From be6541a65307505dd53552c4bcf8cadc32406ee4 Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 21:56:20 -0400
Subject: [PATCH 01/29] Expanded backend endpoints to accomodate mutating
 professors of a course and updated old docstring

---
 .../api/courses/[courseId]/students/route.ts  | 66 ++++++++++++-------
 1 file changed, 44 insertions(+), 22 deletions(-)

diff --git a/src/app/api/courses/[courseId]/students/route.ts b/src/app/api/courses/[courseId]/students/route.ts
index b1932e8..cf8e757 100644
--- a/src/app/api/courses/[courseId]/students/route.ts
+++ b/src/app/api/courses/[courseId]/students/route.ts
@@ -12,11 +12,11 @@ interface RouteParams {
 // ---------------------------------------------------------------------------
 
 /**
- * Returns all enrolled students and TAs for a course.
+ * Returns enrolled students, staff (TAs), and professors for a course.
  *
- * Returns: { students: [{name, utorid}], tas: [{name, utorid}] }
+ * Returns: { students, tas, professors } each [{name, utorid}]
  *
- * Only the professor enrolled in the course may call this.
+ * Only a professor enrolled in the course may call this.
  */
 export async function GET(_request: NextRequest, { params }: RouteParams) {
   try {
@@ -39,20 +39,21 @@ export async function GET(_request: NextRequest, { params }: RouteParams) {
     }
 
     const enrollments = await prisma.courseEnrollment.findMany({
-      where: { courseId, role: { in: ["STUDENT", "TA"] } },
+      where: { courseId, role: { in: ["STUDENT", "TA", "PROFESSOR"] } },
       include: { user: { select: { name: true, utorid: true } } },
       orderBy: { user: { name: "asc" } },
     });
 
-    const students = enrollments
-      .filter((e) => e.role === "STUDENT")
-      .map((e) => ({ name: e.user.name, utorid: e.user.utorid }));
-
-    const tas = enrollments
-      .filter((e) => e.role === "TA")
-      .map((e) => ({ name: e.user.name, utorid: e.user.utorid }));
+    const mapEntry = (e: (typeof enrollments)[number]) => ({
+      name: e.user.name,
+      utorid: e.user.utorid,
+    });
 
-    return NextResponse.json({ students, tas });
+    return NextResponse.json({
+      students: enrollments.filter((e) => e.role === "STUDENT").map(mapEntry),
+      tas: enrollments.filter((e) => e.role === "TA").map(mapEntry),
+      professors: enrollments.filter((e) => e.role === "PROFESSOR").map(mapEntry),
+    });
   } catch (error) {
     console.error("[Courses API] Failed to fetch roster:", error);
     return NextResponse.json({ error: "An error occurred." }, { status: 500 });
@@ -119,8 +120,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
       return NextResponse.json({ error: "utorids must be a non-empty array." }, { status: 400 });
     }
 
-    // Only STUDENT and TA are valid enrollment roles for this endpoint
-    const enrollmentRole: "STUDENT" | "TA" = roleParam === "TA" ? "TA" : "STUDENT";
+    const enrollmentRole: "STUDENT" | "TA" | "PROFESSOR" =
+      roleParam === "TA" ? "TA" : roleParam === "PROFESSOR" ? "PROFESSOR" : "STUDENT";
 
     const added: string[] = [];
     const alreadyEnrolled: string[] = [];
@@ -186,7 +187,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
  *
  * - Students in the new list but not enrolled → added as STUDENT
  * - Students currently enrolled as STUDENT but not in the new list → removed
- * - TAs and the PROFESSOR are never touched.
+ * - TAs and professors are never touched.
  *
  * Returns: { added: string[], removed: string[], unchanged: number }
  *
@@ -310,11 +311,17 @@ export async function PUT(request: NextRequest, { params }: RouteParams) {
 // ---------------------------------------------------------------------------
 
 /**
- * Removes a student or TA enrollment from a course by UTORid.
+ * Demotes a staff (TA) or co-professor enrollment to STUDENT by UTORid.
+ * Students are demoted the same way (no-op if already STUDENT — still "removed"
+ * from the instructional list by role). Actually students get role STUDENT update.
  *
  * Request body: { utorid: string }
  *
- * Only the professor enrolled in the course may call this.
+ * Guards for PROFESSOR targets:
+ *   - Cannot remove yourself
+ *   - Cannot remove the last professor on the course
+ *
+ * Only a professor enrolled in the course may call this.
  */
 export async function DELETE(request: NextRequest, { params }: RouteParams) {
   try {
@@ -348,8 +355,9 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
       return NextResponse.json({ error: "utorid is required." }, { status: 400 });
     }
 
+    const normalizedUtorid = utorid.trim().toLowerCase();
     const target = await prisma.user.findUnique({
-      where: { utorid: utorid.trim().toLowerCase() },
+      where: { utorid: normalizedUtorid },
       select: { id: true },
     });
     if (!target) {
@@ -362,18 +370,32 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
     if (!targetEnrollment) {
       return NextResponse.json({ error: "User is not enrolled in this course." }, { status: 404 });
     }
+
     if (targetEnrollment.role === "PROFESSOR") {
-      return NextResponse.json({ error: "Cannot remove the course professor." }, { status: 403 });
+      if (target.id === user.userId) {
+        return NextResponse.json(
+          { error: "You cannot remove yourself as a professor." },
+          { status: 403 }
+        );
+      }
+      const professorCount = await prisma.courseEnrollment.count({
+        where: { courseId, role: "PROFESSOR" },
+      });
+      if (professorCount <= 1) {
+        return NextResponse.json(
+          { error: "Cannot remove the last professor from the course." },
+          { status: 403 }
+        );
+      }
     }
 
-    // Demote TA back to STUDENT rather than removing them from the course entirely.
-    // This preserves their enrollment so they stay in any active session.
+    // Demote to STUDENT rather than deleting the row — keeps them in live sessions.
     await prisma.courseEnrollment.update({
       where: { userId_courseId: { userId: target.id, courseId } },
       data: { role: "STUDENT" },
     });
 
-    return NextResponse.json({ removed: utorid.trim().toLowerCase() });
+    return NextResponse.json({ removed: normalizedUtorid });
   } catch (error) {
     console.error("[Courses API] Failed to remove student:", error);
     return NextResponse.json({ error: "An error occurred." }, { status: 500 });

From 33d5aa20e49fefcd2b07ffeda7331ab25f05b754 Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 22:06:01 -0400
Subject: [PATCH 02/29] Updated ManageClassModal internal states to support
 modifying professors. And renamed TAs tab to Staff

---
 src/app/classes/ManageClassModal.tsx | 50 ++++++++++++++++++++++++++--
 1 file changed, 48 insertions(+), 2 deletions(-)

diff --git a/src/app/classes/ManageClassModal.tsx b/src/app/classes/ManageClassModal.tsx
index a4cc2d0..702b0cb 100644
--- a/src/app/classes/ManageClassModal.tsx
+++ b/src/app/classes/ManageClassModal.tsx
@@ -32,7 +32,7 @@ interface ManageClassModalProps {
   onDeleted: (courseId: string) => void;
 }
 
-type Tab = "students" | "tas" | "rename" | "delete";
+type Tab = "students" | "staff" | "rename" | "delete";
 
 interface RosterEntry {
   name: string;
@@ -193,12 +193,14 @@ export default function ManageClassModal({
   // ---- Roster state ----
   const [rosterStudents, setRosterStudents] = useState<RosterEntry[]>([]);
   const [rosterTas, setRosterTas] = useState<RosterEntry[]>([]);
+  const [rosterProfessors, setRosterProfessors] = useState<RosterEntry[]>([]);
   const [rosterLoading, setRosterLoading] = useState(true);
   const [rosterError, setRosterError] = useState<string | null>(null);
 
   // ---- Search state ----
   const [studentSearch, setStudentSearch] = useState("");
   const [taSearch, setTaSearch] = useState("");
+  const [professorSearch, setProfessorSearch] = useState("");
 
   // ---- Remove state ----
   const [removingUtorid, setRemovingUtorid] = useState<string | null>(null);
@@ -224,6 +226,16 @@ export default function ManageClassModal({
   } | null>(null);
   const [taAddError, setTaAddError] = useState<string | null>(null);
 
+  // ---- Add professors state ----
+  const [professorUtoridsInput, setProfessorUtoridsInput] = useState("");
+  const [addingProfessors, setAddingProfessors] = useState(false);
+  const [professorAddResult, setProfessorAddResult] = useState<{
+    added: string[];
+    alreadyEnrolled: string[];
+    invalid: string[];
+  } | null>(null);
+  const [professorAddError, setProfessorAddError] = useState<string | null>(null);
+
   // ---- CSV sync state ----
   const csvInputRef = useRef<HTMLInputElement>(null);
   const [csvParsing, setCsvParsing] = useState(false);
@@ -271,6 +283,7 @@ export default function ManageClassModal({
       }
       setRosterStudents(data.students ?? []);
       setRosterTas(data.tas ?? []);
+      setRosterProfessors(data.professors ?? []);
     } catch {
       setRosterError("Failed to load roster.");
     } finally {
@@ -315,6 +328,7 @@ export default function ManageClassModal({
       // Optimistically remove from local state
       setRosterStudents((prev) => prev.filter((e) => e.utorid !== utorid));
       setRosterTas((prev) => prev.filter((e) => e.utorid !== utorid));
+      setRosterProfessors((prev) => prev.filter((e) => e.utorid !== utorid));
     } catch {
       setRemoveError("Failed to remove. Please try again.");
     } finally {
@@ -386,6 +400,38 @@ export default function ManageClassModal({
     }
   }
 
+  async function handleAddProfessors() {
+    const utorids = professorUtoridsInput
+      .split(/[\n,\s]+/)
+      .map((s) => s.trim())
+      .filter(Boolean);
+    if (utorids.length === 0) return;
+
+    setAddingProfessors(true);
+    setProfessorAddError(null);
+    setProfessorAddResult(null);
+
+    try {
+      const res = await fetch(`/api/courses/${course.id}/students`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ utorids, role: "PROFESSOR" }),
+      });
+      const data = await res.json();
+      if (!res.ok) {
+        setProfessorAddError(data.error ?? "Failed to add professors.");
+        return;
+      }
+      setProfessorAddResult(data);
+      setProfessorUtoridsInput("");
+      await fetchRoster();
+    } catch {
+      setProfessorAddError("Failed to add professors. Please try again.");
+    } finally {
+      setAddingProfessors(false);
+    }
+  }
+
   async function handleCsvSelect(file: File) {
     setCsvError(null);
     setCsvPreview(null);
@@ -522,7 +568,7 @@ export default function ManageClassModal({
           {(
             [
               { id: "students", label: "Students", icon: UserPlus },
-              { id: "tas", label: "TAs", icon: GraduationCap },
+              { id: "staff", label: "Staff", icon: GraduationCap },
               { id: "rename", label: "Rename", icon: Pencil },
               { id: "delete", label: "Delete", icon: Trash2 },
             ] as { id: Tab; label: string; icon: React.ElementType }[]

From 3dbbc2185ba094f860e4a2b5952884b91bd6cafa Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 22:09:00 -0400
Subject: [PATCH 03/29] Modified ManageClassModal UI to allow the updating of
 professors

---
 src/app/classes/ManageClassModal.tsx | 177 ++++++++++++++++++---------
 1 file changed, 122 insertions(+), 55 deletions(-)

diff --git a/src/app/classes/ManageClassModal.tsx b/src/app/classes/ManageClassModal.tsx
index 702b0cb..9bd9640 100644
--- a/src/app/classes/ManageClassModal.tsx
+++ b/src/app/classes/ManageClassModal.tsx
@@ -610,7 +610,8 @@ export default function ManageClassModal({
                 <p className="text-sm font-medium text-stone-700">Sync Roster from CSV</p>
                 <p className="text-xs text-stone-500">
                   Upload your updated class list CSV. Students added to the file will be enrolled;
-                  students removed from the file will be unenrolled. TAs are not affected.
+                  students removed from the file will be unenrolled. TAs and professors are not
+                  affected.
                 </p>
 
                 {/* File picker */}
@@ -734,61 +735,127 @@ export default function ManageClassModal({
             </div>
           )}
 
-          {/* ---- TAs ---- */}
-          {activeTab === "tas" && (
-            <div className="flex flex-col gap-4">
-              <RosterTable
-                entries={rosterTas}
-                search={taSearch}
-                onSearchChange={setTaSearch}
-                emptyMessage="No TAs enrolled yet."
-                loading={rosterLoading}
-                error={rosterError}
-                removingUtorid={removingUtorid}
-                removeError={removeError}
-                onRemove={handleRemove}
-              />
-              <div className="border-t border-stone-100 pt-4 flex flex-col gap-3">
-                <p className="text-sm font-medium text-stone-700">Add TAs</p>
-                <p className="text-xs text-stone-500">
-                  Enter one or more UTORids — separated by commas, spaces, or new lines. TAs can see
-                  all questions and answer in restricted mode.
-                </p>
-                <textarea
-                  value={taUtoridsInput}
-                  spellCheck={false}
-                  onChange={(e) => {
-                    setTaUtoridsInput(e.target.value);
-                    setTaAddResult(null);
-                    setTaAddError(null);
-                  }}
-                  placeholder={"tasmith2, janedooe, scalijad"}
-                  rows={3}
-                  className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
+          {/* ---- Staff (professors + TAs) ---- */}
+          {activeTab === "staff" && (
+            <div className="flex flex-col gap-8">
+              {/* Professors */}
+              <div className="flex flex-col gap-4">
+                <p className="text-sm font-semibold text-stone-800">Professors</p>
+                <RosterTable
+                  entries={rosterProfessors}
+                  search={professorSearch}
+                  onSearchChange={setProfessorSearch}
+                  emptyMessage="No professors enrolled yet."
+                  loading={rosterLoading}
+                  error={rosterError}
+                  removingUtorid={removingUtorid}
+                  removeError={removeError}
+                  onRemove={handleRemove}
                 />
-                {taAddError && <p className="text-sm text-red-600">{taAddError}</p>}
-                {taAddResult && (
-                  <div className="text-sm space-y-1">
-                    {taAddResult.added.length > 0 && (
-                      <p className="text-green-700">Added: {taAddResult.added.join(", ")}</p>
-                    )}
-                    {taAddResult.alreadyEnrolled.length > 0 && (
-                      <p className="text-stone-500">
-                        Already enrolled: {taAddResult.alreadyEnrolled.join(", ")}
-                      </p>
-                    )}
-                    {taAddResult.invalid.length > 0 && (
-                      <p className="text-red-600">Invalid: {taAddResult.invalid.join(", ")}</p>
-                    )}
-                  </div>
-                )}
-                <button
-                  onClick={handleAddTas}
-                  disabled={addingTas || taUtoridsInput.trim().length === 0}
-                  className="px-4 py-2 bg-green-500 hover:bg-green-600 text-white rounded-lg text-sm font-medium transition-colors disabled:opacity-50"
-                >
-                  {addingTas ? "Adding…" : "Add TAs"}
-                </button>
+                <div className="border-t border-stone-100 pt-4 flex flex-col gap-3">
+                  <p className="text-sm font-medium text-stone-700">Add Professors</p>
+                  <p className="text-xs text-stone-500">
+                    Enter one or more UTORids — separated by commas, spaces, or new lines.
+                    Professors can start sessions, control slides, and manage this course.
+                  </p>
+                  <textarea
+                    value={professorUtoridsInput}
+                    spellCheck={false}
+                    onChange={(e) => {
+                      setProfessorUtoridsInput(e.target.value);
+                      setProfessorAddResult(null);
+                      setProfessorAddError(null);
+                    }}
+                    placeholder={"smithj, doejohn"}
+                    rows={3}
+                    className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
+                  />
+                  {professorAddError && <p className="text-sm text-red-600">{professorAddError}</p>}
+                  {professorAddResult && (
+                    <div className="text-sm space-y-1">
+                      {professorAddResult.added.length > 0 && (
+                        <p className="text-green-700">
+                          Added: {professorAddResult.added.join(", ")}
+                        </p>
+                      )}
+                      {professorAddResult.alreadyEnrolled.length > 0 && (
+                        <p className="text-stone-500">
+                          Already enrolled: {professorAddResult.alreadyEnrolled.join(", ")}
+                        </p>
+                      )}
+                      {professorAddResult.invalid.length > 0 && (
+                        <p className="text-red-600">
+                          Invalid: {professorAddResult.invalid.join(", ")}
+                        </p>
+                      )}
+                    </div>
+                  )}
+                  <button
+                    onClick={handleAddProfessors}
+                    disabled={addingProfessors || professorUtoridsInput.trim().length === 0}
+                    className="px-4 py-2 bg-green-500 hover:bg-green-600 text-white rounded-lg text-sm font-medium transition-colors disabled:opacity-50"
+                  >
+                    {addingProfessors ? "Adding…" : "Add Professors"}
+                  </button>
+                </div>
+              </div>
+
+              {/* TAs */}
+              <div className="flex flex-col gap-4 border-t border-stone-200 pt-6">
+                <p className="text-sm font-semibold text-stone-800">TAs</p>
+                <RosterTable
+                  entries={rosterTas}
+                  search={taSearch}
+                  onSearchChange={setTaSearch}
+                  emptyMessage="No TAs enrolled yet."
+                  loading={rosterLoading}
+                  error={rosterError}
+                  removingUtorid={removingUtorid}
+                  removeError={removeError}
+                  onRemove={handleRemove}
+                />
+                <div className="border-t border-stone-100 pt-4 flex flex-col gap-3">
+                  <p className="text-sm font-medium text-stone-700">Add TAs</p>
+                  <p className="text-xs text-stone-500">
+                    Enter one or more UTORids — separated by commas, spaces, or new lines. TAs can
+                    see all questions and answer in restricted mode.
+                  </p>
+                  <textarea
+                    value={taUtoridsInput}
+                    spellCheck={false}
+                    onChange={(e) => {
+                      setTaUtoridsInput(e.target.value);
+                      setTaAddResult(null);
+                      setTaAddError(null);
+                    }}
+                    placeholder={"tasmith2, janedooe, scalijad"}
+                    rows={3}
+                    className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
+                  />
+                  {taAddError && <p className="text-sm text-red-600">{taAddError}</p>}
+                  {taAddResult && (
+                    <div className="text-sm space-y-1">
+                      {taAddResult.added.length > 0 && (
+                        <p className="text-green-700">Added: {taAddResult.added.join(", ")}</p>
+                      )}
+                      {taAddResult.alreadyEnrolled.length > 0 && (
+                        <p className="text-stone-500">
+                          Already enrolled: {taAddResult.alreadyEnrolled.join(", ")}
+                        </p>
+                      )}
+                      {taAddResult.invalid.length > 0 && (
+                        <p className="text-red-600">Invalid: {taAddResult.invalid.join(", ")}</p>
+                      )}
+                    </div>
+                  )}
+                  <button
+                    onClick={handleAddTas}
+                    disabled={addingTas || taUtoridsInput.trim().length === 0}
+                    className="px-4 py-2 bg-green-500 hover:bg-green-600 text-white rounded-lg text-sm font-medium transition-colors disabled:opacity-50"
+                  >
+                    {addingTas ? "Adding…" : "Add TAs"}
+                  </button>
+                </div>
               </div>
             </div>
           )}

From bc7024c566f39ae7246305471776a7cdbb8bc1c6 Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 22:14:39 -0400
Subject: [PATCH 04/29] Updated course creation endpoint to support professors

---
 src/app/api/courses/route.ts | 56 +++++++++++++++++++++++++++---------
 1 file changed, 42 insertions(+), 14 deletions(-)

diff --git a/src/app/api/courses/route.ts b/src/app/api/courses/route.ts
index 4bc7d70..eac05bb 100644
--- a/src/app/api/courses/route.ts
+++ b/src/app/api/courses/route.ts
@@ -72,14 +72,10 @@ export async function GET() {
  *
  * Request body:
  *   {
- *     code:     string                              // e.g. "CSC398H5"
- *     students: Array<{                             // from parseAndProcessCSV
- *       utorid:    string,
- *       givenName: string,
- *       surname:   string,
- *       Email?:    string,
- *       [key]:     string                           // other CSV columns
- *     }>
+ *     code:     string
+ *     students: Array<{ utorid, givenName, surname, ... }>
+ *     tas?:     string[]         // optional TA UTORids
+ *     professors?: string[]      // optional co-professor UTORids
  *   }
  *
  * Only PROFESSOR-role users may call this endpoint.
@@ -108,7 +104,7 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Request body is required." }, { status: 400 });
     }
 
-    const { code, section, students, tas } = body as Record<string, unknown>;
+    const { code, section, students, tas, professors } = body as Record<string, unknown>;
 
     if (!code || typeof code !== "string" || code.trim().length === 0) {
       return NextResponse.json({ error: "Course code is required." }, { status: 400 });
@@ -118,11 +114,17 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Students list is required." }, { status: 400 });
     }
 
-    const tasArray: string[] = Array.isArray(tas)
-      ? (tas as unknown[])
-          .map((t) => (typeof t === "string" ? t.trim().toLowerCase() : ""))
-          .filter(Boolean)
-      : [];
+    const parseUtorids = (raw: unknown): string[] =>
+      Array.isArray(raw)
+        ? (raw as unknown[])
+            .map((t) => (typeof t === "string" ? t.trim().toLowerCase() : ""))
+            .filter(Boolean)
+        : [];
+
+    const tasArray = parseUtorids(tas);
+    const professorsArray = parseUtorids(professors).filter(
+      (utorid) => utorid !== user.utorid.toLowerCase()
+    );
 
     const semester = getCurrentSemester();
     const courseCode = code.trim();
@@ -192,6 +194,32 @@ export async function POST(request: NextRequest) {
         });
       }
 
+      // Enroll co-professors (CourseEnrollment.role = "PROFESSOR"; User.role is NOT changed)
+      for (const utorid of professorsArray) {
+        const profUser = await tx.user.upsert({
+          where: { utorid },
+          update: {},
+          create: {
+            utorid,
+            name: utorid,
+            email: `${utorid}@mail.utoronto.ca`,
+            role: "STUDENT",
+          },
+        });
+
+        await tx.courseEnrollment.upsert({
+          where: {
+            userId_courseId: { userId: profUser.id, courseId: newCourse.id },
+          },
+          update: { role: "PROFESSOR" },
+          create: {
+            userId: profUser.id,
+            courseId: newCourse.id,
+            role: "PROFESSOR",
+          },
+        });
+      }
+
       // Enroll TAs (CourseEnrollment.role = "TA"; User.role is NOT changed)
       for (const utorid of tasArray) {
         const taUser = await tx.user.upsert({

From d3758d287930162902af014578e98bf379a9935e Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 22:16:25 -0400
Subject: [PATCH 05/29] Updated UI components to support adding multiple
 professors

---
 .../create-class/components/PreviewClass.tsx  | 23 +++++++++++++++++++
 src/app/create-class/page.tsx                 |  9 ++++++++
 2 files changed, 32 insertions(+)

diff --git a/src/app/create-class/components/PreviewClass.tsx b/src/app/create-class/components/PreviewClass.tsx
index 2fb029a..ff2a11d 100644
--- a/src/app/create-class/components/PreviewClass.tsx
+++ b/src/app/create-class/components/PreviewClass.tsx
@@ -6,6 +6,8 @@ interface PreviewClassProps {
   processedData: ProcessedClassData | null;
   onClear: () => void;
   onSubmit: () => void;
+  professorsInput: string;
+  onProfessorsChange: (value: string) => void;
   tasInput: string;
   onTasChange: (value: string) => void;
   courseCodeInput: string;
@@ -17,6 +19,8 @@ export default function PreviewClass({
   processedData,
   onClear,
   onSubmit,
+  professorsInput,
+  onProfessorsChange,
   tasInput,
   onTasChange,
   courseCodeInput,
@@ -103,6 +107,25 @@ export default function PreviewClass({
         </div>
       )}
 
+      {/* Co-professor UTORid input */}
+      <div className="space-y-3 mt-4">
+        <label className="text-xl font-bold text-stone-900 tracking-tight block">
+          Add Professors <span className="text-stone-400 font-normal text-base">(optional)</span>
+        </label>
+        <p className="text-sm text-stone-500">
+          Enter UTORids separated by commas, spaces, or new lines. Co-professors can start sessions,
+          control slides, and manage this course.
+        </p>
+        <textarea
+          value={professorsInput}
+          spellCheck={false}
+          onChange={(e) => onProfessorsChange(e.target.value)}
+          placeholder={"smithj, doejohn"}
+          rows={3}
+          className="w-full border-2 border-stone-100 rounded-md px-4 py-3 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm"
+        />
+      </div>
+
       {/* TA UTORid input */}
       <div className="space-y-3 mt-4">
         <label className="text-xl font-bold text-stone-900 tracking-tight block">
diff --git a/src/app/create-class/page.tsx b/src/app/create-class/page.tsx
index 1f2da41..5d07636 100644
--- a/src/app/create-class/page.tsx
+++ b/src/app/create-class/page.tsx
@@ -19,6 +19,7 @@ export default function CreateClassPage() {
   const [file, setFile] = useState<File | null>(null);
   const [processedData, setProcessedData] = useState<ProcessedClassData | null>(null);
   const [tasInput, setTasInput] = useState("");
+  const [professorsInput, setProfessorsInput] = useState("");
   const [courseCodeInput, setCourseCodeInput] = useState("");
   const [user, setUser] = useState<User | null>(null);
   const [submitting, setSubmitting] = useState(false);
@@ -56,6 +57,7 @@ export default function CreateClassPage() {
     setFile(null);
     setProcessedData(null);
     setTasInput("");
+    setProfessorsInput("");
     setCourseCodeInput("");
     setSubmitError(null);
   };
@@ -68,6 +70,10 @@ export default function CreateClassPage() {
       .split(/[\n,\s]+/)
       .map((s) => s.trim())
       .filter(Boolean);
+    const professors = professorsInput
+      .split(/[\n,\s]+/)
+      .map((s) => s.trim())
+      .filter(Boolean);
 
     try {
       const res = await fetch("/api/courses", {
@@ -77,6 +83,7 @@ export default function CreateClassPage() {
           code: courseCodeInput.trim() || processedData.courseCode,
           students: processedData.students,
           ...(tas.length > 0 ? { tas } : {}),
+          ...(professors.length > 0 ? { professors } : {}),
         }),
       });
       const data = await res.json();
@@ -149,6 +156,8 @@ export default function CreateClassPage() {
               processedData={processedData}
               onClear={clearFile}
               onSubmit={submitting ? () => {} : submitClassCreation}
+              professorsInput={professorsInput}
+              onProfessorsChange={setProfessorsInput}
               tasInput={tasInput}
               onTasChange={setTasInput}
               courseCodeInput={courseCodeInput}

From 6c8ae6718ef4ebe979a896b3f665e7598a4c8e73 Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 22:38:18 -0400
Subject: [PATCH 06/29] Expanded pnpm dev:all to allow for easier testing of
 various user interactions

---
 scripts/dev-all.ts | 127 +++++++++++++++++++++++++++++++++++----------
 1 file changed, 101 insertions(+), 26 deletions(-)

diff --git a/scripts/dev-all.ts b/scripts/dev-all.ts
index b825bba..5f5e50f 100644
--- a/scripts/dev-all.ts
+++ b/scripts/dev-all.ts
@@ -1,25 +1,30 @@
 /**
  * Multi-instance dev launcher — `pnpm dev:all`
  *
- * Spins up three dev servers, each permanently logged in as a different
- * persona, so multi-user flows (a student asking, a TA resolving, a professor
- * answering) can be tested in three tabs of one browser window.
+ * Spins up N professor, M TA, and K student dev servers so multi-user flows
+ * can be tested in multiple tabs of one browser window.
  *
+ *   pnpm dev:all              → 1 prof, 1 TA, 1 student (default)
+ *   pnpm dev:all -- 2 1 3     → 2 profs, 1 TA, 3 students
+ *
+ * Default layout (1 of each):
  *   PROF     -> http://localhost:3000   askeasy-dev-prof
  *   TA       -> http://localhost:3001   askeasy-dev-ta
  *   STUDENT  -> http://localhost:3002   askeasy-dev-student
  *
+ * Extra instances of a role get sequential ports, distinct cookie names /
+ * dist dirs, and numbered default identities (devprof2, …). Override with
+ * DEV_<ROLE>_2_UTORID / _NAME / _ROLE / _EMAIL (and _3, …).
+ *
  * Identity is process-global (src/app/api/auth/session/route.ts reads
  * DEV_UTORID / DEV_NAME / DEV_ROLE from the environment), so one identity
- * requires one process. This script resolves each persona from the DEV_<P>_*
- * vars in .env, falls back to a documented default with a warning, and spawns
- * a child with those values injected.
+ * requires one process.
  *
  * Each child also gets its own SESSION_COOKIE_NAME. Browser cookies are keyed
- * by host and ignore the port, so without distinct names all three instances
- * would share one cookie and every tab would become whoever logged in last.
+ * by host and ignore the port, so without distinct names all instances would
+ * share one cookie and every tab would become whoever logged in last.
  *
- * All three share one Postgres and one Redis — that is the point. The
+ * All instances share one Postgres and one Redis — that is the point. The
  * Socket.IO Redis adapter is what carries events between the processes.
  */
 import { spawn, type ChildProcess } from "node:child_process";
@@ -41,25 +46,29 @@ dotenv.config({ path: ".env.local", override: true });
 const ROLES = ["STUDENT", "TA", "PROFESSOR"] as const;
 type Role = (typeof ROLES)[number];
 
-interface PersonaSpec {
+interface PersonaBase {
   key: string;
-  port: number;
   cookieName: string;
   distDir: string;
   color: string;
   defaults: { utorid: string; name: string; role: Role };
 }
 
+interface PersonaSpec extends PersonaBase {
+  /** Env prefix: PROF, PROF_2, TA, STUDENT_3, … */
+  envKey: string;
+  port: number;
+}
+
 const RESET = "\x1b[0m";
 const BOLD = "\x1b[1m";
 const DIM = "\x1b[2m";
 const YELLOW = "\x1b[33m";
 const RED = "\x1b[31m";
 
-const PERSONAS: PersonaSpec[] = [
+const PERSONA_BASES: PersonaBase[] = [
   {
     key: "PROF",
-    port: 3000,
     cookieName: "askeasy-dev-prof",
     distDir: ".next-prof",
     color: "\x1b[35m", // magenta
@@ -67,7 +76,6 @@ const PERSONAS: PersonaSpec[] = [
   },
   {
     key: "TA",
-    port: 3001,
     cookieName: "askeasy-dev-ta",
     distDir: ".next-ta",
     color: "\x1b[36m", // cyan
@@ -75,7 +83,6 @@ const PERSONAS: PersonaSpec[] = [
   },
   {
     key: "STUDENT",
-    port: 3002,
     cookieName: "askeasy-dev-student",
     distDir: ".next-student",
     color: "\x1b[32m", // green
@@ -94,9 +101,67 @@ interface ResolvedPersona {
 const warnings: string[] = [];
 const errors: string[] = [];
 
+/** Parse `pnpm dev:all -- <profs> <tas> <students>`. Default 1 1 1. */
+function parseCounts(argv: string[]): { profs: number; tas: number; students: number } {
+  const args = argv.slice(2);
+  if (args.length === 0) return { profs: 1, tas: 1, students: 1 };
+
+  if (args.length !== 3) {
+    errors.push("Usage: pnpm dev:all -- <profs> <tas> <students>   (e.g. pnpm dev:all -- 2 1 3)");
+    return { profs: 0, tas: 0, students: 0 };
+  }
+
+  const nums = args.map((a) => Number(a));
+  if (nums.some((n) => !Number.isInteger(n) || n < 0)) {
+    errors.push("Counts must be non-negative integers: <profs> <tas> <students>");
+    return { profs: 0, tas: 0, students: 0 };
+  }
+
+  const [profs, tas, students] = nums;
+  if (profs + tas + students === 0) {
+    errors.push("At least one instance is required.");
+    return { profs: 0, tas: 0, students: 0 };
+  }
+
+  return { profs, tas, students };
+}
+
+function expandPersonas(profs: number, tas: number, students: number): PersonaSpec[] {
+  const counts = [profs, tas, students];
+  let port = 3000;
+  const out: PersonaSpec[] = [];
+
+  for (let bi = 0; bi < PERSONA_BASES.length; bi++) {
+    const base = PERSONA_BASES[bi];
+    const count = counts[bi];
+    for (let i = 1; i <= count; i++) {
+      const alone = count === 1;
+      // First of a multi-set still uses DEV_PROF_* so existing .env keeps working;
+      // extras use DEV_PROF_2_*, DEV_PROF_3_*, …
+      const envKey = alone || i === 1 ? base.key : `${base.key}_${i}`;
+      const label = alone ? base.key : `${base.key}${i}`;
+      out.push({
+        key: label,
+        envKey,
+        port: port++,
+        cookieName: alone ? base.cookieName : `${base.cookieName}-${i}`,
+        distDir: alone ? base.distDir : `${base.distDir}-${i}`,
+        color: base.color,
+        defaults: {
+          utorid: alone ? base.defaults.utorid : `${base.defaults.utorid}${i}`,
+          name: alone ? base.defaults.name : `${base.defaults.name} ${i}`,
+          role: base.defaults.role,
+        },
+      });
+    }
+  }
+
+  return out;
+}
+
 function resolvePersona(spec: PersonaSpec): ResolvedPersona {
   const read = (suffix: string, fallback: string): string => {
-    const varName = `DEV_${spec.key}_${suffix}`;
+    const varName = `DEV_${spec.envKey}_${suffix}`;
     const value = process.env[varName]?.trim();
     if (value) return value;
     warnings.push(`${varName} is not set — using default "${fallback}".`);
@@ -110,12 +175,12 @@ function resolvePersona(spec: PersonaSpec): ResolvedPersona {
   if (!ROLES.includes(role)) {
     // route.ts casts DEV_ROLE straight to the Prisma enum, so a typo would
     // otherwise surface as an opaque database error on first login.
-    errors.push(`DEV_${spec.key}_ROLE is "${role}" — must be one of ${ROLES.join(", ")}.`);
+    errors.push(`DEV_${spec.envKey}_ROLE is "${role}" — must be one of ${ROLES.join(", ")}.`);
   }
 
-  // Always set explicitly: a single global DEV_EMAIL shared by all three
-  // personas would collide on the User table's unique email.
-  const email = process.env[`DEV_${spec.key}_EMAIL`]?.trim() || `${utorid}@mail.utoronto.ca`;
+  // Always set explicitly: a single global DEV_EMAIL shared by all personas
+  // would collide on the User table's unique email.
+  const email = process.env[`DEV_${spec.envKey}_EMAIL`]?.trim() || `${utorid}@mail.utoronto.ca`;
 
   return { spec, utorid, name, email, role };
 }
@@ -211,8 +276,9 @@ function printSummary(resolved: ResolvedPersona[]): void {
   }
 
   console.log("");
+  const labelWidth = Math.max(8, ...resolved.map((p) => p.spec.key.length));
   for (const { spec, utorid, name, role } of resolved) {
-    const label = `${spec.color}${BOLD}${spec.key.padEnd(8)}${RESET}`;
+    const label = `${spec.color}${BOLD}${spec.key.padEnd(labelWidth)}${RESET}`;
     const url = `http://localhost:${spec.port}`;
     console.log(`  ${label} ${url}   ${DIM}${name} (${utorid}, ${role})${RESET}`);
   }
@@ -315,19 +381,28 @@ function launch(persona: ResolvedPersona, tsx: string): Promise<void> {
 }
 
 async function main(): Promise<void> {
-  const resolved = PERSONAS.map(resolvePersona);
+  const { profs, tas, students } = parseCounts(process.argv);
+  if (errors.length > 0) {
+    console.error("");
+    for (const error of errors) console.error(`${RED}✖${RESET}  ${error}`);
+    console.error("");
+    process.exit(1);
+  }
+
+  const specs = expandPersonas(profs, tas, students);
+  const resolved = specs.map(resolvePersona);
 
   // Two personas sharing a utorid are the same database user, which defeats
-  // the entire purpose of running three instances.
+  // the purpose of running multiple instances.
   const seen = new Map<string, string>();
   for (const { spec, utorid } of resolved) {
     const previous = seen.get(utorid.toLowerCase());
     if (previous) {
       errors.push(
-        `DEV_${spec.key}_UTORID and DEV_${previous}_UTORID are both "${utorid}" — each persona needs a distinct UTORid.`
+        `DEV_${spec.envKey}_UTORID and DEV_${previous}_UTORID are both "${utorid}" — each persona needs a distinct UTORid.`
       );
     }
-    seen.set(utorid.toLowerCase(), spec.key);
+    seen.set(utorid.toLowerCase(), spec.envKey);
   }
 
   const portChecks = await Promise.all(
@@ -354,7 +429,7 @@ async function main(): Promise<void> {
   //
   // Next rewrites next-env.d.ts (and can rewrite tsconfig.json) during
   // app.prepare(), and each instance wants its own distDir in the import line.
-  // Launching all three at once interleaves those writes and corrupts the file,
+  // Launching all at once interleaves those writes and corrupts the file,
   // which then breaks `pnpm typecheck` and the pre-commit hook.
   for (const persona of resolved) {
     await launch(persona, tsx);

From af888022ac7a54ffb5c9992256afcb764151f69b Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 22:43:46 -0400
Subject: [PATCH 07/29] Fixed incorrect documentation in function and updated
 README with no capabilities

---
 README.md          | 23 ++++++++++++++++-------
 scripts/dev-all.ts | 11 ++++++-----
 2 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index e9f3b03..f3ec0e3 100644
--- a/README.md
+++ b/README.md
@@ -198,22 +198,28 @@ Open [http://localhost:3000](http://localhost:3000). The app auto-reloads on cha
 
 A single dev server can only ever be one user — identity comes from `DEV_UTORID` /
 `DEV_NAME` / `DEV_ROLE`, which are process-global. To test a student asking a question
-while a professor answers it, run three instances at once:
+while a professor answers it, run multiple instances at once:
 
 ```bash
-pnpm dev:all
+pnpm dev:all          # 1 professor, 1 TA, 1 student (default)
+pnpm dev:all 2 1 3    # 2 professors, 1 TA, 3 students
 ```
 
+Pass three non-negative integers: `<profs> <tas> <students>`. Omit them to get one of
+each. Ports are assigned sequentially from `3000`.
+
+Default layout (1 of each):
+
 | Persona   | URL                   | Cookie                |
 | --------- | --------------------- | --------------------- |
 | `PROF`    | http://localhost:3000 | `askeasy-dev-prof`    |
 | `TA`      | http://localhost:3001 | `askeasy-dev-ta`      |
 | `STUDENT` | http://localhost:3002 | `askeasy-dev-student` |
 
-Open all three in tabs of the same window. Each instance gets its own session cookie
+Open the instances in tabs of the same window. Each instance gets its own session cookie
 name, so they don't clobber each other — browser cookies are keyed by host and ignore
 the port, meaning a single shared name would make every tab become whoever logged in
-last. All three share one Postgres and one Redis, which is what lets events broadcast
+last. All instances share one Postgres and one Redis, which is what lets events broadcast
 between them.
 
 Configure each persona in `.env` (all optional — anything missing falls back to a
@@ -233,6 +239,10 @@ DEV_STUDENT_NAME=Dev Student
 DEV_STUDENT_ROLE=STUDENT
 ```
 
+Extra instances of a role (e.g. a second professor) use numbered defaults (`devprof2`)
+and can be overridden with `DEV_PROF_2_UTORID` / `_NAME` / `_ROLE` / `_EMAIL` (same
+pattern for `TA` and `STUDENT`).
+
 Notes:
 
 - `DEV_ROLE` overrides the whitelist lookup, so the PROF persona does **not** need to be
@@ -241,12 +251,11 @@ Notes:
 - Leave `SOCKET_IO_USE_REDIS` unset. With the adapter disabled, events don't cross
   instances: a question asked in one tab won't appear in the others until you refresh.
 - Each instance runs its own Next compiler against its own build dir (`.next-prof`,
-  `.next-ta`, `.next-student`), so expect roughly 3× the memory and CPU of `pnpm dev`.
+  `.next-ta`, `.next-student`, …), so expect roughly N× the memory and CPU of `pnpm dev`.
 - Instances start one at a time rather than all at once. Next rewrites `next-env.d.ts`
   during startup and each instance wants its own build dir in it, so concurrent
   startups interleave those writes and corrupt the file — which then breaks
-  `pnpm typecheck` and the pre-commit hook. Startup therefore takes about three
-  times as long as `pnpm dev`.
+  `pnpm typecheck` and the pre-commit hook. Startup therefore scales with instance count.
 - `pnpm dev` is unaffected and still uses the `ask_easy_session` cookie, so switching
   between the two modes won't log you out of either.
 
diff --git a/scripts/dev-all.ts b/scripts/dev-all.ts
index 5f5e50f..3782436 100644
--- a/scripts/dev-all.ts
+++ b/scripts/dev-all.ts
@@ -4,8 +4,8 @@
  * Spins up N professor, M TA, and K student dev servers so multi-user flows
  * can be tested in multiple tabs of one browser window.
  *
- *   pnpm dev:all              → 1 prof, 1 TA, 1 student (default)
- *   pnpm dev:all -- 2 1 3     → 2 profs, 1 TA, 3 students
+ *   pnpm dev:all          → 1 prof, 1 TA, 1 student (default)
+ *   pnpm dev:all 2 1 3    → 2 profs, 1 TA, 3 students
  *
  * Default layout (1 of each):
  *   PROF     -> http://localhost:3000   askeasy-dev-prof
@@ -101,13 +101,14 @@ interface ResolvedPersona {
 const warnings: string[] = [];
 const errors: string[] = [];
 
-/** Parse `pnpm dev:all -- <profs> <tas> <students>`. Default 1 1 1. */
+/** Parse `pnpm dev:all <profs> <tas> <students>`. Default 1 1 1. */
 function parseCounts(argv: string[]): { profs: number; tas: number; students: number } {
-  const args = argv.slice(2);
+  // Ignore a literal "--" if someone still uses the npm-style separator.
+  const args = argv.slice(2).filter((a) => a !== "--");
   if (args.length === 0) return { profs: 1, tas: 1, students: 1 };
 
   if (args.length !== 3) {
-    errors.push("Usage: pnpm dev:all -- <profs> <tas> <students>   (e.g. pnpm dev:all -- 2 1 3)");
+    errors.push("Usage: pnpm dev:all <profs> <tas> <students>   (e.g. pnpm dev:all 2 1 3)");
     return { profs: 0, tas: 0, students: 0 };
   }
 

From 082c644c3032ffff80a09f21ce739d70341c7077 Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 23:09:30 -0400
Subject: [PATCH 08/29] Fixed lecture desync bug where two rooms can be ran
 simultaneously for the same course

---
 src/app/api/sessions/route.ts |  8 +++-----
 src/lib/sessionService.ts     | 34 ++++++++++++++++++++++++----------
 2 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/src/app/api/sessions/route.ts b/src/app/api/sessions/route.ts
index 3bd8558..de77bcf 100644
--- a/src/app/api/sessions/route.ts
+++ b/src/app/api/sessions/route.ts
@@ -8,7 +8,8 @@ import { getCurrentUser } from "@/lib/auth";
 /**
  * GET /api/sessions
  *
- * Returns active sessions with course info.
+ * Returns active sessions for courses the user is enrolled in.
+ * (Enrollment — not course.createdById — so co-professors see the same live session.)
  */
 export async function GET() {
   try {
@@ -20,10 +21,7 @@ export async function GET() {
     const sessions = await prisma.session.findMany({
       where: {
         status: "ACTIVE",
-        course:
-          user.role === "PROFESSOR"
-            ? { createdById: user.userId }
-            : { enrollments: { some: { userId: user.userId } } },
+        course: { enrollments: { some: { userId: user.userId } } },
       },
       select: {
         id: true,
diff --git a/src/lib/sessionService.ts b/src/lib/sessionService.ts
index ca0ece5..0ea2691 100644
--- a/src/lib/sessionService.ts
+++ b/src/lib/sessionService.ts
@@ -275,9 +275,11 @@ export async function validateProfessorRole(
 /**
  * Creates a new session for a course.
  * Validates professor role and generates unique join code.
+ * If the course already has an ACTIVE session, returns that one instead of
+ * creating a duplicate (co-professors must share one live room).
  *
  * @param data - Session creation data (courseId, title, userId)
- * @returns Result with created session or error
+ * @returns Result with created (or existing) session or error
  */
 export async function createSession(data: SessionCreateInput): Promise<SessionCreateResult> {
   const { courseId, title, userId } = data;
@@ -292,6 +294,26 @@ export async function createSession(data: SessionCreateInput): Promise<SessionCr
     };
   }
 
+  const sessionSelect = {
+    id: true,
+    title: true,
+    joinCode: true,
+    status: true,
+    courseId: true,
+    createdById: true,
+    createdAt: true,
+  } as const;
+
+  // One live session per course — join the existing one if a co-prof already started it.
+  const existing = await prisma.session.findFirst({
+    where: { courseId, status: "ACTIVE" },
+    select: sessionSelect,
+    orderBy: { startTime: "desc" },
+  });
+  if (existing) {
+    return { success: true, session: existing };
+  }
+
   // Generate unique join code (cryptographically secure)
   const joinCode = await generateUniqueSessionCode();
 
@@ -306,15 +328,7 @@ export async function createSession(data: SessionCreateInput): Promise<SessionCr
       isSubmissionsEnabled: true,
       startTime: new Date(),
     },
-    select: {
-      id: true,
-      title: true,
-      joinCode: true,
-      status: true,
-      courseId: true,
-      createdById: true,
-      createdAt: true,
-    },
+    select: sessionSelect,
   });
 
   return {

From 01464886fc397c697ee707cb3ce78173ecb128fe Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 23:25:06 -0400
Subject: [PATCH 09/29] Renders both student view and professor view as needed

Setup before would only show students view even to people who are professor in a course
---
 src/app/page.tsx | 37 ++++++++++++++++++++++++++-----------
 1 file changed, 26 insertions(+), 11 deletions(-)

diff --git a/src/app/page.tsx b/src/app/page.tsx
index 8d7e19a..602e746 100644
--- a/src/app/page.tsx
+++ b/src/app/page.tsx
@@ -16,6 +16,9 @@ export default function LandingPage() {
   const [user, setUser] = useState<User | null>(null);
   const [isAdmin, setIsAdmin] = useState(false);
   const [showOnboarding, setShowOnboarding] = useState(false);
+  const [hasProfessorCourses, setHasProfessorCourses] = useState(false);
+  const [hasStudentCourses, setHasStudentCourses] = useState(false);
+  const [coursesReady, setCoursesReady] = useState(false);
 
   useEffect(() => {
     fetch("/api/auth/me")
@@ -39,6 +42,18 @@ export default function LandingPage() {
         }
       })
       .catch(() => null);
+
+    // Home UI is driven by CourseEnrollment, not only global User.role — co-professors
+    // are usually global STUDENTs who still need the professor lecture panel.
+    fetch("/api/courses")
+      .then((res) => (res.ok ? res.json() : null))
+      .then((data) => {
+        const courses = (data?.courses ?? []) as { role: string }[];
+        setHasProfessorCourses(courses.some((c) => c.role === "PROFESSOR"));
+        setHasStudentCourses(courses.some((c) => c.role === "STUDENT" || c.role === "TA"));
+      })
+      .catch(() => null)
+      .finally(() => setCoursesReady(true));
   }, []);
 
   const handleOnboardingComplete = () => {
@@ -48,7 +63,7 @@ export default function LandingPage() {
     setShowOnboarding(false);
   };
 
-  if (!user) {
+  if (!user || !coursesReady) {
     return (
       <div className="min-h-screen flex items-center justify-center">
         <span className="text-stone-400 text-sm">Loading…</span>
@@ -56,14 +71,13 @@ export default function LandingPage() {
     );
   }
 
+  const isGlobalProfessor = user.role === "PROFESSOR";
+  const showProfViewer = isGlobalProfessor || hasProfessorCourses;
+  const showStudentViewer = !isGlobalProfessor || hasStudentCourses;
+
   const getStepsForRole = () => {
-    switch (user.role) {
-      case "PROFESSOR":
-        return PROF_ONBOARDING_STEPS;
-      case "STUDENT":
-      default:
-        return STUDENT_ONBOARDING_STEPS;
-    }
+    if (showProfViewer) return PROF_ONBOARDING_STEPS;
+    return STUDENT_ONBOARDING_STEPS;
   };
 
   return (
@@ -94,8 +108,9 @@ export default function LandingPage() {
 
       <div className="overflow-y-auto flex-1 flex flex-col">
         <div className="flex-1 p-5 pt-16 pb-10 flex flex-col items-center">
-          <div className="w-full max-w-7xl mx-auto flex-1 flex flex-col">
-            {user.role === "PROFESSOR" ? <ProfCourseViewer /> : <CourseViewer />}
+          <div className="w-full max-w-7xl mx-auto flex-1 flex flex-col gap-10">
+            {showProfViewer && <ProfCourseViewer canCreateClass={isGlobalProfessor} />}
+            {showStudentViewer && <CourseViewer />}
           </div>
         </div>
         {footer()}
@@ -105,7 +120,7 @@ export default function LandingPage() {
         <OnboardingCarousel
           steps={getStepsForRole()}
           onComplete={handleOnboardingComplete}
-          requireAgreement={user.role !== "PROFESSOR"}
+          requireAgreement={!showProfViewer}
         />
       )}
     </div>

From beb81c8f6358e1c5a25680775029106cc6f6312c Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Tue, 8 Sep 2026 23:25:51 -0400
Subject: [PATCH 10/29] Made 'Create Lecture' button dependent on if user can
 create a course actually

---
 src/app/classes/ProfCourseViewer.tsx | 64 +++++++++++++++++-----------
 1 file changed, 38 insertions(+), 26 deletions(-)

diff --git a/src/app/classes/ProfCourseViewer.tsx b/src/app/classes/ProfCourseViewer.tsx
index 41aa579..341273b 100644
--- a/src/app/classes/ProfCourseViewer.tsx
+++ b/src/app/classes/ProfCourseViewer.tsx
@@ -33,7 +33,12 @@ interface ActiveSession {
   courseId: string;
 }
 
-export default function ProfCourseButtons() {
+interface ProfCourseButtonsProps {
+  /** Global professors may create courses; course-only co-professors may not. */
+  canCreateClass?: boolean;
+}
+
+export default function ProfCourseButtons({ canCreateClass = true }: ProfCourseButtonsProps) {
   const router = useRouter();
   const [courses, setCourses] = useState<Course[]>([]);
   const [activeSessions, setActiveSessions] = useState<Map<string, ActiveSession>>(new Map());
@@ -164,13 +169,15 @@ export default function ProfCourseButtons() {
               </p>
             </div>
 
-            <Link
-              href="/create-class"
-              className="hidden sm:flex items-center gap-2 px-6 py-3 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm hover:shadow-md hover:-translate-y-0.5"
-            >
-              <PlusCircle className="w-5 h-5" />
-              Create Lecture
-            </Link>
+            {canCreateClass && (
+              <Link
+                href="/create-class"
+                className="hidden sm:flex items-center gap-2 px-6 py-3 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm hover:shadow-md hover:-translate-y-0.5"
+              >
+                <PlusCircle className="w-5 h-5" />
+                Create Lecture
+              </Link>
+            )}
           </div>
 
           <div className="grid md:grid-cols-2 lg:grid-cols-3 gap-6 max-w-6xl mx-auto relative">
@@ -297,15 +304,17 @@ export default function ProfCourseButtons() {
             })}
           </div>
 
-          <div className="max-w-6xl mx-auto w-full mt-8 sm:hidden">
-            <Link
-              href="/create-class"
-              className="flex items-center justify-center gap-2 w-full py-4 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm"
-            >
-              <PlusCircle className="w-5 h-5" />
-              Create New Lecture
-            </Link>
-          </div>
+          {canCreateClass && (
+            <div className="max-w-6xl mx-auto w-full mt-8 sm:hidden">
+              <Link
+                href="/create-class"
+                className="flex items-center justify-center gap-2 w-full py-4 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm"
+              >
+                <PlusCircle className="w-5 h-5" />
+                Create New Lecture
+              </Link>
+            </div>
+          )}
         </div>
 
         {managingCourse && (
@@ -327,17 +336,20 @@ export default function ProfCourseButtons() {
       </div>
       <h1 className="font-bold text-3xl text-stone-900 tracking-tight mb-2">No Lectures Yet</h1>
       <p className="text-stone-500 text-lg max-w-md text-center mb-8">
-        You haven&apos;t created any lectures. Create your first lecture to get started with
-        AskEasy.
+        {canCreateClass
+          ? "You haven't created any lectures. Create your first lecture to get started with AskEasy."
+          : "You aren't assigned as a professor on any lectures yet."}
       </p>
 
-      <Link
-        href="/create-class"
-        className="flex items-center gap-2 px-8 py-4 bg-green-500 hover:bg-green-600 text-white font-bold rounded-md transition-all shadow-md hover:shadow-lg hover:-translate-y-1 text-lg"
-      >
-        <PlusCircle className="w-6 h-6" />
-        Create a Lecture
-      </Link>
+      {canCreateClass && (
+        <Link
+          href="/create-class"
+          className="flex items-center gap-2 px-8 py-4 bg-green-500 hover:bg-green-600 text-white font-bold rounded-md transition-all shadow-md hover:shadow-lg hover:-translate-y-1 text-lg"
+        >
+          <PlusCircle className="w-6 h-6" />
+          Create a Lecture
+        </Link>
+      )}
     </div>
   );
 }

From bb7ceb0d617b5a9418f7d4c9b9ed363f217cd4de Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Wed, 9 Sep 2026 10:00:18 -0400
Subject: [PATCH 11/29] Extracted 'My Lectures' header and subtitle out of
 course viewer components. letting a simultaneous prof and student use the app

---
 src/app/classes/ProfCourseViewer.tsx | 33 +-----------------
 src/app/components/CourseViewer.tsx  | 20 ++++-------
 src/app/page.tsx                     | 52 +++++++++++++++++++++++++---
 3 files changed, 54 insertions(+), 51 deletions(-)

diff --git a/src/app/classes/ProfCourseViewer.tsx b/src/app/classes/ProfCourseViewer.tsx
index 341273b..6fdc708 100644
--- a/src/app/classes/ProfCourseViewer.tsx
+++ b/src/app/classes/ProfCourseViewer.tsx
@@ -160,26 +160,7 @@ export default function ProfCourseButtons({ canCreateClass = true }: ProfCourseB
   if (courses.length > 0) {
     return (
       <>
-        <div className="flex-1 w-full py-8 text-left">
-          <div className="max-w-6xl mx-auto w-full mb-10 flex items-center justify-between">
-            <div>
-              <h2 className="text-4xl font-bold text-stone-900 tracking-tight mb-2">My Lectures</h2>
-              <p className="text-lg text-stone-500">
-                Manage your lectures and start live sessions.
-              </p>
-            </div>
-
-            {canCreateClass && (
-              <Link
-                href="/create-class"
-                className="hidden sm:flex items-center gap-2 px-6 py-3 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm hover:shadow-md hover:-translate-y-0.5"
-              >
-                <PlusCircle className="w-5 h-5" />
-                Create Lecture
-              </Link>
-            )}
-          </div>
-
+        <div className="flex-1 w-full text-left">
           <div className="grid md:grid-cols-2 lg:grid-cols-3 gap-6 max-w-6xl mx-auto relative">
             {error && (
               <div className="col-span-full md:col-span-2 lg:col-span-3 mb-2 bg-red-50 text-red-600 p-4 rounded-md border border-red-100 flex items-center gap-3 font-medium">
@@ -303,18 +284,6 @@ export default function ProfCourseButtons({ canCreateClass = true }: ProfCourseB
               );
             })}
           </div>
-
-          {canCreateClass && (
-            <div className="max-w-6xl mx-auto w-full mt-8 sm:hidden">
-              <Link
-                href="/create-class"
-                className="flex items-center justify-center gap-2 w-full py-4 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm"
-              >
-                <PlusCircle className="w-5 h-5" />
-                Create New Lecture
-              </Link>
-            </div>
-          )}
         </div>
 
         {managingCourse && (
diff --git a/src/app/components/CourseViewer.tsx b/src/app/components/CourseViewer.tsx
index dbd509c..317e50d 100644
--- a/src/app/components/CourseViewer.tsx
+++ b/src/app/components/CourseViewer.tsx
@@ -76,21 +76,13 @@ export default function CourseViewer() {
 
   if (courses.length > 0) {
     return (
-      <div className="flex-1 w-full py-8 text-left">
-        <div className="max-w-6xl mx-auto w-full mb-10 flex flex-col gap-4">
-          <div>
-            <h2 className="text-4xl font-bold text-stone-900 tracking-tight mb-2">My Lectures</h2>
-            <p className="text-lg text-stone-500">
-              Select a live lecture to join its session. If the lecture is not live, just wait!
-            </p>
+      <div className="flex-1 w-full text-left">
+        {joinError && (
+          <div className="max-w-6xl mx-auto mb-6 bg-red-50 text-red-600 p-4 rounded-md border border-red-100 flex items-center gap-3 font-medium">
+            <div className="w-2 h-2 rounded-full bg-red-500" />
+            {joinError}
           </div>
-          {joinError && (
-            <div className="bg-red-50 text-red-600 p-4 rounded-md border border-red-100 flex items-center gap-3 font-medium">
-              <div className="w-2 h-2 rounded-full bg-red-500" />
-              {joinError}
-            </div>
-          )}
-        </div>
+        )}
 
         <div className="grid md:grid-cols-2 lg:grid-cols-3 gap-6 max-w-6xl mx-auto">
           {courses.map((course) => {
diff --git a/src/app/page.tsx b/src/app/page.tsx
index 602e746..6078fab 100644
--- a/src/app/page.tsx
+++ b/src/app/page.tsx
@@ -9,7 +9,7 @@ import OnboardingCarousel from "./components/OnboardingCarousel";
 import { STUDENT_ONBOARDING_STEPS, PROF_ONBOARDING_STEPS } from "@/constants/onboarding";
 import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
 import { getInitials, isLikelyAvatarImageUrl } from "@/utils/types";
-import { CircleHelp, LayoutDashboard } from "lucide-react";
+import { CircleHelp, LayoutDashboard, PlusCircle } from "lucide-react";
 import Link from "next/link";
 
 export default function LandingPage() {
@@ -73,7 +73,15 @@ export default function LandingPage() {
 
   const isGlobalProfessor = user.role === "PROFESSOR";
   const showProfViewer = isGlobalProfessor || hasProfessorCourses;
-  const showStudentViewer = !isGlobalProfessor || hasStudentCourses;
+  // Don't mount the student viewer empty-state under a co-prof who only has professor courses.
+  const showStudentViewer = hasStudentCourses || !showProfViewer;
+  const showLecturesHeader = hasProfessorCourses || hasStudentCourses;
+
+  const lecturesSubtitle = showProfViewer
+    ? showStudentViewer
+      ? "Manage your lectures, start live sessions, or join when a class goes live."
+      : "Manage your lectures and start live sessions."
+    : "Select a live lecture to join its session. If the lecture is not live, just wait!";
 
   const getStepsForRole = () => {
     if (showProfViewer) return PROF_ONBOARDING_STEPS;
@@ -108,9 +116,43 @@ export default function LandingPage() {
 
       <div className="overflow-y-auto flex-1 flex flex-col">
         <div className="flex-1 p-5 pt-16 pb-10 flex flex-col items-center">
-          <div className="w-full max-w-7xl mx-auto flex-1 flex flex-col gap-10">
-            {showProfViewer && <ProfCourseViewer canCreateClass={isGlobalProfessor} />}
-            {showStudentViewer && <CourseViewer />}
+          <div className="w-full max-w-7xl mx-auto flex-1 flex flex-col">
+            {showLecturesHeader && (
+              <div className="max-w-6xl mx-auto w-full mb-10 flex items-center justify-between">
+                <div>
+                  <h2 className="text-4xl font-bold text-stone-900 tracking-tight mb-2">
+                    My Lectures
+                  </h2>
+                  <p className="text-lg text-stone-500">{lecturesSubtitle}</p>
+                </div>
+                {isGlobalProfessor && (
+                  <Link
+                    href="/create-class"
+                    className="hidden sm:flex items-center gap-2 px-6 py-3 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm hover:shadow-md hover:-translate-y-0.5"
+                  >
+                    <PlusCircle className="w-5 h-5" />
+                    Create Lecture
+                  </Link>
+                )}
+              </div>
+            )}
+
+            <div className="flex flex-col gap-10">
+              {showProfViewer && <ProfCourseViewer canCreateClass={isGlobalProfessor} />}
+              {showStudentViewer && <CourseViewer />}
+            </div>
+
+            {isGlobalProfessor && showLecturesHeader && (
+              <div className="max-w-6xl mx-auto w-full mt-8 sm:hidden">
+                <Link
+                  href="/create-class"
+                  className="flex items-center justify-center gap-2 w-full py-4 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm"
+                >
+                  <PlusCircle className="w-5 h-5" />
+                  Create New Lecture
+                </Link>
+              </div>
+            )}
           </div>
         </div>
         {footer()}

From 43fd6e54c4426c2548c0297fd876bd8d24b9e0d5 Mon Sep 17 00:00:00 2001
From: Guneev Pannu <guneevpannu@outlook.com>
Date: Wed, 9 Sep 2026 10:17:54 -0400
Subject: [PATCH 12/29] Hid my name in the app

---
 src/app/classes/ManageClassModal.tsx             | 2 +-
 src/app/create-class/components/PreviewClass.tsx | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/app/classes/ManageClassModal.tsx b/src/app/classes/ManageClassModal.tsx
index 9bd9640..46c22fe 100644
--- a/src/app/classes/ManageClassModal.tsx
+++ b/src/app/classes/ManageClassModal.tsx
@@ -766,7 +766,7 @@ export default function ManageClassModal({
                       setProfessorAddResult(null);
                       setProfessorAddError(null);
                     }}
-                    placeholder={"smithj, doejohn"}
+                    placeholder={"smithj, doejohn, pannugun"}
                     rows={3}
                     className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
                   />
diff --git a/src/app/create-class/components/PreviewClass.tsx b/src/app/create-class/components/PreviewClass.tsx
index ff2a11d..332aa63 100644
--- a/src/app/create-class/components/PreviewClass.tsx
+++ b/src/app/create-class/components/PreviewClass.tsx
@@ -120,7 +120,7 @@ export default function PreviewClass({
           value={professorsInput}
           spellCheck={false}
           onChange={(e) => onProfessorsChange(e.target.value)}
-          placeholder={"smithj, doejohn"}
+          placeholder={"smithj, doejohn, pannugun"}
           rows={3}
           className="w-full border-2 border-stone-100 rounded-md px-4 py-3 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm"
         />

From 86567487911167b1922ca6814a78a63102f51472 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 07:32:20 -0400
Subject: [PATCH 13/29] =?UTF-8?q?Step=200:=20remove=20the=20global=20profe?=
 =?UTF-8?q?ssor=20role=20=E2=80=94=20roles=20are=20per=20class?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PROFESSOR_WHITELIST is gone. Every login now writes User.role = STUDENT;
PROFESSOR and TA exist only on CourseEnrollment, granted per class by an
admin. ADMIN_WHITELIST is the only remaining global permission.

Two routes read the global role as an authorization shortcut and would have
silently granted a leftover PROFESSOR user access to every course:
  - GET /api/sessions/[sessionId] skipped the enrollment check entirely
  - POST /api/questions/[id]/answers let a global professor answer anywhere
Both now require an enrollment like everyone else.

The Socket.IO viewer count filtered on the cookie role, which is now always
STUDENT — it would have counted the professor as a viewer of their own room.
It reads the CourseEnrollment role recorded at session:join instead.

DEV_ROLE no longer does anything, so drop it from the auth route, server.ts
and dev-all.ts. The dev:all PROF/TA/STUDENT personas are now just labels for
which tab is which; assign them roles by adding them to a classlist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 FEATURES.md                                   |   8 +-
 README.md                                     |  58 ++++----
 docker-compose.yml                            |   1 -
 docs/ADMIN-GUIDE.md                           | 129 +++++++++---------
 scripts/dev-all.ts                            |  49 ++++---
 src/app/api/auth/session/route.ts             |  26 ++--
 .../questions/[questionId]/answers/route.ts   |   2 +-
 src/app/api/sessions/[sessionId]/route.ts     |  19 ++-
 src/lib/whitelist.ts                          |  48 -------
 src/server.ts                                 |   1 -
 src/socket/index.ts                           |  20 ++-
 src/socket/types.ts                           |   9 ++
 12 files changed, 158 insertions(+), 212 deletions(-)
 delete mode 100644 src/lib/whitelist.ts

diff --git a/FEATURES.md b/FEATURES.md
index 59676b6..dfcdfc5 100644
--- a/FEATURES.md
+++ b/FEATURES.md
@@ -15,11 +15,9 @@ A comprehensive list of every feature in the AskEasy platform.
 
 ### Role System
 
-- **Two-tier roles**:
-  - **Global role** — determined from `whitelist.txt` on every login (PROFESSOR or STUDENT)
-  - **Per-course role** — stored in `CourseEnrollment` (PROFESSOR, TA, or STUDENT)
-- **Whitelist** — plain text file of UTORids; case-insensitive; supports legacy `utorid,PROFESSOR` format
-- **Effective permissions** — course/session actions use the per-course enrollment role, not the global role
+- **Roles are per class** — stored in `CourseEnrollment` (PROFESSOR, TA, or STUDENT). Every login writes `User.role = STUDENT`; there is no global professor role to authorize on.
+- **Admins** — `ADMIN_WHITELIST` (case-insensitive UTORids) is the only global permission. Admins create classlists and assign each one's professors and TAs.
+- **Effective permissions** — every course/session action resolves the caller's `CourseEnrollment` role for that specific course
 
 ### Endpoints
 
diff --git a/README.md b/README.md
index f3ec0e3..e1e8674 100644
--- a/README.md
+++ b/README.md
@@ -97,8 +97,8 @@ SESSION_SECRET=<64-char-hex>
 # Cron job auth (for /api/cron/cleanup-sessions)
 CRON_SECRET=<random-secret>
 
-# Roles — comma-separated UTORids, case-insensitive
-PROFESSOR_WHITELIST=utorid1,utorid2
+# Admins — comma-separated UTORids, case-insensitive.
+# Admins create classlists and assign each one's professors and TAs.
 ADMIN_WHITELIST=utorid1
 ```
 
