ExamAdvantage — Changelog

Certification Tool and Die, Ltd. · ISC2 and ISACA certification courses

Release 26286_01 — October 13, 2026

Course DBs · Course content update · All 9 ISC2 exams rebuilt · No program changes

Topic Structure Matches the Examulator Practice Exams

Every study page in the nine ISC2 courses now carries the same number and the same title as the matching objective in the Examulator practice exams, at every level of the outline. The two products share one topic tree of 83,252 topics, so a practice-exam result points straight at the study page that covers it. This is the final stage of Examulator <-> Exam Advantage alignment.

• 36,218 pages moved to the number Examulator uses for the same topic, and 3,343 pages took Examulator's title.

• Topic numbers no longer contain parentheses. The official ISC2 objective is followed by a space and the sub-topic letters, separated by periods: 1.1.1 a.b.c (previously 1.1.1 a(b.c)).

• Where one study page covered a topic that Examulator splits into narrower sub-topics, the page moved under the sub-topic it teaches or, when it covered all of them, became that topic's overview page beside the new sub-topic pages.

• Duplicate topics were merged, and topics that sat under the wrong objective were moved, in both products. Examples include CGRC system documentation types that appeared twice, the Parallel and Full interruption BCP test types that ISSMP listed twice and a set of CGRC continuous monitoring pages stored three times.

• Titles now use American spelling and plain words in place of symbols in both products (for example "FIPS 199 result to SP 800-53B baseline").

New Study Pages and Practice Questions

• The courses grew by 17,261 study pages, covering the topics Examulator tests that the courses did not yet have. Each new topic page has an introduction, a deep dive, a worked example, an ISC2 role callout, an exam tip and three practice questions (easy, moderate and challenging).

• The courses grew by 36,045 practice questions. Every new question has one correct answer and three wrong answers that are real practices or concepts, each with its own explanation.

• 5,725 topics that group several sub-topics received an orientation page: what ties the sub-topics together, how they differ and what an exam question uses to tell them apart, with a map of the sub-topics.

Quality Review of the New Pages

• Every new page was checked against the course editorial standard, and 11,856 pages had weak sections rewritten: short deep dives and worked examples, callouts that did not name the exam role, and practice questions whose correct answer was the longest option or whose explanation was too brief.

• Answer keys on the first set of new questions were verified against their explanations; 517 that credited the wrong option were corrected.

• Two CGRC configuration control board pages whose text described SSP documentation were rewritten to cover their topic.

Current Standards and House Style

• 120 answer references that cited a superseded edition now name the current one: NIST SP 800-61 Rev 3, NIST SP 800-63-4 and NIST SP 800-171 Rev 3.

• 3,380 British spellings were changed to American spelling, 2,133 missing spaces between words in ISSEP were restored and 15 stray data fragments were removed from page text.

• New text follows the house style: no banned words, dashes or Oxford commas.

Changes by Course

• CC: 5,098 pages became 6,706; 13,293 practice questions became 17,052; 3,584 pages moved, 221 retitled.

• SSCP: 7,696 pages became 9,353; 18,894 practice questions became 22,251; 4,096 pages moved, 395 retitled.

• CCSP: 7,429 pages became 8,873; 18,246 practice questions became 21,075; 4,389 pages moved, 302 retitled.

• CISSP: 9,904 pages became 11,422; 22,602 practice questions became 25,488; 2,740 pages moved, 290 retitled.

• CSSLP: 10,591 pages became 11,964; 23,610 practice questions became 26,769; 4,919 pages moved, 431 retitled.

• CGRC: 6,890 pages became 8,777; 18,456 practice questions became 22,656; 3,680 pages moved, 188 retitled.

• ISSAP: 5,185 pages became 9,188; 13,455 practice questions became 22,062; 3,756 pages moved, 698 retitled.

• ISSMP: 6,328 pages became 7,945; 16,530 practice questions became 19,236; 4,354 pages moved, 393 retitled.

• ISSEP: 6,870 pages became 9,024; 17,994 practice questions became 22,536; 4,700 pages moved, 425 retitled.

Upgrade Actions

No action is needed beyond installing the updated course downloads.

Release 26282_01 — October 9, 2026

Course DBs · Course content update · All 9 ISC2 exams rebuilt · No program changes

Practice Question Quality

• 89,036 practice questions received new wrong options. Many wrong options were absurd, self-defeating or written in absolutes, or carried pasted-on fragments, so the answer could be spotted from wording alone. Each replacement is a real practice or concept that is wrong for one specific reason, and each comes with its own explanation.

• Correct answers are spread evenly across the four positions in every course.

• 3,695 wrong options lost a stock ending that told the candidate the option was wrong ("and would leave the core security objective unmet"). 102 options lost an unrelated clause pasted after the final period, and options whose text had been cut off were completed.

