From 7e3ed19c8957c46fd4ad7fd0d6923d417575359d Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 14:41:56 +0700
Subject: [PATCH 01/15] fix(linux-import): keep an empty CSV field over the
 column default

---
 linux/crates/core/src/import/csv_import.rs    | 22 ++++++++++++----
 .../crates/drivers/sqlite/tests/csv_import.rs | 26 +++++++++++++++++++
 2 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/linux/crates/core/src/import/csv_import.rs b/linux/crates/core/src/import/csv_import.rs
index e1dd3f3352..1679ac2776 100644
--- a/linux/crates/core/src/import/csv_import.rs
+++ b/linux/crates/core/src/import/csv_import.rs
@@ -177,16 +177,17 @@ pub fn row_to_cells(
 
 fn cell_for(text: &str, column: &ColumnInfo, options: &CsvImportOptions) -> Result<CellInput, String> {
     if text == options.null_marker {
+        // An empty string is a value in its own right for a text
+        // column, and the marker being empty is the common case. The
+        // file holds it, so it wins over the column's default.
+        if options.null_marker.is_empty() && column.column_type.kind.accepts_empty_string() {
+            return Ok(CellInput::Value(crate::value::Value::Text(String::new())));
+        }
         // A NOT NULL column with a default is better served by its
         // default than by an insert the server will refuse.
         if !column.nullable && !column.default.is_none() {
             return Ok(CellInput::Default);
         }
-        // An empty string is a value in its own right for a text
-        // column, and the marker being empty is the common case.
-        if options.null_marker.is_empty() && column.column_type.kind.accepts_empty_string() {
-            return Ok(CellInput::Value(crate::value::Value::Text(String::new())));
-        }
         return Ok(CellInput::Value(crate::value::Value::Null));
     }
     parse_literal_text(text, &column.column_type)
@@ -415,6 +416,17 @@ mod tests {
         assert_eq!(cells[0], CellInput::Default);
     }
 
+    #[test]
+    fn an_empty_field_for_a_not_null_text_column_with_a_default_stays_empty() {
+        let mut columns = vec![text_column("status")];
+        columns[0].nullable = false;
+        columns[0].default = ColumnDefault::Literal(Value::Text("active".to_owned()));
+
+        let cells = row_to_cells(&[String::new()], &[Some(0)], &columns, &options(), 2).expect("cells");
+
+        assert_eq!(cells[0], CellInput::Value(Value::Text(String::new())));
+    }
+
     #[test]
     fn a_field_the_column_cannot_hold_names_the_row_and_the_cell() {
         let columns = vec![int_column("id")];
diff --git a/linux/crates/drivers/sqlite/tests/csv_import.rs b/linux/crates/drivers/sqlite/tests/csv_import.rs
index a04cd82728..8dc3e3cbd2 100644
--- a/linux/crates/drivers/sqlite/tests/csv_import.rs
+++ b/linux/crates/drivers/sqlite/tests/csv_import.rs
@@ -170,6 +170,32 @@ async fn a_column_the_file_does_not_name_keeps_its_default() {
     connection.close().await.expect("the close");
 }
 
+#[tokio::test]
+async fn an_empty_field_is_kept_as_an_empty_string_over_the_default() {
+    let (_directory, connection) = open().await.expect("a database file");
+    create(
+        connection.as_ref(),
+        "CREATE TABLE accounts (id INTEGER PRIMARY KEY, status TEXT NOT NULL DEFAULT 'active')",
+    )
+    .await
+    .expect("the table");
+
+    import(
+        connection.as_ref(),
+        "accounts",
+        b"id,status\n1,\n",
+        &CsvImportOptions::default(),
+    )
+    .await
+    .expect("the import");
+
+    let rows = query(connection.as_ref(), "SELECT status FROM accounts")
+        .await
+        .expect("the rows");
+    assert_eq!(rows.rows[0][0], Value::Text(String::new()));
+    connection.close().await.expect("the close");
+}
+
 #[tokio::test]
 async fn a_row_the_table_cannot_hold_leaves_the_table_as_it_was() {
     let (_directory, connection) = open().await.expect("a database file");

From f8f6b76d6ff8583b900bf2d9f381783f6ba4e26f Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:23:52 +0700
Subject: [PATCH 02/15] fix(linux-import): keep the ids a CSV gives an identity
 column

---
 linux/crates/app/src/ui/import_dialog.rs      | 71 +++++++++++----
 linux/crates/app/src/ui/workspace/import.rs   | 87 +++++++++++--------
 linux/crates/app/src/ui/workspace/mod.rs      |  2 +-
 linux/crates/core/src/ddl/identity_style.rs   | 29 +++++++
 linux/crates/core/src/dml/build_insert.rs     | 13 +--
 linux/crates/core/src/dml/tests.rs            | 47 ++++++++--
 linux/crates/core/src/import/csv_import.rs    | 79 +++++++++++++----
 linux/crates/core/src/import/import_column.rs | 69 +++++++++++++++
 linux/crates/core/src/import/import_plan.rs   | 30 +++++++
 linux/crates/core/src/import/mod.rs           |  4 +
 .../mssql/tests/integration/csv_import.rs     | 36 ++++++++
 .../drivers/mssql/tests/integration/main.rs   |  1 +
 .../mysql/tests/integration/csv_import.rs     | 35 ++++++++
 .../drivers/mysql/tests/integration/main.rs   |  1 +
 .../postgres/tests/integration/csv_import.rs  | 50 +++++++++++
 .../postgres/tests/integration/main.rs        |  1 +
 .../crates/drivers/sqlite/tests/csv_import.rs | 56 ++++++++----
 linux/crates/test-support/src/csv_import.rs   | 49 +++++++++++
 linux/crates/test-support/src/lib.rs          |  2 +
 19 files changed, 562 insertions(+), 100 deletions(-)
 create mode 100644 linux/crates/core/src/import/import_column.rs
 create mode 100644 linux/crates/core/src/import/import_plan.rs
 create mode 100644 linux/crates/drivers/mssql/tests/integration/csv_import.rs
 create mode 100644 linux/crates/drivers/mysql/tests/integration/csv_import.rs
 create mode 100644 linux/crates/drivers/postgres/tests/integration/csv_import.rs
 create mode 100644 linux/crates/test-support/src/csv_import.rs

diff --git a/linux/crates/app/src/ui/import_dialog.rs b/linux/crates/app/src/ui/import_dialog.rs
index c4a39f6b6e..7838f78874 100644
--- a/linux/crates/app/src/ui/import_dialog.rs
+++ b/linux/crates/app/src/ui/import_dialog.rs
@@ -5,9 +5,8 @@ use relm4::adw::prelude::*;
 use relm4::prelude::*;
 use relm4::{adw, gtk};
 
-use tablepro_core::ColumnInfo;
 use tablepro_core::export::CsvDelimiter;
-use tablepro_core::import::{CsvImportOptions, CsvSheet, MAX_PREVIEW_ROWS, read_csv, suggest_mapping};
+use tablepro_core::import::{CsvImportOptions, CsvSheet, ImportColumn, MAX_PREVIEW_ROWS, read_csv, suggest_mapping};
 
 use crate::runtime::DeliverInput;
 
@@ -28,7 +27,7 @@ pub struct ImportCsvDialog {
     schema: Option<String>,
     table: String,
     bytes: Vec<u8>,
-    columns: Vec<ColumnInfo>,
+    columns: Vec<ImportColumn>,
     sheet: CsvSheet,
     options: CsvImportOptions,
     /// One row per table column, in column order. The selected index is
@@ -45,7 +44,7 @@ pub struct ImportCsvDialog {
 pub struct ImportCsvDialogInit {
     pub schema: Option<String>,
     pub table: String,
-    pub columns: Vec<ColumnInfo>,
+    pub columns: Vec<ImportColumn>,
     pub bytes: Vec<u8>,
 }
 
@@ -68,9 +67,9 @@ pub enum ImportCsvDialogInput {
 pub struct CsvImport {
     pub schema: Option<String>,
     pub table: String,
-    pub columns: Vec<ColumnInfo>,
+    pub columns: Vec<ImportColumn>,
     /// One entry per table column: the CSV field it takes, or `None`
-    /// for a column the user set to Skip.
+    /// for a column the user set to Skip or the server fills.
     pub mapping: Vec<Option<usize>>,
     pub options: CsvImportOptions,
     pub bytes: Vec<u8>,
@@ -266,8 +265,9 @@ impl ImportCsvDialog {
 
         for (column, field) in self.columns.iter().zip(&suggested) {
             let row = adw::ComboRow::builder()
-                .title(glib::markup_escape_text(&column.name))
+                .title(glib::markup_escape_text(&column.info.name))
                 .model(&gtk::StringList::new(&choice_refs))
+                .sensitive(!column.server_filled)
                 .build();
             row.set_selected(field.map_or(0, |index| index as u32 + 1));
             let sender = sender.clone();
@@ -280,8 +280,10 @@ impl ImportCsvDialog {
 
     /// Show what the mapped field actually holds, under each column.
     fn show_samples(&self) {
-        for (row, field) in self.mapping_rows.borrow().iter().zip(self.mapping()) {
+        let rows = self.mapping_rows.borrow();
+        for ((row, field), column) in rows.iter().zip(self.mapping()).zip(&self.columns) {
             row.set_subtitle(&match field {
+                _ if column.server_filled => crate::i18n::gettext("The database fills this column"),
                 Some(index) => sample_text(&self.sheet, index, &self.options),
                 None => crate::i18n::gettext("Uses the column's own default"),
             });
@@ -315,7 +317,9 @@ impl ImportCsvDialog {
         self.mapping_rows
             .borrow()
             .iter()
-            .map(|row| match row.selected() {
+            .zip(&self.columns)
+            .map(|(row, column)| match row.selected() {
+                _ if column.server_filled => None,
                 0 => None,
                 index => Some(index as usize - 1),
             })
@@ -400,20 +404,24 @@ mod tests {
 #[cfg(test)]
 mod dialog_tests {
     use super::*;
+    use tablepro_core::ColumnInfo;
     use tablepro_core::column::{ColumnDefault, ColumnType};
 
     /// The dialog only reads a column's name: the type decides what a
     /// value parses into, which happens after the dialog is gone.
-    fn column(name: &str) -> ColumnInfo {
-        ColumnInfo {
-            name: name.to_owned(),
-            column_type: ColumnType::unknown(),
-            nullable: true,
-            primary_key: false,
-            is_auto_increment: false,
-            is_generated: false,
-            default: ColumnDefault::None,
-            comment: None,
+    fn column(name: &str) -> ImportColumn {
+        ImportColumn {
+            info: ColumnInfo {
+                name: name.to_owned(),
+                column_type: ColumnType::unknown(),
+                nullable: true,
+                primary_key: false,
+                is_auto_increment: false,
+                is_generated: false,
+                default: ColumnDefault::None,
+                comment: None,
+            },
+            server_filled: false,
         }
     }
 
@@ -469,6 +477,31 @@ mod dialog_tests {
         assert_eq!(dialog.model().mapping(), vec![None, None, None]);
     }
 
+    #[gtk4::test]
+    fn a_column_the_server_fills_cannot_take_a_field() {
+        let mut id = column("id");
+        id.server_filled = true;
+        let dialog = ImportCsvDialog::builder().launch(ImportCsvDialogInit {
+            schema: None,
+            table: "people".to_owned(),
+            columns: vec![id, column("name")],
+            bytes: b"id,name\n1,ada\n".to_vec(),
+        });
+        crate::test_support::drain_main_context();
+
+        let rows = dialog.model().mapping_rows.borrow().clone();
+
+        assert_eq!(dialog.model().mapping(), vec![None, Some(1)]);
+        assert!(
+            !rows[0].is_sensitive(),
+            "a field could be picked for a column the server fills"
+        );
+        assert_eq!(
+            rows[0].subtitle().unwrap_or_default().as_str(),
+            "The database fills this column"
+        );
+    }
+
     #[gtk4::test]
     fn a_file_that_is_not_csv_leaves_the_import_button_off() {
         let dialog = ImportCsvDialog::builder().launch(ImportCsvDialogInit {
diff --git a/linux/crates/app/src/ui/workspace/import.rs b/linux/crates/app/src/ui/workspace/import.rs
index 1c2cf195c9..8efe5b8009 100644
--- a/linux/crates/app/src/ui/workspace/import.rs
+++ b/linux/crates/app/src/ui/workspace/import.rs
@@ -5,11 +5,10 @@ use gtk4::{gio, glib};
 use libadwaita::prelude::*;
 use relm4::{Component, ComponentController};
 
-use tablepro_core::dialect::SqlDialect;
 use tablepro_core::edit::CellInput;
+use tablepro_core::import::{ImportColumn, plan_import};
 use tablepro_core::meta::TableRef;
-use tablepro_core::statement::GuardedStatement;
-use tablepro_core::{ColumnInfo, ForeignKeyMode, WriteBatch, WriteKind, WriteReport};
+use tablepro_core::{WriteKind, WriteReport};
 use tablepro_session::{OperationError, OperationKind, Session};
 
 use crate::ui::file_read::{FileReadError, read_capped_file};
@@ -100,7 +99,7 @@ impl WorkspaceModel {
         &mut self,
         schema: Option<String>,
         table: String,
-        columns: Vec<tablepro_core::ColumnInfo>,
+        columns: Vec<ImportColumn>,
         bytes: Vec<u8>,
     ) {
         use crate::ui::import_dialog::{ImportCsvDialog, ImportCsvDialogInit, ImportCsvDialogOutput};
@@ -194,11 +193,16 @@ async fn read_csv_file(file: &gio::File) -> Result<Vec<u8>, String> {
         })
 }
 
-async fn read_columns(session: Arc<Session>, table: TableRef) -> Result<Vec<ColumnInfo>, OperationError> {
+/// The table's columns with what the engine lets an insert write, so
+/// the mapping never offers a column the server fills.
+async fn read_columns(session: Arc<Session>, table: TableRef) -> Result<Vec<ImportColumn>, OperationError> {
     session
         .run(OperationKind::Metadata, move |lease, options| {
             let table = table.clone();
-            async move { Ok(lease.fetch_columns(&table, options).await?) }
+            async move {
+                let definition = lease.fetch_table_definition(&table, options).await?;
+                Ok(definition.columns.iter().map(ImportColumn::from_definition).collect())
+            }
         })
         .await
 }
@@ -208,7 +212,7 @@ async fn read_columns(session: Arc<Session>, table: TableRef) -> Result<Vec<Colu
 async fn write_import(
     session: &Session,
     table: TableRef,
-    columns: Vec<ColumnInfo>,
+    columns: Vec<ImportColumn>,
     rows: Vec<Vec<CellInput>>,
 ) -> Result<(Vec<String>, WriteReport), OperationError> {
     let rows = Arc::new(rows);
@@ -218,7 +222,7 @@ async fn write_import(
             let columns = columns.clone();
             let rows = rows.clone();
             async move {
-                let batch = import_batch(&*lease.dialect(), &table, &columns, &rows)?;
+                let batch = plan_import(&*lease.dialect(), &table, &columns, &rows)?;
                 let sql: Vec<String> = batch.steps.iter().map(|step| step.statement.sql().to_owned()).collect();
                 tracing::info!(
                     rows = rows.len(),
@@ -232,26 +236,6 @@ async fn write_import(
         .await
 }
 