@@ -121,31 +121,28 @@ REDIS_URL=redis://:<password>@localhost:6379
 DEV_UTORID=yourutorid
 DEV_NAME=Your Name
 DEV_EMAIL=your.email@mail.utoronto.ca
-DEV_ROLE=PROFESSOR   # or STUDENT
 ```
 
 > **The `DEV_*` variables are ignored in production.** The auth route only reads them when `NODE_ENV !== "production"`; a production request arriving without a Shibboleth header is rejected with a 401 rather than falling back to `DEV_UTORID`. Keep them out of production environments regardless — `docker-compose.override.yml` is the only place they belong.
 
-| Variable                                    | Required | Description                                                                                                               |
-| ------------------------------------------- | :------: | ------------------------------------------------------------------------------------------------------------------------- |
-| `POSTGRES_USER` / `PASSWORD` / `DB`         |   Yes    | Postgres credentials                                                                                                      |
-| `REDIS_PASSWORD`                            |   Yes    | Passed to the Redis container as `--requirepass`                                                                          |
-| `SESSION_SECRET`                            |   Yes    | Key for iron-session cookie encryption. Changing it logs everyone out.                                                    |
-| `PROFESSOR_WHITELIST`                       |   Yes    | UTORids granted the PROFESSOR role on login. Everyone else is a STUDENT.                                                  |
-| `ADMIN_WHITELIST`                           |   Yes    | UTORids granted `/dashboard` access. Empty means nobody can administer.                                                   |
-| `CRON_SECRET`                               |   Yes    | Bearer token for the cleanup-sessions cron endpoint                                                                       |
-| `DATABASE_URL`                              |   Dev    | Only in `.env.local`; Compose derives it otherwise                                                                        |
-| `REDIS_URL`                                 |   Dev    | Only in `.env.local`; Compose derives it otherwise                                                                        |
-| `DEV_UTORID`                                |   Dev    | Fake UTORid injected when Shibboleth is not present                                                                       |
-| `DEV_NAME`                                  |   Dev    | Display name for the fake dev user                                                                                        |
-| `DEV_EMAIL`                                 |   Dev    | Email for the fake dev user; defaults to `<utorid>@mail.utoronto.ca`                                                      |
-| `DEV_ROLE`                                  |   Dev    | `PROFESSOR` or `STUDENT` — overrides whitelist lookup                                                                     |
-| `DEV_PROF_*` / `DEV_TA_*` / `DEV_STUDENT_*` |   Dev    | Per-persona `UTORID` / `NAME` / `ROLE` / `EMAIL` for `pnpm dev:all`. Each falls back to a default with a startup warning. |
-| `SESSION_COOKIE_NAME`                       |    No    | Set per instance by `pnpm dev:all`. Ignored in production.                                                                |
-| `NEXT_DIST_DIR`                             |    No    | Set per instance by `pnpm dev:all` so concurrent dev servers don't share `.next`.                                         |
-| `SOCKET_IO_USE_REDIS`                       |    No    | Set to `"false"` to disable the Socket.IO Redis adapter. Enabled otherwise.                                               |
-
-Whitelists are read once at startup and cached, so restart the app after changing them.
+| Variable                                    | Required | Description                                                                                                      |
+| ------------------------------------------- | :------: | ---------------------------------------------------------------------------------------------------------------- |
+| `POSTGRES_USER` / `PASSWORD` / `DB`         |   Yes    | Postgres credentials                                                                                             |
+| `REDIS_PASSWORD`                            |   Yes    | Passed to the Redis container as `--requirepass`                                                                 |
+| `SESSION_SECRET`                            |   Yes    | Key for iron-session cookie encryption. Changing it logs everyone out.                                           |
+| `ADMIN_WHITELIST`                           |   Yes    | UTORids granted `/dashboard` access and the right to create classlists. Empty means nobody can administer.       |
+| `CRON_SECRET`                               |   Yes    | Bearer token for the cleanup-sessions cron endpoint                                                              |
+| `DATABASE_URL`                              |   Dev    | Only in `.env.local`; Compose derives it otherwise                                                               |
+| `REDIS_URL`                                 |   Dev    | Only in `.env.local`; Compose derives it otherwise                                                               |
+| `DEV_UTORID`                                |   Dev    | Fake UTORid injected when Shibboleth is not present                                                              |
+| `DEV_NAME`                                  |   Dev    | Display name for the fake dev user                                                                               |
+| `DEV_EMAIL`                                 |   Dev    | Email for the fake dev user; defaults to `<utorid>@mail.utoronto.ca`                                             |
+| `DEV_PROF_*` / `DEV_TA_*` / `DEV_STUDENT_*` |   Dev    | Per-persona `UTORID` / `NAME` / `EMAIL` for `pnpm dev:all`. Each falls back to a default with a startup warning. |
+| `SESSION_COOKIE_NAME`                       |    No    | Set per instance by `pnpm dev:all`. Ignored in production.                                                       |
+| `NEXT_DIST_DIR`                             |    No    | Set per instance by `pnpm dev:all` so concurrent dev servers don't share `.next`.                                |
+| `SOCKET_IO_USE_REDIS`                       |    No    | Set to `"false"` to disable the Socket.IO Redis adapter. Enabled otherwise.                                      |
+
+`ADMIN_WHITELIST` is read once at startup and cached, so restart the app after changing it.
 
 ---
 
@@ -169,7 +166,7 @@ pnpm install
 
 Create `.env` and `.env.local` in the project root using the templates in [Environment Variables](#environment-variables) above. Both are gitignored, so a fresh clone has neither.
 
-Put your own UTORid in `PROFESSOR_WHITELIST` and `ADMIN_WHITELIST`, and set `DEV_UTORID` to the same value so your fake dev login picks up those roles.
+Put your own UTORid in `ADMIN_WHITELIST`, and set `DEV_UTORID` to the same value so your fake dev login can create classlists and reach `/dashboard`. Everyone else signs in as a student until an admin assigns them to a class.
 
 ### 3. Start the database and Redis
 
@@ -239,15 +236,16 @@ DEV_STUDENT_NAME=Dev Student
 DEV_STUDENT_ROLE=STUDENT
 ```
 
-Extra instances of a role (e.g. a second professor) use numbered defaults (`devprof2`)
-and can be overridden with `DEV_PROF_2_UTORID` / `_NAME` / `_ROLE` / `_EMAIL` (same
+Extra instances of a label (e.g. a second professor tab) use numbered defaults
+(`devprof2`) and can be overridden with `DEV_PROF_2_UTORID` / `_NAME` / `_EMAIL` (same
 pattern for `TA` and `STUDENT`).
 
 Notes:
 
-- `DEV_ROLE` overrides the whitelist lookup, so the PROF persona does **not** need to be
-  in `PROFESSOR_WHITELIST`. It **does** need to be in `ADMIN_WHITELIST` for `/dashboard`
-  access, and whitelists are cached at startup — restart after editing.
+- PROF / TA / STUDENT label which tab is which; they are not roles. Every persona signs
+  in as a student. To give one professor or TA rights, sign in as an admin, create a
+  classlist and add that persona's UTORid. `ADMIN_WHITELIST` is cached at startup —
+  restart after editing.
 - Leave `SOCKET_IO_USE_REDIS` unset. With the adapter disabled, events don't cross
   instances: a question asked in one tab won't appear in the others until you refresh.
 - Each instance runs its own Next compiler against its own build dir (`.next-prof`,
@@ -347,7 +345,7 @@ prisma/
 └── seed.ts               # Resets all tables (dev use only)
 ```
 
-Professor and admin permissions are set with the `PROFESSOR_WHITELIST` and `ADMIN_WHITELIST` environment variables — see [docs/ADMIN-GUIDE.md](docs/ADMIN-GUIDE.md) for details.
+Admin access is set with the `ADMIN_WHITELIST` environment variable. Professor and TA rights are granted per class by an admin — see [docs/ADMIN-GUIDE.md](docs/ADMIN-GUIDE.md) for details.
 
 ---
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 0f1c3d3..380638e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,7 +9,6 @@ services:
       - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-ask_easy}
       - REDIS_URL=redis://:${REDIS_PASSWORD:-changeme}@redis:6379
       - SESSION_SECRET=${SESSION_SECRET:?required in prod.env}
-      - PROFESSOR_WHITELIST=${PROFESSOR_WHITELIST}
       - ADMIN_WHITELIST=${ADMIN_WHITELIST}
       # DEV_* live in docker-compose.override.yml so production never sees them.
     depends_on:
diff --git a/docs/ADMIN-GUIDE.md b/docs/ADMIN-GUIDE.md
index a5782a5..e02559a 100644
--- a/docs/ADMIN-GUIDE.md
+++ b/docs/ADMIN-GUIDE.md
@@ -1,46 +1,29 @@
 # AskEasy — Administrator Guide
 
-This guide is for professors and system administrators who need to manage the platform — handling course cleanup at the end of a semester, controlling who has professor access, and accessing the database directly if needed.
+This guide is for administrators who need to manage the platform — handling course cleanup at the end of a semester, controlling who can create classes, and accessing the database directly if needed.
 
 ---
 
-## Role Control Files
+## Who Can Do What
 
-Three plain-text files on the server control who can do what. All three live in the project root directory (`~/AskEasy/`).
+There is no global professor role. Everyone who signs in is a student until an admin
+puts them on a class.
 
-| File | What it controls |
-|------|-----------------|
-| `whitelist.txt` | Who gets the **PROFESSOR** role in the app |
-| `admin_whitelist.txt` | Who can access the **Admin Dashboard** at `/dashboard` |
+| Level         | How it is granted                                               | What it allows                                                   |
+| ------------- | --------------------------------------------------------------- | ---------------------------------------------------------------- |
+| **Admin**     | `ADMIN_WHITELIST` env var (`admin_whitelist.txt` on the server) | Create classlists, assign professors and TAs, reach `/dashboard` |
+| **Professor** | Assigned by an admin when the classlist is created              | Runs one room — their own. Cannot see other professors' rooms    |
+| **TA**        | Assigned by an admin or by the professor of a room              | Answer questions and moderate, inside that one room              |
+| **Student**   | On the uploaded classlist, or joins with a room code            | Ask, upvote and reply                                            |
 
-Both files are read once at server startup and cached in memory. A restart is required to pick up any changes.
+An admin who creates a classlist gets a room of their own (as its professor) plus TA
+access to every other room on that classlist, so they can always see what is going on.
 
-### `whitelist.txt` — who gets the Professor role
+### `admin_whitelist.txt` — who can administer
 
-Any UTORid listed here is assigned the **PROFESSOR** role when they log in. Everyone else gets the **STUDENT** role by default.
-
-```
-# One UTORid per line. Lines starting with # are ignored.
-scalij
-phintr
-yousef10
-```
-
-The role is checked on every login, so changes take effect the next time the user logs in.
-
-**To add a new professor:**
-
-```bash
-ssh easy@redacted_ip
-echo "newutorid" >> ~/AskEasy/whitelist.txt
-docker restart ask_easy-app-1
-```
-
-**TAs are not listed here.** TAs are assigned per-course by professors through the app UI. A TA has elevated permissions only within the specific course they're assigned to.
-
-### `admin_whitelist.txt` — who can access the Admin Dashboard
-
-Any UTORid listed here gains access to the `/dashboard` admin panel. They must also be a PROFESSOR (i.e., also in `whitelist.txt`) for their role to function correctly, but the dashboard itself only checks this file.
+Any UTORid listed here can create classlists and reach the `/dashboard` admin panel.
+The file is read once at server startup and cached in memory, so a restart is required
+to pick up changes.
 
