Bulk Import Platform

Pin immutable import inputs, stage bounded validated rows and commit deterministic batches with progress in one transaction. Expose partial success and cancellation truthfully instead of implying a global rollback.

1. Authorize the tenant and source upload, record checksum/version and validate a supported mapping/schema. Create an idempotent job with its explicit partial-batch commit policy.
2. Stream-decode/parse with byte/row/column/depth limits. Stage valid rows under deterministic source-row identities and store bounded error details with overflow counts.
3. For each deterministic batch, apply validated upserts/inserts and mark the batch committed in the same destination transaction. Scope natural/operation keys by tenant and reject mapping drift on resume.
4. Cancellation stops admission of new batches and waits/reconciles an in-flight batch. Report accepted/rejected/committed counts and downloadable scoped errors. Retain partial writes under this policy; atomic mode would need another publication boundary.

• Repeated batches do not duplicate destination rows.
• Changed source/mapping versions cannot resume the old job silently.
• Malformed huge fields and many errors remain within configured budgets.
• Cancellation reports already committed rows and never claims an unsupported rollback.

Trade-offs to explain

• Partial batch commit scales well but requires users to understand that some rows remain after failure/cancellation.
• All-or-nothing visibility requires staging plus a real atomic publish mechanism, not just a final status flag.
• Source row order alone may be insufficient for restart if parsing dialect/mapping changes, so both remain pinned.