-/// One INSERT per row, as a single batch so the engine runs them in
-/// one transaction where it has one.
-fn import_batch(
-    dialect: &dyn SqlDialect,
-    table: &TableRef,
-    columns: &[ColumnInfo],
-    rows: &[Vec<CellInput>],
-) -> Result<WriteBatch, tablepro_core::dml::BuildSqlError> {
-    let steps = rows
-        .iter()
-        .map(|cells| tablepro_core::dml::build_insert(dialect, table, columns, cells).map(GuardedStatement::unguarded))
-        .collect::<Result<Vec<_>, _>>()?;
-    Ok(WriteBatch::new(
-        WriteKind::RowChanges,
-        table.clone(),
-        steps,
-        ForeignKeyMode::Enforced,
-    ))
-}
-
 /// Every row of the file as the cells to insert, or the first row that
 /// could not be read.
 ///
@@ -294,7 +278,8 @@ fn import_rows(import: &CsvImport) -> Result<Vec<Vec<CellInput>>, String> {
 #[cfg(test)]
 mod tests {
     use tablepro_core::column::{ColumnDefault, ColumnKind, ColumnType, TextLength};
-    use tablepro_core::{LivenessPolicy, Value};
+    use tablepro_core::ddl::{ColumnAttributes, ColumnDefinition, IdentityStyle, TableDefinition};
+    use tablepro_core::{ColumnInfo, LivenessPolicy, Value};
     use tablepro_session::fakes::{FakeConnector, FakeCredentialSource};
     use tablepro_session::operation::DefaultDeadlines;
     use tablepro_session::{SessionDeps, SessionHealth};
@@ -302,7 +287,7 @@ mod tests {
 
     use super::*;
 
-    fn column(name: &str) -> ColumnInfo {
+    fn info(name: &str) -> ColumnInfo {
         let mut column_type = ColumnType::untyped_text("text");
         column_type.kind = ColumnKind::Text {
             length: TextLength::Unbounded,
@@ -319,6 +304,23 @@ mod tests {
         }
     }
 
+    fn column(name: &str) -> ImportColumn {
+        ImportColumn {
+            info: info(name),
+            server_filled: false,
+        }
+    }
+
+    fn definition(name: &str, identity: IdentityStyle) -> ColumnDefinition {
+        ColumnDefinition::new(
+            info(name),
+            ColumnAttributes {
+                identity,
+                ..ColumnAttributes::default()
+            },
+        )
+    }
+
     fn session(script: ConnectionScript) -> (Arc<Session>, Arc<FakeConnection>) {
         let (pending, connection) = FakeConnector::pending_session(FakeConnector::request().unwrap(), script);
         let session = Session::start(
@@ -348,9 +350,18 @@ mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn csv_import_reads_columns_through_session() {
         let mut script = ConnectionScript::default();
-        script
-            .fetch_columns
-            .always(FakeReply::ok(vec![column("name"), column("city")]));
+        script.fetch_table_definition.always(FakeReply::ok(TableDefinition {
+            table: TableRef::unqualified("people"),
+            columns: vec![
+                definition("id", IdentityStyle::MssqlIdentity),
+                definition("name", IdentityStyle::None),
+            ],
+            primary_key: None,
+            indexes: Vec::new(),
+            foreign_keys: Vec::new(),
+            inbound_foreign_keys: Vec::new(),
+            source: None,
+        }));
         let (session, connection) = session(script);
 
         let columns = crate::test_support::paused_tasks()
@@ -359,8 +370,12 @@ mod tests {
             .unwrap()
             .unwrap();
 
-        assert_eq!(columns.len(), 2);
-        assert_eq!(CallCounters::get(&connection.counters().fetch_columns), 1);
+        assert_eq!(
+            columns.iter().map(|column| column.server_filled).collect::<Vec<_>>(),
+            vec![true, false],
+            "an identity that refuses a value was offered to the file"
+        );
+        assert_eq!(CallCounters::get(&connection.counters().fetch_table_definition), 1);
         assert_eq!(*session.health().borrow(), SessionHealth::Online);
     }
 
@@ -387,7 +402,7 @@ mod tests {
     #[test]
     fn a_bad_row_names_its_line_in_the_file() {
         let mut bad = import("name,city\nAda,London\n");
-        bad.columns[1].column_type.kind = ColumnKind::Integer(tablepro_core::column::IntegerKind {
+        bad.columns[1].info.column_type.kind = ColumnKind::Integer(tablepro_core::column::IntegerKind {
             width: tablepro_core::column::IntegerWidth::W32,
             signed: true,
         });
diff --git a/linux/crates/app/src/ui/workspace/mod.rs b/linux/crates/app/src/ui/workspace/mod.rs
index f39644dee9..63f8584233 100644
--- a/linux/crates/app/src/ui/workspace/mod.rs
+++ b/linux/crates/app/src/ui/workspace/mod.rs
@@ -401,7 +401,7 @@ pub(crate) enum WorkspaceInput {
     ImportCsvReady {
         schema: Option<String>,
         table: String,
-        columns: Vec<tablepro_core::ColumnInfo>,
+        columns: Vec<tablepro_core::import::ImportColumn>,
         bytes: Vec<u8>,
     },
     ImportCsvRun(Box<super::import_dialog::CsvImport>),
diff --git a/linux/crates/core/src/ddl/identity_style.rs b/linux/crates/core/src/ddl/identity_style.rs
index 9407cc1a6d..50f8d72ae3 100644
--- a/linux/crates/core/src/ddl/identity_style.rs
+++ b/linux/crates/core/src/ddl/identity_style.rs
@@ -22,3 +22,32 @@ pub enum IdentityStyle {
     /// SQL Server `IDENTITY(seed, increment)`.
     MssqlIdentity,
 }
+
+impl IdentityStyle {
+    /// Whether a plain INSERT may give the column a value of its own.
+    /// GENERATED ALWAYS needs `OVERRIDING SYSTEM VALUE` and SQL Server
+    /// IDENTITY needs `IDENTITY_INSERT`, so both refuse one.
+    pub fn accepts_explicit_value(self) -> bool {
+        !matches!(self, Self::GeneratedAlways | Self::MssqlIdentity)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_the_identities_that_need_an_override_refuse_a_value() {
+        assert!(!IdentityStyle::GeneratedAlways.accepts_explicit_value());
+        assert!(!IdentityStyle::MssqlIdentity.accepts_explicit_value());
+        for style in [
+            IdentityStyle::None,
+            IdentityStyle::GeneratedByDefault,
+            IdentityStyle::SequenceDefault,
+            IdentityStyle::AutoIncrementKeyword,
+            IdentityStyle::SqliteRowidAlias,
+        ] {
+            assert!(style.accepts_explicit_value(), "{style:?}");
+        }
+    }
+}
diff --git a/linux/crates/core/src/dml/build_insert.rs b/linux/crates/core/src/dml/build_insert.rs
index 50ab06c608..415bfb65b7 100644
--- a/linux/crates/core/src/dml/build_insert.rs
+++ b/linux/crates/core/src/dml/build_insert.rs
@@ -6,11 +6,14 @@ use crate::statement::{Statement, StatementBuilder};
 
 use super::BuildSqlError;
 
-/// The INSERT for a draft row.
+/// The INSERT for one row.
 ///
-/// A cell the user left alone is left out of the statement, so the
-/// server applies its own default. A generated or auto-increment
-/// column is never written, because the server owns its value.
+/// A `Default` cell is left out of the statement, so the server applies
+/// its own default or next number. A generated column is never written,
+/// because the server computes it. Every other value is written, an
+/// auto-increment column's included: a value given for one is a key the
+/// caller means to keep, and the caller leaves out the identities an
+/// engine refuses a value for.
 pub fn build_insert(
     dialect: &dyn SqlDialect,
     table: &TableRef,
@@ -32,7 +35,7 @@ pub fn build_insert(
         let Some(value) = cell.value() else {
             continue;
         };
-        if column.is_generated || column.is_auto_increment {
+        if column.is_generated {
             continue;
         }
         markers.push(builder.bind(dialect, value.clone(), BindTarget::Column(column))?);
diff --git a/linux/crates/core/src/dml/tests.rs b/linux/crates/core/src/dml/tests.rs
index d2d2d9c5d7..93eab785f4 100644
--- a/linux/crates/core/src/dml/tests.rs
+++ b/linux/crates/core/src/dml/tests.rs
@@ -189,10 +189,9 @@ fn build_key_probe_stops_at_two_rows() {
 }
 
 #[test]
-fn build_insert_omits_default_cells_and_generated_columns() {
+fn build_insert_omits_generated_columns() {
     let dialect = TestDialect::exact();
     let mut columns = columns();
-    columns[0].is_auto_increment = true;
     columns[2].is_generated = true;
 
     let statement = build_insert(
@@ -209,10 +208,48 @@ fn build_insert_omits_default_cells_and_generated_columns() {
 
     assert_eq!(
         statement.sql(),
-        r#"INSERT INTO "public"."users" ("name") VALUES ($1)"#,
-        "a column the server owns was written"
+        r#"INSERT INTO "public"."users" ("id", "name") VALUES ($1, $2)"#,
+        "a generated column was written"
     );
-    assert_eq!(statement.params().len(), 1);
+    assert_eq!(statement.params().len(), 2);
+}
+
+#[test]
+fn build_insert_writes_the_value_given_for_an_auto_increment_column() {
+    let dialect = TestDialect::exact();
+    let mut columns = columns();
+    columns[0].is_auto_increment = true;
+
+    let given = build_insert(
+        &dialect,
+        &table(),
+        &columns,
+        &[
+            CellInput::Value(Value::Int(100)),
+            CellInput::Value(Value::Text("a".to_owned())),
+            CellInput::Default,
+        ],
+    )
+    .expect("the insert");
+    let left = build_insert(
+        &dialect,
+        &table(),
+        &columns,
+        &[
+            CellInput::Default,
+            CellInput::Value(Value::Text("a".to_owned())),
+            CellInput::Default,
+        ],
+    )
+    .expect("the insert");
+
+    assert_eq!(
+        given.sql(),
+        r#"INSERT INTO "public"."users" ("id", "name") VALUES ($1, $2)"#,
+        "the id the row was given was dropped"
+    );
+    assert_eq!(given.params()[0].value(), &Value::Int(100));
+    assert_eq!(left.sql(), r#"INSERT INTO "public"."users" ("name") VALUES ($1)"#);
 }
 
 #[test]
diff --git a/linux/crates/core/src/import/csv_import.rs b/linux/crates/core/src/import/csv_import.rs
index 1679ac2776..fceb660d6c 100644
--- a/linux/crates/core/src/import/csv_import.rs
+++ b/linux/crates/core/src/import/csv_import.rs
@@ -4,6 +4,8 @@ use crate::column::ColumnInfo;
 use crate::edit::{CellInput, parse_literal_text};
 use crate::export::CsvDelimiter;
 
+use super::ImportColumn;
+
 /// How many rows the mapping dialog shows. Enough to tell whether the
 /// delimiter and the header switch are right, few enough that a
 /// gigabyte file still opens the dialog at once.
@@ -134,12 +136,15 @@ pub fn read_csv(bytes: &[u8], options: &CsvImportOptions, limit: Option<usize>)
 ///
 /// Columns the file has no match for are left unmapped, which the
 /// dialog shows as "Skip" and the insert turns into the column's own
-/// default.
-pub fn suggest_mapping(headers: &[String], columns: &[ColumnInfo]) -> Vec<Option<usize>> {
+/// default. A column the server fills is never mapped.
+pub fn suggest_mapping(headers: &[String], columns: &[ImportColumn]) -> Vec<Option<usize>> {
     columns
         .iter()
         .map(|column| {
-            let wanted = column.name.trim().to_lowercase();
+            if column.server_filled {
+                return None;
+            }
+            let wanted = column.info.name.trim().to_lowercase();
             headers.iter().position(|header| header.trim().to_lowercase() == wanted)
         })
         .collect()
@@ -150,11 +155,12 @@ pub fn suggest_mapping(headers: &[String], columns: &[ColumnInfo]) -> Vec<Option
 /// A column with no mapped field, or one whose field is past the end of
 /// a short row, is left to its default rather than written as NULL: the
 /// file said nothing about it, which is not the same as saying it is
-/// empty.
+/// empty. A column the server fills is left to it whatever the mapping
+/// says.
 pub fn row_to_cells(
     row: &[String],
     mapping: &[Option<usize>],
-    columns: &[ColumnInfo],
+    columns: &[ImportColumn],
     options: &CsvImportOptions,
     line: usize,
 ) -> Result<Vec<CellInput>, CsvRowError> {
@@ -162,12 +168,12 @@ pub fn row_to_cells(
         .iter()
         .zip(mapping)
         .map(|(column, field)| {
-            let Some(text) = field.and_then(|index| row.get(index)) else {
+            let Some(text) = field.filter(|_| !column.server_filled).and_then(|index| row.get(index)) else {
                 return Ok(CellInput::Default);
             };
-            cell_for(text, column, options).map_err(|reason| CsvRowError {
+            cell_for(text, &column.info, options).map_err(|reason| CsvRowError {
                 line,
-                column: column.name.clone(),
+                column: column.info.name.clone(),
                 text: text.clone(),
                 reason,
             })
@@ -216,7 +222,14 @@ mod tests {
         CsvImportOptions::default()
     }
 
-    fn column(name: &str, kind: ColumnKind, sql: &str) -> ColumnInfo {
+    fn column(name: &str, kind: ColumnKind, sql: &str) -> ImportColumn {
+        ImportColumn {
+            info: column_info(name, kind, sql),
+            server_filled: false,
+        }
+    }
+
+    fn column_info(name: &str, kind: ColumnKind, sql: &str) -> ColumnInfo {
         ColumnInfo {
             name: name.to_owned(),
             column_type: ColumnType {
@@ -235,7 +248,7 @@ mod tests {
         }
     }
 
-    fn text_column(name: &str) -> ColumnInfo {
+    fn text_column(name: &str) -> ImportColumn {
         column(
             name,
             ColumnKind::Text {
@@ -245,7 +258,7 @@ mod tests {
         )
     }
 
-    fn int_column(name: &str) -> ColumnInfo {
+    fn int_column(name: &str) -> ImportColumn {
         column(
             name,
             ColumnKind::Integer(IntegerKind {
@@ -408,8 +421,8 @@ mod tests {
     #[test]
     fn a_not_null_column_with_a_default_takes_the_default_rather_than_a_refused_insert() {
         let mut columns = vec![int_column("id")];
-        columns[0].nullable = false;
-        columns[0].default = ColumnDefault::Expression(SqlExpression::from_catalog_text("0"));
+        columns[0].info.nullable = false;
+        columns[0].info.default = ColumnDefault::Expression(SqlExpression::from_catalog_text("0"));
 
         let cells = row_to_cells(&[String::new()], &[Some(0)], &columns, &options(), 2).expect("cells");
 
