fix: four-perspective audit remediation (student flow, security, UX, AI)

drizzle/0041_plan_consolidation.sql

@@ -0,0 +1,28 @@
+-- ============================================================================
+-- 0041 — Plan consolidation window & plan-correctness (audit Phase 2)
+--
+-- Purely ADDITIVE (CREATE/ALTER only — no DROP): the existing plan tables keep
+-- their columns and legacy rows stay valid via defaults. Backs the pre-exam
+-- consolidation window, week overrides, plan staleness, persisted scheduler
+-- warnings and the idempotent exam-event sync:
+--   * plan_session.kind          — study | review | cards (majority category),
+--                                  DEFAULT 'study' → existing sessions read as
+--                                  study.
+--   * semester_plan.week_overrides  — {"2026-W31": 4} per-ISO-week hour caps.
+--   * semester_plan.stale_at        — null = fresh; set on plan-relevant edits.
+--   * semester_plan.last_warnings   — last recompute's scheduler warnings.
+--   * event.goal_id (FK module_goal, ON DELETE CASCADE) + index — lets the exam
+--                                  goal own an all-day calendar event keyed by
+--                                  goal, so the scheduler blocks the exam day.
+-- GoalConfig.reviewDays is a jsonb-only field (no DDL).
+--
+-- Not runnable here (no DB in this environment); verified via db:generate (no
+-- drift), typecheck and tests.
+-- ============================================================================
+ALTER TABLE "event" ADD COLUMN "goal_id" text;--> statement-breakpoint
+ALTER TABLE "semester_plan" ADD COLUMN "week_overrides" jsonb;--> statement-breakpoint
+ALTER TABLE "semester_plan" ADD COLUMN "stale_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "semester_plan" ADD COLUMN "last_warnings" jsonb;--> statement-breakpoint
+ALTER TABLE "plan_session" ADD COLUMN "kind" text DEFAULT 'study' NOT NULL;--> statement-breakpoint
+ALTER TABLE "event" ADD CONSTRAINT "event_goal_id_module_goal_id_fk" FOREIGN KEY ("goal_id") REFERENCES "public"."module_goal"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "event_goalId_idx" ON "event" USING btree ("goal_id");

drizzle/0042_search_and_locale.sql

@@ -0,0 +1,23 @@
+-- ============================================================================
+-- 0042 — Bounded search & reminder locale (audit Phase 5)
+--
+-- Purely ADDITIVE (CREATE/ALTER only — no DROP):
+--   * material.text_content_tsv  — STORED generated tsvector over text_content
+--                                  ('german' config, coalesced for the nullable
+--                                  column) + GIN index. Replaces the ILIKE
+--                                  seq-scan in the command-palette search route
+--                                  with websearch_to_tsquery('german', …) @@.
+--                                  Mirrors material_chunk.content_tsv (0033).
+--   * user_prefs.locale          — preferred locale; reminder job localizes
+--                                  push/email through it (R4 seam).
+--   * event.skip_dates jsonb     — ISO dates of individually-deleted recurring
+--                                  occurrences; expandOccurrences skips them
+--                                  (E18 single-occurrence delete, no series drop).
+--
+-- Not runnable here (no DB in this environment); verified via db:generate (no
+-- drift), typecheck and tests.
+-- ============================================================================
+ALTER TABLE "event" ADD COLUMN "skip_dates" jsonb;--> statement-breakpoint
+ALTER TABLE "user_prefs" ADD COLUMN "locale" text;--> statement-breakpoint
+ALTER TABLE "material" ADD COLUMN "text_content_tsv" "tsvector" GENERATED ALWAYS AS (to_tsvector('german', coalesce("material"."text_content", ''))) STORED;--> statement-breakpoint
+CREATE INDEX "material_text_content_tsv_idx" ON "material" USING gin ("text_content_tsv");