# EDU-011 — Bounded content import assets, jobs, and export policy

- **Status:** bounded capability delivered
- **Type:** implementation program
- **Phase:** 3 / 6
- **Delivered migration:** V4130 only

## Delivered tenant-admin outcome

Education owns tenant-scoped import asset metadata and durable import jobs while reusing only public Infra APIs for private-file operations and other platform primitives. The delivered job lifecycle has exactly five states: `PREVIEW_PENDING`, `PREVIEW_READY`, `EXECUTE_PENDING`, `COMPLETED`, and `FAILED`.

The bounded capability provides:

- durable atomic claim with lease token, heartbeat, expired-lease recovery, bounded attempts, and terminal failure;
- tenant-scoped duplicate safety for preview requests and execution, so at-least-once delivery does not create a second logical job or repeat completed effects;
- fail-closed scanning: the default scanner result is `UNAVAILABLE`, and unavailable, infected, or errored scans are never executable;
- CSV/XLSX preview metadata when no parser is available; this reports file/type metadata only and does not claim row parsing or content validation;
- execution only after the scan is clean and the preview explicitly reports executable parsed content;
- an export-request redaction policy that excludes answers and private fields from authorized export requests.

## Ownership and reuse boundary

- Education owns `education_content_import_asset`, `education_content_import_job`, their business state, duplicate keys, lease/recovery semantics, preview policy, and execution orchestration.
- Infra continues to own generic file storage and platform facilities. Education integrates through public Infra APIs only; it does not depend on Infra DOs, mappers, `ServiceImpl` classes, or private implementation packages.
- V4130 is the only EDU-011 schema migration in this slice. No additional migration, generic scanner platform, generic scheduler, or Infra-internal extension is delivered.

## Deferred scope

- Production preview requests reference an admitted tenant asset ID; object keys, filenames, media types, and sizes are derived server-side from `education_content_import_asset` and are never accepted from the request body.
- The executable question-import service uses the V4130 `education_content_import_job` aggregate directly; the obsolete parallel `education_question_import_job` path has been removed.
- Per-job claims, heartbeat/finish fencing, expired lease recovery, bounded attempts, and terminal exhaustion failure use the production PostgreSQL mapper contract.
- No generated export file, downloadable export artifact, export worker, or export-job persistence is delivered. Only the request-time redaction policy is established.
- No production malware-scanner integration is delivered; the default remains fail-closed `UNAVAILABLE` until an external scanner adapter is configured.
- No full CSV/XLSX parser is promised by the fallback. Without an available parser, preview remains metadata-only and execution is blocked.
- File retention/deletion automation, dead-letter tooling, operator UI, partial-row import reporting, and legacy asset migration/re-scan remain deferred.

## Acceptance record

- [x] Education-owned import assets and durable jobs are represented by V4130.
- [x] Jobs use the five-state lifecycle `PREVIEW_PENDING`, `PREVIEW_READY`, `EXECUTE_PENDING`, `COMPLETED`, `FAILED`.
- [x] Claim, lease, heartbeat, expired-lease recovery, retry bounds, and duplicate safety are defined.
- [x] Scanning fails closed, with default `UNAVAILABLE`.
- [x] CSV/XLSX can return metadata-only preview when the parser is unavailable.
- [x] Execute is blocked unless scanning is clean and preview content is executable.
- [x] Export requests apply answer/private-field redaction policy.
- [x] Generated export files, retention automation, production parser/scanner adapters, operator UI, and legacy re-scan are explicitly outside this bounded capability; their absence is exposed through blockers and fail-closed behavior rather than represented as available.

## Risk and rollback

- **Risk:** Import processing remains security-sensitive; scanner or parser absence intentionally removes executability rather than degrading silently.
- **Rollback:** Disable import handlers while preserving Education asset/job state for inspection and forward recovery. Do not bypass scan or executable-preview gates.