@@ -419,14 +432,50 @@ mod tests {
     #[test]
     fn an_empty_field_for_a_not_null_text_column_with_a_default_stays_empty() {
         let mut columns = vec![text_column("status")];
-        columns[0].nullable = false;
-        columns[0].default = ColumnDefault::Literal(Value::Text("active".to_owned()));
+        columns[0].info.nullable = false;
+        columns[0].info.default = ColumnDefault::Literal(Value::Text("active".to_owned()));
 
         let cells = row_to_cells(&[String::new()], &[Some(0)], &columns, &options(), 2).expect("cells");
 
         assert_eq!(cells[0], CellInput::Value(Value::Text(String::new())));
     }
 
+    #[test]
+    fn a_column_the_server_fills_is_never_mapped_or_written() {
+        let mut columns = vec![int_column("id"), text_column("name")];
+        columns[0].server_filled = true;
+        let headers = vec!["id".to_owned(), "name".to_owned()];
+
+        let mapping = suggest_mapping(&headers, &columns);
+        let cells = row_to_cells(
+            &["7".to_owned(), "ada".to_owned()],
+            &[Some(0), Some(1)],
+            &columns,
+            &options(),
+            2,
+        )
+        .expect("cells");
+
+        assert_eq!(mapping, vec![None, Some(1)]);
+        assert_eq!(
+            cells[0],
+            CellInput::Default,
+            "a value went to a column the server fills"
+        );
+        assert_eq!(cells[1], CellInput::Value(Value::Text("ada".to_owned())));
+    }
+
+    #[test]
+    fn an_auto_increment_column_takes_the_files_value() {
+        let mut columns = vec![int_column("id")];
+        columns[0].info.is_auto_increment = true;
+
+        let mapping = suggest_mapping(&["id".to_owned()], &columns);
+        let cells = row_to_cells(&["100".to_owned()], &mapping, &columns, &options(), 2).expect("cells");
+
+        assert_eq!(cells[0], CellInput::Value(Value::Int(100)));
+    }
+
     #[test]
     fn a_field_the_column_cannot_hold_names_the_row_and_the_cell() {
         let columns = vec![int_column("id")];
diff --git a/linux/crates/core/src/import/import_column.rs b/linux/crates/core/src/import/import_column.rs
new file mode 100644
index 0000000000..16863e34db
--- /dev/null
+++ b/linux/crates/core/src/import/import_column.rs
@@ -0,0 +1,69 @@
+use crate::column::ColumnInfo;
+use crate::ddl::ColumnDefinition;
+
+/// A table column as an import writes it.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ImportColumn {
+    pub info: ColumnInfo,
+    /// The server fills the column whatever the file holds: a generated
+    /// column, or an identity that refuses a value of its own. The
+    /// import never maps a field to it, so no value is dropped unseen.
+    pub server_filled: bool,
+}
+
+impl ImportColumn {
+    pub fn from_definition(definition: &ColumnDefinition) -> Self {
+        Self {
+            server_filled: definition.info.is_generated || !definition.attributes.identity.accepts_explicit_value(),
+            info: definition.info.clone(),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::column::{ColumnDefault, ColumnType};
+    use crate::ddl::{ColumnAttributes, IdentityStyle};
+
+    fn definition(identity: IdentityStyle, generated: bool) -> ColumnDefinition {
+        ColumnDefinition::new(
+            ColumnInfo {
+                name: "id".to_owned(),
+                column_type: ColumnType::unknown(),
+                nullable: false,
+                primary_key: true,
+                is_auto_increment: identity != IdentityStyle::None,
+                is_generated: generated,
+                default: ColumnDefault::None,
+                comment: None,
+            },
+            ColumnAttributes {
+                identity,
+                ..ColumnAttributes::default()
+            },
+        )
+    }
+
+    #[test]
+    fn an_identity_that_takes_a_value_is_filled_from_the_file() {
+        for identity in [
+            IdentityStyle::GeneratedByDefault,
+            IdentityStyle::SequenceDefault,
+            IdentityStyle::AutoIncrementKeyword,
+            IdentityStyle::SqliteRowidAlias,
+        ] {
+            assert!(
+                !ImportColumn::from_definition(&definition(identity, false)).server_filled,
+                "{identity:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_generated_column_or_a_refusing_identity_is_left_to_the_server() {
+        assert!(ImportColumn::from_definition(&definition(IdentityStyle::GeneratedAlways, false)).server_filled);
+        assert!(ImportColumn::from_definition(&definition(IdentityStyle::MssqlIdentity, false)).server_filled);
+        assert!(ImportColumn::from_definition(&definition(IdentityStyle::None, true)).server_filled);
+    }
+}
diff --git a/linux/crates/core/src/import/import_plan.rs b/linux/crates/core/src/import/import_plan.rs
new file mode 100644
index 0000000000..a2caff74a3
--- /dev/null
+++ b/linux/crates/core/src/import/import_plan.rs
@@ -0,0 +1,30 @@
+use crate::column::ColumnInfo;
+use crate::dialect::SqlDialect;
+use crate::dml::{BuildSqlError, build_insert};
+use crate::edit::CellInput;
+use crate::meta::TableRef;
+use crate::statement::GuardedStatement;
+use crate::{ForeignKeyMode, WriteBatch, WriteKind};
+
+use super::ImportColumn;
+
+/// The rows as one batch, so the engine runs them in one transaction
+/// where it has one and a file either lands whole or not at all.
+pub fn plan_import(
+    dialect: &dyn SqlDialect,
+    table: &TableRef,
+    columns: &[ImportColumn],
+    rows: &[Vec<CellInput>],
+) -> Result<WriteBatch, BuildSqlError> {
+    let infos: Vec<ColumnInfo> = columns.iter().map(|column| column.info.clone()).collect();
+    let steps = rows
+        .iter()
+        .map(|cells| build_insert(dialect, table, &infos, cells).map(GuardedStatement::unguarded))
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(WriteBatch::new(
+        WriteKind::RowChanges,
+        table.clone(),
+        steps,
+        ForeignKeyMode::Enforced,
+    ))
+}
diff --git a/linux/crates/core/src/import/mod.rs b/linux/crates/core/src/import/mod.rs
index 8eb926e2c0..059c6eb8b9 100644
--- a/linux/crates/core/src/import/mod.rs
+++ b/linux/crates/core/src/import/mod.rs
@@ -2,7 +2,11 @@
 //! `export`.
 
 mod csv_import;
+mod import_column;
+mod import_plan;
 
 pub use csv_import::{
     CsvImportOptions, CsvRowError, CsvSheet, ImportError, MAX_PREVIEW_ROWS, read_csv, row_to_cells, suggest_mapping,
 };
+pub use import_column::ImportColumn;
+pub use import_plan::plan_import;
diff --git a/linux/crates/drivers/mssql/tests/integration/csv_import.rs b/linux/crates/drivers/mssql/tests/integration/csv_import.rs
new file mode 100644
index 0000000000..3c948d52af
--- /dev/null
+++ b/linux/crates/drivers/mssql/tests/integration/csv_import.rs
@@ -0,0 +1,36 @@
+//! The CSV import against SQL Server, through the same plan the app
+//! runs.
+
+use tablepro_core::Value;
+use tablepro_core::import::CsvImportOptions;
+use tablepro_test_support::import_csv;
+
+use crate::support::{CALL, connect, dbo, rows, setup, start, within};
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn an_identity_column_is_numbered_by_the_server() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    setup(
+        connection.as_ref(),
+        &["CREATE TABLE dbo.people (id int IDENTITY(1,1) PRIMARY KEY, name nvarchar(50))"],
+    )
+    .await;
+
+    import_csv(
+        connection.as_ref(),
+        &dbo("people"),
+        b"id,name\n100,ada\n",
+        &CsvImportOptions::default(),
+        within(CALL),
+    )
+    .await
+    .expect("the import");
+
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT id, name FROM dbo.people").await,
+        vec![vec![Value::Int(1), Value::Text("ada".to_owned())]],
+        "IDENTITY refuses a value without IDENTITY_INSERT, so the server numbers the row"
+    );
+}
diff --git a/linux/crates/drivers/mssql/tests/integration/main.rs b/linux/crates/drivers/mssql/tests/integration/main.rs
index f0188ef6aa..52031244b0 100644
--- a/linux/crates/drivers/mssql/tests/integration/main.rs
+++ b/linux/crates/drivers/mssql/tests/integration/main.rs
@@ -9,6 +9,7 @@
 
 mod cancellation;
 mod conformance_engine;
+mod csv_import;
 mod ddl;
 mod decode;
 mod filter;
diff --git a/linux/crates/drivers/mysql/tests/integration/csv_import.rs b/linux/crates/drivers/mysql/tests/integration/csv_import.rs
new file mode 100644
index 0000000000..77c8ffbb1a
--- /dev/null
+++ b/linux/crates/drivers/mysql/tests/integration/csv_import.rs
@@ -0,0 +1,35 @@
+//! The CSV import against MySQL, through the same plan the app runs.
+
+use tablepro_core::Value;
+use tablepro_core::import::CsvImportOptions;
+use tablepro_test_fixtures::MysqlFlavour;
+use tablepro_test_support::import_csv;
+
+use crate::support::{CALL, connect, rows, setup, start, table, within};
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_file_keeps_its_ids_for_an_auto_increment_column() {
+    let fixture = start(MysqlFlavour::Mysql).await;
+    let connection = connect(&fixture, false).await;
+    setup(
+        connection.as_ref(),
+        &["CREATE TABLE people (id int AUTO_INCREMENT PRIMARY KEY, name text)"],
+    )
+    .await;
+
+    import_csv(
+        connection.as_ref(),
+        &table("people"),
+        b"id,name\n100,ada\n",
+        &CsvImportOptions::default(),
+        within(CALL),
+    )
+    .await
+    .expect("the import");
+
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT id FROM people").await,
+        vec![vec![Value::Int(100)]]
+    );
+}
diff --git a/linux/crates/drivers/mysql/tests/integration/main.rs b/linux/crates/drivers/mysql/tests/integration/main.rs
index 51a48296eb..d8353c8068 100644
--- a/linux/crates/drivers/mysql/tests/integration/main.rs
+++ b/linux/crates/drivers/mysql/tests/integration/main.rs
@@ -7,6 +7,7 @@
 )]
 
 mod conformance_engine;
+mod csv_import;
 mod ddl;
 mod decode;
 mod editor_session;
diff --git a/linux/crates/drivers/postgres/tests/integration/csv_import.rs b/linux/crates/drivers/postgres/tests/integration/csv_import.rs
new file mode 100644
index 0000000000..2638b92908
--- /dev/null
+++ b/linux/crates/drivers/postgres/tests/integration/csv_import.rs
@@ -0,0 +1,50 @@
+//! The CSV import against PostgreSQL, through the same plan the app
+//! runs.
+
+use tablepro_core::import::CsvImportOptions;
+use tablepro_core::{TableRef, Value};
+use tablepro_test_support::import_csv;
+
+use crate::support::{CALL, connect, rows, setup, start, within};
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_file_keeps_its_ids_where_the_identity_takes_them() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    setup(
+        connection.as_ref(),
+        &[
+            "CREATE TABLE serials (id serial PRIMARY KEY, name text)",
+            "CREATE TABLE by_default (id int GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, name text)",
+            "CREATE TABLE always (id int GENERATED ALWAYS AS IDENTITY PRIMARY KEY, name text)",
+        ],
+    )
+    .await;
+
+    for table in ["serials", "by_default", "always"] {
+        import_csv(
+            connection.as_ref(),
+            &TableRef::new(Some("public".to_owned()), table),
+            b"id,name\n100,ada\n",
+            &CsvImportOptions::default(),
+            within(CALL),
+        )
+        .await
+        .unwrap_or_else(|failure| panic!("the import into {table}: {failure:?}"));
+    }
+
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT id FROM serials").await,
+        vec![vec![Value::Int(100)]]
+    );
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT id FROM by_default").await,
+        vec![vec![Value::Int(100)]]
+    );
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT id, name FROM always").await,
+        vec![vec![Value::Int(1), Value::Text("ada".to_owned())]],
+        "GENERATED ALWAYS refuses a value, so the server numbers the row"
+    );
+}
diff --git a/linux/crates/drivers/postgres/tests/integration/main.rs b/linux/crates/drivers/postgres/tests/integration/main.rs
index 91981dcf07..180c427c51 100644
--- a/linux/crates/drivers/postgres/tests/integration/main.rs
+++ b/linux/crates/drivers/postgres/tests/integration/main.rs
@@ -8,6 +8,7 @@
 
 mod cancellation;
 mod conformance_engine;
+mod csv_import;
 mod ddl;
 mod decode;
 mod editor_session;
diff --git a/linux/crates/drivers/sqlite/tests/csv_import.rs b/linux/crates/drivers/sqlite/tests/csv_import.rs
index 8dc3e3cbd2..bb8223e749 100644
--- a/linux/crates/drivers/sqlite/tests/csv_import.rs
+++ b/linux/crates/drivers/sqlite/tests/csv_import.rs
@@ -9,7 +9,7 @@ use drivers_sqlite::SqliteDriver;
 use sqlx::Connection as _;
 use sqlx::sqlite::{SqliteConnectOptions, SqliteConnection};
 use tablepro_core::dml::build_insert;
-use tablepro_core::import::{CsvImportOptions, read_csv, row_to_cells, suggest_mapping};
+use tablepro_core::import::{CsvImportOptions, ImportColumn, read_csv, row_to_cells};
 use tablepro_core::meta::TableRef;
 use tablepro_core::statement::{GuardedStatement, StatementBuilder};
 use tablepro_core::{
@@ -17,6 +17,7 @@ use tablepro_core::{
     ForeignKeyMode, LivenessPolicy, QueryResult, RowLimit, Value, WorkspaceSettings, WriteBatch, WriteKind,
     WriteReport,
 };
+use tablepro_test_support::import_csv;
 use tempfile::TempDir;
 use tokio::time::Instant;
 use tokio_util::sync::CancellationToken;
@@ -90,23 +91,9 @@ async fn import(
     csv: &[u8],
     options: &CsvImportOptions,
 ) -> Result<Vec<Option<u64>>, String> {
-    let table_ref = TableRef::unqualified(table);
-    let columns = connection
-        .fetch_columns(&table_ref, call())
+    let report = import_csv(connection, &TableRef::unqualified(table), csv, options, call())
         .await
-        .map_err(|error| error.to_string())?;
-    let sheet = read_csv(csv, options, None).map_err(|error| error.to_string())?;
-    let mapping = suggest_mapping(&sheet.headers, &columns);
-    let dialect = connection.dialect();
-
-    let mut steps = Vec::new();
-    for (index, row) in sheet.rows.iter().enumerate() {
-        let cells = row_to_cells(row, &mapping, &columns, options, index + 2).map_err(|error| error.reason)?;
-        let statement =
-            build_insert(dialect.as_ref(), &table_ref, &columns, &cells).map_err(|error| error.to_string())?;
-        steps.push(GuardedStatement::unguarded(statement));
-    }
-    let report = save(connection, WriteKind::RowChanges, table, steps).await?;
+        .map_err(|failure| format!("{failure:?}"))?;
     Ok(report.rows_affected)
 }
 
@@ -170,6 +157,32 @@ async fn a_column_the_file_does_not_name_keeps_its_default() {
     connection.close().await.expect("the close");
 }
 