 ```
 # One UTORid per line. Lines starting with # are ignored.
@@ -55,6 +38,9 @@ echo "newutorid" >> ~/AskEasy/admin_whitelist.txt
 docker restart ask_easy-app-1
 ```
 
+**To add a new professor**, no server access is needed: an admin creates the classlist
+in the app and types the professor's UTORid. There is no `whitelist.txt` any more.
+
 Anyone not in this file who tries to visit `/dashboard` is silently redirected to the home page.
 
 ---
@@ -67,15 +53,15 @@ The **Dashboard** link appears in the **top-right corner of the home page** —
 
 At the top of the page, seven live counters give you a snapshot of the platform:
 
-| Counter | What it shows |
-|---------|--------------|
-| Total Users | Everyone who has ever logged in |
-| Total Courses | All courses ever created |
-| Active Sessions | Sessions currently live |
-| Total Sessions | All sessions ever created |
-| Total Questions | All questions ever asked |
-| Total Answers | All answers ever posted |
-| Enrollments | Total course membership records |
+| Counter         | What it shows                   |
+| --------------- | ------------------------------- |
+| Total Users     | Everyone who has ever logged in |
+| Total Courses   | All courses ever created        |
+| Active Sessions | Sessions currently live         |
+| Total Sessions  | All sessions ever created       |
+| Total Questions | All questions ever asked        |
+| Total Answers   | All answers ever posted         |
+| Enrollments     | Total course membership records |
 
 Click **Refresh** (top right of the page) to reload the counts and all table data.
 
@@ -95,10 +81,12 @@ The landing tab when you open the dashboard. It has:
 **Columns:** Name, UTORid, Email, Role
 
 **Filters:**
+
 - Search by name or UTORid
 - Filter by role (Student / TA / Professor)
 
 **Actions:**
+
 - Delete a single user — removes the user and all their questions, answers, and enrollments across the platform
 - **Delete All Users** button — requires typing `DELETE USERS` to confirm; wipes every user record
 
@@ -109,9 +97,11 @@ The landing tab when you open the dashboard. It has:
 **Columns:** Code, Name, Semester, Created By, Enrollment count, Session count
 
 **Filters:**
+
 - Search by course code or name
 
 **Actions:**
+
 - Delete a single course — cascades to all its sessions, questions, answers, enrollments, and slides
 - **Delete All Courses** button — requires typing `DELETE COURSES` to confirm
 
@@ -122,10 +112,12 @@ The landing tab when you open the dashboard. It has:
 **Columns:** Title, Course, Status (ACTIVE / ENDED), Created By, Question count, Created date
 
 **Filters:**
+
 - Search by session title
 - Filter by status (Active / Scheduled / Ended)
 
 **Actions:**
+
 - Delete a single session — removes all its questions, answers, and uploaded slides
 - **Delete All Sessions** button — requires typing `DELETE SESSIONS` to confirm
 
@@ -138,6 +130,7 @@ The landing tab when you open the dashboard. It has:
 **Columns:** Metadata for every uploaded PDF, linked to its session
 
 **Actions:**
+
 - Delete individual slide set records
 - **Delete All Slide Sets** button
 
@@ -150,6 +143,7 @@ The landing tab when you open the dashboard. It has:
 **Columns:** Question content, session, author, status, timestamps
 
 **Actions:**
+
 - Delete individual questions
 - **Delete All Questions** button
 
@@ -160,10 +154,12 @@ The landing tab when you open the dashboard. It has:
 **Columns:** User name, UTORid, Course, Role (Student / TA / Professor)
 
 **Filters:**
+
 - Search by name, UTORid, or course code
 - Filter by role
 
 **Actions:**
+
 - Remove a single enrollment (removes the user from that course only, does not delete the user)
 - **Delete All Enrollments** button — requires typing `DELETE ENROLLMENTS` to confirm
 - Supports **Load More** pagination (loads 50 at a time)
@@ -231,26 +227,26 @@ docker exec -it ask_easy-postgres-1 psql -U postgres -d ask_easy
 
 Useful psql commands:
 
-| Command | What it does |
-|---------|-------------|
-| `\dt` | List all tables |
-| `\q` | Exit psql |
-| `SELECT * FROM "User";` | See all users who have logged in |
-| `SELECT * FROM "Course";` | See all courses |
-| `SELECT * FROM "Session";` | See all sessions |
+| Command                    | What it does                     |
+| -------------------------- | -------------------------------- |
+| `\dt`                      | List all tables                  |
+| `\q`                       | Exit psql                        |
+| `SELECT * FROM "User";`    | See all users who have logged in |
+| `SELECT * FROM "Course";`  | See all courses                  |
+| `SELECT * FROM "Session";` | See all sessions                 |
 
 ### Database tables
 
-| Table | What it stores |
-|-------|---------------|
-| `User` | Everyone who has logged in (UTORid, name, email, global role) |
-| `Course` | Courses created by professors |
-| `CourseEnrollment` | Which users are in which courses (STUDENT / TA / PROFESSOR) |
-| `Session` | Live Q&A sessions within a course |
-| `Question` | Questions asked during sessions |
-| `Answer` | Answers to questions |
-| `QuestionUpvote` / `AnswerUpvote` | Upvote records |
-| `SlideSet` | Uploaded PDF metadata (files live in `uploads/`) |
+| Table                             | What it stores                                                |
+| --------------------------------- | ------------------------------------------------------------- |
+| `User`                            | Everyone who has logged in (UTORid, name, email, global role) |
+| `Course`                          | Courses created by professors                                 |
+| `CourseEnrollment`                | Which users are in which courses (STUDENT / TA / PROFESSOR)   |
+| `Session`                         | Live Q&A sessions within a course                             |
+| `Question`                        | Questions asked during sessions                               |
+| `Answer`                          | Answers to questions                                          |
+| `QuestionUpvote` / `AnswerUpvote` | Upvote records                                                |
+| `SlideSet`                        | Uploaded PDF metadata (files live in `uploads/`)              |
 
 ---
 
@@ -271,11 +267,10 @@ Useful psql commands:
 
 ### Key files on the VM
 
-| File | Purpose |
-|------|---------|
-| `/etc/apache2/sites-enabled/askeasy.conf` | Apache vhost — TLS, reverse proxy, Shibboleth directives |
-| `/etc/shibboleth/shibboleth2.xml` | Shibboleth SP config — entity ID, IdP endpoint, metadata |
-| `/etc/shibboleth/utorauth_metadata_verify.crt` | U of T metadata signing certificate |
-| `/etc/letsencrypt/live/askeasy.utm.utoronto.ca/` | TLS certificates (auto-renewed by certbot) |
-| `~/AskEasy/whitelist.txt` | UTORids that receive the PROFESSOR role |
-| `~/AskEasy/admin_whitelist.txt` | UTORids that can access the `/dashboard` admin panel |
+| File                                             | Purpose                                                    |
+| ------------------------------------------------ | ---------------------------------------------------------- |
+| `/etc/apache2/sites-enabled/askeasy.conf`        | Apache vhost — TLS, reverse proxy, Shibboleth directives   |
+| `/etc/shibboleth/shibboleth2.xml`                | Shibboleth SP config — entity ID, IdP endpoint, metadata   |
+| `/etc/shibboleth/utorauth_metadata_verify.crt`   | U of T metadata signing certificate                        |
+| `/etc/letsencrypt/live/askeasy.utm.utoronto.ca/` | TLS certificates (auto-renewed by certbot)                 |
+| `~/AskEasy/admin_whitelist.txt`                  | UTORids that can create classlists and access `/dashboard` |
diff --git a/scripts/dev-all.ts b/scripts/dev-all.ts
index 3782436..9d3a568 100644
--- a/scripts/dev-all.ts
+++ b/scripts/dev-all.ts
@@ -12,13 +12,18 @@
  *   TA       -> http://localhost:3001   askeasy-dev-ta
  *   STUDENT  -> http://localhost:3002   askeasy-dev-student
  *
- * Extra instances of a role get sequential ports, distinct cookie names /
+ * PROF / TA / STUDENT are labels for which tab is which, not roles. Roles are
+ * granted per class by an admin, so a persona is a professor only once it has
+ * been assigned to a class — sign in as an admin (ADMIN_WHITELIST) and add the
+ * other personas' UTORids when you create the classlist.
+ *
+ * Extra instances of a label get sequential ports, distinct cookie names /
  * dist dirs, and numbered default identities (devprof2, …). Override with
- * DEV_<ROLE>_2_UTORID / _NAME / _ROLE / _EMAIL (and _3, …).
+ * DEV_<LABEL>_2_UTORID / _NAME / _EMAIL (and _3, …).
  *
  * Identity is process-global (src/app/api/auth/session/route.ts reads
- * DEV_UTORID / DEV_NAME / DEV_ROLE from the environment), so one identity
- * requires one process.
+ * DEV_UTORID / DEV_NAME from the environment), so one identity requires one
+ * process.
  *
  * Each child also gets its own SESSION_COOKIE_NAME. Browser cookies are keyed
  * by host and ignore the port, so without distinct names all instances would
@@ -43,15 +48,12 @@ dotenv.config({ path: ".env.local", override: true });
 // Personas
 // ---------------------------------------------------------------------------
 
-const ROLES = ["STUDENT", "TA", "PROFESSOR"] as const;
-type Role = (typeof ROLES)[number];
-
 interface PersonaBase {
   key: string;
   cookieName: string;
   distDir: string;
   color: string;
-  defaults: { utorid: string; name: string; role: Role };
+  defaults: { utorid: string; name: string };
 }
 
 interface PersonaSpec extends PersonaBase {
@@ -72,21 +74,21 @@ const PERSONA_BASES: PersonaBase[] = [
     cookieName: "askeasy-dev-prof",
     distDir: ".next-prof",
     color: "\x1b[35m", // magenta
-    defaults: { utorid: "devprof", name: "Dev Professor", role: "PROFESSOR" },
+    defaults: { utorid: "devprof", name: "Dev Professor" },
   },
   {
     key: "TA",
     cookieName: "askeasy-dev-ta",
     distDir: ".next-ta",
     color: "\x1b[36m", // cyan
-    defaults: { utorid: "devta", name: "Dev TA", role: "TA" },
+    defaults: { utorid: "devta", name: "Dev TA" },
   },
   {
     key: "STUDENT",
     cookieName: "askeasy-dev-student",
     distDir: ".next-student",
     color: "\x1b[32m", // green
-    defaults: { utorid: "devstudent", name: "Dev Student", role: "STUDENT" },
+    defaults: { utorid: "devstudent", name: "Dev Student" },
   },
 ];
 
@@ -95,7 +97,6 @@ interface ResolvedPersona {
   utorid: string;
   name: string;
   email: string;
-  role: Role;
 }
 
 const warnings: string[] = [];
@@ -151,7 +152,6 @@ function expandPersonas(profs: number, tas: number, students: number): PersonaSp
         defaults: {
           utorid: alone ? base.defaults.utorid : `${base.defaults.utorid}${i}`,
           name: alone ? base.defaults.name : `${base.defaults.name} ${i}`,
-          role: base.defaults.role,
         },
       });
     }
@@ -171,19 +171,12 @@ function resolvePersona(spec: PersonaSpec): ResolvedPersona {
 
   const utorid = read("UTORID", spec.defaults.utorid);
   const name = read("NAME", spec.defaults.name);
-  const role = read("ROLE", spec.defaults.role) as Role;
-
-  if (!ROLES.includes(role)) {
-    // route.ts casts DEV_ROLE straight to the Prisma enum, so a typo would
-    // otherwise surface as an opaque database error on first login.
-    errors.push(`DEV_${spec.envKey}_ROLE is "${role}" — must be one of ${ROLES.join(", ")}.`);
-  }
 
   // Always set explicitly: a single global DEV_EMAIL shared by all personas
   // would collide on the User table's unique email.
   const email = process.env[`DEV_${spec.envKey}_EMAIL`]?.trim() || `${utorid}@mail.utoronto.ca`;
 
-  return { spec, utorid, name, email, role };
+  return { spec, utorid, name, email };
 }
 
 // ---------------------------------------------------------------------------
@@ -278,12 +271,19 @@ function printSummary(resolved: ResolvedPersona[]): void {
 
   console.log("");
   const labelWidth = Math.max(8, ...resolved.map((p) => p.spec.key.length));
-  for (const { spec, utorid, name, role } of resolved) {
+  for (const { spec, utorid, name } of resolved) {
     const label = `${spec.color}${BOLD}${spec.key.padEnd(labelWidth)}${RESET}`;
     const url = `http://localhost:${spec.port}`;
-    console.log(`  ${label} ${url}   ${DIM}${name} (${utorid}, ${role})${RESET}`);
+    console.log(`  ${label} ${url}   ${DIM}${name} (${utorid})${RESET}`);
   }
   console.log("");
+  console.log(
+    `${DIM}  Everyone starts as a student. Sign in as an admin (ADMIN_WHITELIST) to${RESET}`
+  );
+  console.log(
+    `${DIM}  create a classlist and assign the other personas as professors or TAs.${RESET}`
+  );
+  console.log("");
 }
 
 // ---------------------------------------------------------------------------
@@ -320,7 +320,7 @@ const READY_TIMEOUT_MS = 120_000;
 
 /** Spawns one instance and resolves once it reports ready (or gives up waiting). */
 function launch(persona: ResolvedPersona, tsx: string): Promise<void> {
-  const { spec, utorid, name, email, role } = persona;
+  const { spec, utorid, name, email } = persona;
 
   const child = spawn(tsx, ["watch", "src/server.ts"], {
     cwd: process.cwd(),
@@ -332,7 +332,6 @@ function launch(persona: ResolvedPersona, tsx: string): Promise<void> {
       DEV_UTORID: utorid,
       DEV_NAME: name,
       DEV_EMAIL: email,
-      DEV_ROLE: role,
       SESSION_COOKIE_NAME: spec.cookieName,
       NEXT_DIST_DIR: spec.distDir,
     },
diff --git a/src/app/api/auth/session/route.ts b/src/app/api/auth/session/route.ts
index 5f807da..1608c0b 100644
--- a/src/app/api/auth/session/route.ts
+++ b/src/app/api/auth/session/route.ts
@@ -4,7 +4,6 @@ import { cookies } from "next/headers";
 
 import { prisma } from "@/lib/prisma";
 import { getSessionOptions, type SessionData } from "@/lib/session";
-import { getRoleFromWhitelist } from "@/lib/whitelist";
 
 // ---------------------------------------------------------------------------
 // GET /api/auth/session
@@ -67,34 +66,25 @@ export async function GET(request: NextRequest) {
   }
 
   // ------------------------------------------------------------------
-  // 2. Resolve role from the instructor whitelist.
-  //    PROFESSOR / TA → listed in PROFESSOR_WHITELIST
-  //    STUDENT       → everyone else (default)
-  //    In dev mode DEV_ROLE overrides the whitelist (for testing instructor UI).
-  // ------------------------------------------------------------------
-  const whitelistRole = getRoleFromWhitelist(utorid);
-  const role =
-    !isProd && process.env.DEV_ROLE
-      ? (process.env.DEV_ROLE as "STUDENT" | "TA" | "PROFESSOR")
-      : whitelistRole;
-
-  // ------------------------------------------------------------------
-  // 3. Upsert user in Postgres.
-  //    Role is re-evaluated on every login so whitelist changes take
-  //    effect immediately on the user's next sign-in.
+  // 2. Upsert user in Postgres.
+  //
+  //    Everyone signs in as STUDENT. There is no global professor role:
+  //    PROFESSOR and TA are granted per class by an admin, and live on
+  //    CourseEnrollment. User.role is therefore only ever STUDENT and is
+  //    kept solely as the default for new enrollment rows.
   // ------------------------------------------------------------------
   const user = await prisma.user.upsert({
     where: { utorid },
     update: {
       ...(name ? { name } : {}),
       ...(email ? { email } : {}),
-      role,
+      role: "STUDENT",
     },
     create: {
       utorid,
       name: name ?? utorid,
       email: email ?? `${utorid}@mail.utoronto.ca`,
-      role,
+      role: "STUDENT",
     },
   });
 
diff --git a/src/app/api/questions/[questionId]/answers/route.ts b/src/app/api/questions/[questionId]/answers/route.ts
index 68b2f2f..944640f 100644
--- a/src/app/api/questions/[questionId]/answers/route.ts
+++ b/src/app/api/questions/[questionId]/answers/route.ts
@@ -120,7 +120,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         where: { userId_courseId: { userId: user.userId, courseId: sessionRecord.courseId } },
         select: { role: true },
       });
-      if (!enrollment && user.role !== "PROFESSOR") {
+      if (!enrollment) {
         return NextResponse.json(
           { error: "You are not enrolled in this session." },
           { status: 403 }
diff --git a/src/app/api/sessions/[sessionId]/route.ts b/src/app/api/sessions/[sessionId]/route.ts
index a828def..fc8a730 100644
--- a/src/app/api/sessions/[sessionId]/route.ts
+++ b/src/app/api/sessions/[sessionId]/route.ts
@@ -31,16 +31,15 @@ export async function GET(_req: Request, { params }: RouteParams) {
       return NextResponse.json({ error: "Session not found." }, { status: 404 });
     }
 
-    // Enrollment check — non-professors may only query sessions for courses they belong to.
-    // Return 404 (not 403) to avoid leaking the existence of sessions.
-    if (user.role !== "PROFESSOR") {
-      const enrollment = await prisma.courseEnrollment.findUnique({
-        where: { userId_courseId: { userId: user.userId, courseId: session.courseId } },
-        select: { role: true },
-      });
-      if (!enrollment) {
-        return NextResponse.json({ error: "Session not found." }, { status: 404 });
-      }
+    // Enrollment check — a user may only query sessions for courses they belong to.
+    // There is no global professor role to fall back on, so this applies to
+    // everyone. Return 404 (not 403) to avoid leaking the existence of sessions.
+    const enrollment = await prisma.courseEnrollment.findUnique({
+      where: { userId_courseId: { userId: user.userId, courseId: session.courseId } },
+      select: { role: true },
+    });
+    if (!enrollment) {
+      return NextResponse.json({ error: "Session not found." }, { status: 404 });
     }
 
     // Auto-end the session if it has been inactive for too long, then re-read
diff --git a/src/lib/whitelist.ts b/src/lib/whitelist.ts
deleted file mode 100644
index 3eba110..0000000
--- a/src/lib/whitelist.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import type { Role } from "@/utils/types";
-
-// ---------------------------------------------------------------------------
-// Instructor whitelist
-//
-// Reads the PROFESSOR_WHITELIST env var to determine which UTORids are
-// professors. Comma-separated; surrounding whitespace is ignored.
-//
-// Any UTORid in the list → PROFESSOR
-// Any UTORid NOT in the list → STUDENT
-//
-// TAs are assigned per-course by professors via the UI and stored in
-// CourseEnrollment.role. They are never listed here.
-//
-// Example:
-//   PROFESSOR_WHITELIST=smithj,doejohn
-// ---------------------------------------------------------------------------
-
-function loadWhitelist(): Set<string> {
-  const raw = process.env.PROFESSOR_WHITELIST;
-
-  if (!raw) {
-    // If the var is unset, everyone is a student — not a fatal error.
-    console.warn("[whitelist] PROFESSOR_WHITELIST is not set. All users will be STUDENT.");
-    return new Set();
-  }
-
-  const set = new Set<string>();
-
-  for (const rawEntry of raw.split(",")) {
-    const utorid = rawEntry.trim().toLowerCase();
-    if (utorid) set.add(utorid);
-  }
-
-  return set;
-}
-
-// Loaded once at startup (module-level cache).
-// Restart the server to pick up changes to PROFESSOR_WHITELIST.
-const WHITELIST: Set<string> = loadWhitelist();
-
-/**
- * Returns PROFESSOR if the UTORid is in the whitelist, STUDENT otherwise.
- * TAs are never in the whitelist — they are managed per-course via the UI.
- */
-export function getRoleFromWhitelist(utorid: string): Role {
-  return WHITELIST.has(utorid.toLowerCase()) ? "PROFESSOR" : "STUDENT";
-}
diff --git a/src/server.ts b/src/server.ts
index 03de8fc..fa1e64a 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -8,7 +8,6 @@ const INJECTED_KEYS = [
   "DEV_UTORID",
   "DEV_NAME",
   "DEV_EMAIL",
-  "DEV_ROLE",
   "SESSION_COOKIE_NAME",
   "NEXT_DIST_DIR",
 ] as const;
diff --git a/src/socket/index.ts b/src/socket/index.ts
index 27dcc7c..c00c6cd 100644
--- a/src/socket/index.ts
+++ b/src/socket/index.ts
@@ -128,10 +128,18 @@ export async function initSocketIO(
   // Connection handler
   // -----------------------------------------------------------------------
 
-  async function broadcastViewerCount(sessionId: string) {
+  /**
+   * The professor running the room is not one of its viewers. Roles are per
+   * course, so this reads the enrollment role recorded at session:join —
+   * the global cookie role is always STUDENT and would count everyone.
+   */
+  async function countViewers(sessionId: string): Promise<number> {
     const sockets = await io!.in(`session:${sessionId}`).fetchSockets();
-    const count = sockets.filter((s) => s.data.role !== "PROFESSOR").length;
-    io!.to(`session:${sessionId}`).emit("viewer:count", { count });
+    return sockets.filter((s) => s.data.currentSessionRole !== "PROFESSOR").length;
+  }
+
+  async function broadcastViewerCount(sessionId: string) {
+    io!.to(`session:${sessionId}`).emit("viewer:count", { count: await countViewers(sessionId) });
   }
 
   io.on("connection", (socket) => {
@@ -186,6 +194,7 @@ export async function initSocketIO(
 
         socket.join(`session:${payload.sessionId}`);
         socket.data.currentSessionId = payload.sessionId;
+        socket.data.currentSessionRole = enrollment.role as SocketData["currentSessionRole"];
         console.log(`[Socket.IO] ${socket.id} joined session:${payload.sessionId}`);
 
         // Join the instructor room if the user is a TA or PROFESSOR in this course,
@@ -217,9 +226,7 @@ export async function initSocketIO(
         });
         if (!syncEnrollment) return;
 
-        const sockets = await io!.in(`session:${payload.sessionId}`).fetchSockets();
-        const count = sockets.filter((s) => s.data.role !== "PROFESSOR").length;
-        socket.emit("viewer:count", { count });
+        socket.emit("viewer:count", { count: await countViewers(payload.sessionId) });
       }
     });
 
@@ -228,6 +235,7 @@ export async function initSocketIO(
         socket.leave(`session:${payload.sessionId}`);
         if (socket.data.currentSessionId === payload.sessionId) {
           socket.data.currentSessionId = undefined;
+          socket.data.currentSessionRole = undefined;
         }
         console.log(`[Socket.IO] ${socket.id} left session:${payload.sessionId}`);
 
diff --git a/src/socket/types.ts b/src/socket/types.ts
index 3a8d1fc..043430c 100644
--- a/src/socket/types.ts
+++ b/src/socket/types.ts
@@ -1,8 +1,17 @@
 export interface SocketData {
   userId: string;
+  /**
+   * Global User.role from the session cookie. Always STUDENT — roles are per
+   * class now — so never authorize on it. Kept only for logging.
+   */
   role: string;
   connectedAt: Date;
   currentSessionId?: string;
+  /**
+   * CourseEnrollment role for `currentSessionId`, resolved on session:join.
+   * This is the only role that carries any authority.
+   */
+  currentSessionRole?: "STUDENT" | "TA" | "PROFESSOR";
 }
 
 export interface SocketErrorPayload {

From 3d63f6efb591c0078da3ffd39feaa74ff0ef4c9d Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 07:33:14 -0400
Subject: [PATCH 14/29] Step 1: only admins can create a class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Create Lecture button, the /create-class page and POST /api/courses all
gated on the global PROFESSOR role, which no longer exists. They now check
ADMIN_WHITELIST. Professors are assigned to a class by an admin; they do not
make one.

The home page header was gated on having at least one course, so a brand-new
admin would have landed on the student empty state with no way to create
anything. It now shows for admins regardless.

Also drops a leftover `role: "PROFESSOR"` from the creator upsert in
POST /api/courses — global roles are always STUDENT now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/app/api/courses/route.ts  | 12 +++++++-----
 src/app/create-class/page.tsx |  6 +++++-
 src/app/page.tsx              | 18 +++++++++++-------
 3 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/src/app/api/courses/route.ts b/src/app/api/courses/route.ts
index eac05bb..319fe76 100644
--- a/src/app/api/courses/route.ts
+++ b/src/app/api/courses/route.ts
@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 
 import { prisma } from "@/lib/prisma";
 import { getCurrentUser } from "@/lib/auth";
+import { isAdmin } from "@/lib/adminWhitelist";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -78,7 +79,7 @@ export async function GET() {
  *     professors?: string[]      // optional co-professor UTORids
  *   }
  *
- * Only PROFESSOR-role users may call this endpoint.
+ * Only admins (ADMIN_WHITELIST) may call this endpoint.
  *
  * Response: { course: { id, code, name, semester } }
  */
@@ -89,8 +90,8 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Authentication required." }, { status: 401 });
     }
 
-    if (user.role !== "PROFESSOR") {
-      return NextResponse.json({ error: "Only professors can create courses." }, { status: 403 });
+    if (!isAdmin(user.utorid)) {
+      return NextResponse.json({ error: "Only admins can create classes." }, { status: 403 });
     }
 
     let body: unknown;
@@ -135,7 +136,8 @@ export async function POST(request: NextRequest) {
 
     // Create the course and enroll the professor in one transaction
     const course = await prisma.$transaction(async (tx) => {
-      // Ensure the professor exists in the DB (in case of a system wipe)
+      // Ensure the creator exists in the DB (in case of a system wipe).
+      // User.role stays STUDENT — being a professor is a CourseEnrollment.
       await tx.user.upsert({
         where: { id: user.userId },
         update: {},
@@ -144,7 +146,7 @@ export async function POST(request: NextRequest) {
           utorid: user.utorid,
           email: user.email,
           name: user.name,
-          role: "PROFESSOR",
+          role: "STUDENT",
         },
       });
 
diff --git a/src/app/create-class/page.tsx b/src/app/create-class/page.tsx
index 5d07636..cb02966 100644
--- a/src/app/create-class/page.tsx
+++ b/src/app/create-class/page.tsx
@@ -22,6 +22,7 @@ export default function CreateClassPage() {
   const [professorsInput, setProfessorsInput] = useState("");
   const [courseCodeInput, setCourseCodeInput] = useState("");
   const [user, setUser] = useState<User | null>(null);
+  const [isAdmin, setIsAdmin] = useState(false);
   const [submitting, setSubmitting] = useState(false);
   const [submitError, setSubmitError] = useState<string | null>(null);
 
@@ -36,6 +37,7 @@ export default function CreateClassPage() {
             pfp: data.name?.[0]?.toUpperCase() ?? "?",
             role: data.role as User["role"],
           });
+          setIsAdmin(!!data.isAdmin);
         }
       })
       .catch(() => null);
@@ -108,7 +110,9 @@ export default function CreateClassPage() {
     );
   }
 
-  if (user.role !== "PROFESSOR") {
+  // Creating a class is an admin action — professors are assigned to a class,
+  // they do not make one.
+  if (!isAdmin) {
     return <NoPermissions user={user} />;
   }
 
diff --git a/src/app/page.tsx b/src/app/page.tsx
index 6078fab..2338ed8 100644
--- a/src/app/page.tsx
+++ b/src/app/page.tsx
@@ -71,11 +71,15 @@ export default function LandingPage() {
     );
   }
 
-  const isGlobalProfessor = user.role === "PROFESSOR";
-  const showProfViewer = isGlobalProfessor || hasProfessorCourses;
-  // Don't mount the student viewer empty-state under a co-prof who only has professor courses.
+  // Only admins create classes. Professors are assigned to one, so their panel
+  // is driven by CourseEnrollment rather than any global role.
+  const showProfViewer = isAdmin || hasProfessorCourses;
+  // Don't mount the student viewer empty-state under a professor who only has
+  // professor courses.
   const showStudentViewer = hasStudentCourses || !showProfViewer;
-  const showLecturesHeader = hasProfessorCourses || hasStudentCourses;
+  // An admin with nothing yet still needs the header — that is where the
+  // Create button lives.
+  const showLecturesHeader = isAdmin || hasProfessorCourses || hasStudentCourses;
 
   const lecturesSubtitle = showProfViewer
     ? showStudentViewer
@@ -125,7 +129,7 @@ export default function LandingPage() {
                   </h2>
                   <p className="text-lg text-stone-500">{lecturesSubtitle}</p>
                 </div>
-                {isGlobalProfessor && (
+                {isAdmin && (
                   <Link
                     href="/create-class"
                     className="hidden sm:flex items-center gap-2 px-6 py-3 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm hover:shadow-md hover:-translate-y-0.5"
@@ -138,11 +142,11 @@ export default function LandingPage() {
             )}
 
             <div className="flex flex-col gap-10">
-              {showProfViewer && <ProfCourseViewer canCreateClass={isGlobalProfessor} />}
+              {showProfViewer && <ProfCourseViewer canCreateClass={isAdmin} />}
               {showStudentViewer && <CourseViewer />}
             </div>
 
-            {isGlobalProfessor && showLecturesHeader && (
+            {isAdmin && showLecturesHeader && (
               <div className="max-w-6xl mx-auto w-full mt-8 sm:hidden">
                 <Link
                   href="/create-class"

From a683df83230f222fd901cbf100f62c8f0f64fa86 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 07:36:27 -0400
Subject: [PATCH 15/29] =?UTF-8?q?Step=203a:=20schema=20=E2=80=94=20classli?=
 =?UTF-8?q?sts=20own=20one=20room=20per=20professor?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds Classlist, and turns a Course row into a *room*: one professor's Q&A
space inside a classlist. Course gains classlistId and professorId; the room's
display label is derived from the professor's User.name rather than stored, so
it follows them when a placeholder name is replaced.

A room has exactly one professor. Prisma cannot express a partial unique
index, so the invariant is enforced in SQL:

  CREATE UNIQUE INDEX ... ON "CourseEnrollment" ("courseId")
    WHERE "role" = 'PROFESSOR'

The migration backfills existing data rather than leaving it orphaned: every
current course becomes a single-room classlist owned by its creator, extra
PROFESSOR enrollments left over from the co-professor model are demoted to TA,
and a course whose creator was never enrolled gets that enrollment created —
otherwise it would end up with no professor at all.

User.hasLoggedIn tracks whether User.name is real or a placeholder. Step 3b
needs it: an admin types a temporary name for a professor who has never signed
in, and Shibboleth replaces it on first login.

The admin bulk-delete routes and the test cleanups now clear Classlist too —
its createdById FK is RESTRICT, so deleting users failed without it. Those
routes also protected "professors" by the global User.role, which is always
STUDENT now; they check for a PROFESSOR enrollment instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../migration.sql                             | 81 +++++++++++++++++++
 prisma/schema.prisma                          | 50 ++++++++++++
 prisma/seed.ts                                |  1 +
 src/__tests__/prisma-schema.test.ts           |  1 +
 src/__tests__/session-join.test.ts            |  1 +
 src/app/api/admin/courses/all/route.ts        |  1 +
 src/app/api/admin/system/all/route.ts         | 11 ++-
 src/app/api/admin/users/all/route.ts          | 11 ++-
 src/app/api/auth/session/route.ts             |  6 ++
 9 files changed, 161 insertions(+), 2 deletions(-)
 create mode 100644 prisma/migrations/20260910000000_classlist_rooms/migration.sql

diff --git a/prisma/migrations/20260910000000_classlist_rooms/migration.sql b/prisma/migrations/20260910000000_classlist_rooms/migration.sql
new file mode 100644
index 0000000..822eb92
--- /dev/null
+++ b/prisma/migrations/20260910000000_classlist_rooms/migration.sql
@@ -0,0 +1,81 @@
+-- Classlists and per-professor rooms.
+--
+-- A Course row is now a *room*: one professor's space inside a Classlist.
+-- Existing courses become single-room classlists so nothing is orphaned.
+
+-- AlterTable
+ALTER TABLE "User" ADD COLUMN "hasLoggedIn" BOOLEAN NOT NULL DEFAULT false;
+
+-- Everyone already in the table got there either by signing in or by being on
+-- an uploaded roster. Assume the former where the name is not just the UTORid.
+UPDATE "User" SET "hasLoggedIn" = true WHERE "name" <> "utorid";
+
+-- CreateTable
+CREATE TABLE "Classlist" (
+    "id" TEXT NOT NULL,
+    "code" TEXT NOT NULL,
+    "semester" TEXT NOT NULL,
+    "createdById" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Classlist_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "Classlist_createdById_idx" ON "Classlist"("createdById");
+CREATE INDEX "Classlist_semester_idx" ON "Classlist"("semester");
+
+-- AddForeignKey
+ALTER TABLE "Classlist" ADD CONSTRAINT "Classlist_createdById_fkey" FOREIGN KEY ("createdById") REFERENCES "User"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AlterTable
+ALTER TABLE "Course" ADD COLUMN "classlistId" TEXT;
+ALTER TABLE "Course" ADD COLUMN "professorId" TEXT;
+
+-- CreateIndex
+CREATE INDEX "Course_classlistId_idx" ON "Course"("classlistId");
+CREATE INDEX "Course_professorId_idx" ON "Course"("professorId");
+
+-- AddForeignKey
+ALTER TABLE "Course" ADD CONSTRAINT "Course_classlistId_fkey" FOREIGN KEY ("classlistId") REFERENCES "Classlist"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+ALTER TABLE "Course" ADD CONSTRAINT "Course_professorId_fkey" FOREIGN KEY ("professorId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- Backfill: give every existing course a classlist of its own, and make its
+-- creator the room's professor.
+INSERT INTO "Classlist" ("id", "code", "semester", "createdById", "createdAt", "updatedAt")
+SELECT "id", "code", "semester", "createdById", CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+FROM "Course";
+
+UPDATE "Course" SET "classlistId" = "id", "professorId" = "createdById";
+
+-- A room has exactly one professor. Courses created under the old co-professor
+-- model can have several, so demote everyone who is not the room's professor.
+UPDATE "CourseEnrollment" e
+SET "role" = 'TA'
+FROM "Course" c
+WHERE e."courseId" = c."id"
+  AND e."role" = 'PROFESSOR'
+  AND e."userId" <> c."professorId";
+
+-- The room's professor must actually be enrolled as one — a course whose
+-- creator was never enrolled would otherwise end up with no professor at all.
+INSERT INTO "CourseEnrollment" ("id", "userId", "courseId", "role")
+SELECT md5(random()::text || clock_timestamp()::text), c."professorId", c."id", 'PROFESSOR'
+FROM "Course" c
+WHERE c."professorId" IS NOT NULL
+  AND NOT EXISTS (
+    SELECT 1 FROM "CourseEnrollment" e
+    WHERE e."courseId" = c."id" AND e."userId" = c."professorId"
+  );
+
+UPDATE "CourseEnrollment" e
+SET "role" = 'PROFESSOR'
+FROM "Course" c
+WHERE e."courseId" = c."id" AND e."userId" = c."professorId" AND e."role" <> 'PROFESSOR';
+
+-- Enforce the invariant from here on. Prisma cannot express a partial unique
+-- index, so it lives in SQL: a second PROFESSOR enrollment on a room fails.
+CREATE UNIQUE INDEX "CourseEnrollment_one_professor_per_course"
+    ON "CourseEnrollment" ("courseId")
+    WHERE "role" = 'PROFESSOR';
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 5d33f74..ad0efb7 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -37,6 +37,19 @@ enum QuestionStatus {
 
 // =============================================================================
 // Models
+//
+// Classlist → Course → Session
+//
+// A **Classlist** is what an admin uploads: one course code, one semester, one
+// student roster. Nothing happens inside it directly.
+//
+// A **Course** row is a **room** — one professor's Q&A space for that classlist.
+// Creating a classlist creates one room per professor, and a room has exactly
+// one PROFESSOR enrollment (enforced by a partial unique index; see the
+// classlist_rooms migration). Everything session-scoped resolves permissions
+// through CourseEnrollment for the room, so a professor sees only their own.
+//
+// A **Session** is one live sitting of a room.
 // =============================================================================
 
 model User {
@@ -44,10 +57,17 @@ model User {
   utorid String @unique
   email String @unique
   name  String
+  /// Always STUDENT. Real roles live on CourseEnrollment, per room.
   role  Role   @default(STUDENT)
+  /// False while `name` is a placeholder — a UTORid, or a temporary name an
+  /// admin typed when assigning this person to a class. Set on first sign-in,
+  /// when Shibboleth gives us their real name.
+  hasLoggedIn Boolean @default(false)
 
   enrollments       CourseEnrollment[]
   createdCourses    Course[]
+  createdClasslists Classlist[]        @relation("ClasslistCreator")
+  professorOfRooms  Course[]           @relation("RoomProfessor")
   createdSessions   Session[]
   questions         Question[]
   answers           Answer[]
@@ -58,19 +78,49 @@ model User {
   @@index([role])
 }
 
+/// One uploaded classlist: a course code, a semester and a student roster.
+/// Owns one room (Course) per professor.
+model Classlist {
+  id          String   @id @default(cuid())
+  code        String
+  semester    String
+  /// The admin who uploaded it. They get a room of their own and TA access to
+  /// every other room on this classlist.
+  createdById String
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  createdBy User     @relation("ClasslistCreator", fields: [createdById], references: [id])
+  rooms     Course[]
+
+  @@index([createdById])
+  @@index([semester])
+}
+
+/// A room — one professor's Q&A space for a classlist. Exactly one
+/// CourseEnrollment on it has role PROFESSOR.
 model Course {
   id        String   @id @default(cuid())
   code      String
   name      String
   semester  String
   createdById String
+  /// Null only for rooms created before classlists existed.
+  classlistId String?
+  /// The room's one professor. Its display label is derived from this user's
+  /// name, so it follows them when a placeholder name is replaced at sign-in.
+  professorId String?
 
   createdBy   User               @relation(fields: [createdById], references: [id])
+  classlist   Classlist?         @relation(fields: [classlistId], references: [id])
+  professor   User?              @relation("RoomProfessor", fields: [professorId], references: [id])
   enrollments CourseEnrollment[]
   sessions    Session[]
 
   @@index([createdById])
   @@index([semester])
+  @@index([classlistId])
+  @@index([professorId])
 }
 
 model CourseEnrollment {
diff --git a/prisma/seed.ts b/prisma/seed.ts
index 4d1ffe4..03cfdf3 100644
--- a/prisma/seed.ts
+++ b/prisma/seed.ts
@@ -13,6 +13,7 @@ async function main() {
   await prisma.session.deleteMany();
   await prisma.courseEnrollment.deleteMany();
   await prisma.course.deleteMany();
+  await prisma.classlist.deleteMany();
   await prisma.user.deleteMany();
 
   console.log("✅ All tables cleared. DB is empty and ready.\n");
diff --git a/src/__tests__/prisma-schema.test.ts b/src/__tests__/prisma-schema.test.ts
index cbebc0f..09d6810 100644
--- a/src/__tests__/prisma-schema.test.ts
+++ b/src/__tests__/prisma-schema.test.ts
@@ -21,6 +21,7 @@ beforeEach(async () => {
   await prisma.session.deleteMany();
   await prisma.courseEnrollment.deleteMany();
   await prisma.course.deleteMany();
+  await prisma.classlist.deleteMany();
   await prisma.user.deleteMany();
 });
 
diff --git a/src/__tests__/session-join.test.ts b/src/__tests__/session-join.test.ts
index 523ca86..2fd2c65 100644
--- a/src/__tests__/session-join.test.ts
+++ b/src/__tests__/session-join.test.ts
@@ -23,6 +23,7 @@ beforeEach(async () => {
   await prisma.session.deleteMany();
   await prisma.courseEnrollment.deleteMany();
   await prisma.course.deleteMany();
+  await prisma.classlist.deleteMany();
   await prisma.user.deleteMany();
 });
 
diff --git a/src/app/api/admin/courses/all/route.ts b/src/app/api/admin/courses/all/route.ts
index 0e02bfd..b8e2b74 100644
--- a/src/app/api/admin/courses/all/route.ts
+++ b/src/app/api/admin/courses/all/route.ts
@@ -17,6 +17,7 @@ export async function DELETE() {
       prisma.session.deleteMany(),
       prisma.courseEnrollment.deleteMany(),
       prisma.course.deleteMany(),
+      prisma.classlist.deleteMany(),
     ]);
 
     return NextResponse.json({ success: true });
diff --git a/src/app/api/admin/system/all/route.ts b/src/app/api/admin/system/all/route.ts
index 59a3099..1b7cec4 100644
--- a/src/app/api/admin/system/all/route.ts
+++ b/src/app/api/admin/system/all/route.ts
@@ -11,7 +11,15 @@ export async function DELETE() {
 
     const adminUtorids = getAdminUtorids();
     const protectedUsers = await prisma.user.findMany({
-      where: { OR: [{ utorid: { in: adminUtorids } }, { role: "PROFESSOR" }] },
+      where: {
+        OR: [
+          { utorid: { in: adminUtorids } },
+          // Global User.role is always STUDENT — being a professor is an
+          // enrollment, so that is what has to be checked here.
+          { enrollments: { some: { role: "PROFESSOR" } } },
+          { createdClasslists: { some: {} } },
+        ],
+      },
       select: { id: true },
     });
     const protectedIds = protectedUsers.map((u) => u.id);
@@ -25,6 +33,7 @@ export async function DELETE() {
       prisma.session.deleteMany(),
       prisma.courseEnrollment.deleteMany(),
       prisma.course.deleteMany(),
+      prisma.classlist.deleteMany(),
       prisma.user.deleteMany(
         protectedIds.length > 0 ? { where: { id: { notIn: protectedIds } } } : undefined
       ),
diff --git a/src/app/api/admin/users/all/route.ts b/src/app/api/admin/users/all/route.ts
index f67f281..97596c2 100644
--- a/src/app/api/admin/users/all/route.ts
+++ b/src/app/api/admin/users/all/route.ts
@@ -11,7 +11,15 @@ export async function DELETE() {
 
     const adminUtorids = getAdminUtorids();
     const protectedUsers = await prisma.user.findMany({
-      where: { OR: [{ utorid: { in: adminUtorids } }, { role: "PROFESSOR" }] },
+      where: {
+        OR: [
+          { utorid: { in: adminUtorids } },
+          // Global User.role is always STUDENT — being a professor is an
+          // enrollment, so that is what has to be checked here.
+          { enrollments: { some: { role: "PROFESSOR" } } },
+          { createdClasslists: { some: {} } },
+        ],
+      },
       select: { id: true },
     });
     const protectedIds = protectedUsers.map((u) => u.id);
@@ -25,6 +33,7 @@ export async function DELETE() {
       prisma.session.deleteMany(),
       prisma.courseEnrollment.deleteMany(),
       prisma.course.deleteMany(),
+      prisma.classlist.deleteMany(),
       prisma.user.deleteMany(
         protectedIds.length > 0 ? { where: { id: { notIn: protectedIds } } } : undefined
       ),
diff --git a/src/app/api/auth/session/route.ts b/src/app/api/auth/session/route.ts
index 1608c0b..267a95e 100644
--- a/src/app/api/auth/session/route.ts
+++ b/src/app/api/auth/session/route.ts
@@ -73,18 +73,24 @@ export async function GET(request: NextRequest) {
   //    CourseEnrollment. User.role is therefore only ever STUDENT and is
   //    kept solely as the default for new enrollment rows.
   // ------------------------------------------------------------------
+  //
+  //    hasLoggedIn also flips true here. Until it does, `name` may be a
+  //    placeholder an admin typed when assigning this person to a class, and
+  //    the identity provider's name replaces it now.
   const user = await prisma.user.upsert({
     where: { utorid },
     update: {
       ...(name ? { name } : {}),
       ...(email ? { email } : {}),
       role: "STUDENT",
+      hasLoggedIn: true,
     },
     create: {
       utorid,
       name: name ?? utorid,
       email: email ?? `${utorid}@mail.utoronto.ca`,
       role: "STUDENT",
+      hasLoggedIn: true,
     },
   });
 

From b258d6745b1a07009dba55f62d85a702754e93e0 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 07:42:55 -0400
Subject: [PATCH 16/29] Step 3b: creating a classlist makes one room per
 professor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

POST /api/classlists replaces POST /api/courses. It creates the classlist,
then a room for the admin who made it and a room for every professor they
named. The admin is PROFESSOR of their own room and TA on all the others; each
other professor is PROFESSOR of exactly one room and has no row at all in the
rest, so those rooms are invisible to them.

A professor who also appears on the uploaded roster is deliberately left out
of the student enrollments — otherwise the roster would hand them student
access to every room the split exists to keep them out of.

Room labels are the professor's surname alone, derived from User.name at read
time rather than stored. Two Smiths on one classlist get a first initial, and
two J. Smiths fall back to the UTORid (src/lib/roomLabel.ts, unit-tested).

The create form now takes a UTORid and a name per professor instead of a
textarea of UTORids. GET /api/users/lookup (admin-only) resolves each UTORid as
it is typed: someone who has signed in has their real name filled in and
locked, and someone who has not gets an amber note that the name is temporary
until they sign in for the first time.

Verified against the dev database: room count, one professor per room, the
roster/TA overlap resolving to TA, professors having no access to each other's
rooms, and the partial unique index rejecting a second professor.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/__tests__/room-label.test.ts              |  73 ++++
 src/app/api/classlists/route.ts               | 329 ++++++++++++++++++
 src/app/api/courses/route.ts                  | 225 +-----------
 src/app/api/users/lookup/route.ts             |  81 +++++
 .../create-class/components/PreviewClass.tsx  |  33 +-
 .../create-class/components/ProfessorList.tsx | 225 ++++++++++++
 src/app/create-class/page.tsx                 |  41 ++-
 src/lib/classlistService.ts                   | 181 ++++++++++
 src/lib/roomLabel.ts                          |  71 ++++
 9 files changed, 1002 insertions(+), 257 deletions(-)
 create mode 100644 src/__tests__/room-label.test.ts
 create mode 100644 src/app/api/classlists/route.ts
 create mode 100644 src/app/api/users/lookup/route.ts
 create mode 100644 src/app/create-class/components/ProfessorList.tsx
 create mode 100644 src/lib/classlistService.ts
 create mode 100644 src/lib/roomLabel.ts

diff --git a/src/__tests__/room-label.test.ts b/src/__tests__/room-label.test.ts
new file mode 100644
index 0000000..06cfdf2
--- /dev/null
+++ b/src/__tests__/room-label.test.ts
@@ -0,0 +1,73 @@
+import { describe, expect, it } from "vitest";
+
+import { roomLabelsFor, surnameOf, type RoomProfessor } from "@/lib/roomLabel";
+
+const prof = (id: string, name: string, utorid: string): RoomProfessor => ({ id, name, utorid });
+
+describe("surnameOf", () => {
+  it("returns the last part of a name", () => {
+    expect(surnameOf("John Smith")).toBe("Smith");
+    expect(surnameOf("Maria del Carmen Rodriguez")).toBe("Rodriguez");
+  });
+
+  it("returns a single-part name unchanged", () => {
+    expect(surnameOf("Prince")).toBe("Prince");
+    expect(surnameOf("smithj")).toBe("smithj");
+  });
+
+  it("tolerates padding and repeated spaces", () => {
+    expect(surnameOf("  John   Smith  ")).toBe("Smith");
+  });
+
+  it("returns an empty string for a missing name", () => {
+    expect(surnameOf("")).toBe("");
+    expect(surnameOf(null)).toBe("");
+    expect(surnameOf(undefined)).toBe("");
+  });
+});
+
+describe("roomLabelsFor", () => {
+  it("uses the bare surname when it is unique", () => {
+    const labels = roomLabelsFor([
+      prof("1", "John Smith", "smithj"),
+      prof("2", "Ada Lovelace", "lovea"),
+    ]);
+    expect(labels.get("1")).toBe("Smith");
+    expect(labels.get("2")).toBe("Lovelace");
+  });
+
+  it("adds a first initial when two professors share a surname", () => {
+    const labels = roomLabelsFor([
+      prof("1", "John Smith", "smithj"),
+      prof("2", "Ada Smith", "smitha"),
+      prof("3", "Ada Lovelace", "lovea"),
+    ]);
+    expect(labels.get("1")).toBe("J. Smith");
+    expect(labels.get("2")).toBe("A. Smith");
+    // Unaffected by the collision next to it.
+    expect(labels.get("3")).toBe("Lovelace");
+  });
+
+  it("falls back to the UTORid when the initial does not separate them", () => {
+    const labels = roomLabelsFor([
+      prof("1", "John Smith", "smithj"),
+      prof("2", "Jane Smith", "smithj2"),
+    ]);
+    expect(labels.get("1")).toBe("Smith (smithj)");
+    expect(labels.get("2")).toBe("Smith (smithj2)");
+  });
+
+  it("labels a placeholder single-word name by the word itself", () => {
+    const labels = roomLabelsFor([prof("1", "smithj", "smithj")]);
+    expect(labels.get("1")).toBe("smithj");
+  });
+
+  it("uses the UTORid when there is no name at all", () => {
+    const labels = roomLabelsFor([prof("1", "", "smithj")]);
+    expect(labels.get("1")).toBe("smithj");
+  });
+
+  it("returns an empty map for no professors", () => {
+    expect(roomLabelsFor([]).size).toBe(0);
+  });
+});
diff --git a/src/app/api/classlists/route.ts b/src/app/api/classlists/route.ts
new file mode 100644
index 0000000..816443a
--- /dev/null
+++ b/src/app/api/classlists/route.ts
@@ -0,0 +1,329 @@
+import { NextRequest, NextResponse } from "next/server";
+
+import { prisma } from "@/lib/prisma";
+import { getCurrentUser } from "@/lib/auth";
+import { isAdmin } from "@/lib/adminWhitelist";
+import { roomLabelsFor } from "@/lib/roomLabel";
+import {
+  buildEnrollmentRows,
+  fullNameOf,
+  getCurrentSemester,
+  normalizeProfessorInputs,
+  normalizeStudentInputs,
+  normalizeUtorids,
+  upsertPersonByUtorid,
+  type RoomEnrollmentPlan,
+} from "@/lib/classlistService";
+
+// A large roster is a lot of upserts. The default 5s interactive-transaction
+// budget is not enough for a 1,000-student classlist.
+const CREATE_TRANSACTION_OPTIONS = { maxWait: 10_000, timeout: 120_000 } as const;
+
+// ---------------------------------------------------------------------------
+// GET /api/classlists
+// ---------------------------------------------------------------------------
+
+/**
+ * Returns the classlists the caller can reach, each with only the rooms they
+ * are actually enrolled in.
+ *
+ * This is the home page's data source. A student sees every room on their
+ * classlist; a professor sees one — their own; the admin who created the
+ * classlist sees all of them (their own as PROFESSOR, the rest as TA).
+ *
+ * Response: { classlists: [{ id, code, semester, isCreator, rooms: [...] }] }
+ */
+export async function GET() {
+  try {
+    const user = await getCurrentUser();
+    if (!user) {
+      return NextResponse.json({ error: "Authentication required." }, { status: 401 });
+    }
+
+    const enrollments = await prisma.courseEnrollment.findMany({
+      where: { userId: user.userId },
+      select: {
+        role: true,
+        course: {
+          select: {
+            id: true,
+            code: true,
+            name: true,
+            semester: true,
+            classlistId: true,
+            professorId: true,
+            professor: { select: { id: true, name: true, utorid: true, hasLoggedIn: true } },
+            classlist: {
+              select: { id: true, code: true, semester: true, createdById: true },
+            },
+            sessions: {
+              where: { status: "ACTIVE" },
+              select: { id: true, joinCode: true },
+              orderBy: { startTime: "desc" },
+              take: 1,
+            },
+          },
+        },
+      },
+    });
+
+    // A room from before classlists existed has no parent. Group it under its
+    // own id so it still appears rather than vanishing from the home page.
+    const groups = new Map<
+      string,
+      {
+        id: string;
+        code: string;
+        semester: string;
+        createdById: string | null;
+        rooms: (typeof enrollments)[number][];
+      }
+    >();
+
+    for (const enrollment of enrollments) {
+      const { course } = enrollment;
+      const key = course.classlistId ?? `room:${course.id}`;
+      const group = groups.get(key);
+      if (group) {
+        group.rooms.push(enrollment);
+      } else {
+        groups.set(key, {
+          id: course.classlist?.id ?? key,
+          code: course.classlist?.code ?? course.code,
+          semester: course.classlist?.semester ?? course.semester,
+          createdById: course.classlist?.createdById ?? null,
+          rooms: [enrollment],
+        });
+      }
+    }
+
+    const classlists = [...groups.values()].map((group) => {
+      // Disambiguate surnames within a classlist, not globally — two rooms
+      // only collide if they sit next to each other.
+      const labels = roomLabelsFor(
+        group.rooms
+          .map((e) => e.course.professor)
+          .filter((p): p is NonNullable<typeof p> => !!p)
+          .map((p) => ({ id: p.id, name: p.name, utorid: p.utorid }))
+      );
+
+      const rooms = group.rooms
+        .map((enrollment) => {
+          const { course } = enrollment;
+          const session = course.sessions[0] ?? null;
+          return {
+            id: course.id,
+            label: course.professor
+              ? (labels.get(course.professor.id) ?? course.name)
+              : course.name,
+            code: course.code,
+            role: enrollment.role,
+            professor: course.professor
+              ? {
+                  name: course.professor.name,
+                  utorid: course.professor.utorid,
+                  hasLoggedIn: course.professor.hasLoggedIn,
+                }
+              : null,
+            isMine: course.professorId === user.userId,
+            activeSession: session ? { id: session.id, joinCode: session.joinCode } : null,
+          };
+        })
+        .sort((a, b) => a.label.localeCompare(b.label));
+
+      return {
+        id: group.id,
+        code: group.code,
+        semester: group.semester,
+        isCreator: group.createdById === user.userId,
+        liveRoomCount: rooms.filter((r) => r.activeSession).length,
+        rooms,
+      };
+    });
+
+    classlists.sort((a, b) => a.code.localeCompare(b.code));
+
+    return NextResponse.json({ classlists });
+  } catch (error) {
+    console.error("[Classlists API] Failed to fetch classlists:", error);
+    return NextResponse.json(
+      { error: "An error occurred while fetching your classes." },
+      { status: 500 }
+    );
+  }
+}
+
+// ---------------------------------------------------------------------------
+// POST /api/classlists
+// ---------------------------------------------------------------------------
+
+/**
+ * Creates a classlist and one room per professor.
+ *
+ * The creating admin always gets a room of their own, plus TA access to every
+ * other room so they can see what is happening in them. Every other professor
+ * gets exactly one room and no access at all to the others.
+ *
+ * Request body:
+ *   {
+ *     code:        string
+ *     students:    Array<{ utorid, givenName, surname }>
+ *     professors?: Array<{ utorid, displayName? }> | string[]
+ *     tas?:        string[]    // TA on every room of this classlist
+ *   }
+ *
+ * Only admins (ADMIN_WHITELIST) may call this endpoint.
+ *
+ * Response: { classlist: { id, code, semester, rooms: [{ id, label, utorid }] } }
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const user = await getCurrentUser();
+    if (!user) {
+      return NextResponse.json({ error: "Authentication required." }, { status: 401 });
+    }
+
+    if (!isAdmin(user.utorid)) {
+      return NextResponse.json({ error: "Only admins can create classes." }, { status: 403 });
+    }
+
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
+    }
+
+    if (!body || typeof body !== "object") {
+      return NextResponse.json({ error: "Request body is required." }, { status: 400 });
+    }
+
+    const { code, students, professors, tas } = body as Record<string, unknown>;
+
+    if (!code || typeof code !== "string" || code.trim().length === 0) {
+      return NextResponse.json({ error: "Course code is required." }, { status: 400 });
+    }
+
+    if (!Array.isArray(students)) {
+      return NextResponse.json({ error: "Students list is required." }, { status: 400 });
+    }
+
+    const classCode = code.trim();
+    const semester = getCurrentSemester();
+    const creatorUtorid = user.utorid.toLowerCase();
+
+    const studentInputs = normalizeStudentInputs(students);
+    const taUtorids = normalizeUtorids(tas).filter((u) => u !== creatorUtorid);
+    // The creator always gets their own room, so listing them again is a no-op.
+    const professorInputs = normalizeProfessorInputs(professors).filter(
+      (p) => p.utorid !== creatorUtorid
+    );
+
+    const created = await prisma.$transaction(async (tx) => {
+      // The creator's row can be missing after a system wipe — their session
+      // cookie outlives the database.
+      await tx.user.upsert({
+        where: { id: user.userId },
+        update: {},
+        create: {
+          id: user.userId,
+          utorid: user.utorid,
+          email: user.email,
+          name: user.name,
+          role: "STUDENT",
+          hasLoggedIn: true,
+        },
+      });
+
+      const classlist = await tx.classlist.create({
+        data: { code: classCode, semester, createdById: user.userId },
+      });
+
+      // Professors, creator first — their room is the one they run.
+      const professorUsers = [{ id: user.userId, utorid: creatorUtorid }];
+      for (const input of professorInputs) {
+        const person = await upsertPersonByUtorid(tx, input.utorid, input.displayName);
+        professorUsers.push({ id: person.id, utorid: person.utorid });
+      }
+      const professorIds = new Set(professorUsers.map((p) => p.id));
+
+      const taIds: string[] = [];
+      for (const utorid of taUtorids) {
+        const person = await upsertPersonByUtorid(tx, utorid);
+        taIds.push(person.id);
+      }
+
+      const studentIds: string[] = [];
+      for (const student of studentInputs) {
+        const person = await tx.user.upsert({
+          where: { utorid: student.utorid },
+          update: { name: fullNameOf(student) },
+          create: {
+            utorid: student.utorid,
+            name: fullNameOf(student),
+            email: `${student.utorid}@mail.utoronto.ca`,
+            role: "STUDENT",
+          },
+          select: { id: true },
+        });
+        // A professor who also appears on the roster must not get student
+        // access to everyone else's rooms — that is exactly what this whole
+        // split exists to prevent.
+        if (!professorIds.has(person.id)) studentIds.push(person.id);
+      }
+
+      const plans: RoomEnrollmentPlan[] = [];
+      const rooms: { id: string; professorId: string; utorid: string }[] = [];
+
+      for (const professor of professorUsers) {
+        const room = await tx.course.create({
+          data: {
+            code: classCode,
+            name: classCode,
+            semester,
+            createdById: user.userId,
+            classlistId: classlist.id,
+            professorId: professor.id,
+          },
+          select: { id: true },
+        });
+
+        rooms.push({ id: room.id, professorId: professor.id, utorid: professor.utorid });
+        plans.push({
+          roomId: room.id,
+          professorId: professor.id,
+          // The admin who made the classlist watches every room they do not run.
+          taIds: [...(professor.id === user.userId ? [] : [user.userId]), ...taIds],
+          studentIds,
+        });
+      }
+
+      await tx.courseEnrollment.createMany({ data: buildEnrollmentRows(plans) });
+
+      const professorRecords = await tx.user.findMany({
+        where: { id: { in: [...professorIds] } },
+        select: { id: true, name: true, utorid: true },
+      });
+      const labels = roomLabelsFor(professorRecords);
+
+      return {
+        id: classlist.id,
+        code: classlist.code,
+        semester: classlist.semester,
+        rooms: rooms.map((room) => ({
+          id: room.id,
+          utorid: room.utorid,
+          label: labels.get(room.professorId) ?? room.utorid,
+        })),
+      };
+    }, CREATE_TRANSACTION_OPTIONS);
+
+    return NextResponse.json({ classlist: created }, { status: 201 });
+  } catch (error) {
+    console.error("[Classlists API] Failed to create classlist:", error);
+    return NextResponse.json(
+      { error: "An error occurred while creating the class." },
+      { status: 500 }
+    );
+  }
+}
diff --git a/src/app/api/courses/route.ts b/src/app/api/courses/route.ts
index 319fe76..5aaba11 100644
--- a/src/app/api/courses/route.ts
+++ b/src/app/api/courses/route.ts
@@ -1,30 +1,17 @@
-import { NextRequest, NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 
 import { prisma } from "@/lib/prisma";
 import { getCurrentUser } from "@/lib/auth";
-import { isAdmin } from "@/lib/adminWhitelist";
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-function getCurrentSemester(): string {
-  const now = new Date();
-  const month = now.getMonth() + 1; // 1-indexed
-  const year = now.getFullYear();
-  if (month <= 4) return `Winter ${year}`;
-  if (month <= 8) return `Summer ${year}`;
-  return `Fall ${year}`;
-}
 
 // ---------------------------------------------------------------------------
 // GET /api/courses
 // ---------------------------------------------------------------------------
 
 /**
- * Returns all courses the authenticated user is enrolled in (any role).
+ * Returns every room the authenticated user is enrolled in, with their role in
+ * it. Classes are created through POST /api/classlists, which makes the rooms.
  *
- * Response: { courses: [{ id, code, name, semester, role, createdById }] }
+ * Response: { courses: [{ id, code, name, semester, role, createdById, classlistId }] }
  */
 export async function GET() {
   try {
@@ -43,6 +30,7 @@ export async function GET() {
             name: true,
             semester: true,
             createdById: true,
+            classlistId: true,
           },
         },
       },
@@ -62,206 +50,3 @@ export async function GET() {
     );
   }
 }
-
-// ---------------------------------------------------------------------------
-// POST /api/courses
-// ---------------------------------------------------------------------------
-
-/**
- * Creates a new course and enrolls the professor + all students from the
- * parsed U of T classlist CSV.
- *
- * Request body:
- *   {
- *     code:     string
- *     students: Array<{ utorid, givenName, surname, ... }>
- *     tas?:     string[]         // optional TA UTORids
- *     professors?: string[]      // optional co-professor UTORids
- *   }
- *
- * Only admins (ADMIN_WHITELIST) may call this endpoint.
- *
- * Response: { course: { id, code, name, semester } }
- */
-export async function POST(request: NextRequest) {
-  try {
-    const user = await getCurrentUser();
-    if (!user) {
-      return NextResponse.json({ error: "Authentication required." }, { status: 401 });
-    }
-
-    if (!isAdmin(user.utorid)) {
-      return NextResponse.json({ error: "Only admins can create classes." }, { status: 403 });
-    }
-
-    let body: unknown;
-    try {
-      body = await request.json();
-    } catch {
-      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
-    }
-
-    if (!body || typeof body !== "object") {
-      return NextResponse.json({ error: "Request body is required." }, { status: 400 });
-    }
-
-    const { code, section, students, tas, professors } = body as Record<string, unknown>;
-
-    if (!code || typeof code !== "string" || code.trim().length === 0) {
-      return NextResponse.json({ error: "Course code is required." }, { status: 400 });
-    }
-
-    if (!Array.isArray(students)) {
-      return NextResponse.json({ error: "Students list is required." }, { status: 400 });
-    }
-
-    const parseUtorids = (raw: unknown): string[] =>
-      Array.isArray(raw)
-        ? (raw as unknown[])
-            .map((t) => (typeof t === "string" ? t.trim().toLowerCase() : ""))
-            .filter(Boolean)
-        : [];
-
-    const tasArray = parseUtorids(tas);
-    const professorsArray = parseUtorids(professors).filter(
-      (utorid) => utorid !== user.utorid.toLowerCase()
-    );
-
-    const semester = getCurrentSemester();
-    const courseCode = code.trim();
-    const courseName =
-      typeof section === "string" && section.trim()
-        ? `${courseCode} ${section.trim()}`
-        : courseCode;
-
-    // Create the course and enroll the professor in one transaction
-    const course = await prisma.$transaction(async (tx) => {
-      // Ensure the creator exists in the DB (in case of a system wipe).
-      // User.role stays STUDENT — being a professor is a CourseEnrollment.
-      await tx.user.upsert({
-        where: { id: user.userId },
-        update: {},
-        create: {
-          id: user.userId,
-          utorid: user.utorid,
-          email: user.email,
-          name: user.name,
-          role: "STUDENT",
-        },
-      });
-
-      const newCourse = await tx.course.create({
-        data: {
-          code: courseCode,
-          name: courseName,
-          semester,
-          createdById: user.userId,
-        },
-      });
-
-      // Enroll the professor
-      await tx.courseEnrollment.create({
-        data: {
-          userId: user.userId,
-          courseId: newCourse.id,
-          role: "PROFESSOR",
-        },
-      });
-
-      // Batch-upsert each student and enroll them
-      for (const student of students) {
-        const s = student as Record<string, string>;
-        const utorid = s.utorid?.trim();
-        if (!utorid || utorid === "Missing UTORid" || utorid === "ERROR") continue;
-
-        const name = `${s.givenName ?? ""} ${s.surname ?? ""}`.trim() || utorid;
-
-        const studentUser = await tx.user.upsert({
-          where: { utorid },
-          update: { name },
-          create: { utorid, name, email: `${utorid}@mail.utoronto.ca`, role: "STUDENT" },
-        });
-
-        // Skip if already enrolled (e.g. student in multiple sections)
-        await tx.courseEnrollment.upsert({
-          where: {
-            userId_courseId: { userId: studentUser.id, courseId: newCourse.id },
-          },
-          update: {},
-          create: {
-            userId: studentUser.id,
-            courseId: newCourse.id,
-            role: "STUDENT",
-          },
-        });
-      }
-
-      // Enroll co-professors (CourseEnrollment.role = "PROFESSOR"; User.role is NOT changed)
-      for (const utorid of professorsArray) {
-        const profUser = await tx.user.upsert({
-          where: { utorid },
-          update: {},
-          create: {
-            utorid,
-            name: utorid,
-            email: `${utorid}@mail.utoronto.ca`,
-            role: "STUDENT",
-          },
-        });
-
-        await tx.courseEnrollment.upsert({
-          where: {
-            userId_courseId: { userId: profUser.id, courseId: newCourse.id },
-          },
-          update: { role: "PROFESSOR" },
-          create: {
-            userId: profUser.id,
-            courseId: newCourse.id,
-            role: "PROFESSOR",
-          },
-        });
-      }
-
-      // Enroll TAs (CourseEnrollment.role = "TA"; User.role is NOT changed)
-      for (const utorid of tasArray) {
-        const taUser = await tx.user.upsert({
-          where: { utorid },
-          update: {},
-          create: {
-            utorid,
-            name: utorid,
-            email: `${utorid}@mail.utoronto.ca`,
-            role: "STUDENT",
-          },
-        });
-
-        await tx.courseEnrollment.upsert({
-          where: {
-            userId_courseId: { userId: taUser.id, courseId: newCourse.id },
-          },
-          update: { role: "TA" },
-          create: {
-            userId: taUser.id,
-            courseId: newCourse.id,
-            role: "TA",
-          },
-        });
-      }
-
-      return newCourse;
-    });
-
-    return NextResponse.json(
-      {
-        course: { id: course.id, code: course.code, name: course.name, semester: course.semester },
-      },
-      { status: 201 }
-    );
-  } catch (error) {
-    console.error("[Courses API] Failed to create course:", error);
-    return NextResponse.json(
-      { error: "An error occurred while creating the course." },
-      { status: 500 }
-    );
-  }
-}
diff --git a/src/app/api/users/lookup/route.ts b/src/app/api/users/lookup/route.ts
new file mode 100644
index 0000000..d6cbc26
--- /dev/null
+++ b/src/app/api/users/lookup/route.ts
@@ -0,0 +1,81 @@
+import { NextRequest, NextResponse } from "next/server";
+
+import { prisma } from "@/lib/prisma";
+import { getCurrentUser } from "@/lib/auth";
+import { isAdmin } from "@/lib/adminWhitelist";
+
+// ---------------------------------------------------------------------------
+// GET /api/users/lookup?utorids=smithj,doej
+//
+// Resolves UTORids to display names so the classlist form can autofill a
+// professor who is already known and ask for a temporary name for one who is
+// not.
+//
+// `hasLoggedIn` is the meaningful field: a user row can exist because someone
+// was on a roster or because an admin typed a placeholder for them, and in
+// neither case is `name` their real name.
+//
+// Admin-only — it discloses names for arbitrary UTORids.
+//
+// Response: { users: [{ utorid, name, hasLoggedIn, exists }] }
+// ---------------------------------------------------------------------------
+
+/** Refuse absurd batches; the form looks up a handful of professors at a time. */
+const MAX_LOOKUPS = 50;
+
+export async function GET(request: NextRequest) {
+  try {
+    const user = await getCurrentUser();
+    if (!user) {
+      return NextResponse.json({ error: "Authentication required." }, { status: 401 });
+    }
+
+    if (!isAdmin(user.utorid)) {
+      return NextResponse.json({ error: "Admins only." }, { status: 403 });
+    }
+
+    const raw = request.nextUrl.searchParams.get("utorids") ?? "";
+    const utorids = [
+      ...new Set(
+        raw
+          .split(",")
+          .map((u) => u.trim().toLowerCase())
+          .filter(Boolean)
+      ),
+    ];
+
+    if (utorids.length === 0) {
+      return NextResponse.json({ users: [] });
+    }
+
+    if (utorids.length > MAX_LOOKUPS) {
+      return NextResponse.json(
+        { error: `Too many UTORids — ${MAX_LOOKUPS} at a time.` },
+        { status: 400 }
+      );
+    }
+
+    const found = await prisma.user.findMany({
+      where: { utorid: { in: utorids } },
+      select: { utorid: true, name: true, hasLoggedIn: true },
+    });
+    const byUtorid = new Map(found.map((u) => [u.utorid, u]));
+
+    return NextResponse.json({
+      users: utorids.map((utorid) => {
+        const match = byUtorid.get(utorid);
+        return {
+          utorid,
+          exists: !!match,
+          // Only a signed-in user's name is worth autofilling — anything else
+          // is a placeholder the admin should be allowed to replace.
+          name: match?.hasLoggedIn ? match.name : null,
+          hasLoggedIn: match?.hasLoggedIn ?? false,
+        };
+      }),
+    });
+  } catch (error) {
+    console.error("[Users API] Failed to look up UTORids:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
diff --git a/src/app/create-class/components/PreviewClass.tsx b/src/app/create-class/components/PreviewClass.tsx
index 332aa63..5ee2e1e 100644
--- a/src/app/create-class/components/PreviewClass.tsx
+++ b/src/app/create-class/components/PreviewClass.tsx
@@ -1,13 +1,15 @@
 import { CheckCircle2, File as FileIcon, X } from "lucide-react";
 import { ProcessedClassData } from "@/utils/types";
 
+import ProfessorList, { type ProfessorRow } from "./ProfessorList";
+
 interface PreviewClassProps {
   file: File;
   processedData: ProcessedClassData | null;
   onClear: () => void;
   onSubmit: () => void;
-  professorsInput: string;
-  onProfessorsChange: (value: string) => void;
+  professorRows: ProfessorRow[];
+  onProfessorRowsChange: (rows: ProfessorRow[]) => void;
   tasInput: string;
   onTasChange: (value: string) => void;
   courseCodeInput: string;
@@ -19,8 +21,8 @@ export default function PreviewClass({
   processedData,
   onClear,
   onSubmit,
-  professorsInput,
-  onProfessorsChange,
+  professorRows,
+  onProfessorRowsChange,
   tasInput,
   onTasChange,
   courseCodeInput,
@@ -107,24 +109,7 @@ export default function PreviewClass({
         </div>
       )}
 
-      {/* Co-professor UTORid input */}
-      <div className="space-y-3 mt-4">
-        <label className="text-xl font-bold text-stone-900 tracking-tight block">
-          Add Professors <span className="text-stone-400 font-normal text-base">(optional)</span>
-        </label>
-        <p className="text-sm text-stone-500">
-          Enter UTORids separated by commas, spaces, or new lines. Co-professors can start sessions,
-          control slides, and manage this course.
-        </p>
-        <textarea
-          value={professorsInput}
-          spellCheck={false}
-          onChange={(e) => onProfessorsChange(e.target.value)}
-          placeholder={"smithj, doejohn, pannugun"}
-          rows={3}
-          className="w-full border-2 border-stone-100 rounded-md px-4 py-3 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm"
-        />
-      </div>
+      <ProfessorList rows={professorRows} onChange={onProfessorRowsChange} />
 
       {/* TA UTORid input */}
       <div className="space-y-3 mt-4">
@@ -133,7 +118,7 @@ export default function PreviewClass({
         </label>
         <p className="text-sm text-stone-500">
           Enter UTORids separated by commas, spaces, or new lines. TAs can answer all questions and
-          delete posts.
+          delete posts, in every room on this classlist.
         </p>
         <textarea
           value={tasInput}
@@ -149,7 +134,7 @@ export default function PreviewClass({
         onClick={onSubmit}
         className="w-full py-4 bg-green-500 text-white hover:bg-green-600 rounded-md font-bold shadow-sm transition-colors text-lg mt-8"
       >
-        Confirm & Create Lecture
+        Confirm & Create Classlist
       </button>
     </div>
   );
diff --git a/src/app/create-class/components/ProfessorList.tsx b/src/app/create-class/components/ProfessorList.tsx
new file mode 100644
index 0000000..0ca3794
--- /dev/null
+++ b/src/app/create-class/components/ProfessorList.tsx
@@ -0,0 +1,225 @@
+"use client";
+
+import { useEffect, useRef } from "react";
+import { CheckCircle2, Clock, Loader2, Plus, X } from "lucide-react";
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+export interface ProfessorRow {
