No marketing banner/door/chips above content. Text-based. Mobile: unchanged (follow-up). Operator may revert. Revert kit: storage/backups/revert_v11.73.0/. Verified: fresh user (goal cleared) sees 6 goal buttons; goal pick → path shows 8 recommended tracks + next step highlight; sections render (5 groups + Core Courses = 43 track rows + 9 core); width normal; zero JS errors; smoke 9/9.

Operator: 'All Courses has mastery tracks then no need.' Removed 'Skill Tracks' from the Create group (it pointed at the same /student/courses catalog as All Courses in Learn — a duplicate door). Create: Playground, Business Tools, AI Helper, Job Packs, Final Project. Help page Create section de-duplicated (Mastery Tracks entry removed). Old /student/mastery hub remains URL-only. Revert kit: storage/backups/revert_v11.72.5/.

Operator approved 'Learn AI' (my pick over AI Basics/Start Here/First Course — action words beat abstract 'Foundation' for the English-struggling audience) and moved the catalog link into Learn. Changes: (1) 🤖 AI Foundation → 🤖 Learn AI across sidebar (+START tag kept, search text extended), /student/foundation h1 (soul sub-line unchanged), catalog Door ('Learning AI IS Maahir'), Getting Started Step 1 (+ button 'Start Learning AI'), dashboard header button, help core section, catalog foundation card title, tour copy. URL /student/foundation unchanged. (2) Catalog menu item renamed 'All Courses' and moved to 📚 Learn 2nd position; removed from Explore; Getting Started Step 3 button, help config and tour copy aligned. Zero stale old labels on rendered dashboard (verified). Revert kit: storage/backups/revert_v11.72.4/ (10 file backups).

Operator deep-review of /student/courses ('do all' on the analysis). Problems fixed: (1) 'Recommended for you' showed 3 zero-enrollment niche tracks (Supply Chain/Legal/Hospitality) to a goal-less user while claiming 'for you' — platform has only 10 track enrollments total (31/35 tracks at zero), so the strip was arbitrary: REMOVED (view block + controller computation disabled; goal_group mapping kept in config for an honest future version). (2) Category collapse 6→4 buckets: Business & Freelance (9), Tech & AI (6), Professions & Specialist (17), Social Impact (3) — config/track_categories.php rewritten, mobile mirrors. (3) Cyber Hygiene card had 0 modules — empty core cards now hidden at query level. (4) Duplicate-domain confusion (AI for HR Professionals vs HR Mastery etc.): 7 Core cards now carry 'Next level: <Mastery track> →' ladder links (Entrepreneurship, Cybersecurity, HR, Finance, Operations, Freelance, Sales) — one door, two depths. Structure now: Start Here → Core Programs (AI Foundation first, 9 cards, 7 with ladders) → 4 track buckets. Revert kit: storage/backups/revert_v11.72.2/ (4 .baks + REVERT.md). Verified: chips/sections show 4 buckets, recommended absent, Cyber Hygiene absent, 7 named ladders render, page width 1078px (no collapse), zero JS errors, div-balance 0, smoke 9/9, mobile tsc+build+smoke 159/159.

Operator follow-up: /student/modules showed 'Foundation (0)' after v11.72.0 filtered the group out — but the library's Foundation tab is the page's DEFAULT view. Fix: foundation modules back in the library listing (21, tab shows count, default tab renders) while the dedicated /student/foundation hero page stays; women_empowerment remains Saheli-only. The library's Foundation tab now opens with a '🤖 This is the REAL SOUL of Maahir — everyone starts here' banner linking to /student/foundation. Verified: tab count 21, banner + cross-link live, women tab still absent, div-balance 0, smoke 9/9.

Operator: 'Foundation is the REAL CORE HEART — the actual model teaching them; it's being ignored' + 'AI Foundation below Dashboard in main menu' + 'Saheli hub with everything female' + 'kids sections in learn and practice'. (1) New /student/foundation page: the 21 foundation modules (operator choice: foundation only) as hero cards — 'The REAL SOUL of Maahir — everyone starts here', Module 1 first with Start-here badge, per-module progress, stats strip (modules/lessons/finished/done). Sidebar gains two top-level links directly below Dashboard: 🤖 AI Foundation and 💪 Saheli (Women). Catalog 'AI Foundation Course' card, Getting Started 'Open Foundation Course' and Help page buttons repointed to /student/foundation. (2) Women: existing /student/empowerment (Women Empowerment Hub — WE courses with progress, 744 female-targeted roleplay scenarios, Saheli databank ideas/prompts/templates/guides/legal, women founders) retitled 'Saheli — Women's Hub' and promoted to the top-level nav (was URL-only). Women Empowerment module group hidden from My Lessons (home = hub). (3) Kids: new /student/kids hub (6 kids modules + play link to /student/kid-scenarios); nav: Learn → Kids Learning, Practice → Kids Practice; kids group remains in the library. (4) My Lessons (/student/modules): foundation + women_empowerment excluded (own homes; filter in controller query) — verified group headers gone, kids remains. Revert kit: storage/backups/revert_v11.72.0/ (4 view/config .baks + REVERT.md). Verified: all pages 200, foundation renders 21 cards + badge + Module 1, sidebar links live, div-balance 0 on all touched views, Playwright widths normal + zero JS errors, smoke 9/9.

Operator-directed during maintenance window (banner ON). (1) 'Your First Week — 5 starter lessons' strip removed from /student/modules (view block deleted with a restore pointer; full backup in storage/backups/revert_v11.71.1/ incl. modules.php.bak + REVERT.md). (2) Module 378 'Women in AI' moved from foundation to women_empowerment group (renders under 💪 Women Empowerment now). (3) Module 142 'Quick Test Quiz' (order 1099, 3 exercises) unpublished → status='draft' (hidden, one-line revert). All reversible per REVERT.md. Verified live: strip 0, quiz 0, Women in AI under Women Empowerment; php -l + div-balance 0; smoke 9/9.

Operator requests: a simple page explaining every category/feature ('the actual core for learning AI gets priority' → Foundation Course section first, always open) and a maintenance bar togglable from chat. Help page: /student/help renders the CORE (AI Foundation Course: how modules work, Classic vs Interactive, Module 1 Talking to AI, the 16 module groups, progress + certificates, Open/Start buttons) followed by Basics-style groups — Learn(7) Practice(6)+Inside More Practice(14, from HubController::PRACTICE) Build & Master(6) Career & Earn(6) Community(5)+Inside Competitions(9) Explore(6, incl. new Help item) My Maahir(9)+Inside Profile/Settings/Goals(12) — 80 items total, each icon+name+what-it-does+when-to-use+Go link, collapsible sections with counts, live search (normalized: 'roleplay' matches 'role-play'). Content lives in config/help.php; hub lists imported from HubController constants (auto-accurate). Links added: Explore nav 'Help & How-To', Support page header, Onboarding hub tools. Maintenance banner: partials/maintenance_banner.php (Auth-gated, sticky amber, non-blocking) included in app.php + fullscreen.php; settings.maintenance_banner flag; scripts/maintenance.php CLI (on [msg]/off/status). Verified: help 200 with 80 rows + search 6/6 roleplay variants + 900px content (no layout collapse — div-balance checked on every touched file, per operator's demand after the v11.70.2 incident); banner ON shows dashboard+welcome, anonymous /, /login, /features, /register show none, OFF removes instantly; smoke 9/9.

Operator: 'you messed it up, check yourself' — the dashboard rendered with the Getting Started card 4,426px tall and all content squeezed into a ~48px column. Root cause: the v11.70.2 Daily-Goal removal script's div depth-walk started at the element's id= attribute (after its opening <div), so it ended one </div> short — leaving the daily-goal card's inner content (goal text, target <select>, two closing </div>s and the changeDailyGoal script) orphaned in the page. The stray </div> closed the .main layout wrapper early, collapsing main.content to ~0 width and stacking every word vertically inside the Getting Started card. Fix: removed the entire orphaned chunk (div balance restored to 0). Verified: greeting 70px, Getting Started 984px, all sections normal heights in order, zero JS page errors, div balance 0, php -l clean, smoke 9/9. Lesson applied: verify structural cuts with an HTML div-balance check before shipping.

Operator audit ('check dashboard, tell me what is not needed' → 'go'). Order change: greeting+date+streak now FIRST, Getting Started card directly below (was above). Removed from dashboard.php: Daily Goal card (3rd do-this-today widget), WhatsApp banner (duplicate of Getting Started #1 — same batch link), Support Quick Access card (sidebar has it), Learning Guide banner (duplicate of GS), Career Track enrollment prompt (nags beginners; GS Step 3 covers), Feature Discovery Spotlight, dead-code battles block (if(false) wrapper), Community & Wellness details wrapper (forum/polls/wellness — forum lives in sidebar). Removed from app.php (all student pages): 'You've been away X min!' idle popup (idle tracking code inside the shared gamification IIFE — combo meter, launch announcement, toasts, confetti untouched), 'Daily Report Before You Go?' banner + modal + dedicated script. Borderline items kept per audit: Surprise Rewards, launch announcement, Women in AI, Batch Resources. Dashboard is now: greeting → Getting Started → streak warning → assignment banner → Daily Challenge / Quests / Recommended / micro skill / Real-World Skills / Bookmarks. View shrank 57.5KB → 42KB. Verified: all 12 removal targets absent from rendered HTML, order GREETING→GS→…, zero JS page errors, smoke 9/9.

Operator request. Removed from the dashboard: the 'Complete your setup (x/5)' strip (also carried stale 'S4S' branding — setup now lives in the Onboarding hub's profile checklist), the 'My Journey — Zero to Hero' card (Journey remains at My Maahir → My Journey), and the 'Job-Ready Checklist' progress strip (feature remains at Career & Earn → Job-Ready Checklist). Dashboard top is now: Getting Started card → streak-at-risk warning (when applicable) → content. Controller still passes journeyStage/jobReady data (harmless, view ignores).

Operator-directed onboarding overhaul. (1) Dashboard-first: removed the <5-completions redirect to /student/welcome — every login lands on the dashboard from the start (Welcome page remains reachable via the hub). (2) Getting Started card (partials/getting_started.php, shared by dashboard + hub) written for total beginners — every instruction says exactly where to click: #1 Join WhatsApp Group (user's own batches.whatsapp_group_url); 'no need to rush' intro; Classic = step-by-step vs Interactive = like a friend teaching you; ⭐ Step 1 AI Foundation Course ('the REAL SOUL of Maahir') with the left-menu path spelled out + Open Foundation Course and Start Module 1 buttons; 🎭 Step 2 Practice with one-line descriptions of Decision Scenarios / RolePlay / English Tutor + More Practice + 🧠 Know Yourself → Assessments (personality type, strengths); 🎓 Step 3 Mastery → Browse All Courses. ✕ dismisses permanently (POST /student/onboarding/dismiss → users.onboarding_dismissed=1) and the card auto-hides once the 5 starter lessons are complete — 'skips it, never asked again'. (3) Onboarding hub at /student/onboarding/hub, nav 'Onboarding 🚀' first in My Maahir: the same Getting Started guide + goal card (goal-less see 'Pick your goal', skippers see a calm 'Exploring for now 🌟' chip — never a prompt) + 5 starter-lesson checklist with done/next states + profile-setup checklist (profile/birthday/avatar/assessment/first-exercise with progress %, reusing the legacy checklist rules) + tools row (Guide, replay guided tour, Welcome page, Journey map). DB: users.onboarding_dismissed tinyint added. reset_student.php clears the flag. Verified live: dashboard 200 without ?full for a fresh student, card + WA button + 3 steps render desktop+mobile with zero page errors, dismiss POST → flag=1 → card gone on reload (then reset), hub renders all sections, nav item live, smoke 9/9.

Operator: 'replace AI fundamentals + AI productivity suite + developer tools with /student/modules (foundation course) — I don't see additional modules in core; Life Skills & Ethics may not be fundamental'. The real foundation content (Talking to AI etc., 220 course-less modules) lived only at /student/modules while the catalog showed 3-module 'AI Fundamentals'. Change: synthetic AI Foundation Course card (StudentController::foundationCourseCard — counts modules/exercises where course_id IS NULL or in the replaced set, includes live user progress) is now the FIRST Core Programs card, CTA → /student/modules; AI Fundamentals / AI Productivity Suite / Developer Tools cards removed; Life Skills & Ethics moved last. GET /api/v1/student/courses applies the identical replacement (foundation row slug='foundation' first, life-skills last) so mobile mirrors it; mobile CoreCourseCard shows a Start→/learn CTA for the foundation row. Verified: web Core order = Foundation (234 mods · 3656 lessons) → business/cyber/… → Life Skills last; API returns foundation first; smoke 9/9; mobile smoke 159/159.

