ISO T&L v1.5.0: 51 digital resources reviewed, 20 October 2026
These are implementation references, not claims that 50 competing systems were installed or tested.

1. https://laravel.com/docs/13.x/validation
Decision: Validate mode and dates on the server.

2. https://laravel.com/docs/13.x/authorization
Decision: Keep role and module access checks on every operation.

3. https://laravel.com/docs/13.x/filesystem
Decision: Retain private evidence storage.

4. https://laravel.com/docs/13.x/requests
Decision: Validate file inputs before import.

5. https://laravel.com/docs/13.x/responses
Decision: Stream CSV downloads.

6. https://laravel.com/docs/13.x/session
Decision: Bind previews to the current session.

7. https://laravel.com/docs/13.x/database
Decision: Use transactions and row locks.

8. https://laravel.com/docs/13.x/migrations
Decision: Prefer additive schema changes.

9. https://laravel.com/docs/13.x/eloquent
Decision: Use model casts for dates and arrays.

10. https://laravel.com/docs/13.x/blade
Decision: Escape values rendered in forms.

11. https://getbootstrap.com/docs/5.3/forms/validation/
Decision: Use server feedback and native required inputs.

12. https://getbootstrap.com/docs/5.3/forms/form-control/
Decision: Keep file inputs and labels consistent.

13. https://getbootstrap.com/docs/5.3/forms/select/
Decision: Use a required semester selector.

14. https://getbootstrap.com/docs/5.3/layout/grid/
Decision: Maintain responsive columns.

15. https://getbootstrap.com/docs/5.3/content/tables/
Decision: Wrap wide ISO tables for small screens.

16. https://getbootstrap.com/docs/5.3/components/card/
Decision: Keep related import actions inside cards.

17. https://getbootstrap.com/docs/5.3/components/navbar/
Decision: Keep navigation keyboard accessible.

18. https://getbootstrap.com/docs/5.3/components/navs-tabs/
Decision: Retain institutional tab grouping.

19. https://getbootstrap.com/docs/5.3/utilities/display/
Decision: Hide preview images until content is available.

20. https://getbootstrap.com/docs/5.3/getting-started/accessibility/
Decision: Use labels and visible required field notes.

21. https://www.adminlte.io/themes/v4/docs/introduction.html
Decision: Retain the existing free AdminLTE theme.

22. https://www.adminlte.io/themes/v4/docs/layout.html
Decision: Keep the sidebar structure compatible with AdminLTE.

23. https://www.adminlte.io/themes/v4/docs/customization.html
Decision: Apply restrained theme overrides.

24. https://www.php.net/manual/en/function.fgetcsv.php
Decision: Parse CSV using explicit delimiter, enclosure and escape.

25. https://www.php.net/manual/en/function.fputcsv.php
Decision: Write eleven teaching-plan columns consistently.

26. https://www.php.net/manual/en/function.imagecreatefromstring.php
Decision: Decode uploaded image content.

27. https://www.php.net/manual/en/function.imagepng.php
Decision: Normalize saved signatures to PNG.

28. https://www.php.net/manual/en/function.password-verify.php
Decision: Retain existing password hashes.

29. https://www.php.net/manual/en/pdo.transactions.php
Decision: Use transactions around record updates.

30. https://getcomposer.org/doc/01-basic-usage.md
Decision: Use the lock file to reproduce dependencies.

31. https://getcomposer.org/doc/03-cli.md
Decision: Use production install without development packages.

32. https://getcomposer.org/doc/06-config.md
Decision: Retain the PHP 8.3 platform constraint.

33. https://laravel.com/docs/13.x/http-client
Decision: Keep AI requests bounded by connection and response timeouts.

34. https://docs.ollama.com/api/chat
Decision: Use the existing free Ollama chat integration.

35. https://docs.ollama.com/api/introduction
Decision: AI remains optional and independently hosted.

36. https://docs.phpmyadmin.net/en/latest/import_export.html
Decision: Import only the incremental patch on an existing installation.

37. https://docs.cpanel.net/cpanel/software/multiphp-manager-for-cpanel/
Decision: Select PHP for the correct domain.

38. https://docs.cpanel.net/cpanel/software/multiphp-ini-editor-for-cpanel/
Decision: Set upload and input limits per domain.

39. https://docs.cpanel.net/cpanel/files/file-manager/
Decision: Upload application contents using File Manager.

40. https://docs.cpanel.net/cpanel/databases/phpmyadmin/
Decision: Select the existing database before SQL import.

41. https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html
Decision: Validate image dimensions and content.

42. https://owasp.org/www-community/attacks/CSV_Injection
Decision: Formula-like CSV text needs safe export handling.

43. https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html
Decision: Reject users outside the assigned module.

44. https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
Decision: Preserve CSRF protection on mutations.

45. https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html
Decision: Record changes in the audit trail.

46. https://developer.mozilla.org/en-US/docs/Web/API/FileReader/readAsDataURL
Decision: Preview a selected image before saving.

47. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/file
Decision: Keep image upload restrictions visible.

48. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/date
Decision: Use YYYY-MM-DD submissions and DD/MM/YYYY display.

49. https://phpspreadsheet.readthedocs.io/en/latest/topics/reading-files/
Decision: Bound document extraction size.

50. https://github.com/barryvdh/laravel-dompdf
Decision: Retain the existing PDF renderer.

51. https://getbootstrap.com/docs/5.3/forms/checks-radios/
Decision: use native checkboxes with explicit Yes/No form values.

Approaches compared for the 8 pm changes
Module ownership: let lecturers create modules assigned to themselves. Programme assignment remains visible, while impersonating another lecturer on create is prevented by the server.
Student linkage: snapshot enrollment identities on save. Use a selector for single-student counselling and mentoring records; seed all enrollment rows for attendance. Preserve historical rows and marks on explicit refresh instead of silently replacing records.
Attendance dates: a dedicated per-module table supports dated class sessions on any weekday. Keeping it separate from Monday week_dates avoids changing the teaching plan or signed records.
CSV import: retain preview and confirmation. Attendance import upserts dates without deleting omitted dates. TOS import replaces draft tables with version checks and never overwrites approved records.
TOS format: one 23-column schema carries named sections for components, CLOs, specification, moderation and question mappings. A single upload preserves the relationships between sections; a one-table CSV would lose them.
Prints: keep the original institutional templates, add a compact student identity band to QF 8.8.1, and use the selected student's programme for QF 8.10.2. Large contents are rejected rather than silently truncated.
Signature preview: retain the stored signature and PDF dimensions. Reduce only the profile thumbnail to 73 by 30 CSS pixels, approximately one-third of the prior 220 by 90 limits; version asset URLs to avoid stale styling.
AI: retain free self-hosted Ollama; add enrollment and actual-date readiness information to the local checker. AI drafts still require academic review.

All 51 listed official documentation pages were opened during this revision. They are digital resources, not 51 competing systems that were installed or tested.