+  /** Stable key — UTORids change as the admin types, so they cannot be keys. */
+  key: string;
+  utorid: string;
+  displayName: string;
+  /**
+   * idle     — nothing typed yet
+   * checking — lookup in flight
+   * known    — already signed in; name comes from their U of T account
+   * unknown  — never signed in; the admin supplies a temporary name
+   */
+  status: "idle" | "checking" | "known" | "unknown";
+}
+
+interface LookupResult {
+  utorid: string;
+  exists: boolean;
+  name: string | null;
+  hasLoggedIn: boolean;
+}
+
+export function emptyProfessorRow(): ProfessorRow {
+  return {
+    key: Math.random().toString(36).slice(2),
+    utorid: "",
+    displayName: "",
+    status: "idle",
+  };
+}
+
+interface ProfessorListProps {
+  rows: ProfessorRow[];
+  onChange: (rows: ProfessorRow[]) => void;
+}
+
+// ---------------------------------------------------------------------------
+// Component
+// ---------------------------------------------------------------------------
+
+export default function ProfessorList({ rows, onChange }: ProfessorListProps) {
+  // Always read the newest rows inside the debounce callback — the timer is set
+  // up when a UTORid changes but fires long after that render.
+  const rowsRef = useRef(rows);
+  rowsRef.current = rows;
+
+  const timers = useRef(new Map<string, ReturnType<typeof setTimeout>>());
+  useEffect(() => {
+    const pending = timers.current;
+    return () => {
+      for (const timer of pending.values()) clearTimeout(timer);
+      pending.clear();
+    };
+  }, []);
+
+  function patch(key: string, changes: Partial<ProfessorRow>) {
+    onChange(rowsRef.current.map((row) => (row.key === key ? { ...row, ...changes } : row)));
+  }
+
+  function handleUtoridChange(key: string, raw: string) {
+    const utorid = raw.trim().toLowerCase();
+    patch(key, { utorid, status: utorid ? "checking" : "idle" });
+
+    const existing = timers.current.get(key);
+    if (existing) clearTimeout(existing);
+    if (!utorid) return;
+
+    timers.current.set(
+      key,
+      setTimeout(() => {
+        timers.current.delete(key);
+        void lookup(key, utorid);
+      }, 400)
+    );
+  }
+
+  async function lookup(key: string, utorid: string) {
+    try {
+      const res = await fetch(`/api/users/lookup?utorids=${encodeURIComponent(utorid)}`);
+      if (!res.ok) throw new Error("lookup failed");
+      const data = (await res.json()) as { users: LookupResult[] };
+      const match = data.users?.[0];
+
+      // The admin may have kept typing while this was in flight; that response
+      // is about a UTORid they have already moved on from.
+      const current = rowsRef.current.find((row) => row.key === key);
+      if (!current || current.utorid !== utorid) return;
+
+      if (match?.hasLoggedIn && match.name) {
+        patch(key, { status: "known", displayName: match.name });
+      } else {
+        patch(key, { status: "unknown" });
+      }
+    } catch {
+      // Treat a failed lookup as an unknown user rather than blocking the form —
+      // the admin can still type a name, and the server re-checks anyway.
+      const current = rowsRef.current.find((row) => row.key === key);
+      if (current?.utorid === utorid) patch(key, { status: "unknown" });
+    }
+  }
+
+  function addRow() {
+    onChange([...rows, emptyProfessorRow()]);
+  }
+
+  function removeRow(key: string) {
+    const timer = timers.current.get(key);
+    if (timer) clearTimeout(timer);
+    timers.current.delete(key);
+    const remaining = rows.filter((row) => row.key !== key);
+    onChange(remaining.length > 0 ? remaining : [emptyProfessorRow()]);
+  }
+
+  return (
+    <div className="space-y-3 mt-4">
+      <label className="text-xl font-bold text-stone-900 tracking-tight block">
+        Add Professors <span className="text-stone-400 font-normal text-base">(optional)</span>
+      </label>
+      <p className="text-sm text-stone-500">
+        Each professor gets their own room, named after them, and can only see that room. You get a
+        room of your own plus TA access to all of theirs.
+      </p>
+
+      <div className="space-y-2">
+        {rows.map((row) => {
+          const known = row.status === "known";
+          return (
+            <div key={row.key} className="flex items-start gap-2">
+              <div className="flex-1 min-w-0">
+                <input
+                  type="text"
+                  value={row.utorid}
+                  spellCheck={false}
+                  onChange={(e) => handleUtoridChange(row.key, e.target.value)}
+                  placeholder="UTORid — e.g. smithj"
+                  className="w-full border-2 border-stone-100 rounded-md px-4 py-2.5 text-sm font-mono focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm"
+                />
+              </div>
+
+              <div className="flex-1 min-w-0">
+                <div className="relative">
+                  <input
+                    type="text"
+                    value={row.displayName}
+                    spellCheck={false}
+                    disabled={known}
+                    onChange={(e) => patch(row.key, { displayName: e.target.value })}
+                    placeholder="Full name — e.g. Jane Smith"
+                    className="w-full border-2 border-stone-100 rounded-md px-4 py-2.5 pr-9 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm disabled:bg-stone-50 disabled:text-stone-500"
+                  />
+                  {row.status === "checking" && (
+                    <Loader2 className="absolute right-3 top-1/2 -translate-y-1/2 w-4 h-4 text-stone-300 animate-spin" />
+                  )}
+                  {known && (
+                    <CheckCircle2 className="absolute right-3 top-1/2 -translate-y-1/2 w-4 h-4 text-emerald-500" />
+                  )}
+                  {row.status === "unknown" && (
+                    <Clock className="absolute right-3 top-1/2 -translate-y-1/2 w-4 h-4 text-amber-500" />
+                  )}
+                </div>
+                {known && (
+                  <p className="mt-1 text-xs text-emerald-600">Name from their U of T account.</p>
+                )}
+                {row.status === "unknown" && (
+                  <p className="mt-1 text-xs text-amber-600">
+                    Hasn&rsquo;t signed in yet — this name is temporary and is replaced by their
+                    real one when they do.
+                  </p>
+                )}
+              </div>
+
+              <button
+                type="button"
+                onClick={() => removeRow(row.key)}
+                aria-label="Remove professor"
+                className="mt-2.5 text-stone-300 hover:text-red-500 transition-colors shrink-0"
+              >
+                <X className="w-4 h-4" />
+              </button>
+            </div>
+          );
+        })}
+      </div>
+
+      <button
+        type="button"
+        onClick={addRow}
+        className="flex items-center gap-1.5 text-sm font-medium text-stone-500 hover:text-stone-900 transition-colors"
+      >
+        <Plus className="w-4 h-4" />
+        Add another professor
+      </button>
+    </div>
+  );
+}
+
+/** Drops blank rows and hands the API the shape it wants. */
+export function professorRowsToPayload(
+  rows: ProfessorRow[]
+): { utorid: string; displayName?: string }[] {
+  return rows
+    .filter((row) => row.utorid.trim().length > 0)
+    .map((row) => ({
+      utorid: row.utorid.trim().toLowerCase(),
+      // A known user's name is theirs already; only send a placeholder.
+      ...(row.status !== "known" && row.displayName.trim()
+        ? { displayName: row.displayName.trim() }
+        : {}),
+    }));
+}
+
+/** Rows with a UTORid but no name to show — the admin has nothing to label the room with. */
+export function professorRowsMissingNames(rows: ProfessorRow[]): string[] {
+  return rows
+    .filter((row) => row.utorid.trim().length > 0 && row.displayName.trim().length === 0)
+    .map((row) => row.utorid.trim().toLowerCase());
+}
diff --git a/src/app/create-class/page.tsx b/src/app/create-class/page.tsx
index cb02966..d9cf5ab 100644
--- a/src/app/create-class/page.tsx
+++ b/src/app/create-class/page.tsx
@@ -11,6 +11,12 @@ import { ArrowLeft } from "lucide-react";
 import NoPermissions from "./components/NoPermissions";
 import Upload from "./components/Upload";
 import PreviewClass from "./components/PreviewClass";
+import {
+  emptyProfessorRow,
+  professorRowsMissingNames,
+  professorRowsToPayload,
+  type ProfessorRow,
+} from "./components/ProfessorList";
 import { parseAndProcessCSV } from "@/utils/create-class";
 import type { ProcessedClassData } from "@/utils/types";
 
@@ -19,7 +25,7 @@ export default function CreateClassPage() {
   const [file, setFile] = useState<File | null>(null);
   const [processedData, setProcessedData] = useState<ProcessedClassData | null>(null);
   const [tasInput, setTasInput] = useState("");
-  const [professorsInput, setProfessorsInput] = useState("");
+  const [professorRows, setProfessorRows] = useState<ProfessorRow[]>([emptyProfessorRow()]);
   const [courseCodeInput, setCourseCodeInput] = useState("");
   const [user, setUser] = useState<User | null>(null);
   const [isAdmin, setIsAdmin] = useState(false);
@@ -59,7 +65,7 @@ export default function CreateClassPage() {
     setFile(null);
     setProcessedData(null);
     setTasInput("");
-    setProfessorsInput("");
+    setProfessorRows([emptyProfessorRow()]);
     setCourseCodeInput("");
     setSubmitError(null);
   };
@@ -72,13 +78,21 @@ export default function CreateClassPage() {
       .split(/[\n,\s]+/)
       .map((s) => s.trim())
       .filter(Boolean);
-    const professors = professorsInput
-      .split(/[\n,\s]+/)
-      .map((s) => s.trim())
-      .filter(Boolean);
+    // A room is labelled by its professor's name, so an unnamed professor
+    // would leave a room nobody can identify.
+    const unnamed = professorRowsMissingNames(professorRows);
+    if (unnamed.length > 0) {
+      setSubmitError(
+        `Add a name for ${unnamed.join(", ")} — it labels their room until they first sign in.`
+      );
+      setSubmitting(false);
+      return;
+    }
+
+    const professors = professorRowsToPayload(professorRows);
 
     try {
-      const res = await fetch("/api/courses", {
+      const res = await fetch("/api/classlists", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
@@ -90,7 +104,7 @@ export default function CreateClassPage() {
       });
       const data = await res.json();
       if (!res.ok) {
-        setSubmitError(data.error ?? "Failed to create course.");
+        setSubmitError(data.error ?? "Failed to create the class.");
         return;
       }
       router.push("/");
@@ -139,10 +153,11 @@ export default function CreateClassPage() {
         <div className="max-w-3xl w-full bg-white p-6 sm:p-8 rounded-md border-2 border-stone-100 shadow-sm space-y-6 z-10 mx-auto">
           <div className="mb-8">
             <h1 className="text-4xl font-bold text-stone-900 tracking-tight mb-2">
-              Create a Lecture
+              Create a Classlist
             </h1>
             <p className="text-lg text-stone-500">
-              Upload your student roster to create a new lecture.
+              Upload your student roster, then add the professors teaching it. Each one gets their
+              own room.
             </p>
           </div>
 
@@ -160,8 +175,8 @@ export default function CreateClassPage() {
               processedData={processedData}
               onClear={clearFile}
               onSubmit={submitting ? () => {} : submitClassCreation}
-              professorsInput={professorsInput}
-              onProfessorsChange={setProfessorsInput}
+              professorRows={professorRows}
+              onProfessorRowsChange={setProfessorRows}
               tasInput={tasInput}
               onTasChange={setTasInput}
               courseCodeInput={courseCodeInput}
@@ -169,7 +184,7 @@ export default function CreateClassPage() {
             />
           )}
 
-          {submitting && <p className="text-sm text-stone-500 text-center">Creating class…</p>}
+          {submitting && <p className="text-sm text-stone-500 text-center">Creating rooms…</p>}
         </div>
       </div>
       {footer()}
diff --git a/src/lib/classlistService.ts b/src/lib/classlistService.ts
new file mode 100644
index 0000000..d91a2eb
--- /dev/null
+++ b/src/lib/classlistService.ts
@@ -0,0 +1,181 @@
+import type { Prisma, Role } from "@/generated/prisma";
+
+// ---------------------------------------------------------------------------
+// Shared classlist helpers
+//
+// A classlist owns one room (Course) per professor. Everything in here is
+// about keeping those rooms consistent with each other: the same roster, the
+// same TAs, exactly one professor each.
+// ---------------------------------------------------------------------------
+
+export interface ProfessorInput {
+  utorid: string;
+  /** Temporary name to show until this person signs in. Ignored once they have. */
+  displayName?: string;
+}
+
+export interface StudentInput {
+  utorid: string;
+  givenName?: string;
+  surname?: string;
+}
+
+/** Placeholder UTORids the CSV parser emits for rows it could not read. */
+const INVALID_UTORIDS = new Set(["missing utorid", "error"]);
+
+export function getCurrentSemester(now: Date = new Date()): string {
+  const month = now.getMonth() + 1; // 1-indexed
+  const year = now.getFullYear();
+  if (month <= 4) return `Winter ${year}`;
+  if (month <= 8) return `Summer ${year}`;
+  return `Fall ${year}`;
+}
+
+/** Lower-cases, trims and de-duplicates a list of UTORids, dropping junk. */
+export function normalizeUtorids(raw: unknown): string[] {
+  if (!Array.isArray(raw)) return [];
+  const out = new Set<string>();
+  for (const entry of raw) {
+    if (typeof entry !== "string") continue;
+    const utorid = entry.trim().toLowerCase();
+    if (utorid && !INVALID_UTORIDS.has(utorid)) out.add(utorid);
+  }
+  return [...out];
+}
+
+/**
+ * Accepts either `["smithj"]` or `[{ utorid, displayName }]` and normalizes to
+ * the latter. The plain-string form exists because not every caller has a name
+ * to offer (adding a professor from the roster screen, for instance).
+ */
+export function normalizeProfessorInputs(raw: unknown): ProfessorInput[] {
+  if (!Array.isArray(raw)) return [];
+  const byUtorid = new Map<string, ProfessorInput>();
+
+  for (const entry of raw) {
+    let utorid = "";
+    let displayName: string | undefined;
+
+    if (typeof entry === "string") {
+      utorid = entry.trim().toLowerCase();
+    } else if (entry && typeof entry === "object") {
+      const record = entry as Record<string, unknown>;
+      utorid = typeof record.utorid === "string" ? record.utorid.trim().toLowerCase() : "";
+      const name = typeof record.displayName === "string" ? record.displayName.trim() : "";
+      if (name) displayName = name;
+    }
+
+    if (!utorid || INVALID_UTORIDS.has(utorid)) continue;
+
+    // Later entries win only when they carry a name the earlier one lacked.
+    const existing = byUtorid.get(utorid);
+    if (!existing) byUtorid.set(utorid, { utorid, displayName });
+    else if (!existing.displayName && displayName) existing.displayName = displayName;
+  }
+
+  return [...byUtorid.values()];
+}
+
+export function normalizeStudentInputs(raw: unknown): StudentInput[] {
+  if (!Array.isArray(raw)) return [];
+  const byUtorid = new Map<string, StudentInput>();
+
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const record = entry as Record<string, unknown>;
+    const utorid = typeof record.utorid === "string" ? record.utorid.trim().toLowerCase() : "";
+    if (!utorid || INVALID_UTORIDS.has(utorid)) continue;
+
+    byUtorid.set(utorid, {
+      utorid,
+      givenName: typeof record.givenName === "string" ? record.givenName.trim() : undefined,
+      surname: typeof record.surname === "string" ? record.surname.trim() : undefined,
+    });
+  }
+
+  return [...byUtorid.values()];
+}
+
+export function fullNameOf(student: StudentInput): string {
+  return `${student.givenName ?? ""} ${student.surname ?? ""}`.trim() || student.utorid;
+}
+
+type Tx = Prisma.TransactionClient;
+
+/**
+ * Finds or creates the User for a UTORid.
+ *
+ * `displayName` is only ever written to a user who has not signed in — their
+ * `name` is a placeholder at that point, so replacing it is an improvement.
+ * A real name from Shibboleth is never overwritten by something an admin typed.
+ */
+export async function upsertPersonByUtorid(
+  tx: Tx,
+  utorid: string,
+  displayName?: string
+): Promise<{ id: string; utorid: string; name: string; hasLoggedIn: boolean }> {
+  const existing = await tx.user.findUnique({
+    where: { utorid },
+    select: { id: true, utorid: true, name: true, hasLoggedIn: true },
+  });
+
+  if (!existing) {
+    return tx.user.create({
+      data: {
+        utorid,
+        name: displayName || utorid,
+        email: `${utorid}@mail.utoronto.ca`,
+        role: "STUDENT",
+      },
+      select: { id: true, utorid: true, name: true, hasLoggedIn: true },
+    });
+  }
+
+  if (displayName && !existing.hasLoggedIn && existing.name !== displayName) {
+    return tx.user.update({
+      where: { id: existing.id },
+      data: { name: displayName },
+      select: { id: true, utorid: true, name: true, hasLoggedIn: true },
+    });
+  }
+
+  return existing;
+}
+
+export interface RoomEnrollmentPlan {
+  roomId: string;
+  /** The room's one professor. */
+  professorId: string;
+  /** Everyone who gets TA access to this room (admin creator, classlist TAs). */
+  taIds: string[];
+  studentIds: string[];
+}
+
+/**
+ * Flattens per-room membership into CourseEnrollment rows, keeping the
+ * strongest role when someone appears in more than one list.
+ *
+ * The de-duplication matters: a classlist TA who is also on the student roster
+ * must not get two rows — the table has a unique (userId, courseId) — and must
+ * end up a TA, not a student.
+ */
+export function buildEnrollmentRows(
+  plans: RoomEnrollmentPlan[]
+): { userId: string; courseId: string; role: Role }[] {
+  const rows: { userId: string; courseId: string; role: Role }[] = [];
+
+  for (const plan of plans) {
+    const assigned = new Set<string>();
+    const add = (userId: string, role: Role) => {
+      if (assigned.has(userId)) return;
+      assigned.add(userId);
+      rows.push({ userId, courseId: plan.roomId, role });
+    };
+
+    add(plan.professorId, "PROFESSOR");
+    for (const id of plan.taIds) add(id, "TA");
+    for (const id of plan.studentIds) add(id, "STUDENT");
+  }
+
+  return rows;
+}
diff --git a/src/lib/roomLabel.ts b/src/lib/roomLabel.ts
new file mode 100644
index 0000000..0488db5
--- /dev/null
+++ b/src/lib/roomLabel.ts
@@ -0,0 +1,71 @@
+// ---------------------------------------------------------------------------
+// Room labels
+//
+// A room is labelled by its professor's surname alone — "Smith", never
+// "John Smith". The label is derived from User.name at read time rather than
+// stored, so it corrects itself when a professor signs in for the first time
+// and their placeholder name is replaced by the real one.
+// ---------------------------------------------------------------------------
+
+export interface RoomProfessor {
+  id: string;
+  name: string;
+  utorid: string;
+}
+
+/**
+ * The last whitespace-separated part of a name.
+ * Falls back to the whole string when there is only one part.
+ */
+export function surnameOf(fullName: string | null | undefined): string {
+  const parts = (fullName ?? "").trim().split(/\s+/).filter(Boolean);
+  if (parts.length === 0) return "";
+  return parts[parts.length - 1];
+}
+
+/** First initial with a period: "John Smith" → "J." Empty when there is no given name. */
+function givenInitial(fullName: string): string {
+  const parts = fullName.trim().split(/\s+/).filter(Boolean);
+  if (parts.length < 2) return "";
+  return `${parts[0][0].toUpperCase()}.`;
+}
+
+/**
+ * Labels for every professor on one classlist, keyed by user id.
+ *
+ * Surnames alone are ambiguous the moment a classlist has two professors named
+ * Smith, so colliding surnames gain a first initial ("J. Smith"), and a
+ * still-colliding pair falls back to the UTORid — which is unique by
+ * definition. Professors whose surnames are unique are never decorated.
+ */
+export function roomLabelsFor(professors: RoomProfessor[]): Map<string, string> {
+  const bySurname = new Map<string, RoomProfessor[]>();
+  for (const prof of professors) {
+    const surname = surnameOf(prof.name) || prof.utorid;
+    const group = bySurname.get(surname);
+    if (group) group.push(prof);
+    else bySurname.set(surname, [prof]);
+  }
+
+  const labels = new Map<string, string>();
+  for (const [surname, group] of bySurname) {
+    if (group.length === 1) {
+      labels.set(group[0].id, surname);
+      continue;
+    }
+
+    const withInitial = group.map((prof) => {
+      const initial = givenInitial(prof.name);
+      return { prof, label: initial ? `${initial} ${surname}` : surname };
+    });
+
+    const counts = new Map<string, number>();
+    for (const { label } of withInitial) counts.set(label, (counts.get(label) ?? 0) + 1);
+
+    for (const { prof, label } of withInitial) {
+      labels.set(prof.id, counts.get(label)! > 1 ? `${surname} (${prof.utorid})` : label);
+    }
+  }
+
+  return labels;
+}

From 48a6b9e9e762c187e83820f38995a6b86623a64f Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 07:49:57 -0400
Subject: [PATCH 17/29] Step 3c: manage a classlist across all of its rooms
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds the endpoints the manage screen needs, all of them fanning changes out to
every room so the rooms never drift apart:

  GET/PATCH/DELETE /api/classlists/[id]              detail, rename, delete
  GET/POST/PUT/DELETE .../students                   roster, pooled and synced
  POST/DELETE .../professors                         add or remove a room

Adding a professor builds their room seeded with the class's current roster
and TAs; removing one tears their room down. A professor and a room are the
same thing here, so neither can exist without the other. Removal refuses on
the last professor and on a live room.

Renaming fans out because every room carries its own copy of the code and
semester for display — renaming only the classlist would leave rooms labelled
with the old code.

Roster reads pool across rooms and keep the strongest role, so a TA in one
room is a TA on the class. Removing someone demotes a TA to student or drops a
student — one or the other, never a demote followed by a delete that undoes
it. Room owners are refused here and sent to the professors endpoint.

deleteRooms() in classlistService centralises the manual teardown order that
Course's lack of cascades requires.

Verified over HTTP against a dev server: 24 checks covering creation, adding
and removing professors, roster sync, TA demotion, rename fan-out, the refusal
cases, and deletion.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../[classlistId]/professors/route.ts         | 227 ++++++++++++
 src/app/api/classlists/[classlistId]/route.ts | 188 ++++++++++
 .../[classlistId]/students/route.ts           | 346 ++++++++++++++++++
 src/lib/classlistAccess.ts                    |  52 +++
 src/lib/classlistService.ts                   |  78 ++++
 5 files changed, 891 insertions(+)
 create mode 100644 src/app/api/classlists/[classlistId]/professors/route.ts
 create mode 100644 src/app/api/classlists/[classlistId]/route.ts
 create mode 100644 src/app/api/classlists/[classlistId]/students/route.ts
 create mode 100644 src/lib/classlistAccess.ts

diff --git a/src/app/api/classlists/[classlistId]/professors/route.ts b/src/app/api/classlists/[classlistId]/professors/route.ts
new file mode 100644
index 0000000..d4970d9
--- /dev/null
+++ b/src/app/api/classlists/[classlistId]/professors/route.ts
@@ -0,0 +1,227 @@
+import { NextRequest, NextResponse } from "next/server";
+
+import { prisma } from "@/lib/prisma";
+import { requireClasslistAdmin } from "@/lib/classlistAccess";
+import {
+  buildEnrollmentRows,
+  deleteRooms,
+  liveRoomIds,
+  normalizeProfessorInputs,
+  upsertPersonByUtorid,
+} from "@/lib/classlistService";
+import { roomLabelsFor } from "@/lib/roomLabel";
+
+interface RouteParams {
+  params: Promise<{ classlistId: string }>;
+}
+
+// ---------------------------------------------------------------------------
+// Professors on a classlist
+//
+// A professor *is* a room here — adding one builds a room, removing one tears
+// theirs down. There is no way to have a professor without a room or a room
+// without a professor.
+// ---------------------------------------------------------------------------
+
+// ---------------------------------------------------------------------------
+// POST /api/classlists/[classlistId]/professors
+// ---------------------------------------------------------------------------
+
+/**
+ * Adds a professor and creates their room, seeded with the class's existing
+ * roster and TAs plus the classlist creator as a TA.
+ *
+ * Request body: { utorid: string; displayName?: string }
+ * Response: { room: { id, label, utorid } }
+ */
+export async function POST(request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    const { classlist, roomIds } = access.context;
+
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
+    }
+
+    const [input] = normalizeProfessorInputs([body]);
+    if (!input) {
+      return NextResponse.json({ error: "A UTORid is required." }, { status: 400 });
+    }
+
+    const existingRoom = await prisma.course.findFirst({
+      where: { classlistId, professor: { utorid: input.utorid } },
+      select: { id: true },
+    });
+    if (existingRoom) {
+      return NextResponse.json(
+        { error: `${input.utorid} already runs a room on this class.` },
+        { status: 409 }
+      );
+    }
+
+    // Seed the new room from what the class already has. Reading one existing
+    // room is enough — they all carry the same roster.
+    const template = roomIds[0];
+    const seed = template
+      ? await prisma.courseEnrollment.findMany({
+          where: { courseId: template, role: { in: ["STUDENT", "TA"] } },
+          select: { userId: true, role: true },
+        })
+      : [];
+
+    const created = await prisma.$transaction(
+      async (tx) => {
+        const professor = await upsertPersonByUtorid(tx, input.utorid, input.displayName);
+
+        const room = await tx.course.create({
+          data: {
+            code: classlist.code,
+            name: classlist.code,
+            semester: classlist.semester,
+            createdById: classlist.createdById,
+            classlistId,
+            professorId: professor.id,
+          },
+          select: { id: true },
+        });
+
+        const taIds = new Set(seed.filter((e) => e.role === "TA").map((e) => e.userId));
+        // The creating admin watches every room but their own.
+        if (professor.id !== classlist.createdById) taIds.add(classlist.createdById);
+
+        // A professor never gets a student row in their own room, and the
+        // template room's professor is a stranger here — they stay out.
+        const otherProfessorIds = new Set(
+          (
+            await tx.course.findMany({
+              where: { classlistId, professorId: { not: null } },
+              select: { professorId: true },
+            })
+          )
+            .map((r) => r.professorId)
+            .filter((id): id is string => !!id && id !== professor.id)
+        );
+
+        const studentIds = seed
+          .filter((e) => e.role === "STUDENT")
+          .map((e) => e.userId)
+          .filter((id) => id !== professor.id && !otherProfessorIds.has(id));
+
+        await tx.courseEnrollment.createMany({
+          data: buildEnrollmentRows([
+            {
+              roomId: room.id,
+              professorId: professor.id,
+              taIds: [...taIds].filter((id) => !otherProfessorIds.has(id)),
+              studentIds,
+            },
+          ]),
+        });
+
+        return { roomId: room.id, professorId: professor.id, utorid: professor.utorid };
+      },
+      { maxWait: 10_000, timeout: 120_000 }
+    );
+
+    // Label against the whole class so a new Smith gets an initial and so does
+    // the Smith who was already there.
+    const professors = await prisma.course.findMany({
+      where: { classlistId, professorId: { not: null } },
+      select: { professor: { select: { id: true, name: true, utorid: true } } },
+    });
+    const labels = roomLabelsFor(
+      professors.map((p) => p.professor!).filter((p): p is NonNullable<typeof p> => !!p)
+    );
+
+    return NextResponse.json(
+      {
+        room: {
+          id: created.roomId,
+          utorid: created.utorid,
+          label: labels.get(created.professorId) ?? created.utorid,
+        },
+      },
+      { status: 201 }
+    );
+  } catch (error) {
+    console.error("[Classlists API] Failed to add professor:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// DELETE /api/classlists/[classlistId]/professors
+// ---------------------------------------------------------------------------
+
+/**
+ * Removes a professor by deleting their room and everything in it.
+ *
+ * Refuses while that room is live, and refuses to remove the last professor —
+ * a class with no rooms is not something the UI can get back out of.
+ *
+ * Request body: { utorid: string }
+ */
+export async function DELETE(request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
+    }
+
+    const { utorid } = (body as Record<string, unknown>) ?? {};
+    if (!utorid || typeof utorid !== "string" || !utorid.trim()) {
+      return NextResponse.json({ error: "utorid is required." }, { status: 400 });
+    }
+    const normalized = utorid.trim().toLowerCase();
+
+    const room = await prisma.course.findFirst({
+      where: { classlistId, professor: { utorid: normalized } },
+      select: { id: true },
+    });
+    if (!room) {
+      return NextResponse.json(
+        { error: "That person does not run a room on this class." },
+        { status: 404 }
+      );
+    }
+
+    const roomCount = await prisma.course.count({ where: { classlistId } });
+    if (roomCount <= 1) {
+      return NextResponse.json(
+        { error: "Cannot remove the last professor — delete the class instead." },
+        { status: 409 }
+      );
+    }
+
+    const live = await liveRoomIds([room.id]);
+    if (live.length > 0) {
+      return NextResponse.json(
+        { error: "That room is live. End the session before removing its professor." },
+        { status: 409 }
+      );
+    }
+
+    await deleteRooms([room.id]);
+
+    return NextResponse.json({ removed: normalized });
+  } catch (error) {
+    console.error("[Classlists API] Failed to remove professor:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
diff --git a/src/app/api/classlists/[classlistId]/route.ts b/src/app/api/classlists/[classlistId]/route.ts
new file mode 100644
index 0000000..a504729
--- /dev/null
+++ b/src/app/api/classlists/[classlistId]/route.ts
@@ -0,0 +1,188 @@
+import { NextRequest, NextResponse } from "next/server";
+
+import { prisma } from "@/lib/prisma";
+import { requireClasslistAdmin } from "@/lib/classlistAccess";
+import { deleteRooms, liveRoomIds } from "@/lib/classlistService";
+import { roomLabelsFor } from "@/lib/roomLabel";
+
+interface RouteParams {
+  params: Promise<{ classlistId: string }>;
+}
+
+// ---------------------------------------------------------------------------
+// GET /api/classlists/[classlistId]
+// ---------------------------------------------------------------------------
+
+/**
+ * Everything the manage screen needs: the class itself and its rooms, each
+ * with its professor and whether it is currently live.
+ *
+ * Response: { classlist: { id, code, semester, rooms: [...] } }
+ */
+export async function GET(_request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    const { classlist, roomIds } = access.context;
+
+    const rooms = await prisma.course.findMany({
+      where: { classlistId },
+      select: {
+        id: true,
+        professorId: true,
+        professor: { select: { id: true, name: true, utorid: true, hasLoggedIn: true } },
+        _count: { select: { enrollments: true } },
+      },
+    });
+
+    const live = new Set(await liveRoomIds(roomIds));
+    const labels = roomLabelsFor(
+      rooms
+        .map((r) => r.professor)
+        .filter((p): p is NonNullable<typeof p> => !!p)
+        .map((p) => ({ id: p.id, name: p.name, utorid: p.utorid }))
+    );
+
+    return NextResponse.json({
+      classlist: {
+        id: classlist.id,
+        code: classlist.code,
+        semester: classlist.semester,
+        createdById: classlist.createdById,
+        rooms: rooms
+          .map((room) => ({
+            id: room.id,
+            label: room.professorId ? (labels.get(room.professorId) ?? "") : "",
+            professor: room.professor
+              ? {
+                  name: room.professor.name,
+                  utorid: room.professor.utorid,
+                  hasLoggedIn: room.professor.hasLoggedIn,
+                }
+              : null,
+            memberCount: room._count.enrollments,
+            isLive: live.has(room.id),
+            isCreatorRoom: room.professorId === classlist.createdById,
+          }))
+          .sort((a, b) => a.label.localeCompare(b.label)),
+      },
+    });
+  } catch (error) {
+    console.error("[Classlists API] Failed to fetch classlist:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// PATCH /api/classlists/[classlistId]
+// ---------------------------------------------------------------------------
+
+/**
+ * Renames the class code and/or semester.
+ *
+ * Every room carries a copy of both for display, so the change fans out to all
+ * of them — leaving one room labelled with the old code would be worse than
+ * not renaming at all.
+ *
+ * Request body: { code?: string; semester?: string }
+ */
+export async function PATCH(request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
+    }
+
+    const { code, semester } = (body as Record<string, unknown>) ?? {};
+
+    if (code !== undefined && (typeof code !== "string" || code.trim().length === 0)) {
+      return NextResponse.json({ error: "Course code cannot be empty." }, { status: 400 });
+    }
+    if (semester !== undefined && (typeof semester !== "string" || semester.trim().length === 0)) {
+      return NextResponse.json({ error: "Semester cannot be empty." }, { status: 400 });
+    }
+
+    const updates: { code?: string; semester?: string } = {};
+    if (typeof code === "string") updates.code = code.trim();
+    if (typeof semester === "string") updates.semester = semester.trim();
+
+    if (Object.keys(updates).length === 0) {
+      return NextResponse.json({ error: "Nothing to update." }, { status: 400 });
+    }
+
+    const updated = await prisma.$transaction(async (tx) => {
+      const classlist = await tx.classlist.update({
+        where: { id: classlistId },
+        data: updates,
+        select: { id: true, code: true, semester: true },
+      });
+
+      await tx.course.updateMany({
+        where: { classlistId },
+        data: {
+          ...(updates.code ? { code: updates.code, name: updates.code } : {}),
+          ...(updates.semester ? { semester: updates.semester } : {}),
+        },
+      });
+
+      return classlist;
+    });
+
+    return NextResponse.json({ classlist: updated });
+  } catch (error) {
+    console.error("[Classlists API] Failed to rename classlist:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// DELETE /api/classlists/[classlistId]
+// ---------------------------------------------------------------------------
+
+/**
+ * Deletes the class, every room on it, and all of their Q&A and slides.
+ *
+ * Refuses while any room is live — ending someone else's lecture out from
+ * under them is not something to do by accident.
+ */
+export async function DELETE(_request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    const { roomIds } = access.context;
+
+    const live = await liveRoomIds(roomIds);
+    if (live.length > 0) {
+      return NextResponse.json(
+        {
+          error: `Cannot delete a class while ${live.length === 1 ? "a room is" : `${live.length} rooms are`} live. End the session first.`,
+        },
+        { status: 409 }
+      );
+    }
+
+    await deleteRooms(roomIds);
+    await prisma.classlist.delete({ where: { id: classlistId } });
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error("[Classlists API] Failed to delete classlist:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
diff --git a/src/app/api/classlists/[classlistId]/students/route.ts b/src/app/api/classlists/[classlistId]/students/route.ts
new file mode 100644
index 0000000..c904921
--- /dev/null
+++ b/src/app/api/classlists/[classlistId]/students/route.ts
@@ -0,0 +1,346 @@
+import { NextRequest, NextResponse } from "next/server";
+
+import { prisma } from "@/lib/prisma";
+import { requireClasslistAdmin } from "@/lib/classlistAccess";
+import { normalizeUtorids, upsertPersonByUtorid } from "@/lib/classlistService";
+
+interface RouteParams {
+  params: Promise<{ classlistId: string }>;
+}
+
+// ---------------------------------------------------------------------------
+// Roster management
+//
+// Every room on a classlist carries the same roster, so each of these fans the
+// change out across all of them. Reads take the union — a person counts as a
+// TA on the class if they are a TA in any of its rooms.
+//
+// Professors are never touched here; they are room owners, and
+// /api/classlists/[id]/professors is where they are added and removed.
+// ---------------------------------------------------------------------------
+
+/** Enrolls people in every room at once, skipping any room where they own it. */
+async function enrollAcrossRooms(
+  roomIds: string[],
+  userIds: string[],
+  role: "STUDENT" | "TA"
+): Promise<void> {
+  if (roomIds.length === 0 || userIds.length === 0) return;
+
+  const rooms = await prisma.course.findMany({
+    where: { id: { in: roomIds } },
+    select: { id: true, professorId: true },
+  });
+
+  await prisma.$transaction(
+    async (tx) => {
+      for (const room of rooms) {
+        for (const userId of userIds) {
+          // The room's professor keeps their PROFESSOR row — the partial
+          // unique index would not stop this, since it only guards against a
+          // *second* professor, but demoting the owner would orphan the room.
+          if (room.professorId === userId) continue;
+
+          await tx.courseEnrollment.upsert({
+            where: { userId_courseId: { userId, courseId: room.id } },
+            update: { role },
+            create: { userId, courseId: room.id, role },
+          });
+        }
+      }
+    },
+    { maxWait: 10_000, timeout: 120_000 }
+  );
+}
+
+// ---------------------------------------------------------------------------
+// GET /api/classlists/[classlistId]/students
+// ---------------------------------------------------------------------------
+
+/**
+ * The class roster, pooled across rooms.
+ *
+ * Response: { students, tas, professors } — each [{ name, utorid }]
+ */
+export async function GET(_request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    const { roomIds } = access.context;
+    if (roomIds.length === 0) {
+      return NextResponse.json({ students: [], tas: [], professors: [] });
+    }
+
+    const enrollments = await prisma.courseEnrollment.findMany({
+      where: { courseId: { in: roomIds } },
+      select: {
+        role: true,
+        user: { select: { id: true, name: true, utorid: true } },
+      },
+      orderBy: { user: { name: "asc" } },
+    });
+
+    // Strongest role wins: someone who is a TA in one room and a student in
+    // another is a TA on the class.
+    const rank = { STUDENT: 0, TA: 1, PROFESSOR: 2 } as const;
+    const best = new Map<string, { name: string; utorid: string; role: keyof typeof rank }>();
+
+    for (const enrollment of enrollments) {
+      const current = best.get(enrollment.user.id);
+      if (!current || rank[enrollment.role] > rank[current.role]) {
+        best.set(enrollment.user.id, {
+          name: enrollment.user.name,
+          utorid: enrollment.user.utorid,
+          role: enrollment.role,
+        });
+      }
+    }
+
+    const people = [...best.values()].sort((a, b) => a.name.localeCompare(b.name));
+    const entry = (p: (typeof people)[number]) => ({ name: p.name, utorid: p.utorid });
+
+    return NextResponse.json({
+      students: people.filter((p) => p.role === "STUDENT").map(entry),
+      tas: people.filter((p) => p.role === "TA").map(entry),
+      professors: people.filter((p) => p.role === "PROFESSOR").map(entry),
+    });
+  } catch (error) {
+    console.error("[Classlists API] Failed to fetch roster:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// POST /api/classlists/[classlistId]/students
+// ---------------------------------------------------------------------------
+
+/**
+ * Adds people to every room on the class.
+ *
+ * Request body: { utorids: string[]; role?: "STUDENT" | "TA" }
+ * Response: { added: string[] }
+ */
+export async function POST(request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
+    }
+
+    const { utorids, role } = (body as Record<string, unknown>) ?? {};
+    const normalized = normalizeUtorids(utorids);
+
+    if (normalized.length === 0) {
+      return NextResponse.json({ error: "utorids must be a non-empty array." }, { status: 400 });
+    }
+
+    if (role === "PROFESSOR") {
+      return NextResponse.json(
+        { error: "Add a professor through the professors endpoint — it creates their room." },
+        { status: 400 }
+      );
+    }
+
+    const enrollmentRole: "STUDENT" | "TA" = role === "TA" ? "TA" : "STUDENT";
+
+    const userIds: string[] = [];
+    await prisma.$transaction(async (tx) => {
+      for (const utorid of normalized) {
+        const person = await upsertPersonByUtorid(tx, utorid);
+        userIds.push(person.id);
+      }
+    });
+
+    await enrollAcrossRooms(access.context.roomIds, userIds, enrollmentRole);
+
+    return NextResponse.json({ added: normalized });
+  } catch (error) {
+    console.error("[Classlists API] Failed to add people:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// PUT /api/classlists/[classlistId]/students
+// ---------------------------------------------------------------------------
+
+/**
+ * Replaces the student roster from a fresh CSV upload.
+ *
+ * Students in the new list are added to every room; students no longer on it
+ * are removed from every room. TAs and professors are left alone — dropping
+ * the instructional team because they are not on a student roster would be a
+ * nasty surprise.
+ *
+ * Request body: { utorids: string[] }
+ * Response: { added, removed, unchanged }
+ */
+export async function PUT(request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    const { roomIds } = access.context;
+
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
+    }
+
+    const { utorids } = (body as Record<string, unknown>) ?? {};
+    if (!Array.isArray(utorids)) {
+      return NextResponse.json({ error: "utorids must be an array." }, { status: 400 });
+    }
+
+    const wanted = new Set(normalizeUtorids(utorids));
+
+    const current = await prisma.courseEnrollment.findMany({
+      where: { courseId: { in: roomIds }, role: "STUDENT" },
+      select: { user: { select: { id: true, utorid: true } } },
+    });
+    const currentByUtorid = new Map(current.map((e) => [e.user.utorid, e.user.id]));
+
+    const toAdd = [...wanted].filter((u) => !currentByUtorid.has(u));
+    const toRemove = [...currentByUtorid.keys()].filter((u) => !wanted.has(u));
+    const unchanged = [...currentByUtorid.keys()].filter((u) => wanted.has(u)).length;
+
+    const addedIds: string[] = [];
+    if (toAdd.length > 0) {
+      await prisma.$transaction(
+        async (tx) => {
+          for (const utorid of toAdd) {
+            const person = await upsertPersonByUtorid(tx, utorid);
+            addedIds.push(person.id);
+          }
+        },
+        { maxWait: 10_000, timeout: 120_000 }
+      );
+    }
+
+    // Only ever create STUDENT rows here: someone already a TA or professor in
+    // a room must keep that role even if they are on the student CSV.
+    if (addedIds.length > 0) {
+      const rooms = await prisma.course.findMany({
+        where: { id: { in: roomIds } },
+        select: { id: true },
+      });
+      await prisma.courseEnrollment.createMany({
+        data: rooms.flatMap((room) =>
+          addedIds.map((userId) => ({ userId, courseId: room.id, role: "STUDENT" as const }))
+        ),
+        skipDuplicates: true,
+      });
+    }
+
+    if (toRemove.length > 0) {
+      const removeIds = toRemove
+        .map((u) => currentByUtorid.get(u))
+        .filter((id): id is string => !!id);
+      await prisma.courseEnrollment.deleteMany({
+        where: { courseId: { in: roomIds }, userId: { in: removeIds }, role: "STUDENT" },
+      });
+    }
+
+    return NextResponse.json({ added: toAdd, removed: toRemove, unchanged });
+  } catch (error) {
+    console.error("[Classlists API] Failed to sync roster:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// DELETE /api/classlists/[classlistId]/students
+// ---------------------------------------------------------------------------
+
+/**
+ * Removes one person from every room on the class.
+ *
+ * A TA is demoted to student rather than dropped, matching what the room-level
+ * screen does — they stay reachable in a live session instead of being kicked
+ * mid-lecture. A student is removed outright.
+ *
+ * Request body: { utorid: string }
+ */
+export async function DELETE(request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    const { roomIds } = access.context;
+
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
+    }
+
+    const { utorid } = (body as Record<string, unknown>) ?? {};
+    if (!utorid || typeof utorid !== "string" || !utorid.trim()) {
+      return NextResponse.json({ error: "utorid is required." }, { status: 400 });
+    }
+
+    const normalized = utorid.trim().toLowerCase();
+    const target = await prisma.user.findUnique({
+      where: { utorid: normalized },
+      select: { id: true },
+    });
+    if (!target) {
+      return NextResponse.json({ error: "User not found." }, { status: 404 });
+    }
+
+    const ownsARoom = await prisma.course.findFirst({
+      where: { classlistId, professorId: target.id },
+      select: { id: true },
+    });
+    if (ownsARoom) {
+      return NextResponse.json(
+        { error: "That person runs a room. Remove them from the professors list instead." },
+        { status: 409 }
+      );
+    }
+
+    // Demote or drop, never both — running the demotion first and then
+    // deleting students would delete the person we just demoted.
+    const taRooms = await prisma.courseEnrollment.count({
+      where: { courseId: { in: roomIds }, userId: target.id, role: "TA" },
+    });
+
+    if (taRooms > 0) {
+      await prisma.courseEnrollment.updateMany({
+        where: { courseId: { in: roomIds }, userId: target.id, role: "TA" },
+        data: { role: "STUDENT" },
+      });
+      return NextResponse.json({ removed: normalized, demotedTo: "STUDENT" });
+    }
+
+    await prisma.courseEnrollment.deleteMany({
+      where: { courseId: { in: roomIds }, userId: target.id, role: "STUDENT" },
+    });
+
+    return NextResponse.json({ removed: normalized, demotedTo: null });
+  } catch (error) {
+    console.error("[Classlists API] Failed to remove person:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
diff --git a/src/lib/classlistAccess.ts b/src/lib/classlistAccess.ts
new file mode 100644
index 0000000..506b599
--- /dev/null
+++ b/src/lib/classlistAccess.ts
@@ -0,0 +1,52 @@
+import { prisma } from "@/lib/prisma";
+import { getCurrentUser, type AuthUser } from "@/lib/auth";
+import { isAdmin } from "@/lib/adminWhitelist";
+
+// ---------------------------------------------------------------------------
+// Classlist authorization
+//
+// Managing a classlist means touching every room on it at once — the roster,
+// the professors, the code. That is an admin action, the same as creating one.
+// A professor manages their own room through /api/courses/[courseId], never
+// through here.
+// ---------------------------------------------------------------------------
+
+export interface ClasslistContext {
+  user: AuthUser;
+  classlist: { id: string; code: string; semester: string; createdById: string };
+  roomIds: string[];
+}
+
+export type ClasslistAccess =
+  | { ok: true; context: ClasslistContext }
+  | { ok: false; error: string; status: number };
+
+export async function requireClasslistAdmin(classlistId: string): Promise<ClasslistAccess> {
+  const user = await getCurrentUser();
+  if (!user) {
+    return { ok: false, error: "Authentication required.", status: 401 };
+  }
+
+  if (!isAdmin(user.utorid)) {
+    return { ok: false, error: "Only admins can manage a class.", status: 403 };
+  }
+
+  const classlist = await prisma.classlist.findUnique({
+    where: { id: classlistId },
+    select: { id: true, code: true, semester: true, createdById: true },
+  });
+
+  if (!classlist) {
+    return { ok: false, error: "Class not found.", status: 404 };
+  }
+
+  const rooms = await prisma.course.findMany({
+    where: { classlistId },
+    select: { id: true },
+  });
+
+  return {
+    ok: true,
+    context: { user, classlist, roomIds: rooms.map((r) => r.id) },
+  };
+}
diff --git a/src/lib/classlistService.ts b/src/lib/classlistService.ts
index d91a2eb..cca8af6 100644
--- a/src/lib/classlistService.ts
+++ b/src/lib/classlistService.ts
@@ -1,4 +1,6 @@
 import type { Prisma, Role } from "@/generated/prisma";
+import { prisma } from "@/lib/prisma";
+import { deleteFile } from "@/lib/storage";
 
 // ---------------------------------------------------------------------------
 // Shared classlist helpers
@@ -179,3 +181,79 @@ export function buildEnrollmentRows(
 
   return rows;
 }
+
+// ---------------------------------------------------------------------------
+// Room teardown
+// ---------------------------------------------------------------------------
+
+/**
+ * Permanently removes rooms and everything hanging off them.
+ *
+ * Course has no cascades, so the order is manual:
+ *   QuestionUpvote → Answer → Question → slide files → SlideSet → Session
+ *   → CourseEnrollment → Course
+ *
+ * Slide files live on disk and are deleted first — a failure there is logged
+ * rather than thrown, since an orphaned file is a smaller problem than a
+ * half-deleted room.
+ */
+export async function deleteRooms(roomIds: string[]): Promise<void> {
+  if (roomIds.length === 0) return;
+
+  const sessions = await prisma.session.findMany({
+    where: { courseId: { in: roomIds } },
+    select: { id: true },
+  });
+  const sessionIds = sessions.map((s) => s.id);
+
+  if (sessionIds.length > 0) {
+    const slideSets = await prisma.slideSet.findMany({
+      where: { sessionId: { in: sessionIds } },
+      select: { storageKey: true },
+    });
+
+    await Promise.allSettled(
+      slideSets.map((slideSet) =>
+        deleteFile(slideSet.storageKey).catch((err) =>
+          console.error("[Classlist] Failed to delete slide file:", slideSet.storageKey, err)
+        )
+      )
+    );
+  }
+
+  await prisma.$transaction(
+    async (tx) => {
+      if (sessionIds.length > 0) {
+        const questions = await tx.question.findMany({
+          where: { sessionId: { in: sessionIds } },
+          select: { id: true },
+        });
+        const questionIds = questions.map((q) => q.id);
+
+        if (questionIds.length > 0) {
+          await tx.questionUpvote.deleteMany({ where: { questionId: { in: questionIds } } });
+          await tx.answer.deleteMany({ where: { questionId: { in: questionIds } } });
+          await tx.question.deleteMany({ where: { id: { in: questionIds } } });
+        }
+
+        await tx.slideSet.deleteMany({ where: { sessionId: { in: sessionIds } } });
+        await tx.session.deleteMany({ where: { id: { in: sessionIds } } });
+      }
+
+      await tx.courseEnrollment.deleteMany({ where: { courseId: { in: roomIds } } });
+      await tx.course.deleteMany({ where: { id: { in: roomIds } } });
+    },
+    { maxWait: 10_000, timeout: 120_000 }
+  );
+}
+
+/** Room ids of a classlist that currently have a live session. */
+export async function liveRoomIds(roomIds: string[]): Promise<string[]> {
+  if (roomIds.length === 0) return [];
+  const live = await prisma.session.findMany({
+    where: { courseId: { in: roomIds }, status: "ACTIVE" },
+    select: { courseId: true },
+    distinct: ["courseId"],
+  });
+  return live.map((s) => s.courseId);
+}

From 4517af63644e72a35b1a4c3e23c514538dc565a7 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 07:59:27 -0400
Subject: [PATCH 18/29] Step 3d: home page browses classes, then drills into
 their rooms
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces CourseViewer and ProfCourseViewer with one ClassBrowser. The gallery
now shows a card per class — TES101, not one card per room — with a badge when
any of its rooms is live. Opening a class swaps the gallery for its rooms,
behind a back link: one card per professor, green with a Join button when
live, and the professor's own room offering Start Live Session / End instead.

Only rooms the viewer is enrolled in are listed, so a professor's class opens
onto exactly one room while a student's opens onto all of them. That filtering
is the API's job, not the UI's — GET /api/classlists already returns only what
the caller can reach.

CourseViewer paired a course with its live session by matching course.name
against session.course.name, which quietly broke as soon as two classes shared
a name. The session now arrives attached to its room.

ManageClassModal moves to the classlist endpoints. Its Staff tab becomes
Rooms & TAs: the professor list is now a list of rooms showing who runs each,
how many members it has, and whether it is live, with the same UTORid-plus-name
entry the create form uses. Removing one says plainly that it deletes the room.

Onboarding picked its walkthrough from the global role, which is always STUDENT
now — a professor would have been shown the student one. It waits for the
enrollment answer and branches on that instead.

Verified across three signed-in dev servers: 25 checks that an admin sees every
room (professor of theirs, TA of the rest), a professor sees only their own and
is refused the others' sessions, roles and management, and a student sees all
rooms as a student. Plus 8 render tests for the drill-down itself.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/__tests__/class-browser.test.tsx | 227 ++++++++++++++
 src/app/classes/ManageClassModal.tsx | 439 +++++++++++++++++----------
 src/app/classes/ProfCourseViewer.tsx | 324 --------------------
 src/app/components/ClassBrowser.tsx  | 225 ++++++++++++++
 src/app/components/CourseViewer.tsx  | 166 ----------
 src/app/components/RoomGrid.tsx      | 246 +++++++++++++++
 src/app/components/classTypes.ts     |  28 ++
 src/app/page.tsx                     | 160 ++++------
 src/constants/onboarding.ts          |   4 +-
 tsconfig.json                        |   6 +-
 10 files changed, 1064 insertions(+), 761 deletions(-)
 create mode 100644 src/__tests__/class-browser.test.tsx
 delete mode 100644 src/app/classes/ProfCourseViewer.tsx
 create mode 100644 src/app/components/ClassBrowser.tsx
 delete mode 100644 src/app/components/CourseViewer.tsx
 create mode 100644 src/app/components/RoomGrid.tsx
 create mode 100644 src/app/components/classTypes.ts

diff --git a/src/__tests__/class-browser.test.tsx b/src/__tests__/class-browser.test.tsx
new file mode 100644
index 0000000..cc35873
--- /dev/null
+++ b/src/__tests__/class-browser.test.tsx
@@ -0,0 +1,227 @@
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+
+import ClassBrowser from "@/app/components/ClassBrowser";
+import type { ClasslistSummary } from "@/app/components/classTypes";
+
+const push = vi.fn();
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push, replace: vi.fn() }),
+}));
+
+function classlist(overrides: Partial<ClasslistSummary> = {}): ClasslistSummary {
+  return {
+    id: "cl1",
+    code: "TES101",
+    semester: "Fall 2026",
+    isCreator: false,
+    liveRoomCount: 0,
+    rooms: [],
+    ...overrides,
+  };
+}
+
+function mockClasslists(classlists: ClasslistSummary[]) {
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (input: string) => {
+      if (String(input).startsWith("/api/classlists")) {
+        return { ok: true, json: async () => ({ classlists }) } as Response;
+      }
+      return { ok: true, json: async () => ({}) } as Response;
+    })
+  );
+}
+
+beforeEach(() => {
+  push.mockClear();
+});
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe("ClassBrowser", () => {
+  test("shows one card per class, not per room", async () => {
+    mockClasslists([
+      classlist({
+        rooms: [
+          {
+            id: "r1",
+            label: "Smith",
+            code: "TES101",
+            role: "STUDENT",
+            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: true },
+            isMine: false,
+            activeSession: null,
+          },
+          {
+            id: "r2",
+            label: "Haddad",
+            code: "TES101",
+            role: "STUDENT",
+            professor: { name: "Omar Haddad", utorid: "haddado", hasLoggedIn: true },
+            isMine: false,
+            activeSession: null,
+          },
+        ],
+      }),
+    ]);
+
+    render(<ClassBrowser isAdmin={false} />);
+
+    expect(await screen.findByText("TES101")).toBeTruthy();
+    expect(screen.getByText("2 rooms")).toBeTruthy();
+    // The rooms are behind the drill-down, not on the class card.
+    expect(screen.queryByText("Smith")).toBeNull();
+  });
+
+  test("opening a class reveals its rooms and a way back", async () => {
+    mockClasslists([
+      classlist({
+        liveRoomCount: 1,
+        rooms: [
+          {
+            id: "r1",
+            label: "Smith",
+            code: "TES101",
+            role: "STUDENT",
+            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: true },
+            isMine: false,
+            activeSession: { id: "s1", joinCode: "ABC123" },
+          },
+          {
+            id: "r2",
+            label: "Haddad",
+            code: "TES101",
+            role: "STUDENT",
+            professor: { name: "Omar Haddad", utorid: "haddado", hasLoggedIn: true },
+            isMine: false,
+            activeSession: null,
+          },
+        ],
+      }),
+    ]);
+
+    render(<ClassBrowser isAdmin={false} />);
+    fireEvent.click(await screen.findByText("TES101"));
+
+    expect(screen.getByText("Smith")).toBeTruthy();
+    expect(screen.getByText("Haddad")).toBeTruthy();
+    // Live room offers Join; the other says so plainly.
+    expect(screen.getByRole("button", { name: /join/i })).toBeTruthy();
+    expect(screen.getByText("Not live right now")).toBeTruthy();
+
+    fireEvent.click(screen.getByRole("button", { name: /all classes/i }));
+    expect(screen.getByText("2 rooms")).toBeTruthy();
+  });
+
+  test("a professor's own room offers Start Live Session, not Join", async () => {
+    mockClasslists([
+      classlist({
+        rooms: [
+          {
+            id: "r1",
+            label: "Smith",
+            code: "TES101",
+            role: "PROFESSOR",
+            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: true },
+            isMine: true,
+            activeSession: null,
+          },
+        ],
+      }),
+    ]);
+
+    render(<ClassBrowser isAdmin={false} />);
+    fireEvent.click(await screen.findByText("TES101"));
+
+    expect(screen.getByRole("button", { name: /start live session/i })).toBeTruthy();
+    expect(screen.queryByRole("button", { name: /^join$/i })).toBeNull();
+    expect(screen.getByText("Your room")).toBeTruthy();
+  });
+
+  test("flags a room whose professor has not signed in yet", async () => {
+    mockClasslists([
+      classlist({
+        rooms: [
+          {
+            id: "r1",
+            label: "Smith",
+            code: "TES101",
+            role: "STUDENT",
+            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: false },
+            isMine: false,
+            activeSession: null,
+          },
+        ],
+      }),
+    ]);
+
+    render(<ClassBrowser isAdmin={false} />);
+    fireEvent.click(await screen.findByText("TES101"));
+
+    expect(screen.getByText(/Temporary name/)).toBeTruthy();
+  });
+
+  test("only the class creator gets the manage control", async () => {
+    mockClasslists([
+      classlist({ isCreator: false }),
+      classlist({ id: "cl2", code: "TES202", isCreator: true }),
+    ]);
+
+    render(<ClassBrowser isAdmin />);
+
+    await screen.findByText("TES101");
+    expect(screen.queryByLabelText("Manage TES101")).toBeNull();
+    expect(screen.getByLabelText("Manage TES202")).toBeTruthy();
+  });
+
+  test("a class deleted elsewhere drops the drill-down instead of blanking", async () => {
+    let current: ClasslistSummary[] = [
+      classlist({
+        rooms: [
+          {
+            id: "r1",
+            label: "Smith",
+            code: "TES101",
+            role: "STUDENT",
+            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: true },
+            isMine: false,
+            activeSession: null,
+          },
+        ],
+      }),
+    ];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => ({ ok: true, json: async () => ({ classlists: current }) }) as Response)
+    );
+    vi.useFakeTimers({ shouldAdvanceTime: true });
+
+    render(<ClassBrowser isAdmin={false} />);
+    fireEvent.click(await screen.findByText("TES101"));
+    expect(screen.getByText("Smith")).toBeTruthy();
+
+    current = [];
+    await vi.advanceTimersByTimeAsync(8000);
+
+    await waitFor(() => expect(screen.getByText("No Classes Found")).toBeTruthy());
+    vi.useRealTimers();
+  });
+
+  test("tells an admin with nothing how to start", async () => {
+    mockClasslists([]);
+    render(<ClassBrowser isAdmin />);
+    expect(await screen.findByText("No Classes Yet")).toBeTruthy();
+    expect(screen.getByRole("link", { name: /create a classlist/i })).toBeTruthy();
+  });
+
+  test("does not offer a non-admin a way to create one", async () => {
+    mockClasslists([]);
+    render(<ClassBrowser isAdmin={false} />);
+    expect(await screen.findByText("No Classes Found")).toBeTruthy();
+    expect(screen.queryByRole("link", { name: /create/i })).toBeNull();
+  });
+});
diff --git a/src/app/classes/ManageClassModal.tsx b/src/app/classes/ManageClassModal.tsx
index 46c22fe..dd1b1b8 100644
--- a/src/app/classes/ManageClassModal.tsx
+++ b/src/app/classes/ManageClassModal.tsx
@@ -18,18 +18,18 @@ import { parseAndProcessCSV } from "@/utils/create-class";
 // Types
 // ---------------------------------------------------------------------------
 
-export interface CourseForModal {
+export interface ClasslistForModal {
   id: string;
   code: string;
-  name: string;
   semester: string;
 }
 
 interface ManageClassModalProps {
-  course: CourseForModal;
+  classlist: ClasslistForModal;
   onClose: () => void;
-  onRenamed: (courseId: string, code: string, semester: string) => void;
-  onDeleted: (courseId: string) => void;
+  /** Anything that changed the class — the caller re-fetches. */
+  onChanged: () => void;
+  onDeleted: () => void;
 }
 
 type Tab = "students" | "staff" | "rename" | "delete";
@@ -39,6 +39,15 @@ interface RosterEntry {
   utorid: string;
 }
 
+interface RoomEntry {
+  id: string;
+  label: string;
+  professor: { name: string; utorid: string; hasLoggedIn: boolean } | null;
+  memberCount: number;
+  isLive: boolean;
+  isCreatorRoom: boolean;
+}
+
 // ---------------------------------------------------------------------------
 // Helper: split "Given Surname" into two parts
 // ---------------------------------------------------------------------------
@@ -183,9 +192,9 @@ function RosterTable({
 // ---------------------------------------------------------------------------
 
 export default function ManageClassModal({
-  course,
+  classlist,
   onClose,
-  onRenamed,
+  onChanged,
   onDeleted,
 }: ManageClassModalProps) {
   const [activeTab, setActiveTab] = useState<Tab>("students");
@@ -193,14 +202,13 @@ export default function ManageClassModal({
   // ---- Roster state ----
   const [rosterStudents, setRosterStudents] = useState<RosterEntry[]>([]);
   const [rosterTas, setRosterTas] = useState<RosterEntry[]>([]);
-  const [rosterProfessors, setRosterProfessors] = useState<RosterEntry[]>([]);
+  const [rooms, setRooms] = useState<RoomEntry[]>([]);
   const [rosterLoading, setRosterLoading] = useState(true);
   const [rosterError, setRosterError] = useState<string | null>(null);
 
   // ---- Search state ----
   const [studentSearch, setStudentSearch] = useState("");
   const [taSearch, setTaSearch] = useState("");
-  const [professorSearch, setProfessorSearch] = useState("");
 
   // ---- Remove state ----
   const [removingUtorid, setRemovingUtorid] = useState<string | null>(null);
@@ -209,32 +217,23 @@ export default function ManageClassModal({
   // ---- Add students state ----
   const [utoridsInput, setUtoridsInput] = useState("");
   const [addingStudents, setAddingStudents] = useState(false);
-  const [addResult, setAddResult] = useState<{
-    added: string[];
-    alreadyEnrolled: string[];
-    invalid: string[];
-  } | null>(null);
+  const [addResult, setAddResult] = useState<{ added: string[] } | null>(null);
   const [addError, setAddError] = useState<string | null>(null);
 
   // ---- Add TAs state ----
   const [taUtoridsInput, setTaUtoridsInput] = useState("");
   const [addingTas, setAddingTas] = useState(false);
-  const [taAddResult, setTaAddResult] = useState<{
-    added: string[];
-    alreadyEnrolled: string[];
-    invalid: string[];
-  } | null>(null);
+  const [taAddResult, setTaAddResult] = useState<{ added: string[] } | null>(null);
   const [taAddError, setTaAddError] = useState<string | null>(null);
 
-  // ---- Add professors state ----
-  const [professorUtoridsInput, setProfessorUtoridsInput] = useState("");
-  const [addingProfessors, setAddingProfessors] = useState(false);
-  const [professorAddResult, setProfessorAddResult] = useState<{
-    added: string[];
-    alreadyEnrolled: string[];
-    invalid: string[];
-  } | null>(null);
+  // ---- Add professor state ----
+  const [professorUtorid, setProfessorUtorid] = useState("");
+  const [professorName, setProfessorName] = useState("");
+  const [professorKnown, setProfessorKnown] = useState(false);
+  const [addingProfessor, setAddingProfessor] = useState(false);
   const [professorAddError, setProfessorAddError] = useState<string | null>(null);
+  const [professorAddSuccess, setProfessorAddSuccess] = useState<string | null>(null);
+  const [removingRoomUtorid, setRemovingRoomUtorid] = useState<string | null>(null);
 
   // ---- CSV sync state ----
   const csvInputRef = useRef<HTMLInputElement>(null);
@@ -257,8 +256,8 @@ export default function ManageClassModal({
   const [csvError, setCsvError] = useState<string | null>(null);
 
   // ---- Rename state ----
-  const [newCode, setNewCode] = useState(course.code);
-  const [newSemester, setNewSemester] = useState(course.semester);
+  const [newCode, setNewCode] = useState(classlist.code);
+  const [newSemester, setNewSemester] = useState(classlist.semester);
   const [renaming, setRenaming] = useState(false);
   const [renameError, setRenameError] = useState<string | null>(null);
   const [renameSuccess, setRenameSuccess] = useState(false);
@@ -275,15 +274,22 @@ export default function ManageClassModal({
   async function fetchRoster() {
     setRosterError(null);
     try {
-      const res = await fetch(`/api/courses/${course.id}/students`);
-      const data = await res.json();
-      if (!res.ok) {
-        setRosterError(data.error ?? "Failed to load roster.");
+      const [rosterRes, detailRes] = await Promise.all([
+        fetch(`/api/classlists/${classlist.id}/students`),
+        fetch(`/api/classlists/${classlist.id}`),
+      ]);
+      const rosterData = await rosterRes.json();
+      if (!rosterRes.ok) {
+        setRosterError(rosterData.error ?? "Failed to load roster.");
         return;
       }
-      setRosterStudents(data.students ?? []);
-      setRosterTas(data.tas ?? []);
-      setRosterProfessors(data.professors ?? []);
+      setRosterStudents(rosterData.students ?? []);
+      setRosterTas(rosterData.tas ?? []);
+
+      if (detailRes.ok) {
+        const detailData = await detailRes.json();
+        setRooms(detailData.classlist?.rooms ?? []);
+      }
     } catch {
       setRosterError("Failed to load roster.");
     } finally {
@@ -294,7 +300,7 @@ export default function ManageClassModal({
   useEffect(() => {
     fetchRoster();
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [course.id]);
+  }, [classlist.id]);
 
   // Recompute the CSV diff whenever either the parsed UTORids or the loaded
   // roster changes — this prevents stale-closure bugs where the roster hadn't
@@ -315,7 +321,7 @@ export default function ManageClassModal({
     setRemovingUtorid(utorid);
     setRemoveError(null);
     try {
-      const res = await fetch(`/api/courses/${course.id}/students`, {
+      const res = await fetch(`/api/classlists/${classlist.id}/students`, {
         method: "DELETE",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ utorid }),
@@ -325,10 +331,10 @@ export default function ManageClassModal({
         setRemoveError(data.error ?? "Failed to remove.");
         return;
       }
-      // Optimistically remove from local state
-      setRosterStudents((prev) => prev.filter((e) => e.utorid !== utorid));
-      setRosterTas((prev) => prev.filter((e) => e.utorid !== utorid));
-      setRosterProfessors((prev) => prev.filter((e) => e.utorid !== utorid));
+      // A TA is demoted to student rather than dropped, so re-read rather than
+      // guessing which list they landed in.
+      await fetchRoster();
+      onChanged();
     } catch {
       setRemoveError("Failed to remove. Please try again.");
     } finally {
@@ -348,7 +354,7 @@ export default function ManageClassModal({
     setAddResult(null);
 
     try {
-      const res = await fetch(`/api/courses/${course.id}/students`, {
+      const res = await fetch(`/api/classlists/${classlist.id}/students`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ utorids }),
@@ -380,7 +386,7 @@ export default function ManageClassModal({
     setTaAddResult(null);
 
     try {
-      const res = await fetch(`/api/courses/${course.id}/students`, {
+      const res = await fetch(`/api/classlists/${classlist.id}/students`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ utorids, role: "TA" }),
@@ -400,35 +406,97 @@ export default function ManageClassModal({
     }
   }
 
-  async function handleAddProfessors() {
-    const utorids = professorUtoridsInput
-      .split(/[\n,\s]+/)
-      .map((s) => s.trim())
-      .filter(Boolean);
-    if (utorids.length === 0) return;
+  // Adding a professor builds a room, so it takes one UTORid at a time and
+  // needs a name to label that room with.
+  async function handleProfessorUtoridChange(raw: string) {
+    const utorid = raw.trim().toLowerCase();
+    setProfessorUtorid(utorid);
+    setProfessorAddError(null);
+    setProfessorAddSuccess(null);
+    if (!utorid) {
+      setProfessorKnown(false);
+      setProfessorName("");
+      return;
+    }
 
-    setAddingProfessors(true);
+    try {
+      const res = await fetch(`/api/users/lookup?utorids=${encodeURIComponent(utorid)}`);
+      if (!res.ok) return;
+      const data = await res.json();
+      const match = data.users?.[0];
+      // The field may have moved on while this was in flight.
+      if (match?.utorid !== utorid) return;
+      if (match.hasLoggedIn && match.name) {
+        setProfessorKnown(true);
+        setProfessorName(match.name);
+      } else {
+        setProfessorKnown(false);
+      }
+    } catch {
+      /* leave the name editable — the admin can type one */
+    }
+  }
+
+  async function handleAddProfessor() {
+    const utorid = professorUtorid.trim().toLowerCase();
+    if (!utorid) return;
+    if (!professorName.trim()) {
+      setProfessorAddError("Add a name — it labels their room until they first sign in.");
+      return;
+    }
+
+    setAddingProfessor(true);
     setProfessorAddError(null);
-    setProfessorAddResult(null);
+    setProfessorAddSuccess(null);
 
     try {
-      const res = await fetch(`/api/courses/${course.id}/students`, {
+      const res = await fetch(`/api/classlists/${classlist.id}/professors`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ utorids, role: "PROFESSOR" }),
+        body: JSON.stringify({
+          utorid,
+          ...(professorKnown ? {} : { displayName: professorName.trim() }),
+        }),
+      });
+      const data = await res.json();
+      if (!res.ok) {
+        setProfessorAddError(data.error ?? "Failed to add the professor.");
+        return;
+      }
+      setProfessorAddSuccess(`Created a room for ${data.room?.label ?? utorid}.`);
+      setProfessorUtorid("");
+      setProfessorName("");
+      setProfessorKnown(false);
+      await fetchRoster();
+      onChanged();
+    } catch {
+      setProfessorAddError("Failed to add the professor. Please try again.");
+    } finally {
+      setAddingProfessor(false);
+    }
+  }
+
+  async function handleRemoveRoom(utorid: string) {
+    setRemovingRoomUtorid(utorid);
+    setProfessorAddError(null);
+    setProfessorAddSuccess(null);
+    try {
+      const res = await fetch(`/api/classlists/${classlist.id}/professors`, {
+        method: "DELETE",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ utorid }),
       });
       const data = await res.json();
       if (!res.ok) {
-        setProfessorAddError(data.error ?? "Failed to add professors.");
+        setProfessorAddError(data.error ?? "Failed to remove the professor.");
         return;
       }
-      setProfessorAddResult(data);
-      setProfessorUtoridsInput("");
       await fetchRoster();
+      onChanged();
     } catch {
-      setProfessorAddError("Failed to add professors. Please try again.");
+      setProfessorAddError("Failed to remove the professor. Please try again.");
     } finally {
-      setAddingProfessors(false);
+      setRemovingRoomUtorid(null);
     }
   }
 
@@ -464,7 +532,7 @@ export default function ManageClassModal({
