# Current State

> Phase 0 static assessment originally generated on 2026-07-29. Updated on 2026-07-31 after bounded implementation through V4180, full Education tests against disposable PostgreSQL, server compilation, and the student harness.

## Current implementation summary

The target branch now contains the complete student core loop, tenant/identity enforcement, module-owned PostgreSQL Flyway migrations V4010–V4200, bounded tenant content authoring, import job and asset contracts, class/invitation relationships, education entitlement bindings, a representative extended-learning wave, and operational dependency/health contracts. The full Education suite passed against disposable PostgreSQL (596 tests), the server reactor compiled successfully, and the fixture-based student harness passed six browser flows. These tests executed the module-owned Flyway chain in isolated disposable test schemas; they are not evidence that a shared Pilot or production database was migrated. Production deployment, real Pilot data, production scanner/parser adapters, automatic Mall/Pay/CRM fulfillment events, and selected deferred learning families remain outside the verified implementation.

This document retains the original Phase 0 findings below as provenance. Current ticket status is authoritative in [`issues/README.md`](issues/README.md), and rollout evidence is tracked by [`../pilot-acceptance-runbook.md`](../pilot-acceptance-runbook.md).

## Original Phase 0 executive summary

Verified evidence showed the target on `feature/education-core-loop` with a heavily dirty worktree, while the source checkout had no local or remote branch with that name and remained at `033701a`. The assessment identified a meaningful committed core-loop slice plus substantial provider/catalog/session work that still required classification. It selected provider-neutral fail-closed question handling, tenant/principal enforcement, atomic idempotency, PostgreSQL/Flyway takeover, and catalog graph integrity as the immediate blockers. Those bounded blockers have since been implemented and verified; this paragraph is retained only as historical context.

## Original Phase 0 decisions and unknowns

The remaining sections are the immutable investigation record from 2026-07-29. Items phrased as pending may now be resolved by later tickets and migrations; use the current summary and ticket index above for delivery status.

### Decisions recorded during Phase 0

- Verified source provenance is limited: /Users/tiku1/code/tiku-backend has only main and origin/main at 033701a785c7012139e7f86995eea6041225592e; no local or remote feature/education-core-loop ref exists. Use main/033701a provisionally only, or obtain explicit approval for that baseline.
- Verified target branch is feature/education-core-loop and its worktree is dirty. Current read-only inventory reports 65 modified tracked files and 97 untracked entries; preserve all, and do not rely on an older 21-untracked count.
- Classify target behavior as committed-and-tested, committed-but-not-runtime-verified, dirty/uncommitted, or absent before scheduling work. ce02f8a is committed core-loop evidence; native provider/catalog and much of the schema are dirty.
- Verified V4010 is SELECT 1 and V4020 is native catalog only. Practice/report/idempotency/wrong/favorite DDL in sql/postgresql/education is untracked/manual and not proven active Flyway. Convert required DDL to immutable module-owned PostgreSQL Flyway migrations before claiming schema delivery; never modify published migrations.
- Keep PostgreSQL/Flyway as the only new schema delivery mechanism. Historical MySQL files and root SQL are not active delivery unless explicitly labeled archival/manual and removed from operational runbooks.
- Treat public tenant resolution origin-binding absence as a P0 correction, not merely a richer-legacy gap. Separately acknowledge that TenantSecurityWebFilter already rejects authenticated tenant/header mismatch; the remaining principal issue is missing Member/UserType enforcement in /education/context.
- Treat hostname port handling as a verified internal contradiction requiring alignment across implementation, properties, API documentation, System lookup normalization, and tests.
- Treat native catalog isolation as an intentional TenantUtils.executeIgnore/manual-scope boundary, not evidence of a current leak. Make mapper audit and tenant/scope-consistent graph constraints concrete blockers before authoring.
- Make the first slice provider-neutral or cover both providers because SCALAR_READ is the verified default and Java provider is conditional. The slice must include fresh browsing and persisted session restoration, with a common option-schema contract and fail-closed behavior.
- Do not treat submit idempotency as complete: check-then-insert is not an atomic claim. Reserve keys atomically and define crash recovery before the submit slice.
- Add first-class Auth/Profile/extended Learning, tenant appearance/integrations/secrets/codes, and granular platform-admin capability groups so every required legacy cluster has a disposition.
- Do not expose paid/private practice until entitlement semantics and public target contracts are decided.
- No tests, builds, PostgreSQL connections, Flyway execution, or runtime verification were performed; all conclusions are static repository evidence unless explicitly marked otherwise.

### Unknowns recorded during Phase 0

- EDU-003 decided the public resolver threat model and contract. Browser headers are forgeable context claims; a constrained Public Tenant Handle supports headless clients; success discloses tenant existence; unknown/disabled/expired failures are identical; exact errors, canonical websites, local activation, Member-only context, and abuse controls are assigned to EDU-004.
- Whether a future System-owned immutable Tenant Code or authenticated/signed locator is required beyond the accepted public-handle contract.
- The valid option schema for each question type, including whether absent options are legal; whether malformed published content is omitted or produces a controlled source failure.
- Whether PUBLIC tenant_id=0 rows may reference only PUBLIC parents, whether tenant-owned rows may reference global rows, and the precise composite constraint/trigger strategy.
- Whether untracked /Users/tiku1/code/ruoyi-vue-pro/sql/postgresql/education files are intended for promotion into Flyway or are design/manual artifacts.
- Whether V4010/V4020 or any manual core-loop DDL has ever run successfully in PostgreSQL; no runtime migration evidence exists.
- Whether target test H2 MODE=MYSQL is test-only and compatible with PostgreSQL-only delivery.
- Which Auth/Profile/extended Learning semantics are replaced by Member/System/Infra versus Education-owned, including vocabulary, leaderboard, stats, trend, feedback, exam dates, notifications, points, and badges.
- Whether tenant appearance, domains, payment accounts, auth providers, secrets, activation codes, coupons, integrations, marketing, public-bank grants, and sync are in scope or explicitly retired.
- Whether legacy assets are migrated, re-uploaded, re-scanned, or retired, and who owns ClamAV/scanner integration.
- Which legacy RLS, triggers, functions, grants, seeds, queue leases, retry behavior, and operational semantics are contractual and need Java/constraint/event/job reproduction.
- Whether the ten required Phase 0 artifacts must be committed files or may remain in reviewed scratch form during discovery.