+#[tokio::test]
+async fn an_id_from_the_file_is_kept_for_a_rowid_alias() {
+    let (_directory, connection) = open().await.expect("a database file");
+    create(
+        connection.as_ref(),
+        "CREATE TABLE people (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT)",
+    )
+    .await
+    .expect("the table");
+
+    import(
+        connection.as_ref(),
+        "people",
+        b"id,name\n100,ada\n",
+        &CsvImportOptions::default(),
+    )
+    .await
+    .expect("the import");
+
+    let rows = query(connection.as_ref(), "SELECT id, name FROM people")
+        .await
+        .expect("the rows");
+    assert_eq!(rows.rows[0][0], Value::Int(100), "the file's id was replaced");
+    connection.close().await.expect("the close");
+}
+
 #[tokio::test]
 async fn an_empty_field_is_kept_as_an_empty_string_over_the_default() {
     let (_directory, connection) = open().await.expect("a database file");
@@ -269,11 +282,16 @@ async fn a_semicolon_file_without_a_header_imports_by_position() {
     assert_eq!(sheet.headers, vec!["Column 1", "Column 2"]);
 
     let table = TableRef::unqualified("pairs");
-    let columns = connection.fetch_columns(&table, call()).await.expect("the columns");
+    let definition = connection
+        .fetch_table_definition(&table, call())
+        .await
+        .expect("the table");
+    let columns: Vec<ImportColumn> = definition.columns.iter().map(ImportColumn::from_definition).collect();
+    let infos: Vec<_> = columns.iter().map(|column| column.info.clone()).collect();
     let mapping = vec![Some(0), Some(1)];
     let cells = row_to_cells(&sheet.rows[0], &mapping, &columns, &options, 1).expect("the cells");
     let dialect = connection.dialect();
-    let statement = build_insert(dialect.as_ref(), &table, &columns, &cells).expect("the insert");
+    let statement = build_insert(dialect.as_ref(), &table, &infos, &cells).expect("the insert");
     save(
         connection.as_ref(),
         WriteKind::RowChanges,
diff --git a/linux/crates/test-support/src/csv_import.rs b/linux/crates/test-support/src/csv_import.rs
new file mode 100644
index 0000000000..084b9c210c
--- /dev/null
+++ b/linux/crates/test-support/src/csv_import.rs
@@ -0,0 +1,49 @@
+//! The CSV import as the app runs it, from the file's bytes to the rows
+//! in the table, so each driver's tests run it against the real engine.
+
+use tablepro_core::dml::BuildSqlError;
+use tablepro_core::import::{
+    CsvImportOptions, CsvRowError, ImportColumn, ImportError, plan_import, read_csv, row_to_cells, suggest_mapping,
+};
+use tablepro_core::meta::TableRef;
+use tablepro_core::{CallOptions, Connection, DriverError, WriteReport};
+
+/// Where an import stopped.
+#[derive(Debug)]
+pub enum CsvImportFailure {
+    Read(ImportError),
+    Row(CsvRowError),
+    Build(BuildSqlError),
+    Driver(DriverError),
+}
+
+/// Import `csv` into `table`, each column taking the field its header
+/// names, as the mapping dialog first suggests.
+pub async fn import_csv(
+    connection: &dyn Connection,
+    table: &TableRef,
+    csv: &[u8],
+    options: &CsvImportOptions,
+    call: CallOptions,
+) -> Result<WriteReport, CsvImportFailure> {
+    let definition = connection
+        .fetch_table_definition(table, call.clone())
+        .await
+        .map_err(CsvImportFailure::Driver)?;
+    let columns: Vec<ImportColumn> = definition.columns.iter().map(ImportColumn::from_definition).collect();
+    let sheet = read_csv(csv, options, None).map_err(CsvImportFailure::Read)?;
+    let mapping = suggest_mapping(&sheet.headers, &columns);
+    let first_line = if options.has_header { 2 } else { 1 };
+    let rows = sheet
+        .rows
+        .iter()
+        .enumerate()
+        .map(|(index, row)| row_to_cells(row, &mapping, &columns, options, first_line + index))
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(CsvImportFailure::Row)?;
+    let batch = plan_import(connection.dialect().as_ref(), table, &columns, &rows).map_err(CsvImportFailure::Build)?;
+    connection
+        .write_batch(&batch, call)
+        .await
+        .map_err(CsvImportFailure::Driver)
+}
diff --git a/linux/crates/test-support/src/lib.rs b/linux/crates/test-support/src/lib.rs
index 6e6ba8a9af..f9d726f6b0 100644
--- a/linux/crates/test-support/src/lib.rs
+++ b/linux/crates/test-support/src/lib.rs
@@ -12,6 +12,7 @@ mod close_behaviour;
 mod close_race;
 pub mod conformance;
 mod connection_script;
+mod csv_import;
 mod executable;
 mod fake_connection;
 mod fake_dialect;
@@ -29,6 +30,7 @@ mod stream_end;
 pub use call_counters::CallCounters;
 pub use close_behaviour::CloseBehaviour;
 pub use connection_script::ConnectionScript;
+pub use csv_import::{CsvImportFailure, import_csv};
 pub use executable::write_executable;
 pub use fake_connection::FakeConnection;
 pub use fake_dialect::FakeDialect;

From d5a54f6fb83125f38c865da0624e3bbe10467b08 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:23:56 +0700
Subject: [PATCH 03/15] fix(linux-export): keep CR in XML and refuse control
 characters

---
 .../app/src/ui/clipboard/clipboard_copy.rs    |   4 +
 .../app/src/ui/export/export_failure_text.rs  |  35 +++++-
 .../core/src/export/encoder/encode_error.rs   |   5 +
 linux/crates/core/src/export/encoder/mod.rs   |   2 +-
 linux/crates/core/src/export/encoder/tests.rs |   4 +-
 .../core/src/export/encoder/xml_encoder.rs    |   2 +-
 linux/crates/core/src/export/xml.rs           | 102 ++++++++++++------
 7 files changed, 115 insertions(+), 39 deletions(-)

diff --git a/linux/crates/app/src/ui/clipboard/clipboard_copy.rs b/linux/crates/app/src/ui/clipboard/clipboard_copy.rs
index e439fa013f..a2fbb2be01 100644
--- a/linux/crates/app/src/ui/clipboard/clipboard_copy.rs
+++ b/linux/crates/app/src/ui/clipboard/clipboard_copy.rs
@@ -170,6 +170,10 @@ fn copy_error_text(error: &CopyError) -> String {
             "Couldn't copy: the column “{column}” holds a value TablePro couldn't read",
             &[("column", column)],
         ),
+        CopyError::Encode(EncodeError::NotXmlText { column }) => gettext_f(
+            "Couldn't copy: the column “{column}” holds a control character",
+            &[("column", column)],
+        ),
         CopyError::Insert(RenderInsertError::Literal(_)) => {
             gettext("This row has a value that can't be written as SQL")
         }
diff --git a/linux/crates/app/src/ui/export/export_failure_text.rs b/linux/crates/app/src/ui/export/export_failure_text.rs
index 0f5705b4c7..8aa8be2e48 100644
--- a/linux/crates/app/src/ui/export/export_failure_text.rs
+++ b/linux/crates/app/src/ui/export/export_failure_text.rs
@@ -53,10 +53,7 @@ pub(crate) fn progress_text(rows: u64, expected: Option<ExpectedRows>) -> String
 /// file.
 pub(crate) fn failure_text(failure: &ExportFailure, file: Option<AbortOutcome>, name: &str) -> String {
     let reason = match failure {
-        ExportFailure::Stream(ExportStreamFailure::Encode(EncodeError::Undecodable { column })) => gettext_f(
-            "The column “{column}” holds a value TablePro couldn't read, so it can't be written to the file.",
-            &[("column", column)],
-        ),
+        ExportFailure::Stream(ExportStreamFailure::Encode(error)) => encode_text(error),
         ExportFailure::Stream(ExportStreamFailure::MultipleResultSets) => {
             gettext("This statement returned more than one result, so it can't be exported as one file.")
         }
@@ -108,6 +105,20 @@ fn rerun_text(error: &OperationError) -> String {
     }
 }
 
+/// Why a value could not go into the file, whichever format refused it.
+fn encode_text(error: &EncodeError) -> String {
+    match error {
+        EncodeError::Undecodable { column } => gettext_f(
+            "The column “{column}” holds a value TablePro couldn't read, so it can't be written to the file.",
+            &[("column", column)],
+        ),
+        EncodeError::NotXmlText { column } => gettext_f(
+            "The column “{column}” holds a control character XML can't carry. Export it as CSV or JSON instead.",
+            &[("column", column)],
+        ),
+    }
+}
+
 fn document_text(error: &RenderError) -> String {
     match error {
         RenderError::TooManyRows { got, limit } => gettext_f(
@@ -273,4 +284,20 @@ mod tests {
             "An Excel sheet holds 100 rows, and this result has more. Export it as CSV instead."
         );
     }
+
+    #[test]
+    fn xml_names_the_column_with_a_control_character() {
+        let text = failure_text(
+            &ExportFailure::Stream(ExportStreamFailure::Encode(EncodeError::NotXmlText {
+                column: "note".to_owned(),
+            })),
+            None,
+            "rows.xml",
+        );
+
+        assert_eq!(
+            text,
+            "The column “note” holds a control character XML can't carry. Export it as CSV or JSON instead."
+        );
+    }
 }
diff --git a/linux/crates/core/src/export/encoder/encode_error.rs b/linux/crates/core/src/export/encoder/encode_error.rs
index 4a7c6c2eef..51a08d790f 100644
--- a/linux/crates/core/src/export/encoder/encode_error.rs
+++ b/linux/crates/core/src/export/encoder/encode_error.rs
@@ -6,4 +6,9 @@ use thiserror::Error;
 pub enum EncodeError {
     #[error("column {column} has an undecodable value")]
     Undecodable { column: String },
+
+    /// A control character XML 1.0 has no representation for, not even
+    /// as a character reference.
+    #[error("column {column} holds a character XML cannot carry")]
+    NotXmlText { column: String },
 }
diff --git a/linux/crates/core/src/export/encoder/mod.rs b/linux/crates/core/src/export/encoder/mod.rs
index a45a7683cb..830910ea51 100644
--- a/linux/crates/core/src/export/encoder/mod.rs
+++ b/linux/crates/core/src/export/encoder/mod.rs
@@ -56,7 +56,7 @@ fn readable_cells<'a>(
 }
 
 /// A column's name, or its position for a cell past the header.
-fn column_name(columns: &[ResultColumn], index: usize) -> String {
+pub(in crate::export) fn column_name(columns: &[ResultColumn], index: usize) -> String {
     columns
         .get(index)
         .map_or_else(|| (index + 1).to_string(), |column| column.name.clone())
diff --git a/linux/crates/core/src/export/encoder/tests.rs b/linux/crates/core/src/export/encoder/tests.rs
index c9ae68794b..5f69752786 100644
--- a/linux/crates/core/src/export/encoder/tests.rs
+++ b/linux/crates/core/src/export/encoder/tests.rs
@@ -288,7 +288,7 @@ fn document_encoders_match_their_renderers() {
     );
     assert_eq!(
         streamed(XmlEncoder::new(columns.clone()), &rows),
-        render_xml(&columns, &rows)
+        render_xml(&columns, &rows).expect("the document")
     );
     assert_eq!(
         streamed(SqlInsertEncoder::new(dialect.clone(), "t", columns.clone()), &rows),
@@ -307,7 +307,7 @@ fn document_encoders_write_whole_documents_for_no_rows() {
     );
     assert_eq!(
         streamed(XmlEncoder::new(columns.clone()), &[]),
-        render_xml(&columns, &[])
+        render_xml(&columns, &[]).expect("the document")
     );
     assert_eq!(streamed(SqlInsertEncoder::new(dialect.clone(), "t", columns), &[]), "");
     assert_eq!(
diff --git a/linux/crates/core/src/export/encoder/xml_encoder.rs b/linux/crates/core/src/export/encoder/xml_encoder.rs
index 866bfa0093..7be654c35c 100644
--- a/linux/crates/core/src/export/encoder/xml_encoder.rs
+++ b/linux/crates/core/src/export/encoder/xml_encoder.rs
@@ -25,7 +25,7 @@ impl RowEncoder for XmlEncoder {
     fn row(&mut self, out: &mut Vec<u8>, cells: &mut dyn Iterator<Item = &Value>) -> Result<(), EncodeError> {
         let cells = readable_cells(&self.columns, cells)?;
         let mut row = String::new();
-        xml_row(&mut row, &self.columns, cells);
+        xml_row(&mut row, &self.columns, cells)?;
         out.extend_from_slice(row.as_bytes());
         Ok(())
     }
diff --git a/linux/crates/core/src/export/xml.rs b/linux/crates/core/src/export/xml.rs
index 31a45af683..e19e1cd8db 100644
--- a/linux/crates/core/src/export/xml.rs
+++ b/linux/crates/core/src/export/xml.rs
@@ -2,6 +2,7 @@ use crate::column::ResultColumn;
 use crate::value::Value;
 
 use super::column_type;
+use super::encoder::{EncodeError, XmlEncoder, encode_rows};
 use super::value_text::value_text;
 
 /// A result as XML.
@@ -10,33 +11,35 @@ use super::value_text::value_text;
 /// because a SQL column may be called `order total` or `1`, and
 /// neither is a name XML allows. Putting it in an attribute keeps
 /// every result representable without renaming the user's columns.
-pub fn render_xml(columns: &[ResultColumn], rows: &[Vec<Value>]) -> String {
-    let mut out = String::with_capacity(rows.len() * columns.len() * 24);
-    out.push_str(XML_HEAD);
-    for row in rows {
-        xml_row(&mut out, columns, row);
-    }
-    out.push_str(XML_TAIL);
-    out
+pub fn render_xml(columns: &[ResultColumn], rows: &[Vec<Value>]) -> Result<String, EncodeError> {
+    encode_rows(XmlEncoder::new(columns.into()), rows)
 }
 
 pub(super) const XML_HEAD: &str = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<rows>\n";
 
 pub(super) const XML_TAIL: &str = "</rows>\n";
 
-pub(super) fn xml_row<'a>(out: &mut String, columns: &[ResultColumn], row: impl IntoIterator<Item = &'a Value>) {
+/// One row, or the column holding a character XML 1.0 cannot carry.
+pub(super) fn xml_row<'a>(
+    out: &mut String,
+    columns: &[ResultColumn],
+    row: impl IntoIterator<Item = &'a Value>,
+) -> Result<(), EncodeError> {
     out.push_str("  <row>\n");
     for (index, value) in row.into_iter().enumerate() {
         let name = columns
             .get(index)
             .map(|column| column.name.as_str())
             .unwrap_or_default();
+        let refused = || EncodeError::NotXmlText {
+            column: super::encoder::column_name(columns, index),
+        };
         out.push_str("    <field name=\"");
-        escape_into(out, name);
+        escape_into(out, name, Position::Attribute).map_err(|_| refused())?;
         match value_text(value, column_type(columns, index)) {
             Some(text) => {
                 out.push_str("\">");
-                escape_into(out, &text);
+                escape_into(out, &text, Position::Text).map_err(|_| refused())?;
                 out.push_str("</field>\n");
             }
             // An empty element with the flag, so a NULL reads back as
@@ -45,17 +48,27 @@ pub(super) fn xml_row<'a>(out: &mut String, columns: &[ResultColumn], row: impl
         }
     }
     out.push_str("  </row>\n");
+    Ok(())
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Position {
+    Text,
+    Attribute,
 }
 
-/// Escape for both text and attribute positions, and drop what XML 1.0
-/// cannot carry at all.
+/// A character XML 1.0 has no representation for.
+struct NotXmlText;
+
+/// Escape for a text or attribute position.
 ///
-/// The control characters below `space`, apart from tab, newline and
-/// carriage return, have no representation in XML 1.0: a numeric
-/// reference to them is as invalid as the character itself. A document
-/// containing one would fail to parse, so they are dropped and the
-/// rest of the value is kept.
-fn escape_into(out: &mut String, text: &str) {
+/// A parser reads a raw carriage return back as a line feed, and a raw
+/// tab or line feed in an attribute as a space, so those go in as
+/// character references. The control characters below `space` other
+/// than tab, line feed and carriage return have no representation in
+/// XML 1.0, not even as a reference, so a value holding one is refused
+/// rather than written without it.
+fn escape_into(out: &mut String, text: &str, position: Position) -> Result<(), NotXmlText> {
     for ch in text.chars() {
         match ch {
             '&' => out.push_str("&amp;"),
@@ -63,14 +76,17 @@ fn escape_into(out: &mut String, text: &str) {
             '>' => out.push_str("&gt;"),
             '"' => out.push_str("&quot;"),
             '\'' => out.push_str("&apos;"),
-            '\t' | '\n' | '\r' => out.push(ch),
-            other if (other as u32) < 0x20 => {}
+            '\r' => out.push_str("&#13;"),
+            '\t' if position == Position::Attribute => out.push_str("&#9;"),
+            '\n' if position == Position::Attribute => out.push_str("&#10;"),
+            '\t' | '\n' => out.push(ch),
             // The surrogate range cannot appear in a Rust `char`, and
             // these two are the remaining non-characters XML refuses.
-            '\u{FFFE}' | '\u{FFFF}' => {}
+            other if (other as u32) < 0x20 || matches!(other, '\u{FFFE}' | '\u{FFFF}') => return Err(NotXmlText),
             other => out.push(other),
         }
     }
+    Ok(())
 }
 