     setCsvSyncing(true);
     setCsvError(null);
     try {
-      const res = await fetch(`/api/courses/${course.id}/students`, {
+      const res = await fetch(`/api/classlists/${classlist.id}/students`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ utorids: csvPreview.utorids }),
@@ -479,6 +547,7 @@ export default function ManageClassModal({
       setCsvParsedUtorids(null);
       if (csvInputRef.current) csvInputRef.current.value = "";
       await fetchRoster();
+      onChanged();
     } catch {
       setCsvError("Failed to sync roster. Please try again.");
     } finally {
@@ -493,41 +562,41 @@ export default function ManageClassModal({
     setRenameSuccess(false);
 
     try {
-      const res = await fetch(`/api/courses/${course.id}`, {
+      const res = await fetch(`/api/classlists/${classlist.id}`, {
         method: "PATCH",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ code: newCode.trim(), semester: newSemester.trim() }),
       });
       const data = await res.json();
       if (!res.ok) {
-        setRenameError(data.error ?? "Failed to rename course.");
+        setRenameError(data.error ?? "Failed to rename the class.");
         return;
       }
       setRenameSuccess(true);
-      onRenamed(course.id, newCode.trim(), newSemester.trim());
+      onChanged();
     } catch {
-      setRenameError("Failed to rename course. Please try again.");
+      setRenameError("Failed to rename the class. Please try again.");
     } finally {
       setRenaming(false);
     }
   }
 
   async function handleDelete() {
-    if (deleteConfirmCode !== course.code) return;
+    if (deleteConfirmCode !== classlist.code) return;
     setDeleting(true);
     setDeleteError(null);
 
     try {
-      const res = await fetch(`/api/courses/${course.id}`, { method: "DELETE" });
+      const res = await fetch(`/api/classlists/${classlist.id}`, { method: "DELETE" });
       const data = await res.json();
       if (!res.ok) {
-        setDeleteError(data.error ?? "Failed to delete course.");
+        setDeleteError(data.error ?? "Failed to delete the class.");
         return;
       }
-      onDeleted(course.id);
+      onDeleted();
       onClose();
     } catch {
-      setDeleteError("Failed to delete course. Please try again.");
+      setDeleteError("Failed to delete the class. Please try again.");
     } finally {
       setDeleting(false);
     }
@@ -551,9 +620,9 @@ export default function ManageClassModal({
         <div className="flex items-center justify-between px-6 py-4 border-b">
           <div>
             <p className="text-xs text-stone-400 font-medium uppercase tracking-wide">
-              Manage Class
+              Manage Classlist
             </p>
-            <h2 className="text-xl font-bold text-stone-900">{course.code}</h2>
+            <h2 className="text-xl font-bold text-stone-900">{classlist.code}</h2>
           </div>
           <button
             onClick={onClose}
@@ -568,7 +637,7 @@ export default function ManageClassModal({
           {(
             [
               { id: "students", label: "Students", icon: UserPlus },
-              { id: "staff", label: "Staff", icon: GraduationCap },
+              { id: "staff", label: "Rooms & TAs", icon: GraduationCap },
               { id: "rename", label: "Rename", icon: Pencil },
               { id: "delete", label: "Delete", icon: Trash2 },
             ] as { id: Tab; label: string; icon: React.ElementType }[]
@@ -609,9 +678,9 @@ export default function ManageClassModal({
               <div className="border-t border-stone-100 pt-4 flex flex-col gap-3">
                 <p className="text-sm font-medium text-stone-700">Sync Roster from CSV</p>
                 <p className="text-xs text-stone-500">
-                  Upload your updated class list CSV. Students added to the file will be enrolled;
-                  students removed from the file will be unenrolled. TAs and professors are not
-                  affected.
+                  Upload your updated class list CSV. Students added to the file are enrolled in
+                  every room; students removed from the file are unenrolled from every room. TAs and
+                  professors are not affected.
                 </p>
 
                 {/* File picker */}
@@ -694,7 +763,8 @@ export default function ManageClassModal({
               <div className="border-t border-stone-100 pt-4 flex flex-col gap-3">
                 <p className="text-sm font-medium text-stone-700">Add Students</p>
                 <p className="text-xs text-stone-500">
-                  Enter one or more UTORids — separated by commas, spaces, or new lines.
+                  Enter one or more UTORids — separated by commas, spaces, or new lines. They are
+                  added to every room on this class.
                 </p>
                 <textarea
                   value={utoridsInput}
@@ -709,20 +779,10 @@ export default function ManageClassModal({
                   className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
                 />
                 {addError && <p className="text-sm text-red-600">{addError}</p>}
-                {addResult && (
-                  <div className="text-sm space-y-1">
-                    {addResult.added.length > 0 && (
-                      <p className="text-green-700">Added: {addResult.added.join(", ")}</p>
-                    )}
-                    {addResult.alreadyEnrolled.length > 0 && (
-                      <p className="text-stone-500">
-                        Already enrolled: {addResult.alreadyEnrolled.join(", ")}
-                      </p>
-                    )}
-                    {addResult.invalid.length > 0 && (
-                      <p className="text-red-600">Invalid: {addResult.invalid.join(", ")}</p>
-                    )}
-                  </div>
+                {addResult && addResult.added.length > 0 && (
+                  <p className="text-sm text-green-700">
+                    Added to every room: {addResult.added.join(", ")}
+                  </p>
                 )}
                 <button
                   onClick={handleAddStudents}
@@ -735,67 +795,127 @@ export default function ManageClassModal({
             </div>
           )}
 
-          {/* ---- Staff (professors + TAs) ---- */}
+          {/* ---- Rooms (one per professor) + TAs ---- */}
           {activeTab === "staff" && (
             <div className="flex flex-col gap-8">
-              {/* Professors */}
+              {/* Rooms */}
               <div className="flex flex-col gap-4">
-                <p className="text-sm font-semibold text-stone-800">Professors</p>
-                <RosterTable
-                  entries={rosterProfessors}
-                  search={professorSearch}
-                  onSearchChange={setProfessorSearch}
-                  emptyMessage="No professors enrolled yet."
-                  loading={rosterLoading}
-                  error={rosterError}
-                  removingUtorid={removingUtorid}
-                  removeError={removeError}
-                  onRemove={handleRemove}
-                />
+                <div>
+                  <p className="text-sm font-semibold text-stone-800">Rooms</p>
+                  <p className="text-xs text-stone-500 mt-1">
+                    One per professor. Each professor sees only their own room; you are a TA in all
+                    of them.
+                  </p>
+                </div>
+
+                {rosterLoading ? (
+                  <div className="space-y-2">
+                    {[1, 2].map((i) => (
+                      <div key={i} className="h-10 bg-stone-100 rounded animate-pulse" />
+                    ))}
+                  </div>
+                ) : rooms.length === 0 ? (
+                  <p className="text-xs text-stone-400 italic">No rooms yet.</p>
+                ) : (
+                  <ul className="border border-stone-200 rounded-lg divide-y divide-stone-100">
+                    {rooms.map((room) => (
+                      <li key={room.id} className="flex items-center gap-2 px-3 py-2.5 group">
+                        <div className="min-w-0 flex-1">
+                          <div className="flex items-center gap-1.5">
+                            <span className="text-sm font-medium text-stone-800 truncate">
+                              {room.label}
+                            </span>
+                            {room.isLive && (
+                              <span className="shrink-0 px-1.5 py-0.5 rounded bg-green-50 text-green-700 text-[10px] font-bold border border-green-200">
+                                LIVE
+                              </span>
+                            )}
+                            {room.isCreatorRoom && (
+                              <span className="shrink-0 px-1.5 py-0.5 rounded bg-stone-100 text-stone-500 text-[10px] font-bold">
+                                YOURS
+                              </span>
+                            )}
+                          </div>
+                          <span className="text-xs text-stone-400">
+                            {room.professor?.name ?? "Unassigned"}
+                            {room.professor ? ` · ${room.professor.utorid}` : ""} ·{" "}
+                            {room.memberCount} member{room.memberCount === 1 ? "" : "s"}
+                          </span>
+                          {room.professor && !room.professor.hasLoggedIn && (
+                            <span className="block text-[11px] text-amber-600">
+                              Temporary name until they sign in
+                            </span>
+                          )}
+                        </div>
+                        {room.professor && !room.isCreatorRoom && rooms.length > 1 && (
+                          <button
+                            onClick={() => handleRemoveRoom(room.professor!.utorid)}
+                            disabled={removingRoomUtorid === room.professor.utorid || room.isLive}
+                            title={
+                              room.isLive
+                                ? "End the session before removing this room"
+                                : "Remove this professor and delete their room"
+                            }
+                            className="opacity-0 group-hover:opacity-100 transition-opacity text-stone-400 hover:text-red-500 disabled:opacity-30 disabled:cursor-not-allowed shrink-0"
+                          >
+                            {removingRoomUtorid === room.professor.utorid ? (
+                              <span className="text-xs text-stone-400">…</span>
+                            ) : (
+                              <UserMinus className="w-3.5 h-3.5" />
+                            )}
+                          </button>
+                        )}
+                      </li>
+                    ))}
+                  </ul>
+                )}
+
+                <p className="text-xs text-stone-500">
+                  Removing a professor deletes their room and everything in it.
+                </p>
+
                 <div className="border-t border-stone-100 pt-4 flex flex-col gap-3">
-                  <p className="text-sm font-medium text-stone-700">Add Professors</p>
+                  <p className="text-sm font-medium text-stone-700">Add a Professor</p>
                   <p className="text-xs text-stone-500">
-                    Enter one or more UTORids — separated by commas, spaces, or new lines.
-                    Professors can start sessions, control slides, and manage this course.
+                    This creates a new room named after them, with the current roster and TAs.
                   </p>
-                  <textarea
-                    value={professorUtoridsInput}
+                  <input
+                    type="text"
+                    value={professorUtorid}
                     spellCheck={false}
-                    onChange={(e) => {
-                      setProfessorUtoridsInput(e.target.value);
-                      setProfessorAddResult(null);
-                      setProfessorAddError(null);
-                    }}
-                    placeholder={"smithj, doejohn, pannugun"}
-                    rows={3}
-                    className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
+                    onChange={(e) => handleProfessorUtoridChange(e.target.value)}
+                    placeholder="UTORid — e.g. smithj"
+                    className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
+                  />
+                  <input
+                    type="text"
+                    value={professorName}
+                    spellCheck={false}
+                    disabled={professorKnown}
+                    onChange={(e) => setProfessorName(e.target.value)}
+                    placeholder="Full name — e.g. Jane Smith"
+                    className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all disabled:bg-stone-50 disabled:text-stone-500"
                   />
+                  {professorKnown ? (
+                    <p className="text-xs text-emerald-600">Name from their U of T account.</p>
+                  ) : (
+                    professorUtorid.length > 0 && (
+                      <p className="text-xs text-amber-600">
+                        Hasn&rsquo;t signed in yet — this name is temporary and is replaced by their
+                        real one when they do.
+                      </p>
+                    )
+                  )}
                   {professorAddError && <p className="text-sm text-red-600">{professorAddError}</p>}
-                  {professorAddResult && (
-                    <div className="text-sm space-y-1">
-                      {professorAddResult.added.length > 0 && (
-                        <p className="text-green-700">
-                          Added: {professorAddResult.added.join(", ")}
-                        </p>
-                      )}
-                      {professorAddResult.alreadyEnrolled.length > 0 && (
-                        <p className="text-stone-500">
-                          Already enrolled: {professorAddResult.alreadyEnrolled.join(", ")}
-                        </p>
-                      )}
-                      {professorAddResult.invalid.length > 0 && (
-                        <p className="text-red-600">
-                          Invalid: {professorAddResult.invalid.join(", ")}
-                        </p>
-                      )}
-                    </div>
+                  {professorAddSuccess && (
+                    <p className="text-sm text-green-700">{professorAddSuccess}</p>
                   )}
                   <button
-                    onClick={handleAddProfessors}
-                    disabled={addingProfessors || professorUtoridsInput.trim().length === 0}
+                    onClick={handleAddProfessor}
+                    disabled={addingProfessor || professorUtorid.trim().length === 0}
                     className="px-4 py-2 bg-green-500 hover:bg-green-600 text-white rounded-lg text-sm font-medium transition-colors disabled:opacity-50"
                   >
-                    {addingProfessors ? "Adding…" : "Add Professors"}
+                    {addingProfessor ? "Creating room…" : "Add Professor & Create Room"}
                   </button>
                 </div>
               </div>
@@ -817,8 +937,9 @@ export default function ManageClassModal({
                 <div className="border-t border-stone-100 pt-4 flex flex-col gap-3">
                   <p className="text-sm font-medium text-stone-700">Add TAs</p>
                   <p className="text-xs text-stone-500">
-                    Enter one or more UTORids — separated by commas, spaces, or new lines. TAs can
-                    see all questions and answer in restricted mode.
+                    Enter one or more UTORids — separated by commas, spaces, or new lines. A TA here
+                    can see all questions and answer in restricted mode, in every room on this
+                    class.
                   </p>
                   <textarea
                     value={taUtoridsInput}
@@ -833,20 +954,10 @@ export default function ManageClassModal({
                     className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono resize-none focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
                   />
                   {taAddError && <p className="text-sm text-red-600">{taAddError}</p>}
-                  {taAddResult && (
-                    <div className="text-sm space-y-1">
-                      {taAddResult.added.length > 0 && (
-                        <p className="text-green-700">Added: {taAddResult.added.join(", ")}</p>
-                      )}
-                      {taAddResult.alreadyEnrolled.length > 0 && (
-                        <p className="text-stone-500">
-                          Already enrolled: {taAddResult.alreadyEnrolled.join(", ")}
-                        </p>
-                      )}
-                      {taAddResult.invalid.length > 0 && (
-                        <p className="text-red-600">Invalid: {taAddResult.invalid.join(", ")}</p>
-                      )}
-                    </div>
+                  {taAddResult && taAddResult.added.length > 0 && (
+                    <p className="text-sm text-green-700">
+                      Added to every room: {taAddResult.added.join(", ")}
+                    </p>
                   )}
                   <button
                     onClick={handleAddTas}
@@ -864,7 +975,7 @@ export default function ManageClassModal({
           {activeTab === "rename" && (
             <div className="flex flex-col gap-4">
               <div className="flex flex-col gap-1.5">
-                <label className="text-sm font-medium text-stone-700">Course Code</label>
+                <label className="text-sm font-medium text-stone-700">Class Code</label>
                 <input
                   type="text"
                   value={newCode}
@@ -893,7 +1004,9 @@ export default function ManageClassModal({
               </div>
               {renameError && <p className="text-sm text-red-600">{renameError}</p>}
               {renameSuccess && (
-                <p className="text-sm text-green-700">Course updated successfully.</p>
+                <p className="text-sm text-green-700">
+                  Updated — every room now shows the new code.
+                </p>
               )}
               <button
                 onClick={handleRename}
@@ -901,7 +1014,7 @@ export default function ManageClassModal({
                   renaming ||
                   !newCode.trim() ||
                   !newSemester.trim() ||
-                  (newCode.trim() === course.code && newSemester.trim() === course.semester)
+                  (newCode.trim() === classlist.code && newSemester.trim() === classlist.semester)
                 }
                 className="px-4 py-2 bg-green-500 hover:bg-green-600 text-white rounded-lg text-sm font-medium transition-colors disabled:opacity-50"
               >
@@ -914,12 +1027,12 @@ export default function ManageClassModal({
           {activeTab === "delete" && (
             <div className="flex flex-col gap-4">
               <div className="bg-red-50 border border-red-200 rounded-lg p-4 text-sm text-red-700">
-                This will permanently delete <strong>{course.code}</strong> and all its sessions,
-                slides, and questions. This cannot be undone.
+                This will permanently delete <strong>{classlist.code}</strong>, all {rooms.length}{" "}
+                of its rooms, and every session, slide and question in them. This cannot be undone.
               </div>
               <div className="flex flex-col gap-1.5">
                 <label className="text-sm font-medium text-stone-700">
-                  Type <span className="font-mono font-bold">{course.code}</span> to confirm
+                  Type <span className="font-mono font-bold">{classlist.code}</span> to confirm
                 </label>
                 <input
                   type="text"
@@ -928,17 +1041,17 @@ export default function ManageClassModal({
                     setDeleteConfirmCode(e.target.value);
                     setDeleteError(null);
                   }}
-                  placeholder={course.code}
+                  placeholder={classlist.code}
                   className="border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono focus:outline-none focus:border-red-400"
                 />
               </div>
               {deleteError && <p className="text-sm text-red-600">{deleteError}</p>}
               <button
                 onClick={handleDelete}
-                disabled={deleting || deleteConfirmCode !== course.code}
+                disabled={deleting || deleteConfirmCode !== classlist.code}
                 className="px-4 py-2 bg-red-600 hover:bg-red-700 text-white rounded-lg text-sm font-medium transition-colors disabled:opacity-50"
               >
-                {deleting ? "Deleting…" : "Delete Course"}
+                {deleting ? "Deleting…" : "Delete Classlist"}
               </button>
             </div>
           )}
diff --git a/src/app/classes/ProfCourseViewer.tsx b/src/app/classes/ProfCourseViewer.tsx
deleted file mode 100644
index 6fdc708..0000000
--- a/src/app/classes/ProfCourseViewer.tsx
+++ /dev/null
@@ -1,324 +0,0 @@
-"use client";
-
-import { useEffect, useState } from "react";
-import { useRouter } from "next/navigation";
-import Link from "next/link";
-import {
-  Settings,
-  BookOpen,
-  Calendar,
-  PlusCircle,
-  Radio,
-  Users,
-  CheckCircle,
-  Monitor,
-  Play,
-  Square,
-  AlertCircle,
-} from "lucide-react";
-
-import ManageClassModal, { type CourseForModal } from "./ManageClassModal";
-
-interface Course {
-  id: string;
-  code: string;
-  name: string;
-  semester: string;
-  role: string;
-}
-
-interface ActiveSession {
-  id: string;
-  joinCode: string;
-  courseId: string;
-}
-
-interface ProfCourseButtonsProps {
-  /** Global professors may create courses; course-only co-professors may not. */
-  canCreateClass?: boolean;
-}
-
-export default function ProfCourseButtons({ canCreateClass = true }: ProfCourseButtonsProps) {
-  const router = useRouter();
-  const [courses, setCourses] = useState<Course[]>([]);
-  const [activeSessions, setActiveSessions] = useState<Map<string, ActiveSession>>(new Map());
-  const [goingLive, setGoingLive] = useState<string | null>(null);
-  const [liveInfo, setLiveInfo] = useState<{ sessionId: string; joinCode: string } | null>(null);
-  const [error, setError] = useState<string | null>(null);
-  const [endingSession, setEndingSession] = useState<string | null>(null);
-  const [managingCourse, setManagingCourse] = useState<CourseForModal | null>(null);
-
-  useEffect(() => {
-    fetch("/api/courses")
-      .then((res) => (res.ok ? res.json() : null))
-      .then((data) => {
-        if (data?.courses) {
-          setCourses(data.courses.filter((c: Course) => c.role === "PROFESSOR"));
-        }
-      })
-      .catch(() => null);
-
-    fetch("/api/sessions")
-      .then((res) => (res.ok ? res.json() : null))
-      .then((data) => {
-        if (data?.sessions) {
-          const map = new Map<string, ActiveSession>();
-          for (const s of data.sessions) {
-            map.set(s.courseId, { id: s.id, joinCode: s.joinCode, courseId: s.courseId });
-          }
-          setActiveSessions(map);
-        }
-      })
-      .catch(() => null);
-  }, []);
-
-  function handleCourseClick() {
-    setError(null);
-  }
-
-  function handleRejoin(courseId: string, courseName: string) {
-    const session = activeSessions.get(courseId);
-    if (session) {
-      router.push(`/room?sessionId=${session.id}&title=${encodeURIComponent(courseName)}`);
-    }
-  }
-
-  async function handleGoLive(courseId: string, courseName: string) {
-    setGoingLive(courseId);
-    setError(null);
-    try {
-      const res = await fetch("/api/sessions", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ courseId, title: `${courseName} Live Session` }),
-      });
-      const data = await res.json();
-      if (!res.ok) {
-        setError(data.error ?? "Failed to start session.");
-        return;
-      }
-      const { session } = data;
-      setLiveInfo({ sessionId: session.id, joinCode: session.joinCode });
-      setTimeout(() => {
-        router.push(`/room?sessionId=${session.id}&title=${encodeURIComponent(courseName)}`);
-      }, 1500);
-    } catch {
-      setError("Failed to start session. Please try again.");
-    } finally {
-      setGoingLive(null);
-    }
-  }
-
-  async function handleEndSession(courseId: string, sessionId: string) {
-    setEndingSession(courseId);
-    setError(null);
-    try {
-      const res = await fetch(`/api/sessions/${sessionId}`, {
-        method: "PATCH",
-      });
-      if (!res.ok) {
-        const data = await res.json();
-        setError(data.error ?? "Failed to end session.");
-        return;
-      }
-      setActiveSessions((prev) => {
-        const newMap = new Map(prev);
-        newMap.delete(courseId);
-        return newMap;
-      });
-      setLiveInfo(null);
-    } catch {
-      setError("Failed to end session. Please try again.");
-    } finally {
-      setEndingSession(null);
-    }
-  }
-
-  function handleOpenManage(e: React.MouseEvent, course: Course) {
-    e.stopPropagation();
-    setManagingCourse({
-      id: course.id,
-      code: course.code,
-      name: course.name,
-      semester: course.semester,
-    });
-  }
-
-  function handleRenamed(courseId: string, code: string, semester: string) {
-    setCourses((prev) =>
-      prev.map((c) => (c.id === courseId ? { ...c, code, name: code, semester } : c))
-    );
-    setManagingCourse((prev) =>
-      prev?.id === courseId ? { ...prev, code, name: code, semester } : prev
-    );
-  }
-
-  function handleDeleted(courseId: string) {
-    setCourses((prev) => prev.filter((c) => c.id !== courseId));
-  }
-
-  if (courses.length > 0) {
-    return (
-      <>
-        <div className="flex-1 w-full text-left">
-          <div className="grid md:grid-cols-2 lg:grid-cols-3 gap-6 max-w-6xl mx-auto relative">
-            {error && (
-              <div className="col-span-full md:col-span-2 lg:col-span-3 mb-2 bg-red-50 text-red-600 p-4 rounded-md border border-red-100 flex items-center gap-3 font-medium">
-                <AlertCircle className="w-5 h-5" />
-                {error}
-              </div>
-            )}
-            {courses.map((course) => {
-              const session = activeSessions.get(course.id);
-              const isActive = !!session;
-              const isStarting = goingLive === course.id;
-              const isEnding = endingSession === course.id;
-
-              return (
-                <div
-                  key={course.id}
-                  onClick={() => {
-                    handleCourseClick();
-                    if (isActive && !isEnding) {
-                      handleRejoin(course.id, course.name);
-                    }
-                  }}
-                  className={`
-                    group relative overflow-hidden flex flex-col
-                    p-6 sm:p-8 rounded-md transition-all duration-300
-                    bg-white border-2 shadow-sm min-h-[16rem]
-                    ${
-                      isActive
-                        ? "border-green-400 hover:shadow-xl cursor-pointer"
-                        : "border-stone-100 hover:border-stone-200 cursor-default"
-                    }
-                  `}
-                >
-                  <div className="flex items-start justify-between w-full mb-6 relative z-10">
-                    <div
-                      className={`w-12 h-12 rounded-md flex items-center justify-center transition-all shrink-0 ${isActive ? "bg-green-50 text-green-500 group-hover:scale-110" : "bg-stone-50 text-stone-600"}`}
-                    >
-                      {isActive ? (
-                        <Monitor className="w-6 h-6" />
-                      ) : (
-                        <BookOpen className="w-6 h-6" />
-                      )}
-                    </div>
-
-                    {isActive && (
-                      <span className="flex items-center gap-1.5 px-3 py-1 bg-green-50 text-green-700 text-xs font-bold rounded-md border border-green-200 shadow-sm animate-pulse">
-                        <span className="w-1.5 h-1.5 rounded-full bg-green-500" />
-                        LIVE
-                      </span>
-                    )}
-                  </div>
-
-                  <div className="flex flex-col gap-1 mt-auto relative z-10">
-                    <h3
-                      className={`font-bold tracking-tight transition-colors line-clamp-2 ${isActive ? "text-3xl text-stone-900 group-hover:text-green-600" : "text-3xl text-stone-900"}`}
-                    >
-                      {course.name}
-                    </h3>
-                  </div>
-
-                  <div className="flex items-center gap-2 mt-4 pt-4 border-t border-stone-100 w-full text-sm font-medium text-stone-400 relative z-10 mb-4">
-                    <Calendar className="w-4 h-4" />
-                    {course.semester}
-                  </div>
-
-                  <div className="flex flex-col gap-2 relative z-10 w-full mt-auto">
-                    {liveInfo && liveInfo.sessionId === session?.id ? (
-                      <div className="bg-green-50 rounded-md py-3 px-4 border border-green-100 flex items-center justify-center gap-2">
-                        <CheckCircle className="w-5 h-5 text-green-500" />
-                        <p className="text-sm font-bold text-green-800">Redirecting…</p>
-                      </div>
-                    ) : isActive ? (
-                      <div className="flex gap-2 w-full mt-2">
-                        <button
-                          onClick={(e) => {
-                            e.stopPropagation();
-                            handleRejoin(course.id, course.name);
-                          }}
-                          className="flex-1 flex items-center justify-center gap-2 py-2.5 bg-green-500 text-white rounded-md hover:bg-green-600 font-semibold shadow-sm transition-colors text-sm"
-                        >
-                          <Play className="w-4 h-4" />
-                          Rejoin
-                        </button>
-                        <button
-                          onClick={(e) => {
-                            e.stopPropagation();
-                            handleEndSession(course.id, session!.id);
-                          }}
-                          disabled={isEnding}
-                          className="flex-1 flex items-center justify-center gap-2 py-2.5 bg-red-100 text-red-600 rounded-md hover:bg-red-200 font-semibold shadow-sm transition-colors disabled:opacity-60 text-sm"
-                        >
-                          <Square className="w-4 h-4" />
-                          {isEnding ? "Ending..." : "End"}
-                        </button>
-                      </div>
-                    ) : (
-                      <div className="flex flex-col gap-2 w-full mt-2">
-                        <button
-                          onClick={(e) => {
-                            e.stopPropagation();
-                            handleGoLive(course.id, course.name);
-                          }}
-                          disabled={isStarting}
-                          className="w-full flex items-center justify-center gap-2 py-2.5 bg-stone-900 text-white rounded-md hover:bg-green-600 font-semibold shadow-sm transition-colors disabled:opacity-60 text-sm hover:!bg-green-600 hover:text-white"
-                        >
-                          <Radio className={`w-4 h-4 ${isStarting ? "animate-pulse" : ""}`} />
-                          {isStarting ? "Starting..." : "Start Live Session"}
-                        </button>
-
-                        <button
-                          onClick={(e) => handleOpenManage(e, course)}
-                          className="w-full flex items-center justify-center gap-2 py-2.5 bg-stone-100 hover:bg-stone-200 text-stone-600 rounded-md transition-colors font-medium text-sm"
-                        >
-                          <Settings className="w-4 h-4" />
-                          Manage Lecture
-                        </button>
-                      </div>
-                    )}
-                  </div>
-                </div>
-              );
-            })}
-          </div>
-        </div>
-
-        {managingCourse && (
-          <ManageClassModal
-            course={managingCourse}
-            onClose={() => setManagingCourse(null)}
-            onRenamed={handleRenamed}
-            onDeleted={handleDeleted}
-          />
-        )}
-      </>
-    );
-  }
-
-  return (
-    <div className="w-full flex-1 flex flex-col items-center justify-center min-h-[60vh]">
-      <div className="w-20 h-20 rounded-full bg-green-50 flex items-center justify-center text-green-500 mb-6">
-        <Users className="w-10 h-10" />
-      </div>
-      <h1 className="font-bold text-3xl text-stone-900 tracking-tight mb-2">No Lectures Yet</h1>
-      <p className="text-stone-500 text-lg max-w-md text-center mb-8">
-        {canCreateClass
-          ? "You haven't created any lectures. Create your first lecture to get started with AskEasy."
-          : "You aren't assigned as a professor on any lectures yet."}
-      </p>
-
-      {canCreateClass && (
-        <Link
-          href="/create-class"
-          className="flex items-center gap-2 px-8 py-4 bg-green-500 hover:bg-green-600 text-white font-bold rounded-md transition-all shadow-md hover:shadow-lg hover:-translate-y-1 text-lg"
-        >
-          <PlusCircle className="w-6 h-6" />
-          Create a Lecture
-        </Link>
-      )}
-    </div>
-  );
-}
diff --git a/src/app/components/ClassBrowser.tsx b/src/app/components/ClassBrowser.tsx
new file mode 100644
index 0000000..08523db
--- /dev/null
+++ b/src/app/components/ClassBrowser.tsx
@@ -0,0 +1,225 @@
+"use client";
+
+import { useCallback, useEffect, useRef, useState } from "react";
+import Link from "next/link";
+import {
+  ArrowRight,
+  BookOpen,
+  Calendar,
+  DoorOpen,
+  LayoutGrid,
+  PlusCircle,
+  Settings,
+  Users,
+} from "lucide-react";
+
+import ManageClassModal from "../classes/ManageClassModal";
+import RoomGrid from "./RoomGrid";
+import type { ClasslistSummary } from "./classTypes";
+
+interface ClassBrowserProps {
+  isAdmin: boolean;
+}
+
+/** How often the live-session state is re-checked while the page is open. */
+const REFRESH_MS = 8000;
+
+export default function ClassBrowser({ isAdmin }: ClassBrowserProps) {
+  const [classlists, setClasslists] = useState<ClasslistSummary[]>([]);
+  const [ready, setReady] = useState(false);
+  const [selectedId, setSelectedId] = useState<string | null>(null);
+  const [managingId, setManagingId] = useState<string | null>(null);
+
+  // The poll must not clobber a selection the reader made a moment ago, so it
+  // only ever replaces the data.
+  const load = useCallback(async () => {
+    try {
+      const res = await fetch("/api/classlists");
+      if (!res.ok) return;
+      const data = (await res.json()) as { classlists: ClasslistSummary[] };
+      setClasslists(data.classlists ?? []);
+    } catch {
+      /* transient — the next poll retries */
+    } finally {
+      setReady(true);
+    }
+  }, []);
+
+  const loadRef = useRef(load);
+  loadRef.current = load;
+
+  useEffect(() => {
+    void loadRef.current();
+    const interval = setInterval(() => void loadRef.current(), REFRESH_MS);
+    return () => clearInterval(interval);
+  }, []);
+
+  const selected = selectedId ? (classlists.find((c) => c.id === selectedId) ?? null) : null;
+  const managing = managingId ? (classlists.find((c) => c.id === managingId) ?? null) : null;
+
+  // A class deleted in another tab (or by another admin) leaves a dangling
+  // selection pointing at nothing.
+  useEffect(() => {
+    if (selectedId && ready && !classlists.some((c) => c.id === selectedId)) {
+      setSelectedId(null);
+    }
+  }, [classlists, ready, selectedId]);
+
+  if (!ready) {
+    return (
+      <div className="w-full flex-1 flex items-center justify-center min-h-[40vh]">
+        <span className="text-stone-400 text-sm">Loading…</span>
+      </div>
+    );
+  }
+
+  if (selected) {
+    return (
+      <RoomGrid
+        classlist={selected}
+        onBack={() => setSelectedId(null)}
+        onRefresh={() => void load()}
+      />
+    );
+  }
+
+  return (
+    <>
+      <div className="max-w-6xl mx-auto w-full mb-10 flex items-center justify-between gap-4">
+        <div>
+          <h2 className="text-4xl font-bold text-stone-900 tracking-tight mb-2">My Classes</h2>
+          <p className="text-lg text-stone-500">
+            {classlists.length === 0
+              ? isAdmin
+                ? "Upload a classlist to get started."
+                : "You aren't on any classes yet."
+              : "Open a class to see its rooms — one per professor."}
+          </p>
+        </div>
+        {isAdmin && classlists.length > 0 && (
+          <Link
+            href="/create-class"
+            className="hidden sm:flex items-center gap-2 px-6 py-3 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm hover:shadow-md hover:-translate-y-0.5 shrink-0"
+          >
+            <PlusCircle className="w-5 h-5" />
+            Create Classlist
+          </Link>
+        )}
+      </div>
+
+      {classlists.length === 0 ? (
+        <EmptyState isAdmin={isAdmin} />
+      ) : (
+        <div className="grid md:grid-cols-2 lg:grid-cols-3 gap-6 max-w-6xl mx-auto w-full">
+          {classlists.map((classlist) => (
+            <div
+              key={classlist.id}
+              onClick={() => setSelectedId(classlist.id)}
+              className="group relative overflow-hidden flex flex-col p-6 sm:p-8 rounded-md transition-all duration-300 bg-white border-2 border-stone-100 hover:border-stone-200 shadow-sm hover:shadow-xl cursor-pointer min-h-[16rem]"
+            >
+              <div className="flex items-start justify-between w-full mb-6">
+                <div className="w-12 h-12 rounded-md flex items-center justify-center shrink-0 bg-stone-50 text-stone-600 transition-all group-hover:scale-110">
+                  <BookOpen className="w-6 h-6" />
+                </div>
+
+                <div className="flex items-center gap-2">
+                  {classlist.liveRoomCount > 0 && (
+                    <span className="flex items-center gap-1.5 px-3 py-1 bg-green-50 text-green-700 text-xs font-bold rounded-md border border-green-200 shadow-sm animate-pulse">
+                      <span className="w-1.5 h-1.5 rounded-full bg-green-500" />
+                      {classlist.liveRoomCount} LIVE
+                    </span>
+                  )}
+                  {classlist.isCreator && (
+                    <button
+                      onClick={(e) => {
+                        e.stopPropagation();
+                        setManagingId(classlist.id);
+                      }}
+                      aria-label={`Manage ${classlist.code}`}
+                      className="w-8 h-8 flex items-center justify-center rounded-md text-stone-400 hover:text-stone-900 hover:bg-stone-100 transition-colors"
+                    >
+                      <Settings className="w-4 h-4" />
+                    </button>
+                  )}
+                </div>
+              </div>
+
+              <div className="flex flex-col gap-1 mt-auto">
+                <h3 className="font-bold text-3xl tracking-tight text-stone-900 line-clamp-2 group-hover:text-green-600 transition-colors">
+                  {classlist.code}
+                </h3>
+              </div>
+
+              <div className="flex items-center gap-2 mt-4 pt-4 border-t border-stone-100 w-full text-sm font-medium text-stone-400">
+                <Calendar className="w-4 h-4" />
+                {classlist.semester}
+                <span className="ml-auto flex items-center gap-1.5 text-stone-500 group-hover:text-green-600 transition-colors">
+                  <DoorOpen className="w-4 h-4" />
+                  {classlist.rooms.length} {classlist.rooms.length === 1 ? "room" : "rooms"}
+                  <ArrowRight className="w-4 h-4 group-hover:translate-x-1 transition-transform" />
+                </span>
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
+
+      {isAdmin && classlists.length > 0 && (
+        <div className="max-w-6xl mx-auto w-full mt-8 sm:hidden">
+          <Link
+            href="/create-class"
+            className="flex items-center justify-center gap-2 w-full py-4 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm"
+          >
+            <PlusCircle className="w-5 h-5" />
+            Create Classlist
+          </Link>
+        </div>
+      )}
+
+      {managing && (
+        <ManageClassModal
+          classlist={{ id: managing.id, code: managing.code, semester: managing.semester }}
+          onClose={() => setManagingId(null)}
+          onChanged={() => void load()}
+          onDeleted={() => {
+            setManagingId(null);
+            setSelectedId(null);
+            void load();
+          }}
+        />
+      )}
+    </>
+  );
+}
+
+function EmptyState({ isAdmin }: { isAdmin: boolean }) {
+  return (
+    <div className="w-full flex-1 flex flex-col items-center justify-center min-h-[50vh]">
+      <div
+        className={`w-20 h-20 rounded-full flex items-center justify-center mb-6 ${
+          isAdmin ? "bg-green-50 text-green-500" : "bg-stone-100 text-stone-400"
+        }`}
+      >
+        {isAdmin ? <Users className="w-10 h-10" /> : <LayoutGrid className="w-10 h-10" />}
+      </div>
+      <h1 className="font-bold text-3xl text-stone-900 tracking-tight mb-2">
+        {isAdmin ? "No Classes Yet" : "No Classes Found"}
+      </h1>
+      <p className="text-stone-500 text-lg max-w-md text-center mb-8">
+        {isAdmin
+          ? "Upload a classlist and add the professors teaching it. Each one gets their own room."
+          : "You aren't on any classes yet. An admin adds you when they upload the classlist."}
+      </p>
+
+      {isAdmin && (
+        <Link
+          href="/create-class"
+          className="flex items-center gap-2 px-8 py-4 bg-green-500 hover:bg-green-600 text-white font-bold rounded-md transition-all shadow-md hover:shadow-lg hover:-translate-y-1 text-lg"
+        >
+          <PlusCircle className="w-6 h-6" />
+          Create a Classlist
+        </Link>
+      )}
+    </div>
+  );
+}
diff --git a/src/app/components/CourseViewer.tsx b/src/app/components/CourseViewer.tsx
deleted file mode 100644
index 317e50d..0000000
--- a/src/app/components/CourseViewer.tsx
+++ /dev/null
@@ -1,166 +0,0 @@
-"use client";
-
-import { useEffect, useState } from "react";
-import { useRouter } from "next/navigation";
-import { BookOpen, Calendar, ArrowRight, Monitor, LayoutGrid } from "lucide-react";
-
-interface Course {
-  id: string;
-  code: string;
-  name: string;
-  semester: string;
-  role: string;
-}
-
-interface ActiveSession {
-  id: string;
-  title: string;
-  joinCode: string;
-  status: string;
-  course: { code: string; name: string };
-}
-
-export default function CourseViewer() {
-  const router = useRouter();
-  const [courses, setCourses] = useState<Course[]>([]);
-  const [activeSessions, setActiveSessions] = useState<ActiveSession[]>([]);
-  const [joining, setJoining] = useState<string | null>(null);
-  const [joinError, setJoinError] = useState<string | null>(null);
-
-  const fetchSessions = () => {
-    fetch("/api/sessions")
-      .then((res) => (res.ok ? res.json() : null))
-      .then((data) => {
-        if (data?.sessions) setActiveSessions(data.sessions);
-      })
-      .catch(() => null);
-  };
-
-  useEffect(() => {
-    fetch("/api/courses")
-      .then((res) => (res.ok ? res.json() : null))
-      .then((data) => {
-        if (data?.courses) {
-          setCourses(data.courses.filter((c: Course) => c.role === "STUDENT" || c.role === "TA"));
-        }
-      })
-      .catch(() => null);
-
-    fetchSessions();
-
-    const interval = setInterval(fetchSessions, 5000);
-    return () => clearInterval(interval);
-  }, []);
-
-  async function handleJoin(session: ActiveSession) {
-    setJoining(session.id);
-    setJoinError(null);
-    try {
-      const res = await fetch(`/api/sessions/join/${session.joinCode}`, {
-        method: "POST",
-      });
-      if (res.ok || res.status === 409) {
-        router.push(
-          `/room?sessionId=${session.id}&title=${encodeURIComponent(session.course.name)}`
-        );
-        return;
-      }
-      const data = await res.json();
-      setJoinError(data.error ?? "Failed to join session.");
-    } catch {
-      setJoinError("Failed to join. Please try again.");
-    } finally {
-      setJoining(null);
-    }
-  }
-
-  if (courses.length > 0) {
-    return (
-      <div className="flex-1 w-full text-left">
-        {joinError && (
-          <div className="max-w-6xl mx-auto mb-6 bg-red-50 text-red-600 p-4 rounded-md border border-red-100 flex items-center gap-3 font-medium">
-            <div className="w-2 h-2 rounded-full bg-red-500" />
-            {joinError}
-          </div>
-        )}
-
-        <div className="grid md:grid-cols-2 lg:grid-cols-3 gap-6 max-w-6xl mx-auto">
-          {courses.map((course) => {
-            const activeSession = activeSessions.find((s) => s.course.name === course.name);
-            const isActive = !!activeSession;
-            const isJoining = joining === activeSession?.id;
-
-            return (
-              <div
-                key={course.id}
-                onClick={() => {
-                  if (isActive && !isJoining && activeSession) {
-                    handleJoin(activeSession);
-                  }
-                }}
-                className={`
-                  group relative overflow-hidden flex flex-col
-                  p-6 sm:p-8 rounded-md transition-all duration-300
-                  bg-white border-2 h-[16rem]
-                  ${
-                    isActive
-                      ? "border-green-400 shadow-sm hover:shadow-xl cursor-pointer"
-                      : "border-stone-100 cursor-default"
-                  }
-                  ${isJoining ? "opacity-60 pointer-events-none" : ""}
-                `}
-              >
-                <div className="flex items-start justify-between w-full mb-6">
-                  <div
-                    className={`w-12 h-12 rounded-md flex items-center justify-center shrink-0 transition-all ${isActive ? "bg-green-50 text-green-500 group-hover:scale-110" : "bg-stone-50 text-stone-600"}`}
-                  >
-                    {isActive ? <Monitor className="w-6 h-6" /> : <BookOpen className="w-6 h-6" />}
-                  </div>
-
-                  {isActive && (
-                    <span className="flex items-center gap-1.5 px-3 py-1 bg-green-50 text-green-700 text-xs font-bold rounded-md border border-green-200 shadow-sm animate-pulse">
-                      <span className="w-1.5 h-1.5 rounded-full bg-green-500" />
-                      LIVE
-                    </span>
-                  )}
-                </div>
-
-                <div className="flex flex-col gap-1 mt-auto">
-                  <h3
-                    className={`font-bold text-3xl tracking-tight line-clamp-2 transition-colors ${isActive ? "text-stone-900 group-hover:text-green-600" : "text-stone-900"}`}
-                  >
-                    {course.name}
-                  </h3>
-                </div>
-
-                <div className="flex items-center gap-2 mt-6 pt-6 border-t border-stone-100 w-full text-sm font-medium text-stone-400">
-                  <Calendar className="w-4 h-4" />
-                  {course.semester}
-
-                  {isActive ? (
-                    <div className="ml-auto flex items-center gap-1.5 text-sm font-medium text-green-500 group-hover:text-green-600 transition-colors">
-                      {isJoining ? "Joining..." : "Join"}
-                      <ArrowRight className="w-4 h-4 text-green-400 group-hover:text-green-500 group-hover:translate-x-1 transition-all" />
-                    </div>
-                  ) : null}
-                </div>
-              </div>
-            );
-          })}
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <div className="w-full flex-1 flex flex-col items-center justify-center min-h-[60vh]">
-      <div className="w-20 h-20 rounded-full bg-stone-100 flex items-center justify-center text-stone-400 mb-6">
-        <LayoutGrid className="w-10 h-10" />
-      </div>
-      <h1 className="font-bold text-3xl text-stone-900 tracking-tight mb-2">No Lectures Found</h1>
-      <p className="text-stone-500 text-lg max-w-md text-center">
-        You are not enrolled in any lectures yet.
-      </p>
-    </div>
-  );
-}
diff --git a/src/app/components/RoomGrid.tsx b/src/app/components/RoomGrid.tsx
new file mode 100644
index 0000000..954cc39
--- /dev/null
+++ b/src/app/components/RoomGrid.tsx
@@ -0,0 +1,246 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import {
+  AlertCircle,
+  ArrowLeft,
+  ArrowRight,
+  BookOpen,
+  CheckCircle,
+  Clock,
+  GraduationCap,
+  Monitor,
+  Play,
+  Radio,
+  Square,
+} from "lucide-react";
+
+import { roomTitle, type ClasslistSummary, type RoomSummary } from "./classTypes";
+
+interface RoomGridProps {
+  classlist: ClasslistSummary;
+  onBack: () => void;
+  /** Re-fetches the classlists so a started or ended session shows up. */
+  onRefresh: () => void;
+}
+
+export default function RoomGrid({ classlist, onBack, onRefresh }: RoomGridProps) {
+  const router = useRouter();
+  const [busyRoomId, setBusyRoomId] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  function enterRoom(room: RoomSummary) {
+    if (!room.activeSession) return;
+    const title = encodeURIComponent(roomTitle(classlist.code, room.label));
+    router.push(`/room?sessionId=${room.activeSession.id}&title=${title}`);
+  }
+
+  async function startSession(room: RoomSummary) {
+    setBusyRoomId(room.id);
+    setError(null);
+    try {
+      const res = await fetch("/api/sessions", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          courseId: room.id,
+          title: roomTitle(classlist.code, room.label),
+        }),
+      });
+      const data = await res.json();
+      if (!res.ok) {
+        setError(data.error ?? "Failed to start the session.");
+        return;
+      }
+      const title = encodeURIComponent(roomTitle(classlist.code, room.label));
+      router.push(`/room?sessionId=${data.session.id}&title=${title}`);
+    } catch {
+      setError("Failed to start the session. Please try again.");
+    } finally {
+      setBusyRoomId(null);
+    }
+  }
+
+  async function endSession(room: RoomSummary) {
+    if (!room.activeSession) return;
+    setBusyRoomId(room.id);
+    setError(null);
+    try {
+      const res = await fetch(`/api/sessions/${room.activeSession.id}`, { method: "PATCH" });
+      if (!res.ok) {
+        const data = await res.json();
+        setError(data.error ?? "Failed to end the session.");
+        return;
+      }
+      onRefresh();
+    } catch {
+      setError("Failed to end the session. Please try again.");
+    } finally {
+      setBusyRoomId(null);
+    }
+  }
+
+  return (
+    <div className="flex-1 w-full text-left">
+      <div className="max-w-6xl mx-auto w-full mb-8">
+        <button
+          onClick={onBack}
+          className="flex items-center gap-2 py-2 px-3 -ml-3 text-stone-500 hover:text-stone-900 hover:bg-stone-200/60 rounded-md transition-colors font-medium text-sm"
+        >
+          <ArrowLeft className="w-4 h-4" />
+          All classes
+        </button>
+
+        <div className="mt-4 flex items-end justify-between gap-4 flex-wrap">
+          <div>
+            <h2 className="text-4xl font-bold text-stone-900 tracking-tight mb-2">
+              {classlist.code}
+            </h2>
+            <p className="text-lg text-stone-500">
+              {classlist.rooms.length === 1
+                ? "One room on this class."
+                : `${classlist.rooms.length} rooms on this class, one per professor.`}
+            </p>
+          </div>
+          <span className="text-sm font-medium text-stone-400">{classlist.semester}</span>
+        </div>
+      </div>
+
+      <div className="grid md:grid-cols-2 lg:grid-cols-3 gap-6 max-w-6xl mx-auto">
+        {error && (
+          <div className="col-span-full mb-2 bg-red-50 text-red-600 p-4 rounded-md border border-red-100 flex items-center gap-3 font-medium">
+            <AlertCircle className="w-5 h-5" />
+            {error}
+          </div>
+        )}
+
+        {classlist.rooms.map((room) => {
+          const isLive = !!room.activeSession;
+          const isBusy = busyRoomId === room.id;
+          const canEnter = isLive && !isBusy;
+
+          return (
+            <div
+              key={room.id}
+              onClick={() => canEnter && enterRoom(room)}
+              className={`
+                group relative overflow-hidden flex flex-col
+                p-6 sm:p-8 rounded-md transition-all duration-300
+                bg-white border-2 shadow-sm min-h-[16rem]
+                ${
+                  isLive
+                    ? "border-green-400 hover:shadow-xl cursor-pointer"
+                    : "border-stone-100 hover:border-stone-200 cursor-default"
+                }
+                ${isBusy ? "opacity-60 pointer-events-none" : ""}
+              `}
+            >
+              <div className="flex items-start justify-between w-full mb-6 relative z-10">
+                <div
+                  className={`w-12 h-12 rounded-md flex items-center justify-center transition-all shrink-0 ${
+                    isLive
+                      ? "bg-green-50 text-green-500 group-hover:scale-110"
+                      : "bg-stone-50 text-stone-600"
+                  }`}
+                >
+                  {isLive ? <Monitor className="w-6 h-6" /> : <BookOpen className="w-6 h-6" />}
+                </div>
+
+                {isLive && (
+                  <span className="flex items-center gap-1.5 px-3 py-1 bg-green-50 text-green-700 text-xs font-bold rounded-md border border-green-200 shadow-sm animate-pulse">
+                    <span className="w-1.5 h-1.5 rounded-full bg-green-500" />
+                    LIVE
+                  </span>
+                )}
+              </div>
+
+              <div className="flex flex-col gap-1 mt-auto relative z-10">
+                <h3
+                  className={`font-bold text-3xl tracking-tight line-clamp-2 transition-colors ${
+                    isLive ? "text-stone-900 group-hover:text-green-600" : "text-stone-900"
+                  }`}
+                >
+                  {room.label}
+                </h3>
+                {room.professor && !room.professor.hasLoggedIn && (
+                  <span className="flex items-center gap-1 text-xs text-amber-600 font-medium">
+                    <Clock className="w-3 h-3" />
+                    Temporary name — {room.professor.utorid} hasn&rsquo;t signed in yet
+                  </span>
+                )}
+              </div>
+
+              <div className="flex items-center gap-2 mt-4 pt-4 border-t border-stone-100 w-full text-sm font-medium text-stone-400 relative z-10">
+                <GraduationCap className="w-4 h-4" />
+                {room.isMine
+                  ? "Your room"
+                  : room.role === "TA"
+                    ? "You're a TA here"
+                    : (room.professor?.name ?? "Professor")}
+              </div>
+
+              <div className="flex flex-col gap-2 relative z-10 w-full mt-4">
+                {room.role === "PROFESSOR" ? (
+                  isLive ? (
+                    <div className="flex gap-2 w-full">
+                      <button
+                        onClick={(e) => {
+                          e.stopPropagation();
+                          enterRoom(room);
+                        }}
+                        className="flex-1 flex items-center justify-center gap-2 py-2.5 bg-green-500 text-white rounded-md hover:bg-green-600 font-semibold shadow-sm transition-colors text-sm"
+                      >
+                        <Play className="w-4 h-4" />
+                        Rejoin
+                      </button>
+                      <button
+                        onClick={(e) => {
+                          e.stopPropagation();
+                          void endSession(room);
+                        }}
+                        disabled={isBusy}
+                        className="flex-1 flex items-center justify-center gap-2 py-2.5 bg-red-100 text-red-600 rounded-md hover:bg-red-200 font-semibold shadow-sm transition-colors disabled:opacity-60 text-sm"
+                      >
+                        <Square className="w-4 h-4" />
+                        {isBusy ? "Ending…" : "End"}
+                      </button>
+                    </div>
+                  ) : (
+                    <button
+                      onClick={(e) => {
+                        e.stopPropagation();
+                        void startSession(room);
+                      }}
+                      disabled={isBusy}
+                      className="w-full flex items-center justify-center gap-2 py-2.5 bg-stone-900 text-white rounded-md font-semibold shadow-sm transition-colors disabled:opacity-60 text-sm hover:!bg-green-600"
+                    >
+                      <Radio className={`w-4 h-4 ${isBusy ? "animate-pulse" : ""}`} />
+                      {isBusy ? "Starting…" : "Start Live Session"}
+                    </button>
+                  )
+                ) : isLive ? (
+                  <button
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      enterRoom(room);
+                    }}
+                    className="w-full flex items-center justify-center gap-2 py-2.5 bg-green-500 text-white rounded-md hover:bg-green-600 font-semibold shadow-sm transition-colors text-sm"
+                  >
+                    Join
+                    <ArrowRight className="w-4 h-4 group-hover:translate-x-1 transition-transform" />
+                  </button>
+                ) : (
+                  <div className="w-full flex items-center justify-center gap-2 py-2.5 bg-stone-50 text-stone-400 rounded-md font-medium text-sm">
+                    <CheckCircle className="w-4 h-4" />
+                    Not live right now
+                  </div>
+                )}
+              </div>
+            </div>
+          );
+        })}
+      </div>
+    </div>
+  );
+}
diff --git a/src/app/components/classTypes.ts b/src/app/components/classTypes.ts
new file mode 100644
index 0000000..dec594f
--- /dev/null
+++ b/src/app/components/classTypes.ts
@@ -0,0 +1,28 @@
+export type RoomRole = "STUDENT" | "TA" | "PROFESSOR";
+
+export interface RoomSummary {
+  id: string;
+  /** The professor's surname, disambiguated within the class. */
+  label: string;
+  code: string;
+  role: RoomRole;
+  professor: { name: string; utorid: string; hasLoggedIn: boolean } | null;
+  /** True when the viewer is this room's professor. */
+  isMine: boolean;
+  activeSession: { id: string; joinCode: string } | null;
+}
+
+export interface ClasslistSummary {
+  id: string;
+  code: string;
+  semester: string;
+  /** True for the admin who uploaded it — they get the manage controls. */
+  isCreator: boolean;
+  liveRoomCount: number;
+  rooms: RoomSummary[];
+}
+
+/** Where the room page's title comes from: "CSC101 — Smith". */
+export function roomTitle(classCode: string, roomLabel: string): string {
+  return roomLabel ? `${classCode} — ${roomLabel}` : classCode;
+}
diff --git a/src/app/page.tsx b/src/app/page.tsx
index 2338ed8..0ba91fd 100644
--- a/src/app/page.tsx
+++ b/src/app/page.tsx
@@ -1,69 +1,75 @@
 "use client";
 
 import React, { useEffect, useState } from "react";
-import { User } from "@/utils/types";
-import CourseViewer from "./components/CourseViewer";
-import footer from "./components/footer";
-import ProfCourseViewer from "./classes/ProfCourseViewer";
-import OnboardingCarousel from "./components/OnboardingCarousel";
-import { STUDENT_ONBOARDING_STEPS, PROF_ONBOARDING_STEPS } from "@/constants/onboarding";
-import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
-import { getInitials, isLikelyAvatarImageUrl } from "@/utils/types";
-import { CircleHelp, LayoutDashboard, PlusCircle } from "lucide-react";
 import Link from "next/link";
+import { CircleHelp, LayoutDashboard } from "lucide-react";
+
+import { User, getInitials, isLikelyAvatarImageUrl } from "@/utils/types";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { STUDENT_ONBOARDING_STEPS, PROF_ONBOARDING_STEPS } from "@/constants/onboarding";
+import ClassBrowser from "./components/ClassBrowser";
+import OnboardingCarousel from "./components/OnboardingCarousel";
+import footer from "./components/footer";
 
 export default function LandingPage() {
   const [user, setUser] = useState<User | null>(null);
   const [isAdmin, setIsAdmin] = useState(false);
+  const [isInstructor, setIsInstructor] = useState(false);
   const [showOnboarding, setShowOnboarding] = useState(false);
-  const [hasProfessorCourses, setHasProfessorCourses] = useState(false);
-  const [hasStudentCourses, setHasStudentCourses] = useState(false);
-  const [coursesReady, setCoursesReady] = useState(false);
+  const [ready, setReady] = useState(false);
 
   useEffect(() => {
-    fetch("/api/auth/me")
-      .then((res) => (res.ok ? res.json() : null))
-      .then((data) => {
-        if (data?.userId) {
-          const role = data.role as User["role"];
-          setUser({
-            id: data.userId,
-            username: data.name ?? data.utorid,
-            pfp: data.name?.[0]?.toUpperCase() ?? data.utorid?.[0]?.toUpperCase() ?? "?",
-            role,
-          });
-          setIsAdmin(!!data.isAdmin);
+    // Identity and enrollments are resolved together: which walkthrough to show
+    // depends on whether this person teaches anything, and that lives on their
+    // enrollments — the global role is always STUDENT now. Deciding before the
+    // enrollments land would show a professor the student walkthrough.
+    async function load() {
+      const [me, courses] = await Promise.all([
+        fetch("/api/auth/me")
+          .then((res) => (res.ok ? res.json() : null))
+          .catch(() => null),
+        fetch("/api/courses")
+          .then((res) => (res.ok ? res.json() : null))
+          .catch(() => null),
+      ]);
+
+      if (me?.userId) {
+        setUser({
+          id: me.userId,
+          username: me.name ?? me.utorid,
+          pfp: me.name?.[0]?.toUpperCase() ?? me.utorid?.[0]?.toUpperCase() ?? "?",
+          role: me.role as User["role"],
+        });
+        setIsAdmin(!!me.isAdmin);
+      }
 
-          // Check for onboarding
-          const seenToken = `hasSeenOnboarding_${role}`;
-          if (!localStorage.getItem(seenToken)) {
-            setShowOnboarding(true);
-          }
-        }
-      })
-      .catch(() => null);
+      const enrolled = (courses?.courses ?? []) as { role: string }[];
+      const instructor = !!me?.isAdmin || enrolled.some((c) => c.role === "PROFESSOR");
+      setIsInstructor(instructor);
 
-    // Home UI is driven by CourseEnrollment, not only global User.role — co-professors
-    // are usually global STUDENTs who still need the professor lecture panel.
-    fetch("/api/courses")
-      .then((res) => (res.ok ? res.json() : null))
-      .then((data) => {
-        const courses = (data?.courses ?? []) as { role: string }[];
-        setHasProfessorCourses(courses.some((c) => c.role === "PROFESSOR"));
-        setHasStudentCourses(courses.some((c) => c.role === "STUDENT" || c.role === "TA"));
-      })
-      .catch(() => null)
-      .finally(() => setCoursesReady(true));
+      try {
+        const seenToken = `hasSeenOnboarding_${instructor ? "INSTRUCTOR" : "STUDENT"}`;
+        if (me?.userId && !localStorage.getItem(seenToken)) setShowOnboarding(true);
+      } catch {
+        /* storage blocked — just skip the walkthrough */
+      }
+
+      setReady(true);
+    }
+
+    void load();
   }, []);
 
   const handleOnboardingComplete = () => {
-    if (user) {
-      localStorage.setItem(`hasSeenOnboarding_${user.role}`, "true");
+    try {
+      localStorage.setItem(`hasSeenOnboarding_${isInstructor ? "INSTRUCTOR" : "STUDENT"}`, "true");
+    } catch {
+      /* storage blocked — the walkthrough reappears next visit */
     }
     setShowOnboarding(false);
   };
 
-  if (!user || !coursesReady) {
+  if (!ready || !user) {
     return (
       <div className="min-h-screen flex items-center justify-center">
         <span className="text-stone-400 text-sm">Loading…</span>
@@ -71,27 +77,6 @@ export default function LandingPage() {
     );
   }
 
-  // Only admins create classes. Professors are assigned to one, so their panel
-  // is driven by CourseEnrollment rather than any global role.
-  const showProfViewer = isAdmin || hasProfessorCourses;
-  // Don't mount the student viewer empty-state under a professor who only has
-  // professor courses.
-  const showStudentViewer = hasStudentCourses || !showProfViewer;
-  // An admin with nothing yet still needs the header — that is where the
-  // Create button lives.
-  const showLecturesHeader = isAdmin || hasProfessorCourses || hasStudentCourses;
-
-  const lecturesSubtitle = showProfViewer
-    ? showStudentViewer
-      ? "Manage your lectures, start live sessions, or join when a class goes live."
-      : "Manage your lectures and start live sessions."
-    : "Select a live lecture to join its session. If the lecture is not live, just wait!";
-
-  const getStepsForRole = () => {
-    if (showProfViewer) return PROF_ONBOARDING_STEPS;
-    return STUDENT_ONBOARDING_STEPS;
-  };
-
   return (
     <div className="min-h-screen flex flex-col dot-grid relative">
       <div className="absolute top-6 right-7 z-10 flex items-center gap-3">
@@ -121,42 +106,7 @@ export default function LandingPage() {
       <div className="overflow-y-auto flex-1 flex flex-col">
         <div className="flex-1 p-5 pt-16 pb-10 flex flex-col items-center">
           <div className="w-full max-w-7xl mx-auto flex-1 flex flex-col">
-            {showLecturesHeader && (
-              <div className="max-w-6xl mx-auto w-full mb-10 flex items-center justify-between">
-                <div>
-                  <h2 className="text-4xl font-bold text-stone-900 tracking-tight mb-2">
-                    My Lectures
-                  </h2>
-                  <p className="text-lg text-stone-500">{lecturesSubtitle}</p>
-                </div>
-                {isAdmin && (
-                  <Link
-                    href="/create-class"
-                    className="hidden sm:flex items-center gap-2 px-6 py-3 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm hover:shadow-md hover:-translate-y-0.5"
-                  >
-                    <PlusCircle className="w-5 h-5" />
-                    Create Lecture
-                  </Link>
-                )}
-              </div>
-            )}
-
-            <div className="flex flex-col gap-10">
-              {showProfViewer && <ProfCourseViewer canCreateClass={isAdmin} />}
-              {showStudentViewer && <CourseViewer />}
-            </div>
-
-            {isAdmin && showLecturesHeader && (
-              <div className="max-w-6xl mx-auto w-full mt-8 sm:hidden">
-                <Link
-                  href="/create-class"
-                  className="flex items-center justify-center gap-2 w-full py-4 bg-green-500 hover:bg-green-600 text-white font-semibold rounded-md transition-all shadow-sm"
-                >
-                  <PlusCircle className="w-5 h-5" />
-                  Create New Lecture
-                </Link>
-              </div>
-            )}
+            <ClassBrowser isAdmin={isAdmin} />
           </div>
         </div>
         {footer()}
@@ -164,9 +114,9 @@ export default function LandingPage() {
 
       {showOnboarding && (
         <OnboardingCarousel
-          steps={getStepsForRole()}
+          steps={isInstructor ? PROF_ONBOARDING_STEPS : STUDENT_ONBOARDING_STEPS}
           onComplete={handleOnboardingComplete}
-          requireAgreement={!showProfViewer}
+          requireAgreement={!isInstructor}
         />
       )}
     </div>
diff --git a/src/constants/onboarding.ts b/src/constants/onboarding.ts
index 4bfa127..40052a6 100644
--- a/src/constants/onboarding.ts
+++ b/src/constants/onboarding.ts
@@ -41,7 +41,7 @@ export const PROF_ONBOARDING_STEPS: OnboardingStep[] = [
   {
     title: "Go Live & Share Slides",
     description: [
-      "Hit 'Go Live' on any course to start a session. Students will see it appear on their dashboard.",
+      "Open your class, then hit 'Start Live Session' on your room. Students will see it go green on their home page.",
       "Upload your lecture slides as a PDF and students will see them in a synced split-view alongside the chat.",
     ],
     image: "/images/onboarding/onboard-classes.jpg",
@@ -59,7 +59,7 @@ export const PROF_ONBOARDING_STEPS: OnboardingStep[] = [
   {
     title: "Manage & Export",
     description: [
-      "Assign TAs, moderate posts, and control answer permissions from within the session.",
+      "Assign TAs, moderate posts, and control answer permissions from within the session. Every professor on a class runs their own room and sees only that one.",
       "When you end a session, download the full Q&A transcript as a .txt file.",
     ],
     image: "/images/onboarding/onboard-end.jpg",
diff --git a/tsconfig.json b/tsconfig.json
index a2d4d34..0998797 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -34,7 +34,11 @@
     ".next-ta/types/**/*.ts",
     ".next-ta/dev/types/**/*.ts",
     ".next-student/types/**/*.ts",
-    ".next-student/dev/types/**/*.ts"
+    ".next-student/dev/types/**/*.ts",
+    ".next-probe-p/types/**/*.ts",
+    ".next-probe-p/dev/types/**/*.ts",
+    ".next-probe-a/types/**/*.ts",
+    ".next-probe-a/dev/types/**/*.ts"
   ],
   "exclude": ["node_modules", ".next", ".next-prof", ".next-ta", ".next-student"]
 }

From aaa9eaa19a6009a1e0d5a0a71c080d5762174698 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 08:05:27 -0400
Subject: [PATCH 19/29] Close the gaps the per-room split opened up
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Six things the rest of the app still assumed rooms were shared:

- A socket switching or leaving a session left `session:<id>:instructors`
  behind. A professor moving to a room where they are a student would have kept
  receiving the old room's INSTRUCTOR_ONLY questions.

- POST /api/courses/[id]/students accepted role: "PROFESSOR", which now trips
  the partial unique index and surfaces as a 500. It refuses with an
  explanation and points at the classlist endpoint that creates a room.

- Its DELETE still carried the co-professor guards ("cannot remove the last
  professor"). A room's professor is the room, so demoting them is refused
  outright rather than conditionally.

- PATCH/DELETE /api/courses/[courseId] are gone. Renaming one room desynced it
  from its classlist's code, and deleting one stranded the classlist. Both live
  at classlist level now, and nothing called these any more.

- A join code let a professor enrol as a student in a colleague's room on the
  same class — walking straight around the isolation. joinSession refuses when
  the joiner already runs a room on that classlist.

- The admin room-delete and user-delete routes left classlists behind with no
  rooms: invisible on the home page, and a RESTRICT foreign key that blocks
  deleting the user who created them. Both clean up what they empty.

stress-tests/seed.ts also built a room with no classlist and no professor set,
and gave its professor the global PROFESSOR role that no longer means anything.

Verified against three signed-in dev servers: 13 checks covering each refusal
and that a professor can still manage TAs on their own room.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/app/api/admin/courses/[courseId]/route.ts |  14 ++
 src/app/api/admin/users/[userId]/route.ts     |  20 +-
 src/app/api/courses/[courseId]/route.ts       | 185 ------------------
 .../api/courses/[courseId]/students/route.ts  |  89 +++++----
 src/lib/sessionJoin.ts                        |  27 +++
 src/socket/index.ts                           |  10 +-
 stress-tests/seed.ts                          |  22 ++-
 tsconfig.json                                 |   4 +-
 8 files changed, 140 insertions(+), 231 deletions(-)
 delete mode 100644 src/app/api/courses/[courseId]/route.ts

diff --git a/src/app/api/admin/courses/[courseId]/route.ts b/src/app/api/admin/courses/[courseId]/route.ts
index 8627e23..e12cd5e 100644
--- a/src/app/api/admin/courses/[courseId]/route.ts
+++ b/src/app/api/admin/courses/[courseId]/route.ts
@@ -16,6 +16,13 @@ export async function DELETE(_request: NextRequest, { params }: RouteParams) {
 
     const { courseId } = await params;
 
+    // Deleting the last room on a classlist would leave the classlist behind
+    // with nothing in it — invisible on the home page and unmanageable.
+    const room = await prisma.course.findUnique({
+      where: { id: courseId },
+      select: { classlistId: true },
+    });
+
     // Gather all session IDs for this course
     const sessions = await prisma.session.findMany({
       where: { courseId },
@@ -61,6 +68,13 @@ export async function DELETE(_request: NextRequest, { params }: RouteParams) {
 
       await tx.courseEnrollment.deleteMany({ where: { courseId } });
       await tx.course.delete({ where: { id: courseId } });
+
+      if (room?.classlistId) {
+        const remaining = await tx.course.count({ where: { classlistId: room.classlistId } });
+        if (remaining === 0) {
+          await tx.classlist.delete({ where: { id: room.classlistId } });
+        }
+      }
     });
 
     return NextResponse.json({ success: true });
diff --git a/src/app/api/admin/users/[userId]/route.ts b/src/app/api/admin/users/[userId]/route.ts
index 590ea66..0d0c060 100644
--- a/src/app/api/admin/users/[userId]/route.ts
+++ b/src/app/api/admin/users/[userId]/route.ts
@@ -103,11 +103,29 @@ export async function DELETE(_request: NextRequest, { params }: RouteParams) {
         },
       });
 
-      // 10. Delete Courses