Operator feedback: 'Core programs should come first, then recommended' + earlier 'where are the original modules (Talking to AI / ChatGPT)? Getting Started Guide should come first'. Root finding: Module 1 Talking-to-AI lives inside the AI Fundamentals course (only 3 modules) and 220 of 323 modules have no course at all — reachable only via /student/modules, which the catalog never linked. Changes: (1) new Start Here strip above everything — Getting Started Guide (/student/guide), Lesson 1: ChatGPT — Your First Message (/student/exercise/1, from config/starter_path.php), All Lessons (/student/modules); (2) page order now Start Here → Core Programs (first section, open) → Recommended for you → category groups; (3) AI Fundamentals card description prefixed with the ChatGPT/Claude/Gemini hint. Mobile mirror: same Start Here strip (Guide → /learn/1 → /learn) above Core Programs on m.maahir.io /courses. Follow-up noted: mapping the 220 course-less modules into Core Programs is a separate content task.

Operator: '/student/courses is cluttered, hard to find what I need'. Was 47 large cards in one wall with no search/filter. Now: (1) sticky toolbar — live search (name+description) + category chips (All / Core Programs / Business & Leadership / Freelance & Earning / Job Skills / AI Specialist Careers / Specialist Professions / Social Impact) + progress toggles (In progress / Not started); (2) 'Recommended for you' strip — top-3 most-enrolled tracks from the user's onboarding-goal group (fallback: most-enrolled overall); (3) collapsible sections per category with live visible/total counts — only Core Programs open by default, matching sections auto-open while searching; (4) compact single-row cards (icon, title, difficulty, modules/weeks/lessons, Start/Continue) — 3x density, progress bar only on started items; (5) popularity (enrolled_users) sort within groups. Grouping = new config/track_categories.php (pure arrays: slug→group for all 35 tracks + goal→group; unmapped slugs land in 'More Courses'). GET /api/v1/student/tracks now returns category per track for mobile grouping. Verified via Playwright: 47 rows render, Core-only open initially, search 'freelance'→3 rows + auto-open, 'healthcare'→2, Job Skills chip isolates 6 rows, Not-started filter shows 47 unstarted, zero page errors; smoke 9/9.

Operator request: 'remove whats new popup disable'. Removed BOTH surprise modals from the app layout: (1) #whatsNewModal — version-change modal reading manifest history on first page view after an update; (2) #whatsNewOverlay — once-per-session changelog-entries overlay (with its dismissWhatsNew script and whatsnew_shown_ session key). Kept: /student/changelog page, sidebar nav entry, and the small NEW-count badge on that nav item. Layout now: last_seen_version session still updated (no modal attached). Verified: rendered pages contain zero whatsNew markup, php -l clean, smoke 9/9.

Operator shared /status showing 3 known issues. Investigation: ALL THREE were development artifacts, zero real user-facing bugs — (1) ISS-57C0A 'Class Auth not found' recurrence = a CLI test script (/tmp) missing the Auth import; the actual Sep 27 teams-views fix is intact (8 real hits stopped that day). (2) ISS-52B94 = seed_partner_gaps_d.php seeding artifact. (3) ISS-16DC7 = /tmp verification-script TypeError. Fixes: (a) error_status rows resolved as noise with honest diagnostic notes, status cache cleared — board now shows 'No known issues'; (b) structural fix — CLI (php_sapi cli) errors now log to storage/logs/cli_error.log instead of error.log and the exception handler skips HTTP output for CLI, so scripts/tests/cron dev artifacts can never surface on the public /status board again while remaining diagnosable. Verified: RuntimeException via bootstrap lands in cli_error.log only; smoke 9/9.

Operator-directed cleanup: soft-deleted (deleted_at set, data preserved for ledger/audit) users #61 hello.taha@gmail.com, #62 taha.khalid@gmail.com, #496 unknown.trusted.user@gmail.com (all sharing whatsapp 03282372325 — dead duplicates shadowing live account #487) and #501 dilat91136@aminavin.com (operator test account). Auth::attempt candidate queries now filter deleted_at IS NULL so removed accounts' emails/numbers/passwords can never shadow or match live users. Verified: removed-account logins rejected, shared number now resolves unambiguously to the one live account, smoke 9/9.

Operator follow-up: an account created earlier still rejected WhatsApp-number login even after v11.68.8. Root cause: the number 0328237325-family is stored on FOUR accounts (61, 62, 487, 496 — same person registering repeatedly since July); v11.68.8 picked one row (oldest id, never-logged-in #61) whose password differs → 'wrong password'. Fix: phone-like identifiers now fetch ALL matching candidates (exact-match ranked, then recently-used first, LIMIT 6) and password_verify runs against each — the account whose password verifies is the one logged in. Covers shared family numbers and duplicate registrations without touching user data. Wrong-password on a multi-match number shows a hint to use email login. Verified by HTTP E2E: two accounts sharing 03119998877 (different formats/passwords) each log in with their own password (0300 and +92 variants), wrong password rejected. Recommend admin cleanup of dead duplicates #61/#62 (never logged in) — operator decision.

Two operator-reported bugs. (1) Tour popovers floated disconnected (bottom-left corners) from their targets. Root cause: engine-wide align:'start' + driver.js auto-placement mis-anchoring on this layout (fixed sidebar with its own scroll container, expanding nav groups, below-fold cards; driver's no-space fallback parks popovers at viewport bottom and align:start glues them to the target's left edge; state.activeElement is also stale during onPopoverRender). Fix: custom deterministic placePopover() — prefers configured side, flips when no viewport space, rejects candidates whose clamping broke target adjacency, scrollIntoView(block:center) for targets inside scrollable containers, clamps fully inside viewport as last resort; wired via onPopoverRender + onHighlightStarted with re-placement at 50/350/600ms (after driver's final animation-end pass); config gains per-step align + mob_side/mob_align; popover max-width min(360px,88vw). Verified with a Playwright adjacency audit: popover↔target gap ≤140px with perpendicular overlap on every step — welcome/desktop 4/4, welcome/mobile 4/4, dashboard/desktop 7/7, dashboard/mobile 4/4, exercise 3/3 (was 9/22). (2) Login with a WhatsApp number failed ('No account found…'): Auth::attempt only matched email/phone/cnic. Registration makes WhatsApp mandatory but phone optional, so WhatsApp-only users could not log in with their number. Fix: phone-like identifiers normalize to last-10-digits and match phone OR whatsapp via RIGHT(REGEXP_REPLACE(...)), exact matches prioritized (ORDER BY), short identifiers fall back to exact phone/whatsapp; registration hardening copies WhatsApp→phone when phone empty; login subtitle now says 'email, phone, or WhatsApp number'. Verified: test user with phone=NULL, whatsapp='+92 345 9876500' — all of 03459876500 / +923459876500 / 923459876500 / 3459876500 / spaced variant resolve; wrong numbers rejected. Mobile app login covered automatically (same Auth::attempt).

Operator report: after Roshni's tour nudge popped up, typing 'tour' returned the canned reply with a LITERAL [LAUNCH_TOUR] token instead of a button ('mo button'), then the generic AI produced a low-quality hallucinated text tour. Root cause: the Bot Popup (sendBotReply + escBP + the nudge renderer in checkBotPopup) is a separate render path from the sidebar chat — only the sidebar had the token→button replacement. Fix: new bpRender() (escBP + [LAUNCH_TOUR]→button) used in BOTH popup render paths; shared launchTourFromMsg() (closes the Bot Popup first, then MaahirTour.launchFromChat()) now used by sidebar + popup buttons. Verified via Playwright: unit tokenization on both renderers, live 'tour' send in sidebar AND popup render real buttons, DOM click on the popup button closes the popup and starts the dashboard tour.

Operator feedback: 'just 1 exercise is enough... and they can skip that too'. (1) Exercise tour now boots on exercise 1 ONLY (was 1-3; guard in exercise.php, localStorage suffix '1'). (2) Skip fix: the last step of every tour had showButtons ['next'] which HIDES driver.js's X close button — now ['next','close'] so users can dismiss at any point incl. the final step. Skip path (X / overlay / Esc) logs tour_skipped + sends the one-time Roshni rescue message. Smoke test hardened again: session now presets wow_goal_prompted so a goal-less fresh student doesn't redirect-exit at the dashboard check.

Operator-requested product tours ('websites that show you a tour after login') + Roshni nudges ('nudge like Sukoon') + onboarding upgrades. Tours: (1) Welcome tour — 4 steps at first login on the fullscreen welcome page (starter checklist → Browse All Courses → goal → Roshni fab); (2) Dashboard tour — 7 steps on first dashboard visit (header → Learn → Practice → My Maahir → sidebar search / → Daily Challenge → Roshni finale), mobile variant swaps sidebar steps for bottom-nav spotlight, auto-expands collapsed nav groups, graceful skip for missing elements; (3) Exercise tour — exercises 1-3 converted from the v11.68.3 custom tooltip card to the same driver.js engine (3 steps). Engine: self-hosted driver.js 1.3.5 IIFE (public/assets/vendor/) + public/assets/js/guided-tour.js (MaahirTour: localStorage flags, ?tour=1 replay, confetti + toast finale, analytics POSTs, red-dot fab badge with chat-open dismiss). All step copy lives in config/tour.php (maintainable when interfaces change); selectors use data-tour hooks added to sidebar group buttons, Browse All Courses link, dashboard header, welcome cards. Roshni integration: POST /student/tour/roshni inserts a real personalized agent_messages row (context_type=tour_finale, dedup per tour) and the chat panel auto-opens live at the finale; skipping triggers a one-time rescue message ('type tour to relaunch'); ProactiveController block 6 nudges students 24h+ old with no tour_completed (Sukoon-style Bot Popup + notification, once ever); typing 'tour' (or start/guided/platform tour, show me around) in Roshni chat returns [LAUNCH_TOUR] rendered as a Start-guided-tour button. Onboarding v2: 4 new goal cards (Upgrade My Career → /student/career-hub, Study Abroad → /student/english-tutor, Teacher/Educator → /tracks/teaching-mastery, Just Curious About AI → /student/ai-guide; goal_key is VARCHAR so no migration), goal-picker skip now goes to /student/dashboard?full=1 (previously bounced back to welcome), WelcomeController goalLabels/goalCTA synced. Welcome page: Join Your Batch WhatsApp Group card (user's own batches.whatsapp_group_url, hidden when none). Smoke test hardened (dashboard check sets full=1 so fresh students don't redirect-exit). Replay links added to Getting Started Guide + Support pages. Mobile app tour = next release.

Triggered by real user #494 (registered 07:53, abandoned at first exercise, complained: 'portal is complicated, where do I start, where is the course list'). Fixed four broken promises: (1) Welcome CTAs now deep-link to the REAL first lesson (/student/exercise/1..5) instead of the 323-module wall; (2) '5 starter lessons' now refers to a real curated sequence (config/starter_path.php: exercises 1-5, Module 1 Talking to AI) with truthful progress dots and a 5-item checklist on Welcome; (3) the promised Roshni help button now exists on Welcome (wc-fab → /student/chat); (4) course catalog reachable: /student/courses retitled 'All Courses' with Core Courses grid + new Mastery Tracks section (35 tracks via track_modules counts), nav item 'Browse All Courses' added first in Learn group, Welcome has a 'Browse All Courses' card. Also: First-Week strip on /student/modules for <10 completions (progressive disclosure, module wall intact below #allLessons anchor); Welcome nav now student-aware (All Courses / How It Works / Community / Logout — no more Login+Pricing to logged-in users); social-proof card (learners/courses/lessons/scenarios + /success /alumni /guide links); tooltip tour on exercises 1-3 (custom vanilla JS, localStorage maahir_tour_done_ex{1..3}, 3 steps: read brief → write answer → submit). New API GET /api/v1/student/courses. Mobile: /courses page (Core Programs + Mastery Tracks sections, search), welcome Browse All Courses button.