 #[cfg(test)]
@@ -83,7 +99,7 @@ mod tests {
         let columns = cols(&["order total", "1"]);
         let rows = vec![vec![Value::Int(2), Value::Int(3)]];
 
-        let xml = render_xml(&columns, &rows);
+        let xml = render_xml(&columns, &rows).expect("the document");
 
         assert!(xml.contains("<field name=\"order total\">2</field>"), "{xml}");
         assert!(xml.contains("<field name=\"1\">3</field>"), "{xml}");
@@ -93,7 +109,7 @@ mod tests {
     fn markup_in_a_value_is_escaped() {
         let rows = vec![vec![Value::Text("a < b & \"c\"".into())]];
 
-        let xml = render_xml(&cols(&["a"]), &rows);
+        let xml = render_xml(&cols(&["a"]), &rows).expect("the document");
 
         assert!(xml.contains("a &lt; b &amp; &quot;c&quot;"), "{xml}");
     }
@@ -102,25 +118,49 @@ mod tests {
     fn a_null_is_told_apart_from_the_empty_string() {
         let rows = vec![vec![Value::Null, Value::Text(String::new())]];
 
-        let xml = render_xml(&cols(&["a", "b"]), &rows);
+        let xml = render_xml(&cols(&["a", "b"]), &rows).expect("the document");
 
         assert!(xml.contains("<field name=\"a\" null=\"true\"/>"), "{xml}");
         assert!(xml.contains("<field name=\"b\"></field>"), "{xml}");
     }
 
+    fn encoded_row(columns: &[ResultColumn], row: &[Value]) -> Result<String, EncodeError> {
+        use super::super::RowEncoder;
+
+        let mut out = Vec::new();
+        XmlEncoder::new(columns.into()).row(&mut out, &mut row.iter())?;
+        Ok(String::from_utf8(out).expect("utf-8"))
+    }
+
     #[test]
-    fn a_character_xml_cannot_carry_is_dropped_rather_than_breaking_the_document() {
-        let rows = vec![vec![Value::Text("a\u{1}b\tc".into())]];
+    fn a_carriage_return_survives_a_parser_reading_it_back() {
+        let xml = encoded_row(&cols(&["a\rb"]), &[Value::Text("one\r\ntwo\rthree\tfour".into())]).expect("the row");
 
-        let xml = render_xml(&cols(&["a"]), &rows);
+        assert!(
+            xml.contains("<field name=\"a&#13;b\">one&#13;\ntwo&#13;three\tfour</field>"),
+            "{xml}"
+        );
+    }
+
+    #[test]
+    fn a_break_in_a_column_name_is_kept_in_its_attribute() {
+        let xml = encoded_row(&cols(&["a\tb\nc"]), &[Value::Int(1)]).expect("the row");
+
+        assert!(xml.contains("<field name=\"a&#9;b&#10;c\">1</field>"), "{xml}");
+    }
+
+    #[test]
+    fn a_character_xml_cannot_carry_is_refused_rather_than_dropped() {
+        let refused = encoded_row(&cols(&["a"]), &[Value::Text("a\u{1}b\tc".into())]);
+        let refused_name = encoded_row(&cols(&["a\u{1}"]), &[Value::Int(1)]);
 
-        assert!(xml.contains("<field name=\"a\">ab\tc</field>"), "{xml}");
-        assert!(!xml.contains('\u{1}'), "an unrepresentable character survived");
+        assert_eq!(refused, Err(EncodeError::NotXmlText { column: "a".to_owned() }));
+        assert!(refused_name.is_err(), "{refused_name:?}");
     }
 
     #[test]
     fn an_empty_result_is_still_a_document() {
-        let xml = render_xml(&cols(&["a"]), &[]);
+        let xml = render_xml(&cols(&["a"]), &[]).expect("the document");
 
         assert!(xml.starts_with("<?xml version=\"1.0\" encoding=\"UTF-8\"?>"), "{xml}");
         assert!(xml.contains("<rows>\n</rows>"), "{xml}");

From cb5c8827ddea0eaeef490411a1e77eaed5b0c4a9 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:24:05 +0700
Subject: [PATCH 04/15] fix(linux-export): refuse an unreadable value in XLSX,
 not a blank

---
 .../app/src/ui/export/export_failure_text.rs  | 21 +++++++++++++++
 linux/crates/core/src/export/mod.rs           |  5 ++++
 linux/crates/core/src/export/xlsx.rs          | 26 ++++++++++++++++++-
 3 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/linux/crates/app/src/ui/export/export_failure_text.rs b/linux/crates/app/src/ui/export/export_failure_text.rs
index 8aa8be2e48..b6a13a0fe6 100644
--- a/linux/crates/app/src/ui/export/export_failure_text.rs
+++ b/linux/crates/app/src/ui/export/export_failure_text.rs
@@ -121,6 +121,7 @@ fn encode_text(error: &EncodeError) -> String {
 
 fn document_text(error: &RenderError) -> String {
     match error {
+        RenderError::Encode(error) => encode_text(error),
         RenderError::TooManyRows { got, limit } => gettext_f(
             "An Excel sheet holds {limit} rows, and this result has {got}.",
             &[
@@ -285,6 +286,26 @@ mod tests {
         );
     }
 
+    fn document(error: RenderError) -> String {
+        failure_text(
+            &ExportFailure::Stream(ExportStreamFailure::Document(error)),
+            None,
+            "rows.xlsx",
+        )
+    }
+
+    #[test]
+    fn a_sheet_names_the_column_it_could_not_read() {
+        let unreadable = document(RenderError::Encode(EncodeError::Undecodable {
+            column: "body".to_owned(),
+        }));
+
+        assert_eq!(
+            unreadable,
+            "The column “body” holds a value TablePro couldn't read, so it can't be written to the file."
+        );
+    }
+
     #[test]
     fn xml_names_the_column_with_a_control_character() {
         let text = failure_text(
diff --git a/linux/crates/core/src/export/mod.rs b/linux/crates/core/src/export/mod.rs
index 3079cde8aa..f81d533324 100644
--- a/linux/crates/core/src/export/mod.rs
+++ b/linux/crates/core/src/export/mod.rs
@@ -57,6 +57,11 @@ pub enum RenderError {
 
     #[error("a sheet holds {limit} columns, and this result has {got}")]
     TooManyColumns { got: usize, limit: usize },
+
+    /// A value the file cannot carry, refused as every row encoder
+    /// refuses it.
+    #[error(transparent)]
+    Encode(#[from] EncodeError),
 }
 
 /// The text of one cell, at the precision its column declares.
diff --git a/linux/crates/core/src/export/xlsx.rs b/linux/crates/core/src/export/xlsx.rs
index 6b4a3a1ce4..dda13da22a 100644
--- a/linux/crates/core/src/export/xlsx.rs
+++ b/linux/crates/core/src/export/xlsx.rs
@@ -2,7 +2,8 @@ use std::sync::Arc;
 
 use rust_xlsxwriter::{Format, Workbook, Worksheet};
 
-use super::{RenderError, cell_text};
+use super::encoder::column_name;
+use super::{EncodeError, RenderError, cell_text};
 use crate::column::ResultColumn;
 use crate::value::{Temporal, Value};
 
@@ -133,6 +134,12 @@ fn write_cell(
         // A blank cell, not an empty string: Excel's COUNT and AVERAGE
         // read the two differently, and NULL is the absent one.
         Value::Null => Ok(()),
+        // Left blank, it would read as a NULL the table does not hold.
+        Value::Undecodable(_) => {
+            return Err(RenderError::Encode(EncodeError::Undecodable {
+                column: column_name(columns, usize::from(column)),
+            }));
+        }
         Value::Bool(flag) => sheet.write_boolean(row, column, *flag).map(drop),
         Value::Date(Temporal::Finite(day)) => sheet.write_datetime_with_format(row, column, day, date).map(drop),
         Value::Timestamp(Temporal::Finite(at)) => {
@@ -388,6 +395,23 @@ mod tests {
         );
     }
 
+    fn undecodable() -> Value {
+        Value::Undecodable(Box::new(crate::value::UndecodedValue {
+            type_name: "text".to_owned(),
+            reason: crate::value::UndecodableReason::InvalidEncoding,
+        }))
+    }
+
+    #[test]
+    fn an_unreadable_value_is_refused_rather_than_written_as_a_blank() {
+        let refused = render_xlsx(&cols(&["id", "body"]), &[vec![Value::Int(1), undecodable()]], "Results");
+
+        assert!(
+            matches!(&refused, Err(RenderError::Encode(EncodeError::Undecodable { column })) if column == "body"),
+            "{refused:?}"
+        );
+    }
+
     #[test]
     fn every_value_kind_writes_without_failing() {
         let columns = cols(&["a", "b", "c", "d", "e", "f", "g"]);

From f2448b4e9b98da349883e66beea109ce999995cd Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:24:57 +0700
Subject: [PATCH 05/15] fix(linux-export): write 16-digit XLSX numbers as text,
 name long cells

---
 .../app/src/ui/export/export_failure_text.rs  | 17 +++-
 linux/crates/core/src/export/mod.rs           |  3 +
 linux/crates/core/src/export/xlsx.rs          | 99 +++++++++++++++++--
 3 files changed, 108 insertions(+), 11 deletions(-)

diff --git a/linux/crates/app/src/ui/export/export_failure_text.rs b/linux/crates/app/src/ui/export/export_failure_text.rs
index b6a13a0fe6..12d87717e1 100644
--- a/linux/crates/app/src/ui/export/export_failure_text.rs
+++ b/linux/crates/app/src/ui/export/export_failure_text.rs
@@ -122,6 +122,10 @@ fn encode_text(error: &EncodeError) -> String {
 fn document_text(error: &RenderError) -> String {
     match error {
         RenderError::Encode(error) => encode_text(error),
+        RenderError::TextTooLong { column, limit } => gettext_f(
+            "The column “{column}” holds a value longer than the {limit} characters an Excel cell holds. Export it as CSV instead.",
+            &[("column", column), ("limit", &format_thousands(*limit as u64))],
+        ),
         RenderError::TooManyRows { got, limit } => gettext_f(
             "An Excel sheet holds {limit} rows, and this result has {got}.",
             &[
@@ -295,15 +299,26 @@ mod tests {
     }
 
     #[test]
-    fn a_sheet_names_the_column_it_could_not_read() {
+    fn a_sheet_names_the_column_it_could_not_write() {
         let unreadable = document(RenderError::Encode(EncodeError::Undecodable {
             column: "body".to_owned(),
         }));
+        let long = document(RenderError::TextTooLong {
+            column: "body".to_owned(),
+            limit: 32_767,
+        });
 
         assert_eq!(
             unreadable,
             "The column “body” holds a value TablePro couldn't read, so it can't be written to the file."
         );
+        assert_eq!(
+            long,
+            format!(
+                "The column “body” holds a value longer than the {} characters an Excel cell holds. Export it as CSV instead.",
+                format_thousands(32_767)
+            )
+        );
     }
 
     #[test]
diff --git a/linux/crates/core/src/export/mod.rs b/linux/crates/core/src/export/mod.rs
index f81d533324..97091039c2 100644
--- a/linux/crates/core/src/export/mod.rs
+++ b/linux/crates/core/src/export/mod.rs
@@ -58,6 +58,9 @@ pub enum RenderError {
     #[error("a sheet holds {limit} columns, and this result has {got}")]
     TooManyColumns { got: usize, limit: usize },
 
+    #[error("column {column} holds a value longer than the {limit} characters a sheet cell holds")]
+    TextTooLong { column: String, limit: usize },
+
     /// A value the file cannot carry, refused as every row encoder
     /// refuses it.
     #[error(transparent)]
diff --git a/linux/crates/core/src/export/xlsx.rs b/linux/crates/core/src/export/xlsx.rs
index dda13da22a..4e0fa5deb5 100644
--- a/linux/crates/core/src/export/xlsx.rs
+++ b/linux/crates/core/src/export/xlsx.rs
@@ -12,6 +12,14 @@ use crate::value::{Temporal, Value};
 const MAX_ROWS: usize = 1_048_576;
 const MAX_COLUMNS: usize = 16_384;
 
+/// The characters one cell holds.
+const MAX_CELL_CHARS: usize = 32_767;
+
+/// The significant digits Excel keeps of a number. A number with more
+/// comes back changed even when an f64 holds it exactly:
+/// `4111111111111111` reads back as `4111111111111110`.
+const EXCEL_DIGITS: usize = 15;
+
 /// The rows a sheet holds under its header row.
 pub const XLSX_MAX_DATA_ROWS: usize = MAX_ROWS - 1;
 
@@ -152,7 +160,7 @@ fn write_cell(
             .map(drop),
         _ => match sheet_number(columns, column, value) {
             Some(number) => sheet.write_number(row, column, number).map(drop),
-            None => write_text(sheet, row, column, columns, value),
+            None => return write_text(sheet, row, column, columns, value),
         },
     }
     .map_err(xlsx_error)
@@ -175,24 +183,35 @@ fn sheet_number(columns: &[ResultColumn], column: u16, value: &Value) -> Option<
 }
 
 /// Everything else goes in as the same text the other exports write,
-/// so a cell reads the same whichever format the user picked.
+/// so a cell reads the same whichever format the user picked. A value
+/// longer than a cell holds is refused by name rather than cut.
 fn write_text(
     sheet: &mut Worksheet,
     row: u32,
     column: u16,
     columns: &[ResultColumn],
     value: &Value,
-) -> Result<(), rust_xlsxwriter::XlsxError> {
-    match cell_text(columns, column as usize, value) {
-        Some(text) => sheet.write_string(row, column, text).map(drop),
-        None => Ok(()),
+) -> Result<(), RenderError> {
+    let Some(text) = cell_text(columns, column as usize, value) else {
+        return Ok(());
+    };
+    if text.chars().count() > MAX_CELL_CHARS {
+        return Err(RenderError::TextTooLong {
+            column: column_name(columns, usize::from(column)),
+            limit: MAX_CELL_CHARS,
+        });
     }
+    sheet.write_string(row, column, text).map(drop).map_err(xlsx_error)
 }
 
-/// The value as an f64, when that f64 prints back as the same number.
-/// `None` when it does not, which is the case this exists to catch.
+/// The value as an f64, when that f64 prints back as the same number
+/// and Excel keeps all its digits. `None` when it does not, which is the
+/// case this exists to catch.
 fn exact_number(columns: &[ResultColumn], column: u16, value: &Value) -> Option<f64> {
     let text = cell_text(columns, column as usize, value)?;
+    if significant_digits(&text) > EXCEL_DIGITS {
+        return None;
+    }
     let parsed: f64 = text.parse().ok()?;
     // `{}` on an f64 prints the shortest form that round-trips, so
     // comparing against it is comparing the value, not the spelling.
@@ -203,6 +222,13 @@ fn exact_number(columns: &[ResultColumn], column: u16, value: &Value) -> Option<
     }
 }
 