+      // 10. Delete Courses (rooms), then any classlist they emptied
       if (courseIds.length > 0) {
+        const affected = await tx.course.findMany({
+          where: { id: { in: courseIds }, classlistId: { not: null } },
+          select: { classlistId: true },
+          distinct: ["classlistId"],
+        });
+
         await tx.course.deleteMany({ where: { id: { in: courseIds } } });
+
+        for (const { classlistId } of affected) {
+          if (!classlistId) continue;
+          const remaining = await tx.course.count({ where: { classlistId } });
+          if (remaining === 0) {
+            await tx.classlist.delete({ where: { id: classlistId } });
+          }
+        }
       }
 
+      // A classlist this user created but whose rooms belong elsewhere would
+      // block the user delete on its RESTRICT foreign key.
+      await tx.classlist.deleteMany({ where: { createdById: userId, rooms: { none: {} } } });
+
       // 11. Finally, delete the User
       await tx.user.delete({ where: { id: userId } });
     });
diff --git a/src/app/api/courses/[courseId]/route.ts b/src/app/api/courses/[courseId]/route.ts
deleted file mode 100644
index f0392be..0000000
--- a/src/app/api/courses/[courseId]/route.ts
+++ /dev/null
@@ -1,185 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-
-import { prisma } from "@/lib/prisma";
-import { getCurrentUser } from "@/lib/auth";
-import { deleteFile } from "@/lib/storage";
-
-interface RouteParams {
-  params: Promise<{ courseId: string }>;
-}
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-async function assertProfessorOwner(userId: string, courseId: string) {
-  const enrollment = await prisma.courseEnrollment.findUnique({
-    where: { userId_courseId: { userId, courseId } },
-    select: { role: true },
-  });
-  if (!enrollment || enrollment.role !== "PROFESSOR") return false;
-  return true;
-}
-
-// ---------------------------------------------------------------------------
-// PATCH /api/courses/[courseId]
-// ---------------------------------------------------------------------------
-
-/**
- * Renames a course's code and/or semester.
- *
- * Request body: { code?: string; semester?: string }
- *
- * Only the professor enrolled in the course may call this.
- */
-export async function PATCH(request: NextRequest, { params }: RouteParams) {
-  try {
-    const { courseId } = await params;
-
-    const user = await getCurrentUser();
-    if (!user) {
-      return NextResponse.json({ error: "Authentication required." }, { status: 401 });
-    }
-
-    if (!(await assertProfessorOwner(user.userId, courseId))) {
-      return NextResponse.json(
-        { error: "Only the course professor can rename this course." },
-        { status: 403 }
-      );
-    }
-
-    let body: unknown;
-    try {
-      body = await request.json();
-    } catch {
-      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
-    }
-
-    const { code, semester } = (body as Record<string, unknown>) ?? {};
-
-    if (code !== undefined && (typeof code !== "string" || code.trim().length === 0)) {
-      return NextResponse.json({ error: "Course code cannot be empty." }, { status: 400 });
-    }
-
-    if (semester !== undefined && (typeof semester !== "string" || semester.trim().length === 0)) {
-      return NextResponse.json({ error: "Semester cannot be empty." }, { status: 400 });
-    }
-
-    const updateData: { code?: string; name?: string; semester?: string } = {};
-    if (typeof code === "string") {
-      updateData.code = code.trim();
-      updateData.name = code.trim(); // keep name in sync with code
-    }
-    if (typeof semester === "string") updateData.semester = semester.trim();
-
-    if (Object.keys(updateData).length === 0) {
-      return NextResponse.json({ error: "Nothing to update." }, { status: 400 });
-    }
-
-    const updated = await prisma.course.update({
-      where: { id: courseId },
-      data: updateData,
-      select: { id: true, code: true, name: true, semester: true },
-    });
-
-    return NextResponse.json({ course: updated });
-  } catch (error) {
-    console.error("[Courses API] Failed to rename course:", error);
-    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
-  }
-}
-
-// ---------------------------------------------------------------------------
-// DELETE /api/courses/[courseId]
-// ---------------------------------------------------------------------------
-
-/**
- * Permanently deletes a course and all related data.
- *
- * Rejects if the course has an ACTIVE session.
- * Deletes slide files from disk before removing DB records.
- * Manual deletion order (no cascades on Course):
- *   QuestionUpvote → Answer → Question → SlideSet files → SlideSet
- *   → Session → CourseEnrollment → Course
- */
-export async function DELETE(_request: NextRequest, { params }: RouteParams) {
-  try {
-    const { courseId } = await params;
-
-    const user = await getCurrentUser();
-    if (!user) {
-      return NextResponse.json({ error: "Authentication required." }, { status: 401 });
-    }
-
-    if (!(await assertProfessorOwner(user.userId, courseId))) {
-      return NextResponse.json(
-        { error: "Only the course professor can delete this course." },
-        { status: 403 }
-      );
-    }
-
-    // Block deletion if an active session exists
-    const activeSession = await prisma.session.findFirst({
-      where: { courseId, status: "ACTIVE" },
-      select: { id: true },
-    });
-    if (activeSession) {
-      return NextResponse.json(
-        { error: "Cannot delete a course with an active session. End the session first." },
-        { status: 409 }
-      );
-    }
-
-    // Gather all session IDs for this course
-    const sessions = await prisma.session.findMany({
-      where: { courseId },
-      select: { id: true },
-    });
-    const sessionIds = sessions.map((s) => s.id);
-
-    await prisma.$transaction(async (tx) => {
-      if (sessionIds.length > 0) {
-        // Collect slide storage keys before deleting
-        const slideSets = await tx.slideSet.findMany({
-          where: { sessionId: { in: sessionIds } },
-          select: { storageKey: true },
-        });
-
-        // Delete slide files from disk (outside transaction is fine too, but keep it together)
-        await Promise.allSettled(
-          slideSets.map((ss) =>
-            deleteFile(ss.storageKey).catch((err) =>
-              console.error("[Courses API] Failed to delete slide file:", ss.storageKey, err)
-            )
-          )
-        );
-
-        // Get question IDs to remove upvotes and answers
-        const questions = await tx.question.findMany({
-          where: { sessionId: { in: sessionIds } },
-          select: { id: true },
-        });
-        const questionIds = questions.map((q) => q.id);
-
-        if (questionIds.length > 0) {
-          await tx.questionUpvote.deleteMany({ where: { questionId: { in: questionIds } } });
-          await tx.answer.deleteMany({ where: { questionId: { in: questionIds } } });
-          await tx.question.deleteMany({ where: { id: { in: questionIds } } });
-        }
-
-        // SlideSet (Slide rows cascade from SlideSet)
-        await tx.slideSet.deleteMany({ where: { sessionId: { in: sessionIds } } });
-
-        await tx.session.deleteMany({ where: { courseId } });
-      }
-
-      await tx.courseEnrollment.deleteMany({ where: { courseId } });
-      await tx.course.delete({ where: { id: courseId } });
-    });
-
-    return NextResponse.json({ success: true });
-  } catch (error) {
-    console.error("[Courses API] Failed to delete course:", error);
-    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
-  }
-}
diff --git a/src/app/api/courses/[courseId]/students/route.ts b/src/app/api/courses/[courseId]/students/route.ts
index cf8e757..3a9a2bb 100644
--- a/src/app/api/courses/[courseId]/students/route.ts
+++ b/src/app/api/courses/[courseId]/students/route.ts
@@ -3,6 +3,17 @@ import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
 import { getCurrentUser } from "@/lib/auth";
 
+// ---------------------------------------------------------------------------
+// Room-level roster
+//
+// This is what a professor uses on their own room — chiefly assigning TAs from
+// inside a live session. Changes here affect one room only.
+//
+// Professors are not managed here. A room has exactly one, enforced by a
+// partial unique index, and adding one means creating a room: that is
+// /api/classlists/[classlistId]/professors, and it is an admin action.
+// ---------------------------------------------------------------------------
+
 interface RouteParams {
   params: Promise<{ courseId: string }>;
 }
@@ -12,11 +23,11 @@ interface RouteParams {
 // ---------------------------------------------------------------------------
 
 /**
- * Returns enrolled students, staff (TAs), and professors for a course.
+ * Returns this room's students, TAs and its one professor.
  *
  * Returns: { students, tas, professors } each [{name, utorid}]
  *
- * Only a professor enrolled in the course may call this.
+ * Only this room's professor may call it.
  */
 export async function GET(_request: NextRequest, { params }: RouteParams) {
   try {
@@ -33,7 +44,7 @@ export async function GET(_request: NextRequest, { params }: RouteParams) {
     });
     if (!enrollment || enrollment.role !== "PROFESSOR") {
       return NextResponse.json(
-        { error: "Only the course professor can view the roster." },
+        { error: "Only this room’s professor can view its roster." },
         { status: 403 }
       );
     }
@@ -65,17 +76,17 @@ export async function GET(_request: NextRequest, { params }: RouteParams) {
 // ---------------------------------------------------------------------------
 
 /**
- * Adds one or more students to a course by UTORid.
+ * Adds one or more students or TAs to this room by UTORid.
  *
- * Request body: { utorids: string[] }
+ * Request body: { utorids: string[]; role?: "STUDENT" | "TA" }
  *
  * For each UTORid:
  *   - Upserts the User (creates with default name = utorid if new)
- *   - Creates a STUDENT CourseEnrollment (skips if already enrolled)
+ *   - Creates the enrollment (updates the role if one already exists)
  *
  * Returns per-UTORid results: { added: string[], alreadyEnrolled: string[], invalid: string[] }
  *
- * Only the professor enrolled in the course may call this.
+ * Only this room's professor may call it.
  */
 export async function POST(request: NextRequest, { params }: RouteParams) {
   try {
@@ -93,7 +104,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
     });
     if (!enrollment || enrollment.role !== "PROFESSOR") {
       return NextResponse.json(
-        { error: "Only the course professor can add students." },
+        { error: "Only this room’s professor can add people to it." },
         { status: 403 }
       );
     }
@@ -120,8 +131,17 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
       return NextResponse.json({ error: "utorids must be a non-empty array." }, { status: 400 });
     }
 
-    const enrollmentRole: "STUDENT" | "TA" | "PROFESSOR" =
-      roleParam === "TA" ? "TA" : roleParam === "PROFESSOR" ? "PROFESSOR" : "STUDENT";
+    if (roleParam === "PROFESSOR") {
+      return NextResponse.json(
+        {
+          error:
+            "A room has one professor. Ask an admin to add another professor to the class — it creates them a room of their own.",
+        },
+        { status: 400 }
+      );
+    }
+
+    const enrollmentRole: "STUDENT" | "TA" = roleParam === "TA" ? "TA" : "STUDENT";
 
     const added: string[] = [];
     const alreadyEnrolled: string[] = [];
@@ -134,7 +154,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         continue;
       }
 
-      // User.role is NOT changed here — global role is managed by whitelist only
+      // User.role is NOT changed — it is always STUDENT. Roles are per room.
       const enrolledUser = await prisma.user.upsert({
         where: { utorid },
         update: {},
@@ -187,11 +207,11 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
  *
  * - Students in the new list but not enrolled → added as STUDENT
  * - Students currently enrolled as STUDENT but not in the new list → removed
- * - TAs and professors are never touched.
+ * - TAs and the professor are never touched.
  *
  * Returns: { added: string[], removed: string[], unchanged: number }
  *
- * Only the professor enrolled in the course may call this.
+ * Only this room's professor may call it.
  */
 export async function PUT(request: NextRequest, { params }: RouteParams) {
   try {
@@ -208,7 +228,7 @@ export async function PUT(request: NextRequest, { params }: RouteParams) {
     });
     if (!enrollment || enrollment.role !== "PROFESSOR") {
       return NextResponse.json(
-        { error: "Only the course professor can sync the roster." },
+        { error: "Only this room’s professor can sync its roster." },
         { status: 403 }
       );
     }
@@ -272,6 +292,7 @@ export async function PUT(request: NextRequest, { params }: RouteParams) {
 
       // Never overwrite an existing PROFESSOR or TA enrollment — only create
       // new STUDENT enrollments or leave an already-STUDENT enrollment alone.
+      // The professor appearing on a student CSV must stay the professor.
       const existingEnrollment = await prisma.courseEnrollment.findUnique({
         where: { userId_courseId: { userId: enrolledUser.id, courseId } },
         select: { role: true },
@@ -311,17 +332,15 @@ export async function PUT(request: NextRequest, { params }: RouteParams) {
 // ---------------------------------------------------------------------------
 
 /**
- * Demotes a staff (TA) or co-professor enrollment to STUDENT by UTORid.
- * Students are demoted the same way (no-op if already STUDENT — still "removed"
- * from the instructional list by role). Actually students get role STUDENT update.
+ * Demotes a TA to STUDENT in this room. Demoting a student is a no-op.
  *
- * Request body: { utorid: string }
+ * The row is demoted rather than deleted so the person stays reachable in a
+ * live session instead of being kicked mid-lecture.
  *
- * Guards for PROFESSOR targets:
- *   - Cannot remove yourself
- *   - Cannot remove the last professor on the course
+ * Request body: { utorid: string }
  *
- * Only a professor enrolled in the course may call this.
+ * Only this room's professor may call it, and the professor themselves cannot
+ * be demoted — see the guard below.
  */
 export async function DELETE(request: NextRequest, { params }: RouteParams) {
   try {
@@ -338,7 +357,7 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
     });
     if (!enrollment || enrollment.role !== "PROFESSOR") {
       return NextResponse.json(
-        { error: "Only the course professor can remove students." },
+        { error: "Only this room’s professor can remove people from it." },
         { status: 403 }
       );
     }
@@ -371,22 +390,16 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
       return NextResponse.json({ error: "User is not enrolled in this course." }, { status: 404 });
     }
 
+    // The room's professor is the room. Demoting them would leave it with
+    // nobody able to start a session and no label to show.
     if (targetEnrollment.role === "PROFESSOR") {
-      if (target.id === user.userId) {
-        return NextResponse.json(
-          { error: "You cannot remove yourself as a professor." },
-          { status: 403 }
-        );
-      }
-      const professorCount = await prisma.courseEnrollment.count({
-        where: { courseId, role: "PROFESSOR" },
-      });
-      if (professorCount <= 1) {
-        return NextResponse.json(
-          { error: "Cannot remove the last professor from the course." },
-          { status: 403 }
-        );
-      }
+      return NextResponse.json(
+        {
+          error:
+            "This room's professor cannot be removed here. An admin removes a professor from the class, which deletes their room.",
+        },
+        { status: 403 }
+      );
     }
 
     // Demote to STUDENT rather than deleting the row — keeps them in live sessions.
diff --git a/src/lib/sessionJoin.ts b/src/lib/sessionJoin.ts
index 7df6e69..93dc809 100644
--- a/src/lib/sessionJoin.ts
+++ b/src/lib/sessionJoin.ts
@@ -144,6 +144,33 @@ export async function joinSession(code: string, userId: string): Promise<Session
     };
   }
 
+  // A professor runs one room and cannot see the others on the same class.
+  // A join code would otherwise walk straight around that, enrolling them in a
+  // colleague's room as a student.
+  const room = await prisma.course.findUnique({
+    where: { id: session.courseId },
+    select: { classlistId: true },
+  });
+
+  if (room?.classlistId) {
+    const ownsAnotherRoom = await prisma.course.findFirst({
+      where: {
+        classlistId: room.classlistId,
+        professorId: userId,
+        id: { not: session.courseId },
+      },
+      select: { id: true },
+    });
+
+    if (ownsAnotherRoom) {
+      return {
+        success: false,
+        error: "You run your own room on this class, so you cannot join another one.",
+        statusCode: 403,
+      };
+    }
+  }
+
   // Create enrollment as STUDENT
   const enrollment = await prisma.courseEnrollment.create({
     data: {
diff --git a/src/socket/index.ts b/src/socket/index.ts
index c00c6cd..3f09501 100644
--- a/src/socket/index.ts
+++ b/src/socket/index.ts
@@ -188,8 +188,13 @@ export async function initSocketIO(
         }
 
         if (socket.data.currentSessionId && socket.data.currentSessionId !== payload.sessionId) {
-          socket.leave(`session:${socket.data.currentSessionId}`);
-          await broadcastViewerCount(socket.data.currentSessionId);
+          const previous = socket.data.currentSessionId;
+          socket.leave(`session:${previous}`);
+          // The instructor room has to go too: a professor switching to a room
+          // where they are a student would otherwise keep receiving the old
+          // room's INSTRUCTOR_ONLY questions.
+          socket.leave(`session:${previous}:instructors`);
+          await broadcastViewerCount(previous);
         }
 
         socket.join(`session:${payload.sessionId}`);
@@ -233,6 +238,7 @@ export async function initSocketIO(
     socket.on("session:leave", async (payload) => {
       if (payload?.sessionId && typeof payload.sessionId === "string") {
         socket.leave(`session:${payload.sessionId}`);
+        socket.leave(`session:${payload.sessionId}:instructors`);
         if (socket.data.currentSessionId === payload.sessionId) {
           socket.data.currentSessionId = undefined;
           socket.data.currentSessionRole = undefined;
diff --git a/stress-tests/seed.ts b/stress-tests/seed.ts
index 9b25c39..a5c44e7 100644
--- a/stress-tests/seed.ts
+++ b/stress-tests/seed.ts
@@ -1,7 +1,7 @@
 /**
  * Stress Test Seed Script
  *
- * Creates 100 student users, 1 professor, 1 course, and 1 active session
+ * Creates 100 student users, 1 professor, 1 classlist with 1 room, and 1 active session
  * for stress testing. Run with: pnpm run stress:seed
  */
 import { PrismaClient, Role, SessionStatus } from "../src/generated/prisma";
@@ -35,6 +35,7 @@ async function seed() {
     where: { course: { code: "STRESS101" } },
   });
   await prisma.course.deleteMany({ where: { code: "STRESS101" } });
+  await prisma.classlist.deleteMany({ where: { code: "STRESS101" } });
   await prisma.user.deleteMany({
     where: {
       utorid: {
@@ -49,7 +50,9 @@ async function seed() {
       utorid: "stress_prof",
       email: "stress_prof@mail.utoronto.ca",
       name: "Stress Test Professor",
-      role: Role.PROFESSOR,
+      // Global roles are always STUDENT — being a professor is an enrollment.
+      role: Role.STUDENT,
+      hasLoggedIn: true,
     },
   });
 
@@ -68,13 +71,24 @@ async function seed() {
     orderBy: { utorid: "asc" },
   });
 
-  console.log("[stress-seed] Creating course STRESS101...");
+  console.log("[stress-seed] Creating classlist STRESS101 and its one room...");
+  const classlist = await prisma.classlist.create({
+    data: {
+      code: "STRESS101",
+      semester: "Winter 2026",
+      createdById: professor.id,
+    },
+  });
+
+  // One room, run by the one professor — the same shape the app creates.
   const course = await prisma.course.create({
     data: {
       code: "STRESS101",
-      name: "Stress Testing Course",
+      name: "STRESS101",
       semester: "Winter 2026",
       createdById: professor.id,
+      classlistId: classlist.id,
+      professorId: professor.id,
     },
   });
 
diff --git a/tsconfig.json b/tsconfig.json
index 0998797..2687a79 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -38,7 +38,9 @@
     ".next-probe-p/types/**/*.ts",
     ".next-probe-p/dev/types/**/*.ts",
     ".next-probe-a/types/**/*.ts",
-    ".next-probe-a/dev/types/**/*.ts"
+    ".next-probe-a/dev/types/**/*.ts",
+    ".next-probe-s/types/**/*.ts",
+    ".next-probe-s/dev/types/**/*.ts"
   ],
   "exclude": ["node_modules", ".next", ".next-prof", ".next-ta", ".next-student"]
 }

From 836dc17e240d4563629c9b34c3711d76ffb98149 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 08:12:02 -0400
Subject: [PATCH 20/29] Make the admin dashboard and docs describe rooms
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every room on a class carries the same code, so the dashboard's course table
listed N identical "TES101" rows with no way to tell them apart. Rows now show
whose room each is, search matches the professor's name or UTORid, and the tab
and delete copy say "rooms". The stats bar counts classlists separately from
rooms, which is the number that differs when a class has several professors.

FEATURES.md and the admin guide described professor-created courses with
co-professors sharing one room. They now describe classlists, per-professor
rooms, who can see what, and where each kind of management lives — the class
gear icon for admins, Manage TAs inside a session for a room's professor.

Also clears comments still referring to co-professors and the global role.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 FEATURES.md                                   | 69 +++++++++-----
 README.md                                     |  6 +-
 docs/ADMIN-GUIDE.md                           | 89 ++++++++++---------
 src/app/api/admin/courses/route.ts            | 12 ++-
 src/app/api/admin/stats/route.ts              |  6 +-
 src/app/api/sessions/route.ts                 |  2 +-
 src/app/dashboard/components/CoursesTable.tsx | 40 ++++++---
 src/app/dashboard/page.tsx                    |  9 +-
 src/lib/session.ts                            |  2 +-
 src/lib/sessionService.ts                     | 12 +--
 10 files changed, 155 insertions(+), 92 deletions(-)

diff --git a/FEATURES.md b/FEATURES.md
index dfcdfc5..d0cbe3e 100644
--- a/FEATURES.md
+++ b/FEATURES.md
@@ -29,28 +29,51 @@ A comprehensive list of every feature in the AskEasy platform.
 
 ---
 
-## Course Management
+## Classlists and Rooms
+
+A **classlist** is what an admin uploads: one course code, one semester, one
+student roster. It owns one **room** per professor — a room is where the Q&A
+actually happens, and it has exactly one professor.
 
 ### Creation
 
-- Professors create courses with a course code, name, and optional section
+- **Admins only** (`ADMIN_WHITELIST`). Professors are assigned to a class; they do not make one
 - **Semester auto-detection** from current date (Jan–Apr = Winter, May–Aug = Summer, Sep–Dec = Fall)
 - **CSV enrollment** — upload a CSV with columns: `utorid`, `givenName`, `surname`, `Email` (optional); rows with "Missing UTORid" or "ERROR" are skipped
-- **TA assignment** — professors can designate TAs during course creation
+- **One room per professor** — the creating admin gets a room of their own plus TA access to every other room; each other professor gets one room and no access to the rest
+- **Professor names** — a UTORid that has signed in autofills its real name; one that has not takes a temporary name from the admin, replaced at first sign-in
+- **Room labels** — the professor's surname alone, disambiguated with a first initial when two collide and with the UTORid when that is still ambiguous
+- **TA assignment** — TAs added at creation are TAs in every room on the class
+
+### Who sees what
+
+|                  | Their own room | Other rooms on the class |
+| ---------------- | -------------- | ------------------------ |
+| Creating admin   | PROFESSOR      | TA                       |
+| Other professors | PROFESSOR      | No access at all         |
+| TAs              | —              | TA in all                |
+| Students         | —              | STUDENT in all           |
+
+Students see one card per class and open it to pick a room. A professor's class
+opens onto exactly one room. Join codes respect this too: a professor cannot use
+one to enter a colleague's room on the same class.
 
 ### Operations
 
-- **Rename** — professor can update course code and/or semester
-- **Delete** — cascading deletion (questions, answers, upvotes, slide sets, sessions, enrollments); blocked if an ACTIVE session exists
+- **Rename** — an admin updates the class code and/or semester; the change fans out to every room
+- **Delete** — cascading deletion (questions, answers, upvotes, slide sets, sessions, enrollments) across all rooms; blocked while any room is live
+- **Add a professor** — creates a room seeded with the current roster and TAs
+- **Remove a professor** — deletes their room; blocked on the last professor and on a live room
 
-### Student & TA Management
+### Roster Management
 
-- **View roster** — returns students and TAs with name and UTORid
-- **Add individuals** — add one or more UTORids; returns added, already-enrolled, and invalid lists
-- **Batch sync** — full replace of the STUDENT roster from a new CSV; preserves TAs and professor
-- **Remove** — remove a single student by UTORid
+- **View roster** — pooled across rooms; the strongest role wins, so a TA in one room is a TA on the class
+- **Add individuals** — added to every room on the class
+- **Batch sync** — full replace of the STUDENT roster from a new CSV, across every room; preserves TAs and professors
+- **Remove** — a TA is demoted to student, a student is dropped; a room's professor is refused and sent to the professors endpoint
 - **Auto-creation** — users not yet in the database are created automatically on enrollment
 - **CSV diff preview** — before applying a sync, shows counts of students to add, remove, and unchanged
+- **Room-level TAs** — a professor assigns TAs on their own room from inside a live session; a room takes only one professor, so that route refuses PROFESSOR
 
 ---
 
@@ -201,17 +224,21 @@ If Redis is unavailable, rate limiting fails closed (blocks all requests).
 
 ## Permissions Matrix
 
-### Course Operations
-
-| Action              | Student | TA  |  Professor  |
-| ------------------- | :-----: | :-: | :---------: |
-| Create course       |         |     |     Yes     |
-| View own courses    |   Yes   | Yes |     Yes     |
-| Rename course       |         |     | Yes (owner) |
-| Delete course       |         |     | Yes (owner) |
-| View roster         |         |     | Yes (owner) |
-| Add/remove students |         |     | Yes (owner) |
-| Sync CSV roster     |         |     | Yes (owner) |
+### Class Operations
+
+| Action                   | Student | TA  | Professor | Admin |
+| ------------------------ | :-----: | :-: | :-------: | :---: |
+| Create a classlist       |         |     |           |  Yes  |
+| View own classes/rooms   |   Yes   | Yes |    Yes    |  Yes  |
+| Rename a class           |         |     |           |  Yes  |
+| Delete a class           |         |     |           |  Yes  |
+| Add/remove a professor   |         |     |           |  Yes  |
+| View class roster        |         |     |           |  Yes  |
+| Add/remove students, TAs |         |     |           |  Yes  |
+| Sync CSV roster          |         |     |           |  Yes  |
+| Manage TAs on own room   |         |     |    Yes    | Yes¹  |
+
+¹ On the room they run. An admin is a TA in the other rooms on their classes, not their professor.
 
 ### Session Operations
 
diff --git a/README.md b/README.md
index e1e8674..10b498e 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ AskEasy is built for that moment. It gives every lecture a live Q&A room where t
         │   PostgreSQL 16  │     │      Redis 7         │
         │   (via Prisma)   │     │  - Socket.IO pub/sub │
         │                  │     │  - Rate limiting     │
-        │  Users, Courses  │     │  - Answer mode TTL   │
+        │ Users, Classlists│     │  - Answer mode TTL   │
         │  Sessions, Q&A   │     │  - Session data      │
         │  Upvotes, Slides │     └─────────────────────┘
         └──────────────────┘
@@ -330,8 +330,8 @@ Pull requests run the same build and tests but do not deploy. The workflow is [.
 src/
 ├── app/                  # Next.js App Router pages & API routes
 │   ├── api/              # REST endpoints (auth, courses, sessions, questions, cron)
-│   ├── classes/          # Course listing & management UI
-│   ├── create-class/     # Course creation flow
+│   ├── classes/          # Classlist management modal
+│   ├── create-class/     # Classlist creation flow (admins only)
 │   ├── room/             # Live session room (chat + slide viewer)
 │   └── admin/            # Admin dashboard (data overview, table wipe)
 ├── components/ui/        # Shared UI components (Radix-based)
diff --git a/docs/ADMIN-GUIDE.md b/docs/ADMIN-GUIDE.md
index e02559a..48409a9 100644
--- a/docs/ADMIN-GUIDE.md
+++ b/docs/ADMIN-GUIDE.md
@@ -1,6 +1,6 @@
 # AskEasy — Administrator Guide
 
-This guide is for administrators who need to manage the platform — handling course cleanup at the end of a semester, controlling who can create classes, and accessing the database directly if needed.
+This guide is for administrators who need to manage the platform — handling cleanup at the end of a semester, controlling who can create classes, and accessing the database directly if needed.
 
 ---
 
@@ -51,17 +51,18 @@ The **Dashboard** link appears in the **top-right corner of the home page** —
 
 ### Stats bar
 
-At the top of the page, seven live counters give you a snapshot of the platform:
+At the top of the page, eight live counters give you a snapshot of the platform:
 
-| Counter         | What it shows                   |
-| --------------- | ------------------------------- |
-| Total Users     | Everyone who has ever logged in |
-| Total Courses   | All courses ever created        |
-| Active Sessions | Sessions currently live         |
-| Total Sessions  | All sessions ever created       |
-| Total Questions | All questions ever asked        |
-| Total Answers   | All answers ever posted         |
-| Enrollments     | Total course membership records |
+| Counter         | What it shows                                                                   |
+| --------------- | ------------------------------------------------------------------------------- |
+| Total Users     | Everyone who has ever logged in                                                 |
+| Classlists      | All classlists ever created                                                     |
+| Rooms           | All rooms ever created — one per professor, so this exceeds the classlist count |
+| Active Sessions | Sessions currently live                                                         |
+| Total Sessions  | All sessions ever created                                                       |
+| Total Questions | All questions ever asked                                                        |
+| Total Answers   | All answers ever posted                                                         |
+| Enrollments     | Total room membership records                                                   |
 
 Click **Refresh** (top right of the page) to reload the counts and all table data.
 
@@ -71,7 +72,7 @@ Click **Refresh** (top right of the page) to reload the counts and all table dat
 
 The landing tab when you open the dashboard. It has:
 
-- A reminder about how deletions cascade (e.g. deleting a user removes their questions, answers, and enrollments; deleting a course removes all its sessions and questions)
+- A reminder about how deletions cascade (e.g. deleting a user removes their questions, answers, and enrollments; deleting a room removes all its sessions and questions)
 - The **Danger Zone** — a "Delete Everything" button that wipes the entire database in one action. Requires typing `DELETE EVERYTHING` to confirm. Use this at the end of a term to fully reset the platform.
 
 ---
@@ -92,18 +93,18 @@ The landing tab when you open the dashboard. It has:
 
 ---
 
-### Courses tab
+### Rooms tab
 
 **Columns:** Code, Name, Semester, Created By, Enrollment count, Session count
 
 **Filters:**
 
-- Search by course code or name
+- Search by class code, room name, or the professor who runs it
 
 **Actions:**
 
-- Delete a single course — cascades to all its sessions, questions, answers, enrollments, and slides
-- **Delete All Courses** button — requires typing `DELETE COURSES` to confirm
+- Delete a single room — cascades to all its sessions, questions, answers, enrollments, and slides. Deleting the last room on a classlist removes the classlist too
+- **Delete All Rooms** button — requires typing `DELETE COURSES` to confirm
 
 ---
 
@@ -121,7 +122,7 @@ The landing tab when you open the dashboard. It has:
 - Delete a single session — removes all its questions, answers, and uploaded slides
 - **Delete All Sessions** button — requires typing `DELETE SESSIONS` to confirm
 
-> Deleting sessions here is the recommended way to clear old Q&A data at end of term without touching users or courses.
+> Deleting sessions here is the recommended way to clear old Q&A data at end of term without touching users or rooms.
 
 ---
 
@@ -155,52 +156,59 @@ The landing tab when you open the dashboard. It has:
 
 **Filters:**
 
-- Search by name, UTORid, or course code
+- Search by name, UTORid, or class code
 - Filter by role
 
 **Actions:**
 
-- Remove a single enrollment (removes the user from that course only, does not delete the user)
+- Remove a single enrollment (removes the user from that room only, does not delete the user)
 - **Delete All Enrollments** button — requires typing `DELETE ENROLLMENTS` to confirm
 - Supports **Load More** pagination (loads 50 at a time)
 
-> Deleting all enrollments at end of term is a clean way to reset course rosters while keeping user accounts intact.
+> Deleting all enrollments at end of term is a clean way to reset rosters while keeping user accounts intact.
 
 ---
 
-## Managing Courses Through the App
+## Managing Classes Through the App
 
-Professors manage everything through the **Manage Lecture** modal on the `/classes` page. Click "Manage Lecture" on any course card to open it. It has four tabs:
+Admins manage a class from the **gear icon** on its card on the home page. It has
+four tabs:
 
 ### Students tab
 
-- View the full student roster (searchable by name or UTORid)
-- **Remove** individual students by hovering their row and clicking the remove icon
-- **Add students** by typing one or more UTORids (comma, space, or newline separated)
-- **Sync roster from CSV** — upload a class list CSV exported from ACORN/ROSI. The app shows a preview of who will be added and removed before applying. TAs are not affected by a sync.
+- The pooled roster across every room on the class
+- Add students by UTORid — they are enrolled in every room
+- Sync the roster from a fresh CSV, with a diff preview before it applies
+- Removing a student drops them from every room
 
-### TAs tab
+### Rooms & TAs tab
 
-- View and remove current TAs
-- Add new TAs by UTORid — same input format as students
+- One row per room, showing who runs it, how many members it has, and whether it is live
+- Add a professor — this creates them a room seeded with the current roster and TAs
+- Remove a professor — this **deletes their room and everything in it**. Blocked on the last professor and on a live room
+- Add TAs by UTORid — they become TAs in every room on the class
+
+A professor manages TAs on their own room from inside a live session, via the
+Manage TAs button in the chat header. That affects their room only.
 
 ### Rename tab
 
-- Update the course code and/or semester label
+- Update the class code and/or semester label
+- The change fans out to every room, so none is left showing the old code
 
 ### Delete tab
 
-- Permanently deletes the course and everything under it: all sessions, questions, answers, upvotes, and uploaded slides
-- Requires typing the course code to confirm
-- **Blocked if the course has an active session** — end the session first
+- Permanently deletes the class, all its rooms, and everything under them: sessions, questions, answers, upvotes, and uploaded slides
+- Requires typing the class code to confirm
+- **Blocked while any room is live** — end the session first
 
 ---
 
-## End of Semester Cleanup
+## End-of-Semester Cleanup
 
-### Step 1 — Delete courses through the app
+### Step 1 — Delete classes through the app
 
-For each course you want to retire, go to `/classes`, open "Manage Lecture", go to the **Delete** tab, type the course code, and confirm. This cascades through the database and removes all associated sessions, Q&A data, enrollments, and slide records.
+For each class you want to retire, open its gear icon on the home page, go to the **Delete** tab, type the class code, and confirm. This cascades through the database and removes every room on the class along with all associated sessions, Q&A data, enrollments, and slide records.
 
 ### Step 2 — Remove uploaded slide files from disk
 
@@ -232,7 +240,7 @@ Useful psql commands:
 | `\dt`                      | List all tables                  |
 | `\q`                       | Exit psql                        |
 | `SELECT * FROM "User";`    | See all users who have logged in |
-| `SELECT * FROM "Course";`  | See all courses                  |
+| `SELECT * FROM "Course";`  | See all rooms                    |
 | `SELECT * FROM "Session";` | See all sessions                 |
 
 ### Database tables
@@ -240,9 +248,10 @@ Useful psql commands:
 | Table                             | What it stores                                                |
 | --------------------------------- | ------------------------------------------------------------- |
 | `User`                            | Everyone who has logged in (UTORid, name, email, global role) |
-| `Course`                          | Courses created by professors                                 |
-| `CourseEnrollment`                | Which users are in which courses (STUDENT / TA / PROFESSOR)   |
-| `Session`                         | Live Q&A sessions within a course                             |
+| `Classlist`                       | A class an admin uploaded: code, semester, roster             |
+| `Course`                          | A **room** — one professor's space inside a classlist         |
+| `CourseEnrollment`                | Which users are in which rooms (STUDENT / TA / PROFESSOR)     |
+| `Session`                         | Live Q&A sessions within a room                               |
 | `Question`                        | Questions asked during sessions                               |
 | `Answer`                          | Answers to questions                                          |
 | `QuestionUpvote` / `AnswerUpvote` | Upvote records                                                |
diff --git a/src/app/api/admin/courses/route.ts b/src/app/api/admin/courses/route.ts
index 89cb469..601e6b3 100644
--- a/src/app/api/admin/courses/route.ts
+++ b/src/app/api/admin/courses/route.ts
@@ -19,19 +19,25 @@ export async function GET(request: NextRequest) {
       where.OR = [
         { code: { contains: search, mode: "insensitive" } },
         { name: { contains: search, mode: "insensitive" } },
+        { professor: { name: { contains: search, mode: "insensitive" } } },
+        { professor: { utorid: { contains: search, mode: "insensitive" } } },
       ];
     }
 
-    const courses = await prisma.course.findMany({
+    // Rows are rooms, and every room on a class carries the same code — without
+    // the professor there is no way to tell one row from another.
+    const rooms = await prisma.course.findMany({
       where,
       include: {
         createdBy: { select: { name: true, utorid: true } },
+        professor: { select: { name: true, utorid: true } },
+        classlist: { select: { id: true, code: true } },
         _count: { select: { enrollments: true, sessions: true } },
       },
-      orderBy: { code: "asc" },
+      orderBy: [{ code: "asc" }, { professor: { name: "asc" } }],
     });
 
-    return NextResponse.json({ courses });
+    return NextResponse.json({ courses: rooms });
   } catch (error) {
     console.error("[Admin Courses] Failed to fetch courses:", error);
     return NextResponse.json({ error: "An error occurred." }, { status: 500 });
diff --git a/src/app/api/admin/stats/route.ts b/src/app/api/admin/stats/route.ts
index 9e0716e..c32172b 100644
--- a/src/app/api/admin/stats/route.ts
+++ b/src/app/api/admin/stats/route.ts
@@ -9,9 +9,12 @@ export async function GET() {
     const guard = adminGuardResponse(user);
     if (guard) return guard;
 
-    const [users, courses, sessions, activeSessions, questions, answers, enrollments] =
+    const [users, classlists, courses, sessions, activeSessions, questions, answers, enrollments] =
       await Promise.all([
         prisma.user.count(),
+        prisma.classlist.count(),
+        // Course rows are rooms — one per professor, so this exceeds the
+        // classlist count whenever a class has more than one.
         prisma.course.count(),
         prisma.session.count(),
         prisma.session.count({ where: { status: "ACTIVE" } }),
@@ -22,6 +25,7 @@ export async function GET() {
 
     return NextResponse.json({
       users,
+      classlists,
       courses,
       sessions,
       activeSessions,
diff --git a/src/app/api/sessions/route.ts b/src/app/api/sessions/route.ts
index de77bcf..f9606e8 100644
--- a/src/app/api/sessions/route.ts
+++ b/src/app/api/sessions/route.ts
@@ -9,7 +9,7 @@ import { getCurrentUser } from "@/lib/auth";
  * GET /api/sessions
  *
  * Returns active sessions for courses the user is enrolled in.
- * (Enrollment — not course.createdById — so co-professors see the same live session.)
+ * Enrollment-scoped, so this returns only the rooms the caller belongs to.
  */
 export async function GET() {
   try {
diff --git a/src/app/dashboard/components/CoursesTable.tsx b/src/app/dashboard/components/CoursesTable.tsx
index 017972b..4187c1c 100644
--- a/src/app/dashboard/components/CoursesTable.tsx
+++ b/src/app/dashboard/components/CoursesTable.tsx
@@ -6,17 +6,20 @@ import { Button } from "@/components/ui/button";
 import { Trash2, Search } from "lucide-react";
 import DeleteConfirmModal from "./DeleteConfirmModal";
 
-interface Course {
+/** One row is a room — one professor's space inside a classlist. */
+interface Room {
   id: string;
   code: string;
   name: string;
   semester: string;
   createdBy: { name: string; utorid: string };
+  professor: { name: string; utorid: string } | null;
+  classlist: { id: string; code: string } | null;
   _count: { enrollments: number; sessions: number };
 }
 
 export default function CoursesTable() {
-  const [courses, setCourses] = useState<Course[]>([]);
+  const [courses, setCourses] = useState<Room[]>([]);
   const [search, setSearch] = useState("");
   const [deleteTarget, setDeleteTarget] = useState<{
     type: "single" | "all";
@@ -45,7 +48,7 @@ export default function CoursesTable() {
     if (res.ok) {
       fetchRef.current++;
       setCourses((prev) => prev.filter((c) => c.id !== courseId));
-    } else alert("Failed to delete course.");
+    } else alert("Failed to delete room.");
   };
 
   const confirmDeleteAll = async () => {
@@ -53,7 +56,7 @@ export default function CoursesTable() {
     if (res.ok) {
       fetchRef.current++;
       setCourses([]);
-    } else alert("Failed to delete all courses.");
+    } else alert("Failed to delete all rooms.");
   };
 
   return (
@@ -62,14 +65,14 @@ export default function CoursesTable() {
         <div className="relative flex-1">
           <Search className="absolute left-3 top-1/2 -translate-y-1/2 w-4 h-4 text-stone-400" />
           <Input
-            placeholder="Search by code or name…"
+            placeholder="Search by code, name or professor…"
             value={search}
             onChange={(e) => setSearch(e.target.value)}
             className="pl-9"
           />
         </div>
         <Button variant="destructive" onClick={() => setDeleteTarget({ type: "all" })}>
-          Delete All Courses
+          Delete All Rooms
         </Button>
       </div>
 
@@ -77,8 +80,8 @@ export default function CoursesTable() {
         <table className="w-full text-sm">
           <thead>
             <tr className="border-b bg-stone-50 text-stone-500">
-              <th className="text-left px-4 py-3 font-medium">Code</th>
-              <th className="text-left px-4 py-3 font-medium">Name</th>
+              <th className="text-left px-4 py-3 font-medium">Class</th>
+              <th className="text-left px-4 py-3 font-medium">Room (professor)</th>
               <th className="text-left px-4 py-3 font-medium">Semester</th>
               <th className="text-left px-4 py-3 font-medium">Created By</th>
               <th className="text-center px-4 py-3 font-medium">Enrollments</th>
@@ -96,14 +99,25 @@ export default function CoursesTable() {
             ) : courses.length === 0 ? (
               <tr>
                 <td colSpan={7} className="px-4 py-8 text-center text-stone-400">
-                  No courses found.
+                  No rooms found.
                 </td>
               </tr>
             ) : (
               courses.map((course) => (
                 <tr key={course.id} className="border-b last:border-0 hover:bg-stone-50">
                   <td className="px-4 py-3 font-mono text-xs">{course.code}</td>
-                  <td className="px-4 py-3">{course.name}</td>
+                  <td className="px-4 py-3">
+                    {course.professor ? (
+                      <>
+                        {course.professor.name}{" "}
+                        <span className="text-stone-400 font-mono text-xs">
+                          {course.professor.utorid}
+                        </span>
+                      </>
+                    ) : (
+                      <span className="text-stone-400 italic">Unassigned</span>
+                    )}
+                  </td>
                   <td className="px-4 py-3 text-stone-500">{course.semester}</td>
                   <td className="px-4 py-3 text-stone-500">{course.createdBy.name}</td>
                   <td className="px-4 py-3 text-center">{course._count.enrollments}</td>
@@ -130,11 +144,11 @@ export default function CoursesTable() {
       <DeleteConfirmModal
         isOpen={!!deleteTarget}
         onClose={() => setDeleteTarget(null)}
-        title={deleteTarget?.type === "all" ? "Delete All Courses" : "Delete Course"}
+        title={deleteTarget?.type === "all" ? "Delete All Rooms" : "Delete Room"}
         description={
           deleteTarget?.type === "all" ? (
             <>
-              This will permanently delete <strong>ALL courses</strong> and{" "}
+              This will permanently delete <strong>ALL rooms and classlists</strong> and{" "}
               <strong>ALL their sessions, questions, and enrollments</strong>. This cannot be
               undone.
             </>
@@ -146,7 +160,7 @@ export default function CoursesTable() {
           )
         }
         requireTypeToConfirm={deleteTarget?.type === "all" ? "DELETE COURSES" : undefined}
-        confirmText={deleteTarget?.type === "all" ? "Delete All Courses" : "Delete Course"}
+        confirmText={deleteTarget?.type === "all" ? "Delete All Rooms" : "Delete Room"}
         onConfirm={async () => {
           if (deleteTarget?.type === "all") {
             await confirmDeleteAll();
diff --git a/src/app/dashboard/page.tsx b/src/app/dashboard/page.tsx
index 83bc29b..188cce7 100644
--- a/src/app/dashboard/page.tsx
+++ b/src/app/dashboard/page.tsx
@@ -7,6 +7,7 @@ import { Button } from "@/components/ui/button";
 import {
   Users,
   BookOpen,
+  DoorOpen,
   Radio,
   MessageSquare,
   MessageCircle,
@@ -24,6 +25,7 @@ import SlideSetsTable from "./components/SlideSetsTable";
 
 interface Stats {
   users: number;
+  classlists: number;
   courses: number;
   sessions: number;
   activeSessions: number;
@@ -61,7 +63,8 @@ export default function DashboardPage() {
 
   const statCards = [
     { label: "Total Users", value: stats?.users, icon: Users },
-    { label: "Total Courses", value: stats?.courses, icon: BookOpen },
+    { label: "Classlists", value: stats?.classlists, icon: BookOpen },
+    { label: "Rooms", value: stats?.courses, icon: DoorOpen },
     { label: "Active Sessions", value: stats?.activeSessions, icon: Radio },
     { label: "Total Sessions", value: stats?.sessions, icon: Radio },
     { label: "Total Questions", value: stats?.questions, icon: MessageSquare },
@@ -101,7 +104,7 @@ export default function DashboardPage() {
         <TabsList>
           <TabsTrigger value="overview">Overview</TabsTrigger>
           <TabsTrigger value="users">Users</TabsTrigger>
-          <TabsTrigger value="courses">Courses</TabsTrigger>
+          <TabsTrigger value="courses">Rooms</TabsTrigger>
           <TabsTrigger value="sessions">Sessions</TabsTrigger>
           <TabsTrigger value="slidesets">Slide Sets</TabsTrigger>
           <TabsTrigger value="questions">Questions</TabsTrigger>
@@ -181,7 +184,7 @@ export default function DashboardPage() {
           <>
             This action will permanently delete{" "}
             <strong>
-              absolutely ALL users, courses, sessions, questions, enrollments, and answers
+              absolutely ALL users, classlists, rooms, sessions, questions, enrollments, and answers
             </strong>{" "}
             in the database. This CANNOT be undone.
           </>
diff --git a/src/lib/session.ts b/src/lib/session.ts
index 58a77e8..45eef61 100644
--- a/src/lib/session.ts
+++ b/src/lib/session.ts
@@ -43,7 +43,7 @@ export function getSessionOptions(): SessionOptions {
       httpOnly: true,
       sameSite: "lax",
       // 8-hour session lifetime. Reduces the window where a revoked user's
-      // cookie stays valid after a whitelist update + server restart.
+      // cookie stays valid after an ADMIN_WHITELIST update + server restart.
       maxAge: 60 * 60 * 8,
     },
   };
diff --git a/src/lib/sessionService.ts b/src/lib/sessionService.ts
index 0ea2691..db02937 100644
--- a/src/lib/sessionService.ts
+++ b/src/lib/sessionService.ts
@@ -196,10 +196,9 @@ export async function getSessionMembership(
 /**
  * Resolves the per-course role of several users in one query.
  *
- * CourseEnrollment is the source of truth for role-based UI: `User.role` is
- * global and stays STUDENT for someone who is a TA in a particular course.
- * Users with no enrollment row (e.g. a professor acting outside their own
- * courses) are absent from the map — fall back to their global role.
+ * CourseEnrollment is the only source of truth for role-based UI: `User.role`
+ * is always STUDENT now. Users with no enrollment row for this room are absent
+ * from the map, and callers treat that as STUDENT.
  */
 export async function getCourseRoles(
   courseId: string,
@@ -276,7 +275,8 @@ export async function validateProfessorRole(
  * Creates a new session for a course.
  * Validates professor role and generates unique join code.
  * If the course already has an ACTIVE session, returns that one instead of
- * creating a duplicate (co-professors must share one live room).
+ * creating a duplicate — a professor rejoining their own room must land in
+ * the session already running there.
  *
  * @param data - Session creation data (courseId, title, userId)
  * @returns Result with created (or existing) session or error
@@ -304,7 +304,7 @@ export async function createSession(data: SessionCreateInput): Promise<SessionCr
     createdAt: true,
   } as const;
 
-  // One live session per course — join the existing one if a co-prof already started it.
+  // One live session per room — hand back the running one rather than starting a second.
   const existing = await prisma.session.findFirst({
     where: { courseId, status: "ACTIVE" },
     select: sessionSelect,

From 0ab0522710b10f0057617e374e01b674e2dd6c8a Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 22:25:37 -0400
Subject: [PATCH 21/29] Better placeholder text

---
 src/app/classes/ManageClassModal.tsx              | 4 ++--
 src/app/components/ClassBrowser.tsx               | 2 +-
 src/app/create-class/components/ProfessorList.tsx | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/app/classes/ManageClassModal.tsx b/src/app/classes/ManageClassModal.tsx
index dd1b1b8..5388a14 100644
--- a/src/app/classes/ManageClassModal.tsx
+++ b/src/app/classes/ManageClassModal.tsx
@@ -884,7 +884,7 @@ export default function ManageClassModal({
                     value={professorUtorid}
                     spellCheck={false}
                     onChange={(e) => handleProfessorUtoridChange(e.target.value)}
-                    placeholder="UTORid — e.g. smithj"
+                    placeholder="UTORid — ex. smithj"
                     className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
                   />
                   <input
@@ -893,7 +893,7 @@ export default function ManageClassModal({
                     spellCheck={false}
                     disabled={professorKnown}
                     onChange={(e) => setProfessorName(e.target.value)}
-                    placeholder="Full name — e.g. Jane Smith"
+                    placeholder="Last name - ex. Engineer (For room naming)"
                     className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all disabled:bg-stone-50 disabled:text-stone-500"
                   />
                   {professorKnown ? (
diff --git a/src/app/components/ClassBrowser.tsx b/src/app/components/ClassBrowser.tsx
index 08523db..d141af0 100644
--- a/src/app/components/ClassBrowser.tsx
+++ b/src/app/components/ClassBrowser.tsx
@@ -208,7 +208,7 @@ function EmptyState({ isAdmin }: { isAdmin: boolean }) {
       <p className="text-stone-500 text-lg max-w-md text-center mb-8">
         {isAdmin
           ? "Upload a classlist and add the professors teaching it. Each one gets their own room."
-          : "You aren't on any classes yet. An admin adds you when they upload the classlist."}
+          : "You aren't in any classes yet. A participating admin professor will add you."}
       </p>
 
       {isAdmin && (
diff --git a/src/app/create-class/components/ProfessorList.tsx b/src/app/create-class/components/ProfessorList.tsx
index 0ca3794..5dbe102 100644
--- a/src/app/create-class/components/ProfessorList.tsx
+++ b/src/app/create-class/components/ProfessorList.tsx
@@ -140,7 +140,7 @@ export default function ProfessorList({ rows, onChange }: ProfessorListProps) {
                   value={row.utorid}
                   spellCheck={false}
                   onChange={(e) => handleUtoridChange(row.key, e.target.value)}
-                  placeholder="UTORid — e.g. smithj"
+                  placeholder="UTORid — ex. smithj"
                   className="w-full border-2 border-stone-100 rounded-md px-4 py-2.5 text-sm font-mono focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm"
                 />
               </div>
@@ -153,7 +153,7 @@ export default function ProfessorList({ rows, onChange }: ProfessorListProps) {
                     spellCheck={false}
                     disabled={known}
                     onChange={(e) => patch(row.key, { displayName: e.target.value })}
-                    placeholder="Full name — e.g. Jane Smith"
+                    placeholder="Last name - ex. Engineer (For room naming)"
                     className="w-full border-2 border-stone-100 rounded-md px-4 py-2.5 pr-9 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm disabled:bg-stone-50 disabled:text-stone-500"
                   />
                   {row.status === "checking" && (

From e53bbeb0117b740adabdfa5edd2c139c6a19dbec Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 22:27:08 -0400
Subject: [PATCH 22/29] Page through the whole roster in the classlist preview
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The preview table cut off at four rows and said "Showing 4 of 5 students" with
no way to see the rest — an admin could not check that the roster they were
about to upload was actually right.

It now pages four at a time with prev/next arrows, a position readout, and a
page counter. Short last pages are padded with spacer rows so the card keeps
its height instead of jumping, and the controls are hidden entirely when
everyone already fits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/__tests__/preview-class.test.tsx          | 91 +++++++++++++++++++
 .../create-class/components/PreviewClass.tsx  | 67 ++++++++++++--
 test-classlist.csv                            |  6 ++
 tsconfig.json                                 |  8 +-
 4 files changed, 163 insertions(+), 9 deletions(-)
 create mode 100644 src/__tests__/preview-class.test.tsx
 create mode 100644 test-classlist.csv

diff --git a/src/__tests__/preview-class.test.tsx b/src/__tests__/preview-class.test.tsx
new file mode 100644
index 0000000..2791719
--- /dev/null
+++ b/src/__tests__/preview-class.test.tsx
@@ -0,0 +1,91 @@
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { cleanup, fireEvent, render, screen } from "@testing-library/react";
+
+import PreviewClass from "@/app/create-class/components/PreviewClass";
+import { emptyProfessorRow } from "@/app/create-class/components/ProfessorList";
+import type { StudentRecord } from "@/utils/types";
+
+function students(n: number): StudentRecord[] {
+  return Array.from({ length: n }, (_, i) => ({
+    givenName: `Given${i + 1}`,
+    surname: `Sur${i + 1}`,
+    utorid: `stu${i + 1}`,
+  }));
+}
+
+function renderPreview(count: number) {
+  return render(
+    <PreviewClass
+      file={new File(["a"], "roster.csv", { type: "text/csv" })}
+      processedData={{ courseCode: "TES101", students: students(count) }}
+      onClear={vi.fn()}
+      onSubmit={vi.fn()}
+      professorRows={[emptyProfessorRow()]}
+      onProfessorRowsChange={vi.fn()}
+      tasInput=""
+      onTasChange={vi.fn()}
+      courseCodeInput="TES101"
+      onCourseCodeChange={vi.fn()}
+    />
+  );
+}
+
+afterEach(cleanup);
+
+describe("PreviewClass roster pagination", () => {
+  test("pages through every student", () => {
+    renderPreview(5);
+
+    expect(screen.getByText("1–4 of 5 students")).toBeTruthy();
+    expect(screen.getByText("Given1")).toBeTruthy();
+    expect(screen.getByText("Given4")).toBeTruthy();
+    expect(screen.queryByText("Given5")).toBeNull();
+
+    fireEvent.click(screen.getByLabelText("Next students"));
+
+    expect(screen.getByText("5–5 of 5 students")).toBeTruthy();
+    expect(screen.getByText("Given5")).toBeTruthy();
+    expect(screen.queryByText("Given1")).toBeNull();
+
+    fireEvent.click(screen.getByLabelText("Previous students"));
+    expect(screen.getByText("Given1")).toBeTruthy();
+  });
+
+  test("disables the arrows at each end", () => {
+    renderPreview(5);
+    const prev = screen.getByLabelText("Previous students") as HTMLButtonElement;
+    const next = screen.getByLabelText("Next students") as HTMLButtonElement;
+
+    expect(prev.disabled).toBe(true);
+    expect(next.disabled).toBe(false);
+
+    fireEvent.click(next);
+    expect(prev.disabled).toBe(false);
+    expect(next.disabled).toBe(true);
+  });
+
+  test("shows the page counter", () => {
+    renderPreview(9);
+    expect(screen.getByText("1 / 3")).toBeTruthy();
+    fireEvent.click(screen.getByLabelText("Next students"));
+    expect(screen.getByText("2 / 3")).toBeTruthy();
+  });
+
+  test("keeps the table four rows tall on a short last page", () => {
+    const { container } = renderPreview(5);
+    const rowCount = () => container.querySelectorAll("tbody tr").length;
+
+    expect(rowCount()).toBe(4);
+    fireEvent.click(screen.getByLabelText("Next students"));
+    // One student plus three spacers — the card must not shrink.
+    expect(rowCount()).toBe(4);
+    expect(container.querySelectorAll('tbody tr[aria-hidden="true"]').length).toBe(3);
+  });
+
+  test("hides the controls when everyone already fits", () => {
+    renderPreview(4);
+    expect(screen.queryByLabelText("Next students")).toBeNull();
+    expect(screen.queryByText(/of 4 students/)).toBeNull();
+    expect(screen.getByText("Given4")).toBeTruthy();
+  });
+});
diff --git a/src/app/create-class/components/PreviewClass.tsx b/src/app/create-class/components/PreviewClass.tsx
index 5ee2e1e..9a2bd8a 100644
--- a/src/app/create-class/components/PreviewClass.tsx
+++ b/src/app/create-class/components/PreviewClass.tsx
@@ -1,8 +1,14 @@
-import { CheckCircle2, File as FileIcon, X } from "lucide-react";
+"use client";
+
+import { useState } from "react";
+import { CheckCircle2, ChevronLeft, ChevronRight, File as FileIcon, X } from "lucide-react";
 import { ProcessedClassData } from "@/utils/types";
 
 import ProfessorList, { type ProfessorRow } from "./ProfessorList";
 
+/** Rows per page in the roster preview. Keeps the card a predictable height. */
+const STUDENTS_PER_PAGE = 4;
+
 interface PreviewClassProps {
   file: File;
   processedData: ProcessedClassData | null;
@@ -28,6 +34,18 @@ export default function PreviewClass({
   courseCodeInput,
   onCourseCodeChange,
 }: PreviewClassProps) {
+  const [page, setPage] = useState(0);
+
+  const students = processedData?.students ?? [];
+  const pageCount = Math.max(1, Math.ceil(students.length / STUDENTS_PER_PAGE));
+  // Clamp rather than reset in an effect — a newly parsed, shorter roster can
+  // leave the page index past the end.
+  const currentPage = Math.min(page, pageCount - 1);
+  const firstIndex = currentPage * STUDENTS_PER_PAGE;
+  const visible = students.slice(firstIndex, firstIndex + STUDENTS_PER_PAGE);
+  // Hold the table's height steady so the page doesn't jump on a short last page.
+  const filler = STUDENTS_PER_PAGE - visible.length;
+
   return (
     <div className="space-y-8 animate-in fade-in duration-300">
       <div className="bg-stone-50 border-2 border-stone-100 rounded-md p-6 relative">
@@ -89,8 +107,8 @@ export default function PreviewClass({
                 </tr>
               </thead>
               <tbody className="divide-y divide-stone-200">
-                {processedData.students.slice(0, 4).map((student, idx) => (
-                  <tr key={idx} className="hover:bg-stone-50 transition-colors">
+                {visible.map((student, i) => (
+                  <tr key={firstIndex + i} className="hover:bg-stone-50 transition-colors">
                     <td className="px-6 py-3.5 text-stone-700 font-medium">{student.givenName}</td>
                     <td className="px-6 py-3.5 text-stone-700 font-medium">{student.surname}</td>
                     <td className="px-6 py-3.5 text-stone-500 font-mono text-xs">
@@ -98,14 +116,47 @@ export default function PreviewClass({
                     </td>
                   </tr>
                 ))}
+                {Array.from({ length: filler }, (_, i) => (
+                  <tr key={`filler-${i}`} aria-hidden="true">
+                    <td className="px-6 py-3.5" colSpan={3}>
+                      &nbsp;
+                    </td>
+                  </tr>
+                ))}
               </tbody>
             </table>
+
+            {students.length > STUDENTS_PER_PAGE && (
+              <div className="flex items-center justify-between gap-3 px-6 py-3 bg-stone-50 border-t border-stone-200">
+                <p className="text-xs text-stone-500 font-medium tracking-wide">
+                  {firstIndex + 1}&ndash;{firstIndex + visible.length} of {students.length} students
+                </p>
+                <div className="flex items-center gap-1">
+                  <button
+                    type="button"
+                    onClick={() => setPage(currentPage - 1)}
+                    disabled={currentPage === 0}
+                    aria-label="Previous students"
+                    className="w-8 h-8 flex items-center justify-center rounded-md text-stone-500 hover:text-stone-900 hover:bg-stone-200 transition-colors disabled:opacity-30 disabled:hover:bg-transparent disabled:cursor-not-allowed"
+                  >
+                    <ChevronLeft className="w-4 h-4" />
+                  </button>
+                  <span className="text-xs text-stone-500 font-medium tabular-nums px-1">
+                    {currentPage + 1} / {pageCount}
+                  </span>
+                  <button
+                    type="button"
+                    onClick={() => setPage(currentPage + 1)}
+                    disabled={currentPage >= pageCount - 1}
+                    aria-label="Next students"
+                    className="w-8 h-8 flex items-center justify-center rounded-md text-stone-500 hover:text-stone-900 hover:bg-stone-200 transition-colors disabled:opacity-30 disabled:hover:bg-transparent disabled:cursor-not-allowed"
+                  >
+                    <ChevronRight className="w-4 h-4" />
+                  </button>
+                </div>
+              </div>
+            )}
           </div>
-          {processedData.students.length > 4 && (
-            <p className="text-xs text-stone-500 text-center pt-2 font-medium tracking-wide">
-              Showing 4 of {processedData.students.length} students
-            </p>
-          )}
         </div>
       )}
 
diff --git a/test-classlist.csv b/test-classlist.csv
new file mode 100644
index 0000000..c5d8425
--- /dev/null
+++ b/test-classlist.csv
@@ -0,0 +1,6 @@
+Given Name,Surname,UTORid,Acad_act
+Sam,Reyes,devstudent,TES101
+Priya,Raman,devstu2,TES101
+Noah,Bergman,devstu3,TES101
+Mei,Lin,devstu4,TES101
+Kofi,Mensah,devstu5,TES101
diff --git a/tsconfig.json b/tsconfig.json
index 2687a79..9cf2bca 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -40,7 +40,13 @@
     ".next-probe-a/types/**/*.ts",
     ".next-probe-a/dev/types/**/*.ts",
     ".next-probe-s/types/**/*.ts",
-    ".next-probe-s/dev/types/**/*.ts"
+    ".next-probe-s/dev/types/**/*.ts",
+    ".next-prof-1/types/**/*.ts",
+    ".next-prof-1/dev/types/**/*.ts",
+    ".next-prof-2/types/**/*.ts",
+    ".next-prof-2/dev/types/**/*.ts",
+    ".next-prof-3/types/**/*.ts",
+    ".next-prof-3/dev/types/**/*.ts"
   ],
   "exclude": ["node_modules", ".next", ".next-prof", ".next-ta", ".next-student"]
 }

From a51517eca3c8d0e4fc3518d9371d885aa601d621 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 22:36:11 -0400
Subject: [PATCH 23/29] A room's name is the room's, set by an admin and
 permanent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The name an admin typed for a professor was being written onto that person's
User record as a placeholder, then overwritten with their real name the first
time they signed in — so the label an admin chose could change under them, and
the form had to warn about it. That is backwards: the name is the room's, not
the professor's.

Course.name now holds it. It is typed at creation, never rewritten by a login,
survives a class rename, and only an admin changes it — via a new
PATCH /api/classlists/[id]/rooms, or by clicking the name in the Rooms tab.

Nothing branches on whether someone has signed in before, so the machinery that
existed to decide that is gone: User.hasLoggedIn, GET /api/users/lookup, the
autofill, the amber "temporary name" warning, and the surname disambiguation
that silently rewrote two Smiths into initials. Two rooms may now share a name
if an admin gives them one; that is the admin's call to make.

upsertPersonByUtorid no longer writes names at all. A new user is named after
their UTORid until Shibboleth gives us the real one.

Fixes a bug this surfaced: adding a professor to an existing class filtered the
creating admin out of the new room's TA list, because the filter that keeps
sibling professors out did not exempt them. The admin was left with no
enrollment, so the room they had just created was invisible on their own home
page. Verified with 80 checks across four probes against live dev servers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 FEATURES.md                                   |   6 +-
 docs/ADMIN-GUIDE.md                           |   3 +-
 .../migration.sql                             |  16 ++
 .../migration.sql                             |   4 +
 prisma/schema.prisma                          |  11 +-
 src/__tests__/class-browser.test.tsx          |  16 +-
 src/__tests__/room-label.test.ts              |  73 -------
 src/app/api/auth/session/route.ts             |   6 -
 .../[classlistId]/professors/route.ts         |  51 +++--
 .../classlists/[classlistId]/rooms/route.ts   |  65 ++++++
 src/app/api/classlists/[classlistId]/route.ts |  41 ++--
 src/app/api/classlists/route.ts               |  62 +++---
 src/app/api/users/lookup/route.ts             |  81 --------
 src/app/classes/ManageClassModal.tsx          | 115 +++++------
 src/app/components/RoomGrid.tsx               |   7 -
 src/app/components/classTypes.ts              |   4 +-
 .../create-class/components/ProfessorList.tsx | 186 ++++--------------
 src/app/create-class/page.tsx                 |   6 +-
 src/lib/classlistService.ts                   |  65 +++---
 src/lib/nameUtils.ts                          |  13 ++
 src/lib/roomLabel.ts                          |  71 -------
 tsconfig.json                                 |   6 -
 22 files changed, 310 insertions(+), 598 deletions(-)
 create mode 100644 prisma/migrations/20260911000000_room_name_is_owned/migration.sql
 create mode 100644 prisma/migrations/20260911010000_drop_has_logged_in/migration.sql
 delete mode 100644 src/__tests__/room-label.test.ts
 create mode 100644 src/app/api/classlists/[classlistId]/rooms/route.ts
 delete mode 100644 src/app/api/users/lookup/route.ts
 create mode 100644 src/lib/nameUtils.ts
 delete mode 100644 src/lib/roomLabel.ts

diff --git a/FEATURES.md b/FEATURES.md
index d0cbe3e..6b220f6 100644
--- a/FEATURES.md
+++ b/FEATURES.md
@@ -41,8 +41,7 @@ actually happens, and it has exactly one professor.
 - **Semester auto-detection** from current date (Jan–Apr = Winter, May–Aug = Summer, Sep–Dec = Fall)
 - **CSV enrollment** — upload a CSV with columns: `utorid`, `givenName`, `surname`, `Email` (optional); rows with "Missing UTORid" or "ERROR" are skipped
 - **One room per professor** — the creating admin gets a room of their own plus TA access to every other room; each other professor gets one room and no access to the rest
-- **Professor names** — a UTORid that has signed in autofills its real name; one that has not takes a temporary name from the admin, replaced at first sign-in
-- **Room labels** — the professor's surname alone, disambiguated with a first initial when two collide and with the UTORid when that is still ambiguous
+- **Room names** — the admin types a name for each professor's room (the creator's own defaults to their surname). It is the room's name, not the professor's: signing in never rewrites it, and only an admin changes it afterwards
 - **TA assignment** — TAs added at creation are TAs in every room on the class
 
 ### Who sees what
@@ -62,7 +61,8 @@ one to enter a colleague's room on the same class.
 
 - **Rename** — an admin updates the class code and/or semester; the change fans out to every room
 - **Delete** — cascading deletion (questions, answers, upvotes, slide sets, sessions, enrollments) across all rooms; blocked while any room is live
-- **Add a professor** — creates a room seeded with the current roster and TAs
+- **Add a professor** — creates a room, named by the admin, seeded with the current roster and TAs
+- **Rename a room** — admin-only; the professor of a room cannot rename it
 - **Remove a professor** — deletes their room; blocked on the last professor and on a live room
 
 ### Roster Management
diff --git a/docs/ADMIN-GUIDE.md b/docs/ADMIN-GUIDE.md
index 48409a9..b634cfd 100644
--- a/docs/ADMIN-GUIDE.md
+++ b/docs/ADMIN-GUIDE.md
@@ -184,7 +184,8 @@ four tabs:
 ### Rooms & TAs tab
 
 - One row per room, showing who runs it, how many members it has, and whether it is live
-- Add a professor — this creates them a room seeded with the current roster and TAs
+- Click a room's name to rename it. The name is the room's, not the professor's — it is yours to set and nothing else ever changes it
+- Add a professor — this creates them a room, with the name you give it, seeded with the current roster and TAs
 - Remove a professor — this **deletes their room and everything in it**. Blocked on the last professor and on a live room
 - Add TAs by UTORid — they become TAs in every room on the class
 
diff --git a/prisma/migrations/20260911000000_room_name_is_owned/migration.sql b/prisma/migrations/20260911000000_room_name_is_owned/migration.sql
new file mode 100644
index 0000000..b26a0f3
--- /dev/null
+++ b/prisma/migrations/20260911000000_room_name_is_owned/migration.sql
@@ -0,0 +1,16 @@
+-- Course.name becomes the room's own label instead of a copy of the class code.
+--
+-- Until now a room was labelled by deriving its professor's surname at read
+-- time, which meant the label changed under the admin whenever that person's
+-- account name changed. The label is now stored and admin-owned.
+--
+-- Backfill with what the derivation used to produce: the last whitespace-
+-- separated part of the professor's name, falling back to their UTORid.
+-- Rooms with no professor keep the class code they already had.
+UPDATE "Course" c
+SET "name" = COALESCE(
+    NULLIF(regexp_replace(btrim(u."name"), '^.*\s', ''), ''),
+    u."utorid"
+)
+FROM "User" u
+WHERE c."professorId" = u."id";
diff --git a/prisma/migrations/20260911010000_drop_has_logged_in/migration.sql b/prisma/migrations/20260911010000_drop_has_logged_in/migration.sql
new file mode 100644
index 0000000..f1f09f1
--- /dev/null
+++ b/prisma/migrations/20260911010000_drop_has_logged_in/migration.sql
@@ -0,0 +1,4 @@
+-- hasLoggedIn existed only to decide whether a name an admin typed was a
+-- placeholder. Room names are now the room's own, set by an admin and never
+-- rewritten, so nothing branches on whether someone has signed in before.
+ALTER TABLE "User" DROP COLUMN "hasLoggedIn";
