Migration

The three guarantees

• The source is read-only. No code path in the import can issue a mutating request to a source server — the client objects carry no such method. Nothing is written to the source, not even progress marks; your old provider sees reads and nothing else.
• An import is resumable and idempotent. A job killed at 40 GiB resumes at 40 GiB, and a job run twice does not produce two copies.
• This is a one-way import, not a sync. The wizard says this in one sentence before the run and repeats it on the report — changes made at the old provider afterwards do not follow.

Running a job in the wizard

Sign in at /import/, name the source, its protocol and credentials, and what it should become here. Well-known providers' published settings are built into the wizard. Before the run it shows the mapping — which old folder becomes which new one — as an editable table. Google Drive needs no password: you sign in with Google and the refresh token Google issues is the job's credential.

While it runs, the progress page counts items, folders and failures as they happen. A source that answers slowly is met slowly on purpose: one connection per job, batches backed off with patience — your old account getting rate-limited or locked out helps nobody. A job can be paused and resumed; failed items are re-run with one press, and items the target refused for their size can join the re-run if an administrator has raised the limit since.

What stops a run, and what does not

• A failed item never stops the run. An unreadable message is one line in the report; the run goes on.
• A failed folder is one failure, named. The run continues with the other folders; a targeted re-run of the failures takes every item in it.
• What does stop the run: an authentication failure, our own target refusing writes, and a source that stops answering — three batches in a row from which nothing could be fetched.
• No target refuses for quota. Quota here is a billing figure, not a gate. If a store is genuinely full the job pauses, the wizard says which item did not fit, and you resume once there is room.

Credentials, and what happens to them

The import writes into this install as you, with a refresh grant — the wizard runs an ordinary sign-in, and the grant lives in a session of its own, not in the browser the wizard ran in. The source password is held encrypted and destroyed at the end: a job that ends done with nothing left behind keeps neither password nor grant. A failed job keeps them for a restart window, so re-running the failures is one press.

TLS is required for every source connection — implicit TLS or STARTTLS always; a server that offers neither is refused, and no import ever sends a credential in clear. An unverified certificate is refused unless you chose "Connect without a valid certificate" for that job, which is per job and loud.