tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

content/services.py

@@ -6,6 +6,7 @@ content/receivers.py صدا زده می‌شن (نه مستقیم از views.py)
 دقیقاً همون الگوی signal-based که برای discount/subscription استفاده شده.
 """
 from django.db import transaction
+from django.db.models import Count
 from django.utils import timezone
 
 from statuslog.signals import status_changed
@@ -53,6 +54,39 @@ def touch_node_progress_on_answer(user_id, question):
     return progress
 
 
+def playable_lesson_ids(lessons_with_counts) -> list[int]:
+    """
+    [(lesson_id, تعدادِ سوال), ...] → idهای درس‌های سوال‌دار، به همان ترتیب.
+
+    ۵۸۵ درس از ۲٬۶۲۴ (۲۰۲۶-۰۹-۲۴) هنوز سوال ندارند و اپ برایشان فقط «به‌زودی»
+    نشان می‌دهد، پس هیچ‌وقت تمام نمی‌شوند. اگر شرطِ تمام شدنِ جزیره «همه‌ی
+    درس‌ها» باشد، ۱۸۱ جزیره از ۲۶۹ هرگز تمام نمی‌شد. جزیره‌ای که هیچ درسِ
+    سوال‌داری ندارد، همه‌ی درس‌هایش را نگه می‌دارد (رفتارِ قبلی).
+    """
+    pairs = list(lessons_with_counts)
+    playable = [lid for lid, count in pairs if count]
+    return playable or [lid for lid, _count in pairs]
+
+
+def node_playable_lesson_ids(node) -> list[int]:
+    return playable_lesson_ids(
+        node.lessons.annotate(question_total=Count('questions'))
+        .values_list('id', 'question_total')
+    )
+
+
+def verified_correct_count(user_id, *, lesson_id=None, node_id=None) -> int:
+    """تعدادِ سوال‌های متمایزی از این درس/مبحث که کاربر درست جواب داده و ثبت شده."""
+    from .models import UserAnswer
+
+    qs = UserAnswer.objects.filter(user_id=user_id, correct=True)
+    if lesson_id is not None:
+        qs = qs.filter(question__lesson_id=lesson_id)
+    if node_id is not None:
+        qs = qs.filter(question__lesson__node_id=node_id)
+    return qs.values('question_id').distinct().count()
+
+
 def update_node_progress_on_lesson_completion(user_id, lesson):
     """
     وقتی یک Lesson تکمیل می‌شه، تعداد Lessonهای تکمیل‌شده‌ی Node رو
@@ -65,7 +99,7 @@ def update_node_progress_on_lesson_completion(user_id, lesson):
         old_status = progress.status
         now = timezone.now()
 
-        lesson_ids = list(node.lessons.values_list('id', flat=True))
+        lesson_ids = node_playable_lesson_ids(node)
         completed_count = UserLessonCompletion.objects.filter(
             user_id=user_id, lesson_id__in=lesson_ids
         ).values('lesson_id').distinct().count()
@@ -129,9 +163,10 @@ def grade_progress_percent(user_id, grade_id):
     """
     if not grade_id:
         return 0
-    lesson_ids = set(
-        Lesson.objects.filter(node__unit__grade_id=grade_id).values_list('id', flat=True)
-    )
+    lesson_ids = set(playable_lesson_ids(
+        Lesson.objects.filter(node__unit__grade_id=grade_id)
+        .annotate(question_total=Count('questions')).values_list('id', 'question_total')
+    ))
     if not lesson_ids:
         return 0
     done = set(
@@ -142,6 +177,7 @@ def grade_progress_percent(user_id, grade_id):
         user_id=user_id, node__unit__grade_id=grade_id,
     ).values_list('node_id', flat=True)
     done |= set(Lesson.objects.filter(node_id__in=quiz_nodes).values_list('id', flat=True))
+    done &= lesson_ids
     return round(min(len(done) / len(lesson_ids), 1.0) * 100, 2)