New consolidated stats page (GET /student/stats, session auth, HTML) grouping every measurement previously scattered on the dashboard: Overview (Maahir Score + 6-factor breakdown, XP/level progress bar, core 4-grid of Points/Rank/Started/Completed/Streak), Progress (6 learning-domain bars, career-track widget, life-skills/projects/AI-tools mini-stats), Achievements (recent achievements, milestone proximity alert, daily missions checklist), Tools (combo-chain meter, recommended uncompleted assessments list, quick-actions grid); weekly quests with claim buttons stay on the dashboard only (single claim source), Social (collapsed <details>: weekly top-5 leaderboard, student-of-the-week banner, class activity feed), Comparison (collapsed <details>: batch-vs-batch bars, daily activity log link). Dashboard performance fixes: (a) assessmentTotal now written to and read from the 5-min dashboard cache (warm loads previously showed 0); (b) career-track widget N+1 (2 queries/module) replaced by one LEFT JOIN aggregate over track_modules/exercises/exercise_progress; (c) weekly-quests claimed check N+1 replaced by one quest_progress lookup (quest_progress has no claimed column — kept status='completed' AND completed_at>=week-start semantics); (d) jobReady widget, studentOfWeek and per-batch cohortComparison moved into the 5-min cache (cold-path compute only); (e) assignment, announcement, WhatsApp-group, batch-resource and batch-comparison queries moved out of dashboard.php view into the controller; (f) dashboard cache busted on exercise completion (pre-existing) and now also in PointManager::award() whenever points change; (g) dashboard and stats pages send Cache-Control: private, max-age=60. Same release: student sidebar restructured — 'Home' group removed (pinned Dashboard link remains at sidebar top), new 'My Maahir' group appended last (My Journey, Daily Challenge, Assignments, My Stats, Profile, Portfolio, Support, Settings), fixed bottom bar reduced to Logout only. Dashboard simplified: 15 stat sections moved to /student/stats; 'Start Here' guide block removed (Welcome page covers 0-exercise users); Learning Guide banner hidden once a user has 5+ completed exercises ($completedCount < 5 guard).

New simple full-screen Welcome page (GET /student/welcome, fullscreen layout) for students with fewer than 5 completed exercises: greeting from Roshni, 3 step cards (pick goal / ONE big gradient first-lesson CTA mapped to the onboarding goal / ask Roshni help), 5-dot starter-lesson progress, dashboard-unlock info card, and a Skip link via /student/dashboard?full=1. StudentController::dashboard() now redirects sub-5-exercise users to the Welcome page BEFORE the goal-picker redirect (?full=1 escape hatch). Bug fix: the green All assignments submitted! card no longer renders for users who have completed 0 exercises (now also requires completedCount > 0). Bug fix: claimQuest() JS block was inside the <style> element of the dashboard view (broken claim button) — moved after </style>. No DB schema changes.

Student sidebar rebuilt: 94 items / 11 groups -> 36 items / 7 groups + 5 fixed bottom links. Single-open accordion (sessionStorage maahir_nav_open), real <button> headers with aria-expanded/aria-controls/nav-btn-{slug} ids, chevron rotate, max-height .25s transition, sticky bottom section (margin-top:auto + position:sticky). Active group+item detected by URL path. new_until reduced to mastery-tracks only. URL corrections vs old nav: Wisdom Hub=/student/playbook, Decision Scenarios=/student/scenarios, Forum=/forum, Platform Info=/roadmap, Competitions=/student/battles, Settings=/student/profile (no /student/account route exists). Dropped: More Practice (/student/practice-hub does not exist). guardian/teacher/admin arrays unchanged. No API or DB changes.

Three major improvements. (1) NAVIGATION REDESIGN: sidebar reduced from 94 items across 11 groups to 37 items across 7 intuitive groups (Home, Learn, Practice, Build & Master, Career & Earn, Community, Explore) + 5-item fixed bottom bar (Profile, Portfolio, Support, Settings, Logout). Accessible accordion (one group open at a time, aria-expanded, keyboard navigation, sessionStorage persistence). 3 new hub pages consolidate the long tail: Practice Hub (14 features), Competitions Hub (9 features), My Account (Profile/Settings tabs). All NEW badges removed except Mastery Tracks. (2) EMPTY MODULE FIX: 9 placeholder business_systems modules (bsm-m1 through bsm-m9, IDs 287-295) archived — they showed 0/0 exercises and confused users; real content lives in buildm modules 345-353 with 90 exercises. (3) CONTENT GAPS FILLED: 6 SDG modules (Clean Water SDG 6, Clean Energy SDG 7, Sustainable Cities SDG 11, Responsible Consumption SDG 12, Life Below Water SDG 14, Life on Land SDG 15 — Community Impact track now 14 modules/140 exercises, ALL 17 SDGs have module coverage) + 134 MCQs across 10 thin categories (cybersecurity offensive, women-focused) + 150 vocational scenarios (10 each for mechanic, electrician, plumber, carpenter, chef, beautician, tailor, driver, shopkeeper, real-estate, photographer, event-planner, mobile-repair, construction, painter — all Wave C packs now have 13 scenarios each) + 10 mastery track modules (Finance +Islamic Finance +Audit, Operations +Project Coordination +Quality, Entrepreneurship +Franchising +Social Enterprise, Data +Data Engineering +AI/ML, Customer Success +Account Management +CS Leadership — all 22 tracks now minimum 8 modules, total 1,620 exercises).

Filled every genuine content gap identified across the 106-partner directory. 13 NEW PACKS: mountain-agriculture-pro (50 scenarios: apricot value chain, potato farming, walnut/almond, mountain livestock, farming challenges) · solar-green-jobs-pro (50: solar installation, solar business, wind/hydro, energy efficiency, green career transitions) · balochistan-value-chains-pro (50: livestock, fisheries including Gwadar, mining including Reko Diq, trade) · artisan-heritage-pro (50: embroidery/textiles, pottery, woodwork, metal/jewelry, heritage markets) · digital-safety-girls-pro (50: online harassment response, privacy, scam protection, safe behavior — all female-targeted) · disability-inclusive-pro (50: workplace accommodation, job seeking, inclusive practices, specific disabilities) · exam-prep-pro (50: Matric/FSc prep, university applications, study skills with AI) · smartphone-basics-pro (50: phone basics, WhatsApp, mobile money, daily apps, safety — 27 female-targeted) · home-income-online-pro (50: stitching/fashion, home food, crafts, digital services, managing — 44 female-targeted) · kp-tourism-pro (45: Swat/Kalam/Chitral destinations, guesthouse ops, tour operations, community) · trade-digitization-pro (45: electrician/plumber/tailor digitization, general trade business) · coastal-climate-pro (40: coastal resilience, flood recovery, climate-adaptive livelihoods, policy) · balochistan-tourism-pro (35: Gwadar/coast, cultural/heritage, adventure/nature, tourism business). Platform: 73 packs, 9,259 scenarios, 206 tools, 1,079 micro-cards.

Final completeness wave. MOBILE PARITY: 4 missing pages built (/partners with 106 partner directory + detail, /ai-economy 7-pillar page, /industries 39 industries, /library 26 free resources) — mobile now at full parity, 159/159 API + 102/102 pages. PARTNER IMPACT: monthly cron (1st of each month, 9 AM) sends each partner their aligned content counts + live platform stats via email; dry-run verified; contact_email column ready. CONTENT GAPS: Public Speaking module (Marketing M9, 10 exercises: anxiety, structure, PowerPoint, Q&A, body language, virtual presenting) + Business Writing module (SMM M8, 10 exercises: email, WhatsApp, proposals, reports, formal letters) + 6 more healthcare-admin scenarios + 6 more teaching scenarios (both tracks now 12 scenarios each) + 21 SDG mappings (SDG 3, 4, 16 now have module coverage). CERTIFICATES: mastery track completion certificate generator (Playwright PDF, issued_certificates with verification codes, tested on user 5 with Customer Success track — 37.9KB PDF verified). SITEMAP: regenerated with 202 URLs (22 static + 35 tracks + 39 industries + 106 partners), valid XML.

NEW TRACK Hospitality Mastery (8 modules/80 exercises, group hosm, SDG 8, icon hotel, color #f59e0b): M1 Hospitality Career Map (hotel vs restaurant vs travel, L1-L5 ladders commis-to-owner / receptionist-to-GM / guide-to-destination-manager, Pakistan market PC-Serena-Marriott + QSR + cloud kitchens + Umrah operators, honest PKR salary bands) · M2 Front Office & Guest Experience (5-stage guest cycle, Booking.com/Agoda OTA management, LEARN complaints, VIP handling, upselling, night audit with occupancy/ADR/RevPAR, telephone etiquette) · M3 F&B Operations (service flow greeting-to-bill, KOT/pass coordination, menu engineering stars-plowhorses-puzzles-dogs, PFA/SFA food safety, room service, buffets, dietary/allergen protocol) · M4 Housekeeping & Facilities (10-point room inspection, laundry par system, work orders + OOO rooms, deep-clean calendar, PA rounds, pest control records, linen par math, pre-monsoon PM plan) · M5 Restaurant Business (30% food cost rule, supplier two-source discipline, staffing bands, POS controls/void log/Z-report, PFA-SFA inspections, foodpanda channel economics ~30% commission, cloud kitchen multi-brand, franchisor/franchisee diligence) · M6 Revenue & Sales (occupancy-ADR-RevPAR crunch, dynamic pricing calendar, corporate contracts, wedding BBO with guaranteed-minimum, social media, packages, low-season playbook) · M7 Travel & Tourism (Umrah operations factual: Nusuk-era visas, packages from Karachi/Lahore/Islamabad, group leader playbook, lost luggage protocol; Hunza/Skardu/Naran/Kaghan itineraries with drive-hour honesty and Plan B; tour operator costing; IATA/BSP ticketing; corporate travel; visa documentation; tour emergency protocols) · M8 Leadership (GM path rotations, restaurant owner journey, brand standards audits, NPS, staffing-at-scale ratios, revenue leadership, crisis command book, SOP writing, 90-day GM turnaround capstone). Plus hospitality-pro mini-pack (sort 52) with 6 scenarios (VIP early arrival, food complaint on a busy night, 500-guest wedding buffet changes, Umrah group lost luggage in Jeddah, PFA inspector walk-in, foodpanda surge) + 2 profession tools (menu-cost-calc: plate cost/food cost %/margin/30%-rule verdict/menu engineering slot; guest-complaint-resolver: response script/escalation/recovery options/follow-up) + 10 hospitality_skills micro-cards (Daily Life & Rights group, ladder/check-in/30% rule/inspection/upsell/wedding/Umrah/Hunza-Skardu/OTA/NPS). Mastery hub now 17 tracks.

Two new mastery tracks completing the full professional spectrum. Healthcare Administration Mastery (7 modules/70 ex, SDG 3): OPD flow, Sehat Sahulat Card, Healthcare Commission, hospital operations, HIS/EMR, healthcare HR + healthcare-admin-pro pack (6 scenarios) + opd-flow-optimizer + billing-compliance-check tools. Teaching and Education Mastery (7 modules/70 ex, SDG 4): lesson planning, classroom management, assessment, EdTech, curriculum, teacher leadership + teaching-mastery-pro pack (6 scenarios) + lesson-plan-builder + rubric-generator tools. 22 mastery tracks, 1,600 exercises, 57 packs, 169+ tools.

Two new mastery tracks completing the full professional spectrum. Healthcare Administration Mastery (7 modules/70 ex, SDG 3): OPD flow, Sehat Sahulat Card, Healthcare Commission, hospital operations, HIS/EMR, healthcare HR + healthcare-admin-pro pack (6 scenarios) + opd-flow-optimizer + billing-compliance-check tools. Teaching and Education Mastery (7 modules/70 ex, SDG 4): lesson planning, classroom management, assessment, EdTech, curriculum, teacher leadership + teaching-mastery-pro pack (6 scenarios) + lesson-plan-builder + rubric-generator tools. 22 mastery tracks, 1,600 exercises, 57 packs, 169+ tools.

(1) PartnerController: index (grouped directory, ?category= filter, empty-state safe), detail (404 on unknown slug), apiList (JSON for mobile). Content matching is LIVE per request: scenarios via focus_keywords LIKE title/description OR JSON_CONTAINS(sdg_tags, sdg); modules via sdg_mappings entity_type=module joined to published modules; micro_cards and ai_tool_directory via keyword LIKE; 3 sample scenarios per partner for the try-it section. Rows without focus_* columns fall back to SECTOR_DEFAULTS; short_name/color/icon derived when NULL; category derived from (partner_type, sector) so all seed waves (B1 dev/govt/energy/tech/foundation, B2 28 CSR, B3 foundations/energy/tech) render uniformly; pathway renders as structured Week 1-4 JSON or plain-text paragraph. (2) Views: public/partners.php (hero, horizontal category chips, SDG chips, card grid) and public/partner-detail.php (pitch, live stats, try-it, pathway, 4 Ways to Plug In, copy-able CSR paragraph, gap analysis, mailto CTAs, cross-links). (3) ensureSchema() mirrors seed DDL and additively ALTERs the 7 partner-directory columns onto pre-existing tables. Public, SEO index,follow, sitemap + Discover nav entry.

