diff --git a/docs/PHASE_33_SCAN_OCR_PLAN.md b/docs/PHASE_33_SCAN_OCR_PLAN.md
new file mode 100644
index 00000000..67ff38ec
--- /dev/null
+++ b/docs/PHASE_33_SCAN_OCR_PLAN.md
@@ -0,0 +1,198 @@
+# Phase 33 — Scan & OCR of student handwriting — Implementation Plan
+
+**Status:** Proposed (drafting pass). No code written yet — this document is the spec to approve before implementation.
+
+**Goal:** Let a teacher capture or upload a photo/scan of a student's handwritten work (paper essay, worksheet, exam answer), run OCR on it, review and correct the extracted text, and attach both the image and the text to the relevant grading record — while respecting the app's offline-capable, Supabase-primary storage model and its GDPR posture.
+
+**Scope guardrails (from the project's own rules):**
+
+- **No AI generation.** OCR/ICR (turning an image into text) is transcription, not content generation, so it is in scope. Auto-grading, auto-feedback, or "improve this essay" on the recognised text stays out of scope (root `CLAUDE.md` → "No AI generation").
+- **Offline-capable first.** The feature must degrade to a working local-only path when Supabase is absent, exactly like the rest of the app.
+- **Never regress a shipped feature.** The existing image branch of `extractText()` (`src/utils/textExtraction.ts`) already OCRs images; Phase 33 extends that path, it does not replace or break it.
+
+---
+
+## Category 1 — Dependencies we already have that can do this
+
+| Capability                       | Existing dependency / module                                             | Notes                                                                                                                                                                                                 |
+| -------------------------------- | ------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| OCR engine                       | `tesseract.js ^7.0.0` (`src/utils/textExtraction.ts` → `extractFromImage`) | Already wired: `createWorker('eng')` → `worker.recognize(dataUrl)`. Runs fully client-side (WASM). Today it uses defaults only — one language, no preprocessing, no confidence/word data surfaced. |
+| Image branch of the pipeline     | `extractText()` `mimeType.startsWith('image/')` branch                    | The entry point Phase 33 hooks into; already reports progress via `onProgress`.                                                                                                                        |
+| Local binary (blob) storage      | `src/services/mediaStore.ts` (IndexedDB `rm_media`)                        | `putBlob/getBlob/deleteBlob/listIds/pruneOrphanedBlobs/estimateUsage`. This is the correct home for large scan images — **not** the base64 `dataUrl` on `Attachment`, which bloats `localStorage`.   |
+| Cloud blob storage + RLS pattern | Supabase Storage buckets `attachments`, `recordings`, `feedback-audio`     | Precedent to copy: private bucket + `file_size_limit` + `allowed_mime_types`, RLS on `storage.objects` keyed to `(storage.foldername(name))[1] = auth.uid()`, path `{userId}/{id}`.                    |
+| Blob ⇄ Supabase sync             | `src/services/database/RecordingSync.ts` + `recording_metadata` table      | Exact template for a new `ScanSync` + `scan_metadata` (metadata row in Postgres, bytes in the bucket, `storage_path` linking them).                                                                    |
+| Analysis-result persistence      | `analysis_results` table + `src/components/Essay/DocumentAnalysisPanel.tsx` | OCR output already has a persistence home and a review surface to extend.                                                                                                                              |
+| Attachment model & viewer        | `Attachment` type (`src/types/index.ts`), `AttachmentViewer.tsx`           | Scans can surface as a specialised attachment kind linked to a `studentId`/`rubricId`.                                                                                                                 |
+| Media capture precedent          | `src/hooks/useMediaRecorder.ts` (getUserMedia for audio)                   | Establishes the permission/stream/cleanup pattern to mirror for a **camera photo** hook.                                                                                                              |
+| Retention / auto-deletion        | `get_overdue_attachments()` SQL fn + `delete-old-attachments` edge function | Nightly Supabase Cron job driven by the owner's school `retention_years` (default 7). Directly reusable/extendable for scans.                                                                          |
+| PDF rasterisation                | `pdfjs-dist ^6.3.289`                                                       | Lets a multi-page PDF scan be rendered page-by-page to a canvas for OCR (we currently only pull the PDF text layer, which a scanned PDF doesn't have).                                                 |
+| Image resize/preprocess surface  | Browser Canvas 2D + `OffscreenCanvas`                                       | No dependency needed for grayscale, contrast, threshold, downscale/upscale — enough for a first preprocessing pass.                                                                                    |
+
+**Takeaway:** the local capture → OCR → store → review → attach loop can be built almost entirely from what's already installed. New dependencies are only needed to materially *improve handwriting accuracy* (Category 2).
+
+---
+
+## Category 2 — Dependencies we will need to add
+
+Ordered by how strongly they're needed. Each is weighed against bundle size and the offline-first / no-heavy-CDN conventions.
+
+1. **Additional Tesseract language data (no new npm dep, new assets).**
+   Handwriting recognition still benefits from the right traineddata. Ship the LSTM (`_best`) models for the languages we support UI-side (at least `eng`, `nld`, `fra`, `deu`, `spa`) and let the user pick, instead of hardcoding `'eng'`. Host the traineddata as a bundled/self-hosted asset (same principle as the self-hosted pdf worker in `textExtraction.ts`) — do not pull from an external CDN at runtime.
+
+2. **`jscanify` + OpenCV.js for auto edge-detection & perspective correction — _committed_.**
+   A phone photo of paper is skewed, curved, and shadowed; flattening it is the single biggest OCR-quality win, so this phase **commits to auto-crop** rather than shipping manual-crop first. Use **`jscanify`** (MIT, a thin wrapper over OpenCV.js) for automatic page edge-detection + perspective warp, backed by **`opencv.js`** for deskew/adaptive-threshold/denoise. Because OpenCV.js is a ~8 MB WASM payload, it is **lazy-loaded on the scan route only** via dynamic `import()` — never in the main chunk, same rule as `loadDb()` — and the WASM/asset is self-hosted, not pulled from a CDN at runtime. A **manual four-corner adjust** stays available as a fallback when auto-detection misses, but auto-crop is the default path.
+
+3. **_(Deferred — not this phase.)_ Cloud handwriting-recognition provider.**
+   Tesseract is trained on printed text; cursive/messy handwriting is where it fails hardest, and no local option fully closes that gap. A high-accuracy cloud ICR path (Google Cloud Vision, Azure AI Vision Read, AWS Textract) is **explicitly deferred to a later phase** — Phase 33 is **local-only**. It's captured here so the storage/consent design leaves room for it, but no edge function, provider account, or opt-in UI is built now.
+
+**Explicitly avoided:** no new state library, no CSS-in-JS, no AI content-generation SDK, and no cloud OCR in this phase.
+
+---
+
+## Category 3 — Local device vs. server-side processing
+
+**Decision for this phase: local-only.** All OCR runs on the teacher's device via Tesseract.js. The server-side path is analysed here for completeness but is **deferred to a later phase** (Category 2, item 3) — nothing server-side is built now.
+
+| Path                                      | Where                                        | Pros                                                                                                | Cons                                                                                                                  |
+| ----------------------------------------- | -------------------------------------------- | --------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| **Local (Tesseract.js + OpenCV prep)** — _this phase_ | Browser, WASM worker             | Works offline; **no student image or text ever leaves the device** (best GDPR posture); zero per-use cost; matches offline-first design | Weak on cursive/messy handwriting; CPU-heavy on low-end devices; language pack download size                          |
+| **Server-side (edge function → cloud ICR)** — _deferred_ | Supabase edge function calling a cloud model | Dramatically better handwriting accuracy; offloads CPU from the teacher's device        | Requires network (breaks offline); sends student work to a third party (consent/DPA needed); cost; opt-in complexity |
+
+**Design (local-only for Phase 33):**
+
+- **Preprocessing runs locally** (crop/deskew/threshold via OpenCV.js) — cheap and the biggest accuracy lever regardless of engine.
+- **Local Tesseract is the only path.** No network is ever required; the feature works identically with or without a Supabase connection.