• 89 questions whose scenario had been lost (the stem read only "must address the primary security requirement") have a new scenario written to fit the credited answer. 24 questions where one option repeated another, and 3 with garbled or duplicated options, were repaired.

• 744 question stems that ended with no punctuation now end in a question mark, or in a colon for fill-in-the-blank stems. 158 stems lost a stock opening line ("An RMF practitioner needs to answer the following question."), and 8 lost a pasted line about a merger.

• Templated and duplicate questions were rewritten. Every study page with questions now has exactly three, in easy, moderate and challenging order: three pages that carried four to six questions were trimmed, and one page's third question was relabeled challenging.

Answer-Key Verification

Answer keys that did not match their explanations were corrected across all nine courses. A blind check, in which a reviewer answered questions without seeing the key, disputed 11 answers; each was researched and corrected, including EAR mass-market encryption (License Exception ENC), NIST SP 800-161r1 appendix references and Golden Ticket detection signals. A second blind check of 3,000 questions with new wrong options agreed with the key in 98% of cases. The 20 questions it disputed were corrected: one answer key changed (tokenization is now the credited PCI DSS v4.0.1 answer for a legacy system that cannot encrypt card data), and the rest had a second defensible option, a broken stem or a missing option repaired. A further blind check of 200 of the lengthened CSSLP questions found no answer-key problems.

Current Standards and the ISC2 Name

• References to superseded standards now name the current editions: NIST SP 800-61 Rev 3 (incident response organized around the CSF 2.0 Functions), FIPS 140-3, CVSS v4.0, NIST SP 800-63-4, PCI DSS v4.0.1, NIST SP 800-171 Rev 3, NIST CSF 2.0, NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 and NIST SP 800-37 Rev 2. Text about the CMMC Level 2 and DFARS assessment basis still cites SP 800-171 Rev 2, which remains current for that purpose.

• The certifying body is written ISC2 throughout.

Study Content and Page Structure

• Shorthand study notes (arrows, fragments and bullet stubs) were rewritten as complete explanations, and repeated template sentences were replaced with page-specific content.

• 162 study pages that were missing standard sections now have them: 117 worked examples, 84 introductory paragraphs, 39 ISC2 role-relevance callouts, 39 exam tips and 5 deep dives. Five pages had their sections put in the standard order.

Figures

• 4,952 figures received a real caption (many had none, or only a page number such as "Figure 1. 4.1.2.b.c."), and screen readers now announce that caption.

• 1,305 diagrams whose labels ran outside the frame, past their box or over each other were re-laid out with every label kept.

• 4,891 figures that used color names the app does not define (so text or boxes could render solid black) now use the standard palette. 281 had a malformed color fixed, about 300 had labels that disappeared into their background recolored and 400 had connector lines that could fill in black corrected.

• 171 ISSEP figures that stored their drawing in the wrong field now render from the standard drawing field. 3,472 figures had dash separators in their labels replaced.

In the News Callouts

• 4,206 callouts now close with a takeaway written for their own page in place of a generic line ("The incident demonstrated that ...").

• 431 callouts whose story did not fit the page carry a better-matched story with new discussion questions, and 731 that fit nowhere better were removed. Each incident still appears on pages where it fits.

Glossary

• 1,322 new entries for acronyms the courses use often but never defined, bringing the shared glossary to 5,310 entries.

• Existing entries were cleaned: OCR word splits and mislabeled acronyms fixed, truncated entries repaired and outdated citations updated.

Readability and House Style

• Punctuation left by earlier automated edits was repaired: colons standing in for dashes (including 3,729 sentences where a pair of colons wrapped an aside), lists joined by repeated "and" and missing sentence spaces.

• 3,386 discussion questions lost em dashes, Oxford commas and British spellings. Examples now use given names only.

Duplicate Content in Five Exams (Resolved)

The duplicate content reported in release 26274_01 has been remediated. Repeated template sentences were replaced with page-specific content, and the duplicate-content check added in that release now reports no findings in any of the nine exams.

Changes by Course

• CC: 5,028 of 5,098 pages updated, 658 questions rewritten, 406 answer keys corrected, 9,397 wrong options replaced, 63 questions updated for current standards.

• SSCP: 7,565 of 7,696 pages updated, 1,551 questions rewritten, 422 answer keys corrected, 9,361 wrong options replaced, 1,143 questions updated for current standards.

• CCSP: 7,246 of 7,429 pages updated, 548 questions rewritten, 406 answer keys corrected, 11,576 wrong options replaced, 116 questions updated for current standards.

• CISSP: 9,007 of 9,904 pages updated, 8,328 questions rewritten, 289 answer keys corrected, 14,053 wrong options replaced, 75 questions updated for current standards.

• CSSLP: 10,471 of 10,591 pages updated, 606 questions rewritten, 1,358 answer keys corrected, 11,417 wrong options replaced, 194 questions updated for current standards.

