docs(education): document bounded EDU-011 capability

docs/education/migration/issues/EDU-011-import-export-assets.md

@@ -1,32 +1,48 @@
-# EDU-011 — Content import, export, assets, and scanning
+# EDU-011 — Bounded content import assets, jobs, and export policy
 
-- **Status:** blocked
+- **Status:** bounded capability delivered
 - **Type:** implementation program
 - **Phase:** 3 / 6
-- **Blockers:** EDU-010, Infra File contract, scanner ownership decision, durable job claim decision
+- **Delivered migration:** V4130 only
 
-## Tenant-admin outcome
+## Delivered tenant-admin outcome
 
-Administrators can import and export education content through durable, duplicate-safe jobs, with secure files, malware scanning, tenant propagation, audit, retries, and partial-failure reporting.
+Education owns tenant-scoped import asset metadata and durable import jobs while reusing only public Infra APIs for private-file operations and other platform primitives. The delivered job lifecycle has exactly five states: `PREVIEW`, `PENDING`, `PROCESSING`, `COMPLETED`, and `FAILED`.
 
-## Reuse
+The bounded capability provides:
 
-- Education owns import/export business state and content validation.
-- Infra owns File, Job/MQ, locks, logging, and audit primitives.
-- Scanner integration sits behind a clear adapter; Education does not implement generic storage or scheduling.
+- durable atomic claim with lease token, heartbeat, expired-lease recovery, bounded attempts, and terminal failure;
+- tenant-scoped duplicate safety for preview requests and execution, so at-least-once delivery does not create a second logical job or repeat completed effects;
+- fail-closed scanning: the default scanner result is `UNAVAILABLE`, and unavailable, infected, or errored scans are never executable;
+- CSV/XLSX preview metadata when no parser is available; this reports file/type metadata only and does not claim row parsing or content validation;
+- execution only after the scan is clean and the preview explicitly reports executable parsed content;
+- an export-request redaction policy that excludes answers and private fields from authorized export requests.
 
-## Acceptance criteria
+## Ownership and reuse boundary
 
-- [ ] Preview and execute are distinct states.
-- [ ] Jobs use atomic claim/lease/heartbeat/recovery semantics.
-- [ ] At-least-once retries are duplicate-safe.
-- [ ] File type, size, object key, access, and retention are enforced.
-- [ ] Scanning fails closed.
-- [ ] Tenant context propagates into asynchronous handlers.
-- [ ] Exports redact answers and private fields according to authorization.
-- [ ] Partial failures and dead letters are visible and auditable.
+- Education owns `education_content_import_asset`, `education_content_import_job`, their business state, duplicate keys, lease/recovery semantics, preview policy, and execution orchestration.
+- Infra continues to own generic file storage and platform facilities. Education integrates through public Infra APIs only; it does not depend on Infra DOs, mappers, `ServiceImpl` classes, or private implementation packages.
+- V4130 is the only EDU-011 schema migration in this slice. No additional migration, generic scanner platform, generic scheduler, or Infra-internal extension is delivered.
+
+## Deferred scope
+
+- No generated export file, downloadable export artifact, export worker, or export-job persistence is delivered. Only the request-time redaction policy is established.
+- No production malware-scanner integration is delivered; the default remains fail-closed `UNAVAILABLE` until an external scanner adapter is configured.
+- No full CSV/XLSX parser is promised by the fallback. Without an available parser, preview remains metadata-only and execution is blocked.
+- File retention/deletion automation, dead-letter tooling, operator UI, partial-row import reporting, and legacy asset migration/re-scan remain deferred.
+
+## Acceptance record
+
+- [x] Education-owned import assets and durable jobs are represented by V4130.
+- [x] Jobs use the five-state lifecycle `PREVIEW`, `PENDING`, `PROCESSING`, `COMPLETED`, `FAILED`.
+- [x] Claim, lease, heartbeat, expired-lease recovery, retry bounds, and duplicate safety are defined.
+- [x] Scanning fails closed, with default `UNAVAILABLE`.
+- [x] CSV/XLSX can return metadata-only preview when the parser is unavailable.
+- [x] Execute is blocked unless scanning is clean and preview content is executable.
+- [x] Export requests apply answer/private-field redaction policy.
+- [ ] Generated export files and the remaining operational features are deferred as listed above.
 
 ## Risk and rollback
 
-- **Risk:** High operational and file-security risk.
-- **Rollback:** Disable job handlers and preserve job/business state for forward recovery.
+- **Risk:** Import processing remains security-sensitive; scanner or parser absence intentionally removes executability rather than degrading silently.
+- **Rollback:** Disable import handlers while preserving Education asset/job state for inspection and forward recovery. Do not bypass scan or executable-preview gates.