+/// The digits between the first and last nonzero ones: `-0.0120` has
+/// two, and `1000` has one.
+fn significant_digits(text: &str) -> usize {
+    let digits: String = text.chars().filter(char::is_ascii_digit).collect();
+    digits.trim_start_matches('0').trim_end_matches('0').len()
+}
+
 fn without_scale_padding(text: &str) -> &str {
     match text.contains('.') {
         true => text.trim_end_matches('0').trim_end_matches('.'),
@@ -322,8 +348,8 @@ mod tests {
 
         assert_eq!(sheet_number(&columns, 0, &Value::Int(42)), Some(42.0));
         assert_eq!(
-            sheet_number(&columns, 0, &Value::Int(-(1 << 53))),
-            Some(-9_007_199_254_740_992.0)
+            sheet_number(&columns, 0, &Value::Int(-999_999_999_999_999)),
+            Some(-999_999_999_999_999.0)
         );
         assert_eq!(sheet_number(&columns, 0, &Value::Int((1 << 53) + 1)), None);
         assert_eq!(sheet_number(&columns, 0, &Value::UInt(u64::MAX)), None);
@@ -412,6 +438,59 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_number_past_fifteen_digits_stays_text() {
+        let columns = cols(&["card"]);
+
+        assert_eq!(
+            sheet_number(&columns, 0, &Value::Int(4_111_111_111_111_111)),
+            None,
+            "Excel shows 4111111111111110"
+        );
+        assert_eq!(
+            sheet_number(
+                &columns,
+                0,
+                &Value::Decimal("12345678901234.56".parse().expect("decimal"))
+            ),
+            None
+        );
+        assert_eq!(
+            sheet_number(&columns, 0, &Value::Int(411_111_111_111_111)),
+            Some(411_111_111_111_111.0)
+        );
+        assert_eq!(
+            sheet_number(&columns, 0, &Value::Int(1_000_000_000_000_000_000)),
+            Some(1e18),
+            "trailing zeros are not digits Excel loses"
+        );
+        assert_eq!(
+            sheet_number(
+                &columns,
+                0,
+                &Value::Decimal("0.000000000000000123".parse().expect("decimal"))
+            ),
+            Some(1.23e-16),
+            "leading zeros are not digits Excel loses"
+        );
+    }
+
+    #[test]
+    fn a_value_longer_than_a_cell_holds_names_its_column() {
+        let rows = vec![vec![Value::Int(1), Value::Text("x".repeat(32_768))]];
+
+        let refused = render_xlsx(&cols(&["id", "body"]), &rows, "Results");
+
+        assert!(
+            matches!(&refused, Err(RenderError::TextTooLong { column, .. }) if column == "body"),
+            "{refused:?}"
+        );
+        assert!(
+            render_xlsx(&cols(&["body"]), &[vec![Value::Text("x".repeat(32_767))]], "Results").is_ok(),
+            "a value at the limit was refused"
+        );
+    }
+
     #[test]
     fn every_value_kind_writes_without_failing() {
         let columns = cols(&["a", "b", "c", "d", "e", "f", "g"]);

From 063b1f8c234a1bf60da11d1e6fdc2b6e2dbe5db9 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:24:59 +0700
Subject: [PATCH 06/15] fix(linux-export): XLSX fractions, pre-1900 dates and
 History sheet

---
 linux/crates/core/src/export/xlsx.rs | 115 ++++++++++++++++++++++-----
 1 file changed, 94 insertions(+), 21 deletions(-)

diff --git a/linux/crates/core/src/export/xlsx.rs b/linux/crates/core/src/export/xlsx.rs
index 4e0fa5deb5..6f551a9cdd 100644
--- a/linux/crates/core/src/export/xlsx.rs
+++ b/linux/crates/core/src/export/xlsx.rs
@@ -1,5 +1,6 @@
 use std::sync::Arc;
 
+use chrono::{Datelike, Timelike};
 use rust_xlsxwriter::{Format, Workbook, Worksheet};
 
 use super::encoder::column_name;
@@ -54,8 +55,16 @@ pub struct XlsxSheetWriter {
     workbook: Workbook,
     columns: Arc<[ResultColumn]>,
     rows: usize,
+    formats: CellFormats,
+}
+
+/// How the date and time cells are shown.
+struct CellFormats {
     date: Format,
     timestamp: Format,
+    /// For a timestamp with a fraction of a second, which the plain
+    /// format would hide. A sheet shows at most milliseconds.
+    timestamp_fraction: Format,
 }
 
 impl XlsxSheetWriter {
@@ -81,8 +90,11 @@ impl XlsxSheetWriter {
             workbook,
             columns,
             rows: 0,
-            date: Format::new().set_num_format("yyyy-mm-dd"),
-            timestamp: Format::new().set_num_format("yyyy-mm-dd hh:mm:ss"),
+            formats: CellFormats {
+                date: Format::new().set_num_format("yyyy-mm-dd"),
+                timestamp: Format::new().set_num_format("yyyy-mm-dd hh:mm:ss"),
+                timestamp_fraction: Format::new().set_num_format("yyyy-mm-dd hh:mm:ss.000"),
+            },
         })
     }
 
@@ -106,8 +118,7 @@ impl XlsxSheetWriter {
             workbook,
             columns,
             rows: written,
-            date,
-            timestamp,
+            formats,
         } = self;
         let sheet = workbook.worksheet_from_index(0).map_err(xlsx_error)?;
         for row in rows {
@@ -117,7 +128,7 @@ impl XlsxSheetWriter {
                 if column_index >= MAX_COLUMNS {
                     break;
                 }
-                write_cell(sheet, sheet_row, column_index as u16, columns, value, date, timestamp)?;
+                write_cell(sheet, sheet_row, column_index as u16, columns, value, formats)?;
             }
             *written += 1;
         }
@@ -135,10 +146,9 @@ fn write_cell(
     column: u16,
     columns: &[ResultColumn],
     value: &Value,
-    date: &Format,
-    timestamp: &Format,
+    formats: &CellFormats,
 ) -> Result<(), RenderError> {
-    match value {
+    let written = match value {
         // A blank cell, not an empty string: Excel's COUNT and AVERAGE
         // read the two differently, and NULL is the absent one.
         Value::Null => Ok(()),
@@ -149,21 +159,45 @@ fn write_cell(
             }));
         }
         Value::Bool(flag) => sheet.write_boolean(row, column, *flag).map(drop),
-        Value::Date(Temporal::Finite(day)) => sheet.write_datetime_with_format(row, column, day, date).map(drop),
-        Value::Timestamp(Temporal::Finite(at)) => {
-            sheet.write_datetime_with_format(row, column, at, timestamp).map(drop)
+        Value::Date(Temporal::Finite(day)) if on_excel_calendar(*day) => sheet
+            .write_datetime_with_format(row, column, day, &formats.date)
+            .map(drop),
+        Value::Timestamp(Temporal::Finite(at)) if on_excel_calendar(at.date()) => {
+            let format = timestamp_format(columns, column, at.nanosecond(), formats);
+            sheet.write_datetime_with_format(row, column, at, format).map(drop)
         }
         // A sheet cell carries no zone, so an offset timestamp goes in
         // at UTC. The text formats keep the offset; this one cannot.
-        Value::TimestampTz(Temporal::Finite(at)) => sheet
-            .write_datetime_with_format(row, column, at.utc(), timestamp)
-            .map(drop),
+        Value::TimestampTz(Temporal::Finite(at)) if on_excel_calendar(at.utc().date()) => {
+            let at = at.utc();
+            let format = timestamp_format(columns, column, at.nanosecond(), formats);
+            sheet.write_datetime_with_format(row, column, at, format).map(drop)
+        }
         _ => match sheet_number(columns, column, value) {
             Some(number) => sheet.write_number(row, column, number).map(drop),
             None => return write_text(sheet, row, column, columns, value),
         },
+    };
+    written.map_err(xlsx_error)
+}
+
+/// Whether a sheet can hold the date as one: Excel's calendar runs from
+/// 1900 to 9999, and a date outside it would show as `####` or a wrong
+/// day, so it goes in as text instead.
+fn on_excel_calendar(day: chrono::NaiveDate) -> bool {
+    (1900..=9999).contains(&day.year())
+}
+
+/// The timestamp format that shows the fraction the column declares, or
+/// the one the value carries where the column declares none.
+fn timestamp_format<'a>(columns: &[ResultColumn], column: u16, nanos: u32, formats: &'a CellFormats) -> &'a Format {
+    let declared = columns
+        .get(usize::from(column))
+        .and_then(|column| column.column_type.kind.fractional_digits());
+    match declared.map_or(nanos != 0, |digits| digits > 0) {
+        true => &formats.timestamp_fraction,
+        false => &formats.timestamp,
     }
-    .map_err(xlsx_error)
 }
 
 /// The number a cell goes in as, or `None` for one that goes in as
@@ -243,7 +277,8 @@ fn real_number(number: f32) -> f64 {
 }
 
 /// A sheet name Excel accepts: at most 31 characters, none of
-/// `[]:*?/\`, not empty, and not wrapped in apostrophes.
+/// `[]:*?/\`, not empty, not wrapped in apostrophes, and not
+/// `History`, which English Excel keeps for itself.
 fn sheet_title(name: &str) -> String {
     let cleaned: String = name
         .chars()
@@ -254,9 +289,10 @@ fn sheet_title(name: &str) -> String {
         .take(31)
         .collect();
     let trimmed = cleaned.trim().trim_matches('\'');
-    match trimmed.is_empty() {
-        true => "Sheet1".to_owned(),
-        false => trimmed.to_owned(),
+    match trimmed {
+        "" => "Sheet1".to_owned(),
+        reserved if reserved.eq_ignore_ascii_case("history") => format!("{reserved}_"),
+        name => name.to_owned(),
     }
 }
 
@@ -375,12 +411,16 @@ mod tests {
     }
 
     fn sheet_xml(bytes: &[u8]) -> String {
+        part_xml(bytes, "xl/worksheets/sheet1.xml")
+    }
+
+    fn part_xml(bytes: &[u8], name: &str) -> String {
         use std::io::Read;
 
         let mut archive = zip::ZipArchive::new(std::io::Cursor::new(bytes)).expect("a zip archive");
-        let mut sheet = archive.by_name("xl/worksheets/sheet1.xml").expect("the sheet");
+        let mut part = archive.by_name(name).expect("the part");
         let mut xml = String::new();
-        sheet.read_to_string(&mut xml).expect("the sheet's XML");
+        part.read_to_string(&mut xml).expect("the part's XML");
         xml
     }
 
@@ -491,6 +531,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_date_before_1900_is_written_as_text() {
+        let day = chrono::NaiveDate::from_ymd_opt(1899, 12, 31).expect("a date");
+        let rows = vec![vec![Value::Date(Temporal::Finite(day))]];
+
+        let xml = sheet_xml(&render_xlsx(&cols(&["born"]), &rows, "Results").expect("render"));
+
+        assert!(xml.contains("1899-12-31<"), "{xml}");
+    }
+
+    #[test]
+    fn a_timestamp_with_a_fraction_shows_it() {
+        let at = chrono::NaiveDate::from_ymd_opt(2024, 6, 15)
+            .expect("a date")
+            .and_hms_milli_opt(12, 0, 0, 250)
+            .expect("a time");
+        let rows = vec![vec![Value::Timestamp(Temporal::Finite(at))]];
+
+        let styles = part_xml(
+            &render_xlsx(&cols(&["at"]), &rows, "Results").expect("render"),
+            "xl/styles.xml",
+        );
+
+        assert!(styles.contains("hh:mm:ss.000"), "{styles}");
+    }
+
+    #[test]
+    fn the_name_excel_reserves_is_not_used_for_the_sheet() {
+        assert!(!sheet_title("History").eq_ignore_ascii_case("history"));
+        assert!(!sheet_title("history").eq_ignore_ascii_case("history"));
+        assert_eq!(sheet_title("History of orders"), "History of orders");
+    }
+
     #[test]
     fn every_value_kind_writes_without_failing() {
         let columns = cols(&["a", "b", "c", "d", "e", "f", "g"]);

From 8f40de1e8f51f02db94ccd4c4e344ab7fdafdd68 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:25:11 +0700
Subject: [PATCH 07/15] fix(linux-clipboard): copy rows without a leading
 apostrophe

---
 .../app/src/ui/clipboard/copy_renderer.rs     | 21 +++++++++------
 linux/crates/app/src/ui/clipboard/tests.rs    | 26 ++++++++++++++++---
 linux/crates/core/src/export/encoder/tests.rs | 11 +++-----
 .../core/src/export/encoder/tsv_encoder.rs    | 25 +++++++-----------
 linux/crates/core/src/export/tsv.rs           | 13 +++++-----
 5 files changed, 54 insertions(+), 42 deletions(-)

diff --git a/linux/crates/app/src/ui/clipboard/copy_renderer.rs b/linux/crates/app/src/ui/clipboard/copy_renderer.rs
index 077d0f7d04..2468210b44 100644
--- a/linux/crates/app/src/ui/clipboard/copy_renderer.rs
+++ b/linux/crates/app/src/ui/clipboard/copy_renderer.rs
@@ -115,18 +115,12 @@ fn render_rows(
         CopyKind::Rows => encode(TsvEncoder::new(columns, false), rows, ClipboardFormat::Tsv),
         CopyKind::RowsWithHeaders => encode(TsvEncoder::new(columns, true), rows, ClipboardFormat::Tsv),
         CopyKind::Csv => encode(
-            CsvEncoder::new(
-                columns,
-                CsvOptions {
-                    header_row: false,
-                    ..CsvOptions::default()
-                },
-            ),
+            CsvEncoder::new(columns, clipboard_csv(false)),
             rows,
             ClipboardFormat::Csv,
         ),
         CopyKind::CsvWithHeaders => encode(
-            CsvEncoder::new(columns, CsvOptions::default()),
+            CsvEncoder::new(columns, clipboard_csv(true)),
             rows,
             ClipboardFormat::Csv,
         ),
@@ -135,6 +129,17 @@ fn render_rows(
     }
 }
 
+/// CSV as the clipboard carries it. Copied text goes as the user sees
+/// it: the apostrophe an export puts before `-` or `@alice` would be
+/// pasted into every other place the text goes too.
+fn clipboard_csv(header_row: bool) -> CsvOptions {
+    CsvOptions {
+        header_row,
+        sanitize_formulas: false,
+        ..CsvOptions::default()
+    }
+}
+
 fn render_in_clause(dialect: &dyn SqlDialect, values: &InClauseRows) -> Result<ClipboardPayload, CopyError> {
     let InClauseRows { columns, rows, column } = values;
     let column_type = columns
diff --git a/linux/crates/app/src/ui/clipboard/tests.rs b/linux/crates/app/src/ui/clipboard/tests.rs
index 5ec4a36b97..0e6110ddcc 100644
--- a/linux/crates/app/src/ui/clipboard/tests.rs
+++ b/linux/crates/app/src/ui/clipboard/tests.rs
@@ -91,10 +91,17 @@ fn copy_renderer_csv_matches_render_csv() {
             CopyKind::Csv,
             CsvOptions {
                 header_row: false,
+                sanitize_formulas: false,
+                ..CsvOptions::default()
+            },
+        ),
+        (
+            CopyKind::CsvWithHeaders,
+            CsvOptions {
+                sanitize_formulas: false,
                 ..CsvOptions::default()
             },
         ),
-        (CopyKind::CsvWithHeaders, CsvOptions::default()),
     ];
     for (kind, options) in cases {
         let payload = render(rows_request(&rows, kind)).expect("the copy");
@@ -106,6 +113,17 @@ fn copy_renderer_csv_matches_render_csv() {
     }
 }
 
