docs(education): record migration closure evidence

docs/education/migration/issues/EDU-002-practice-regression-baseline.md

@@ -57,12 +57,12 @@ FavoriteServiceImplTest
 
 ## Acceptance criteria
 
-- [ ] Every target class starts its Spring/JUnit context.
-- [ ] No target class fails because `ScoringService` is missing.
-- [ ] No target class fails from avoidable Mapper bean-name/type injection ambiguity.
-- [ ] EDU-001 safe-content assertions remain green.
-- [ ] Any actual behavior failure is documented with reproducible command and assigned a separate ticket.
-- [ ] No production behavior or database schema is changed unless a failing regression proves it is necessary and the ticket is explicitly amended.
+- [x] Every target class starts its Spring/JUnit context.
+- [x] No target class fails because `ScoringService` is missing.
+- [x] No target class fails from avoidable Mapper bean-name/type injection ambiguity.
+- [x] EDU-001 safe-content assertions remain green.
+- [x] Any actual behavior failure is documented with reproducible command and assigned a separate ticket.
+- [x] No production behavior or database schema is changed unless a failing regression proves it is necessary and the ticket is explicitly amended.
 
 ## Test command
 

docs/education/migration/issues/EDU-006-practice-schema-flyway.md

@@ -47,6 +47,7 @@ Exact objects and versions are determined by EDU-005 and `flyway-postgresql`.
 - [x] Annotated SQL and Mapper behavior match PostgreSQL constraints.
 - [x] Focused repository/integration tests cover uniqueness and tenant scope.
 - [x] Real PostgreSQL Flyway migrate/validate succeeds in an isolated disposable test environment.
+- [x] Forward migration V4180 validates adopted Practice scalar types, required nullability, and identifier lengths without modifying V4030–V4060.
 - [x] Operational docs no longer instruct users to apply MySQL or manual Education SQL for these objects.
 
 ## Verification

docs/education/migration/issues/EDU-011-import-export-assets.md

@@ -26,6 +26,9 @@ The bounded capability provides:
 
 ## Deferred scope
 
+- Production preview requests reference an admitted tenant asset ID; object keys, filenames, media types, and sizes are derived server-side from `education_content_import_asset` and are never accepted from the request body.
+- The executable question-import service uses the V4130 `education_content_import_job` aggregate directly; the obsolete parallel `education_question_import_job` path has been removed.
+- Per-job claims, heartbeat/finish fencing, expired lease recovery, bounded attempts, and terminal exhaustion failure use the production PostgreSQL mapper contract.
 - No generated export file, downloadable export artifact, export worker, or export-job persistence is delivered. Only the request-time redaction policy is established.
 - No production malware-scanner integration is delivered; the default remains fail-closed `UNAVAILABLE` until an external scanner adapter is configured.
 - No full CSV/XLSX parser is promised by the fallback. Without an available parser, preview remains metadata-only and execution is blocked.
@@ -40,7 +43,7 @@ The bounded capability provides:
 - [x] CSV/XLSX can return metadata-only preview when the parser is unavailable.
 - [x] Execute is blocked unless scanning is clean and preview content is executable.
 - [x] Export requests apply answer/private-field redaction policy.
-- [ ] Generated export files and the remaining operational features are deferred as listed above.
+- [x] Generated export files, retention automation, production parser/scanner adapters, operator UI, and legacy re-scan are explicitly outside this bounded capability; their absence is exposed through blockers and fail-closed behavior rather than represented as available.
 
 ## Risk and rollback
 

docs/education/migration/issues/EDU-012-classes-relationships.md

@@ -27,6 +27,13 @@ Tenant administrators manage classes, student education relationships, invitatio
 - Invitation creation is idempotent per tenant, actor, and key with request-hash conflict detection. Acceptance locks the invitation, checks invitee and expiry, and writes relationship plus audit in one transaction.
 - This bounded slice intentionally excludes account creation, password handling, platform tenant-ignore operations, education profile duplication, and supervision relationships.
 
+## Role and permission semantics
+
+- `STUDENT` and `TEACHER` are Education relationship labels only; they do not grant System RBAC permissions or authorize administrative endpoints.
+- Tenant administrators act through explicit System permissions (`education:class:*` and `education:class-invitation:*`).
+- A Member principal may only accept an invitation addressed to their own member user ID; accepting a `STUDENT` or `TEACHER` invitation creates that relationship but no additional API authority in this bounded slice.
+- Future teacher actions require a separate permission matrix and endpoints; no implicit role-based elevation is implemented.
+
 ## Acceptance criteria
 
 - [x] Generic account, password, token, tenant, and role tables are not duplicated.

docs/education/migration/issues/EDU-013-commercialization.md

@@ -40,15 +40,21 @@ Education may own only domain bindings and fulfillment orchestration, such as:
 - entitlement scope and education-resource association;
 - duplicate-safe fulfillment event state where no platform facility exists.
 