• CGRC: 6,740 of 6,890 pages updated, 1,017 questions rewritten, 609 answer keys corrected, 9,577 wrong options replaced, 94 questions updated for current standards.

• ISSAP: 5,139 of 5,185 pages updated, 1,325 questions rewritten, 429 answer keys corrected, 7,582 wrong options replaced, 127 questions updated for current standards.

• ISSMP: 6,282 of 6,328 pages updated, 579 questions rewritten, 449 answer keys corrected, 7,502 wrong options replaced, 399 questions updated for current standards.

• ISSEP: 6,821 of 6,870 pages updated, 417 questions rewritten, 329 answer keys corrected, 8,571 wrong options replaced, 85 questions updated for current standards.

Upgrade Actions

No action is needed beyond installing the updated course downloads.

Release 26274_01 — October 1, 2026

Course DBs · Course content update · All 9 (ISC)² exams rebuilt · No program changes

The largest content release since initial delivery: every (ISC)² course's topic structure was realigned to Examulator's canonical hierarchy, thousands of new study pages were written for topics that previously had none, every page title was brought to a consistent style, and every question's credited answer was verified against its own explanation.

Examulator Topic Alignment

ExamAdvantage's topic tree now mirrors Examulator's first-tier grouping under every (ISC)² exam objective, with Examulator's own group letters and titles.

• 5,164 Examulator groups created as topic sub-parents across all nine exams, with every existing page re-filed beneath the correct one.

• Misfiled content found and corrected during alignment: a 12-objective rotation in CCSP's IT Service Management domain (every objective had been holding its neighbor's content), a CISSP cross-objective content shift affecting Libraries, Tool sets, and IDE coverage, and 1,106 individual topics relocated to their correct objective.

• 22 topics identified as outside any exam's scope (unrelated reference material) and removed.

New Study Content

• 3,530 new study pages written for Examulator topics that previously had no ExamAdvantage page, each with full explanatory content, a worked example, a figure, and three practice questions.

• 3,549 topic-group introduction pages written, orienting learners to the set of pages beneath each group before they dive into individual topics.

Title and Readability Cleanup

• Over 23,000 topic titles shortened to a consistent, scannable style; official (ISC)² exam outline wording is unchanged throughout.

• Long "topic plus explanation" titles were split so the explanation became the page's opening content instead of running on in the title.

Answer-Key Quality Verification

• Every question added in this release, plus a statistically-targeted sample of existing questions, was independently re-verified: does the credited answer actually match its own explanation? Verification ran in two passes, the second focused on cases the first pass left uncertain. Across both, 1,020 questions across all nine exams had their credited answer and/or explanation corrected.

Known Issue — Duplicate Content in Five Exams (Remediation Planned)

A user filed a detailed report noting that a large proportion of ISSAP topics appeared to be the same paragraphs copy-pasted with only the topic name changed. The report was accurate. Investigation confirmed the defect and extended it to four additional exams:

Exam & Leaves affected

ISSEP: 2,947

CGRC: 2,908

ISSAP: 1,286

ISSMP: 1,206

CSSLP: 464

The affected topics share nearly identical prose, deep-dive explanations, worked examples, and in many cases even question stems — differing only in the substitution of the topic name. The issue is concentrated in specific sections; ISSAP Domains 1, 2, and 4 are most heavily affected while Domain 3 is clean, consistent with the defect originating in an earlier generation pass that affected some but not all sessions.

A leaf-by-leaf remediation manifest covering all 8,811 affected topics was executed, with each entry specifying exactly which fields need to be rewritten rather than blanket-replacing the whole page. The four remaining exams (CC, SSCP, CCSP, CISSP) were not affected by this report

The audit tooling has also been updated with a permanent duplicate-content check so this class of defect is caught automatically on all future content builds.

Upgrade Actions

None required. Existing databases, glossary, and saved progress are unaffected by this update; installing the new course database replaces topic content and the question bank only.

Release 26272_01 — September 29, 2026

Feature release · Program · Blazor Web, MAUI, and Legacy

One feature addition: release notes are now shown before a course update installs, so a learner can see what they're actually getting instead of updating blind.

Release Notes in the Update Dialog

The confirmation dialog that appears when a course update is available now shows the real release notes for that update, pulled live from the changelog, before the Update button can be used.

• A "What's changed since your version" panel appears between the dialog's description and its progress bar — a scrollable text box showing every changelog entry newer than the version already installed, not just the latest one. A learner who skipped several updates sees everything they missed in one read, concatenated in the same newest-first order the changelog itself uses.

• The Update button starts disabled and only enables once the panel has been scrolled to its bottom — or immediately, if the notes are short enough that there's nothing to scroll. This was chosen over requiring a click on an external link specifically so the notes are seen in place, without leaving the app, while still requiring genuine engagement rather than being satisfied by a panel that's merely present on screen.