+#[test]
+fn a_copy_keeps_text_that_starts_like_a_formula_as_it_is() {
+    let rows = vec![vec![Value::Text("-".into()), Value::Text("@alice".into())]];
+
+    let tsv = render(rows_request(&rows, CopyKind::Rows)).expect("the copy");
+    let csv = render(rows_request(&rows, CopyKind::Csv)).expect("the copy");
+
+    assert_eq!(tsv.text, "-\t@alice\n");
+    assert_eq!(csv.text, "-,@alice\n");
+}
+
 #[test]
 fn copy_insert_uses_visible_columns_only() {
     let request = CopyRequest::Insert(InsertCopy {
@@ -196,7 +214,7 @@ fn a_slower_earlier_copy_gives_way_to_a_later_one() {
     finish_on_main(WAIT, fast)
         .expect("the later copy to end")
         .expect("the later copy");
-    assert_eq!(local_text(&clipboard).as_deref(), Some("-5\t'=cmd\n"));
+    assert_eq!(local_text(&clipboard).as_deref(), Some("-5\t=cmd\n"));
     let landed = clipboard.content();
     finish_on_main(WAIT, slow)
         .expect("the earlier copy to end")
@@ -295,7 +313,7 @@ fn copy_as_csv_offers_text_csv_and_plain_text() {
     assert!(formats.contains_type(String::static_type()), "{}", formats.to_str());
     assert_eq!(
         local_text(&clipboard).as_deref(),
-        Some("\"id\",\"name\"\n\"-5\",\"'=cmd\"\n\"7\",\"Ada, \"\"the first\"\"\"\n")
+        Some("id,name\n-5,=cmd\n7,\"Ada, \"\"the first\"\"\"\n")
     );
     assert_eq!(toasts, ["Copied 2 rows"]);
 }
@@ -312,7 +330,7 @@ fn copy_rows_offers_tab_separated_values() {
     );
     assert_eq!(
         local_text(&clipboard).as_deref(),
-        Some("-5\t'=cmd\n7\t\"Ada, \"\"the first\"\"\"\n")
+        Some("-5\t=cmd\n7\t\"Ada, \"\"the first\"\"\"\n")
     );
     assert_eq!(toasts, ["Copied 2 rows"]);
 }
diff --git a/linux/crates/core/src/export/encoder/tests.rs b/linux/crates/core/src/export/encoder/tests.rs
index 5f69752786..aa5bbd83de 100644
--- a/linux/crates/core/src/export/encoder/tests.rs
+++ b/linux/crates/core/src/export/encoder/tests.rs
@@ -1,6 +1,6 @@
 use std::sync::Arc;
 
-use super::super::csv::{csv_cell, csv_header, csv_writer_builder, neutralise_formula};
+use super::super::csv::{csv_cell, csv_header, csv_writer_builder};
 use super::super::csv_options::{CsvDecimal, CsvDelimiter, CsvLineBreak, CsvOptions, CsvQuote};
 use super::super::test_columns::{cols, typed};
 use super::super::tsv::tsv_writer_builder;
@@ -166,18 +166,13 @@ fn tsv_encoder_matches_render_tsv() {
         let mut writer = tsv_writer_builder().from_writer(Vec::new());
         if with_headers {
             writer
-                .write_record(
-                    columns
-                        .iter()
-                        .map(|column| neutralise_formula(&Value::Null, column.name.clone(), true)),
-                )
+                .write_record(columns.iter().map(|column| column.name.clone()))
                 .expect("the header");
         }
         for row in &rows {
             writer
                 .write_record(row.iter().enumerate().map(|(index, value)| {
-                    value_text(value, column_type(&columns, index))
-                        .map_or_else(|| "NULL".to_owned(), |text| neutralise_formula(value, text, false))
+                    value_text(value, column_type(&columns, index)).unwrap_or_else(|| "NULL".to_owned())
                 }))
                 .expect("the row");
         }
diff --git a/linux/crates/core/src/export/encoder/tsv_encoder.rs b/linux/crates/core/src/export/encoder/tsv_encoder.rs
index deb9f9cdd3..f4f2d66b69 100644
--- a/linux/crates/core/src/export/encoder/tsv_encoder.rs
+++ b/linux/crates/core/src/export/encoder/tsv_encoder.rs
@@ -4,14 +4,14 @@ use crate::column::ResultColumn;
 use crate::value::Value;
 
 use super::super::column_type;
-use super::super::csv::neutralise_formula;
 use super::super::tsv::tsv_writer_builder;
 use super::super::value_text::value_text;
 use super::{EncodeError, RecordWriter, RowEncoder, readable_cells};
 
-/// Tab-separated values, the form a spreadsheet pastes into cells. A
-/// paste reads a cell that starts like a formula as one, so free text
-/// gets the apostrophe a CSV export gives it.
+/// Tab-separated values, the form a spreadsheet pastes into cells. It
+/// is what the clipboard carries, so each value goes as the user sees
+/// it: a leading apostrophe on `-` or `@alice` would be pasted into
+/// every other place the text goes too.
 pub struct TsvEncoder {
     columns: Arc<[ResultColumn]>,
     with_headers: bool,
@@ -32,12 +32,8 @@ impl TsvEncoder {
 impl RowEncoder for TsvEncoder {
     fn begin(&mut self, out: &mut Vec<u8>) {
         if self.with_headers {
-            self.writer.write(
-                out,
-                self.columns
-                    .iter()
-                    .map(|column| neutralise_formula(&Value::Null, column.name.clone(), true)),
-            );
+            self.writer
+                .write(out, self.columns.iter().map(|column| column.name.as_str()));
         }
     }
 
@@ -45,12 +41,9 @@ impl RowEncoder for TsvEncoder {
         let cells = readable_cells(&self.columns, cells)?;
         self.writer.write(
             out,
-            cells.iter().enumerate().map(
-                |(index, value)| match value_text(value, column_type(&self.columns, index)) {
-                    Some(text) => neutralise_formula(value, text, false),
-                    None => "NULL".to_owned(),
-                },
-            ),
+            cells.iter().enumerate().map(|(index, value)| {
+                value_text(value, column_type(&self.columns, index)).unwrap_or_else(|| "NULL".to_owned())
+            }),
         );
         Ok(())
     }
diff --git a/linux/crates/core/src/export/tsv.rs b/linux/crates/core/src/export/tsv.rs
index d20c685163..ef92f68b7c 100644
--- a/linux/crates/core/src/export/tsv.rs
+++ b/linux/crates/core/src/export/tsv.rs
@@ -51,19 +51,20 @@ mod tests {
         assert_eq!(render_tsv(&columns, &rows, false).unwrap(), "\"say \"\"hi\"\"\"\n");
     }
 
-    /// A spreadsheet runs a pasted cell that starts like a formula.
     #[test]
-    fn tsv_neutralises_a_formula_in_free_text() {
-        let columns = cols(&["=sum", "b", "c"]);
+    fn tsv_keeps_text_that_starts_like_a_formula_as_it_is() {
+        let columns = cols(&["=sum", "b", "c", "d", "e"]);
         let rows = vec![vec![
-            Value::Text("=cmd|' /C calc'!A0".into()),
+            Value::Text("-".into()),
+            Value::Text("+1 555 0100".into()),
+            Value::Text("@alice".into()),
+            Value::Text("=1+1".into()),
             Value::Int(-5),
-            Value::Text("-5".into()),
         ]];
 
         assert_eq!(
             render_tsv(&columns, &rows, true).unwrap(),
-            "'=sum\tb\tc\n'=cmd|' /C calc'!A0\t-5\t-5\n"
+            "=sum\tb\tc\td\te\n-\t+1 555 0100\t@alice\t=1+1\t-5\n"
         );
     }
 

From 25eda7c8d9bca50442e01aaaa558079f78c395f0 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:25:39 +0700
Subject: [PATCH 08/15] fix(linux-grid): refuse an unreadable value in Row as
 JSON, not null

---
 .../crates/app/src/ui/grid/row_json_dialog.rs | 68 ++++++++++++++++---
 linux/crates/core/src/export/encoder/tests.rs |  2 +-
 linux/crates/core/src/export/json.rs          | 45 +++++++++---
 3 files changed, 97 insertions(+), 18 deletions(-)

diff --git a/linux/crates/app/src/ui/grid/row_json_dialog.rs b/linux/crates/app/src/ui/grid/row_json_dialog.rs
index ca85a19a49..9f60d40cb7 100644
--- a/linux/crates/app/src/ui/grid/row_json_dialog.rs
+++ b/linux/crates/app/src/ui/grid/row_json_dialog.rs
@@ -7,6 +7,7 @@ use libadwaita::prelude::*;
 use sourceview5::prelude::*;
 use tablepro_core::Value;
 use tablepro_core::column::ResultColumn;
+use tablepro_core::export::EncodeError;
 use tablepro_session::runtime::Tasks;
 
 use super::RowSnapshot;
@@ -35,16 +36,16 @@ struct RowJson {
     shortened: bool,
 }
 
-fn render(request: RowJsonRequest) -> RowJson {
+fn render(request: RowJsonRequest) -> Result<RowJson, EncodeError> {
     let values = request.row.to_values();
-    let full = tablepro_core::export::row_to_json(&request.columns, &values);
+    let full = tablepro_core::export::row_to_json(&request.columns, &values)?;
     let mut shortened = false;
     let shown_values: Vec<Value> = values.into_iter().map(|value| shown(value, &mut shortened)).collect();
     let shown = match shortened {
-        true => tablepro_core::export::row_to_json(&request.columns, &shown_values),
+        true => tablepro_core::export::row_to_json(&request.columns, &shown_values)?,
         false => full.clone(),
     };
-    RowJson { full, shown, shortened }
+    Ok(RowJson { full, shown, shortened })
 }
 
 /// `value` as the dialog shows it, with anything long cut short and
@@ -118,18 +119,33 @@ pub(crate) async fn present_row_json(
     tasks: Tasks,
     request: RowJsonRequest,
 ) -> Option<adw::Dialog> {
-    let rendered = match tasks.spawn_blocking_task(move || render(request)).await {
-        Ok(rendered) => rendered,
+    let dialog = match tasks.spawn_blocking_task(move || render(request)).await {
+        Ok(Ok(rendered)) => row_json_dialog(rendered),
+        Ok(Err(refused)) => refused_alert(&refused).upcast(),
         Err(failure) => {
             tracing::warn!(%failure, "a row could not be rendered as JSON");
             return None;
         }
     };
-    let dialog = row_json_dialog(rendered);
     dialog.present(Some(&parent));
     Some(dialog)
 }
 
+/// Why the row has no JSON to show. Both refusals name the column the
+/// grid shows as unreadable.
+fn refused_alert(refused: &EncodeError) -> adw::AlertDialog {
+    let (EncodeError::Undecodable { column } | EncodeError::NotXmlText { column }) = refused;
+    let alert = adw::AlertDialog::new(
+        Some(&crate::i18n::gettext("Can't Show Row as JSON")),
+        Some(&crate::i18n::gettext_f(
+            "The column “{column}” holds a value TablePro couldn't read, so the row has no JSON to show.",
+            &[("column", column)],
+        )),
+    );
+    alert.add_response("close", &crate::i18n::gettext("_Close"));
+    alert
+}
+
 fn row_json_dialog(json: RowJson) -> adw::Dialog {
     let RowJson { full, shown, shortened } = json;
     let buffer = sourceview5::Buffer::new(None);
@@ -300,7 +316,7 @@ mod tests {
             ),
         };
 
-        let rendered = render(request);
+        let rendered = render(request).expect("a readable row");
 
         assert!(rendered.shortened);
         let longest = rendered.shown.lines().map(str::len).max().unwrap_or_default();
@@ -321,6 +337,42 @@ mod tests {
         assert_eq!(full["tags"].as_array().map(Vec::len), Some(LONG));
     }
 
+    #[gtk4::test]
+    fn an_unreadable_value_is_refused_by_name_rather_than_shown_as_null() {
+        adw::init().expect("libadwaita initialises under the test backend");
+        let window = OwnedWindow::presented(adw::Window::new());
+        let runtime = crate::test_support::test_runtime();
+        let unreadable = Value::Undecodable(Box::new(tablepro_core::value::UndecodedValue {
+            type_name: "text".to_owned(),
+            reason: tablepro_core::value::UndecodableReason::InvalidEncoding,
+        }));
+        let request = RowJsonRequest {
+            columns: vec![
+                ResultColumn::new("id", ColumnType::untyped_text("text")),
+                ResultColumn::new("body", ColumnType::untyped_text("text")),
+            ]
+            .into(),
+            row: RowSnapshot::new(vec![Value::Int(1), unreadable].into(), Vec::new()),
+        };
+
+        let dialog = finish_on_main(
+            Duration::from_secs(10),
+            present_row_json(window.clone().upcast(), runtime.tasks(), request),
+        )
+        .expect("the render to end")
+        .expect("a dialog");
+
+        let alert = dialog
+            .downcast::<adw::AlertDialog>()
+            .expect("an alert, not the JSON view");
+        assert_eq!(
+            alert.body().as_str(),
+            "The column “body” holds a value TablePro couldn't read, so the row has no JSON to show."
+        );
+        alert.force_close();
+        runtime.shutdown();
+    }
+
     #[gtk4::test]
     fn a_closed_dialog_lets_go_of_the_row() {
         adw::init().expect("libadwaita initialises under the test backend");
diff --git a/linux/crates/core/src/export/encoder/tests.rs b/linux/crates/core/src/export/encoder/tests.rs
index aa5bbd83de..a9a1a0951d 100644
--- a/linux/crates/core/src/export/encoder/tests.rs
+++ b/linux/crates/core/src/export/encoder/tests.rs
@@ -224,7 +224,7 @@ fn json_encoder_output_parses_and_matches_render_json() {
     // rows before the encoders.
     let expected: Vec<serde_json::Value> = rows
         .iter()
-        .map(|row| serde_json::from_str(&row_to_json(&columns, row)).expect("a JSON row"))
+        .map(|row| serde_json::from_str(&row_to_json(&columns, row).expect("a readable row")).expect("a JSON row"))
         .collect();
     assert_eq!(parsed, expected);
     assert_eq!(parsed.len(), 10_000);
diff --git a/linux/crates/core/src/export/json.rs b/linux/crates/core/src/export/json.rs
index f2bcb8b417..61e89b7faa 100644
--- a/linux/crates/core/src/export/json.rs
+++ b/linux/crates/core/src/export/json.rs
@@ -103,15 +103,22 @@ fn number_token<S: Serializer>(serializer: S, digits: &str) -> Result<S::Ok, S::
 }
 