4 new mastery tracks (Hospitality/Supply Chain/Legal/Customer Success) bringing total to 20 tracks and 1,410 exercises. 106-partner Development Partner directory with live marketing pages at /partners. AKF-aligned content: Climate Action module, CHW pack, Rural Livelihoods, Teacher Pedagogy. Pakistan region tags, women-in-ai module, 4 new profession packs.

(1) PARSER FIX: AI occasionally returned two concatenated JSON objects which the greedy-regex parser could not decode, leaking raw JSON into chat bubbles. New 3-layer parseAiJson(): direct decode → escape-aware balanced-brace scanner merging all top-level objects → response-value regex salvage → final sanitizer guarantees no {…} skeleton ever renders (5-case unit tested). (2) SCENE BRIEFING: prominent panel above every chat — 👤 You are / 🤖 AI plays / 📋 Situation / 🎯 Your task — plus The-user-plays context so the AI addresses the learner in character; reverse mode explains its flipped roles. (3) user_role COLUMN + FULL BACKFILL: new VARCHAR column; 8,572/8,572 active scenarios labeled (95.7% by AI wave in ~24 min, 3.7% heuristic, 49 generic fallback); normalizeScenario whitelist updated to carry the field. Sample: #3060 now reads You are the master tailor deciding whether to copy the luxury lawn designs. (4) TRANSLATION IN ROLEPLAY (16 languages incl. Arabic + all Pakistani regional languages): sticky chip bar (EN/Roman Urdu/Urdu/Punjabi/Sindhi/Pashto/Saraiki/Balochi/Hindko/Kashmiri/Shina/Balti/Burushaski/Wakhi/Khowar/Arabic, defaults to the learner language_pref), per-bubble translate with show-original toggle and per(bubble,lang) cache, Translate-all (last 30 messages in ONE batched call), Auto-translate toggle for new AI replies, and Translate-briefing. Reuses the existing batch translate endpoint; NEW API alias POST /api/v1/student/roleplay/translate (JSON body + X-CSRF-Token) for the mobile app.

(1) CYBERSECURITY MASTERY — deep L1-to-CISO track (9 modules/90 exercises, group cym, SDG 8+16), grounded in current cert landscape (Security+ V7 now, V8 expected Nov 2026 with AI-risk coverage — verify-current noted): M1 Foundations & Career Map (three families defense/offense/GRC, Pakistan market honestly: SBP-mandated bank SOCs, PTA/SECP, MSSPs, remote export roles) · M2 Networking & OS gate (TCP/IP, DNS, firewalls, Windows/Linux security) · M3 SOC Analyst Bootcamp (triage tiers, log reading, SIEM vendor-neutral, phishing header analysis, escalation, handovers, first 90 days) · M4 Threats & Attacks (ransomware playbook, BEC/CEO fraud, OWASP Top-10 plain, kill chain + MITRE ATT&CK) · M5 Defensive Tooling (SIEM queries, EDR, Wireshark/Nmap labs, Nessus triage, CIS baselines, 3-2-1 backups) · M6 Ethical Hacking (AUTHORIZATION FIRST + PECA framing, PTES, Burp, SQLi/XSS/IDOR labs, CVSS, reporting, bug bounty from Pakistan) · M7 GRC & Frameworks (ISO 27001 walkthrough, NIST CSF, SBP ISMS, SECP/PTA, risk registers, SOC 2) · M8 Cloud & Modern (shared responsibility, IAM, containers, zero trust, AI-era threats incl. prompt injection + deepfake fraud) · M9 Career/Certs/Home-Lab (cert ladder honestly with costs, home lab on old laptop, TryHackMe/HTB, SOC interview prep, CISO track, remote arbitrage). Plus cyber-pro pack (6 scenarios: 2AM alert, CEO fraud during Eid, scan-without-authorization, auditor log gaps, family ransomware, insider exfil) + 10 cyber_careers cards + phish-analyzer and home-lab-roadmap tools. Nav: Cybersecurity Mastery added (12 items, All-16 label). (2) SDG DRILL-DOWNS: /sdg target counts now clickable — /sdg?target=4.4 lists 24 aligned scenarios (title/type/difficulty/preview) each linking to practice; goal-card scenario badges now link to /student/roleplay?sdg={id}; back-to-targets navigation.

(1) /sdg REBUILT as the donor-facing impact page: outcomes hero with LIVE platform numbers (451 approved learners, women % live, 7,600+ completions, 47 certificates, 44 districts, 8,600+ scenarios, 51 professions), 8 PRIORITY SDG TARGETS with UN codes/indicators/platform-alignment statements and keyword-derived aligned-content counts (4.3, 4.4 ICT skills 4,645 scenarios, 5.5 women, 8.5, 8.6 NEET, 8.8 safe work, 10.2 inclusion, 17.17 partnerships), all-17-goals grid retained, published METHODOLOGY note (transparency: keyword-mapping approximation, self-reported demographics, refreshed per page load), partner CTAs to SDG Practice track and /ai-economy. New Sdg::TARGETS const + targetCounts(); /api/v1/public/sdg now returns targets + live outcomes for mobile. (2) NAV rearranged: Mastery section 17 items trimmed to 11 (Hub, All Professions, 8 flagship tracks, All-15 link) — everything remains reachable via the hub which lists all 15 tracks with progress. (3) /tracks page GROUPED: the 24 mixed training tracks now split into Mastery Tracks (12) and AI Career Tracks (12) with section headers; mobile /tracks grouped the same way. (4) MOBILE (m.maahir.io, separate commits 936d0f0/86aedee): new /mastery hub screen (15-track grid), new /build-defense viva screen (start/chat/verdict/sessions against the live API), me-page Mastery link — tsc+build+qa pass, smoke 153/153.

The freelance knowledge that was scattered (277 scenarios, 426 MCQs, 25 cards, Playbook tools) now has a structured ladder. NEW TRACK Freelance Mastery (8 modules/80 exercises, group flm, SDG 8): M1 Mindset & Niche (hybrid path, 3-month rule, 12 high-demand Pakistani niches) · M2 Rates & Getting Paid in Pakistan (rate formula, hourly/fixed/retainer, Payoneer vs Wise vs Deel, filer + IT export basics, PSEB registration) · M3 Upwork & Fiverr Deep (JSS protection, connects economy, 20/10/5 fees, sub-200-word proposals, gig SEO, seller levels, first-5-reviews strategy) · M4 Beyond the Big Two (Toptal 5-stage vetting, Contra 0%, PeoplePerHour/Guru/99designs, Turing/Deel/Remote stable roles, specialized platforms by skill) · M5 Winning Clients Off-Platform (LinkedIn connect-engage-offer, cold email + cadence, local PK businesses, first-10-clients ladder, referrals) · M6 Professional Operations (contracts, 30-50% deposits, scope-creep change orders, late-payment ladder, difficult-client scripts, time tracking) · M7 Growth: Rates to Retainers to Agency (raise scripts, project-to-retainer conversion, firing 80/20 clients, subcontractors, white-label, SMC upgrade, cross-links Entrepreneurship Mastery) · M8 Products & Content Income (digital products on Gumroad/Etsy/Envato, mini-courses, YouTube monetization Pakistan CPM reality, affiliates, Preply/iTalki tutoring, services-fund-products honesty, cross-links Entrepreneurship). Plus freelancer-pro mini-pack with 6 scenarios (JSS crash recovery, ghosted-after-delivery escalation, rate-raise conversation, retainer pitch, the 17th scope-creep change, first subcontractor ethics). Entrepreneurship Mastery unchanged (Option A) with bidirectional cross-links in M7/M8. Mastery hub now 15 tracks.

Operationalizes the national AI agenda as training. NEW TRACK Pakistan AI Economy (7 modules/70 exercises, group aiem) — one module per pillar: M1 AI Adoption & Productivity in IT Companies (adoption ladder, honest productivity metrics, pilot-to-scale, PKR budgets) · M2 AI Products & Agentic AI (exportable products, moat vs thin wrapper, agents = LLM+tools+loop, MCP basics, build a simple agent, pricing) · M3 Responsible & Secure AI Governance (bias/hallucination/IP risk, PECA + GDPR duties, company AI usage policy, prompt injection, human review gates) · M4 AI Skills & Industry-Academia (skills gap map, FYP-to-startup, internships, curriculum co-design) · M5 AI Use Cases for Global Industries (healthcare, fintech, cybersecurity, BPO, software engineering — anatomy, data, first project, failure modes) · M6 International Customers, Investors & Partners (export ladders, Built-in-Pakistan positioning, investor metrics for AI, cloud/model partner programs, GITEX) · M7 Pakistan as Global AI Hub (honest strengths/gaps, India/Bangladesh/Egypt lessons, personal 5-year plan). Plus 6 scenarios (team refuses AI, agent goes rogue, GDPR client call, FYP startup mentorship, hospital board pitch, investor moat question), 10 ai_economy cards (7 pillars one-card, adoption ladder, agentic AI, prompt injection, PECA vs GDPR, FYP checklist, use-case anatomy, export channels, moat thinking), 2 tools ai-adoption-auditor + agent-designer. NEW PUBLIC PAGE /ai-economy: the 7 pillars with live platform stats, each linking to its module + related packs (software-house-pro, exhibition-pro, systems-builder) + Build Defense — the page for partners and policymakers. Mastery hub now 14 tracks; nav additions.

Four parallel builds. (1) BUILD REAL SYSTEMS WITH AI track (9 modules/90 exercises, group buildm): Think Before Prompt, Data First, guided builds — E-Commerce (COD/JazzCash), CMS, Booking/POS/Inventory, ERP-lite (school/clinic/HR), AI-Powered Apps (OCR/Urdu honesty, image tools, voice/IVR, chatbots), Ads & Social Systems (ROAS tools, schedulers, dashboards), Ship-Secure-Price + systems-builder pack (6 scenarios: simple Daraz client, Urdu OCR promise, rude 3AM bot, ROAS promise, auth-check audit, 2AM data loss) + 14 system blueprint cards. (2) BUILD DEFENSE interactive AI cross-examiner: new build_defense_sessions chat flow (tutor-pattern multi-session), 11 system types with ~15 Pakistani-context seed questions each, ONE escalating question per turn (8-10 rounds), per-answer evaluation with score chips, verdict with understanding score /100, AI-dependency risk, gaps, next-study links into the track; web page + toolbox banner; wired for mobile via API. (3) COMMUNITY IMPACT & DIGITAL SYSTEMS track (7 modules/70 exercises, group comim, SDG 2/4/17-mapped): community development foundations, Kitchen Gardening Pakistan — regional season/city calendars (Punjab, Sindh/Karachi, Potohar, KPK-north, Balochistan; 4 sowing windows; fruit zones), garden practice (rooftop/compost/bottle-drip), building garden communities, digitize-the-community (cross-links Build Systems), Surveys That Matter (KoboToolbox/ODK, school/WASH/IT surveys), Data-to-Impact (M&E, donor reports) + community-organizer scenarios (6) + 10 community_gardening cards + tools garden-planner-pk (hand-written regional calendar) and survey-designer. (4) SDG & DEVELOPMENT PRACTICE track (7 modules/70 exercises, group sdgm): SDG foundations (goals-targets-indicators), How Donors Actually Work (World Bank/ADB/GIZ/JICA/UNDP/USAID/FCDO Pakistan priorities + instruments), project design (logframe/Theory of Change/results frameworks), M&E, Maahir own SDG story (4.4/4.3/5.5/8.5/8.6/8.8/10.2 mapping with learner evidence), Writing for Donors, Partnerships & Compliance (CSO registration, due diligence, safeguarding/PSEA) + development-practice scenarios (6) + 10 sdg_practice cards + tools sdg-mapper and logframe-builder. (5) Batch card UX: profile now always shows batch state — Move card (non-default), current-batch confirmation (default), not-in-batch. Platform: 13 mastery tracks, 50 packs, 137 tools, +24 micro-card skills.