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index ad0efb7..fcada2d 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -59,10 +59,6 @@ model User {
   name  String
   /// Always STUDENT. Real roles live on CourseEnrollment, per room.
   role  Role   @default(STUDENT)
-  /// False while `name` is a placeholder — a UTORid, or a temporary name an
-  /// admin typed when assigning this person to a class. Set on first sign-in,
-  /// when Shibboleth gives us their real name.
-  hasLoggedIn Boolean @default(false)
 
   enrollments       CourseEnrollment[]
   createdCourses    Course[]
@@ -101,14 +97,17 @@ model Classlist {
 /// CourseEnrollment on it has role PROFESSOR.
 model Course {
   id        String   @id @default(cuid())
+  /// The classlist's code, copied here for display. Same across sibling rooms.
   code      String
+  /// The room's label, e.g. "Nakamura". Set by the admin who created the room
+  /// and only ever changed by an admin — it is the room's name, not the
+  /// professor's, so signing in never rewrites it.
   name      String
   semester  String
   createdById String
   /// Null only for rooms created before classlists existed.
   classlistId String?
-  /// The room's one professor. Its display label is derived from this user's
-  /// name, so it follows them when a placeholder name is replaced at sign-in.
+  /// The room's one professor.
   professorId String?
 
   createdBy   User               @relation(fields: [createdById], references: [id])
diff --git a/src/__tests__/class-browser.test.tsx b/src/__tests__/class-browser.test.tsx
index cc35873..e5d9250 100644
--- a/src/__tests__/class-browser.test.tsx
+++ b/src/__tests__/class-browser.test.tsx
@@ -52,7 +52,7 @@ describe("ClassBrowser", () => {
             label: "Smith",
             code: "TES101",
             role: "STUDENT",
-            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: true },
+            professor: { name: "Jane Smith", utorid: "smithj" },
             isMine: false,
             activeSession: null,
           },
@@ -61,7 +61,7 @@ describe("ClassBrowser", () => {
             label: "Haddad",
             code: "TES101",
             role: "STUDENT",
-            professor: { name: "Omar Haddad", utorid: "haddado", hasLoggedIn: true },
+            professor: { name: "Omar Haddad", utorid: "haddado" },
             isMine: false,
             activeSession: null,
           },
@@ -87,7 +87,7 @@ describe("ClassBrowser", () => {
             label: "Smith",
             code: "TES101",
             role: "STUDENT",
-            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: true },
+            professor: { name: "Jane Smith", utorid: "smithj" },
             isMine: false,
             activeSession: { id: "s1", joinCode: "ABC123" },
           },
@@ -96,7 +96,7 @@ describe("ClassBrowser", () => {
             label: "Haddad",
             code: "TES101",
             role: "STUDENT",
-            professor: { name: "Omar Haddad", utorid: "haddado", hasLoggedIn: true },
+            professor: { name: "Omar Haddad", utorid: "haddado" },
             isMine: false,
             activeSession: null,
           },
@@ -126,7 +126,7 @@ describe("ClassBrowser", () => {
             label: "Smith",
             code: "TES101",
             role: "PROFESSOR",
-            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: true },
+            professor: { name: "Jane Smith", utorid: "smithj" },
             isMine: true,
             activeSession: null,
           },
@@ -151,7 +151,7 @@ describe("ClassBrowser", () => {
             label: "Smith",
             code: "TES101",
             role: "STUDENT",
-            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: false },
+            professor: { name: "Jane Smith", utorid: "smithj" },
             isMine: false,
             activeSession: null,
           },
@@ -162,7 +162,7 @@ describe("ClassBrowser", () => {
     render(<ClassBrowser isAdmin={false} />);
     fireEvent.click(await screen.findByText("TES101"));
 
-    expect(screen.getByText(/Temporary name/)).toBeTruthy();
+    expect(screen.getByText("Smith")).toBeTruthy();
   });
 
   test("only the class creator gets the manage control", async () => {
@@ -187,7 +187,7 @@ describe("ClassBrowser", () => {
             label: "Smith",
             code: "TES101",
             role: "STUDENT",
-            professor: { name: "Jane Smith", utorid: "smithj", hasLoggedIn: true },
+            professor: { name: "Jane Smith", utorid: "smithj" },
             isMine: false,
             activeSession: null,
           },
diff --git a/src/__tests__/room-label.test.ts b/src/__tests__/room-label.test.ts
deleted file mode 100644
index 06cfdf2..0000000
--- a/src/__tests__/room-label.test.ts
+++ /dev/null
@@ -1,73 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { roomLabelsFor, surnameOf, type RoomProfessor } from "@/lib/roomLabel";
-
-const prof = (id: string, name: string, utorid: string): RoomProfessor => ({ id, name, utorid });
-
-describe("surnameOf", () => {
-  it("returns the last part of a name", () => {
-    expect(surnameOf("John Smith")).toBe("Smith");
-    expect(surnameOf("Maria del Carmen Rodriguez")).toBe("Rodriguez");
-  });
-
-  it("returns a single-part name unchanged", () => {
-    expect(surnameOf("Prince")).toBe("Prince");
-    expect(surnameOf("smithj")).toBe("smithj");
-  });
-
-  it("tolerates padding and repeated spaces", () => {
-    expect(surnameOf("  John   Smith  ")).toBe("Smith");
-  });
-
-  it("returns an empty string for a missing name", () => {
-    expect(surnameOf("")).toBe("");
-    expect(surnameOf(null)).toBe("");
-    expect(surnameOf(undefined)).toBe("");
-  });
-});
-
-describe("roomLabelsFor", () => {
-  it("uses the bare surname when it is unique", () => {
-    const labels = roomLabelsFor([
-      prof("1", "John Smith", "smithj"),
-      prof("2", "Ada Lovelace", "lovea"),
-    ]);
-    expect(labels.get("1")).toBe("Smith");
-    expect(labels.get("2")).toBe("Lovelace");
-  });
-
-  it("adds a first initial when two professors share a surname", () => {
-    const labels = roomLabelsFor([
-      prof("1", "John Smith", "smithj"),
-      prof("2", "Ada Smith", "smitha"),
-      prof("3", "Ada Lovelace", "lovea"),
-    ]);
-    expect(labels.get("1")).toBe("J. Smith");
-    expect(labels.get("2")).toBe("A. Smith");
-    // Unaffected by the collision next to it.
-    expect(labels.get("3")).toBe("Lovelace");
-  });
-
-  it("falls back to the UTORid when the initial does not separate them", () => {
-    const labels = roomLabelsFor([
-      prof("1", "John Smith", "smithj"),
-      prof("2", "Jane Smith", "smithj2"),
-    ]);
-    expect(labels.get("1")).toBe("Smith (smithj)");
-    expect(labels.get("2")).toBe("Smith (smithj2)");
-  });
-
-  it("labels a placeholder single-word name by the word itself", () => {
-    const labels = roomLabelsFor([prof("1", "smithj", "smithj")]);
-    expect(labels.get("1")).toBe("smithj");
-  });
-
-  it("uses the UTORid when there is no name at all", () => {
-    const labels = roomLabelsFor([prof("1", "", "smithj")]);
-    expect(labels.get("1")).toBe("smithj");
-  });
-
-  it("returns an empty map for no professors", () => {
-    expect(roomLabelsFor([]).size).toBe(0);
-  });
-});
diff --git a/src/app/api/auth/session/route.ts b/src/app/api/auth/session/route.ts
index 267a95e..1608c0b 100644
--- a/src/app/api/auth/session/route.ts
+++ b/src/app/api/auth/session/route.ts
@@ -73,24 +73,18 @@ export async function GET(request: NextRequest) {
   //    CourseEnrollment. User.role is therefore only ever STUDENT and is
   //    kept solely as the default for new enrollment rows.
   // ------------------------------------------------------------------
-  //
-  //    hasLoggedIn also flips true here. Until it does, `name` may be a
-  //    placeholder an admin typed when assigning this person to a class, and
-  //    the identity provider's name replaces it now.
   const user = await prisma.user.upsert({
     where: { utorid },
     update: {
       ...(name ? { name } : {}),
       ...(email ? { email } : {}),
       role: "STUDENT",
-      hasLoggedIn: true,
     },
     create: {
       utorid,
       name: name ?? utorid,
       email: email ?? `${utorid}@mail.utoronto.ca`,
       role: "STUDENT",
-      hasLoggedIn: true,
     },
   });
 
diff --git a/src/app/api/classlists/[classlistId]/professors/route.ts b/src/app/api/classlists/[classlistId]/professors/route.ts
index d4970d9..fa964cb 100644
--- a/src/app/api/classlists/[classlistId]/professors/route.ts
+++ b/src/app/api/classlists/[classlistId]/professors/route.ts
@@ -9,7 +9,6 @@ import {
   normalizeProfessorInputs,
   upsertPersonByUtorid,
 } from "@/lib/classlistService";
-import { roomLabelsFor } from "@/lib/roomLabel";
 
 interface RouteParams {
   params: Promise<{ classlistId: string }>;
@@ -31,7 +30,7 @@ interface RouteParams {
  * Adds a professor and creates their room, seeded with the class's existing
  * roster and TAs plus the classlist creator as a TA.
  *
- * Request body: { utorid: string; displayName?: string }
+ * Request body: { utorid: string; roomName?: string }
  * Response: { room: { id, label, utorid } }
  */
 export async function POST(request: NextRequest, { params }: RouteParams) {
@@ -79,12 +78,12 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
 
     const created = await prisma.$transaction(
       async (tx) => {
-        const professor = await upsertPersonByUtorid(tx, input.utorid, input.displayName);
+        const professor = await upsertPersonByUtorid(tx, input.utorid);
 
         const room = await tx.course.create({
           data: {
             code: classlist.code,
-            name: classlist.code,
+            name: input.roomName || input.utorid,
             semester: classlist.semester,
             createdById: classlist.createdById,
             classlistId,
@@ -97,9 +96,11 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         // The creating admin watches every room but their own.
         if (professor.id !== classlist.createdById) taIds.add(classlist.createdById);
 
-        // A professor never gets a student row in their own room, and the
-        // template room's professor is a stranger here — they stay out.
-        const otherProfessorIds = new Set(
+        // Professors of the sibling rooms must not appear in this one at all —
+        // that isolation is the point. The classlist creator is the deliberate
+        // exception: they are a TA in every room, including this one, so they
+        // are excluded from this set even though they run a room too.
+        const siblingProfessorIds = new Set(
           (
             await tx.course.findMany({
               where: { classlistId, professorId: { not: null } },
@@ -107,48 +108,42 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             })
           )
             .map((r) => r.professorId)
-            .filter((id): id is string => !!id && id !== professor.id)
+            .filter(
+              (id): id is string => !!id && id !== professor.id && id !== classlist.createdById
+            )
         );
 
+        // Nobody who instructs this room gets a student row in it.
         const studentIds = seed
           .filter((e) => e.role === "STUDENT")
           .map((e) => e.userId)
-          .filter((id) => id !== professor.id && !otherProfessorIds.has(id));
+          .filter(
+            (id) =>
+              id !== professor.id && id !== classlist.createdById && !siblingProfessorIds.has(id)
+          );
 
         await tx.courseEnrollment.createMany({
           data: buildEnrollmentRows([
             {
               roomId: room.id,
               professorId: professor.id,
-              taIds: [...taIds].filter((id) => !otherProfessorIds.has(id)),
+              taIds: [...taIds].filter((id) => !siblingProfessorIds.has(id)),
               studentIds,
             },
           ]),
         });
 
-        return { roomId: room.id, professorId: professor.id, utorid: professor.utorid };
+        return {
+          roomId: room.id,
+          utorid: professor.utorid,
+          label: input.roomName || input.utorid,
+        };
       },
       { maxWait: 10_000, timeout: 120_000 }
     );
 
-    // Label against the whole class so a new Smith gets an initial and so does
-    // the Smith who was already there.
-    const professors = await prisma.course.findMany({
-      where: { classlistId, professorId: { not: null } },
-      select: { professor: { select: { id: true, name: true, utorid: true } } },
-    });
-    const labels = roomLabelsFor(
-      professors.map((p) => p.professor!).filter((p): p is NonNullable<typeof p> => !!p)
-    );
-
     return NextResponse.json(
-      {
-        room: {
-          id: created.roomId,
-          utorid: created.utorid,
-          label: labels.get(created.professorId) ?? created.utorid,
-        },
-      },
+      { room: { id: created.roomId, utorid: created.utorid, label: created.label } },
       { status: 201 }
     );
   } catch (error) {
diff --git a/src/app/api/classlists/[classlistId]/rooms/route.ts b/src/app/api/classlists/[classlistId]/rooms/route.ts
new file mode 100644
index 0000000..fd68402
--- /dev/null
+++ b/src/app/api/classlists/[classlistId]/rooms/route.ts
@@ -0,0 +1,65 @@
+import { NextRequest, NextResponse } from "next/server";
+
+import { prisma } from "@/lib/prisma";
+import { requireClasslistAdmin } from "@/lib/classlistAccess";
+
+interface RouteParams {
+  params: Promise<{ classlistId: string }>;
+}
+
+// ---------------------------------------------------------------------------
+// PATCH /api/classlists/[classlistId]/rooms
+// ---------------------------------------------------------------------------
+
+/**
+ * Renames one room.
+ *
+ * A room's name is the admin's to set — it is not derived from its professor's
+ * account, so nothing else ever changes it. Admin-only, like everything else
+ * that touches a class as a whole.
+ *
+ * Request body: { roomId: string; name: string }
+ * Response: { room: { id, label } }
+ */
+export async function PATCH(request: NextRequest, { params }: RouteParams) {
+  try {
+    const { classlistId } = await params;
+    const access = await requireClasslistAdmin(classlistId);
+    if (!access.ok) {
+      return NextResponse.json({ error: access.error }, { status: access.status });
+    }
+
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
+    }
+
+    const { roomId, name } = (body as Record<string, unknown>) ?? {};
+
+    if (!roomId || typeof roomId !== "string") {
+      return NextResponse.json({ error: "roomId is required." }, { status: 400 });
+    }
+    if (typeof name !== "string" || name.trim().length === 0) {
+      return NextResponse.json({ error: "A room name is required." }, { status: 400 });
+    }
+
+    // Scope the update to this classlist so a roomId from elsewhere cannot be
+    // renamed through a class the caller happens to administer.
+    if (!access.context.roomIds.includes(roomId)) {
+      return NextResponse.json({ error: "That room is not on this class." }, { status: 404 });
+    }
+
+    const room = await prisma.course.update({
+      where: { id: roomId },
+      data: { name: name.trim() },
+      select: { id: true, name: true },
+    });
+
+    return NextResponse.json({ room: { id: room.id, label: room.name } });
+  } catch (error) {
+    console.error("[Classlists API] Failed to rename room:", error);
+    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
+  }
+}
diff --git a/src/app/api/classlists/[classlistId]/route.ts b/src/app/api/classlists/[classlistId]/route.ts
index a504729..83c2043 100644
--- a/src/app/api/classlists/[classlistId]/route.ts
+++ b/src/app/api/classlists/[classlistId]/route.ts
@@ -3,7 +3,6 @@ import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
 import { requireClasslistAdmin } from "@/lib/classlistAccess";
 import { deleteRooms, liveRoomIds } from "@/lib/classlistService";
-import { roomLabelsFor } from "@/lib/roomLabel";
 
 interface RouteParams {
   params: Promise<{ classlistId: string }>;
@@ -33,19 +32,15 @@ export async function GET(_request: NextRequest, { params }: RouteParams) {
       where: { classlistId },
       select: {
         id: true,
+        name: true,
         professorId: true,
-        professor: { select: { id: true, name: true, utorid: true, hasLoggedIn: true } },
+        professor: { select: { id: true, name: true, utorid: true } },
         _count: { select: { enrollments: true } },
       },
+      orderBy: { name: "asc" },
     });
 
     const live = new Set(await liveRoomIds(roomIds));
-    const labels = roomLabelsFor(
-      rooms
-        .map((r) => r.professor)
-        .filter((p): p is NonNullable<typeof p> => !!p)
-        .map((p) => ({ id: p.id, name: p.name, utorid: p.utorid }))
-    );
 
     return NextResponse.json({
       classlist: {
@@ -53,22 +48,16 @@ export async function GET(_request: NextRequest, { params }: RouteParams) {
         code: classlist.code,
         semester: classlist.semester,
         createdById: classlist.createdById,
-        rooms: rooms
-          .map((room) => ({
-            id: room.id,
-            label: room.professorId ? (labels.get(room.professorId) ?? "") : "",
-            professor: room.professor
-              ? {
-                  name: room.professor.name,
-                  utorid: room.professor.utorid,
-                  hasLoggedIn: room.professor.hasLoggedIn,
-                }
-              : null,
-            memberCount: room._count.enrollments,
-            isLive: live.has(room.id),
-            isCreatorRoom: room.professorId === classlist.createdById,
-          }))
-          .sort((a, b) => a.label.localeCompare(b.label)),
+        rooms: rooms.map((room) => ({
+          id: room.id,
+          label: room.name,
+          professor: room.professor
+            ? { name: room.professor.name, utorid: room.professor.utorid }
+            : null,
+          memberCount: room._count.enrollments,
+          isLive: live.has(room.id),
+          isCreatorRoom: room.professorId === classlist.createdById,
+        })),
       },
     });
   } catch (error) {
@@ -129,10 +118,12 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
         select: { id: true, code: true, semester: true },
       });
 
+      // Only the copied-for-display fields. `name` is the room's own label and
+      // renaming the class must not wipe what an admin chose to call each room.
       await tx.course.updateMany({
         where: { classlistId },
         data: {
-          ...(updates.code ? { code: updates.code, name: updates.code } : {}),
+          ...(updates.code ? { code: updates.code } : {}),
           ...(updates.semester ? { semester: updates.semester } : {}),
         },
       });
diff --git a/src/app/api/classlists/route.ts b/src/app/api/classlists/route.ts
index 816443a..1ef5f9a 100644
--- a/src/app/api/classlists/route.ts
+++ b/src/app/api/classlists/route.ts
@@ -3,7 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
 import { getCurrentUser } from "@/lib/auth";
 import { isAdmin } from "@/lib/adminWhitelist";
-import { roomLabelsFor } from "@/lib/roomLabel";
+import { surnameOf } from "@/lib/nameUtils";
 import {
   buildEnrollmentRows,
   fullNameOf,
@@ -52,7 +52,7 @@ export async function GET() {
             semester: true,
             classlistId: true,
             professorId: true,
-            professor: { select: { id: true, name: true, utorid: true, hasLoggedIn: true } },
+            professor: { select: { id: true, name: true, utorid: true } },
             classlist: {
               select: { id: true, code: true, semester: true, createdById: true },
             },
@@ -98,32 +98,18 @@ export async function GET() {
     }
 
     const classlists = [...groups.values()].map((group) => {
-      // Disambiguate surnames within a classlist, not globally — two rooms
-      // only collide if they sit next to each other.
-      const labels = roomLabelsFor(
-        group.rooms
-          .map((e) => e.course.professor)
-          .filter((p): p is NonNullable<typeof p> => !!p)
-          .map((p) => ({ id: p.id, name: p.name, utorid: p.utorid }))
-      );
-
       const rooms = group.rooms
         .map((enrollment) => {
           const { course } = enrollment;
           const session = course.sessions[0] ?? null;
           return {
             id: course.id,
-            label: course.professor
-              ? (labels.get(course.professor.id) ?? course.name)
-              : course.name,
+            // Course.name is the room's own label, set by an admin.
+            label: course.name,
             code: course.code,
             role: enrollment.role,
             professor: course.professor
-              ? {
-                  name: course.professor.name,
-                  utorid: course.professor.utorid,
-                  hasLoggedIn: course.professor.hasLoggedIn,
-                }
+              ? { name: course.professor.name, utorid: course.professor.utorid }
               : null,
             isMine: course.professorId === user.userId,
             activeSession: session ? { id: session.id, joinCode: session.joinCode } : null,
@@ -231,7 +217,6 @@ export async function POST(request: NextRequest) {
           email: user.email,
           name: user.name,
           role: "STUDENT",
-          hasLoggedIn: true,
         },
       });
 
@@ -240,10 +225,18 @@ export async function POST(request: NextRequest) {
       });
 
       // Professors, creator first — their room is the one they run.
-      const professorUsers = [{ id: user.userId, utorid: creatorUtorid }];
+      // The creator's own room falls back to their surname; they never typed a
+      // name for it.
+      const professorUsers = [
+        { id: user.userId, utorid: creatorUtorid, roomName: surnameOf(user.name) || creatorUtorid },
+      ];
       for (const input of professorInputs) {
-        const person = await upsertPersonByUtorid(tx, input.utorid, input.displayName);
-        professorUsers.push({ id: person.id, utorid: person.utorid });
+        const person = await upsertPersonByUtorid(tx, input.utorid);
+        professorUsers.push({
+          id: person.id,
+          utorid: person.utorid,
+          roomName: input.roomName || person.utorid,
+        });
       }
       const professorIds = new Set(professorUsers.map((p) => p.id));
 
@@ -273,13 +266,13 @@ export async function POST(request: NextRequest) {
       }
 
       const plans: RoomEnrollmentPlan[] = [];
-      const rooms: { id: string; professorId: string; utorid: string }[] = [];
+      const rooms: { id: string; professorId: string; utorid: string; name: string }[] = [];
 
       for (const professor of professorUsers) {
         const room = await tx.course.create({
           data: {
             code: classCode,
-            name: classCode,
+            name: professor.roomName,
             semester,
             createdById: user.userId,
             classlistId: classlist.id,
@@ -288,7 +281,12 @@ export async function POST(request: NextRequest) {
           select: { id: true },
         });
 
-        rooms.push({ id: room.id, professorId: professor.id, utorid: professor.utorid });
+        rooms.push({
+          id: room.id,
+          professorId: professor.id,
+          utorid: professor.utorid,
+          name: professor.roomName,
+        });
         plans.push({
           roomId: room.id,
           professorId: professor.id,
@@ -300,21 +298,11 @@ export async function POST(request: NextRequest) {
 
       await tx.courseEnrollment.createMany({ data: buildEnrollmentRows(plans) });
 
-      const professorRecords = await tx.user.findMany({
-        where: { id: { in: [...professorIds] } },
-        select: { id: true, name: true, utorid: true },
-      });
-      const labels = roomLabelsFor(professorRecords);
-
       return {
         id: classlist.id,
         code: classlist.code,
         semester: classlist.semester,
-        rooms: rooms.map((room) => ({
-          id: room.id,
-          utorid: room.utorid,
-          label: labels.get(room.professorId) ?? room.utorid,
-        })),
+        rooms: rooms.map((room) => ({ id: room.id, utorid: room.utorid, label: room.name })),
       };
     }, CREATE_TRANSACTION_OPTIONS);
 
diff --git a/src/app/api/users/lookup/route.ts b/src/app/api/users/lookup/route.ts
deleted file mode 100644
index d6cbc26..0000000
--- a/src/app/api/users/lookup/route.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-
-import { prisma } from "@/lib/prisma";
-import { getCurrentUser } from "@/lib/auth";
-import { isAdmin } from "@/lib/adminWhitelist";
-
-// ---------------------------------------------------------------------------
-// GET /api/users/lookup?utorids=smithj,doej
-//
-// Resolves UTORids to display names so the classlist form can autofill a
-// professor who is already known and ask for a temporary name for one who is
-// not.
-//
-// `hasLoggedIn` is the meaningful field: a user row can exist because someone
-// was on a roster or because an admin typed a placeholder for them, and in
-// neither case is `name` their real name.
-//
-// Admin-only — it discloses names for arbitrary UTORids.
-//
-// Response: { users: [{ utorid, name, hasLoggedIn, exists }] }
-// ---------------------------------------------------------------------------
-
-/** Refuse absurd batches; the form looks up a handful of professors at a time. */
-const MAX_LOOKUPS = 50;
-
-export async function GET(request: NextRequest) {
-  try {
-    const user = await getCurrentUser();
-    if (!user) {
-      return NextResponse.json({ error: "Authentication required." }, { status: 401 });
-    }
-
-    if (!isAdmin(user.utorid)) {
-      return NextResponse.json({ error: "Admins only." }, { status: 403 });
-    }
-
-    const raw = request.nextUrl.searchParams.get("utorids") ?? "";
-    const utorids = [
-      ...new Set(
-        raw
-          .split(",")
-          .map((u) => u.trim().toLowerCase())
-          .filter(Boolean)
-      ),
-    ];
-
-    if (utorids.length === 0) {
-      return NextResponse.json({ users: [] });
-    }
-
-    if (utorids.length > MAX_LOOKUPS) {
-      return NextResponse.json(
-        { error: `Too many UTORids — ${MAX_LOOKUPS} at a time.` },
-        { status: 400 }
-      );
-    }
-
-    const found = await prisma.user.findMany({
-      where: { utorid: { in: utorids } },
-      select: { utorid: true, name: true, hasLoggedIn: true },
-    });
-    const byUtorid = new Map(found.map((u) => [u.utorid, u]));
-
-    return NextResponse.json({
-      users: utorids.map((utorid) => {
-        const match = byUtorid.get(utorid);
-        return {
-          utorid,
-          exists: !!match,
-          // Only a signed-in user's name is worth autofilling — anything else
-          // is a placeholder the admin should be allowed to replace.
-          name: match?.hasLoggedIn ? match.name : null,
-          hasLoggedIn: match?.hasLoggedIn ?? false,
-        };
-      }),
-    });
-  } catch (error) {
-    console.error("[Users API] Failed to look up UTORids:", error);
-    return NextResponse.json({ error: "An error occurred." }, { status: 500 });
-  }
-}
diff --git a/src/app/classes/ManageClassModal.tsx b/src/app/classes/ManageClassModal.tsx
index 5388a14..12ad3a3 100644
--- a/src/app/classes/ManageClassModal.tsx
+++ b/src/app/classes/ManageClassModal.tsx
@@ -42,7 +42,7 @@ interface RosterEntry {
 interface RoomEntry {
   id: string;
   label: string;
-  professor: { name: string; utorid: string; hasLoggedIn: boolean } | null;
+  professor: { name: string; utorid: string } | null;
   memberCount: number;
   isLive: boolean;
   isCreatorRoom: boolean;
@@ -229,8 +229,9 @@ export default function ManageClassModal({
   // ---- Add professor state ----
   const [professorUtorid, setProfessorUtorid] = useState("");
   const [professorName, setProfessorName] = useState("");
-  const [professorKnown, setProfessorKnown] = useState(false);
   const [addingProfessor, setAddingProfessor] = useState(false);
+  const [renamingRoomId, setRenamingRoomId] = useState<string | null>(null);
+  const [renameRoomError, setRenameRoomError] = useState<string | null>(null);
   const [professorAddError, setProfessorAddError] = useState<string | null>(null);
   const [professorAddSuccess, setProfessorAddSuccess] = useState<string | null>(null);
   const [removingRoomUtorid, setRemovingRoomUtorid] = useState<string | null>(null);
@@ -406,34 +407,34 @@ export default function ManageClassModal({
     }
   }
 
-  // Adding a professor builds a room, so it takes one UTORid at a time and
-  // needs a name to label that room with.
-  async function handleProfessorUtoridChange(raw: string) {
-    const utorid = raw.trim().toLowerCase();
-    setProfessorUtorid(utorid);
-    setProfessorAddError(null);
-    setProfessorAddSuccess(null);
-    if (!utorid) {
-      setProfessorKnown(false);
-      setProfessorName("");
-      return;
-    }
+  // Adding a professor builds a room, so it takes one UTORid and the name that
+  // room will carry. Nothing is looked up: the name is the room's, not the
+  // person's, so it does not matter whether they have signed in before.
+  async function handleRenameRoom(roomId: string, name: string) {
+    const trimmed = name.trim();
+    const room = rooms.find((r) => r.id === roomId);
+    if (!trimmed || !room || trimmed === room.label) return;
 
+    setRenamingRoomId(roomId);
+    setRenameRoomError(null);
     try {
-      const res = await fetch(`/api/users/lookup?utorids=${encodeURIComponent(utorid)}`);
-      if (!res.ok) return;
+      const res = await fetch(`/api/classlists/${classlist.id}/rooms`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ roomId, name: trimmed }),
+      });
       const data = await res.json();
-      const match = data.users?.[0];
-      // The field may have moved on while this was in flight.
-      if (match?.utorid !== utorid) return;
-      if (match.hasLoggedIn && match.name) {
-        setProfessorKnown(true);
-        setProfessorName(match.name);
-      } else {
-        setProfessorKnown(false);
+      if (!res.ok) {
+        setRenameRoomError(data.error ?? "Failed to rename the room.");
+        await fetchRoster();
+        return;
       }
+      setRooms((prev) => prev.map((r) => (r.id === roomId ? { ...r, label: trimmed } : r)));
+      onChanged();
     } catch {
-      /* leave the name editable — the admin can type one */
+      setRenameRoomError("Failed to rename the room. Please try again.");
+    } finally {
+      setRenamingRoomId(null);
     }
   }
 
@@ -441,7 +442,7 @@ export default function ManageClassModal({
     const utorid = professorUtorid.trim().toLowerCase();
     if (!utorid) return;
     if (!professorName.trim()) {
-      setProfessorAddError("Add a name — it labels their room until they first sign in.");
+      setProfessorAddError("Give the room a name — it is what everyone will see it called.");
       return;
     }
 
@@ -453,10 +454,7 @@ export default function ManageClassModal({
       const res = await fetch(`/api/classlists/${classlist.id}/professors`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          utorid,
-          ...(professorKnown ? {} : { displayName: professorName.trim() }),
-        }),
+        body: JSON.stringify({ utorid, roomName: professorName.trim() }),
       });
       const data = await res.json();
       if (!res.ok) {
@@ -466,7 +464,6 @@ export default function ManageClassModal({
       setProfessorAddSuccess(`Created a room for ${data.room?.label ?? utorid}.`);
       setProfessorUtorid("");
       setProfessorName("");
-      setProfessorKnown(false);
       await fetchRoster();
       onChanged();
     } catch {
@@ -822,9 +819,24 @@ export default function ManageClassModal({
                       <li key={room.id} className="flex items-center gap-2 px-3 py-2.5 group">
                         <div className="min-w-0 flex-1">
                           <div className="flex items-center gap-1.5">
-                            <span className="text-sm font-medium text-stone-800 truncate">
-                              {room.label}
-                            </span>
+                            {/* The room's name is the admin's to change. Committing
+                                on blur or Enter keeps it a one-gesture edit. */}
+                            <input
+                              type="text"
+                              defaultValue={room.label}
+                              key={`${room.id}:${room.label}`}
+                              aria-label={`Room name for ${room.professor?.utorid ?? room.id}`}
+                              disabled={renamingRoomId === room.id}
+                              onBlur={(e) => handleRenameRoom(room.id, e.target.value)}
+                              onKeyDown={(e) => {
+                                if (e.key === "Enter") e.currentTarget.blur();
+                                if (e.key === "Escape") {
+                                  e.currentTarget.value = room.label;
+                                  e.currentTarget.blur();
+                                }
+                              }}
+                              className="min-w-0 flex-1 text-sm font-medium text-stone-800 bg-transparent border border-transparent rounded px-1.5 py-0.5 -ml-1.5 hover:border-stone-200 focus:border-green-400 focus:bg-white focus:outline-none focus:ring-4 focus:ring-green-50 transition-all disabled:opacity-50"
+                            />
                             {room.isLive && (
                               <span className="shrink-0 px-1.5 py-0.5 rounded bg-green-50 text-green-700 text-[10px] font-bold border border-green-200">
                                 LIVE
@@ -836,16 +848,11 @@ export default function ManageClassModal({
                               </span>
                             )}
                           </div>
-                          <span className="text-xs text-stone-400">
+                          <span className="text-xs text-stone-400 pl-0.5">
                             {room.professor?.name ?? "Unassigned"}
                             {room.professor ? ` · ${room.professor.utorid}` : ""} ·{" "}
                             {room.memberCount} member{room.memberCount === 1 ? "" : "s"}
                           </span>
-                          {room.professor && !room.professor.hasLoggedIn && (
-                            <span className="block text-[11px] text-amber-600">
-                              Temporary name until they sign in
-                            </span>
-                          )}
                         </div>
                         {room.professor && !room.isCreatorRoom && rooms.length > 1 && (
                           <button
@@ -870,20 +877,27 @@ export default function ManageClassModal({
                   </ul>
                 )}
 
+                {renameRoomError && <p className="text-xs text-red-500">{renameRoomError}</p>}
+
                 <p className="text-xs text-stone-500">
-                  Removing a professor deletes their room and everything in it.
+                  Click a room name to rename it. Removing a professor deletes their room and
+                  everything in it.
                 </p>
 
                 <div className="border-t border-stone-100 pt-4 flex flex-col gap-3">
                   <p className="text-sm font-medium text-stone-700">Add a Professor</p>
                   <p className="text-xs text-stone-500">
-                    This creates a new room named after them, with the current roster and TAs.
+                    This creates a new room with the current roster and TAs.
                   </p>
                   <input
                     type="text"
                     value={professorUtorid}
                     spellCheck={false}
-                    onChange={(e) => handleProfessorUtoridChange(e.target.value)}
+                    onChange={(e) => {
+                      setProfessorUtorid(e.target.value.trim().toLowerCase());
+                      setProfessorAddError(null);
+                      setProfessorAddSuccess(null);
+                    }}
                     placeholder="UTORid — ex. smithj"
                     className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm font-mono focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
                   />
@@ -891,21 +905,10 @@ export default function ManageClassModal({
                     type="text"
                     value={professorName}
                     spellCheck={false}
-                    disabled={professorKnown}
                     onChange={(e) => setProfessorName(e.target.value)}
-                    placeholder="Last name - ex. Engineer (For room naming)"
-                    className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all disabled:bg-stone-50 disabled:text-stone-500"
+                    placeholder="Room name — ex. Smith"
+                    className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
                   />
-                  {professorKnown ? (
-                    <p className="text-xs text-emerald-600">Name from their U of T account.</p>
-                  ) : (
-                    professorUtorid.length > 0 && (
-                      <p className="text-xs text-amber-600">
-                        Hasn&rsquo;t signed in yet — this name is temporary and is replaced by their
-                        real one when they do.
-                      </p>
-                    )
-                  )}
                   {professorAddError && <p className="text-sm text-red-600">{professorAddError}</p>}
                   {professorAddSuccess && (
                     <p className="text-sm text-green-700">{professorAddSuccess}</p>
diff --git a/src/app/components/RoomGrid.tsx b/src/app/components/RoomGrid.tsx
index 954cc39..3e744ea 100644
--- a/src/app/components/RoomGrid.tsx
+++ b/src/app/components/RoomGrid.tsx
@@ -8,7 +8,6 @@ import {
   ArrowRight,
   BookOpen,
   CheckCircle,
-  Clock,
   GraduationCap,
   Monitor,
   Play,
@@ -163,12 +162,6 @@ export default function RoomGrid({ classlist, onBack, onRefresh }: RoomGridProps
                 >
                   {room.label}
                 </h3>
-                {room.professor && !room.professor.hasLoggedIn && (
-                  <span className="flex items-center gap-1 text-xs text-amber-600 font-medium">
-                    <Clock className="w-3 h-3" />
-                    Temporary name — {room.professor.utorid} hasn&rsquo;t signed in yet
-                  </span>
-                )}
               </div>
 
               <div className="flex items-center gap-2 mt-4 pt-4 border-t border-stone-100 w-full text-sm font-medium text-stone-400 relative z-10">
diff --git a/src/app/components/classTypes.ts b/src/app/components/classTypes.ts
index dec594f..bfc7868 100644
--- a/src/app/components/classTypes.ts
+++ b/src/app/components/classTypes.ts
@@ -2,11 +2,11 @@ export type RoomRole = "STUDENT" | "TA" | "PROFESSOR";
 
 export interface RoomSummary {
   id: string;
-  /** The professor's surname, disambiguated within the class. */
+  /** The room's name, as an admin set it. */
   label: string;
   code: string;
   role: RoomRole;
-  professor: { name: string; utorid: string; hasLoggedIn: boolean } | null;
+  professor: { name: string; utorid: string } | null;
   /** True when the viewer is this room's professor. */
   isMine: boolean;
   activeSession: { id: string; joinCode: string } | null;
diff --git a/src/app/create-class/components/ProfessorList.tsx b/src/app/create-class/components/ProfessorList.tsx
index 5dbe102..f634cf6 100644
--- a/src/app/create-class/components/ProfessorList.tsx
+++ b/src/app/create-class/components/ProfessorList.tsx
@@ -1,7 +1,6 @@
 "use client";
 
-import { useEffect, useRef } from "react";
-import { CheckCircle2, Clock, Loader2, Plus, X } from "lucide-react";
+import { Plus, X } from "lucide-react";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -11,29 +10,15 @@ export interface ProfessorRow {
   /** Stable key — UTORids change as the admin types, so they cannot be keys. */
   key: string;
   utorid: string;
-  displayName: string;
-  /**
-   * idle     — nothing typed yet
-   * checking — lookup in flight
-   * known    — already signed in; name comes from their U of T account
-   * unknown  — never signed in; the admin supplies a temporary name
-   */
-  status: "idle" | "checking" | "known" | "unknown";
-}
-
-interface LookupResult {
-  utorid: string;
-  exists: boolean;
-  name: string | null;
-  hasLoggedIn: boolean;
+  /** What this professor's room will be called. Permanent; admin-editable later. */
+  roomName: string;
 }
 
 export function emptyProfessorRow(): ProfessorRow {
   return {
     key: Math.random().toString(36).slice(2),
     utorid: "",
-    displayName: "",
-    status: "idle",
+    roomName: "",
   };
 }
 
@@ -47,64 +32,8 @@ interface ProfessorListProps {
 // ---------------------------------------------------------------------------
 
 export default function ProfessorList({ rows, onChange }: ProfessorListProps) {
-  // Always read the newest rows inside the debounce callback — the timer is set
-  // up when a UTORid changes but fires long after that render.
-  const rowsRef = useRef(rows);
-  rowsRef.current = rows;
-
-  const timers = useRef(new Map<string, ReturnType<typeof setTimeout>>());
-  useEffect(() => {
-    const pending = timers.current;
-    return () => {
-      for (const timer of pending.values()) clearTimeout(timer);
-      pending.clear();
-    };
-  }, []);
-
   function patch(key: string, changes: Partial<ProfessorRow>) {
-    onChange(rowsRef.current.map((row) => (row.key === key ? { ...row, ...changes } : row)));
-  }
-
-  function handleUtoridChange(key: string, raw: string) {
-    const utorid = raw.trim().toLowerCase();
-    patch(key, { utorid, status: utorid ? "checking" : "idle" });
-
-    const existing = timers.current.get(key);
-    if (existing) clearTimeout(existing);
-    if (!utorid) return;
-
-    timers.current.set(
-      key,
-      setTimeout(() => {
-        timers.current.delete(key);
-        void lookup(key, utorid);
-      }, 400)
-    );
-  }
-
-  async function lookup(key: string, utorid: string) {
-    try {
-      const res = await fetch(`/api/users/lookup?utorids=${encodeURIComponent(utorid)}`);
-      if (!res.ok) throw new Error("lookup failed");
-      const data = (await res.json()) as { users: LookupResult[] };
-      const match = data.users?.[0];
-
-      // The admin may have kept typing while this was in flight; that response
-      // is about a UTORid they have already moved on from.
-      const current = rowsRef.current.find((row) => row.key === key);
-      if (!current || current.utorid !== utorid) return;
-
-      if (match?.hasLoggedIn && match.name) {
-        patch(key, { status: "known", displayName: match.name });
-      } else {
-        patch(key, { status: "unknown" });
-      }
-    } catch {
-      // Treat a failed lookup as an unknown user rather than blocking the form —
-      // the admin can still type a name, and the server re-checks anyway.
-      const current = rowsRef.current.find((row) => row.key === key);
-      if (current?.utorid === utorid) patch(key, { status: "unknown" });
-    }
+    onChange(rows.map((row) => (row.key === key ? { ...row, ...changes } : row)));
   }
 
   function addRow() {
@@ -112,9 +41,6 @@ export default function ProfessorList({ rows, onChange }: ProfessorListProps) {
   }
 
   function removeRow(key: string) {
-    const timer = timers.current.get(key);
-    if (timer) clearTimeout(timer);
-    timers.current.delete(key);
     const remaining = rows.filter((row) => row.key !== key);
     onChange(remaining.length > 0 ? remaining : [emptyProfessorRow()]);
   }
@@ -125,69 +51,40 @@ export default function ProfessorList({ rows, onChange }: ProfessorListProps) {
         Add Professors <span className="text-stone-400 font-normal text-base">(optional)</span>
       </label>
       <p className="text-sm text-stone-500">
-        Each professor gets their own room, named after them, and can only see that room. You get a
-        room of your own plus TA access to all of theirs.
+        Each professor gets their own room and can only see that room. You get a room of your own
+        plus TA access to all of theirs. The name you give a room is what everyone sees — you can
+        change it later.
       </p>
 
       <div className="space-y-2">
-        {rows.map((row) => {
-          const known = row.status === "known";
-          return (
-            <div key={row.key} className="flex items-start gap-2">
-              <div className="flex-1 min-w-0">
-                <input
-                  type="text"
-                  value={row.utorid}
-                  spellCheck={false}
-                  onChange={(e) => handleUtoridChange(row.key, e.target.value)}
-                  placeholder="UTORid — ex. smithj"
-                  className="w-full border-2 border-stone-100 rounded-md px-4 py-2.5 text-sm font-mono focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm"
-                />
-              </div>
-
-              <div className="flex-1 min-w-0">
-                <div className="relative">
-                  <input
-                    type="text"
-                    value={row.displayName}
-                    spellCheck={false}
-                    disabled={known}
-                    onChange={(e) => patch(row.key, { displayName: e.target.value })}
-                    placeholder="Last name - ex. Engineer (For room naming)"
-                    className="w-full border-2 border-stone-100 rounded-md px-4 py-2.5 pr-9 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm disabled:bg-stone-50 disabled:text-stone-500"
-                  />
-                  {row.status === "checking" && (
-                    <Loader2 className="absolute right-3 top-1/2 -translate-y-1/2 w-4 h-4 text-stone-300 animate-spin" />
-                  )}
-                  {known && (
-                    <CheckCircle2 className="absolute right-3 top-1/2 -translate-y-1/2 w-4 h-4 text-emerald-500" />
-                  )}
-                  {row.status === "unknown" && (
-                    <Clock className="absolute right-3 top-1/2 -translate-y-1/2 w-4 h-4 text-amber-500" />
-                  )}
-                </div>
-                {known && (
-                  <p className="mt-1 text-xs text-emerald-600">Name from their U of T account.</p>
-                )}
-                {row.status === "unknown" && (
-                  <p className="mt-1 text-xs text-amber-600">
-                    Hasn&rsquo;t signed in yet — this name is temporary and is replaced by their
-                    real one when they do.
-                  </p>
-                )}
-              </div>
-
-              <button
-                type="button"
-                onClick={() => removeRow(row.key)}
-                aria-label="Remove professor"
-                className="mt-2.5 text-stone-300 hover:text-red-500 transition-colors shrink-0"
-              >
-                <X className="w-4 h-4" />
-              </button>
-            </div>
-          );
-        })}
+        {rows.map((row) => (
+          <div key={row.key} className="flex items-start gap-2">
+            <input
+              type="text"
+              value={row.utorid}
+              spellCheck={false}
+              onChange={(e) => patch(row.key, { utorid: e.target.value.trim().toLowerCase() })}
+              placeholder="UTORid — ex. smithj"
+              className="flex-1 min-w-0 border-2 border-stone-100 rounded-md px-4 py-2.5 text-sm font-mono focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm"
+            />
+            <input
+              type="text"
+              value={row.roomName}
+              spellCheck={false}
+              onChange={(e) => patch(row.key, { roomName: e.target.value })}
+              placeholder="Room name — ex. Smith"
+              className="flex-1 min-w-0 border-2 border-stone-100 rounded-md px-4 py-2.5 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm"
+            />
+            <button
+              type="button"
+              onClick={() => removeRow(row.key)}
+              aria-label="Remove professor"
+              className="mt-2.5 text-stone-300 hover:text-red-500 transition-colors shrink-0"
+            >
+              <X className="w-4 h-4" />
+            </button>
+          </div>
+        ))}
       </div>
 
       <button
@@ -205,21 +102,18 @@ export default function ProfessorList({ rows, onChange }: ProfessorListProps) {
 /** Drops blank rows and hands the API the shape it wants. */
 export function professorRowsToPayload(
   rows: ProfessorRow[]
-): { utorid: string; displayName?: string }[] {
+): { utorid: string; roomName: string }[] {
   return rows
     .filter((row) => row.utorid.trim().length > 0)
     .map((row) => ({
       utorid: row.utorid.trim().toLowerCase(),
-      // A known user's name is theirs already; only send a placeholder.
-      ...(row.status !== "known" && row.displayName.trim()
-        ? { displayName: row.displayName.trim() }
-        : {}),
+      roomName: row.roomName.trim(),
     }));
 }
 
-/** Rows with a UTORid but no name to show — the admin has nothing to label the room with. */
+/** UTORids entered without a room name — there would be nothing to call the room. */
 export function professorRowsMissingNames(rows: ProfessorRow[]): string[] {
   return rows
-    .filter((row) => row.utorid.trim().length > 0 && row.displayName.trim().length === 0)
+    .filter((row) => row.utorid.trim().length > 0 && row.roomName.trim().length === 0)
     .map((row) => row.utorid.trim().toLowerCase());
 }
diff --git a/src/app/create-class/page.tsx b/src/app/create-class/page.tsx
index d9cf5ab..2db2502 100644
--- a/src/app/create-class/page.tsx
+++ b/src/app/create-class/page.tsx
@@ -78,13 +78,9 @@ export default function CreateClassPage() {
       .split(/[\n,\s]+/)
       .map((s) => s.trim())
       .filter(Boolean);
-    // A room is labelled by its professor's name, so an unnamed professor
-    // would leave a room nobody can identify.
     const unnamed = professorRowsMissingNames(professorRows);
     if (unnamed.length > 0) {
-      setSubmitError(
-        `Add a name for ${unnamed.join(", ")} — it labels their room until they first sign in.`
-      );
+      setSubmitError(`Give ${unnamed.join(", ")} a room name — it is what their room is called.`);
       setSubmitting(false);
       return;
     }
diff --git a/src/lib/classlistService.ts b/src/lib/classlistService.ts
index cca8af6..5c5d8da 100644
--- a/src/lib/classlistService.ts
+++ b/src/lib/classlistService.ts
@@ -12,8 +12,8 @@ import { deleteFile } from "@/lib/storage";
 
 export interface ProfessorInput {
   utorid: string;
-  /** Temporary name to show until this person signs in. Ignored once they have. */
-  displayName?: string;
+  /** The name for this professor's room. Permanent; only an admin changes it. */
+  roomName?: string;
 }
 
 export interface StudentInput {
@@ -46,9 +46,9 @@ export function normalizeUtorids(raw: unknown): string[] {
 }
 
 /**
- * Accepts either `["smithj"]` or `[{ utorid, displayName }]` and normalizes to
- * the latter. The plain-string form exists because not every caller has a name
- * to offer (adding a professor from the roster screen, for instance).
+ * Accepts either `["smithj"]` or `[{ utorid, roomName }]` and normalizes to the
+ * latter. The plain-string form exists because not every caller has a room name
+ * to offer; those rooms fall back to the professor's surname.
  */
 export function normalizeProfessorInputs(raw: unknown): ProfessorInput[] {
   if (!Array.isArray(raw)) return [];
@@ -56,23 +56,25 @@ export function normalizeProfessorInputs(raw: unknown): ProfessorInput[] {
 
   for (const entry of raw) {
     let utorid = "";
-    let displayName: string | undefined;
+    let roomName: string | undefined;
 
     if (typeof entry === "string") {
       utorid = entry.trim().toLowerCase();
     } else if (entry && typeof entry === "object") {
       const record = entry as Record<string, unknown>;
       utorid = typeof record.utorid === "string" ? record.utorid.trim().toLowerCase() : "";
-      const name = typeof record.displayName === "string" ? record.displayName.trim() : "";
-      if (name) displayName = name;
+      // `displayName` is still accepted for older callers.
+      const raw2 = record.roomName ?? record.displayName;
+      const name = typeof raw2 === "string" ? raw2.trim() : "";
+      if (name) roomName = name;
     }
 
     if (!utorid || INVALID_UTORIDS.has(utorid)) continue;
 
     // Later entries win only when they carry a name the earlier one lacked.
     const existing = byUtorid.get(utorid);
-    if (!existing) byUtorid.set(utorid, { utorid, displayName });
-    else if (!existing.displayName && displayName) existing.displayName = displayName;
+    if (!existing) byUtorid.set(utorid, { utorid, roomName });
+    else if (!existing.roomName && roomName) existing.roomName = roomName;
   }
 
   return [...byUtorid.values()];
@@ -107,41 +109,30 @@ type Tx = Prisma.TransactionClient;
 /**
  * Finds or creates the User for a UTORid.
  *
- * `displayName` is only ever written to a user who has not signed in — their
- * `name` is a placeholder at that point, so replacing it is an improvement.
- * A real name from Shibboleth is never overwritten by something an admin typed.
+ * A new row is named after the UTORid until that person signs in and
+ * Shibboleth gives us their real name. Nothing here writes a name an admin
+ * typed: that name belongs to a room, not to a person.
  */
 export async function upsertPersonByUtorid(
   tx: Tx,
-  utorid: string,
-  displayName?: string
-): Promise<{ id: string; utorid: string; name: string; hasLoggedIn: boolean }> {
+  utorid: string
+): Promise<{ id: string; utorid: string; name: string }> {
   const existing = await tx.user.findUnique({
     where: { utorid },
-    select: { id: true, utorid: true, name: true, hasLoggedIn: true },
+    select: { id: true, utorid: true, name: true },
   });
 
-  if (!existing) {
-    return tx.user.create({
-      data: {
-        utorid,
-        name: displayName || utorid,
-        email: `${utorid}@mail.utoronto.ca`,
-        role: "STUDENT",
-      },
-      select: { id: true, utorid: true, name: true, hasLoggedIn: true },
-    });
-  }
-
-  if (displayName && !existing.hasLoggedIn && existing.name !== displayName) {
-    return tx.user.update({
-      where: { id: existing.id },
-      data: { name: displayName },
-      select: { id: true, utorid: true, name: true, hasLoggedIn: true },
-    });
-  }
+  if (existing) return existing;
 
-  return existing;
+  return tx.user.create({
+    data: {
+      utorid,
+      name: utorid,
+      email: `${utorid}@mail.utoronto.ca`,
+      role: "STUDENT",
+    },
+    select: { id: true, utorid: true, name: true },
+  });
 }
 
 export interface RoomEnrollmentPlan {
diff --git a/src/lib/nameUtils.ts b/src/lib/nameUtils.ts
new file mode 100644
index 0000000..f307d19
--- /dev/null
+++ b/src/lib/nameUtils.ts
@@ -0,0 +1,13 @@
+/**
+ * The last whitespace-separated part of a name: "Jane Nakamura" → "Nakamura".
+ * Falls back to the whole string when there is only one part.
+ *
+ * Used only to pick a default room name for the admin who creates a classlist —
+ * they are the one professor who never types a name for their own room. Every
+ * other room's name is typed by the admin and stored on the room.
+ */
+export function surnameOf(fullName: string | null | undefined): string {
+  const parts = (fullName ?? "").trim().split(/\s+/).filter(Boolean);
+  if (parts.length === 0) return "";
+  return parts[parts.length - 1];
+}
diff --git a/src/lib/roomLabel.ts b/src/lib/roomLabel.ts
deleted file mode 100644
index 0488db5..0000000
--- a/src/lib/roomLabel.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-// ---------------------------------------------------------------------------
-// Room labels
-//
-// A room is labelled by its professor's surname alone — "Smith", never
-// "John Smith". The label is derived from User.name at read time rather than
-// stored, so it corrects itself when a professor signs in for the first time
-// and their placeholder name is replaced by the real one.
-// ---------------------------------------------------------------------------
-
-export interface RoomProfessor {
-  id: string;
-  name: string;
-  utorid: string;
-}
-
-/**
- * The last whitespace-separated part of a name.
- * Falls back to the whole string when there is only one part.
- */
-export function surnameOf(fullName: string | null | undefined): string {
-  const parts = (fullName ?? "").trim().split(/\s+/).filter(Boolean);
-  if (parts.length === 0) return "";
-  return parts[parts.length - 1];
-}
-
-/** First initial with a period: "John Smith" → "J." Empty when there is no given name. */
-function givenInitial(fullName: string): string {
-  const parts = fullName.trim().split(/\s+/).filter(Boolean);
-  if (parts.length < 2) return "";
-  return `${parts[0][0].toUpperCase()}.`;
-}
-
-/**
- * Labels for every professor on one classlist, keyed by user id.
- *
- * Surnames alone are ambiguous the moment a classlist has two professors named
- * Smith, so colliding surnames gain a first initial ("J. Smith"), and a
- * still-colliding pair falls back to the UTORid — which is unique by
- * definition. Professors whose surnames are unique are never decorated.
- */
-export function roomLabelsFor(professors: RoomProfessor[]): Map<string, string> {
-  const bySurname = new Map<string, RoomProfessor[]>();
-  for (const prof of professors) {
-    const surname = surnameOf(prof.name) || prof.utorid;
-    const group = bySurname.get(surname);
-    if (group) group.push(prof);
-    else bySurname.set(surname, [prof]);
-  }
-
-  const labels = new Map<string, string>();
-  for (const [surname, group] of bySurname) {
-    if (group.length === 1) {
-      labels.set(group[0].id, surname);
-      continue;
-    }
-
-    const withInitial = group.map((prof) => {
-      const initial = givenInitial(prof.name);
-      return { prof, label: initial ? `${initial} ${surname}` : surname };
-    });
-
-    const counts = new Map<string, number>();
-    for (const { label } of withInitial) counts.set(label, (counts.get(label) ?? 0) + 1);
-
-    for (const { prof, label } of withInitial) {
-      labels.set(prof.id, counts.get(label)! > 1 ? `${surname} (${prof.utorid})` : label);
-    }
-  }
-
-  return labels;
-}
diff --git a/tsconfig.json b/tsconfig.json
index 9cf2bca..267a5d7 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -35,12 +35,6 @@
     ".next-ta/dev/types/**/*.ts",
     ".next-student/types/**/*.ts",
     ".next-student/dev/types/**/*.ts",
-    ".next-probe-p/types/**/*.ts",
-    ".next-probe-p/dev/types/**/*.ts",
-    ".next-probe-a/types/**/*.ts",
-    ".next-probe-a/dev/types/**/*.ts",
-    ".next-probe-s/types/**/*.ts",
-    ".next-probe-s/dev/types/**/*.ts",
     ".next-prof-1/types/**/*.ts",
     ".next-prof-1/dev/types/**/*.ts",
     ".next-prof-2/types/**/*.ts",

From 41326e874cd61b57150cb86779adfb9e22a6c40d Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 22:50:32 -0400
Subject: [PATCH 24/29] Don't say "no classes" twice on the same screen

The header subtitle and the empty state both announced an empty list, one
right above the other. The empty state already says it, with more room to
explain what to do about it, so the subtitle now only appears when there are
classes to describe.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/app/classes/ManageClassModal.tsx              |  2 +-
 src/app/components/ClassBrowser.tsx               | 14 +++++++-------
 src/app/create-class/components/ProfessorList.tsx |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/app/classes/ManageClassModal.tsx b/src/app/classes/ManageClassModal.tsx
index 12ad3a3..5cc84ba 100644
--- a/src/app/classes/ManageClassModal.tsx
+++ b/src/app/classes/ManageClassModal.tsx
@@ -906,7 +906,7 @@ export default function ManageClassModal({
                     value={professorName}
                     spellCheck={false}
                     onChange={(e) => setProfessorName(e.target.value)}
-                    placeholder="Room name — ex. Smith"
+                    placeholder="Room name — ex. Scali"
                     className="w-full border border-stone-300 rounded-lg px-3 py-2 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all"
                   />
                   {professorAddError && <p className="text-sm text-red-600">{professorAddError}</p>}
diff --git a/src/app/components/ClassBrowser.tsx b/src/app/components/ClassBrowser.tsx
index d141af0..4ff2894 100644
--- a/src/app/components/ClassBrowser.tsx
+++ b/src/app/components/ClassBrowser.tsx
@@ -88,13 +88,13 @@ export default function ClassBrowser({ isAdmin }: ClassBrowserProps) {
       <div className="max-w-6xl mx-auto w-full mb-10 flex items-center justify-between gap-4">
         <div>
           <h2 className="text-4xl font-bold text-stone-900 tracking-tight mb-2">My Classes</h2>
-          <p className="text-lg text-stone-500">
-            {classlists.length === 0
-              ? isAdmin
-                ? "Upload a classlist to get started."
-                : "You aren't on any classes yet."
-              : "Open a class to see its rooms — one per professor."}
-          </p>
+          {/* The empty state already says there is nothing here, so the
+              subtitle would only repeat it. */}
+          {classlists.length > 0 && (
+            <p className="text-lg text-stone-500">
+              Open a class to see its rooms — one per professor.
+            </p>
+          )}
         </div>
         {isAdmin && classlists.length > 0 && (
           <Link
diff --git a/src/app/create-class/components/ProfessorList.tsx b/src/app/create-class/components/ProfessorList.tsx
index f634cf6..f61855b 100644
--- a/src/app/create-class/components/ProfessorList.tsx
+++ b/src/app/create-class/components/ProfessorList.tsx
@@ -72,7 +72,7 @@ export default function ProfessorList({ rows, onChange }: ProfessorListProps) {
               value={row.roomName}
               spellCheck={false}
               onChange={(e) => patch(row.key, { roomName: e.target.value })}
-              placeholder="Room name — ex. Smith"
+              placeholder="Room name — ex. Scali"
               className="flex-1 min-w-0 border-2 border-stone-100 rounded-md px-4 py-2.5 text-sm focus:outline-none focus:border-green-400 focus:ring-4 focus:ring-green-50 transition-all shadow-sm"
             />
             <button

From 9758227a41521db63f47238b2f346ebe61766ff7 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 22:56:20 -0400
Subject: [PATCH 25/29] Make the test classlist safe to run the multi-professor
 flow against
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The roster's UTORids were devstu2..devstu5, which read like dev:all personas —
easy to paste into the professor boxes by mistake, and the class then gets
built with students running the rooms. They are rosterstuN now, so nothing on
the roster can be confused for someone who should be teaching.

Both student personas are on the roster, so the student tabs actually see the
class, and .env gains a step-by-step walkthrough: which port is whom, what to
type at each field, and what each tab should show at every stage.

Verified by running that walkthrough end to end against six signed-in dev
servers — 37 checks covering creation, isolation, going live, renaming a room,
adding and removing a professor, and the refusals.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 test-classlist.csv | 11 +++++++----
 tsconfig.json      | 12 +++++++++++-
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/test-classlist.csv b/test-classlist.csv
index c5d8425..9e66926 100644
--- a/test-classlist.csv
+++ b/test-classlist.csv
@@ -1,6 +1,9 @@
 Given Name,Surname,UTORid,Acad_act
 Sam,Reyes,devstudent,TES101
-Priya,Raman,devstu2,TES101
-Noah,Bergman,devstu3,TES101
-Mei,Lin,devstu4,TES101
-Kofi,Mensah,devstu5,TES101
+Priya,Raman,devstudent2,TES101
+Ira,Whitlock,rosterstu1,TES101
+Noor,Abbasi,rosterstu2,TES101
+Mei,Lin,rosterstu3,TES101
+Kofi,Mensah,rosterstu4,TES101
+Elena,Petrov,rosterstu5,TES101
+Tomas,Ruiz,rosterstu6,TES101
diff --git a/tsconfig.json b/tsconfig.json
index 267a5d7..53c0b3f 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -40,7 +40,17 @@
     ".next-prof-2/types/**/*.ts",
     ".next-prof-2/dev/types/**/*.ts",
     ".next-prof-3/types/**/*.ts",
-    ".next-prof-3/dev/types/**/*.ts"
+    ".next-prof-3/dev/types/**/*.ts",
+    ".next-wlk-3105/types/**/*.ts",
+    ".next-wlk-3105/dev/types/**/*.ts",
+    ".next-wlk-3101/types/**/*.ts",
+    ".next-wlk-3101/dev/types/**/*.ts",
+    ".next-wlk-3102/types/**/*.ts",
+    ".next-wlk-3102/dev/types/**/*.ts",
+    ".next-wlk-3104/types/**/*.ts",
+    ".next-wlk-3104/dev/types/**/*.ts",
+    ".next-wlk-3103/types/**/*.ts",
+    ".next-wlk-3103/dev/types/**/*.ts"
   ],
   "exclude": ["node_modules", ".next", ".next-prof", ".next-ta", ".next-student"]
 }

From 8f10342b3e20fb54919763fae97da8e4232303e9 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 23:10:56 -0400
Subject: [PATCH 26/29] Put the professor and TA personas on the test roster
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CSV listed only students, so there was nothing in it to tell you which
UTORids to type into the professor boxes — and the roster's own names were the
nearest thing to hand, which is how two students ended up running rooms twice
in a row.

Its last three rows are now devprof2, devprof3 and devta, matching ports
3001 / 3002 / 3003. The bottom of the file is exactly what goes into the
create form.

Having them on the student roster is also the case most worth testing: a
professor who appears on it must not be handed student access to a colleague's
room, and a TA on it must come out a TA. The .env walkthrough now calls both
out as things to check in step 2.

Verified against six signed-in dev servers running the documented steps —
43 checks, including that each professor's only row is PROFESSOR in their own
room, that devta is a TA in all three, and that the manage screen lists 5
students rather than all 8 roster rows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 test-classlist.csv | 6 +++---
 tsconfig.json      | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/test-classlist.csv b/test-classlist.csv
index 9e66926..fa32535 100644
--- a/test-classlist.csv
+++ b/test-classlist.csv
@@ -4,6 +4,6 @@ Priya,Raman,devstudent2,TES101
 Ira,Whitlock,rosterstu1,TES101
 Noor,Abbasi,rosterstu2,TES101
 Mei,Lin,rosterstu3,TES101
-Kofi,Mensah,rosterstu4,TES101
-Elena,Petrov,rosterstu5,TES101
-Tomas,Ruiz,rosterstu6,TES101
+Jane,Nakamura,devprof2,TES101
+Omar,Haddad,devprof3,TES101
+Tomas,Alvarez,devta,TES101
diff --git a/tsconfig.json b/tsconfig.json
index 53c0b3f..f313817 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -50,7 +50,9 @@
     ".next-wlk-3104/types/**/*.ts",
     ".next-wlk-3104/dev/types/**/*.ts",
     ".next-wlk-3103/types/**/*.ts",
-    ".next-wlk-3103/dev/types/**/*.ts"
+    ".next-wlk-3103/dev/types/**/*.ts",
+    ".next-wlk-3100/types/**/*.ts",
+    ".next-wlk-3100/dev/types/**/*.ts"
   ],
   "exclude": ["node_modules", ".next", ".next-prof", ".next-ta", ".next-student"]
 }

From 79e1083d35ec7c42f5d5a915420ef8d29fdbaebe Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 23:26:14 -0400
Subject: [PATCH 27/29] fix cookie bug

---
 src/app/api/auth/me/route.ts    | 27 ++++++++++++++++++++++++++-
 src/app/api/classlists/route.ts | 26 +++++++++++++++++---------
 2 files changed, 43 insertions(+), 10 deletions(-)

diff --git a/src/app/api/auth/me/route.ts b/src/app/api/auth/me/route.ts
index a4c5b50..3d7426c 100644
--- a/src/app/api/auth/me/route.ts
+++ b/src/app/api/auth/me/route.ts
@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getIronSession } from "iron-session";
 import { cookies } from "next/headers";
 
+import { prisma } from "@/lib/prisma";
 import { getSessionOptions, type SessionData } from "@/lib/session";
 import { isAdmin } from "@/lib/adminWhitelist";
 
@@ -11,8 +12,15 @@ import { isAdmin } from "@/lib/adminWhitelist";
 // Returns the currently authenticated user from the session cookie.
 // Used by client components to know who is logged in.
 //
+// The cookie can outlive the database — a wipe or restore recreates the row
+// with a fresh id while the sealed cookie still carries the old one, which
+// then matches no enrollments and breaks every write that uses it as a foreign
+// key. UTORid is the stable identity, so this re-reads by UTORid and re-mints
+// the cookie when the id has drifted. Every page calls this on mount, so the
+// correction happens before anything else can act on a dead id.
+//
 // Response:
-//   200 { userId, utorid, name, email, role }
+//   200 { userId, utorid, name, email, role, isAdmin }
 //   401 { error: "Not authenticated." }
 // ---------------------------------------------------------------------------
 
@@ -23,6 +31,23 @@ export async function GET() {
     return NextResponse.json({ error: "Not authenticated." }, { status: 401 });
   }
 
+  if (session.utorid) {
+    const live = await prisma.user.findUnique({
+      where: { utorid: session.utorid },
+      select: { id: true, name: true, email: true },
+    });
+
+    if (live && live.id !== session.userId) {
+      console.warn(
+        `[auth/me] Session for ${session.utorid} pointed at a stale user id; re-minting.`
+      );
+      session.userId = live.id;
+      session.name = live.name;
+      session.email = live.email;
+      await session.save();
+    }
+  }
+
   return NextResponse.json({
     userId: session.userId,
     utorid: session.utorid,
diff --git a/src/app/api/classlists/route.ts b/src/app/api/classlists/route.ts
index 1ef5f9a..42d2cbb 100644
--- a/src/app/api/classlists/route.ts
+++ b/src/app/api/classlists/route.ts
@@ -206,29 +206,37 @@ export async function POST(request: NextRequest) {
     );
 
     const created = await prisma.$transaction(async (tx) => {
-      // The creator's row can be missing after a system wipe — their session
-      // cookie outlives the database.
-      await tx.user.upsert({
-        where: { id: user.userId },
+      // Resolve the creator by UTORid, not by the id in their session cookie.
+      // The cookie outlives the database: after a wipe the row is recreated
+      // with a fresh id, and a cookie still carrying the old one would either
+      // collide on the unique UTORid here or write foreign keys pointing at a
+      // user who no longer exists. UTORid is the stable identity.
+      const creator = await tx.user.upsert({
+        where: { utorid: user.utorid },
         update: {},
         create: {
-          id: user.userId,
           utorid: user.utorid,
           email: user.email,
           name: user.name,
           role: "STUDENT",
         },
+        select: { id: true, name: true },
       });
+      const creatorId = creator.id;
 
       const classlist = await tx.classlist.create({
-        data: { code: classCode, semester, createdById: user.userId },
+        data: { code: classCode, semester, createdById: creatorId },
       });
 
       // Professors, creator first — their room is the one they run.
       // The creator's own room falls back to their surname; they never typed a
       // name for it.
       const professorUsers = [
-        { id: user.userId, utorid: creatorUtorid, roomName: surnameOf(user.name) || creatorUtorid },
+        {
+          id: creatorId,
+          utorid: creatorUtorid,
+          roomName: surnameOf(creator.name) || creatorUtorid,
+        },
       ];
       for (const input of professorInputs) {
         const person = await upsertPersonByUtorid(tx, input.utorid);
@@ -274,7 +282,7 @@ export async function POST(request: NextRequest) {
             code: classCode,
             name: professor.roomName,
             semester,
-            createdById: user.userId,
+            createdById: creatorId,
             classlistId: classlist.id,
             professorId: professor.id,
           },
@@ -291,7 +299,7 @@ export async function POST(request: NextRequest) {
           roomId: room.id,
           professorId: professor.id,
           // The admin who made the classlist watches every room they do not run.
-          taIds: [...(professor.id === user.userId ? [] : [user.userId]), ...taIds],
+          taIds: [...(professor.id === creatorId ? [] : [creatorId]), ...taIds],
           studentIds,
         });
       }

From 1ecc120824de7962516f9cf1c0a7f407d025f475 Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 23:34:21 -0400
Subject: [PATCH 28/29] Let TAs drive the shared slides, but not replace them
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A room's professor and its TAs teach the same lecture off the same deck, so
they now share control of it. `slide:change` accepts either; uploading still
accepts only the professor, so a TA can move the slides everyone sees but can
never swap the file out from under them.

requireSocketInstructor enforced PROFESSOR while the `:instructors` socket room
it shares a word with contains professors *and* TAs — reading it as either one
was a standing invitation to widen access by accident. It is gone, replaced by
requireSocketProfessor and requireSocketProfessorOrTA. Both call sites had to
be revisited to compile, which is the point: answer-mode stays the professor's,
slide movement does not.

The viewer's two-state sync toggle becomes three modes:

  following   track the shared page — the default for students and TAs
  browsing    move around privately, room untouched
  presenting  moving the page moves it for the whole room

Present takes the deck and pulls the room to the presenter's page so nobody has
to guess where it went, and a presenter accepts another presenter's move rather
than fighting it, so two of them converge instead of drifting. The professor
still arrives presenting, and now has a way to stop — which they need, since a
TA may be the one driving.

Students are unchanged except in wording: "Following Professor" is no longer
always true, so it reads "Following Live".

Covered by 9 integration tests over the two guards, including that a TA of a
neighbouring room on the same class gets nothing here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 FEATURES.md                            |  21 ++-
 src/__tests__/slide-control.test.ts    | 168 +++++++++++++++++++++++
 src/app/room/slideViewer.tsx           | 181 +++++++++++++++++++------
 src/lib/sessionService.ts              |  32 ++++-
 src/socket/handlers/sessionHandlers.ts |   6 +-