+- **Leave room for the deferred server path.** Keep a `settings.scanOcr` slice so a future `serverSide` opt-in can be added without reshaping storage or the review UI, but do **not** build the edge function, provider integration, or upload/consent UI in this phase.
+
+---
+
+## Category 4 — Improving OCR for student handwriting
+
+Handwriting is the hard part. Concrete, ordered levers (biggest win first):
+
+1. **Preprocess the image before OCR (local, canvas/OpenCV).**
+    - Auto or manual **perspective crop** to isolate the page (removes desk/background noise).
+    - **Grayscale → adaptive/Otsu binarisation** (handwriting in blue/black ink on white → clean 1-bit).
+    - **Deskew** (rotate to level text lines) and **denoise** (remove speckle/shadow gradients).
+    - **Upscale to ~300 DPI equivalent** — Tesseract accuracy drops sharply below that.
+2. **Configure Tesseract properly (we currently pass nothing).**
+    - Set **OEM = LSTM-only** and pick a sensible **PSM** (e.g. `PSM.SINGLE_BLOCK` / `PSM.AUTO`) per capture type; expose "single column of text" vs "sparse" as a capture hint.
+    - Load the **correct language** (student's subject language), not always `eng`; allow multi-language (`eng+nld`).
+    - Supply **`user_words` / `user_patterns`** dictionaries seeded from the rubric/assignment vocabulary and the class's known names so domain terms resolve better.
+3. **Surface confidence and keep a human in the loop.**
+    - Read Tesseract's per-word confidence (`data.words`), **highlight low-confidence spans** in the review UI, and jump the teacher to them. The extracted text is *always* teacher-editable before it's saved — OCR is a first draft, never the final grade input.
+    - Show the **image and text side-by-side** so correction is fast (extend `DocumentAnalysisPanel`).
+4. **Manage expectations by capture quality.**
+    - Neat block capitals / printed worksheets → local Tesseract is usable.
+    - Cursive / dense handwriting → local accuracy is limited; document this honestly in the in-app docs rather than over-promising, and note that a higher-accuracy path is planned for a future phase (the deferred server ICR — Category 2/3). The teacher-correction step (below) is what makes the feature reliable in the meantime.
+5. **(Future, no-AI-safe) feedback loop.** Store teacher corrections alongside the OCR draft so we can measure accuracy over time and tune preprocessing/PSM defaults. Corrections are used for *tuning our pipeline*, not for training a generative model.
+
+---
+
+## Category 5 — Storing scanned images & deletion policy
+
+Scans are photos of children's schoolwork: **personal data**, often larger than any other blob in the app. Storage follows the existing recordings/attachments pattern; the deletion policy is stricter than the default because of the sensitivity.
+
+### Storage
+
+- **Offline / local:** image bytes go into **IndexedDB via `mediaStore.putBlob`**, keyed by a `scanId`. **Never** store the raw image as a base64 `dataUrl` on the `Attachment`/state (it would land in `localStorage` and blow the quota). State/metadata holds only the `scanId` + OCR result + link (`studentId`, `rubricId`/assignment).
+- **Connected:** new private Supabase bucket **`scans`** (`public=false`, `file_size_limit` ~10–20 MB, `allowed_mime_types = image/*`), RLS keyed to `(storage.foldername(name))[1] = auth.uid()`, path `{userId}/{scanId}`. Bytes in the bucket; a **`scan_metadata`** table (mirroring `recording_metadata`: `id`, `owner_id`, `student_id`, `storage_path`, `data jsonb` for OCR text/confidence/link) carries the metadata and syncs like everything else.
+- **Sync:** a new **`ScanSync`** service (cloned from `RecordingSync`) uploads the blob + upserts metadata while connected, gated through `isOffline()` and the pending-sync queue like all other writes; `pruneOrphanedBlobs` sweeps IndexedDB blobs no longer referenced after a hydrate/merge.
+- **Access:** students/anonymous never read the bucket directly — teacher-minted **signed URLs** only (same rule as `feedback-audio`).
+
+### Deletion policy
+
+Scans are the most sensitive personal-data category in the app, so retention is **deliberately short — one school year maximum**, well below the 7-year default that attachments inherit.
+
+- **Discard-after-OCR default (privacy-preserving).** A setting `settings.scanOcr.keepImage` (**default `false`**): when off, the image blob is deleted as soon as the teacher confirms the recognised text and it's attached to the grade — we keep the *text*, not the photo. When on, the image is retained (subject to the one-year cap below) for later reference.
+- **One-year / school-year cap.** No scan image is retained beyond one school year. Each scan record carries a `schoolYear` stamp (derived at capture from the active school-year setting), and starting a new school year purges the previous year's scans:
+    - **Tied to class import.** The natural trigger is the existing "import new classes / roster rollover" flow — when the teacher rolls the roster into a new school year, that action also sweeps scans stamped with prior years (both the IndexedDB blob and, when connected, the bucket object + `scan_metadata` row). This keeps the purge aligned with the moment the teacher is already refreshing their data, and means offline-only teachers still get the cleanup (it isn't solely a server cron).
+    - **Backstop sweep (connected deployments):** add a `get_overdue_scans()` SQL function keyed to the one-year cap (not `retention_years`) and extend the nightly `delete-old-attachments` edge function (or a `delete-old-scans` sibling) to purge anything the client-side rollover missed. Runs via Supabase Cron.
+    - **Offline backstop:** on app boot, an idempotent local sweep drops IndexedDB scan blobs older than one school year, so a teacher who never triggers a rollover still doesn't accumulate stale images.
+- **Manual delete cascades** everywhere: deleting the scan (or its parent grade/student) removes the IndexedDB blob, the Storage object, and the `scan_metadata` row in one action — no orphans.
+- **Right-to-erasure (GDPR Art. 17):** student deletion already cascades their records; ensure scans are in that cascade (metadata row + blob + bucket object).
+- **Docs:** `PRIVACY.md` §5.5/§5.6 must gain a paragraph on scanned images — what's stored, where, the discard-after-OCR default, and the one-year/school-year purge — since this introduces a new, sensitive personal-data category.
+
+---
+
+## Subphases (logical implementation chunks)
+
+Each subphase is independently shippable and testable; later ones build on earlier ones. Sizes are rough (_small / medium / large_).
+
+### 33.0 — Foundations: types, local storage layer, feature flag _(small)_
+
+- Add domain types to `src/types/index.ts`: `Scan` / `ScanMetadata` (`id`, `studentId?`, `rubricId?`/assignment link, `storagePath?`, `ocrText`, `ocrConfidence`, `lang`, `schoolYear`, `createdAt`) and a `ScanOcrSettings` slice (`keepImage: false`, `defaultLang`). Leave a placeholder for the deferred `serverSide` flag but don't wire it.
+- Extend `mediaStore` usage for scan blobs (no schema change — reuse `rm_media`); add a thin `src/services/scanStore.ts` helper if it clarifies ids/prefixes.
+- Wire a `useSettings()` slice for `scanOcr` with the safe defaults above; stamp `schoolYear` at capture from the active school-year setting.
+- Tests: type/reducer surface, settings defaults.
+
+### 33.1 — Capture & import UI _(medium)_
+
+- New `useCameraCapture` hook (mirror `useMediaRecorder`'s permission/stream/cleanup) + a file/drag-drop importer for existing photos/scanned PDFs.
+- **Teacher-only entry points** where scanning naturally fits — **GradeStudent** (scan a student's paper answer while grading) and the existing attachments/import flow; consider the student profile / batch-import surface if it's low-cost. **No student-portal upload** — students never scan or upload images; this is a teacher tool only. The capture surface carries a "what are you scanning?" hint (single column / sparse) feeding PSM later.
+- Multi-page PDF: render pages to canvas via `pdfjs-dist` for OCR.
+- i18n keys in all five locales; route entry documented.
+- Tests: hook (mocked `getUserMedia`), importer, PDF-page rasterisation.
+
+### 33.2 — Local preprocessing pipeline with OpenCV auto-crop _(medium)_
+
+- **`jscanify` + OpenCV.js auto edge-detection & perspective warp**, lazy-loaded (dynamic `import()`) on the scan route only, WASM self-hosted — committed as the default (not manual-crop-first).