• Scoped deliberately to just what's new: the changelog is always newest-first, so the excerpt runs from the top of the page down to the entry matching the installed version. Showing the full historical changelog and requiring a scroll through all of it would have undermined the point — a wall of unrelated past releases is exactly the kind of thing that trains people to stop reading release notes.

• Fails soft in every direction. If the installed version can't be located on the live page for any reason (an old-enough version may have scrolled off, or the page format changed), the panel falls back to showing just the single newest entry rather than guessing at an unbounded range. If the fetch fails outright (network hiccup, site unreachable), the Update button is never gated at all and the dialog falls back to a plain link to the full changelog — a marketing-site fetch failure must never be able to block a real update.

• Fresh installs are unaffected — there's nothing to compare a first install against, so no notes panel appears there; only course updates trigger this.

• Implemented once per target with matching logic: CourseCatalog.GetLatestReleaseNotesAsync() (Blazor/MAUI) and fetchLatestReleaseNotes() (Legacy) use the identical extraction regex and the identical fallback rules, so the behavior is the same regardless of which target a learner is running.

Upgrade Actions

None required. Existing databases, glossary, and saved progress are unaffected. This only changes the confirmation step shown before a course update installs.

Release 26258_01 — September 15, 2026

Feature release · Program · Blazor Web, MAUI, and Legacy

Three feature additions: download integrity verification for course installs, a new continuing-education-credit report, and a full color-theme system. All three ship across every target except where noted.

SHA-256 Download Verification (Blazor / MAUI)

Course downloads from the versions manifest are now verified against a published SHA-256 hash before installation, catching corruption in transit before a damaged database is ever extracted.

• The versions manifest page can now carry an optional third field per course row: the SHA-256 hash of the published zip, in addition to the filename and Drive link already there. Parsing is unchanged in structure — the existing filename and Drive-link patterns are matched independently and paired by position on the page, and the hash is matched and paired the same way. A course row with no hash yet parses exactly as before; nothing about the existing two-field format changed.

• Confirmed backward compatible with every previously shipped release by testing the old two-field parsing logic against a page containing hashes: it produces identical results whether or not a hash is present, since it was never looking for one.

• CourseInstaller computes the SHA-256 of the downloaded file (streamed, not loaded fully into memory) and compares it to the manifest's value when present. A mismatch aborts the install before extraction and surfaces a clear, user-visible error — "The downloaded file failed an integrity check (SHA-256 mismatch) — it may have been corrupted in transit. Please try installing again" — through the same install-dialog error path every other installer failure already uses, with the confirm button relabeling to Retry.

• Courses without a published hash install exactly as before — this is additive verification, not a new requirement.

CPE Report — Continuing Education Credit (Blazor / MAUI / Legacy)

A new report lets learners generate a certificate of study time recorded by the application, for claiming continuing professional education credit.

• Reachable via a new CPE nav button (Blazor/MAUI header) or CPE report footer link (Legacy) — not tied to whichever exam is currently loaded, so running the report doesn't disturb an active study session.

• Flow: pick an installed exam, enter the name to print on the report, generate. The certificate reads: "This report hereby certifies [Name] has completed [X] hours and [Y] minutes of professional development time preparing for the [ExamCode] — [ExamTitle] certification examination using the Exam Advantage Training Software," followed by a per-domain summary table (exam code, domain, hours, minutes) and a total. Printable via the browser print dialog on Web/Legacy, or the Android share sheet on MAUI, matching the existing platform-aware print/share pattern used elsewhere.

• Study time is tracked per topic via two new timestamp fields (StudyStartedAt / StudyEndedAt, most recent visit) and a cumulative StudySeconds field, added to the per-topic answer record. A "visit" begins when a topic's reading view loads and ends when the learner leaves it for good — it survives bouncing between the reading view and its quiz for the same topic, so answering questions doesn't truncate the reading time already counted.

• Every topic's contribution to the CPE total is capped at five minutes, regardless of how many separate visits it took or how long any single visit ran. This is a flat, deliberately simple rule rather than a statistical outlier filter: it holds up the same whether a learner has studied 10 topics or 400, doesn't require persisting uncapped raw durations that would need explaining later, and behaves predictably if a browser tab is left open on a topic overnight.

• Cross-exam reporting reads saved progress and topic data directly for whichever exam is selected (via ProgressStore/ExamDataService on Blazor; via the existing /api/progress/:examCode, /api/:examCode/topics, and /api/:examCode/settings endpoints on Legacy) without touching the actively loaded study session.

• Hours/minutes are always floored, never rounded up — a report certifying professional education hours should not overstate what was actually recorded.