 src/socket/handlers/slideHandlers.ts   |  28 ++--
 vitest.config.mts                      |   1 +
 vitest.integration.config.mts          |   6 +-
 8 files changed, 376 insertions(+), 67 deletions(-)
 create mode 100644 src/__tests__/slide-control.test.ts

diff --git a/FEATURES.md b/FEATURES.md
index 6b220f6..a1bac70 100644
--- a/FEATURES.md
+++ b/FEATURES.md
@@ -151,7 +151,7 @@ one to enter a colleague's room on the same class.
 
 - **PDF only** — validated by MIME type, magic bytes, and parseability
 - **Size limits** — 1 KB to 50 MB
-- Professor-only; session must be ACTIVE
+- Professor-only (a TA can drive the deck but never replace it); session must be ACTIVE
 
 ### Viewing
 
@@ -160,10 +160,22 @@ one to enter a colleague's room on the same class.
 
 ### Real-Time Sync
 
-- Professor changes the page index; broadcast to all participants via `slide:changed`
-- Late joiners call `slide:sync` to get the current page
+- The professor **and the room's TAs** share one deck and may all drive it; a page change is broadcast to every participant via `slide:changed`. Uploading it stays the professor's alone
+- Late joiners call `slide:sync` to get the current page — wherever the last person to present left it
 - New upload triggers `slides:available` notification to the room
 
+### Viewer modes
+
+Every participant is in one of these at any moment:
+
+| Mode           | Who            | What it does                                                                                                 |
+| -------------- | -------------- | ------------------------------------------------------------------------------------------------------------ |
+| **Following**  | everyone       | Tracks the shared page. The default for students and TAs                                                     |
+| **Browsing**   | everyone       | Move around privately; the room is unaffected. Entered by navigating while following, or via _Browse Freely_ |
+| **Presenting** | professor, TAs | Moving the page moves it for the whole room. The professor's default                                         |
+
+_Present_ takes the deck and pulls the room to the presenter's current page, so nobody has to guess where it went. More than one instructor may present at once: a change from another presenter is accepted rather than fought over, so they converge instead of drifting apart.
+
 ### Split View
 
 - Resizable panel layout — Q&A chat and slide viewer side by side
@@ -249,7 +261,8 @@ If Redis is unavailable, rate limiting fails closed (blocks all requests).
 | End session          |         |     | Yes (creator) |
 | Regenerate join code |         |     | Yes (creator) |
 | Upload slides        |         |     |      Yes      |
-| Control slide page   |         |     |      Yes      |
+| Control slide page   |         | Yes |      Yes      |
+| Browse slides freely |   Yes   | Yes |      Yes      |
 
 ### Question Operations
 
diff --git a/src/__tests__/slide-control.test.ts b/src/__tests__/slide-control.test.ts
new file mode 100644
index 0000000..20a39d1
--- /dev/null
+++ b/src/__tests__/slide-control.test.ts
@@ -0,0 +1,168 @@
+// @vitest-environment node
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from "vitest";
+
+import { PrismaClient, Role, SessionStatus } from "../generated/prisma";
+import {
+  requireSocketProfessor,
+  requireSocketProfessorOrTA,
+  NotEnrolledError,
+  NotInstructorError,
+  SessionNotFoundError,
+} from "@/lib/sessionService";
+
+const prisma = new PrismaClient();
+
+beforeAll(async () => {
+  await prisma.$connect();
+});
+
+afterAll(async () => {
+  await prisma.$disconnect();
+});
+
+beforeEach(async () => {
+  await prisma.questionUpvote.deleteMany();
+  await prisma.answer.deleteMany();
+  await prisma.question.deleteMany();
+  await prisma.slideSet.deleteMany();
+  await prisma.session.deleteMany();
+  await prisma.courseEnrollment.deleteMany();
+  await prisma.course.deleteMany();
+  await prisma.classlist.deleteMany();
+  await prisma.user.deleteMany();
+});
+
+/** A room with a professor, a TA, a student, and an outsider with no enrollment. */
+async function buildRoom() {
+  const make = (utorid: string, name: string) =>
+    prisma.user.create({
+      data: { utorid, email: `${utorid}@utoronto.ca`, name, role: Role.STUDENT },
+    });
+
+  const professor = await make("slideprof", "Jane Nakamura");
+  const ta = await make("slideta", "Tomas Alvarez");
+  const student = await make("slidestu", "Sam Reyes");
+  const outsider = await make("slideout", "Nobody Here");
+
+  const room = await prisma.course.create({
+    data: {
+      code: "SLD101",
+      name: "Nakamura",
+      semester: "Fall 2026",
+      createdById: professor.id,
+      professorId: professor.id,
+    },
+  });
+
+  await prisma.courseEnrollment.createMany({
+    data: [
+      { userId: professor.id, courseId: room.id, role: Role.PROFESSOR },
+      { userId: ta.id, courseId: room.id, role: Role.TA },
+      { userId: student.id, courseId: room.id, role: Role.STUDENT },
+    ],
+  });
+
+  const session = await prisma.session.create({
+    data: {
+      courseId: room.id,
+      createdById: professor.id,
+      title: "SLD101 — Nakamura",
+      joinCode: "SLIDE1",
+      status: SessionStatus.ACTIVE,
+    },
+  });
+
+  return { professor, ta, student, outsider, room, session };
+}
+
+// =============================================================================
+// Who may drive the shared deck
+// =============================================================================
+describe("Slide control authorization", () => {
+  describe("requireSocketProfessorOrTA — moving the shared slides", () => {
+    it("lets the room's professor drive", async () => {
+      const { professor, room, session } = await buildRoom();
+      const result = await requireSocketProfessorOrTA(professor.id, session.id);
+      expect(result.role).toBe(Role.PROFESSOR);
+      expect(result.courseId).toBe(room.id);
+    });
+
+    it("lets a TA of the room drive", async () => {
+      const { ta, room, session } = await buildRoom();
+      const result = await requireSocketProfessorOrTA(ta.id, session.id);
+      expect(result.role).toBe(Role.TA);
+      expect(result.courseId).toBe(room.id);
+    });
+
+    it("refuses a student", async () => {
+      const { student, session } = await buildRoom();
+      await expect(requireSocketProfessorOrTA(student.id, session.id)).rejects.toBeInstanceOf(
+        NotInstructorError
+      );
+    });
+
+    it("refuses someone with no enrollment in the room", async () => {
+      const { outsider, session } = await buildRoom();
+      await expect(requireSocketProfessorOrTA(outsider.id, session.id)).rejects.toBeInstanceOf(
+        NotEnrolledError
+      );
+    });
+
+    it("refuses a TA of a different room", async () => {
+      const { ta, professor } = await buildRoom();
+
+      const otherRoom = await prisma.course.create({
+        data: {
+          code: "SLD101",
+          name: "Haddad",
+          semester: "Fall 2026",
+          createdById: professor.id,
+          professorId: professor.id,
+        },
+      });
+      const otherSession = await prisma.session.create({
+        data: {
+          courseId: otherRoom.id,
+          createdById: professor.id,
+          title: "SLD101 — Haddad",
+          joinCode: "SLIDE2",
+          status: SessionStatus.ACTIVE,
+        },
+      });
+
+      // Being a TA next door grants nothing here — slide control is per room.
+      await expect(requireSocketProfessorOrTA(ta.id, otherSession.id)).rejects.toBeInstanceOf(
+        NotEnrolledError
+      );
+    });
+
+    it("reports a missing session distinctly from a refusal", async () => {
+      const { professor } = await buildRoom();
+      await expect(
+        requireSocketProfessorOrTA(professor.id, "no-such-session")
+      ).rejects.toBeInstanceOf(SessionNotFoundError);
+    });
+  });
+
+  describe("requireSocketProfessor — uploading and ending", () => {
+    it("lets the room's professor through", async () => {
+      const { professor, room, session } = await buildRoom();
+      const result = await requireSocketProfessor(professor.id, session.id);
+      expect(result.courseId).toBe(room.id);
+    });
+
+    it("refuses a TA — uploading the deck is not theirs to do", async () => {
+      const { ta, session } = await buildRoom();
+      await expect(requireSocketProfessor(ta.id, session.id)).rejects.toBeInstanceOf(
+        NotInstructorError
+      );
+    });
+
+    it("refuses a student", async () => {
+      const { student, session } = await buildRoom();
+      await expect(requireSocketProfessor(student.id, session.id)).rejects.toBeInstanceOf(
+        NotInstructorError
+      );
+    });
+  });
+});
diff --git a/src/app/room/slideViewer.tsx b/src/app/room/slideViewer.tsx
index 39f952e..ee456f8 100644
--- a/src/app/room/slideViewer.tsx
+++ b/src/app/room/slideViewer.tsx
@@ -44,6 +44,19 @@ interface SlideViewerProps {
 // Inner UI — needs to be inside EmbedPDF to access document capabilities
 // ---------------------------------------------------------------------------
 
+/**
+ * How this viewer relates to the deck everyone else is looking at.
+ *
+ * following  — track the shared page; what students do by default
+ * browsing   — move around privately, shared page untouched
+ * presenting — moving the page moves it for the whole room
+ *
+ * Students only ever follow or browse. The professor and TAs can do all three,
+ * and more than one of them may present: a change from another presenter is
+ * accepted rather than fought over, so they converge instead of diverging.
+ */
+type SlideMode = "following" | "browsing" | "presenting";
+
 interface SlideUIProps {
   activeDocumentId: string | null;
   isProfessor: boolean;
@@ -63,14 +76,20 @@ function SlideUI({
   onReplaceSlides,
   onEndLecture,
 }: SlideUIProps) {
-  const { socket, sessionId, slideReturnTarget, goBackToPreviousSlide } = useRoom();
+  const { socket, sessionId, role, slideReturnTarget, goBackToPreviousSlide } = useRoom();
   const router = useRouter();
 
+  // The professor and the TAs drive one shared deck between them. Uploading it
+  // is still the professor's alone.
+  const canPresent = role === "PROFESSOR" || role === "TA";
+
   const [pageIndex, setPageIndex] = useState(0);
   const [inputValue, setInputValue] = useState("1");
-  const [isSynced, setIsSynced] = useState(true);
+  // The professor arrives presenting; everyone else arrives following them.
+  const [mode, setMode] = useState<SlideMode>(isProfessor ? "presenting" : "following");
   const [viewerCount, setViewerCount] = useState(0);
-  const professorPageRef = useRef(0);
+  // Where the deck is for the room — whoever last moved it, not just the professor.
+  const sharedPageRef = useRef(0);
   // Each navigateToQuestionSlide call creates a new target object; apply once per object
   // so re-runs (e.g. isSynced → navigateToLocal identity) don't re-detach from live.
   const appliedNavTargetRef = useRef<SlideContextSnapshot | null>(null);
@@ -104,7 +123,7 @@ function SlideUI({
     socket.on("connect", requestSync);
 
     const onSyncResponse = ({ pageIndex: idx }: { pageIndex: number }) => {
-      professorPageRef.current = idx;
+      sharedPageRef.current = idx;
       setPageIndex(idx);
       setInputValue(String(idx + 1));
     };
@@ -136,8 +155,10 @@ function SlideUI({
     if (!socket) return;
 
     const handler = ({ pageIndex: newIndex }: { pageIndex: number }) => {
-      professorPageRef.current = newIndex;
-      if (isSynced || isProfessor) {
+      sharedPageRef.current = newIndex;
+      // Browsing is the only mode that ignores the room. A presenter follows
+      // another presenter's move so two of them cannot drift apart.
+      if (mode !== "browsing") {
         setPageIndex(newIndex);
         setInputValue(String(newIndex + 1));
       }
@@ -149,39 +170,42 @@ function SlideUI({
     return () => {
       socket.off("slide:changed", handler);
     };
-  }, [socket, isSynced, isProfessor]);
+  }, [socket, mode]);
 
   // -------------------------------------------------------------------------
   // Navigation helpers
   // -------------------------------------------------------------------------
 
   const navigateToLocal = useCallback(
-    (newIndex: number, options?: { detachFromProfessor?: boolean }) => {
+    (newIndex: number, options?: { detachFromShared?: boolean }) => {
       if (pageCount === 0) return;
       const clamped = Math.max(0, Math.min(newIndex, pageCount - 1));
-      if (options?.detachFromProfessor && !isProfessor && isSynced) {
-        setIsSynced(false);
+      // Moving while following means you wanted to look elsewhere — stop
+      // following. A presenter is moving the room, so they stay put.
+      if (options?.detachFromShared && mode === "following") {
+        setMode("browsing");
       }
       setPageIndex(clamped);
       setInputValue(String(clamped + 1));
     },
-    [pageCount, isProfessor, isSynced]
+    [pageCount, mode]
   );
 
   const navigateTo = useCallback(
     (newIndex: number) => {
       if (pageCount === 0) return;
       const clamped = Math.max(0, Math.min(newIndex, pageCount - 1));
-      navigateToLocal(clamped);
+      navigateToLocal(clamped, { detachFromShared: true });
 
-      if (isProfessor && socket) {
+      if (mode === "presenting" && socket) {
         socket.emit("slide:change", { sessionId, pageIndex: clamped });
       }
     },
-    [pageCount, navigateToLocal, isProfessor, socket, sessionId]
+    [pageCount, navigateToLocal, mode, socket, sessionId]
   );
 
-  // Question-badge jump: professor broadcasts; students detach from follow mode
+  // Question-badge jump: a presenter takes the room with them; everyone else
+  // detaches and looks on their own.
   useEffect(() => {
     if (slideNavTarget?.slidePageIndex == null || !slideNavTarget.slideSetId) return;
     if (slideNavTarget.slideSetId !== slideSetId) return;
@@ -191,13 +215,13 @@ function SlideUI({
     appliedNavTargetRef.current = slideNavTarget;
     const targetPage = slideNavTarget.slidePageIndex;
     queueMicrotask(() => {
-      if (isProfessor) {
+      if (mode === "presenting") {
         navigateTo(targetPage);
       } else {
-        navigateToLocal(targetPage, { detachFromProfessor: true });
+        navigateToLocal(targetPage, { detachFromShared: true });
       }
     });
-  }, [slideNavTarget, slideSetId, pageCount, navigateToLocal, navigateTo, isProfessor]);
+  }, [slideNavTarget, slideSetId, pageCount, navigateToLocal, navigateTo, mode]);
 
   const handleInputCommit = (value: string) => {
     const num = parseInt(value, 10);
@@ -216,16 +240,26 @@ function SlideUI({
   };
 
   // -------------------------------------------------------------------------
-  // Student sync toggle
+  // Mode switching
   // -------------------------------------------------------------------------
 
-  const handleToggleSync = () => {
-    if (!isSynced) {
-      const target = professorPageRef.current;
-      setPageIndex(target);
-      setInputValue(String(target + 1));
-    }
-    setIsSynced((prev) => !prev);
+  /** Snap back to whatever page the room is on and track it from here. */
+  const handleFollow = () => {
+    const target = sharedPageRef.current;
+    setPageIndex(target);
+    setInputValue(String(target + 1));
+    setMode("following");
+  };
+
+  const handleBrowseFreely = () => setMode("browsing");
+
+  /**
+   * Take the deck. The room is moved to this viewer's current page straight
+   * away so nobody has to guess where the new presenter is.
+   */
+  const handlePresent = () => {
+    setMode("presenting");
+    if (socket) socket.emit("slide:change", { sessionId, pageIndex });
   };
 
   // -------------------------------------------------------------------------
@@ -309,17 +343,64 @@ function SlideUI({
             </>
           )}
 
-          {/* Professor: live indicator + nav */}
-          {isProfessor && (
+          {/* Professor / TA: shared-deck controls */}
+          {canPresent && (
             <>
-              <div className="flex items-center gap-1.5 h-9 px-3 bg-green-100 text-green-700 rounded-md text-sm font-medium">
-                <Radio className="w-4 h-4" />
-                Live
-              </div>
+              {mode === "presenting" && (
+                <div className="flex items-center gap-1.5 h-9 px-3 bg-green-100 text-green-700 rounded-md text-sm font-medium">
+                  <Radio className="w-4 h-4" />
+                  Presenting
+                </div>
+              )}
+              {mode === "following" && (
+                <div className="flex items-center gap-1.5 h-9 px-3 bg-stone-100 text-stone-600 rounded-md text-sm font-medium">
+                  <Navigation className="w-4 h-4" />
+                  Following
+                </div>
+              )}
+              {mode === "browsing" && (
+                <div className="flex items-center gap-1.5 h-9 px-3 bg-stone-100 text-stone-600 rounded-md text-sm font-medium">
+                  <Unlink className="w-4 h-4" />
+                  Browsing
+                </div>
+              )}
+
               <div className="flex items-center gap-1.5 h-9 px-3 bg-stone-100 text-stone-700 rounded-md text-sm font-medium">
                 <Users className="w-4 h-4" />
                 {viewerCount}
               </div>
+
+              {mode !== "presenting" && (
+                <button
+                  onClick={handlePresent}
+                  title="Move the slides for everyone in the room"
+                  className="flex shrink-0 items-center gap-1.5 h-9 px-3 bg-green-100 hover:bg-green-200 text-green-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                >
+                  <Radio className="w-3.5 h-3.5" />
+                  Present
+                </button>
+              )}
+              {mode === "presenting" && (
+                <button
+                  onClick={handleFollow}
+                  title="Stop moving the slides for everyone"
+                  className="flex shrink-0 items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                >
+                  <Unlink className="w-3.5 h-3.5" />
+                  Stop
+                </button>
+              )}
+              {mode === "browsing" && (
+                <button
+                  onClick={handleFollow}
+                  className="flex shrink-0 items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                >
+                  <Navigation className="w-3.5 h-3.5" />
+                  Follow
+                </button>
+              )}
+
+              {/* Uploading the deck stays the professor's — a TA never gets this. */}
               {onReplaceSlides && (
                 <>
                   <input
@@ -338,13 +419,25 @@ function SlideUI({
                   </button>
                 </>
               )}
-              <button
-                onClick={handleEndLecture}
-                className="flex items-center gap-1.5 h-9 px-3 bg-red-100 hover:bg-red-200 text-red-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
-              >
-                <Square className="w-3.5 h-3.5 fill-current" />
-                End Lecture
-              </button>
+
+              {isProfessor ? (
+                <button
+                  onClick={handleEndLecture}
+                  className="flex items-center gap-1.5 h-9 px-3 bg-red-100 hover:bg-red-200 text-red-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                >
+                  <Square className="w-3.5 h-3.5 fill-current" />
+                  End Lecture
+                </button>
+              ) : (
+                <button
+                  onClick={() => router.push("/")}
+                  className="flex items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-red-100 hover:text-red-700 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                >
+                  <LogOut className="w-3.5 h-3.5" />
+                  Exit
+                </button>
+              )}
+
               <div className="w-px h-6 bg-stone-200 mx-1" />
               <button
                 className="w-9 h-9 flex items-center justify-center bg-stone-900 hover:bg-stone-700 text-stone-50 rounded-md transition-colors cursor-pointer"
@@ -373,14 +466,14 @@ function SlideUI({
           )}
 
           {/* Student: following mode */}
-          {!isProfessor && isSynced && (
+          {!canPresent && mode === "following" && (
             <>
               <div className="flex items-center gap-1.5 h-9 px-3 bg-green-100 text-green-700 rounded-md text-sm font-medium">
                 <Navigation className="w-4 h-4" />
-                Following Professor
+                Following Live
               </div>
               <button
-                onClick={handleToggleSync}
+                onClick={handleBrowseFreely}
                 className="flex items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
               >
                 <Unlink className="w-3.5 h-3.5" />
@@ -398,7 +491,7 @@ function SlideUI({
           )}
 
           {/* Student: free navigation mode */}
-          {!isProfessor && !isSynced && (
+          {!canPresent && mode !== "following" && (
             <>
               <button
                 className="w-9 h-9 flex items-center justify-center bg-stone-900 hover:bg-stone-700 text-stone-50 rounded-md transition-colors cursor-pointer"
@@ -424,7 +517,7 @@ function SlideUI({
                 <ChevronRight className="w-5 h-5" />
               </button>
               <button
-                onClick={handleToggleSync}
+                onClick={handleFollow}
                 className="flex items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
               >
                 <Radio className="w-4 h-4" />
diff --git a/src/lib/sessionService.ts b/src/lib/sessionService.ts
index db02937..2238a94 100644
--- a/src/lib/sessionService.ts
+++ b/src/lib/sessionService.ts
@@ -120,12 +120,15 @@ export async function requireSocketEnrollment(
 }
 
 /**
- * Requires that the user is a PROFESSOR in the session's course.
+ * Requires that the user is the PROFESSOR of the session's room.
  * Throws `SessionNotFoundError`, `NotEnrolledError`, or `NotInstructorError`.
  *
+ * For things only the room's owner may do: uploading slides, ending the
+ * lecture, changing who is allowed to answer.
+ *
  * @returns The session's courseId
  */
-export async function requireSocketInstructor(
+export async function requireSocketProfessor(
   userId: string,
   sessionId: string
 ): Promise<{ courseId: string }> {
@@ -138,6 +141,31 @@ export async function requireSocketInstructor(
   return { courseId };
 }
 
+/**
+ * Requires that the user is the PROFESSOR or a TA of the session's room —
+ * the people who run the lecture, which is also who the `:instructors` socket
+ * room contains.
+ *
+ * For things the teaching team shares: driving the slide deck everyone sees.
+ * Note this is deliberately not the same as `requireSocketProfessor`; the two
+ * are named apart because reading "instructor" as either one has been a
+ * reliable way to widen access by accident.
+ *
+ * @returns The session's courseId and the caller's role
+ */
+export async function requireSocketProfessorOrTA(
+  userId: string,
+  sessionId: string
+): Promise<{ courseId: string; role: Role }> {
+  const { role, courseId } = await requireSocketEnrollment(userId, sessionId);
+
+  if (role !== "PROFESSOR" && role !== "TA") {
+    throw new NotInstructorError(userId, sessionId, role);
+  }
+
+  return { courseId, role };
+}
+
 // ---------------------------------------------------------------------------
 // Service Functions
 // ---------------------------------------------------------------------------
diff --git a/src/socket/handlers/sessionHandlers.ts b/src/socket/handlers/sessionHandlers.ts
index 03b6471..a286b53 100644
--- a/src/socket/handlers/sessionHandlers.ts
+++ b/src/socket/handlers/sessionHandlers.ts
@@ -4,7 +4,7 @@ import { redisCache } from "@/lib/redis";
 import { answerMode as answerModeKey } from "@/lib/redisKeys";
 import {
   requireSocketEnrollment,
-  requireSocketInstructor,
+  requireSocketProfessor,
   NotEnrolledError,
   NotInstructorError,
   SessionNotFoundError,
@@ -64,8 +64,8 @@ export function handleAnswerModeChange(socket: Socket, io: Server): void {
       if (!sessionId || typeof sessionId !== "string") return;
       if (mode !== "all" && mode !== "instructors_only") return;
 
-      // 3. Enrollment + role check — only professors in this course
-      await requireSocketInstructor(userId, sessionId);
+      // 3. Enrollment + role check — only this room's professor
+      await requireSocketProfessor(userId, sessionId);
 
       // 4. Persist to Redis
       await redisCache.set(answerModeKey(sessionId), mode, "EX", ANSWER_MODE_TTL_SECONDS);
diff --git a/src/socket/handlers/slideHandlers.ts b/src/socket/handlers/slideHandlers.ts
index 310b79f..340569f 100644
--- a/src/socket/handlers/slideHandlers.ts
+++ b/src/socket/handlers/slideHandlers.ts
@@ -4,7 +4,8 @@ import { redisCache } from "@/lib/redis";
 import { slideState } from "@/lib/redisKeys";
 import {
   requireSocketEnrollment,
-  requireSocketInstructor,
+  requireSocketProfessor,
+  requireSocketProfessorOrTA,
   NotEnrolledError,
   NotInstructorError,
   SessionNotFoundError,
@@ -37,13 +38,13 @@ interface SlideSyncPayload {
 /**
  * Registers the `slide:change` event listener on the given socket.
  *
- * Only professors (per-course CourseEnrollment) may change the shared slide
- * position for a session.
+ * The professor and the TAs of the room share one deck and may all drive it.
+ * Uploading it stays the professor's alone — see handleSlidesUploaded.
  *
  * Guard order (cheap-before-expensive):
  *   1. Auth          — socket.data.userId must exist
  *   2. Payload shape — sessionId must be a string, pageIndex a non-negative integer
- *   3. Enrollment    — user must be a PROFESSOR in the session's course (CourseEnrollment)
+ *   3. Enrollment    — user must be PROFESSOR or TA in the session's course
  *   4. Persist       — current page index written to Redis (24 h TTL)
  *   5. Broadcast     — emit slide:changed to session:{sessionId} (all participants)
  */
@@ -77,8 +78,8 @@ export function handleSlideChange(socket: Socket, io: Server): void {
         return;
       }
 
-      // 3. Enrollment + role check — only professors in this course may change slides
-      await requireSocketInstructor(userId, sessionId);
+      // 3. Enrollment + role check — the room's professor or one of its TAs
+      await requireSocketProfessorOrTA(userId, sessionId);
 
       // 4. Persist current page to Redis with a 24-hour TTL
       await redisCache.set(slideState(sessionId), pageIndex, "EX", SLIDE_STATE_TTL_SECONDS);
@@ -101,10 +102,10 @@ export function handleSlideChange(socket: Socket, io: Server): void {
           userId: socket.data?.userId,
           sessionId: payload?.sessionId,
           action: "slide:change",
-          reason: "not professor",
+          reason: "not professor or TA",
         });
         socket.emit("slide:error", {
-          message: "Only professors can change the shared slide position.",
+          message: "Only the professor and TAs can move the shared slides.",
         });
       } else {
         console.error("[SlideHandler] Failed to process slide:change:", error);
@@ -125,7 +126,7 @@ export function handleSlideChange(socket: Socket, io: Server): void {
  * Guard order:
  *   1. Auth          — socket.data.userId must exist
  *   2. Payload shape — sessionId and slideSetId must be strings
- *   3. Enrollment    — user must be a PROFESSOR in the session's course (CourseEnrollment)
+ *   3. Enrollment    — user must be the PROFESSOR of the session's room
  *   4. Broadcast     — emit slides:available to session:{sessionId}
  */
 export function handleSlidesUploaded(socket: Socket, io: Server): void {
@@ -156,8 +157,8 @@ export function handleSlidesUploaded(socket: Socket, io: Server): void {
         return;
       }
 
-      // 3. Enrollment + role check — only professors in this course
-      await requireSocketInstructor(userId, sessionId);
+      // 3. Enrollment + role check — uploading is the professor's alone
+      await requireSocketProfessor(userId, sessionId);
 
       // 4. Broadcast to all participants in the session room
       io.to(`session:${sessionId}`).emit("slides:available", { slideSetId });
@@ -193,8 +194,9 @@ export function handleSlidesUploaded(socket: Socket, io: Server): void {
 /**
  * Registers the `slide:sync` event listener on the given socket.
  *
- * Returns the professor's last known page index for the session so that
- * late joiners or reconnecting clients can jump to the correct slide.
+ * Returns the room's last known page index — set by whichever of the
+ * professor or TAs last moved the deck — so that late joiners and reconnecting
+ * clients land on the page everyone else is on.
  *
  * Guard order:
  *   1. Auth          — socket.data.userId must exist
diff --git a/vitest.config.mts b/vitest.config.mts
index 7fea523..25cc412 100644
--- a/vitest.config.mts
+++ b/vitest.config.mts
@@ -11,6 +11,7 @@ export default defineConfig({
       "**/dist/**",
       "src/__tests__/prisma-schema.test.ts",
       "src/__tests__/session-join.test.ts",
+      "src/__tests__/slide-control.test.ts",
     ],
   },
 });
diff --git a/vitest.integration.config.mts b/vitest.integration.config.mts
index 21d325b..c1400cc 100644
--- a/vitest.integration.config.mts
+++ b/vitest.integration.config.mts
@@ -5,7 +5,11 @@ export default defineConfig({
   plugins: [tsconfigPaths()],
   test: {
     environment: "node",
-    include: ["src/__tests__/prisma-schema.test.ts", "src/__tests__/session-join.test.ts"],
+    include: [
+      "src/__tests__/prisma-schema.test.ts",
+      "src/__tests__/session-join.test.ts",
+      "src/__tests__/slide-control.test.ts",
+    ],
     // Run test files sequentially to avoid database conflicts
     fileParallelism: false,
     // Run tests within each file sequentially

From 1049366c201a18602297a910d41edf3d668eeedf Mon Sep 17 00:00:00 2001
From: Jaden Scali <jadenrscali@gmail.com>
Date: Thu, 10 Sep 2026 23:45:41 -0400
Subject: [PATCH 29/29] One person drives the slides, and anyone on staff can
 take over
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the concurrent-presenter model with exclusive control, which is what
a lecture actually looks like: one person has the deck, and a TA who wants it
takes it.

A professor or TA who is not driving sees exactly the bar a student sees —
Following / Browse Freely — plus a Control Slides button. Pressing it claims
the deck and pulls the room to the page they were already on, so taking over
while reading ahead brings everyone along instead of stranding them. The
displaced holder, professor included, drops to that same student bar with the
same button back, so control passes back and forth with no release step.

Control lives in Redis per session and is unclaimed by default, resolving to
the room's professor until someone presses the button — a professor who starts
a lecture and never touches it stays in charge with no extra write. slide:change
now checks it: being on staff is no longer enough, because a page change from
someone who is not driving would yank the deck out from under whoever is.

The logic moved to lib/slideControl.ts rather than staying private to a socket
handler, which is what makes it testable — 5 new tests cover the professor
fallback, takeover displacing rather than queueing, and a room with no
professor having no holder at all.

performSessionEnd cleared no Redis state, so an ended lecture kept its slide
position and answer mode for 24 hours. It clears all three now, which also
gives releaseSlideControl a caller outside the tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 FEATURES.md                          |  47 +++--
 src/__tests__/slide-control.test.ts  |  58 +++++
 src/app/room/slideViewer.tsx         | 305 ++++++++++++++-------------
 src/lib/redisKeys.ts                 |  12 ++
 src/lib/sessionService.ts            |  16 ++
 src/lib/slideControl.ts              |  49 +++++
 src/socket/handlers/slideHandlers.ts | 127 ++++++++++-
 src/socket/index.ts                  |   8 +-
 src/socket/types.ts                  |  15 ++
 tsconfig.json                        |   6 +-
 10 files changed, 465 insertions(+), 178 deletions(-)
 create mode 100644 src/lib/slideControl.ts

diff --git a/FEATURES.md b/FEATURES.md
index a1bac70..f48cc8b 100644
--- a/FEATURES.md
+++ b/FEATURES.md
@@ -160,21 +160,25 @@ one to enter a colleague's room on the same class.
 
 ### Real-Time Sync
 
-- The professor **and the room's TAs** share one deck and may all drive it; a page change is broadcast to every participant via `slide:changed`. Uploading it stays the professor's alone
-- Late joiners call `slide:sync` to get the current page — wherever the last person to present left it
+- **One person drives at a time.** The room's professor and its TAs may each take the deck; taking it displaces whoever had it. Uploading stays the professor's alone
+- The holder's page changes are broadcast to every participant via `slide:changed`; `slide:change` from anyone who is not currently holding the deck is refused
+- Control is held in Redis (`slide-controller:{sessionId}`, 24 h) and is **unclaimed by default** — until someone presses the button it belongs to the room's professor, so starting a lecture needs no extra step
+- `slide:control:take` claims it and pulls the room to the taker's current page, so taking over while reading ahead brings everyone along. `slide:control:changed` tells the room who is driving, which is what returns the displaced holder's toolbar to the following view
+- Late joiners call `slide:sync` and get both the current page and the current holder
 - New upload triggers `slides:available` notification to the room
+- Ending a lecture clears the slide position, the controller and the answer mode
 
-### Viewer modes
+### Viewer toolbar
 
-Every participant is in one of these at any moment:
+| Who                              | What they see                                                                                           |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------- |
+| **Holding the deck**             | Controlling badge, viewer count, page controls — plus Replace and End Lecture if they are the professor |
+| **Professor or TA, not holding** | Exactly the student bar, plus a **Control Slides** button                                               |
+| **Student**                      | Following Live / Browse Freely, page controls when browsing                                             |
 
-| Mode           | Who            | What it does                                                                                                 |
-| -------------- | -------------- | ------------------------------------------------------------------------------------------------------------ |
-| **Following**  | everyone       | Tracks the shared page. The default for students and TAs                                                     |
-| **Browsing**   | everyone       | Move around privately; the room is unaffected. Entered by navigating while following, or via _Browse Freely_ |
-| **Presenting** | professor, TAs | Moving the page moves it for the whole room. The professor's default                                         |
-
-_Present_ takes the deck and pulls the room to the presenter's current page, so nobody has to guess where it went. More than one instructor may present at once: a change from another presenter is accepted rather than fought over, so they converge instead of drifting apart.
+A professor who has been taken over lands on the same bar a TA sees, with the
+same button back — so control can pass back and forth without anyone needing to
+release it first.
 
 ### Split View
 
@@ -254,15 +258,18 @@ If Redis is unavailable, rate limiting fails closed (blocks all requests).
 
 ### Session Operations
 
-| Action               | Student | TA  |   Professor   |
-| -------------------- | :-----: | :-: | :-----------: |
-| Create session       |         |     |      Yes      |
-| Join via code        |   Yes   | Yes |      N/A      |
-| End session          |         |     | Yes (creator) |
-| Regenerate join code |         |     | Yes (creator) |
-| Upload slides        |         |     |      Yes      |
-| Control slide page   |         | Yes |      Yes      |
-| Browse slides freely |   Yes   | Yes |      Yes      |
+| Action               | Student |  TA  |   Professor   |
+| -------------------- | :-----: | :--: | :-----------: |
+| Create session       |         |      |      Yes      |
+| Join via code        |   Yes   | Yes  |      N/A      |
+| End session          |         |      | Yes (creator) |
+| Regenerate join code |         |      | Yes (creator) |
+| Upload slides        |         |      |      Yes      |
+| Take slide control   |         | Yes  |      Yes      |
+| Move the shared deck |         | Yes¹ |     Yes¹      |
+| Browse slides freely |   Yes   | Yes  |      Yes      |
+
+¹ Only while holding control — one person at a time.
 
 ### Question Operations
 
diff --git a/src/__tests__/slide-control.test.ts b/src/__tests__/slide-control.test.ts
index 20a39d1..5977b0f 100644
--- a/src/__tests__/slide-control.test.ts
+++ b/src/__tests__/slide-control.test.ts
@@ -9,6 +9,8 @@ import {
   NotInstructorError,
   SessionNotFoundError,
 } from "@/lib/sessionService";
+import { releaseSlideControl, resolveSlideController, takeSlideControl } from "@/lib/slideControl";
+import { redisCache } from "@/lib/redis";
 
 const prisma = new PrismaClient();
 
@@ -18,6 +20,7 @@ beforeAll(async () => {
 
 afterAll(async () => {
   await prisma.$disconnect();
+  redisCache.disconnect();
 });
 
 beforeEach(async () => {
@@ -166,3 +169,58 @@ describe("Slide control authorization", () => {
     });
   });
 });
+
+// =============================================================================
+// Who is holding the deck
+// =============================================================================
+describe("Slide control holder", () => {
+  beforeEach(async () => {
+    await releaseSlideControl("sld-session");
+  });
+
+  it("belongs to the room's professor while unclaimed", async () => {
+    const { professor, room } = await buildRoom();
+    await releaseSlideControl("unclaimed");
+    await expect(resolveSlideController("unclaimed", room.id)).resolves.toBe(professor.id);
+  });
+
+  it("moves to whoever takes it", async () => {
+    const { ta, room, session } = await buildRoom();
+    await takeSlideControl(session.id, ta.id);
+    await expect(resolveSlideController(session.id, room.id)).resolves.toBe(ta.id);
+    await releaseSlideControl(session.id);
+  });
+
+  it("displaces the previous holder rather than queueing", async () => {
+    const { professor, ta, room, session } = await buildRoom();
+
+    await takeSlideControl(session.id, ta.id);
+    await expect(resolveSlideController(session.id, room.id)).resolves.toBe(ta.id);
+
+    // The professor takes it straight back — no release step in between.
+    await takeSlideControl(session.id, professor.id);
+    await expect(resolveSlideController(session.id, room.id)).resolves.toBe(professor.id);
+    await releaseSlideControl(session.id);
+  });
+
+  it("falls back to the professor again once released", async () => {
+    const { professor, ta, room, session } = await buildRoom();
+    await takeSlideControl(session.id, ta.id);
+    await releaseSlideControl(session.id);
+    await expect(resolveSlideController(session.id, room.id)).resolves.toBe(professor.id);
+  });
+
+  it("has no holder for a room with no professor", async () => {
+    const { professor } = await buildRoom();
+    const orphan = await prisma.course.create({
+      data: {
+        code: "SLD999",
+        name: "Legacy",
+        semester: "Fall 2026",
+        createdById: professor.id,
+      },
+    });
+    await releaseSlideControl("orphan-session");
+    await expect(resolveSlideController("orphan-session", orphan.id)).resolves.toBeNull();
+  });
+});
diff --git a/src/app/room/slideViewer.tsx b/src/app/room/slideViewer.tsx
index ee456f8..ca7dde4 100644
--- a/src/app/room/slideViewer.tsx
+++ b/src/app/room/slideViewer.tsx
@@ -47,15 +47,14 @@ interface SlideViewerProps {
 /**
  * How this viewer relates to the deck everyone else is looking at.
  *
- * following  — track the shared page; what students do by default
- * browsing   — move around privately, shared page untouched
- * presenting — moving the page moves it for the whole room
+ * following — track the shared page
+ * browsing  — move around privately, shared page untouched
  *
- * Students only ever follow or browse. The professor and TAs can do all three,
- * and more than one of them may present: a change from another presenter is
- * accepted rather than fought over, so they converge instead of diverging.
+ * This is everyone's relationship to the deck *except* whoever is driving it.
+ * Exactly one person holds control at a time; for them the page they are on is
+ * the shared page, so neither mode applies and the toolbar is different.
  */
-type SlideMode = "following" | "browsing" | "presenting";
+type SlideMode = "following" | "browsing";
 
 interface SlideUIProps {
   activeDocumentId: string | null;
@@ -76,20 +75,25 @@ function SlideUI({
   onReplaceSlides,
   onEndLecture,
 }: SlideUIProps) {
-  const { socket, sessionId, role, slideReturnTarget, goBackToPreviousSlide } = useRoom();
+  const { socket, sessionId, userId, role, slideReturnTarget, goBackToPreviousSlide } = useRoom();
   const router = useRouter();
 
-  // The professor and the TAs drive one shared deck between them. Uploading it
-  // is still the professor's alone.
-  const canPresent = role === "PROFESSOR" || role === "TA";
+  // The professor and the TAs may take the deck. Uploading it stays the
+  // professor's alone.
+  const canTakeControl = role === "PROFESSOR" || role === "TA";
 
   const [pageIndex, setPageIndex] = useState(0);
   const [inputValue, setInputValue] = useState("1");
-  // The professor arrives presenting; everyone else arrives following them.
-  const [mode, setMode] = useState<SlideMode>(isProfessor ? "presenting" : "following");
+  const [mode, setMode] = useState<SlideMode>("following");
   const [viewerCount, setViewerCount] = useState(0);
-  // Where the deck is for the room — whoever last moved it, not just the professor.
+  // Who is driving. Optimistic on the professor so their toolbar is right on
+  // the first frame; slide:sync confirms or corrects it a moment later.
+  const [controllerId, setControllerId] = useState<string | null>(isProfessor ? userId : null);
+  const [controllerName, setControllerName] = useState<string>("");
+  // Where the deck is for the room — whoever last moved it.
   const sharedPageRef = useRef(0);
+
+  const isControlling = !!controllerId && controllerId === userId;
   // Each navigateToQuestionSlide call creates a new target object; apply once per object
   // so re-runs (e.g. isSynced → navigateToLocal identity) don't re-detach from live.
   const appliedNavTargetRef = useRef<SlideContextSnapshot | null>(null);
@@ -122,8 +126,15 @@ function SlideUI({
     if (socket.connected) requestSync();
     socket.on("connect", requestSync);
 
-    const onSyncResponse = ({ pageIndex: idx }: { pageIndex: number }) => {
+    const onSyncResponse = ({
+      pageIndex: idx,
+      controllerId: holder,
+    }: {
+      pageIndex: number;
+      controllerId: string | null;
+    }) => {
       sharedPageRef.current = idx;
+      setControllerId(holder ?? null);
       setPageIndex(idx);
       setInputValue(String(idx + 1));
     };
@@ -156,9 +167,9 @@ function SlideUI({
 
     const handler = ({ pageIndex: newIndex }: { pageIndex: number }) => {
       sharedPageRef.current = newIndex;
-      // Browsing is the only mode that ignores the room. A presenter follows
-      // another presenter's move so two of them cannot drift apart.
-      if (mode !== "browsing") {
+      // Browsing privately is the only reason to ignore the room. The person
+      // driving is the one who sent this, so following it is a no-op for them.
+      if (mode !== "browsing" || isControlling) {
         setPageIndex(newIndex);
         setInputValue(String(newIndex + 1));
       }
@@ -170,7 +181,31 @@ function SlideUI({
     return () => {
       socket.off("slide:changed", handler);
     };
-  }, [socket, mode]);
+  }, [socket, mode, isControlling]);
+
+  // Control changing hands. Losing it drops this viewer back to following the
+  // new holder — the toolbar becomes the same one a student sees, plus the
+  // button to take it back.
+  useEffect(() => {
+    if (!socket) return;
+
+    const onControlChanged = ({
+      controllerId: holder,
+      controllerName: name,
+    }: {
+      controllerId: string;
+      controllerName: string;
+    }) => {
+      setControllerId(holder);
+      setControllerName(name);
+      if (holder !== userId) setMode("following");
+    };
+
+    socket.on("slide:control:changed", onControlChanged);
+    return () => {
+      socket.off("slide:control:changed", onControlChanged);
+    };
+  }, [socket, userId]);
 
   // -------------------------------------------------------------------------
   // Navigation helpers
@@ -182,13 +217,13 @@ function SlideUI({
       const clamped = Math.max(0, Math.min(newIndex, pageCount - 1));
       // Moving while following means you wanted to look elsewhere — stop
       // following. A presenter is moving the room, so they stay put.
-      if (options?.detachFromShared && mode === "following") {
+      if (options?.detachFromShared && mode === "following" && !isControlling) {
         setMode("browsing");
       }
       setPageIndex(clamped);
       setInputValue(String(clamped + 1));
     },
-    [pageCount, mode]
+    [pageCount, mode, isControlling]
   );
 
   const navigateTo = useCallback(
@@ -197,15 +232,15 @@ function SlideUI({
       const clamped = Math.max(0, Math.min(newIndex, pageCount - 1));
       navigateToLocal(clamped, { detachFromShared: true });
 
-      if (mode === "presenting" && socket) {
+      if (isControlling && socket) {
         socket.emit("slide:change", { sessionId, pageIndex: clamped });
       }
     },
-    [pageCount, navigateToLocal, mode, socket, sessionId]
+    [pageCount, navigateToLocal, isControlling, socket, sessionId]
   );
 
-  // Question-badge jump: a presenter takes the room with them; everyone else
-  // detaches and looks on their own.
+  // Question-badge jump: the person driving takes the room with them; everyone
+  // else detaches and looks on their own.
   useEffect(() => {
     if (slideNavTarget?.slidePageIndex == null || !slideNavTarget.slideSetId) return;
     if (slideNavTarget.slideSetId !== slideSetId) return;
@@ -215,13 +250,13 @@ function SlideUI({
     appliedNavTargetRef.current = slideNavTarget;
     const targetPage = slideNavTarget.slidePageIndex;
     queueMicrotask(() => {
-      if (mode === "presenting") {
+      if (isControlling) {
         navigateTo(targetPage);
       } else {
         navigateToLocal(targetPage, { detachFromShared: true });
       }
     });
-  }, [slideNavTarget, slideSetId, pageCount, navigateToLocal, navigateTo, mode]);
+  }, [slideNavTarget, slideSetId, pageCount, navigateToLocal, navigateTo, isControlling]);
 
   const handleInputCommit = (value: string) => {
     const num = parseInt(value, 10);
@@ -254,12 +289,14 @@ function SlideUI({
   const handleBrowseFreely = () => setMode("browsing");
 
   /**
-   * Take the deck. The room is moved to this viewer's current page straight
-   * away so nobody has to guess where the new presenter is.
+   * Take the deck from whoever has it. The room comes to this viewer's current
+   * page, so taking control while browsing ahead brings everyone with you.
+   * The server answers with slide:control:changed, which is what actually
+   * flips this toolbar — and the previous holder's back to following.
    */
-  const handlePresent = () => {
-    setMode("presenting");
-    if (socket) socket.emit("slide:change", { sessionId, pageIndex });
+  const handleTakeControl = () => {
+    if (!socket) return;
+    socket.emit("slide:control:take", { sessionId, pageIndex });
   };
 
   // -------------------------------------------------------------------------
@@ -343,64 +380,21 @@ function SlideUI({
             </>
           )}
 
-          {/* Professor / TA: shared-deck controls */}
-          {canPresent && (
+          {/* Driving the deck — exactly one person at a time, professor or TA.
+              Everything below this block is the same bar everyone else sees. */}
+          {isControlling && (
             <>
-              {mode === "presenting" && (
-                <div className="flex items-center gap-1.5 h-9 px-3 bg-green-100 text-green-700 rounded-md text-sm font-medium">
-                  <Radio className="w-4 h-4" />
-                  Presenting
-                </div>
-              )}
-              {mode === "following" && (
-                <div className="flex items-center gap-1.5 h-9 px-3 bg-stone-100 text-stone-600 rounded-md text-sm font-medium">
-                  <Navigation className="w-4 h-4" />
-                  Following
-                </div>
-              )}
-              {mode === "browsing" && (
-                <div className="flex items-center gap-1.5 h-9 px-3 bg-stone-100 text-stone-600 rounded-md text-sm font-medium">
-                  <Unlink className="w-4 h-4" />
-                  Browsing
-                </div>
-              )}
-
+              <div className="flex items-center gap-1.5 h-9 px-3 bg-green-100 text-green-700 rounded-md text-sm font-medium">
+                <Radio className="w-4 h-4" />
+                Controlling
+              </div>
               <div className="flex items-center gap-1.5 h-9 px-3 bg-stone-100 text-stone-700 rounded-md text-sm font-medium">
                 <Users className="w-4 h-4" />
                 {viewerCount}
               </div>
 
-              {mode !== "presenting" && (
-                <button
-                  onClick={handlePresent}
-                  title="Move the slides for everyone in the room"
-                  className="flex shrink-0 items-center gap-1.5 h-9 px-3 bg-green-100 hover:bg-green-200 text-green-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
-                >
-                  <Radio className="w-3.5 h-3.5" />
-                  Present
-                </button>
-              )}
-              {mode === "presenting" && (
-                <button
-                  onClick={handleFollow}
-                  title="Stop moving the slides for everyone"
-                  className="flex shrink-0 items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
-                >
-                  <Unlink className="w-3.5 h-3.5" />
-                  Stop
-                </button>
-              )}
-              {mode === "browsing" && (
-                <button
-                  onClick={handleFollow}
-                  className="flex shrink-0 items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
-                >
-                  <Navigation className="w-3.5 h-3.5" />
-                  Follow
-                </button>
-              )}
-
-              {/* Uploading the deck stays the professor's — a TA never gets this. */}
+              {/* Replacing the deck is the professor's alone — a TA driving it
+                  never gets this button. */}
               {onReplaceSlides && (
                 <>
                   <input
@@ -465,72 +459,89 @@ function SlideUI({
             </>
           )}
 
-          {/* Student: following mode */}
-          {!canPresent && mode === "following" && (
+          {/* Not driving: the student bar. A professor who has been taken over
+              lands here too, with the same button back. */}
+          {!isControlling && (
             <>
-              <div className="flex items-center gap-1.5 h-9 px-3 bg-green-100 text-green-700 rounded-md text-sm font-medium">
-                <Navigation className="w-4 h-4" />
-                Following Live
-              </div>
-              <button
-                onClick={handleBrowseFreely}
-                className="flex items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
-              >
-                <Unlink className="w-3.5 h-3.5" />
-                Browse Freely
-              </button>
-              <div className="w-px h-6 bg-stone-200 mx-1" />
-              <button
-                onClick={() => router.push("/")}
-                className="flex items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-red-100 hover:text-red-700 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
-              >
-                <LogOut className="w-3.5 h-3.5" />
-                Exit
-              </button>
-            </>
-          )}
+              {mode === "following" ? (
+                <>
+                  <div className="flex items-center gap-1.5 h-9 px-3 bg-green-100 text-green-700 rounded-md text-sm font-medium">
+                    <Navigation className="w-4 h-4" />
+                    {controllerName ? `Following ${controllerName}` : "Following Live"}
+                  </div>
+                  <button
+                    onClick={handleBrowseFreely}
+                    className="flex shrink-0 items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                  >
+                    <Unlink className="w-3.5 h-3.5" />
+                    Browse Freely
+                  </button>
+                </>
+              ) : (
+                <>
+                  <button
+                    className="w-9 h-9 flex items-center justify-center bg-stone-900 hover:bg-stone-700 text-stone-50 rounded-md transition-colors cursor-pointer"
+                    onClick={() => navigateTo(pageIndex === 0 ? pageCount - 1 : pageIndex - 1)}
+                  >
+                    <ChevronLeft className="w-5 h-5" />
+                  </button>
+                  <div className="flex items-center gap-1.5 text-sm font-medium text-foreground">
+                    <input
+                      type="text"
+                      value={inputValue}
+                      onChange={(e) => setInputValue(e.target.value)}
+                      onBlur={() => handleInputCommit(inputValue)}
+                      onKeyDown={handleKeyDown}
+                      className="w-10 h-9 px-1 text-center bg-white border border-stone-300 rounded focus-visible:ring-1 focus-visible:ring-stone-400 focus-visible:outline-none"
+                    />
+                    {pageCount > 0 && <span className="text-stone-500">/ {pageCount}</span>}
+                  </div>
+                  <button
+                    className="w-9 h-9 flex items-center justify-center bg-stone-900 hover:bg-stone-700 text-stone-50 rounded-md transition-colors cursor-pointer"
+                    onClick={() => navigateTo((pageIndex + 1) % pageCount)}
+                  >
+                    <ChevronRight className="w-5 h-5" />
+                  </button>
+                  <button
+                    onClick={handleFollow}
+                    className="flex shrink-0 items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                  >
+                    <Radio className="w-4 h-4" />
+                    Back to Live
+                  </button>
+                </>
+              )}
+
+              {/* The one addition for staff — students never see it. */}
+              {canTakeControl && (
+                <button
+                  onClick={handleTakeControl}
+                  title="Move the slides for everyone in the room"
+                  className="flex shrink-0 items-center gap-1.5 h-9 px-3 bg-green-100 hover:bg-green-200 text-green-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                >
+                  <SquareMousePointer className="w-3.5 h-3.5" />
+                  Control Slides
+                </button>
+              )}
 
-          {/* Student: free navigation mode */}
-          {!canPresent && mode !== "following" && (
-            <>
-              <button
-                className="w-9 h-9 flex items-center justify-center bg-stone-900 hover:bg-stone-700 text-stone-50 rounded-md transition-colors cursor-pointer"
-                onClick={() => navigateTo(pageIndex === 0 ? pageCount - 1 : pageIndex - 1)}
-              >
-                <ChevronLeft className="w-5 h-5" />
-              </button>
-              <div className="flex items-center gap-1.5 text-sm font-medium text-foreground">
-                <input
-                  type="text"
-                  value={inputValue}
-                  onChange={(e) => setInputValue(e.target.value)}
-                  onBlur={() => handleInputCommit(inputValue)}
-                  onKeyDown={handleKeyDown}
-                  className="w-10 h-9 px-1 text-center bg-white border border-stone-300 rounded focus-visible:ring-1 focus-visible:ring-stone-400 focus-visible:outline-none"
-                />
-                {pageCount > 0 && <span className="text-stone-500">/ {pageCount}</span>}
-              </div>
-              <button
-                className="w-9 h-9 flex items-center justify-center bg-stone-900 hover:bg-stone-700 text-stone-50 rounded-md transition-colors cursor-pointer"
-                onClick={() => navigateTo((pageIndex + 1) % pageCount)}
-              >
-                <ChevronRight className="w-5 h-5" />
-              </button>
-              <button
-                onClick={handleFollow}
-                className="flex items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-stone-300 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
-              >
-                <Radio className="w-4 h-4" />
-                Back to Live
-              </button>
               <div className="w-px h-6 bg-stone-200 mx-1" />
-              <button
-                onClick={() => router.push("/")}
-                className="flex items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-red-100 hover:text-red-700 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
-              >
-                <LogOut className="w-3.5 h-3.5" />
-                Exit
-              </button>
+              {isProfessor ? (
+                <button
+                  onClick={handleEndLecture}
+                  className="flex items-center gap-1.5 h-9 px-3 bg-red-100 hover:bg-red-200 text-red-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                >
+                  <Square className="w-3.5 h-3.5 fill-current" />
+                  End Lecture
+                </button>
+              ) : (
+                <button
+                  onClick={() => router.push("/")}
+                  className="flex items-center gap-1.5 h-9 px-3 bg-stone-200 hover:bg-red-100 hover:text-red-700 text-stone-700 rounded-md text-sm font-medium transition-colors cursor-pointer"
+                >
+                  <LogOut className="w-3.5 h-3.5" />
+                  Exit
+                </button>
+              )}
             </>
           )}
         </div>
diff --git a/src/lib/redisKeys.ts b/src/lib/redisKeys.ts
index c48bfd3..cab6d15 100644
--- a/src/lib/redisKeys.ts
+++ b/src/lib/redisKeys.ts
@@ -101,6 +101,18 @@ export function slideState(sessionId: string): string {
   return `slide-state:{${sessionId}}`;
 }
 
+/**
+ * Slide controller key — the userId currently allowed to move the shared deck.
+ * Exactly one person holds it at a time; taking control displaces whoever had
+ * it. Absent means nobody has claimed it yet and the room's professor holds it
+ * by default.
+ * Example: "slide-controller:{abc123}"
+ * TTL: 24 hours, alongside the slide position.
+ */
+export function slideController(sessionId: string): string {
+  return `slide-controller:{${sessionId}}`;
+}
+
 /**
  * Answer mode key — stores whether only instructors or everyone can answer questions.
  * Example: "answer-mode:{abc123}"
diff --git a/src/lib/sessionService.ts b/src/lib/sessionService.ts
index 2238a94..a3008f1 100644
--- a/src/lib/sessionService.ts
+++ b/src/lib/sessionService.ts
@@ -1,5 +1,8 @@
 import type { Role } from "@/generated/prisma";
 import { prisma } from "@/lib/prisma";
+import { redisCache } from "@/lib/redis";
+import { answerMode, slideState } from "@/lib/redisKeys";
+import { releaseSlideControl } from "@/lib/slideControl";
 import { generateUniqueSessionCode } from "@/lib/sessionCode";
 import { deleteFile } from "@/lib/storage";
 import { getIO } from "@/socket";
@@ -385,6 +388,19 @@ export async function performSessionEnd(sessionId: string): Promise<void> {
     // Socket.IO not initialised in test environments — safe to ignore
   }
 
+  // Ephemeral room state. Keys are scoped by session id so a stale one could
+  // never reach a new session, but a ended lecture has no business holding a
+  // slide position or a controller for another 24 hours.
+  try {
+    await Promise.all([
+      releaseSlideControl(sessionId),
+      redisCache.del(slideState(sessionId)),
+      redisCache.del(answerMode(sessionId)),
+    ]);
+  } catch (err) {
+    console.error("[SessionService] Failed to clean up Redis state for session:", sessionId, err);
+  }
+
   try {
     await prisma.question.deleteMany({ where: { sessionId } });
   } catch (err) {
diff --git a/src/lib/slideControl.ts b/src/lib/slideControl.ts
new file mode 100644
index 0000000..1d184a2
--- /dev/null
+++ b/src/lib/slideControl.ts
@@ -0,0 +1,49 @@
+import { prisma } from "@/lib/prisma";
+import { redisCache } from "@/lib/redis";
+import { slideController } from "@/lib/redisKeys";
+
+// ---------------------------------------------------------------------------
+// Slide control
+//
+// Exactly one person drives the deck at a time. Taking control displaces
+// whoever had it — there is no handing it back, because the displaced
+// instructor keeps a Control Slides button and can simply take it again.
+//
+// Nobody holds it until someone claims it, and until then it belongs to the
+// room's professor. That keeps a professor who starts a lecture and never
+// touches the button in charge, with no write needed at session start.
+// ---------------------------------------------------------------------------
+
+/** Matches the slide position's TTL — the two expire together. */
+export const SLIDE_CONTROL_TTL_SECONDS = 86400; // 24 hours
+
+/**
+ * The userId currently allowed to move the deck.
+ *
+ * Falls back to the room's professor while unclaimed. Returns null only for a
+ * room with no professor at all, which is possible for rooms that predate
+ * classlists; nobody can drive those until someone takes control.
+ */
+export async function resolveSlideController(
+  sessionId: string,
+  courseId: string
+): Promise<string | null> {
+  const claimed = await redisCache.get(slideController(sessionId));
+  if (claimed) return claimed;
+
+  const room = await prisma.course.findUnique({
+    where: { id: courseId },
+    select: { professorId: true },
+  });
+  return room?.professorId ?? null;
+}
+
+/** Hands the deck to `userId`, displacing whoever held it. */
+export async function takeSlideControl(sessionId: string, userId: string): Promise<void> {
+  await redisCache.set(slideController(sessionId), userId, "EX", SLIDE_CONTROL_TTL_SECONDS);
+}
+
+/** Forgets who holds the deck — used when a session ends. */
+export async function releaseSlideControl(sessionId: string): Promise<void> {
+  await redisCache.del(slideController(sessionId));
+}
diff --git a/src/socket/handlers/slideHandlers.ts b/src/socket/handlers/slideHandlers.ts
index 340569f..6ab05eb 100644
--- a/src/socket/handlers/slideHandlers.ts
+++ b/src/socket/handlers/slideHandlers.ts
@@ -1,7 +1,9 @@
 import { type Server, type Socket } from "socket.io";
 
+import { prisma } from "@/lib/prisma";
 import { redisCache } from "@/lib/redis";
 import { slideState } from "@/lib/redisKeys";
+import { resolveSlideController, takeSlideControl } from "@/lib/slideControl";
 import {
   requireSocketEnrollment,
   requireSocketProfessor,
@@ -10,7 +12,7 @@ import {
   NotInstructorError,
   SessionNotFoundError,
 } from "@/lib/sessionService";
-import type { SlidesUploadedPayload } from "../types";
+import type { SlideControlTakePayload, SlidesUploadedPayload } from "../types";
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -45,8 +47,9 @@ interface SlideSyncPayload {
  *   1. Auth          — socket.data.userId must exist
  *   2. Payload shape — sessionId must be a string, pageIndex a non-negative integer
  *   3. Enrollment    — user must be PROFESSOR or TA in the session's course
- *   4. Persist       — current page index written to Redis (24 h TTL)
- *   5. Broadcast     — emit slide:changed to session:{sessionId} (all participants)
+ *   4. Control       — and must be the one currently holding the deck
+ *   5. Persist       — current page index written to Redis (24 h TTL)
+ *   6. Broadcast     — emit slide:changed to session:{sessionId} (all participants)
  */
 export function handleSlideChange(socket: Socket, io: Server): void {
   socket.on("slide:change", async (payload: SlideChangePayload) => {
@@ -79,12 +82,22 @@ export function handleSlideChange(socket: Socket, io: Server): void {
       }
 
       // 3. Enrollment + role check — the room's professor or one of its TAs
-      await requireSocketProfessorOrTA(userId, sessionId);
+      const { courseId } = await requireSocketProfessorOrTA(userId, sessionId);
 
-      // 4. Persist current page to Redis with a 24-hour TTL
+      // 4. Control check — being staff is not enough; someone else may be
+      // driving, and their deck must not jump under them.
+      const controllerId = await resolveSlideController(sessionId, courseId);
+      if (controllerId !== userId) {
+        socket.emit("slide:error", {
+          message: "Someone else is controlling the slides. Take control to move them.",
+        });
+        return;
+      }
+
+      // 5. Persist current page to Redis with a 24-hour TTL
       await redisCache.set(slideState(sessionId), pageIndex, "EX", SLIDE_STATE_TTL_SECONDS);
 
-      // 5. Broadcast to all participants in the session room
+      // 6. Broadcast to all participants in the session room
       io.to(`session:${sessionId}`).emit("slide:changed", { pageIndex });
     } catch (error) {
       if (error instanceof SessionNotFoundError) {
@@ -117,6 +130,100 @@ export function handleSlideChange(socket: Socket, io: Server): void {
   });
 }
 
+/**
+ * Registers the `slide:control:take` event listener on the given socket.
+ *
+ * Hands the deck to the caller, displacing whoever held it. The previous
+ * holder's client drops to the following toolbar when the broadcast lands, and
+ * keeps its own Control Slides button, so control can pass back and forth
+ * without anyone having to release it first.
+ *
+ * Guard order:
+ *   1. Auth          — socket.data.userId must exist
+ *   2. Payload shape — sessionId must be a string
+ *   3. Enrollment    — user must be PROFESSOR or TA in the session's course
+ *   4. Claim         — write the holder to Redis (24 h TTL)
+ *   5. Move          — pull the room to the new holder's page, if they sent one
+ *   6. Broadcast     — emit slide:control:changed to the whole session room
+ */
+export function handleSlideControlTake(socket: Socket, io: Server): void {
+  socket.on("slide:control:take", async (payload: SlideControlTakePayload) => {
+    try {
+      // 1. Auth guard
+      const userId: string | undefined = socket.data?.userId;
+      if (!userId) {
+        socket.emit("slide:error", { message: "Authentication required." });
+        return;
+      }
+
+      // 2. Payload shape guard
+      if (!payload || typeof payload !== "object") {
+        socket.emit("slide:error", { message: "Invalid request." });
+        return;
+      }
+
+      const { sessionId, pageIndex } = payload;
+
+      if (!sessionId || typeof sessionId !== "string") {
+        socket.emit("slide:error", { message: "Session ID is required." });
+        return;
+      }
+
+      // 3. Enrollment + role check — students never get the deck
+      await requireSocketProfessorOrTA(userId, sessionId);
+
+      // 4. Claim it
+      await takeSlideControl(sessionId, userId);
+
+      // 5. A takeover lands where the new holder was already looking, so the
+      //    room follows them rather than stranding them on someone else's page.
+      if (typeof pageIndex === "number" && Number.isInteger(pageIndex) && pageIndex >= 0) {
+        await redisCache.set(slideState(sessionId), pageIndex, "EX", SLIDE_STATE_TTL_SECONDS);
+        io.to(`session:${sessionId}`).emit("slide:changed", { pageIndex });
+      }
+
+      // 6. Tell the room who is driving — this is what moves the previous
+      //    holder's toolbar back to the following view.
+      const person = await prisma.user.findUnique({
+        where: { id: userId },
+        select: { name: true },
+      });
+
+      io.to(`session:${sessionId}`).emit("slide:control:changed", {
+        controllerId: userId,
+        controllerName: person?.name ?? "",
+      });
+    } catch (error) {
+      if (error instanceof SessionNotFoundError) {
+        socket.emit("slide:error", { message: "Session not found." });
+      } else if (error instanceof NotEnrolledError) {
+        console.warn("[Security]", {
+          userId: socket.data?.userId,
+          sessionId: payload?.sessionId,
+          action: "slide:control:take",
+          reason: "not enrolled",
+        });
+        socket.emit("slide:error", { message: "You are not enrolled in this session." });
+      } else if (error instanceof NotInstructorError) {
+        console.warn("[Security]", {
+          userId: socket.data?.userId,
+          sessionId: payload?.sessionId,
+          action: "slide:control:take",
+          reason: "not professor or TA",
+        });
+        socket.emit("slide:error", {
+          message: "Only the professor and TAs can control the slides.",
+        });
+      } else {
+        console.error("[SlideHandler] Failed to process slide:control:take:", error);
+        socket.emit("slide:error", {
+          message: "An error occurred while taking control of the slides.",
+        });
+      }
+    }
+  });
+}
+
 /**
  * Registers the `slides:uploaded` event listener on the given socket.
  *
@@ -229,14 +336,16 @@ export function handleSlideSync(socket: Socket): void {
       }
 
       // 3. Enrollment check — must be enrolled in the session's course
-      await requireSocketEnrollment(userId, sessionId);
+      const { courseId } = await requireSocketEnrollment(userId, sessionId);
 
       // 4. Read current page index from Redis
       const stored = await redisCache.get(slideState(sessionId));
       const pageIndex = stored !== null ? parseInt(stored, 10) : 0;
 
-      // 5. Reply only to the requesting socket
-      socket.emit("slide:sync", { pageIndex });
+      // 5. Reply only to the requesting socket, with who is driving so the
+      //    toolbar renders correctly on a late join or a reconnect.
+      const controllerId = await resolveSlideController(sessionId, courseId);
+      socket.emit("slide:sync", { pageIndex, controllerId });
     } catch (error) {
       if (error instanceof NotEnrolledError || error instanceof SessionNotFoundError) {
         socket.emit("slide:error", { message: "You are not enrolled in this session." });
diff --git a/src/socket/index.ts b/src/socket/index.ts
index 3f09501..38874cd 100644
--- a/src/socket/index.ts
+++ b/src/socket/index.ts
@@ -17,7 +17,12 @@ import {
   handleAnswerUpvote,
   handleAnswerDelete,
 } from "./handlers/answerHandlers";
-import { handleSlideChange, handleSlideSync, handleSlidesUploaded } from "./handlers/slideHandlers";
+import {
+  handleSlideChange,
+  handleSlideControlTake,
+  handleSlideSync,
+  handleSlidesUploaded,
+} from "./handlers/slideHandlers";
 import { handleAnswerModeChange, handleAnswerModeSync } from "./handlers/sessionHandlers";
 import type {
   ClientToServerEvents,
@@ -259,6 +264,7 @@ export async function initSocketIO(
     handleAnswerUpvote(socket, io!);
     handleAnswerDelete(socket, io!);
     handleSlideChange(socket, io!);
+    handleSlideControlTake(socket, io!);
     handleSlideSync(socket);
     handleSlidesUploaded(socket, io!);
     handleAnswerModeChange(socket, io!);
diff --git a/src/socket/types.ts b/src/socket/types.ts
index 043430c..14453f6 100644
--- a/src/socket/types.ts
+++ b/src/socket/types.ts
@@ -191,6 +191,19 @@ export interface SlideSyncPayload {
 
 export interface SlideSyncResponsePayload {
   pageIndex: number;
+  /** Who currently holds the deck, so a late joiner renders the right toolbar. */
+  controllerId: string | null;
+}
+
+export interface SlideControlTakePayload {
+  sessionId: string;
+  /** Page to pull the room to, so a takeover lands where the taker is looking. */
+  pageIndex?: number;
+}
+
+export interface SlideControlChangedPayload {
+  controllerId: string;
+  controllerName: string;
 }
 
 export interface SlidesUploadedPayload {
@@ -223,6 +236,7 @@ export interface ClientToServerEvents {
   "question:delete": (payload: QuestionDeletePayload) => void;
   "answer:delete": (payload: AnswerDeletePayload) => void;
   "slide:change": (payload: SlideChangePayload) => void;
+  "slide:control:take": (payload: SlideControlTakePayload) => void;
   "slide:sync": (payload: SlideSyncPayload) => void;
   "slides:uploaded": (payload: SlidesUploadedPayload) => void;
   "answer-mode:change": (payload: AnswerModeChangePayload) => void;
@@ -247,6 +261,7 @@ export interface ServerToClientEvents {
   "question:deleted": (payload: QuestionDeletedPayload) => void;
   "answer:deleted": (payload: AnswerDeletedPayload) => void;
   "slide:changed": (payload: SlideChangedPayload) => void;
+  "slide:control:changed": (payload: SlideControlChangedPayload) => void;
   "slide:sync": (payload: SlideSyncResponsePayload) => void;
   "slide:error": (payload: { message: string }) => void;
   "slides:available": (payload: SlidesAvailablePayload) => void;
diff --git a/tsconfig.json b/tsconfig.json
index f313817..d8a8f44 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -52,7 +52,11 @@
     ".next-wlk-3103/types/**/*.ts",
     ".next-wlk-3103/dev/types/**/*.ts",
     ".next-wlk-3100/types/**/*.ts",
-    ".next-wlk-3100/dev/types/**/*.ts"
+    ".next-wlk-3100/dev/types/**/*.ts",
+    ".next-student-1/types/**/*.ts",
+    ".next-student-1/dev/types/**/*.ts",
+    ".next-student-2/types/**/*.ts",
+    ".next-student-2/dev/types/**/*.ts"
   ],
   "exclude": ["node_modules", ".next", ".next-prof", ".next-ta", ".next-student"]
 }