Import lifecycle and export boundaries

An import captures source evidence, interprets it for review, and records accepted money only after explicit consent. Uploading a statement or storing messages must not itself create transactions.

Lifecycle responsibilities

1. Receive the source and retain its identity.
2. Configure account, mapping and source purpose.
3. Generate a preview for that interpretation.
4. Review ambiguous rows, balances and original-currency evidence.
5. Obtain explicit consent for the intended reviewed version.
6. Start processing and retain durable progress.

Changing source or configuration invalidates assumptions behind an earlier preview. Require fresh review and consent rather than silently processing a new interpretation.

Recovery

Continue an existing job after interruption. Cancellation stops further work once observed and does not pretend already committed work vanished. Undo is bounded to eligible unchanged owned financial units; linked or changed units can be refused.

Source restoration requires the intended original evidence and matching configuration. Reprocessing is another reviewed decision, not unconditional deletion and replay.

Export boundary

Full history export and self-service account deletion are planned. Import review pages, stored source files and paginated movement reads are not complete export facilities. Reserved scopes do not implement missing operations.

Read customer import steps, registered lifecycle actions and destructive controls.