+- Preprocessing chain around it: grayscale → contrast → Otsu/adaptive threshold → deskew → upscale, exposed as a pure, unit-testable `preprocessScan(imageData, opts)` in `src/utils/`.
+- **Manual four-corner adjust** kept as a fallback when auto-detection misses.
+- Verify the OpenCV chunk stays out of the main bundle (bundle-analysis job) and never loads outside the scan flow.
+- Tests: deterministic pixel transforms on fixtures; auto-crop wrapper with OpenCV mocked.
+
+### 33.3 — OCR engine improvements (local) _(medium)_
+
+- Replace the hardcoded `createWorker('eng')` with language selection (`eng`, `nld`, `fra`, `deu`, `spa`, multi-lang), self-hosted traineddata assets, OEM=LSTM, capture-driven PSM, and optional `user_words`/`user_patterns` from rubric/class vocab.
+- Return per-word confidence from `extractFromImage` (extend the return shape without breaking existing callers).
+- Tests: language routing, config plumbing, confidence surfaced (Tesseract mocked).
+
+### 33.4 — Review & correction UI + link to grading _(medium)_
+
+- Extend `DocumentAnalysisPanel` (or a sibling) to show **image + editable text side-by-side**, highlight low-confidence words, and let the teacher edit before saving.
+- On confirm: attach the recognised text to the grade/attachment and persist the scan record; honour `keepImage` (discard-after-OCR default).
+- Tests: edit-then-save flow, low-confidence highlighting, discard-vs-keep branch.
+
+### 33.5 — Cloud storage, sync & one-year retention _(medium)_
+
+- Migration: `scans` bucket + `scan_metadata` table (incl. `school_year`) + RLS (clone `034_recordings_storage.sql`).
+- `ScanSync` service (clone `RecordingSync`): blob upload + metadata upsert, `isOffline()`-gated, pending-queue fallback, orphan pruning; signed-URL read.
+- **School-year purge, tied to class import:** hook the roster-rollover / class-import flow to sweep prior-year scans (blob + bucket + metadata). Add `get_overdue_scans()` keyed to the one-year cap and extend the nightly deletion edge function as a backstop; add the on-boot local IndexedDB sweep. Ensure student-deletion cascade includes scans.
+- Update `supabase/CLAUDE.md` (buckets + tables + edge-function lists).
+- Tests: sync round-trip (fake-indexeddb + adapter mocks), one-year purge on rollover, backstop query, cascade.
+
+### 33.6 — _(Deferred, not this phase)_ Server-side handwriting OCR
+
+Recorded for future planning only — **out of scope for Phase 33.** When picked up: a gated `ocr-handwriting` edge function calling a configured cloud ICR provider (key server-side), an opt-in `serverSide` setting with explicit consent UI, auto-suggested only on low local confidence with a live connection, hidden offline and on the self-hosted stack (no functions runtime). The 33.0 types/settings leave room for it so it slots in without reshaping storage or the review UI.
+
+### 33.7 — Docs, i18n parity & privacy _(small)_
+
+- **In-app docs** (`DocsPage.tsx` — GradingTab/DataTab): what scanning does, how to reach it (teacher-only), the keep/discard image choice, and the honest local-accuracy note.
+- **`README.md`:** Features + Routes + Key utility modules (new `preprocessScan`, `scanStore`, `ScanSync`).
+- **`LandingPage.tsx`:** one teacher-feature card ("Scan & grade handwritten work").
+- **`PRIVACY.md`:** new scanned-image data category, storage location, discard-after-OCR default, one-year/school-year purge.
+- Locale parity across `en/nl/fr/de/es` (guarded by `src/locales/__tests__`).
+
+---
+
+## Cross-cutting regression checklist
+
+- Existing `extractText()` image branch still works for the current document-analysis flow (the new richer return shape must be additive/back-compatible).
+- Offline mode: capture → preprocess → local OCR → attach → save works with **no** Supabase and no network.
+- No full-entity `localStorage` writes reintroduced; scan bytes live in IndexedDB/Storage only (root `CLAUDE.md` storage rule).
+- Supabase client chunk stays lazy — no `services/database` import pulled into the capture/preprocess modules except via `loadDb()`/route-level pages.
+- Coverage stays above thresholds; locale key-parity test green; Playwright wiring guard green if e2e specs are added.
+
+## Resolved decisions
+
+1. **Auto-crop dependency — resolved:** commit to `jscanify` + OpenCV.js auto-crop, lazy-loaded on the scan route only, WASM self-hosted; manual four-corner adjust kept as a fallback.
+2. **Server ICR — resolved:** deferred. Phase 33 is local-only; the server path is documented for a future phase but nothing server-side is built now.
+3. **Retention — resolved:** one-school-year maximum (not the 7-year attachments default). Purge is triggered by the new-school-year class-import/rollover, with a nightly server backstop and an on-boot local sweep.
+4. **Entry points — resolved:** teacher-side only (GradeStudent + attachments/import, optionally student-profile batch import). Students never upload scans through the portal.
+
+## Remaining micro-decisions (safe to settle during build)
+
+- Exact bundle-size budget/threshold for the lazy OpenCV chunk in the analysis job.
+- Whether the school-year stamp is calendar-derived or read from an explicit setting, and the cutover month for NL/EU school years.
+- Which additional teacher surfaces (beyond GradeStudent) are worth a scan entry point.
diff --git a/src/hooks/__tests__/useCameraCapture.test.ts b/src/hooks/__tests__/useCameraCapture.test.ts
new file mode 100644
index 00000000..1128c784
--- /dev/null
+++ b/src/hooks/__tests__/useCameraCapture.test.ts
@@ -0,0 +1,244 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { renderHook, act } from '@testing-library/react';
+import { useCameraCapture } from '../useCameraCapture';
+
+function makeStream() {
+    const track = { stop: vi.fn() };
+    const stream = { getTracks: () => [track] } as unknown as MediaStream;
+    return { stream, track };
+}
+
+let getUserMedia: ReturnType<typeof vi.fn>;
+
+beforeEach(() => {
+    getUserMedia = vi.fn().mockImplementation(async () => makeStream().stream);
+    Object.defineProperty(navigator, 'mediaDevices', {
+        value: { getUserMedia },
+        configurable: true,
+    });
+});
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+describe('useCameraCapture', () => {
+    it('starts in idle status', () => {
+        const { result } = renderHook(() => useCameraCapture());
+        expect(result.current.status).toBe('idle');
+        expect(result.current.error).toBeNull();
+    });
+
+    it('start requests the rear camera by default and goes active', async () => {
+        const { result } = renderHook(() => useCameraCapture());
+        await act(async () => {
+            await result.current.start();
+        });
+        expect(getUserMedia).toHaveBeenCalledWith({ video: { facingMode: 'environment' }, audio: false });
+        expect(result.current.status).toBe('active');
+    });
+
+    it('start honours a user-facing camera request', async () => {
+        const { result } = renderHook(() => useCameraCapture());
+        await act(async () => {
+            await result.current.start({ facingMode: 'user' });
+        });
+        expect(getUserMedia).toHaveBeenCalledWith({ video: { facingMode: 'user' }, audio: false });
+    });
+
+    it('sets error status when permission is denied', async () => {
+        getUserMedia.mockRejectedValueOnce(new Error('denied'));
+        const { result } = renderHook(() => useCameraCapture());
+        let ok = true;
+        await act(async () => {
+            ok = await result.current.start();
+        });
+        expect(ok).toBe(false);
+        expect(result.current.status).toBe('error');
+        expect(result.current.error?.message).toBe('denied');
+    });
+
+    it('capture returns null before the camera is started', async () => {
+        const { result } = renderHook(() => useCameraCapture());
+        const out = await result.current.capture();
+        expect(out).toBeNull();
+    });
+
+    it('capture draws the current frame to a blob', async () => {
+        const drawImage = vi.fn();
+        const getContextSpy = vi
+            .spyOn(HTMLCanvasElement.prototype, 'getContext')
+            .mockReturnValue({ drawImage } as unknown as CanvasRenderingContext2D);
+        const toBlobSpy = vi.spyOn(HTMLCanvasElement.prototype, 'toBlob').mockImplementation(function (