Color Themes

The accessibility panel's Light/Dark toggle is replaced with a dropdown offering fourteen themes: the original Light and Dark, plus twelve new options — Midnight, Slate, Warm Dark, Nord Arctic, Solarized Dark, Solarized Yellow, Amethyst, Catppuccin Mocha, Green Terminal, Sepia, Paper, and High Contrast.

• Nord, Solarized (both variants), and Catppuccin Mocha use those systems' own published color palettes, sourced from their respective official documentation rather than approximated.

• The other eight were supplied by the user from a different application's own theme system and mapped onto this app's color variables. Chrome elements that use the primary text color as a background (the header bar, footer, and results-page summary card) needed per-theme overrides for every dark-toned theme in the full set of twelve — those rules assume dark themes still have dark text, which isn't true once a theme flips to light-on-dark, and would otherwise render as a light-colored header bar in a dark theme.

• Contrast was checked programmatically (WCAG relative luminance, not eyeballed) for every new theme's primary text, secondary text, and accent color against its background. A handful of values from the supplied palette were adjusted afterward — five themes' most muted text tier, Amethyst's and Paper's accent color, and High Contrast's Tip color (which had been identical to its accent) — using a hue-and-saturation-preserving lightness adjustment so each corrected color still reads as the same color family, just legible. All twelve themes now clear WCAG AA (4.5:1) for primary and secondary text; High Contrast clears AAA (7:1) with room to spare.

• Internally, the theme mechanism changed from a single boolean dark-mode CSS class to a data-theme attribute carrying one of the fourteen names, so all themes — including the original two — now go through one consistent code path.

• Known characteristic, not a defect: white text on a solid accent/news/tip/isc2-colored badge background (used for a few small content callout tags) runs low-contrast on most dark-toned themes, including the application's own original Dark theme predating this release. This was found during verification and is called out here rather than silently left undocumented; addressing it would mean changing how those badges are colored generally, which is out of scope for this release.

Upgrade Actions

None required. Existing databases, glossary, and saved progress are unaffected. Topics studied before this release show no CPE time for that period — study-time tracking begins from this release forward.

Release 26243_01 — August 31, 2026

Bug-fix release · Program only · No course content changed

Post-release fixes for five defects discovered in 26239_01 during initial user testing. Two prevented Blazor Web and MAUI from building; three prevented the Legacy target from running. All fixes are code-only; existing databases, glossary, and saved progress are unaffected.

Blazor and MAUI — ExamAdvantage.Shared Failed to Compile

Sprint C's ReviewAttempt class in ProgressModels.cs was missing its closing brace, causing the file to end one brace short. The compiler reported CS1513 (right-brace expected) at end-of-file, and ExamAdvantage.Shared.dll failed to build. Both dependent projects (Web and MAUI) then reported downstream CS0006 (metadata file not found) because the reference assembly was never produced.

Fix: added the missing brace between ReviewAttempt's SelfRating property and the start of the following ProgressState class.

Blazor — Heatmap Cell Nullable-Reference Warning

The Sprint D weakness-heatmap rendering used Dictionary GetValueOrDefault on a HeatmapCell value and directly dereferenced the returned cell's Total property. Because HeatmapCell is a record (reference type), GetValueOrDefault can return null for absent keys, and nullable-reference-types analysis flagged CS8602 (dereference of a possibly null reference) on the subsequent property access.

Fix: added a null-coalescing fallback to a zero-count cell. Semantically identical to the existing empty branch, which already special-cased Total equals zero — the change satisfies the analyzer without altering behaviour.

Legacy — Blank Page from JavaScript Syntax Error

The global error-overlay handler in the Legacy JavaScript contained two lines with unescaped single quotes inside HTML onclick attribute values. The outer JavaScript string was single-quoted, and the inner unescaped quotes closed the outer string prematurely. This produced a syntax error at parse time, which prevented the entire script block from executing — the browser rendered a completely blank page.

Fix: backslash-escaped every embedded single quote in the two affected lines. The full script (977K characters) now passes Node's syntax checker.

Legacy — Private Helper Called from Outside Its Scope

An HTML-escape helper _esc was defined inside an Immediately-Invoked Function Expression (IIFE) that owned the error-overlay code. Sprint C and Sprint D additions later called _esc from 21 sites in the main script scope, where the private helper was not visible. On startup the first such call (rendering the version footer) threw ReferenceError, which the generic error handler caught and misreported to the user as "Could not connect to server."

Fix: replaced all 21 out-of-scope _esc calls with the public escHtml function (semantically identical HTML escaping). The private _esc inside the IIFE was left in place — its five callers all live inside the same IIFE.

A concurrent session had previously patched a single call site (the version footer) by pointing it at esc — this got the app past the immediate startup crash but left the other 20 sites as latent bugs. This release fixes all 21.

