# EDU-011 — Content import, export, assets, and scanning

- **Status:** blocked
- **Type:** implementation program
- **Phase:** 3 / 6
- **Blockers:** EDU-010, Infra File contract, scanner ownership decision, durable job claim decision

## Tenant-admin outcome

Administrators can import and export education content through durable, duplicate-safe jobs, with secure files, malware scanning, tenant propagation, audit, retries, and partial-failure reporting.

## Reuse

- Education owns import/export business state and content validation.
- Infra owns File, Job/MQ, locks, logging, and audit primitives.
- Scanner integration sits behind a clear adapter; Education does not implement generic storage or scheduling.

## Acceptance criteria

- [ ] Preview and execute are distinct states.
- [ ] Jobs use atomic claim/lease/heartbeat/recovery semantics.
- [ ] At-least-once retries are duplicate-safe.
- [ ] File type, size, object key, access, and retention are enforced.
- [ ] Scanning fails closed.
- [ ] Tenant context propagates into asynchronous handlers.
- [ ] Exports redact answers and private fields according to authorization.
- [ ] Partial failures and dead letters are visible and auditable.

## Risk and rollback

- **Risk:** High operational and file-security risk.
- **Rollback:** Disable job handlers and preserve job/business state for forward recovery.