ruoyi-vue-pro/docs/education/migration/04-module-reuse-map.md

# Module Reuse Map

> Phase 0 static assessment generated on 2026-07-29. No build, test, application startup, PostgreSQL connection, or Flyway migration was executed during this assessment.

> Runtime reuse update 2026-08-01: EDU-027 activates Mall Trade order/cart/config, EDU-028 reuses native Promotion Discount/Reward, EDU-029 reuses delivery, EDU-030 reuses after-sale/Pay Refund, and EDU-031 reuses native Trade brokerage. EDU-032 reuses native Promotion Seckill; EDU-033 reuses native Combination app/admin controllers, services, mappers, jobs, Product/Member lookups, group lifecycle, Trade Order bridge, RBAC, and corrected Vben pages while supplying tenant-safe PostgreSQL persistence. Education owns no duplicate commerce, promotion, delivery, refund, commission, stock, or group aggregate.

Education must call public APIs, framework extension points, or events. It must not depend on another module's internal ServiceImpl, Mapper, or DO.

## Tenant resolution, identity, and student context

- **Target owner:** System + Member + framework tenant support with an Education context adapter
- **Public/framework capability to reuse:** System TenantCommonApi/TenantApiImpl, TenantContextHolder, TenantSecurityWebFilter, Member/System authentication and UserTypeEnum, framework tenant injection and tenant-ignore only for explicitly authorized platform operations.
- **Education-owned gap:** Verified: EducationTenantController accepts caller-supplied hostname or tenantName under @PermitAll and does not enforce the source resolver's production Origin/Referer/request-host binding. Verified: TenantSecurityWebFilter already rejects authenticated LoginUser/request-tenant mismatches and requires a tenant on non-ignored URLs. Verified: EducationContextController checks login presence and tenant validity but not LoginUser.userType. Verified: hostname documentation says no port while implementation preserves legal ports and tests expect port preservation. Inference: arbitrary tenant discovery, admin-principal acceptance, and port inconsistency are P0/P1 trust-boundary risks until policy is fixed.
- **Allowed external-module change:** System/framework tenant and security boundaries remain authoritative; Education should only adapt them. A generic tenant lookup contract and possibly Member-only context policy require explicit decisions.

## Student core learning loop

- **Target owner:** Education
- **Public/framework capability to reuse:** Education provider/adapter boundary, Member/System identity, database uniqueness and transactions, framework locks/idempotency only as supplements—not replacements—for atomic database claims.
- **Education-owned gap:** Verified: commit ce02f8a contains committed access/core controllers, safe projections, and focused tests, while native provider/catalog and additional core-loop work are dirty; these statuses must be separated. Verified: native and Scalar providers disagree on malformed/absent options; QuestionCatalogService and SessionResponseAssembler can emit apparently valid empty options. Verified: submit idempotency performs check-then-insert rather than atomic initial reservation. Inference: core-loop completion and concurrency guarantees are not established.
- **Allowed external-module change:** Education owns education-domain state and orchestration; Member/System context is reused. Paid/private access remains blocked on an entitlement decision.

## Education catalog and question content

- **Target owner:** Education
- **Public/framework capability to reuse:** Education Provider boundary, explicit CatalogScopeQuery, framework tenant context, Infra File public API for future assets.
- **Education-owned gap:** Verified: current native reads intentionally run inside TenantUtils.executeIgnore and apply explicit scope predicates; this is a controlled manual-isolation boundary, not proof of a current leak. Verified: V4020 uses ordinary single-column foreign keys, so tenant-owned/public graph consistency is not enforced. Inference: every mapper needs audit and content admission needs composite constraints or equivalent enforcement.
- **Allowed external-module change:** Education owns domain reads; Infra File may later provide asset transport. No provider expansion should occur before provider authority and graph-integrity rules are decided.

## Auth, student profile, and extended learning

- **Target owner:** Member + System + Education, with Infra composition
- **Public/framework capability to reuse:** Member/System auth and profile primitives, System/Infra notifications, Member points/levels where semantics match, Education-specific projections and authorization.
- **Education-owned gap:** Verified source inventory shows these are distinct required Phase 0 domains, not merely generic context or secondary engagement. Target ownership and compatibility are not established. Inference: the definition-of-done is unsupported until each endpoint/state family is classified.
- **Allowed external-module change:** Member/System own authentication and generic membership; Education owns education-specific profile/progress projections. System/Infra may own notifications, while product owners must decide points, badges, feedback, exams, and vocabulary ownership.