+            this: HTMLCanvasElement,
+            cb: BlobCallback
+        ) {
+            cb(new Blob(['img'], { type: 'image/png' }));
+        });
+
+        const { result } = renderHook(() => useCameraCapture());
+        act(() => {
+            result.current.videoRef.current = {
+                videoWidth: 640,
+                videoHeight: 480,
+                play: vi.fn().mockResolvedValue(undefined),
+            } as unknown as HTMLVideoElement;
+        });
+        await act(async () => {
+            await result.current.start();
+        });
+
+        const out = await result.current.capture('image/png');
+        expect(out).not.toBeNull();
+        expect(out!.width).toBe(640);
+        expect(out!.height).toBe(480);
+        expect(out!.mimeType).toBe('image/png');
+        expect(drawImage).toHaveBeenCalled();
+
+        getContextSpy.mockRestore();
+        toBlobSpy.mockRestore();
+    });
+
+    it('capture returns null when the video has no dimensions yet', async () => {
+        const { result } = renderHook(() => useCameraCapture());
+        act(() => {
+            result.current.videoRef.current = {
+                videoWidth: 0,
+                videoHeight: 0,
+                play: vi.fn().mockResolvedValue(undefined),
+            } as unknown as HTMLVideoElement;
+        });
+        await act(async () => {
+            await result.current.start();
+        });
+        expect(await result.current.capture()).toBeNull();
+    });
+
+    it('stop tears down the stream tracks', async () => {
+        const { stream, track } = makeStream();
+        getUserMedia.mockResolvedValueOnce(stream);
+        const { result } = renderHook(() => useCameraCapture());
+        await act(async () => {
+            await result.current.start();
+        });
+        act(() => {
+            result.current.stop();
+        });
+        expect(track.stop).toHaveBeenCalled();
+        expect(result.current.status).toBe('idle');
+    });
+
+    it('start is idempotent while active and does not request the camera twice', async () => {
+        const { result } = renderHook(() => useCameraCapture());
+        await act(async () => {
+            await result.current.start();
+        });
+        await act(async () => {
+            expect(await result.current.start()).toBe(true);
+        });
+        expect(getUserMedia).toHaveBeenCalledTimes(1);
+    });
+
+    it('tears down a partially-acquired stream when play() rejects', async () => {
+        const { stream, track } = makeStream();
+        getUserMedia.mockResolvedValueOnce(stream);
+        const { result } = renderHook(() => useCameraCapture());
+        act(() => {
+            result.current.videoRef.current = {
+                videoWidth: 640,
+                videoHeight: 480,
+                play: vi.fn().mockRejectedValue(new Error('play failed')),
+            } as unknown as HTMLVideoElement;
+        });
+        let ok = true;
+        await act(async () => {
+            ok = await result.current.start();
+        });
+        expect(ok).toBe(false);
+        expect(result.current.status).toBe('error');
+        expect(track.stop).toHaveBeenCalled();
+    });
+
+    it('serializes concurrent start calls into a single getUserMedia request', async () => {
+        const { result } = renderHook(() => useCameraCapture());
+        await act(async () => {
+            await Promise.all([result.current.start(), result.current.start()]);
+        });
+        expect(getUserMedia).toHaveBeenCalledTimes(1);
+        expect(result.current.status).toBe('active');
+    });
+
+    it('discards a stream that arrives after stop() and stays idle', async () => {
+        const { stream, track } = makeStream();
+        let resolveGum!: (s: MediaStream) => void;
+        getUserMedia.mockImplementationOnce(
+            () =>
+                new Promise<MediaStream>((res) => {
+                    resolveGum = res;
+                })
+        );
+        const { result } = renderHook(() => useCameraCapture());
+        let startPromise!: Promise<boolean>;
+        act(() => {
+            startPromise = result.current.start();
+        });
+        act(() => {
+            result.current.stop();
+        });
+        let ok = true;
+        await act(async () => {
+            resolveGum(stream);
+            ok = await startPromise;
+        });
+        expect(ok).toBe(false);
+        expect(track.stop).toHaveBeenCalled();
+        expect(result.current.status).toBe('idle');
+    });
+
+    it('reports the actual blob mime type when the browser falls back to png', async () => {
+        const getContextSpy = vi
+            .spyOn(HTMLCanvasElement.prototype, 'getContext')
+            .mockReturnValue({ drawImage: vi.fn() } as unknown as CanvasRenderingContext2D);
+        const toBlobSpy = vi.spyOn(HTMLCanvasElement.prototype, 'toBlob').mockImplementation(function (
+            this: HTMLCanvasElement,
+            cb: BlobCallback
+        ) {
+            cb(new Blob(['img'], { type: 'image/png' }));
+        });
+
+        const { result } = renderHook(() => useCameraCapture());
+        act(() => {
+            result.current.videoRef.current = {
+                videoWidth: 640,
+                videoHeight: 480,
+                play: vi.fn().mockResolvedValue(undefined),
+            } as unknown as HTMLVideoElement;
+        });
+        await act(async () => {
+            await result.current.start();
+        });
+
+        const out = await result.current.capture('image/webp');
+        expect(out!.mimeType).toBe('image/png');
+
+        getContextSpy.mockRestore();
+        toBlobSpy.mockRestore();
+    });
+
+    it('capture returns null when no 2d context is available', async () => {
+        const getContextSpy = vi.spyOn(HTMLCanvasElement.prototype, 'getContext').mockReturnValue(null);
+        const { result } = renderHook(() => useCameraCapture());
+        act(() => {
+            result.current.videoRef.current = {
+                videoWidth: 640,
+                videoHeight: 480,
+                play: vi.fn().mockResolvedValue(undefined),
+            } as unknown as HTMLVideoElement;
+        });
+        await act(async () => {
+            await result.current.start();
+        });
+        expect(await result.current.capture()).toBeNull();
+        getContextSpy.mockRestore();
+    });
+});
diff --git a/src/hooks/useCameraCapture.ts b/src/hooks/useCameraCapture.ts
new file mode 100644
index 00000000..47bed0b1
--- /dev/null
+++ b/src/hooks/useCameraCapture.ts
@@ -0,0 +1,124 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+export type CameraStatus = 'idle' | 'active' | 'error';
+
+export interface CaptureResult {
+    blob: Blob;
+    mimeType: string;
+    width: number;
+    height: number;
+}
+
+export interface StartCameraOptions {
+    /** Prefer the rear ('environment') camera for scanning paper; falls back if unavailable. */
+    facingMode?: 'environment' | 'user';
+}
+
+export interface UseCameraCaptureReturn {
+    status: CameraStatus;
+    error: Error | null;
+    /** Attach to a <video autoPlay playsInline muted> element to preview the live camera. */
+    videoRef: React.RefObject<HTMLVideoElement | null>;
+    start: (opts?: StartCameraOptions) => Promise<boolean>;
+    capture: (mimeType?: string, quality?: number) => Promise<CaptureResult | null>;
+    stop: () => void;
+}
+
+/**
+ * Live camera preview + still-frame capture for scanning paper work. A still image
+ * (not a recording) is grabbed from the preview onto a canvas; the caller stores the
+ * resulting blob via scanStore. Mirrors useMediaRecorder's permission/stream/cleanup
+ * handling but is video-still oriented.
+ */
+export function useCameraCapture(): UseCameraCaptureReturn {
+    const [status, setStatus] = useState<CameraStatus>('idle');
+    const [error, setError] = useState<Error | null>(null);
+    const videoRef = useRef<HTMLVideoElement | null>(null);
+    const streamRef = useRef<MediaStream | null>(null);
+    const startPromiseRef = useRef<Promise<boolean> | null>(null);
+    // Bumped by stop()/unmount so a getUserMedia request still in flight can tell it
+    // was superseded and release its stream instead of attaching it after teardown.