Part 6/7 of the v1.6 master reference. EXHIBITION-PRO PACK (Part 6.16 built in full): 12 trade-show scenarios (3-second stand rule, BANT qualification, 90-second pitch, demo failure recovery, Pakistan Pavilion at GITEX, Ramadan stand hours, golden 48h follow-up), 3 tools (stand-pitch-builder, lead-capture-sheet with hot/warm/cold scoring, expo-budget-planner with cost-per-lead), 10 exhibition_skills cards incl. regional etiquette and Carnet ATA. LIFE-SKILLS LIBRARIES (Part 6): 40 micro-cards across 4 new skills — remote_jobs 10 (WeWorkRemotely/Remotive/Himalayas/Turing/Deel, Loom intros, Payoneer vs Wise), personal_finance_deep 10 (emergency funds, mutual funds from PKR 500, National Savings, PSX basics, scam spotting), freelance_platforms 10 (Upwork connects/JSS/fees, Fiverr gig SEO and levels, Toptal, Contra 0% fee, specialized platforms), business_risk 10 (7 risk types, reversible decisions, client concentration, udhaar credit risk). OVERSEAS LICENSING (Part 7): 6 pathway scenarios (PLAB decision, fake recruiter refusal, attestation chain, contract changed at airport, NCSHIFT nights, reintegration) + 10 overseas_licensing cards (USMLE, PLAB/GMC, Gulf Prometric, NCLEX, IELTS vs OET, attestation chain, Bureau of Emigration verification, contract checklist, red flags, RDA) — all verify-with-regulator framed.

Executed the Master Industry & Role Track Reference architecture. FOUR new mastery tracks completing Phase 1 + Data (Phase 2): FINANCE & ACCOUNTING MASTERY (6 modules/60 exercises, L1-L5 ladder: bookkeeping → AP/AR+bank recon+FBR tax → financial statements → tax & compliance Pakistan → management accounts → systems+ACCA/ICAP career; +6 accountant scenarios incl. the missing Rs 200k ethics, FBR notice; +2 tools recon-checklist, monthly-close-planner; +10 finance_skills cards). OPERATIONS & ADMINISTRATION MASTERY (6/60, the social-mobility flagship: office foundations → admin engine room → SOPs & process → facilities & assets → vendors & procurement → ops leadership COO track; +6 scenarios; +2 tools sop-writer, vendor-comparison-matrix; +10 operations_skills cards). ENTREPRENEURSHIP MASTERY (6/60, L1 side-hustle → L5 serial: idea validation → SECP/FBR legal setup → money discipline → first customers (WhatsApp/Daraz) → first team & systems → scale/invest/exit; +6 founder scenarios; +2 tools validation-sprint-planner, founder-cash-calendar; +10 cards). DATA & ANALYTICS MASTERY (6/60: Excel bootcamp → analyst thinking → SQL for everyone → dashboards Power BI/Looker → statistics without tears → Python & career with PKR salary honesty; +6 data-analyst scenarios; +2 tools kpi-selector, analysis-brief-builder; +10 data_skills cards). INDUSTRY LIBRARY (Part 1 of the reference, public and SEO-indexed): new industries table with 39 verticals across 10 sectors (tech 5, healthcare 4, finance 4, commerce 4, built 3, energy 4, creative 4, hospitality 3, education 4, public 4) — each with overview, key departments, dominant roles, Pakistan context and AUTO-LINKED practice content (role-play scenario matching, MCQ category counts, profession packs). Public /industries + /industries/{slug}. Pack-to-track links wired (accountant→finance, front-office→operations, founder→entrepreneurship). Mastery hub now 10 tracks. Nav: Mastery section 11 items, Industries in Discover.

Built from an enterprise functional matrix blueprint (9-track org: governance, revenue engine, product/QA, people ops, workplace services). FOUR additions: (1) CEO & Leadership Mastery Module 8 The C-Suite Map (10 exercises: CEO vision/M&A sign-off, CTO tech-debt governance, COO operations standardization, CFO capital allocation + multi-currency, CMO inbound engine, CLO compliance GDPR-SOC2-style + MSA review, decision rights, revenue org BDR->AE->Solutions Engineer->Account Director, paths into the C-suite, 150-person capstone) + 6 exec scenarios + 6 exec cards — track now 8 modules/80 exercises. (2) front-office-pro pack (12 scenarios: early VIP arrival, boardroom conflicts, contract runs, angry walk-ins, confidentiality, courier chains, career ladder office assistant->admin officer; 3 tools visitor-log-manager, meeting-room-planner, office-supplies-tracker; 10 office_pro cards). (3) facilities-pro pack (12 scenarios: load-shedding changeover, server-room HVAC, monsoon leaks, biometric failures, surveillance ethics refusing employee-monitoring, fire drills, generator fuel math, vendor management; 3 tools maintenance-scheduler, emergency-preparedness-planner, asset-log-builder; 10 facility_pro cards). (4) it-support-pro pack (12 scenarios: provisioning kits, phishing first response, everyone-is-admin lockdown, WhatsApp-to-ticket-system, backup rehearsals, helpdesk->sysadmin path; 3 tools ticket-triage, onboarding-it-checklist, incident-first-response; 20 cards — it_support 10 + enterprise_tools 10 covering Jira/Confluence/Figma/Slack/HubSpot/ServiceNow/Workday/Deel/Notion/Google Workspace, the tools named in Pakistani job postings). Platform: 47 packs, 121 tools, 8,494 scenarios, 740 micro-cards.

Research-grounded (software-house body of knowledge: service vs product vs freelancer vs staffing agency, 4 engagement models, credibility signals, 5-phase engagement, severity-tiered SLAs) build-out of the software-house career. ONE new profession pack: software-house-pro 🏢 'Software House Pro — run one, work in one, or hire one' (SDG 8, sort_order 44 — 44 packs total) with 12 hand-written Pakistani-context scenarios (Lahore/Karachi/Islamabad houses, PKR + USD deals, WhatsApp culture, P@SHA-aware): which-model-fits (T&M vs fixed steering), two-week MVP promise reset, sprint demo disaster recovery, change-request pricing, dedicated-team renewal defense with metrics, augmentation without a client tech lead, case study legal veto, screening a red-flag prospect, legacy modernization autopsy (rewrite vs strangler), SLA severity tiers, BA/PM/QA/senior-dev career fork, mid-project key-dev resignation continuity. profession_tools +3 (112 active total): engagement-model-selector, discovery-brief-builder, sla-draft-generator. micro_cards +10 under NEW skill_key software_house_ops (what a software house is, 4 engagement models, 7 roles, 5 phases, Pakistan-vs-offshore-vs-onshore rate benchmarks with honest $15-40/hr export context, vendor red flags, credibility signals, first-call prep, SLA tiers, fixed-vs-T&M tradeoff) — and software_house_ops IS added to the web SKILLS registry (MicroLearningController, group Business) unlike some earlier DB-only waves. Hard requirement honored: all strings English/Latin only — the seed carries a CJK guard (preg_match on U+4E00-9FFF, U+3040-30FF, U+FF00-FFEF) that dies before any write if violated. Seed self-verification: 5/5 checks.

Research-grounded (sales-engineering body of knowledge: consultative selling, ROI quantification gain-A-over-B-years-for-cost-C, POC discipline, SoW proposals) build-out of IT sales careers. TWO new profession packs: it-product-sales (12 scenarios — Hafeez Center price wars, PPRA bank tenders, OEM partner tiers, license renewals, RMA ethics, counterfeit alert, cloud-vs-server honesty; 3 tools tender-bid-checklist, license-renewal-tracker, spec-vs-budget-fit; 10 micro-cards it_product_sales) and it-services-sales (12 scenarios — scope-creep invoice standoff, fixed-price trap, AMC renewal, overseas clients, RFP go/no-go, pilot ladder, burned-CTO trust; 3 tools sow-draft-builder, pilot-proposal-writer, discovery-call-planner; 10 micro-cards it_services_sales). Sales Mastery extended to 10 modules / 100 exercises: M8 IT & Tech Sales, M9 New Business Hunting — How to Grab Business (100-account hunt lists, 21-day multi-channel cadence, first-meeting framework, trigger events, referral systems, chambers/expo networking), M10 Industry Sales Playbooks (pharma detailing, real estate, insurance+takaful respectfully, banking, automotive, edtech admissions, industrial B2B, FMCG trade, Daraz/foodpanda). Plus hunt-list-builder tool. Platform: 43 packs, 102 tools.

Every mastery track extended to 7 modules x 10 exercises (70 each, 420 total mastery exercises) after body-of-knowledge gap research. SALES +M6 Sales Operations & Forecasting (pipeline math, comp plans, territory, RFP/tenders, forecasting) +M7 Retail/Field/Channel Sales in Pakistan (FMCG beat plans, distributor management, merchandising, udhaar credit, Ramadan trade) +5 scenarios (forecast meeting, distributor exclusivity, udhaar recovery, shelf wars, kickback ethics) +forecast-builder tool. MARKETING +M6 Brand/PR/Traditional Media (brand architecture, press releases, TV/OOH mix, activations, agency management, crisis PR) +M7 Research/Insights/Product Marketing (budget research, focus groups, SEC segmentation, pricing psychology, Urdu copywriting) +5 scenarios +campaign-360-planner tool. CEO +M6 Governance/Legal/Deals (board duties, shareholder agreements, SECP, JV/M&A, IP) +M7 Family Business & CEO Operating System (three circles, succession, professional managers, weekly rhythm, decision journal) +5 scenarios +governance-checklist tool. PM +M6 Agile/Scrum/Tools (ceremonies, story points, Jira/Trello/Asana, hybrid contracts) +M7 Stakeholders/Budgets/Programs (RACI, sponsors, earned value, procurement, change management) +5 scenarios +stakeholder-mapper tool. SMM +M6 Paid Social & Influencer Management (Meta Ads structure, PKR budgets, ROAS benchmarks, influencer rates/contracts, fake-follower detection) +M7 Community/Crisis/Agency Craft (trolls, viral comment crisis, WhatsApp commerce, retainers, client onboarding) +5 scenarios +ads-budget-splitter tool. Plus 20 new micro-cards and 25 scenarios across the five packs.

Researched the HR body of knowledge (SHRM function model, HRM practice areas) against our HR Mastery track and filled the real gaps. Module 6 Payroll, Benefits and Compliance Operations (10 exercises): payroll cycle PKR, payslip anatomy, withholding tax filer/non-filer, EOBI in practice, gratuity vs provident fund calculations, leave rules, leave encashment, full-and-final settlement, fixing payroll errors, 5-person payroll capstone. Module 7 Employee Relations, Safety and the Wider Picture (10): workplace investigation playbook + evidence/confidentiality, unions and collective bargaining Pakistani context, grievances, workplace safety office+factory, accident first 24 hours, engagement surveys, culture and change, succession planning 9-box, bias-free hiring. Plus 6 role-play scenarios (shrunken paycheck, union committee at the gate, machine-guard incident, survey fallout, leaked 9-box, biased panel), 4 micro-cards, 1 tool payroll-explainer. HR Mastery now 7 modules / 70 exercises; hr-professional pack 18 scenarios; hr_skills 14 cards.

Dedicated Mastery section for full profession lifecycles. SIX mastery career tracks (5 modules x 10 exercises = 300 exercises total): Social Media Mastery (existing), NEW HR Mastery (full people lifecycle: hiring, JD writing, structured interviews, offers + salary negotiation, 90-day onboarding, appraisals, PIPs, harassment response, layoffs, exits, comp benchmarking PKR, people analytics), NEW Sales Mastery (prospecting, SPIN discovery, objections, PKR negotiation, closing, account management, selling to government/enterprise), NEW Marketing Mastery (positioning, Meta/Google/SEO/TikTok channels, copywriting, attribution, Ramadan campaigns, Rs 50k budgets), NEW CEO & Business Leadership Mastery (reading P&L, runway, delegation, annual planning, cash-crisis playbook, board management, succession), NEW Project Management Mastery (charters, WBS, estimation, sprints, scope-creep defense, UAT, retros, PM careers PKR). FOUR new profession packs linked to tracks: hr-professional, marketer, sales-professional, ceo-executive (48 role-play scenarios + 12 AI tools + 40 micro-cards across hr_skills/marketing_skills/sales_skills/executive_leadership); pack track-links wired for all 6 (incl. project-manager→pm-mastery, social-media-manager→smm). NEW Mastery hub page /student/mastery with per-track progress bars, module chips, linked pack role-play counts; NEW nav section with 7 entries + NEW badges. Platform totals: 41 packs, 96 tools, 8,380 scenarios, 636 micro-cards.

Investigated all 16 issues on /status. Found and fixed ONE live production bug: the capstone page (/student/capstone) fataled for every user since 29-Sep — the view referenced CapstoneController without the App\Controllers namespace (4 occurrences: TYPES, ARTIFACTS, XP_AWARD x2); now fully qualified and verified rendering (164KB). All other tickets triaged: 14 solved (transient dev-script errors from content-generation waves — column mismatches already fixed in the scripts, headers-sent warnings from CLI testing) and 6 marked noise (correct validation messages surfaced as issues: duplicate proposal, capstone review state, missing artifacts, CSRF retry, profession-pack 404, user-not-found). Login-difficulty signal (11 in 24h) analyzed: 9 distinct users, max 3 attempts/IP — mistyped passwords, rate limiter working, no brute-force pattern. Status page now shows 0 known issues.

