ruoyi-vue-pro/docs/education/migration/issues/EDU-014-extended-learning.md

EDU-014 — Extended student and secondary learning waves

• Status: partial implementation; bounded representative wave delivered
• Type: family disposition plus executable vertical slices
• Phase: 5
• Migration: V4160__add_bounded_learning_wave.sql

Delivered bounded wave

Family	Target owner / reused public capability	Data and API disposition	Priority	Verification disposition
Auth compatibility and phone/OAuth binding	Member + System auth APIs	Replaced/reused. Education does not copy credentials, sessions, phone binding, or OAuth state. Existing Member login remains the student entry point. Legacy auth data requires a separate identity migration, outside V4160.	Reuse now	Existing auth tests; no EDU-014 schema
Profile and education profile extensions	Member owns generic profile; Education owns learning projections	Partially migrated. Learning summary is Education-owned and exposes aggregate counts only. New generic profile fields are deferred.	P1 bounded	Summary service/API tests and tenant isolation
Vocabulary learning/review	Education	Migrated for new writes. Tenant/student/key progress and deterministic review scheduling are delivered. Legacy vocabulary history is retained at source pending an explicit import mapping; no silent import.	P1	State, due-review, validation, tenant isolation
Scoreline and admissions content	Education catalog, when selected	Deferred. No safe authoritative dataset or freshness contract is established. Existing legacy data is retained read-only; no endpoint compatibility is claimed.	P2	Retirement/defer compatibility contract only
Video entitlement and progress	Entitlement owner unresolved; media delivery outside Education	Explicitly retired from this wave. No video endpoint, token, progress write, or metadata-based access bypass is added. Legacy video/progress data is retained until an entitlement-led child slice defines import and deletion policy.	P3 blocked	Capability manifest must expose no video interface
Recommendation and AI generation	AI public services plus Education authorization	Explicitly deferred. No student profile or learning history is sent to AI, and no AI recommendation endpoint is exposed. Legacy recommendation data remains retained but non-authoritative.	P3 blocked	Capability manifest must expose no AI interface
Notifications and reminders	Education schedule + System NotifyMessageSendApi	Migrated for exam reminders. Education owns claim/retry state; System owns message rendering/storage. A stable education_exam_reminder template is conditionally seeded.	P1	Due claim, retry, tenant context, notify-port tests
Points, badges, check-ins, feedback, exam countdowns	Education orchestration + Member MemberPointApi; feedback/reminders Education	Partially migrated. Fixed server-side learning awards, one badge family, feedback, and exam reminder/countdown data are delivered. Generic check-in/task exchange remains Member-owned/deferred.	P1 bounded	Duplicate award, fixed-value, port failure, feedback ownership
Learning analytics, leaderboard, trends, reports	Education projections over immutable reports/vocabulary/awards	Partially migrated. Own summary and bounded tenant leaderboard are delivered. Leaderboard is anonymized and contains no user IDs or report details. Trend/export surfaces are deferred.	P1 bounded	Tenant isolation, deterministic ranking, redaction

Executable APIs

Student identity and tenant are always derived from the authenticated context; no API accepts userId or tenantId.

• Vocabulary progress/review: /app-api/education/vocabulary/*
• Exam reminder create/list/cancel: /app-api/education/exam-reminders
• Student feedback: /app-api/education/learning/feedback
• Learning award orchestration: /app-api/education/learning/awards
• Own learning summary: /app-api/education/learning/summary
• Anonymous tenant leaderboard: /app-api/education/learning/leaderboard
• Scheduled dispatch bean: examReminderSendJob using System Notify public API

Security and reversibility

• All Education state is tenant-owned and uses explicit tenant/user predicates in addition to framework interception.
• Client requests cannot choose point values, badge codes, notify templates, delivery users, or leaderboard tenant.
• Exam reminder delivery uses a token-fenced, expiring database claim. An interrupted SENDING row is reclaimed after lease expiry, attempts are bounded, and exhausted claims become observable FAILED rows through V4200.
• Award rows and reminder rows are durable retry authorities; cross-module tables are never written directly by Education application code.
• Leaderboard output uses deterministic tenant-local aliases and aggregate score only. No phone, profile, member ID, answer, explanation, feedback content, or report detail is exported.
• Rollback disables/removes executable application paths while retaining V4160 data. Destructive rollback is not provided; later correction uses a higher forward migration.
• Video and AI remain fail-closed: this wave exposes no executable interface and establishes no entitlement through access metadata.

Acceptance evidence required before production rollout

• Focused unit/controller tests for each delivered family.
• Real PostgreSQL Flyway migration and tenant-isolation tests.
• Compile and migration packaging verification.
• Operational creation of the Quartz schedule for examReminderSendJob; V4160 provides state/template, not an environment-specific cron row.