Harden published curriculum and student flows

backend/app/Services/NabehService.php

@@ -137,7 +137,7 @@ class NabehService
 
         // 1. Attempt with selected type (image card)
         $result = $this->attemptSend($phoneRaw, $selectedType, $otp, $appName, $bearerToken);
-        if ($result['success']) {
+        if ($result['success'] || !empty($result['delivery_unknown'])) {
             return $result;
         }
 
@@ -192,18 +192,18 @@ class NabehService
         if ($curlError) {
             error_log("❌ [Nabeh OTP cURL Error (type={$type}, duration={$duration}s)] " . $curlError);
 
-            // Resilient Fallback: If gateway response timed out after dispatching (duration >= 18s),
-            // Nabeh has already received and queued the WhatsApp image/text message.
-            // The OTP is already stored in Redis on Saqel.
+            // A timeout does not prove whether Nabeh accepted or delivered the message.
+            // Do not report success or send a second OTP via the text fallback: that could
+            // create a duplicate while the original gateway request is still completing.
             if ($duration >= 18.0 && str_contains(strtolower($curlError), 'timed out')) {
-                error_log("⚠️ [Nabeh OTP Tolerant Dispatch] WhatsApp ({$type}) message likely queued/dispatched despite gateway latency ({$duration}s). Proceeding.");
+                error_log("⚠️ [Nabeh OTP Delivery Unknown] WhatsApp ({$type}) request timed out after {$duration}s; delivery is unconfirmed.");
                 return [
-                    'success'   => true,
-                    'type_used' => $type,
-                    'duration'  => "{$duration}s",
-                    'http_code' => 200,
-                    'message'   => 'تم إرسال رمز التحقق بنجاح عبر بطاقة الواتساب المصورة',
-                    'note'      => 'Dispatched under gateway latency'
+                    'success'          => false,
+                    'delivery_unknown' => true,
+                    'type_used'        => $type,
+                    'duration'         => "{$duration}s",
+                    'http_code'        => $httpCode,
+                    'error'            => 'انتهت مهلة بوابة واتساب؛ لم يصل تأكيد التسليم. تحقّق من الرسائل قبل طلب رمز جديد.'
                 ];
             }