Import (migration)

The three guarantees

• The source is read-only. Nothing is written to the old provider, not even progress marks; it sees reads and nothing else.
• An import is resumable and idempotent. A job killed at 40 GiB resumes at 40 GiB, and a job run twice does not produce two copies.
• This is a one-way import, not a sync. Changes made at the old provider afterwards do not follow.

Running a job

Sign in at /import/, name the source, its protocol and credentials, and what it should become here. Well-known providers' published settings are built into the wizard. Before the run it shows the mapping — which old folder becomes which new one — as an editable table. A Google Drive import needs no password: you sign in with Google, and the refresh token Google issues is the job's credential.

While it runs, the progress page counts items, folders and failures as they happen. A job can be paused and resumed; failed items are re-run with one press, and items refused for their size can join the re-run when an administrator has raised the limit since.

What stops a run, and what does not. A failed item never stops the run — it is one line in the report. A failed folder is one failure, named, and the run continues with the others. What does stop the run: an authentication failure, our own target refusing writes, and a source that stops answering. No target refuses for quota: if a store is genuinely full the job pauses and says which item did not fit.

Credentials, and what happens to them

The import writes into this install as you, with a refresh grant from an ordinary sign-in; it lives in a session of its own, not in the browser the wizard ran in. The source password is held encrypted and destroyed at the end: a job that ends done with nothing left behind keeps neither password nor grant. TLS is required for every source connection, and no import ever sends a credential in clear; an unverified certificate is refused unless you chose "Connect without a valid certificate" for that one job.