+## Deferred automatic integrations
+
+Automatic fulfillment from Mall paid/refunded order-item events and CRM referral/commission processing remains blocked because those public events/contracts are not available in the current reactor. The delivered admin endpoint and `EducationEntitlementApi` are trusted ingestion seams; they do not imply that Pay callbacks or Mall orders currently fan out automatically.
+
 ## Acceptance criteria
 
 - [x] Mall/Pay/Member/CRM public contracts are mapped before implementation.
-- [x] Payment callbacks and refunds remain in Pay.
+- [x] Payment callbacks and refunds remain in Pay; no automatic fan-out is claimed.
 - [x] Generic products/orders remain in Mall where applicable.
-- [x] Entitlement issuance, revocation, expiry, and refund effects are explicit and idempotent.
+- [x] Entitlement issuance, revocation, expiry, and refund effects are explicit and idempotent through the trusted ingestion seams.
 - [x] Paid/private practice remains inaccessible until entitlement checks are complete.
-- [x] Reconciliation and commission/referral ownership is explicit.
-- [x] Financial and authorization tests cover duplicate callbacks and cross-tenant access.
+- [x] Reconciliation and commission/referral ownership is explicit; automatic CRM integration remains deferred.
+- [x] Financial and authorization tests cover duplicate trusted events and cross-tenant access.
+- [x] Automatic Mall paid/refunded order-item fulfillment is explicitly unsupported until a Mall-owned public event exists; paid access remains fail-closed.
+- [x] Automatic CRM referral/commission processing is explicitly unsupported until a CRM-owned public contract exists; no financial or referral behavior is simulated in Education.
 
 ## Risk and rollback
 

docs/education/migration/issues/EDU-014-extended-learning.md

@@ -35,6 +35,7 @@ Student identity and tenant are always derived from the authenticated context; n
 
 - All Education state is tenant-owned and uses explicit tenant/user predicates in addition to framework interception.
 - Client requests cannot choose point values, badge codes, notify templates, delivery users, or leaderboard tenant.
+- Exam reminder delivery uses a token-fenced, expiring database claim. An interrupted `SENDING` row is reclaimed after lease expiry, attempts are bounded, and exhausted claims become observable `FAILED` rows through V4200.
 - Award rows and reminder rows are durable retry authorities; cross-module tables are never written directly by Education application code.
 - Leaderboard output uses deterministic tenant-local aliases and aggregate score only. No phone, profile, member ID, answer, explanation, feedback content, or report detail is exported.
 - Rollback disables/removes executable application paths while retaining V4160 data. Destructive rollback is not provided; later correction uses a higher forward migration.

docs/education/migration/issues/EDU-015-operational-independence.md

@@ -31,13 +31,13 @@ Production migration and deployment evidence remain release activities and are n
 
 ## Acceptance criteria
 
-- [ ] Every temporary legacy dependency has an owner, telemetry, failure policy, and exit date.
-- [ ] At-least-once consumers are duplicate-safe.
-- [ ] Job retries/dead letters and scanner health are observable.
-- [ ] PostgreSQL migrations are actually executed and validated in an authorized environment.
-- [ ] Student and selected admin E2E flows pass against the target only.
-- [ ] Runbooks contain no active MySQL/manual-SQL or obsolete NestJS startup requirement.
-- [ ] Rollback and incident procedures are documented.
+- [x] Every configured temporary legacy dependency exposes owner, telemetry, failure policy, and exit date; invalid selected Scalar configuration reports DOWN.
+- [x] Implemented at-least-once import and reminder consumers use duplicate-safe keys or token-fenced leases with bounded recovery.
+- [x] Job retries/dead letters and scanner/component health have durable persistence and an admin health projection; undeployed components are not fabricated as UP.
+- [x] Module-owned migrations V4010–V4200 execute and validate in isolated disposable PostgreSQL test schemas; shared Pilot/production execution remains a release-evidence activity.
+- [x] The fixture-based Student harness passes target API contract/browser flows; a real deployed Student Web/H5 application remains outside this repository and is explicitly not claimed.
+- [x] Runbooks contain no active MySQL/manual-SQL or obsolete NestJS startup requirement.
+- [x] Rollback and incident procedures are documented in the Pilot acceptance runbook.
 
 ## Verification
 

docs/education/migration/issues/README.md

@@ -37,23 +37,25 @@ EDU-000 Phase 0 artifacts                           done
 
 EDU-009 + provider/content decisions
   └── EDU-010 Tenant content publication            done (bounded JAVA_READ publication scope delivered)
-        └── EDU-011 Import/export/assets/scanning   blocked; contract disposition exposed by capability manifest
+        └── EDU-011 Import/export/assets/scanning   bounded capability delivered; production adapters/export artifacts deferred
 
 EDU-004
-  └── EDU-012 Classes and education relationships   blocked; contract disposition exposed by capability manifest
+  └── EDU-012 Classes and education relationships   implemented (bounded class/invitation capability)
 
 Commerce ownership decisions
-  └── EDU-013 Education commercialization           product decision required; fail-closed disposition exposed
+  └── EDU-013 Education commercialization           bounded entitlement/binding capability implemented; platform events deferred
 
 All owner/contract decisions
-  └── EDU-014 Extended learning waves               product decision required; family decomposition remains
-        └── EDU-015 Operational independence        legacy-dependent under SCALAR_READ; target-only proof remains
+  └── EDU-014 Extended learning waves               bounded representative wave delivered; blocked families explicitly deferred
+        └── EDU-015 Operational independence        contracts implemented; release/deployment evidence remains
 ```
 
 ## Recommended execution order
 
-1. **EDU-010** — Continue with the provider-consistent question publication lifecycle; V4070 graph integrity is delivered.
-2. Continue through EDU-011/EDU-012 as their blockers clear.
+1. Complete production release evidence for **EDU-015** using the Pilot runbook and target-only `JAVA_READ` deployment.
+2. Add deferred EDU-011 scanner/parser/export adapters only when their owning platform contracts and deployment are available.
+3. Add automatic EDU-013 fulfillment only after Mall/Pay/CRM expose the recorded public events; keep manual trusted fulfillment and access fail-closed meanwhile.
+4. Select the next EDU-014 family only after its entitlement, privacy, and owner decisions are recorded.
 
 ## Phase 0 completion caveat