## Tenant education operations, appearance, integrations, secrets, and codes

- **Target owner:** Education + System + Member + Mall/Pay + Infra
- **Public/framework capability to reuse:** System Tenant/RBAC/DataPermission/AdminUserApi, Member relationships, Mall/Pay/Member APIs, Infra secret/file/message/audit facilities.
- **Education-owned gap:** V4290 owns presentation extensions. V4300–V4380 expose and activate native Pay/System/Product/Promotion administration without Education shadow ledgers. V4390–V4430 activate native Trade order core, Discount/Reward checkout dependencies, delivery, after-sale, and brokerage; V4440 activates native Seckill and V4450 activates native Combination activity, SKU pricing, group records, capacity protection, and Trade bridge with their real APIs/services and existing pages. Education adds no financial, product, coupon, cart, order, promotion, delivery, refund, commission, stock, or group ledger. V4310 adds only activation-code state and composes Mall-owned SPU binding, Member authentication, and the existing entitlement event. Explicit legacy product/code-coupon/order/refund/referral/settlement-proof import, Bargain/Point and other Promotion families, production bulk export/runbooks and reviewed wallet opening balances, non-equivalent provider/mode replacement, automatic fulfillment/refund revocation, and legacy activation-code import remain unhandled; global System SMS Channel cannot satisfy per-tenant PNVS. Infra/private generic secrets remain separate gaps.
- **Allowed external-module change:** System RBAC/DataPermission and tenant configuration are reused; Mall owns products/coupons/promotions/orders, Pay owns payment, Member owns principals, and Infra owns secrets/messaging/files. Education owns learning relationships/configuration, activation-code credentials, and access orchestration without duplicating those platform ledgers.

## Platform administration and governance

- **Target owner:** System + Pay + Mall + Infra + CRM with Education extensions
- **Public/framework capability to reuse:** System RBAC/DataPermission/AdminUserApi, authorized tenant-ignore mechanisms, Pay/Mall/Infra/CRM public APIs, audit/logging.
- **Education-owned gap:** Verified source surface is broader than one aggregated platform-admin row. Target seams exist, but object-level ownership, data scopes, and cross-tenant operation policy remain incomplete.
- **Allowed external-module change:** System, Pay, Mall, Infra, CRM, and Education-specific extension permissions; Education must not duplicate platform ledgers or generic administration.

## Commercialization and growth

- **Target owner:** Mall + Pay + Member + CRM with Education binding
- **Public/framework capability to reuse:** Mall/Pay DTO APIs, Member identity/entitlement/points, CRM services, Infra Job/MQ/audit.
- **Education-owned gap:** Bounded resource binding, entitlement issuance/revocation, activation-code redemption, native Pay ledgers/import, native Product/Coupon, and V4390–V4450 Trade order/checkout/delivery/after-sale/brokerage/Seckill/Combination persistence/admin are proven. Legacy display-only Product, incompatible code campaigns, aggregate orders/refunds, and UUID referral/settlement/proof objects are not imported; the source has no seckill or group-buying state to import, and its combination-question token remains Education content. Bargain/Point and other Promotion families, production bulk migration and reviewed balances remain open, and successful native Pay/Trade events are not yet composed into automatic Education fulfillment or refund revocation. Native two-level commission, Seckill stock isolation, and Combination capacity isolation are proven, but source CRM referral, proof/export, dunning, and settlement equivalence remain unproven. One prior evidence path was malformed; corrected source location is /Users/tiku1/code/tiku-backend/apps/api/src/nest/commerce-reconciliation.module.ts.
- **Allowed external-module change:** Mall Trade/Product/Promotion, Pay, Member entitlement/points, CRM, Infra jobs/events/audit; Education owns product-to-education bindings and fulfillment orchestration only.

## Background processing, assets, and operational platform

- **Target owner:** Infra platform plus owning domain modules
- **Public/framework capability to reuse:** Public Infra File APIs and framework tenant context; generic locks, logging, tracing, and scheduling remain platform capabilities when exposed through public contracts.
- **Education-owned delivered scope:** EDU-011 owns tenant import asset metadata and import jobs, including the five states `PREVIEW`, `PENDING`, `PROCESSING`, `COMPLETED`, and `FAILED`; lease/heartbeat/expired-lease recovery; bounded attempts; and duplicate safety. V4130 is the only delivered EDU-011 migration. Scanner absence defaults to fail-closed `UNAVAILABLE`; CSV/XLSX preview is metadata-only when no parser is available; execution requires both a clean scan and executable parsed content.
- **Deferred scope:** The export boundary currently defines request redaction only—answers and private fields are excluded—but generates no export file or export job. Production scanner integration, full parser availability, retention automation, dead-letter/operator tooling, partial-row reporting, and legacy asset migration remain deferred.
- **Allowed external-module change:** Education may call public Infra APIs only. It must not depend on Infra DOs, mappers, `ServiceImpl` classes, or implementation packages, and it does not move Education job state into Infra.

## Secondary learning, media, AI, and engagement

- **Target owner:** Education plus AI/Infra/Member/System
- **Public/framework capability to reuse:** AI services, Infra File/notifications, Member points/levels, Education authorization/projections.
- **Education-owned gap:** Verified legacy capabilities exist, but target equivalence and priority are not established. These cannot remain an undifferentiated P3 bucket if Phase 0 must give every capability a disposition.
- **Allowed external-module change:** AI, Infra File/messaging, Member growth primitives, System notifications, and Education extensions.