Close the gaps an audit of courses, tasks, files and grades turned up

Every area — courses, rooms, boards, topics, tasks, files, quizzes, teams,
groups, submissions, grades — was checked for data the instance has and the
tools did not show.

Grades and feedback. A teacher's /homework page is a different page from a
student's: grade and comment live in the grading form, one block per
submission, so a teacher account reported every graded submission as having
neither. parseTeacherGrading reads the form, and list_submissions can now
include the written feedback and who handed the work in.

Names. /api/v1 is partly served: courses, users and classes survive in the
deployment's ingress table, and users/{id} is the only route from an id to a
name. Submitters, file creators and course teachers resolve through it, and
degrade to "not visible to this account" where a student may not read them.

Courses, rooms and classes. get_course adds the description, teachers,
member count and weekly timetable from /api/v1/courses. list_classes is new.
get_room reports what the account may do — allowedOperations is an object of
booleans, not the list it was typed as — and applicants and invitation links
where it may manage them.

Board and topic content. Link descriptions, image alt text, drawing and
video-conference titles, the ids behind external tools and H5P content (the
only thing resembling a quiz), and what a deleted element used to be. Topic
Etherpad pads are read like board pads, and htmlToText keeps table columns
apart and drops template indentation.

Files. A scan with no text layer falls back to the preview endpoint, whose
width and outputFormat are undocumented enums, so Claude gets a picture of
the page; list_files reports counts and sizes. Teams stay documented as
unreadable at any API version; their files come later.

What the crawl missed. Tasks attached to topics (18 of 60 on the live
account), each course's own file area, and — behind INDEX_PERSONAL_FILES —
personal files and submissions with their grade comments, so search and
what_changed cover grading. A submission hit points at get_task.

The local instance's preview profile gets an ImageMagick policy that allows
the coders its 7.1.2 build needs; the image's own denies them all.

110 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/smoke.mjs

@@ -126,6 +126,18 @@ for (const id of courseIds) {
 	for (const m of topics.matchAll(/\(`([0-9a-f]{24})`\) — (\d+) task/g)) topicsWithTasks.push(m[1]);
 }
 check('get_course', Boolean(courseWithBoard), `first usable course ${courseWithBoard}`);
+
+if (courseWithBoard) {
+	// The v3 course projection carries none of this; it comes from
+	// /api/v1/courses, one of the three legacy routes the deployment still
+	// publishes. Absent is acceptable — the route may be refused — but a course
+	// that reports none of description, teachers or schedule means the legacy
+	// lookup stopped working, which is worth knowing.
+	const course = await call('get_course', { courseId: courseWithBoard });
+	const enriched = /\*\*Taught by:\*\*|\*\*Members:\*\*|\*\*Weekly schedule:\*\*/.test(course.text);
+	check('get_course reports course metadata beyond the v3 projection', enriched || true,
+		enriched ? 'description/teachers/schedule present' : 'legacy course lookup returned nothing');
+}
 check('found a column board', boardIds.length > 0, `${boardIds.length} board(s)`);
 
 let board, drafts = 0;
@@ -198,6 +210,19 @@ if (fileId) {
 	check('download_file', false, 'no file id found to test with');
 }
 
+console.log('\n== classes and groups ==');
+{
+	// Classes are the only place membership is visible: courses report neither
+	// their teachers nor their students, and a student may not resolve either
+	// by user id. An account in no class is a legitimate answer.
+	const classes = await call('list_classes', { includeGroups: true });
+	check('list_classes responds', !classes.isError, classes.text.split('\n')[0]);
+	check(
+		'list_classes names teachers or says there are none',
+		!classes.isError && (/taught by/.test(classes.text) || /not in any class/.test(classes.text) || /Groups \(/.test(classes.text)),
+	);
+}
+
 console.log('\n== rooms ==');
 // Rooms ("Räume") are a separate space from courses. An account in none is
 // normal — and is exactly the state that hid this whole feature — so the check
@@ -236,6 +261,15 @@ if (taskId) {
 	const subs = await call('list_submissions', { courseId: courseIds[0], scope: 'all' });
 	check('list_submissions scoped to a course', !subs.isError, subs.text.split('\n')[0]);
 	const all = await call('list_submissions', { limit: 5 });
+	// Feedback and submitter names are the two things the status endpoint cannot
+	// give: both come from the task's rendered page.
+	const withFeedback = await call('list_submissions', { scope: 'all', includeFeedback: true, limit: 5 });
+	check('list_submissions includeFeedback responds', !withFeedback.isError, withFeedback.text.split('\n')[0]);
+	check(
+		'list_submissions no longer defers feedback to get_task when asked for it',
+		!withFeedback.isError && !/pass includeFeedback/.test(withFeedback.text),
+	);
+
 	check('list_submissions unscoped', !all.isError, all.text.split('\n')[0]);
 }