docs(education): record migration closure evidence

This commit is contained in:
2026-07-31 16:26:39 +08:00
parent 184452404d
commit c8a221acbc
13 changed files with 77 additions and 49 deletions

View File

@@ -35,6 +35,7 @@ Student identity and tenant are always derived from the authenticated context; n
- All Education state is tenant-owned and uses explicit tenant/user predicates in addition to framework interception.
- Client requests cannot choose point values, badge codes, notify templates, delivery users, or leaderboard tenant.
- Exam reminder delivery uses a token-fenced, expiring database claim. An interrupted `SENDING` row is reclaimed after lease expiry, attempts are bounded, and exhausted claims become observable `FAILED` rows through V4200.
- Award rows and reminder rows are durable retry authorities; cross-module tables are never written directly by Education application code.
- Leaderboard output uses deterministic tenant-local aliases and aggregate score only. No phone, profile, member ID, answer, explanation, feedback content, or report detail is exported.
- Rollback disables/removes executable application paths while retaining V4160 data. Destructive rollback is not provided; later correction uses a higher forward migration.