# EDU-014 — Extended student and secondary learning waves

- **Status:** partial implementation; bounded representative wave delivered
- **Type:** family disposition plus executable vertical slices
- **Phase:** 5
- **Migration:** `V4160__add_bounded_learning_wave.sql`

## Delivered bounded wave

| Family | Target owner / reused public capability | Data and API disposition | Priority | Verification disposition |
|---|---|---|---|---|
| Auth compatibility and phone/OAuth binding | Member + System auth APIs | **Replaced/reused.** Education does not copy credentials, sessions, phone binding, or OAuth state. Existing Member login remains the student entry point. Legacy auth data requires a separate identity migration, outside V4160. | Reuse now | Existing auth tests; no EDU-014 schema |
| Profile and education profile extensions | Member owns generic profile; Education owns learning projections | **Partially migrated.** Learning summary is Education-owned and exposes aggregate counts only. New generic profile fields are deferred. | P1 bounded | Summary service/API tests and tenant isolation |
| Vocabulary learning/review | Education | **Migrated for new writes.** Tenant/student/key progress and deterministic review scheduling are delivered. Legacy vocabulary history is retained at source pending an explicit import mapping; no silent import. | P1 | State, due-review, validation, tenant isolation |
| Scoreline and admissions content | Education catalog, when selected | **Deferred.** No safe authoritative dataset or freshness contract is established. Existing legacy data is retained read-only; no endpoint compatibility is claimed. | P2 | Retirement/defer compatibility contract only |
| Video entitlement and progress | Entitlement owner unresolved; media delivery outside Education | **Explicitly retired from this wave.** No video endpoint, token, progress write, or metadata-based access bypass is added. Legacy video/progress data is retained until an entitlement-led child slice defines import and deletion policy. | P3 blocked | Capability manifest must expose no video interface |
| Recommendation and AI generation | AI public services plus Education authorization | **Explicitly deferred.** No student profile or learning history is sent to AI, and no AI recommendation endpoint is exposed. Legacy recommendation data remains retained but non-authoritative. | P3 blocked | Capability manifest must expose no AI interface |
| Notifications and reminders | Education schedule + System `NotifyMessageSendApi` | **Migrated for exam reminders.** Education owns claim/retry state; System owns message rendering/storage. A stable `education_exam_reminder` template is conditionally seeded. | P1 | Due claim, retry, tenant context, notify-port tests |
| Points, badges, check-ins, feedback, exam countdowns | Education orchestration + Member `MemberPointApi`; feedback/reminders Education | **Partially migrated.** Fixed server-side learning awards, one badge family, feedback, and exam reminder/countdown data are delivered. Generic check-in/task exchange remains Member-owned/deferred. | P1 bounded | Duplicate award, fixed-value, port failure, feedback ownership |
| Learning analytics, leaderboard, trends, reports | Education projections over immutable reports/vocabulary/awards | **Partially migrated.** Own summary and bounded tenant leaderboard are delivered. Leaderboard is anonymized and contains no user IDs or report details. Trend/export surfaces are deferred. | P1 bounded | Tenant isolation, deterministic ranking, redaction |

## Executable APIs

Student identity and tenant are always derived from the authenticated context; no API accepts `userId` or `tenantId`.

- Vocabulary progress/review: `/app-api/education/vocabulary/*`
- Exam reminder create/list/cancel: `/app-api/education/exam-reminders`
- Student feedback: `/app-api/education/learning/feedback`
- Learning award orchestration: `/app-api/education/learning/awards`
- Own learning summary: `/app-api/education/learning/summary`
- Anonymous tenant leaderboard: `/app-api/education/learning/leaderboard`
- Scheduled dispatch bean: `examReminderSendJob` using System Notify public API

## Security and reversibility

- All Education state is tenant-owned and uses explicit tenant/user predicates in addition to framework interception.
- Client requests cannot choose point values, badge codes, notify templates, delivery users, or leaderboard tenant.
- Award rows and reminder rows are durable retry authorities; cross-module tables are never written directly by Education application code.
- Leaderboard output uses deterministic tenant-local aliases and aggregate score only. No phone, profile, member ID, answer, explanation, feedback content, or report detail is exported.
- Rollback disables/removes executable application paths while retaining V4160 data. Destructive rollback is not provided; later correction uses a higher forward migration.
- Video and AI remain fail-closed: this wave exposes no executable interface and establishes no entitlement through access metadata.

## Acceptance evidence required before production rollout

- Focused unit/controller tests for each delivered family.
- Real PostgreSQL Flyway migration and tenant-isolation tests.
- Compile and migration packaging verification.
- Operational creation of the Quartz schedule for `examReminderSendJob`; V4160 provides state/template, not an environment-specific cron row.