+    const genRef = useRef(0);
+
+    const stop = useCallback(() => {
+        genRef.current += 1;
+        startPromiseRef.current = null;
+        streamRef.current?.getTracks().forEach((t) => t.stop());
+        streamRef.current = null;
+        if (videoRef.current) videoRef.current.srcObject = null;
+        setStatus('idle');
+    }, []);
+
+    const start = useCallback((opts: StartCameraOptions = {}) => {
+        if (streamRef.current) return Promise.resolve(true);
+        if (startPromiseRef.current) return startPromiseRef.current;
+
+        const gen = genRef.current;
+        const run = (async () => {
+            try {
+                const stream = await navigator.mediaDevices.getUserMedia({
+                    video: { facingMode: opts.facingMode ?? 'environment' },
+                    audio: false,
+                });
+                if (gen !== genRef.current) {
+                    stream.getTracks().forEach((t) => t.stop());
+                    return false;
+                }
+                streamRef.current = stream;
+                if (videoRef.current) {
+                    videoRef.current.srcObject = stream;
+                    await videoRef.current.play?.();
+                }
+                if (gen !== genRef.current) {
+                    stream.getTracks().forEach((t) => t.stop());
+                    streamRef.current = null;
+                    if (videoRef.current) videoRef.current.srcObject = null;
+                    return false;
+                }
+                setStatus('active');
+                setError(null);
+                return true;
+            } catch (e) {
+                if (gen === genRef.current) {
+                    streamRef.current?.getTracks().forEach((t) => t.stop());
+                    streamRef.current = null;
+                    setError(e instanceof Error ? e : new Error(String(e)));
+                    setStatus('error');
+                }
+                return false;
+            } finally {
+                if (gen === genRef.current) startPromiseRef.current = null;
+            }
+        })();
+        startPromiseRef.current = run;
+        return run;
+    }, []);
+
+    const capture = useCallback((mimeType = 'image/png', quality?: number) => {
+        const video = videoRef.current;
+        if (!video || !streamRef.current) return Promise.resolve<CaptureResult | null>(null);
+
+        const width = video.videoWidth;
+        const height = video.videoHeight;
+        if (!width || !height) return Promise.resolve<CaptureResult | null>(null);
+
+        const canvas = document.createElement('canvas');
+        canvas.width = width;
+        canvas.height = height;
+        const ctx = canvas.getContext('2d');
+        if (!ctx) return Promise.resolve<CaptureResult | null>(null);
+        ctx.drawImage(video, 0, 0, width, height);
+
+        return new Promise<CaptureResult | null>((resolve) => {
+            canvas.toBlob(
+                (blob) => resolve(blob ? { blob, mimeType: blob.type || mimeType, width, height } : null),
+                mimeType,
+                quality
+            );
+        });
+    }, []);
+
+    useEffect(() => stop, [stop]);
+
+    return { status, error, videoRef, start, capture, stop };
+}
diff --git a/src/services/__tests__/scanStore.test.ts b/src/services/__tests__/scanStore.test.ts
new file mode 100644
index 00000000..4dadfe43
--- /dev/null
+++ b/src/services/__tests__/scanStore.test.ts
@@ -0,0 +1,75 @@
+import 'fake-indexeddb/auto';
+import { describe, it, expect, beforeEach } from 'vitest';
+import { putBlob, getBlob, deleteBlob, listIds } from '../mediaStore';
+import {
+    SCAN_ID_PREFIX,
+    newScanId,
+    isScanId,
+    putScanBlob,
+    getScanBlob,
+    deleteScanBlob,
+    listScanIds,
+} from '../scanStore';
+
+function makeBlob(content: string, type = 'image/png'): Blob {
+    return new Blob([content], { type });
+}
+
+describe('scanStore ids', () => {
+    it('newScanId is prefixed and unique', () => {
+        const a = newScanId();
+        const b = newScanId();
+        expect(a.startsWith(SCAN_ID_PREFIX)).toBe(true);
+        expect(a).not.toBe(b);
+    });
+
+    it('isScanId distinguishes scan ids from other blob ids', () => {
+        expect(isScanId(newScanId())).toBe(true);
+        expect(isScanId('rec_123')).toBe(false);
+    });
+});
+
+describe('scanStore blobs', () => {
+    beforeEach(async () => {
+        for (const id of await listIds()) {
+            await deleteBlob(id);
+        }
+    });
+
+    it('round-trips a scan blob', async () => {
+        const id = newScanId();
+        await putScanBlob(id, makeBlob('img'), 'image/png');
+        const record = await getScanBlob(id);
+        expect(record).not.toBeNull();
+        expect(record!.id).toBe(id);
+        expect(record!.mimeType).toBe('image/png');
+    });
+
+    it('deleteScanBlob removes a scan blob', async () => {
+        const id = newScanId();
+        await putScanBlob(id, makeBlob('img'), 'image/png');
+        await deleteScanBlob(id);
+        expect(await getScanBlob(id)).toBeNull();
+    });
+
+    it('listScanIds returns only scan-prefixed blobs, not recordings', async () => {
+        const scanId = newScanId();
+        await putScanBlob(scanId, makeBlob('img'), 'image/png');
+        await putBlob('rec_abc', makeBlob('audio', 'audio/webm'), 'audio/webm');
+
+        expect(await listScanIds()).toEqual([scanId]);
+    });
+
+    it('rejects a non-scan id in every CRUD wrapper so a recording blob is never touched', async () => {
+        await putBlob('rec_abc', makeBlob('audio', 'audio/webm'), 'audio/webm');
+
+        await expect(putScanBlob('rec_abc', makeBlob('img'), 'image/png')).rejects.toThrow(/scan id/);
+        await expect(getScanBlob('rec_abc')).rejects.toThrow(/scan id/);
+        await expect(deleteScanBlob('rec_abc')).rejects.toThrow(/scan id/);
+
+        // The recording is untouched by the rejected scan calls.
+        const rec = await getBlob('rec_abc');
+        expect(rec).not.toBeNull();
+        expect(rec!.mimeType).toBe('audio/webm');
+    });
+});
diff --git a/src/services/scanStore.ts b/src/services/scanStore.ts
new file mode 100644
index 00000000..9317c097
--- /dev/null
+++ b/src/services/scanStore.ts
@@ -0,0 +1,41 @@
+import { nanoid } from '../utils/nanoid';
+import { putBlob, getBlob, deleteBlob, listIds, type MediaRecord } from './mediaStore';
+
+/**
+ * Scan image bytes share the single `rm_media` IndexedDB blob store with recordings
+ * (services/mediaStore). This prefix keeps scan ids in their own namespace, and the
+ * CRUD wrappers below refuse a non-scan id so a stray recording id can't overwrite a
+ * recording's blob in the shared store.
+ */
+export const SCAN_ID_PREFIX = 'scan_';
+
+export function newScanId(): string {
+    return SCAN_ID_PREFIX + nanoid();
+}
+
+export function isScanId(id: string): boolean {
+    return id.startsWith(SCAN_ID_PREFIX);
+}
+
+function assertScanId(id: string): void {
+    if (!isScanId(id)) throw new Error(`Not a scan id: ${id}`);
+}
+
+export async function putScanBlob(id: string, blob: Blob, mimeType: string): Promise<MediaRecord> {
+    assertScanId(id);
+    return putBlob(id, blob, mimeType);
+}
+
+export async function getScanBlob(id: string): Promise<MediaRecord | null> {
+    assertScanId(id);
+    return getBlob(id);
+}
+
+export async function deleteScanBlob(id: string): Promise<void> {
+    assertScanId(id);
+    return deleteBlob(id);
+}
+
+export async function listScanIds(): Promise<string[]> {
+    return (await listIds()).filter(isScanId);
+}
diff --git a/src/types/index.ts b/src/types/index.ts
index a5048938..4b701955 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -239,6 +239,61 @@ export interface Attachment {
     addedAt: string; // ISO date string
 }
 
+/**
+ * An academic year in `YYYY-YYYY` form (e.g. `'2026-2027'`), the span the retention
+ * policy purges by — distinct from `SchoolYear`, which is a Dutch grade level
+ * (groep-7, jaar-1..6). Derived in `src/utils/academicYear.ts`.