Legacy — Results Screen Crash from Variable Name Mismatch

The Sprint D calibration-trend and weakness-heatmap wiring in Legacy's renderResults function referenced a local variable named "assessed", which does not exist in the Legacy scope. The name was copy-pasted from the Blazor implementation, where the equivalent local holds the same value under a different name. When a learner opened the Results screen, JavaScript threw ReferenceError at line 3331 and the Results view failed to render.

Fix: replaced both references with the correct Legacy-scope variable name (leafsDone). The function signatures use a neutral parameter name (assessedNums) so the function definitions did not change.

Root-Cause Analysis

Three of the five bugs share the same shape: Legacy-only regressions from Sprint C and Sprint D work where patterns were lifted from the Blazor codebase without verifying they'd resolve in the Legacy scope. A follow-up scan of the Blazor codebase for equivalent risk classes (captive dependency-injection scopes, missing @using directives, unchecked GetValueOrDefault returns on reference-type values, fire-and-forget async calls, blocking .Result / .Wait patterns) found no additional bugs of the same shape.

Process change adopted: future cross-target work will run the Legacy script through Node's syntax checker and open the running app in a browser before claiming a sprint or feature is complete for that target.

MAUI — Android Launcher Icon Restored

Users were reporting the app showed a generic Android launcher icon on their home screens instead of the ExamAdvantage brand mark. Investigation found the icon source file (Resources/AppIcon/logo.png) still contained the full brand image including the "EXAM ADVANTAGE" banner text — the same defect the 26232_02 release notes said was fixed but which had either never been applied to the source asset or had been reverted afterwards. When Android scales an icon with fine text to launcher densities (48–96 px), the text degrades to unreadable pixel smearing and some launchers substitute their default icon rather than display the mangled result.

Fix: rebuilt the adaptive-icon foreground from the current source by cropping to just the emblem (cap + shield + lock + key + tassel) and centring it at ~68% of the 432×432 canvas so it fits within Android's inner safe-zone circle. Transparent margins around the emblem allow the launcher to composite it against the brand background colour (#0e6f63) declared by the MauiIcon item.

Note that existing installed users will only see the corrected icon after their device updates to this release from Google Play, and some launchers cache icons — users may need to reboot the device (or clear their launcher's data) if the icon does not refresh after the app update.

Upgrade Actions

None. Existing databases, glossary, and saved progress state are unaffected. Rebuilding course DBs is not required.

Release 26239_01 — August 27, 2026

Course DBs · Course content update · CISM + CRISC initial delivery · All 9 (ISC)² exams rebuilt · No program changes

CISM and CRISC — Initial Course Delivery

The first two ISACA course databases are now available for download:

• CISM — Certified Information Security Manager — 3,537 study leaves, 10,611 questions across 4 domains (17% / 20% / 33% / 30%).

• CRISC — Certified in Risk and Information Systems Control — 1,896 study leaves, 5,688 questions across 4 domains (26% / 20% / 32% / 22%).

Both databases include the full-text search index, ISACA-specific glossary definitions via certBodyDefs, and all editorial standards described below. A deep audit was run against both corpora before release; the items below document what was found and corrected.

CISM Content Fixes

A deep audit surfaced residual editorial issues not caught by the pre-delivery audit pass:

• Banned vocabulary (prose): Leaf 3B1.a.l — "seamless-sounding compliance certifications" corrected to "superficially compliant-sounding certifications."

• British spelling (prose): Leaf 1B1.a.a — "catalogue" corrected to "catalog" in the P1 paragraph and example block. Six additional leaves (2A.c.v, 2B3.a.q, 3B3.b.g, 3B3.b.i) contained the past-tense form "catalogued" (missed by the earlier regex which only tested the bare word); corrected to "cataloged."

• 34 em-dashes in figure SVG content confirmed SVG-exempt per editorial standards; zero prose violations.

CRISC Content Fixes

• Banned vocabulary (question stem): Leaf 1A3.b.b — "genuinely risk-aware" corrected to "truly risk-aware."

• British spelling (prose): "catalogue" and inflected forms corrected to "catalog / catalogs / cataloged / cataloging" in 10 prose blocks across 8 leaves. Root cause: the earlier audit regex did not match inflected forms — extended to cover them.

Glossary Integrity Pass

All nine (ISC)² course databases rebuilt following a multi-round glossary cleanup:

• Removed 96 ALL-CAPS acronym-first entries (e.g., VPN (VIRTUAL PRIVATE NETWORK), LAN (LOCAL AREA NETWORK)), replaced with 70 canonical sentence-case forms.

• Resolved a VPN duplicate — one canonical entry now covers the term.

• Net glossary size: 3,079 → 3,058 authoritative entries (52 CIS Controls task stubs with no definition text are excluded from the compiled database; 3,006 entries are inserted per DB).

• Confirmed certBodyDefs overrides for Audit, Governance, Incident, and Risk resolve to the (ISC)²-specific definitions in all nine databases.