The last mocked mobile screens become real. BATTLES API + MOBILE: /battles rewired to live data (challenge list with states, opponent search over approved students, create/accept/decline, W-L record, top-battlers board) and a new /battles/[id] play screen (live scoreboard you-vs-opponent, per-question countdown, speed-bonus scoring 50/25/10, explanations, finish states). Flow verified end-to-end: create → accept → questions generated → correct+fast answer scored 100 (50 base + 50 speed), wrong+slow 0, duplicates rejected. DAILY CHALLENGE API + MOBILE: /challenges rewired to the real daily challenge (shared date-seeded 5 questions, streak/best/total-today stats, timer, graded result with points; JSON bodies accepted for mobile, state endpoint added; fixed challenge_results column mismatch). SDG: new public GET /api/v1/public/sdg (17 goals with scenario+module counts) + mobile /sdg page with per-goal bars. CV PDF: GET /student/cv-builder/download renders the real CV paper and prints it to PDF server-side via Playwright/Chromium (scripts/print_pdf.js) — branded, clean A4, works from mobile where window.print does not.

Four job-landing features. (1) JOB-READY CHECKLIST: 6-step ladder (Profile Ready → Skills Assessed 3+ → Practice 10 MCQ/20 roleplay → Interview Ready 1 mock → Applied Somewhere job/works/showcase → Proven capstone/certificate), every step verified against real activity tables, dashboard progress strip with step chips + progress bar, dedicated page with per-step progress bars and Go buttons, nav entry with NEW badge. (2) MOCK INTERVIEW FULL REPORT: printable per-question breakdown (question, your answer, score pill, strengths, improvements, improved model answer) with overall band verdict and Print-to-PDF — at /student/mock-interview/report/{id}. (3) ALUMNI DIRECTORY: public /alumni listing HERO graduates (approved capstone + public profile enabled) with capstone titles, certificate counts, verifiable Skills Passport links; employer CTA to talent portal. (4) WEEKLY DIGEST UPGRADE: each student email now includes a job matched to their profession from the job board + one concrete next-step tip derived from their job-ready checklist gaps.

Full removal of the v11.43.0 Chinese-for-Work feature: deleted 12 chinese_for_work micro-cards (+ any progress rows), 10 chinese_language roleplay scenarios, 3 chinese-workplace idea-library entries; reverted the chinese language option from registration, Roshni Chinese persona + CJK auto-detect, and the chinese->zh mapping; reverted CJK-guard exemptions back to cross_cultural only; seed script removed. Platform returns to the English-first content policy: 8,332 roleplay scenarios, 596 micro-cards, 106 ideas, 53 skill groups visible in micro-learning. Leak sweep clean (2 intentional cross-cultural keeps).

Chinese joins the platform as a first-class language: registration now offers 中文 (Chinese — with pinyin); Roshni replies in Simplified Chinese with pinyin + English gloss per sentence for learners; auto-detection recognizes Chinese input; MultilingualHelper maps chinese→zh. New learning content (characters are INTENTIONAL teaching payload, exempted from the CJK leak guard via skill markers): 12 micro-cards chinese_for_work (greetings, self-introduction, numbers/prices with the 万 10,000-unit trap, CPEC site vocabulary incl. 辛苦了, business dining etiquette, workplace requests, WeChat basics incl. 收到 acknowledgment, client meetings, time/deadlines, directions, supplier negotiation, 6-month HSK learning path); 10 hand-written roleplay scenarios tagged chinese_language (CPEC first day with Chinese site manager, WeChat supplier price negotiation, delay update to Chinese director, client dinner toasts, bilingual factory floor, bilingual-bridge raise negotiation, hosting Chinese investors, WeChat group mishap with face/guanxi dynamics, ordering at a Sichuan restaurant halal-safe, Urdu-Mandarin language exchange); 3 idea-library entries (CPEC translator liaison Rs 30k-80k/mo + allowance, sourcing agent for Chinese imports, two-way Urdu-Chinese tutoring). Platform totals: 8,342 roleplay scenarios, 608 micro-cards, 109 ideas.

The English Tutor previously kept exactly ONE conversation per user per mode — switching modes or wanting a fresh start overwrote history. Now: multiple saved chats per user (last 20 kept). New table english_tutor_chats (id, user_id, mode, title from first message, turns, mistake_patterns). Chats auto-titled from the first user message; per-chat mistake patterns preserved so drilling adapts per conversation. Legacy english_tutor_sessions rows migrate automatically into saved chats on first load (no history loss). Web UI: ＋ New chat button, Saved-chats drawer (mode icon, title, turn count, relative time, delete with confirm, active highlight), instant client-side switching, mode tabs jump to the most recent chat in that mode. Mobile /tutor: same feature set via bottom-sheet (list/switch/delete/new). progress() aggregates across all chats.

Full-platform non-Latin script sweep across 21,700+ content rows (roleplay 8,332, MCQ 4,534, micro-cards 596, exercises 3,370, modules 149, ideas 106, tools 84, packs 37, tracks 14, series 10). Repaired: roleplay #5386 Urdu opening converted to English (respectful-tone scenario keeps Roman-Urdu honorifics Janab/aap as Pakistanis write in business English); exercises #2256 Chinese 隔离→isolation and #2491 举报→report (same MiniMax leak class as v11.38.0 fixes). Intentional multilingual content preserved: cross_cultural guanxi cards (3 Urdu AI-prompting exercises #10/#56/#72 teach prompting AI in Urdu — core Pakistani skill). Final state: 0 accidental non-English rows platform-wide; ContentGovernance CJK guard + generator guards prevent recurrence.

Homepage (play.maahir.io) updated for the first time since the content explosion: hero stats now pull LIVE DB counts (13,400+ practice items = 8,332 roleplay + 4,534 MCQ + 596 micro-cards; 100 AI tools = 84 profession + 16 toolbox; 37 profession packs). New section Real Earnings Not Just Certificates (Maahir Works, Skills Passport, 100 AI Tools cards + verified student earnings line). New section 37 Career Paths One Platform (12 pack chips incl. Project Manager NEW badge + Social Media Mastery track line). What Happens Inside cards updated with live numbers. Mobile companion: m.maahir.io shipped /search (global search page, was API-orphaned) and /me/credentials (Skills Passport wallet with share link, certificates, earnings, badges) — mobile smoke 153/153.

Freelancer platform expansion: 45 AI-generated scenarios — 15 international platforms (PeoplePerHour, Toptal, 99designs, Freelancer.com, Guru, Contra, Kolabtree, ProFinder), 15 Pakistani platforms (Rozee.pk, WorkChest, Mustakbil, HerCareer, FPSC/PPSC, recruitment agencies, job fairs), 15 CLIENT-SIDE scenarios (user plays the hiring client: briefs, proposal evaluation, milestones, managing/firing freelancers, agency vs individual, white-label ethics — previously zero coverage). Plus hand-written: gig economy 12 scenarios (Careem/foodpanda/InDrive surge math, deactivation appeals, rider safety, tax thresholds) + micro-cards gig_economy 10; overseas pathway 10 scenarios (OEP verification, Gulf CV/interviews, attestation chain, embassy help, reintegration) + micro-cards overseas_career 8; remittances 6 scenarios (Payoneer/Wise/RDA, filer basics, hawala avoidance) + micro-cards international_money 6; 6 idea-library entries. All CJK-guarded (zero Chinese). Platform: 8,332 roleplay scenarios, 596+ micro-cards, 106 ideas.

Three parallel waves. (1) DELIVERY-ROLE PACKS: 3 new profession_packs (project-manager 📋, qa-tester 🐞, business-analyst 📊 — 37 packs total), 50 hand-written roleplay scenarios on the client↔PM↔developer triangle (spec translation, mid-sprint change requests, schedule-slip comms both directions, standups, retros, 2 AM incidents, technical debt to business), 10 new profession_tools (sprint-planner, user-story-writer, retrospective-facilitator, stakeholder-report, risk-register, burndown-explainer, test-case-generator, bug-report-formatter, requirements-doc-builder, gap-analysis-matrix — 84 tools total), 20 micro-cards (project_management 10, product_management 5, quality_assurance 5). (2) SOCIAL MEDIA MASTERY: new career track #14 social-media-mastery (📱, pink) with 5 modules × 10 exercises = 50 exercises (Foundations, Content Creation, Platform Strategy, Analytics & Growth, Monetization), 15 roleplay scenarios (algorithm drop, viral crisis, brand-deal negotiation in PKR, Ramadan/Eid content crunch), 4 new social-media-manager tools (content-calendar-generator, hashtag-research-pk, caption-writer, analytics-interpreter), 10 micro-cards (social_media_strategy). (3) JOB-SEEKER TOOLBOX: 4 new Business Toolbox generators in a new "jobs" section (cover-letter ✉️, jd-gap-analyzer 🎯 with fit-% + practice recommendations per gap, salary-benchmark 💵 PKR ranges by city/experience + negotiation anchors, linkedin-optimizer 🔗) — toolbox now 16 tools. Platform totals: 8259 roleplay scenarios, 572 micro-cards, 37 packs, 84 profession tools.

Bug report (room 25): messages saved correctly and appeared on page reload, but the 3-second poll never showed them live. Root cause: the play.maahir.io service worker's fetch handler was cache-first for ALL non-navigation GETs (comment claimed "only static assets" but the code matched everything) — the first empty poll response for a given ?after=N URL was cached by the SW and served forever, so polls never reached the network. Fix, three layers: (1) sw.js now caches only true static assets by extension (.css/.js/images/fonts/manifests, same-origin) — AJAX/JSON/poll URLs always hit the network; CACHE_NAME bumped to maahir-v11.37.1 so stale caches purge on activation; (2) every JSON response now sends Cache-Control: no-store (global json() helper + MultiplayerRoleplayController::jsonOut) — also protects the new GET /api/v1/student/scenario/next from any intermediary caching; (3) poll fetches append a &_=Date.now() cache-buster (room, waiting and spectator loops). nginx serves /sw.js with no-cache so the fixed worker propagates on each client's next navigation.

Mobile quiz flow: the m.maahir.io Practice hub linked to /coach/quiz which 404-ed since launch — page now built (random unattempted scenario, 4 scored options, consequence + lesson + points feedback, session streak). Backend: PersonalityController::getScenario/submitScenario now accept JSON bodies (php://input) as well as form posts via a shared input() helper (csrf_check already honours X-CSRF-Token), and three api/v1 routes expose the flow: GET /api/v1/student/scenario/next (safe idempotent GET, category/difficulty/filter params, returns one unattempted scenario with scores/correct/lesson stripped), POST /api/v1/student/scenario/get (direct fetch by scenario_id), POST /api/v1/student/scenario/submit ({scenario_id, selected_option} → correctness, consequence, lesson, points; full web parity: attempts table, PointManager award, streak, feed item, SRS auto-enroll, parent safety notifications). MCQ library stands at 4534 scenarios.

AI-converted government communication, financial literacy and startup checklist roleplay scenarios into MCQ decision scenarios with 5 dedicated new categories: government_protocols, business_registration, civic_rights, financial_literacy, startup_checklist (plus reuse of money_finance, legal_rights, startup_decisions, contracts_legal). MCQ library grows from 3,696 toward ~4,200; roleplay library at 8193. Also records manifest history for v11.28.0–v11.35.0 (committed to git but previously missing from platform_manifest.json) so the roadmap timeline and mobile sync contract are complete. Facet tags copied from source roleplay scenarios; ContentGovernance review entries queued for every conversion.

Government communication (300 scenarios): DC/secretary meetings, MNA visits, district hierarchy (patwari→tehsildar→AC→DC→Commissioner), SECP/FBR/NTN/STRN registration, SMEDA, Kamyab Jawan/Ignite schemes, PSQCA, EPA clearance, police rights and FIR filing, FIA cybercrime, land records, formal letter writing, protocol etiquette. Startup checklist (240 scenarios) across the 5-point framework: idea validation, market research, customer discovery, value proposition, startup capital, business bank account, accounting setup, financial projections, business structure, insurance, MVP, core team, advisors, digital presence, first 100 users, financial statements. 22 micro-cards: government_protocol (12) + financial_literacy (10). Roleplay library: 8,193.