+ */
+export type AcademicYear = string;
+
+/**
+ * Metadata for a scanned image of student work (Phase 33). The image bytes live only
+ * in IndexedDB (scanStore) while offline and, when connected, in the `scans` Storage
+ * bucket referenced by `storagePath` — never inline on this record, matching
+ * SessionRecording. The recognised text is kept here; the image is subject to the
+ * discard-after-OCR default and the one-academic-year retention cap.
+ */
+export interface Scan {
+    id: string;
+    /** Grade record / student this scan belongs to, when captured during grading. */
+    studentId?: string;
+    /** Rubric or assignment the scan is filed under, when applicable. */
+    rubricId?: string;
+    /** Path in the `scans` bucket once uploaded; absent while local-only. */
+    storagePath?: string;
+    /** OCR transcription (teacher-editable before it's saved to a grade). */
+    ocrText: string;
+    /** Mean per-word OCR confidence in [0, 1], or undefined before recognition. */
+    ocrConfidence?: number;
+    /** Tesseract language(s) used, e.g. `'eng'` or `'eng+nld'`. */
+    lang?: string;
+    /** Academic year the scan was captured in; the retention sweep purges by this. */
+    schoolYear: AcademicYear;
+    createdAt: string; // ISO date string
+    /** True once the blob + metadata are pushed to Supabase (connected mode). */
+    synced?: boolean;
+}
+
+/**
+ * Per-user settings for the scan-and-OCR feature (Phase 33). Read through
+ * `resolveScanOcrSettings` (src/utils/scanSettings.ts) so every field has a safe
+ * default when the slice is absent.
+ */
+export interface ScanOcrSettings {
+    /**
+     * Keep the scanned image after its text is confirmed, instead of discarding it.
+     * Defaults to false (discard-after-OCR) — the privacy-preserving choice.
+     */
+    keepImage: boolean;
+    /** Default Tesseract language for recognition, e.g. `'eng'`. */
+    defaultLang: string;
+    /**
+     * Deferred (Phase 33.6): opt into server-side cloud handwriting OCR. Not wired in
+     * Phase 33 — the field exists so the setting can be added later without a reshape.
+     */
+    serverSide?: boolean;
+}
+
 /**
  * An inline anchored comment on a graded document (essay or DOCX attachment, both
  * rendered read-only through CommentableDocumentView). anchor positions are raw
@@ -791,6 +846,8 @@ export interface AppSettings {
     digestUnreadMessagesEnabled?: boolean;
     /** Wider letter-spacing and increased line-height app-wide, for dyslexic readers. */
     dyslexiaFriendlyMode?: boolean;
+    /** Scan-and-OCR preferences (Phase 33); resolve with resolveScanOcrSettings for defaults. */
+    scanOcr?: ScanOcrSettings;
 }
 
 export type UiFontFamily = 'Inter' | 'Nunito' | 'Source Sans 3' | 'Lato' | 'Roboto';
diff --git a/src/utils/__tests__/scanImport.test.ts b/src/utils/__tests__/scanImport.test.ts
new file mode 100644
index 00000000..27be8014
--- /dev/null
+++ b/src/utils/__tests__/scanImport.test.ts
@@ -0,0 +1,185 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+const getPage = vi.fn();
+const getDocument = vi.fn();
+
+vi.mock('pdfjs-dist', () => ({
+    GlobalWorkerOptions: { workerSrc: '' },
+    getDocument: (...args: unknown[]) => getDocument(...args),
+}));
+
+import { isScannableImage, isScannablePdf, rasterizePdf, importScanFiles } from '../scanImport';
+
+function imageFile(name = 'photo.png', type = 'image/png'): File {
+    return new File(['bytes'], name, { type });
+}
+
+function pdfFile(name = 'scan.pdf'): File {
+    const file = new File(['%PDF'], name, { type: 'application/pdf' });
+    file.arrayBuffer = vi.fn().mockResolvedValue(new ArrayBuffer(4));
+    return file;
+}
+
+function mockPdf(numPages: number, viewport = { width: 100, height: 200 }) {
+    getPage.mockImplementation(async () => ({
+        getViewport: () => viewport,
+        render: () => ({ promise: Promise.resolve() }),
+    }));
+    const destroy = vi.fn().mockResolvedValue(undefined);
+    getDocument.mockReturnValue({ promise: Promise.resolve({ numPages, getPage }), destroy });
+    return { destroy };
+}
+
+let getContextSpy: ReturnType<typeof vi.spyOn>;
+let toBlobSpy: ReturnType<typeof vi.spyOn>;
+
+beforeEach(() => {
+    getContextSpy = vi
+        .spyOn(HTMLCanvasElement.prototype, 'getContext')
+        .mockReturnValue({ drawImage: vi.fn() } as unknown as CanvasRenderingContext2D);
+    toBlobSpy = vi.spyOn(HTMLCanvasElement.prototype, 'toBlob').mockImplementation(function (
+        this: HTMLCanvasElement,
+        cb: BlobCallback
+    ) {
+        cb(new Blob(['page'], { type: 'image/png' }));
+    });
+});
+
+afterEach(() => {
+    getContextSpy.mockRestore();
+    toBlobSpy.mockRestore();
+    getPage.mockReset();
+    getDocument.mockReset();
+});
+
+describe('file predicates', () => {
+    it('recognises image files', () => {
+        expect(isScannableImage(imageFile('a.jpg', 'image/jpeg'))).toBe(true);
+        expect(isScannableImage(pdfFile())).toBe(false);
+    });
+
+    it('recognises PDFs by mime type or extension', () => {
+        expect(isScannablePdf(pdfFile())).toBe(true);
+        expect(isScannablePdf(new File([''], 'x.PDF', { type: '' }))).toBe(true);
+        expect(isScannablePdf(imageFile())).toBe(false);
+    });
+});
+
+describe('rasterizePdf', () => {
+    it('renders one image per page', async () => {
+        mockPdf(3);
+        const images = await rasterizePdf(pdfFile());
+        expect(images).toHaveLength(3);
+        expect(images.map((i) => i.pageIndex)).toEqual([0, 1, 2]);
+        expect(images[0].sourceName).toBe('scan.pdf');
+        expect(images[0].mimeType).toBe('image/png');
+    });
+
+    it('rejects when no 2d context is available', async () => {
+        mockPdf(2);
+        getContextSpy.mockReturnValue(null);
+        await expect(rasterizePdf(pdfFile())).rejects.toThrow();
+    });
+
+    it('rejects a non-finite or non-positive scale', async () => {
+        mockPdf(1);
+        await expect(rasterizePdf(pdfFile(), { scale: 0 })).rejects.toThrow();
+        await expect(rasterizePdf(pdfFile(), { scale: Number.POSITIVE_INFINITY })).rejects.toThrow();
+    });
+
+    it('destroys the loading task after a successful render', async () => {
+        const { destroy } = mockPdf(2);
+        await rasterizePdf(pdfFile());
+        expect(destroy).toHaveBeenCalledTimes(1);
+    });
+
+    it('destroys the loading task even when loading rejects', async () => {
+        const destroy = vi.fn().mockResolvedValue(undefined);
+        getDocument.mockReturnValue({ promise: Promise.reject(new Error('bad pdf')), destroy });
+        await expect(rasterizePdf(pdfFile())).rejects.toThrow('bad pdf');
+        expect(destroy).toHaveBeenCalledTimes(1);
+    });
+
+    it('uses the blob mime type when it differs from the requested type', async () => {
+        mockPdf(1);
+        toBlobSpy.mockImplementation(function (this: HTMLCanvasElement, cb: BlobCallback) {
+            cb(new Blob(['page'], { type: 'image/png' }));
+        });
+        const images = await rasterizePdf(pdfFile(), { mimeType: 'image/webp' });
+        expect(images[0].mimeType).toBe('image/png');
+    });
+});
+
+describe('importScanFiles', () => {
+    it('passes image files through unchanged', async () => {