ISACA Glossary Expansion

The shared glossary was expanded and restructured to serve both (ISC)² and ISACA exam databases from a single source.

• Format migration: glossary_master.json migrated from a flat dictionary to a list-of-objects format with a metadata block (schema version, content version, entry count, SHA-256 checksum, timestamp, author).

• ISACA-specific terms: 454 new terms sourced from five ISACA reference works, vetted for OCR quality, minimum word count, and exact-match deduplication.

• Cert-body overrides (certBodyDefs): four terms — Risk, Incident, Governance, Audit — where (ISC)² and ISACA definitions are substantively different now carry per-body definitions.

• Corrupted entry repairs, glued-chain splits (24), misfiled content removal (13), duplicate consolidation (20 groups), and missing-term restoration (61) — full detail in the original entry.

Final glossary: 3,058 entries, zero exact-term duplicates, 8 cert-body overrides, 21 legitimate acronym shares. Validated by both validate_gloss_overrides.py and validate_gloss_metadata.py check at exit 0.

Full-Text Search Index

The course database schema now includes a content_search FTS5 virtual table populated from every topic's title and block content. Powers Jump Palette keyword search and future in-course search features.

⚠ Course database file sizes approximately doubled in this release due to the FTS5 index.

Glossary Metadata Schema

glossary_master.json now carries a metadata block with a SHA-256 content checksum, entry count, content version, and timestamp. migrate.py verifies the checksum on load and reports a warning on mismatch (non-fatal). New validate_gloss_metadata.py tool provides check and bump subcommands.

Bug Fix — migrate.py Glossary Filter

A defect in migrate.py v3 caused all glossary entries to be silently excluded when the glossary uses the new dict format and entries carry no per-exam filter field. Patched: entries with no exams field are now treated as universal and included in all exam databases.

Glossary Remediation — Additional Content Fixes

A concurrent session's audit and remediation pass targeted specific data-quality patterns beyond the general ALL-CAPS consolidation described above, folded into the same 3,079 → 3,058 net reduction: term/definition merges (7 entries), UPS spelling correction, ISO three-way disambiguation, BCP retained as two distinct entries, corrupted CIS Controls entries reconstructed (52), cross-reference normalization (16), acronym field extractions (7), bare-acronym entries populated (48).

Bug Fix — validate_gloss_overrides.py Dict-Format Compatibility

Companion bug to the migrate.py glossary filter fix. The script crashed with AttributeError once the glossary was wrapped in the dict format. Patched to handle both the bare-list and dict-wrapped formats.

Release 26238_01 — August 26, 2026

Feature release · Program · Requires DB rebuild for full-text search

Application-side feature work across three targets (Blazor Web, MAUI Android, Legacy Node). Three feature sprints delivered together, plus the FTS5 application integration to consume the DB-side index shipped in 26239_01.

Sprint C — Retention System

Review queue. Every completed topic resurfaces on a schedule based on how the learner performed. Intervals: 100 percent with high confidence = 14 days, 100 percent otherwise = 7 days, 67 percent accuracy = 7 days, 33 percent = 3 days, 0 percent = 1 day.

Review mode. Clicking a due topic opens it with a review banner and a confidence-only slider instead of the normal quiz. Re-quizzing was deliberately not offered: memorization contaminates repeat scores after one or two passes.

Shaky topics detection. Flags topics where self-rating is out of step with observed performance, only when the pattern is completely consistent across all three questions on the topic.

Launch-time reminder banner. Chosen deliberately in place of Android push notifications, which would have required requesting permissions and undermined the no-permissions, no-ads, no-accounts, no-telemetry story in the Play Store.

Sprint D — Report Screen Overhaul

Report screen segmentation into five sub-sections: Summary, Performance, Insights, Objectives, Next steps.

Weakness heatmap. A domain-by-difficulty grid, each cell coloured on an HSL green-to-red ramp based on accuracy.

Per-domain calibration. Every domain gets its own rated-vs-scored row with a verdict.

Calibration trend over time. Weekly-bucketed dual-line chart. Requires at least two weeks of dated activity before it renders.

One-click remediation. Focused remediation card with a drop-down criterion and a button that jumps the study cursor to the first matching topic.

Sprint E — Exam Date and Pace Tracker

Per-exam target date. Collapsible section on the Start screen lets a learner pick a target date for each exam independently.

Pace card. Shows days remaining, objectives left, required pace, and actual pace over the last seven days. Behind-pace threshold at under 80 percent of required.

Combined launch banner covering both reviews and exam date.

Full-Text Content Search (Application Side)

The Jump palette gains a Search inside topic content too checkbox, querying the DB-side FTS5 index shipped in 26239_01. Falls back gracefully to title-only search on older course databases lacking the index.

Report Screen Segmentation — Legacy Parity

Legacy renderResults now emits the same five section wrappers as Blazor.