550 roleplay scenarios covering banking/finance, import/export/supply chain, textile/garment, healthcare deep, agriculture tech, energy sector, telecom, creative writing, photography business, fitness coaching, restaurant/hotel management, travel, interior design, music education, career counseling, executive coaching, mediation, corporate training, grant writing, data science, cloud, DevOps, blockchain, game development.

460 roleplay scenarios (fear calming, AI literacy, adoption stages, one-person startup, vibe coding, WhatsApp AI, GEO, freelancer 2.0, women entrepreneurs, AI ethics/bias/privacy/copyright/deepfake) + 20 micro-cards (advocacy mindset + transformation frameworks).

580 roleplay scenarios: phone/email/WhatsApp etiquette, meeting skills, small talk, networking, managing up/down, office politics, body language, dress code, dining, cross-generational dynamics, feedback, difficult conversations, professional boundaries, assertiveness.

400 roleplay scenarios: board management, CEO transitions, joint ventures, cofounder hunting/vetting/risk appetite/exit, risk management (regulatory, currency, cybersecurity, customer concentration, key person), crisis (PR, data breach, supplier bankruptcy, social boycott), strategy (market entry, merger, budget, restructuring), people (star resignation, toxic executive, remote culture, C-level hiring), stakeholder management, ESG, DEI, down rounds, founder burnout, dignified shutdown. All Pakistani context preserved.

300 new roleplay scenarios (idea validation, MVP, fundraising mechanics, exits, SECP/IP, operations/supply chain/quality/inventory). 10 founder AI tools (equity-vesting-calc, cap-table-sim, runway-calc, tam-sam-som, investor-update, term-sheet-decoder, mvp-scope-cutter, pitch-story-builder, accelerator-application, dignified-shutdown). Founder profession pack (34 packs total). 40 founder micro-cards across 4 new skill_keys (startup_legal, fundraising_mechanics, operations_basics, exit_strategies). Seeded idempotently by scripts/seed_founder_tools.php.

260 new micro-cards (200→460; 2-minute reads, ~130 wpm pacing). 12 new skill_keys (public_speaking, mental_health, money_conversations, client_management, interviews, cross_cultural, pakistani_daily_life, women_workplace, ai_ethics, crisis_management, parenting, startup) plus deepened 16 existing skills to 15+ cards each. Every card is Pakistani-context (PKR, cities, WhatsApp culture).

825 AI-generated MCQ decision scenarios across 20 new categories (public speaking, confidence, teamwork, mental health, money, legal, leadership, cross-cultural, industry sales, HR, parenting, crisis, startup, interviews, English practice, client management, daily Pakistani life, digital safety, women workplace, AI ethics). MCQ library grew to 3,696; combined practice items ~9,054 at the time. All rows carry pakistani_context=1, difficulty spread easy/medium/hard, 4 scored options with consequences, facet tags (skill/context/role/profession/sdg), and ContentGovernance queue review entries.

Wave D profession pack: Startup Founder 🚀 (profession_packs row, slug 'founder', sdg 8, sort_order 34, no track link — 34 packs total). (1) FOUNDER TOOLS: 10 new profession_tools with profession_tag='founder' (70 tools, 36 professions total): equity-vesting-calc ⚖️ (splits + vesting + cliff/leaver scenarios), cap-table-sim 📊 (2 rounds + ESOP dilution table in plain English), runway-calc ⏱️ (runway, break-even, PKR cut list when runway < 6 months), tam-sam-som 📏 (Pakistani market sizing with visible calculation logic), investor-update 📧 (sub-300-word monthly update with metrics table), term-sheet-decoder 🔍 (plain-English clause-by-clause + red flags + lawyer-review disclaimer), mvp-scope-cutter ✂️ (ruthless cut to 3-5 features with add-back timing), pitch-story-builder 🎤 (hook-villain-hero script, English + Roman Urdu), accelerator-application 🚀 (Nest I/O / Plan9 / NIC style with Pakistani market numbers), dignified-shutdown 🏳️ (2-4 week plan, scripts for employees/users/investors/vendors, Pakistani severance basics). (2) FOUNDER SCENARIOS: 5 hand-written roleplay_scenarios, profession_tags=['founder'], role_tags=['founder'], sdg_tags=[8] — The 2 AM Cofounder Call (teamwork/hard), Choosing Between Two Investors (negotiation/hard), Telling Your Parents You Left Your Job (communication/medium), The Customer Who Wants to Pay But You are Not Ready (boundaries/medium), The Competitor Copy Decision (resilience/hard). (3) FOUNDER MICRO-CARDS: 40 hand-written cards in 4 NEW micro_cards skill_keys (10 each): startup_legal (SECP structures, IPO trademarks, founder agreement, IP assignment, PECA, bank accounts, NDAs, NTN/STRN/filer, employment + EOBI, LOIs/MOUs), fundraising_mechanics (pipeline math, term sheet's 7 clauses, pre/post-money, dilution math, liquidation preferences, SAFEs vs notes, pipeline CRM, warm intros, data room, investor updates), operations_basics (ops triangle, EOQ + safety stock, supplier evaluation, acceptance sampling, process mapping, Karachi/Lahore routing, SOP 5 elements, 10x scaling breaks, vendor lock-in, 70% cost-cut rule), exit_strategies (acquisition vs acqui-hire vs merger, timing signals, 12-month diligence checklist, earn-outs, team/user comms scripts, final investor letter, asset sales, acquisition vesting, life after exit) — 500 micro_cards total. No new routes/controllers/tables: content rows only, surfaced by existing pack/tool/micro endpoints and pages. New skill_keys are DB-seeded like the v11.21 mega-wave skills (web SKILLS-registry grid unchanged).

Four new practice formats. (1) BRANCHING STORIES: branching_stories/nodes/options + branching_progress tables; BranchingController (index/play/choose) at /student/branching — choose-your-adventure with typed endings + lessons, endings-found tracking, +3 XP per new ending, +10 XP all-endings bonus, path backtracking ("Try a Different Path" rewinds to the last decision node); 10 hand-written stories seeded. (2) TIMED CHALLENGES: roleplay_scenarios.time_limit_seconds column; TimedChallengeController at /student/timed — same chat engine as role-play plus a countdown bar/clock (red pulse <10s), auto-submit on timeout via force_end (empty drafts record a timeout placeholder), ⚡ +5 XP speed bonus when finishing with 30%+ remaining (time_remaining posted by the client and validated server-side against the scenario limit); 20 scenarios seeded (5×30/60/90/120s); JSON twin on the start endpoint for mobile. (3) REVERSE ROLE-PLAY: roleplay_scenarios.is_reverse column; /student/roleplay/reverse lists 20 scenarios where the user plays the difficult character and the AI plays the Pakistani freelancer/employee — respond() builds an INVERTED system prompt (stay professional, handle demands, evaluate the user on realism-as-difficult-character + testing thoroughness); the session view shows a 🔄 Reverse badge + role-flip hints; transcript labels swap accordingly. (4) SCENARIO CHAINS: scenario_chains + scenario_chain_steps tables; ScenarioChainController (index/detail/completeChainStep) at /student/chains — ordered 5-step storylines with recurring characters (Ahmed, Sitara, Bilal, the Daraz store, first-job 90 days), steps unlock strictly in order, full completion awards +15 XP once + notification (wired into respond() alongside series completion); 25 new linked scenarios + 5 chains seeded. Nav: 4 new Practice entries (Branching Stories 🧭, Timed Challenges ⏱️, Reverse Roleplay 🔄, Story Chains ⛓️) with NEW badges until 2026-10-13. Verified: php -l clean, seeds idempotent, smoke 9/9, CLI suite scripts/test_format_innovations.php 17/17 (branching play-through incl. backtrack + no-double-XP, timed force_end + speed bonus + timeout placeholder, reverse inversion with real AI, chain locking/order/completion bonus, zero points-ledger drift before and after cleanup), HTTP routes 302-auth-gated on play.maahir.io.

scripts/generate_wave4_hr_legal_culture.php (NEW, sharded wave-1 pattern, roleplay_scenarios): 14 topic-groups x 10 = 140 AI-drafted, deduped, governance-audited roleplay scenarios. HR deep (+50, type communication/ethics/career): hard HR outcomes with dignity (negative review of long-tenured employee, layoffs/severance, promotion denial, PIP), harassment & discrimination (victim-side reporting, HR-side investigation, gender/age/regional bias), managing friction (senior-employee mediation, toxic high-performer, Gen Z generational gap, invisible remote employee), awkward conversations (hygiene, chronic lateness, damaging social posts, romance disclosure, substance abuse, competitor moonlighting), HR-side career talks (star exit interview, returning-mother flex work, HR-side salary negotiation) — skill difficult_conversations/leadership/empathy/conflict_resolution, context workplace, role manager, sdg [8,5]. Legal system (+40, type communication/negotiation/career): FIR filing, traffic stop rights, raid/search rights, false complaint, bail; civil court plaintiff, witness, legal notice, cheque bounce S.138, consumer court; landlord-tenant, encroachment, property transfer, guardianship, child custody; SECP registration, court marriage, NADRA CNIC, FBR notice, workplace injury — skill legal_awareness/rights_advocacy/official_communication, context daily_life, sdg [16]; every legal description carries the disclaimer \u0027For educational purposes. Always consult a qualified lawyer.\u0027. Cross-cultural China/CPEC (+30): Alibaba sourcing & face culture, payment terms/guanxi, quality disputes, CPEC engineer communication styles, Pakistani-reporting-to-Chinese-manager, work-culture misunderstandings, relationship-first partnerships, delegation hosting/protocol/gift-giving, investment-committee proposal, business-dinner etiquette — skill cultural_intelligence/negotiation/business_communication, context business, role founder+professional, sdg [8], region_tags [china] (first region-tagged roleplay set since wave 1 GCC/US/UK/EU). Parenting & Eldercare (+20): online safety with a 10-year-old, teen screen time, peer pressure, alternative career path, financial limits; role-reversal eldercare talk, sibling care disputes, divorce impact on children, doctor refusal, career/presence balance — skill family_communication/empathy/boundaries, context home, sdg [3,4]. Ops: generator supports resume (skips topic-groups already at 10 via content_governance meta tally); run max 3 shards (AI provider concurrency limit). INCIDENT NOTE: a parallel session ran 3 sibling wave-4 generators concurrently (generate_wave4_mental_public/interview_sales/teamwork_money, ~460 rows, separate scopes with their own tags) against the single-operator rule; this session killed its own shards, waited for drain, then reran with exclusive logs (wave4_hlc_s*.log) — no duplicate titles across all 170 overlap-tagged rows. roleplay_scenarios 3,133 -> 3,273 from this script.

PART 1 — MultiplayerRoleplayController gained a MOBILE API v1 section (apiCreate/apiJoin/apiRoom/apiSend/apiPoll/apiEnd/apiCancel) wired into public/api_v1.php under /api/v1/student/multiplayer/*: 6-char room codes from the unambiguous alphabet, atomic guest-claim join (status waiting→active), 2000-char capped messages, 3-second polling with after={message_id} + opponent_online presence (last_active_at < 5 min), end-by-both-players handshake via END_MARKER messages with AI judging on communication/persuasion/problem_solving/professionalism (0-100 each + overall), ai_scores + winner_id stored, 15 XP each + 10 winner bonus (base points; PointManager multipliers still apply), cancel with opponent notification. The web endpoints keep their exact response shapes; the shared judge prompt now emits the four criteria fields (web result panel continues to use overall score/strengths/improvements). PART 2 — MaahirWorksController::suggest(userId) ranks up to 3 open projects (excluding ones already proposed on) by matching skills_needed against the student's top-5 skill_xp keys, professions from completed ai_roleplay_sessions→roleplay_scenarios.profession_tags, and their user_onboarding_goals earn goal (light stemmer: writer≈writing); exposed as GET /api/v1/student/works/suggest (admins may pass ?user_id=), rendered as a 🎯 Recommended for You card row above the project grid on /student/works, plus an admin POST /api/v1/admin/works/auto-match that notifies the best-matching (score ≥ 10) student who has not proposed per open project (idempotent per project+student via activity_log). Verified end-to-end: CLI create→join→4-msg chat→poll→both end→real AI verdict (winner=guest, criteria scores), base XP 15/15/+10 in points_log with zero ledger drift; HTTP E2E 17/18 (all functional; the points delta note reflects platform random multipliers), auto-match seeded run matched project 3→user 4 (score 24, reason "Matches your top skills: Content Creation, Canva") and a second run matched 0 new.