+        const { images, skipped } = await importScanFiles([imageFile('essay.jpg', 'image/jpeg')]);
+        expect(skipped).toEqual([]);
+        expect(images).toHaveLength(1);
+        expect(images[0].mimeType).toBe('image/jpeg');
+        expect(images[0].pageIndex).toBeUndefined();
+    });
+
+    it('expands a PDF into per-page images', async () => {
+        mockPdf(2);
+        const { images } = await importScanFiles([pdfFile()]);
+        expect(images).toHaveLength(2);
+    });
+
+    it('reports a PDF that yields no pages', async () => {
+        mockPdf(0);
+        const { images, skipped } = await importScanFiles([pdfFile('empty.pdf')]);
+        expect(images).toEqual([]);
+        expect(skipped).toEqual([{ name: 'empty.pdf', reason: 'no-pages' }]);
+    });
+
+    it('skips unsupported files with a reason', async () => {
+        const { images, skipped } = await importScanFiles([new File(['x'], 'notes.txt', { type: 'text/plain' })]);
+        expect(images).toEqual([]);
+        expect(skipped).toEqual([{ name: 'notes.txt', reason: 'unsupported-type' }]);
+    });
+
+    it('reports a PDF whose render throws', async () => {
+        getDocument.mockReturnValue({
+            promise: Promise.reject(new Error('bad pdf')),
+            destroy: vi.fn().mockResolvedValue(undefined),
+        });
+        const { images, skipped } = await importScanFiles([pdfFile('broken.pdf')]);
+        expect(images).toEqual([]);
+        expect(skipped).toEqual([{ name: 'broken.pdf', reason: 'pdf-render-failed' }]);
+    });
+
+    it('reports pdf-render-failed when canvas serialization returns null', async () => {
+        mockPdf(1);
+        toBlobSpy.mockImplementation(function (this: HTMLCanvasElement, cb: BlobCallback) {
+            cb(null);
+        });
+        const { images, skipped } = await importScanFiles([pdfFile('nul.pdf')]);
+        expect(images).toEqual([]);
+        expect(skipped).toEqual([{ name: 'nul.pdf', reason: 'pdf-render-failed' }]);
+    });
+
+    it('reports pdf-render-failed for a PDF with too many pages', async () => {
+        mockPdf(10_000);
+        const { images, skipped } = await importScanFiles([pdfFile('huge.pdf')]);
+        expect(images).toEqual([]);
+        expect(skipped).toEqual([{ name: 'huge.pdf', reason: 'pdf-render-failed' }]);
+    });
+
+    it('reports pdf-render-failed when a page exceeds the pixel limit', async () => {
+        mockPdf(1, { width: 100_000, height: 100_000 });
+        const { images, skipped } = await importScanFiles([pdfFile('big.pdf')]);
+        expect(images).toEqual([]);
+        expect(skipped).toEqual([{ name: 'big.pdf', reason: 'pdf-render-failed' }]);
+    });
+
+    it('handles a mix of images, PDFs, and junk in one call', async () => {
+        mockPdf(1);
+        const { images, skipped } = await importScanFiles([
+            imageFile('a.png'),
+            pdfFile('b.pdf'),
+            new File(['x'], 'c.txt', { type: 'text/plain' }),
+        ]);
+        expect(images).toHaveLength(2);
+        expect(skipped).toEqual([{ name: 'c.txt', reason: 'unsupported-type' }]);
+    });
+});
diff --git a/src/utils/academicYear.test.ts b/src/utils/academicYear.test.ts
new file mode 100644
index 00000000..4adcd454
--- /dev/null
+++ b/src/utils/academicYear.test.ts
@@ -0,0 +1,65 @@
+import { describe, it, expect } from 'vitest';
+import {
+    getAcademicYear,
+    academicYearStart,
+    previousAcademicYear,
+    compareAcademicYear,
+    isBeyondRetention,
+} from './academicYear';
+
+describe('getAcademicYear', () => {
+    // getAcademicYear reads local calendar components, so these boundary dates are
+    // built from local Y/M/D (not a UTC literal) to stay stable across time zones.
+    it('places a date on or after the August cutover in the year that starts then', () => {
+        expect(getAcademicYear(new Date(2026, 7, 1))).toBe('2026-2027');
+        expect(getAcademicYear(new Date(2026, 11, 31))).toBe('2026-2027');
+    });
+
+    it('places a date before the cutover in the prior-starting year', () => {
+        expect(getAcademicYear(new Date(2026, 6, 31))).toBe('2025-2026');
+        expect(getAcademicYear(new Date(2026, 0, 1))).toBe('2025-2026');
+    });
+
+    it('honours a custom cutover month', () => {
+        expect(getAcademicYear(new Date(2026, 8, 1), 9)).toBe('2026-2027');
+        expect(getAcademicYear(new Date(2026, 7, 31), 9)).toBe('2025-2026');
+    });
+});
+
+describe('academicYearStart', () => {
+    it('parses the start year', () => {
+        expect(academicYearStart('2026-2027')).toBe(2026);
+    });
+
+    it('is NaN for a malformed value', () => {
+        expect(Number.isNaN(academicYearStart('not-a-year'))).toBe(true);
+    });
+});
+
+describe('previousAcademicYear', () => {
+    it('returns the year before', () => {
+        expect(previousAcademicYear('2026-2027')).toBe('2025-2026');
+    });
+});
+
+describe('compareAcademicYear', () => {
+    it('orders by start year', () => {
+        expect(compareAcademicYear('2025-2026', '2026-2027')).toBeLessThan(0);
+        expect(compareAcademicYear('2026-2027', '2025-2026')).toBeGreaterThan(0);
+        expect(compareAcademicYear('2026-2027', '2026-2027')).toBe(0);
+    });
+});
+
+describe('isBeyondRetention', () => {
+    it('flags any earlier academic year as beyond the one-year cap', () => {
+        expect(isBeyondRetention('2025-2026', '2026-2027')).toBe(true);
+    });
+
+    it('keeps the current academic year', () => {
+        expect(isBeyondRetention('2026-2027', '2026-2027')).toBe(false);
+    });
+
+    it('keeps a future academic year', () => {
+        expect(isBeyondRetention('2027-2028', '2026-2027')).toBe(false);
+    });
+});
diff --git a/src/utils/academicYear.ts b/src/utils/academicYear.ts
new file mode 100644
index 00000000..799e6b9c
--- /dev/null
+++ b/src/utils/academicYear.ts
@@ -0,0 +1,38 @@
+import type { AcademicYear } from '../types';
+
+/**
+ * Month (1-indexed) a new academic year begins on. August matches the Dutch/EU
+ * convention: dates on or after 1 August belong to the year that starts then.
+ */
+export const ACADEMIC_YEAR_CUTOVER_MONTH = 8;
+
+/** The academic year a date falls in, as `YYYY-YYYY` (e.g. `'2026-2027'`). */
+export function getAcademicYear(date: Date = new Date(), cutoverMonth = ACADEMIC_YEAR_CUTOVER_MONTH): AcademicYear {
+    const year = date.getFullYear();
+    const startYear = date.getMonth() + 1 >= cutoverMonth ? year : year - 1;
+    return `${startYear}-${startYear + 1}`;
+}
+
+/** Start year of an `AcademicYear`, or NaN if it isn't in `YYYY-YYYY` form. */
+export function academicYearStart(ay: AcademicYear): number {
+    return Number.parseInt(ay.slice(0, 4), 10);
+}
+
+/** The academic year immediately before `ay` (e.g. `'2026-2027'` → `'2025-2026'`). */
+export function previousAcademicYear(ay: AcademicYear): AcademicYear {
+    const start = academicYearStart(ay) - 1;
+    return `${start}-${start + 1}`;
+}
+
+/** Negative if `a` starts before `b`, positive if after, 0 if the same year. */
+export function compareAcademicYear(a: AcademicYear, b: AcademicYear): number {
+    return academicYearStart(a) - academicYearStart(b);
+}
+
+/**
+ * Whether a scan stamped with `ay` is past the one-year retention cap relative to
+ * `current` — i.e. it belongs to any academic year before the current one.