Not Shipping in This Release

• Per-learner-baseline shaky detection — v1 uses naive per-question thresholds.

• True side-quest remediation cursor — v1 sets the main cursor to the first remediation topic.

• Legacy exam-date backup portability — Legacy stores the exam date in localStorage rather than the preferences table.

Upgrade Actions

• Rebuild all 20 course DBs with the updated migrate.py to populate the FTS5 index.

Release 26237_03 — August 25, 2026

Feature release · Program only · No course content changed

Sprint B — Notes, Notes Report, Examulator Nudge

Per-topic notes UI, a Notes report screen sorted by most recently updated, and an Examulator URL nudge on the Results screen once a learner has completed a substantial portion of the course.

Release 26237_02 — August 25, 2026

Feature release · Program · Introduces cross-device progress transfer

Sprint A — Timestamps and Backup/Restore

Answer timestamps (AnsweredAt, ContentViewedAt). ProgressBackup service with a Manage progress screen (create/restore backup, overwrite or merge modes). Cross-device username remap on restore.

Dependency Notes

• adm-zip ^0.5.16 added to legacy/package.json. Run npm install in the legacy/ folder after upgrading.

Release 26237_01 — August 25, 2026

Program only · No course content changed

ISACA Support & Cert-Body Filter

Groundwork for ISACA course support — all eleven ISACA certification tracks now in the bundled catalog. A cert-body pill toggle ((ISC)² / ISACA) filters the exam selector. Default is (ISC)² for first-time users; last-selected tab remembered via preference store.

Release 26232_03 — August 20, 2026

Bug fixes · Program only · No course content changed

Progress Counts Against Exam Objectives, Not Raw Page Count

Delivery 26232_01 expanded the study sequence to include overview pages, which had knock-on effects on several counters that assumed sequence length equalled testable objectives. Fixed across Start, Progress, Results, and screen-reader summaries.

Release 26232_02 — August 20, 2026

Enhancements · Program only · No course content changed

MAUI App Icon

The Android app icon was rendering as an unreadable blur due to the full brand logo (including text) being used as the adaptive-icon source. Replaced with just the emblem, centred to fit Android's safe-zone circle.

Version + Build Date on Splash Screens

The splash screen now displays the running version and build date in a small monospace footer.

Release 26232_01 — August 20, 2026

Feature · Program only · No course content changed

Study Sequence Now Includes Overview Content

Removed a filter that excluded domain/chapter/topic overview pages from the study sequence.

Back Navigation

Added a Previous button on Topic and Quiz screens.

Text-to-Speech Fixes

Several TTS reliability fixes across Splash, non-content screens, and navigation transitions.

UI Fixes

Cancel button in course-download dialog; scroll-to-top on Next.

Branding

Replaced the placeholder brand image with the actual EA logo across every surface.

Version Format

MAUI ApplicationDisplayVersion and ApplicationVersion (Android versionCode) format corrections.

Release 26228_01 — August 16, 2026

Bug fixes · Program only · No course content changed

Accessibility Audit Remediation

Fixed muted body-text color contrast (was failing WCAG 2.1 AA in both light and dark mode). Added ARIA roles to the progress rail and search inputs. Added focus trap to all modal overlays.

Auto-Updater Infinite Loop

Legacy — updater.js was reading the build-time placeholder instead of the served version, causing every launch to trigger a download-restart cycle. Fixed by reading from appsettings.json.

Start-Over Modal — Dropdown Does Not Activate Choice Button

Legacy — missing change listener on the domain/subdomain select elements.

Release 26227_01 — August 14, 2026

Feature · Course DBs · Full-corpus quality remediation and content versioning

Question Quality

Replaced 228 defective distractor options in CISSP. Completed 16 truncated option texts. Adjudicated 797 disputed questions. Removed 199 em-dashes from whyWrong fields.

Glossary

Removed 4 orphaned fragment entries. Completed or rewrote 30 truncated definitions. Added 5 missing standard entries.

Application — Content Versioning

Each study topic now carries a content version stamp; an Updated — review badge appears when content changes.

Application — Version Check

Course database version is compared against the installed application version on load; a warning banner appears on mismatch.

Release 26226_06 — August 14, 2026

Enhancements · Program only · No course content changed

Course Compatibility Enforcement

Replaced the previous version check with a per-exam compatibility floor.

Print and Share Report

A Print / Save PDF button on Legacy/Razor; a Share report button on MAUI (Android's WebView has no native print dialog).

Application Subtitle

Updated from "Exam Preparation Engine" to "Cybersecurity Certification Preparation."

Visual Studio Solution Restructure

Solution files moved to the repository root.

MAUI / Android Improvements

ApplicationDisplayVersion corrected. PublishTrimmed enabled for Release builds.

Build Script

build-desktop.sh now passes PublishTrimmed/TrimMode for self-contained platform builds.