PART 1 - Impact Analytics: new admin-only page /admin/impact (ImpactAnalyticsController::page -> admin.impact-analytics view) with 4 stat cards (total students, active today/week/month, Rs earned, exercises done), 30-day enrollment trend CSS bar chart, engagement funnel (registered->logged in->first exercise->first roleplay->first earning with step conversion), learning outcomes per batch + avg session scores + module completion bars, earning outcomes by source/batch from student_earnings, SDG 17-goal grid (completions, learners, scenario catalog) + distribution bars, skill growth (top 10 by skill_xp XP + fastest-growing this week from 7-day roleplay skill_tags and micro card completions), at-risk table (inactive 3+ days, batch + last activity + actions). All data from real DB queries; route added in admin-only group next to /student-risk. PART 2 - Kid Entrepreneurship: EarnHubController::paths() gains 7th path kid_earning 'Kid Creator' (5 manual steps, pocket-money est) with age_tier gating - children see only kid_earning, non-children never see it (pathsWithStatus 3rd param + toggleStep 403 on cross-tier); earn.php hero swaps copy for kids; scripts/seed_kid_scenarios.php seeds 10 kid roleplay_scenarios (consent-aware YouTube pitch, family-dawat art sales, shop price-list digitization, scam spotting, ask-before-download, stranger-info defense, cyberbullying disclosure, savings goal, password secrecy, first business report) with difficulty easy, context_tags [education,home], role_tags [student], sdg_tags [4]; idempotent by title. PART 3 - Feedback Boards: new feedback_items + feedback_votes tables (UNIQUE user+item; upvotes recomputed from votes on every toggle so counts cannot drift), FeedbackController page/submit/upvote for students (filter by type+status, sort top/new, one-vote-per-user toggle) and adminIndex/updateStatus triage (open->planned->in_progress->shipped/declined + public admin_response shown on student cards); views student.feedback + admin.feedback-manage; nav: 'Feedback' under student Community + 'Feedback Board' under admin Safety & Support + 'Impact Analytics' under admin Insights; scripts/seed_feedback_boards.php seeds 5 Pakistani-context items with realistic upvotes/statuses; schema record database/migration_feedback_boards.sql. No /api/v1 routes changed.

PART 1 — Global Search: new grouped SearchController::search() (GET /student/search?format=json + GET /api/v1/student/search, min 2 chars, 5 per type, exact→prefix→LIKE relevance, active/published rows only) across roleplay_scenarios, scenario_bank, modules, idea_library, ToolboxController::TOOLS, micro_cards, sahelii_databank, roleplay_series, profession_packs. Full search page resources/views/student/search.php (autofocus input, 300ms-debounced live AJAX, skeleton, quick-filter chips per type, empty state, / hotkey with capture-phase override so it wins over the sidebar nav filter). Old flat universal search preserved as SearchController::legacy() behind /api/search (sidebar dropdown unchanged). PART 2 — Credentials Wallet: CredentialsWalletController (page/public/api) aggregates skill_xp grouped into soft/professional/technical families via MicroLearningController::SKILLS (Novice 0-99 / Practitioner 100-499 / Expert 500-1499 / Master 1500+ with next-level bars), issued_certificates (module certs, /verify/{code}) + skill_certificates (track certs, /verify-cert/{token}), user_achievements, capstone_projects (artifacts done/total), RolePlayController::seriesWithProgress, student_earnings (total + by source), ai_roleplay_sessions stats (sessions/completed/avg/best scenario type), completed assessments, profession-pack practice (JSON_CONTAINS on profession_tags). Views: student/credentials.php (hero + share-link copy + print CSS) and public/credentials.php (noindex, referral-code gated on public_profile_enabled/_forced, zero contact info — verified no email/phone/city in output). Routes: /student/search, /student/credentials, /student/credentials/{code} → 302 /credentials/{code}, public /credentials/{code}. Nav: 'Search' (🔍, top of 📚 Learn) + 'Credentials' (🛂, 🎯 Career) + sidebar 'Search everything →' link; both flagged NEW until 2026-10-13. No DB schema changes — reads existing tables only.

PART 1 — public/why-maahir.php comparison table: removed the Upwork/Fiverr and Rozee.pk columns (9+1 -> 7+1 columns: Capability, Coursera, YouTube, ChatGPT alone, DigiSkills, eRozgaar, IT Academies, Maahir), foreach indices [1..8] -> [1..6], footer note reworded, table min-width 1100px -> 800px so the highlighted Maahir column is visible without horizontal scroll on a 1024px viewport. Verified: 21 rows x 8 cells, zero Upwork/Rozee strings in rendered HTML. PART 2 — scripts/seed_startup_deep.php inserts 40 roleplay_scenarios rows (NOT scenario_bank) covering the full Pakistani startup cycle: pitching/fundraising (12), pricing/business model (10), cofounder/team (10), operations (8); idempotent by title; tags role_tags=[founder], context_tags=[business,career], sdg_tags=[8]. PART 3 — student/learning-guide.php (/student/guide): time expectations rewritten to a flexible model (2-3 hours/day ideal, one module per week at a comfortable pace or faster, all activity types count toward progress, suggested pace not a requirement); rigid DAY 1 / 1-module-per-day schedule softened; MORNING/AFTERNOON/EVENING badges generalized to LEARN/PRACTICE/APPLY. No API routes, auth, or schema changes in this release.

PART 1 — /student/scenarios rebuilt as a server-side faceted browse (same engine pattern as RolePlayController::facetedBrowse): five JSON tag columns added to scenario_bank (skill/context/role/profession/sdg) and backfilled for all 1,826 legacy rows via scripts/backfill_scenario_tags.php (domain→context, category→skill+role+profession maps, tags varchar merged into skills, domain+female→sdg; idempotent — already-tagged rows skipped). PersonalityController::scenarios() now runs facetedScenarios(): skill/context/role/profession/sdg/difficulty/q/page filters (JSON_CONTAINS WHERE builder, 24/page, ORDER BY FIELD(difficulty easy→hard), title), per-facet counts excluding the facet's own filter, age_tier + ?filter= gender scope preserved, legacy $categories/$domainCats kept only as the no-filter 'browse by domain' default state (domain cards click into context filters). View student/scenarios.php replaced with the roleplay-index design: search + difficulty/context/skill(top-15)/role chips, domain-card default state, card grid (scene emoji, difficulty badge, context/role emoji badges, tags, Play →), pagination, empty state, and an in-page MCQ player fed by POST /api/scenario/get which now accepts scenario_id for direct fetch (legacy random-by-category unchanged). New API: GET /api/v1/student/scenarios → {ok, items, facets, total, page, per_page}. PART 2 — Content Wave 3 via scripts/generate_wave3_scenarios.php (sharded, wave-1 pattern, scenario_bank MCQ shape: 4 options {id,text,score 0|3|5|10,correct,consequence}, lesson, scene_emoji, Pakistani context): 350 new scenarios across 35 topics — deepens freelancing(+30), workplace_survival(+20), interview_prep(+20), first_job(+20), critical_thinking(+30), money_basics(+30 incl. halal finance), personal_safety(+20), ethics_dilemmas(+20) and introduces 8 categories: client_communication, startup_decisions, negotiation_daily (life_skills), english_workplace, leadership_basics, remote_work (career), time_management (foundation), digital_marketing (business). Generator inserts curated facet tags at insert time; backfill re-run confirmed 2,176/2,176 active rows tagged. Ops note: AI provider concurrency limit is 3 — run generators with 3 shards max.

Profession Packs Wave C: 15 new packs for hands-on and vocational livelihoods — Auto & Motorcycle Mechanic 🔧, Professional Painter 🎨, Electrician ⚡, Plumber 🚿, Carpenter & Furniture Maker 🪵, Chef & Caterer 👨‍🍳, Beautician & Salon Professional 💅, Professional Tailor & Designer 🧵, Ride-hailing & Delivery Rider 🏍️, Retail & Kirana Shopkeeper 🏪, Property Dealer 🏠, Professional Photographer 📸, Wedding & Event Planner 🎪, Mobile Repair Technician 📱, Construction Contractor 🏗️. Each pack ships 3 hand-written (not AI-generated) Pakistani-context roleplay scenarios — 45 total — covering comeback warranties and counterfeit brake parts, thinned-paint price wars and scope creep, 7/29 wiring refusals and midnight emergency rates, seepage blame games, Pinterest impossibilities and timber inflation, valima guest-count cuts, skin-reaction complaints and midnight bridal changes, designer-dress counterfeits and Eid machine failures, fare dodgers and false suspension appeals, supplier margin squeeze, structural-defect liability and hide-the-defect ethics, wedding-gallery refund demands and uncredited commercial use, venue cancellations 48 hours out, intake-photo damage disputes and half-price refurbished competitors, post-slab design changes, vanished labour and stalled payments. Plus 15 new profession_tools (1 per pack): repair-estimate, paint-quote, wiring-safety-check, plumbing-diagnosis, furniture-quote, menu-costing, salon-price-list, fabric-estimate, trip-log, inventory-sheet, property-listing, photo-package, event-checklist, repair-diagnosis, material-estimate — 60 tools total. Legacy cleanup: 40 old chef/photographer facet-tag rows cleared/stripped so pack pages show exactly their curated scenarios. Nav unchanged — 'Professions' already live under 🎯 Career (roadmap/nav handled in part 1).

New profession_tools table + ProfessionToolController: every profession pack gets 2-3 dedicated AI generators that solve its REAL daily problems (45 tools across 20 professions — the 18 packs plus teacher and accountant; customer-support rounds out full pack coverage). Highlights: lawyer (legal notice drafter, contract analyzer, case timeline), healthcare (patient education Roman Urdu/English, referral letter, clinic SOP), pharmacist (generic finder with PKR prices, dosage card), childcare (lesson planner, WhatsApp parent update), engineer (spec summarizer, site report, BOQ formatter), journalist (fact-check framework that never gives a verdict, headline optimizer), agriculture (crop advisory, mandi analysis), social worker (anonymized case reports, donor impact reports), teacher (report card comments, lesson plans, parent meeting prep), accountant (chart of accounts, FBR tax checklist), plus tools for designer, VA, SMM, translator, data annotation, web dev, content writer, video editor, online tutor and customer support (response templates, de-escalation script, CSAT recovery). Each tool = input_fields JSON schema + Pakistani-context system_prompt in DB (seeded idempotently by scripts/seed_profession_tools.php). Generation engine: POST reads fields per the JSON schema, validates required inputs (422 'Please fill: …'), builds the prompt, calls AI::chatTask('general_chat', max_tokens 1200) with plan-limit gating, saves to existing toolbox_outputs under the tool_key (shared Toolbox history) and logs profession_tool_generated. Wired in three places: (1) profession pack detail page '🔧 Professional Tools' section with modal forms (same pattern as Toolbox hub); (2) Toolbox page new '💼 By Profession' tab with grouped grids — general/profession tabs, both sharing one modal builder with per-tool endpoint base; (3) mobile API. Legal-flavored lawyer tools instruct the AI to prefix learning disclaimers.

New public /why-maahir page (WhyMaahirController + view public/why-maahir.php, no auth): the world's-first Learn→Practice→Earn pitch for Pakistan with every claim backed by a live DB number. Live stats block computes on every request: active roleplay_scenarios, published modules, active micro_cards, idea_library entries, active profession_packs, assessments taken, approved students, SUM(student_earnings.amount_pkr) as total Rs earned, verified student_outcomes, published student_testimonials, and seats left in settings.default_batch_id (same taken-seat formula as the homepage, excluding batch_switches). Page sections: (1) hero with live seat counter + Join Free CTA; (2) The Engine — 5-stage pipeline DISCOVER→LEARN→PRACTICE→PRODUCE→EARN, each card with live count badge; (3) See the Difference — 15-row comparison table across 🎓 Coursera | 📺 YouTube | 💼 Upwork/Fiverr | 🤖 ChatGPT alone | 🎓 Maahir with ✅/🟡/✗ marks (Pakistan context, AI-scored conversation practice, Roman Urdu→Business English, legal rights, regional playbooks, earning ledger, personal opportunity maps, free forever, kids-through-CEOs, conversation arcs, multiplayer, supervised client work, SDG impact, offline PWA, status transparency); (4) Only-at-Maahir wall — 18 unique features each with a live proof metric; (5) six audience strips (student/freelancer/business owner/home business/professional/teen) with 3-step paths; (6) proof section with live stat grid, top 3 verified outcomes (top 5 fetched), top 3 published testimonials, /sdg link; (7) 5-item FAQ accordion; (8) final 'Start free — no credit card, no catch' CTA. SEO: title 'Why Maahir — Learn, Practice, Earn. Built for Pakistan | Free Forever', index,follow, meta description with live counts baked in, OG tags type=website. Links added: public_nav first item, public_footer Platform column, homepage hero CTA row.