+ */
+export function isBeyondRetention(ay: AcademicYear, current: AcademicYear = getAcademicYear()): boolean {
+    return compareAcademicYear(ay, current) < 0;
+}
diff --git a/src/utils/scanImport.ts b/src/utils/scanImport.ts
new file mode 100644
index 00000000..f0026abb
--- /dev/null
+++ b/src/utils/scanImport.ts
@@ -0,0 +1,131 @@
+/**
+ * Turns files a teacher picks (photos, or a scanned PDF) into one or more image blobs
+ * ready for OCR. Image files pass through as-is; PDFs are rendered page-by-page to
+ * images via pdfjs, since a scanned PDF has no text layer to extract. The bytes are
+ * handed to scanStore by the caller — nothing here touches storage or state.
+ */
+
+export interface ScanImage {
+    blob: Blob;
+    mimeType: string;
+    /** Originating file name, for display and provenance. */
+    sourceName: string;
+    /** 0-based page index when the source was a multi-page PDF. */
+    pageIndex?: number;
+}
+
+export interface SkippedFile {
+    name: string;
+    reason: string;
+}
+
+export interface ImportScanResult {
+    images: ScanImage[];
+    skipped: SkippedFile[];
+}
+
+export interface RasterizePdfOptions {
+    /** Render scale; higher = more detail for OCR at the cost of size. */
+    scale?: number;
+    mimeType?: string;
+    quality?: number;
+}
+
+export function isScannableImage(file: File): boolean {
+    return file.type.startsWith('image/');
+}
+
+export function isScannablePdf(file: File): boolean {
+    return file.type === 'application/pdf' || file.name.toLowerCase().endsWith('.pdf');
+}
+
+function canvasToBlob(canvas: HTMLCanvasElement, mimeType: string, quality?: number): Promise<Blob | null> {
+    return new Promise((resolve) => canvas.toBlob(resolve, mimeType, quality));
+}
+
+// Guardrails so a hostile or degenerate PDF can't exhaust memory before the caller
+// ever sees a failure. A page's canvas is allocated at width*height*4 bytes, so the
+// dimensions are checked from the viewport before any canvas is created.
+const MAX_PDF_PAGES = 200;
+const MAX_PAGE_PIXELS = 40_000_000;
+const MAX_TOTAL_PIXELS = 300_000_000;
+
+/**
+ * Render each page of a PDF to an image blob. Rejects (rather than silently dropping
+ * pages) on any per-page render failure so the caller reports the whole file as failed
+ * instead of returning a partial result. Always releases the pdf.js loading task.
+ */
+export async function rasterizePdf(file: File, opts: RasterizePdfOptions = {}): Promise<ScanImage[]> {
+    const { scale = 2, mimeType = 'image/png', quality } = opts;
+    if (!Number.isFinite(scale) || scale <= 0) {
+        throw new Error(`Invalid rasterization scale: ${scale}`);
+    }
+    const pdfjsLib = await import('pdfjs-dist');
+    pdfjsLib.GlobalWorkerOptions.workerSrc = new URL('pdfjs-dist/build/pdf.worker.min.mjs', import.meta.url).href;
+
+    const arrayBuffer = await file.arrayBuffer();
+    const loadingTask = pdfjsLib.getDocument({ data: arrayBuffer });
+    try {
+        const pdf = await loadingTask.promise;
+        if (pdf.numPages > MAX_PDF_PAGES) {
+            throw new Error(`PDF has too many pages (${pdf.numPages} > ${MAX_PDF_PAGES})`);
+        }
+
+        const images: ScanImage[] = [];
+        let totalPixels = 0;
+        for (let i = 1; i <= pdf.numPages; i++) {
+            const page = await pdf.getPage(i);
+            const viewport = page.getViewport({ scale });
+            const width = Math.ceil(viewport.width);
+            const height = Math.ceil(viewport.height);
+            const pagePixels = width * height;
+            if (!Number.isFinite(pagePixels) || pagePixels <= 0 || pagePixels > MAX_PAGE_PIXELS) {
+                throw new Error(`PDF page ${i} exceeds the pixel limit`);
+            }
+            totalPixels += pagePixels;
+            if (totalPixels > MAX_TOTAL_PIXELS) {
+                throw new Error('PDF exceeds the cumulative pixel limit');
+            }
+
+            const canvas = document.createElement('canvas');
+            canvas.width = width;
+            canvas.height = height;
+            const ctx = canvas.getContext('2d');
+            if (!ctx) throw new Error('Canvas 2D context unavailable');
+            await page.render({ canvas, canvasContext: ctx, viewport }).promise;
+            const blob = await canvasToBlob(canvas, mimeType, quality);
+            if (!blob) throw new Error('Canvas serialization returned no blob');
+            images.push({ blob, mimeType: blob.type || mimeType, sourceName: file.name, pageIndex: i - 1 });
+        }
+        return images;
+    } finally {
+        await loadingTask.destroy();
+    }
+}
+
+/** Convert a mixed set of picked files into scannable images, reporting anything unusable. */
+export async function importScanFiles(
+    files: FileList | File[],
+    opts: RasterizePdfOptions = {}
+): Promise<ImportScanResult> {
+    const images: ScanImage[] = [];
+    const skipped: SkippedFile[] = [];
+
+    for (const file of Array.from(files)) {
+        if (isScannableImage(file)) {
+            images.push({ blob: file, mimeType: file.type, sourceName: file.name });
+        } else if (isScannablePdf(file)) {
+            try {
+                const pages = await rasterizePdf(file, opts);
+                if (pages.length === 0) skipped.push({ name: file.name, reason: 'no-pages' });
+                images.push(...pages);
+            } catch {
+                skipped.push({ name: file.name, reason: 'pdf-render-failed' });
+            }
+        } else {
+            skipped.push({ name: file.name, reason: 'unsupported-type' });
+        }
+    }
+
+    return { images, skipped };
+}
diff --git a/src/utils/scanSettings.test.ts b/src/utils/scanSettings.test.ts
new file mode 100644
index 00000000..9d7ea28f
--- /dev/null
+++ b/src/utils/scanSettings.test.ts
@@ -0,0 +1,25 @@
+import { describe, it, expect } from 'vitest';
+import { DEFAULT_SCAN_OCR_SETTINGS, resolveScanOcrSettings } from './scanSettings';
+
+describe('resolveScanOcrSettings', () => {
+    it('returns the defaults when nothing is stored', () => {
+        expect(resolveScanOcrSettings()).toEqual(DEFAULT_SCAN_OCR_SETTINGS);
+        expect(resolveScanOcrSettings(undefined)).toEqual(DEFAULT_SCAN_OCR_SETTINGS);
+    });
+
+    it('defaults to the privacy-preserving discard-after-OCR choice', () => {
+        expect(resolveScanOcrSettings().keepImage).toBe(false);
+    });
+
+    it('overlays stored values over the defaults', () => {
+        expect(resolveScanOcrSettings({ keepImage: true })).toEqual({
+            keepImage: true,
+            defaultLang: 'eng',
+        });
+    });
+
+    it('does not mutate the shared defaults object', () => {
+        resolveScanOcrSettings({ defaultLang: 'nld' });
+        expect(DEFAULT_SCAN_OCR_SETTINGS.defaultLang).toBe('eng');
+    });
+});
diff --git a/src/utils/scanSettings.ts b/src/utils/scanSettings.ts
new file mode 100644
index 00000000..74360c9b
--- /dev/null
+++ b/src/utils/scanSettings.ts
@@ -0,0 +1,11 @@
+import type { ScanOcrSettings } from '../types';
+
+/** Safe defaults for the scan-and-OCR settings slice: discard the image, English OCR. */
+export const DEFAULT_SCAN_OCR_SETTINGS: ScanOcrSettings = {
+    keepImage: false,
+    defaultLang: 'eng',
+};
+
+export function resolveScanOcrSettings(stored?: Partial<ScanOcrSettings>): ScanOcrSettings {
+    return { ...DEFAULT_SCAN_OCR_SETTINGS, ...stored };
+}