 /// One row as a document a person reads, which is the only place a
-/// single row is rendered on its own.
-pub fn row_to_json(columns: &[ResultColumn], row: &[Value]) -> String {
+/// single row is rendered on its own. A value the driver could not read
+/// is refused, as every export refuses it, rather than shown as a
+/// `null` the row does not hold.
+pub fn row_to_json(columns: &[ResultColumn], row: &[Value]) -> Result<String, EncodeError> {
+    if let Some(index) = row.iter().position(|value| matches!(value, Value::Undecodable(_))) {
+        return Err(EncodeError::Undecodable {
+            column: super::encoder::column_name(columns, index),
+        });
+    }
     let names = json_field_names(columns);
     let value = JsonRow {
         names: &names,
         columns,
         row,
     };
-    serde_json::to_string_pretty(&value).unwrap_or_else(|_| "{}".to_owned())
+    Ok(serde_json::to_string_pretty(&value).unwrap_or_else(|_| "{}".to_owned()))
 }
 
 pub fn render_json(columns: &[ResultColumn], rows: &[Vec<Value>]) -> Result<String, EncodeError> {
@@ -126,7 +133,27 @@ mod tests {
     use super::*;
 
     fn parsed(columns: &[ResultColumn], row: &[Value]) -> serde_json::Value {
-        serde_json::from_str(&row_to_json(columns, row)).expect("the row is JSON")
+        serde_json::from_str(&row_to_json(columns, row).expect("a readable row")).expect("the row is JSON")
+    }
+
+    #[test]
+    fn an_unreadable_value_is_refused_rather_than_shown_as_null() {
+        let row = vec![
+            Value::Int(1),
+            Value::Undecodable(Box::new(crate::value::UndecodedValue {
+                type_name: "text".to_owned(),
+                reason: crate::value::UndecodableReason::InvalidEncoding,
+            })),
+        ];
+
+        let refused = row_to_json(&cols(&["id", "body"]), &row);
+
+        assert_eq!(
+            refused,
+            Err(EncodeError::Undecodable {
+                column: "body".to_owned()
+            })
+        );
     }
 
     #[test]
@@ -172,7 +199,7 @@ mod tests {
             Value::Decimal("12345678901234567890.12345678901234567890".parse().expect("a decimal")),
         ];
 
-        let text = row_to_json(&columns, &row);
+        let text = row_to_json(&columns, &row).expect("a readable row");
 
         assert!(text.contains("18446744073709551615"), "{text}");
         assert!(
@@ -197,7 +224,7 @@ mod tests {
         )];
         let row = vec![Value::Decimal("1".parse().expect("a decimal"))];
 
-        let text = row_to_json(&columns, &row);
+        let text = row_to_json(&columns, &row).expect("a readable row");
 
         assert!(text.contains("1.0000000000"), "{text}");
     }
@@ -210,7 +237,7 @@ mod tests {
             crate::value::JsonText::parse(document.to_owned()).expect("valid json"),
         )];
 
-        let text = row_to_json(&columns, &row);
+        let text = row_to_json(&columns, &row).expect("a readable row");
 
         assert!(
             text.contains(&format!("\"payload\": {document}")),
@@ -241,7 +268,7 @@ mod tests {
         let columns = cols(&["r"]);
         let row = vec![Value::Float32(0.1)];
 
-        let text = row_to_json(&columns, &row);
+        let text = row_to_json(&columns, &row).expect("a readable row");
 
         assert!(
             text.contains("\"r\": 0.1\n"),
@@ -266,7 +293,7 @@ mod tests {
             Value::Null,
         ])];
 
-        let text = row_to_json(&columns, &row);
+        let text = row_to_json(&columns, &row).expect("a readable row");
 
         assert!(text.contains("1.50,"), "the item lost its column's scale: {text}");
         assert_eq!(parsed(&columns, &row)["amounts"], serde_json::json!([1.5, null]));

From b258a3d86457af02af0a061cda86e30e021a7496 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:26:57 +0700
Subject: [PATCH 09/15] fix(linux-export): qualify the table and skip generated
 columns in SQL

---
 .../src/ui/browse_tab/clipboard_handlers.rs   |   8 +-
 .../crates/app/src/ui/export/export_format.rs |  12 ++-
 .../app/src/ui/export/export_sink_parts.rs    |   3 +-
 linux/crates/app/src/ui/export_dialog.rs      |   6 +-
 .../src/export/encoder/sql_insert_encoder.rs  |  25 +++--
 linux/crates/core/src/export/encoder/tests.rs |  22 +++-
 linux/crates/core/src/export/sql.rs           | 102 +++++++++++++-----
 linux/crates/drivers/mysql/src/dialect.rs     |   3 +-
 8 files changed, 138 insertions(+), 43 deletions(-)

diff --git a/linux/crates/app/src/ui/browse_tab/clipboard_handlers.rs b/linux/crates/app/src/ui/browse_tab/clipboard_handlers.rs
index 05b685bcb3..0c8ef41197 100644
--- a/linux/crates/app/src/ui/browse_tab/clipboard_handlers.rs
+++ b/linux/crates/app/src/ui/browse_tab/clipboard_handlers.rs
@@ -36,7 +36,13 @@ impl BrowseModel {
     /// write them back as `INSERT` statements.
     fn sql_target(&self) -> crate::ui::export_dialog::SqlTarget {
         crate::ui::export_dialog::SqlTarget {
-            table: self.table.clone(),
+            table: self.table_ref(),
+            generated: self
+                .current_columns
+                .iter()
+                .filter(|column| column.is_generated)
+                .map(|column| column.name.clone())
+                .collect(),
         }
     }
 
diff --git a/linux/crates/app/src/ui/export/export_format.rs b/linux/crates/app/src/ui/export/export_format.rs
index 57800fc061..2696261d8a 100644
--- a/linux/crates/app/src/ui/export/export_format.rs
+++ b/linux/crates/app/src/ui/export/export_format.rs
@@ -7,6 +7,7 @@ use tablepro_core::export::{
     self, CsvEncoder, CsvOptions, HtmlEncoder, JsonArrayEncoder, MarkdownEncoder, RenderError, RowEncoder,
     SqlInsertEncoder, XlsxSheetWriter, XmlEncoder,
 };
+use tablepro_core::meta::TableRef;
 
 /// What an export writes.
 #[derive(Debug, Clone)]
@@ -38,7 +39,12 @@ impl RowFormat {
             Self::Markdown => Box::new(MarkdownEncoder::new(columns)),
             Self::Html { title } => Box::new(HtmlEncoder::new(columns, title.clone())),
             Self::Xml => Box::new(XmlEncoder::new(columns)),
-            Self::Sql(target) => Box::new(SqlInsertEncoder::new(target.dialect.clone(), &target.table, columns)),
+            Self::Sql(target) => Box::new(SqlInsertEncoder::new(
+                target.dialect.clone(),
+                &target.table,
+                columns,
+                &target.generated,
+            )),
         }
     }
 }
@@ -88,6 +94,8 @@ impl DocumentWriter {
 /// from. SQL is offered only with both.
 #[derive(Debug, Clone)]
 pub(crate) struct InsertTarget {
-    pub table: String,
+    pub table: TableRef,
+    /// The columns the server computes, which the statements leave out.
+    pub generated: Arc<[String]>,
     pub dialect: Arc<dyn SqlDialect>,
 }
diff --git a/linux/crates/app/src/ui/export/export_sink_parts.rs b/linux/crates/app/src/ui/export/export_sink_parts.rs
index 7c24bf07cc..0c082e3c3f 100644
--- a/linux/crates/app/src/ui/export/export_sink_parts.rs
+++ b/linux/crates/app/src/ui/export/export_sink_parts.rs
@@ -47,7 +47,8 @@ mod tests {
             RowFormat::Html { title: "t".to_owned() },
             RowFormat::Xml,
             RowFormat::Sql(InsertTarget {
-                table: "t".to_owned(),
+                table: tablepro_core::meta::TableRef::unqualified("t"),
+                generated: Arc::from([]),
                 dialect: Arc::new(FakeDialect),
             }),
         ];
diff --git a/linux/crates/app/src/ui/export_dialog.rs b/linux/crates/app/src/ui/export_dialog.rs
index 256958ccd9..cd6549cf59 100644
--- a/linux/crates/app/src/ui/export_dialog.rs
+++ b/linux/crates/app/src/ui/export_dialog.rs
@@ -8,6 +8,7 @@ use relm4::{adw, gtk};
 
 use tablepro_core::dialect::SqlDialect;
 use tablepro_core::export::{CsvDecimal, CsvDelimiter, CsvLineBreak, CsvOptions, CsvQuote, XLSX_MAX_DATA_ROWS};
+use tablepro_core::meta::TableRef;
 use tablepro_session::Session;
 use uuid::Uuid;
 
@@ -24,7 +25,9 @@ use crate::ui::format::format_thousands;
 /// several tables or none, so SQL is not offered for one.
 #[derive(Debug, Clone)]
 pub struct SqlTarget {
-    pub table: String,
+    pub table: TableRef,
+    /// The columns the server computes, which the statements leave out.
+    pub generated: Arc<[String]>,
 }
 
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -347,6 +350,7 @@ pub(crate) fn present(init: ExportDialogInit<'_>) {
     } = offer;
     let target = target.zip(dialect).map(|(target, dialect)| InsertTarget {
         table: target.table,
+        generated: target.generated,
         dialect,
     });
     let formats = Format::offered(target.as_ref());
diff --git a/linux/crates/core/src/export/encoder/sql_insert_encoder.rs b/linux/crates/core/src/export/encoder/sql_insert_encoder.rs
index f0af1dbf1e..dc81b77327 100644
--- a/linux/crates/core/src/export/encoder/sql_insert_encoder.rs
+++ b/linux/crates/core/src/export/encoder/sql_insert_encoder.rs
@@ -2,26 +2,35 @@ use std::sync::Arc;
 
 use crate::column::ResultColumn;
 use crate::dialect::SqlDialect;
+use crate::meta::TableRef;
 use crate::value::Value;
 
-use super::super::sql::{insert_row, insert_start};
+use super::super::sql::{InsertShape, insert_row, insert_shape};
 use super::{EncodeError, RowEncoder, readable_cells};
 
 /// The statements `render_sql_insert` writes, a row at a time.
 pub struct SqlInsertEncoder {
     dialect: Arc<dyn SqlDialect>,
     columns: Arc<[ResultColumn]>,
-    /// `None` for a result with no columns, which writes nothing.
-    start: Option<String>,
+    /// `None` for a result with no column to write, which writes
+    /// nothing.
+    shape: Option<InsertShape>,
 }
 
 impl SqlInsertEncoder {
-    pub fn new(dialect: Arc<dyn SqlDialect>, table: &str, columns: Arc<[ResultColumn]>) -> Self {
-        let start = insert_start(&*dialect, table, &columns);
+    /// `generated` names the columns the server computes, which every
+    /// statement leaves out.
+    pub fn new(
+        dialect: Arc<dyn SqlDialect>,
+        table: &TableRef,
+        columns: Arc<[ResultColumn]>,
+        generated: &[String],
+    ) -> Self {
+        let shape = insert_shape(&*dialect, table, &columns, generated);
         Self {
             dialect,
             columns,
-            start,
+            shape,
         }
     }
 }
@@ -31,11 +40,11 @@ impl RowEncoder for SqlInsertEncoder {
 
     fn row(&mut self, out: &mut Vec<u8>, cells: &mut dyn Iterator<Item = &Value>) -> Result<(), EncodeError> {
         let cells = readable_cells(&self.columns, cells)?;
-        let Some(start) = &self.start else {
+        let Some(shape) = &self.shape else {
             return Ok(());
         };
         let mut row = String::new();
-        insert_row(&mut row, &*self.dialect, start, &self.columns, cells);
+        insert_row(&mut row, &*self.dialect, shape, &self.columns, cells);
         out.extend_from_slice(row.as_bytes());
         Ok(())
     }
diff --git a/linux/crates/core/src/export/encoder/tests.rs b/linux/crates/core/src/export/encoder/tests.rs
index a9a1a0951d..dfc8aebde4 100644
--- a/linux/crates/core/src/export/encoder/tests.rs
+++ b/linux/crates/core/src/export/encoder/tests.rs
@@ -11,6 +11,7 @@ use super::super::{
 use super::*;
 use crate::column::{ColumnKind, IntegerKind, IntegerWidth};
 use crate::dialect::{SqlDialect, TestDialect};
+use crate::meta::TableRef;
 use crate::value::{JsonText, UndecodableReason, UndecodedValue};
 
 /// Every call's output taken away as soon as it is written, the way a
@@ -286,8 +287,11 @@ fn document_encoders_match_their_renderers() {
         render_xml(&columns, &rows).expect("the document")
     );
     assert_eq!(
-        streamed(SqlInsertEncoder::new(dialect.clone(), "t", columns.clone()), &rows),
-        render_sql_insert(&*dialect, "t", &columns, &rows)
+        streamed(
+            SqlInsertEncoder::new(dialect.clone(), &TableRef::unqualified("t"), columns.clone(), &[]),
+            &rows
+        ),
+        render_sql_insert(&*dialect, &TableRef::unqualified("t"), &columns, &[], &rows)
     );
 }
 
@@ -304,9 +308,16 @@ fn document_encoders_write_whole_documents_for_no_rows() {
         streamed(XmlEncoder::new(columns.clone()), &[]),
         render_xml(&columns, &[]).expect("the document")
     );
-    assert_eq!(streamed(SqlInsertEncoder::new(dialect.clone(), "t", columns), &[]), "");
+    let table = TableRef::unqualified("t");
+    assert_eq!(
+        streamed(SqlInsertEncoder::new(dialect.clone(), &table, columns, &[]), &[]),
+        ""
+    );
     assert_eq!(
-        streamed(SqlInsertEncoder::new(dialect, "t", Vec::new().into()), &[Vec::new()]),
+        streamed(
+            SqlInsertEncoder::new(dialect, &table, Vec::new().into(), &[]),
+            &[Vec::new()]
+        ),
         "",
         "a result with no columns has no statement"
     );
@@ -328,8 +339,9 @@ fn encoder_reports_undecodable_cell() {
         Box::new(XmlEncoder::new(columns.clone())),
         Box::new(SqlInsertEncoder::new(
             Arc::new(TestDialect::default()),
-            "t",
+            &TableRef::unqualified("t"),
             columns.clone(),
+            &[],
         )),
     ];
     for mut encoder in encoders {
diff --git a/linux/crates/core/src/export/sql.rs b/linux/crates/core/src/export/sql.rs
index aa631e2602..ce789a1d73 100644
--- a/linux/crates/core/src/export/sql.rs
+++ b/linux/crates/core/src/export/sql.rs
@@ -12,62 +12,84 @@ use crate::value::Value;
 /// middle of one long statement takes every row with it, while a
 /// failure among many takes one.
 ///
+/// The table is written with its schema, and the columns `generated`
+/// names are left out, as Copy As INSERT leaves them out: every engine
+/// refuses a value for a column it computes.
+///
 /// A value the engine has no literal for, such as a blob, is written as
 /// `NULL` behind a comment saying so. Writing a guess would put the
 /// wrong data in the table, and refusing the whole export would lose
 /// every other row over one cell.
 pub fn render_sql_insert(
     dialect: &dyn SqlDialect,
-    table: &str,
+    table: &TableRef,
     columns: &[ResultColumn],
+    generated: &[String],
     rows: &[Vec<Value>],
 ) -> String {
-    let Some(start) = insert_start(dialect, table, columns) else {
+    let Some(shape) = insert_shape(dialect, table, columns, generated) else {
         return String::new();
     };
     let mut out = String::with_capacity(rows.len() * columns.len() * 12);
     for row in rows {
-        insert_row(&mut out, dialect, &start, columns, row);
+        insert_row(&mut out, dialect, &shape, columns, row);
     }
     out
 }
 
-/// `INSERT INTO table (columns) VALUES `, which every row's statement
-/// starts with. `None` for a result with no columns, which has no
-/// statement to write.
-pub(super) fn insert_start(dialect: &dyn SqlDialect, table: &str, columns: &[ResultColumn]) -> Option<String> {
-    if columns.is_empty() {
-        return None;
-    }
+/// What every row's statement shares: `INSERT INTO table (columns)
+/// VALUES `, and which of the result's columns it writes.
+pub(super) struct InsertShape {
+    start: String,
+    written: Vec<bool>,
+}
+
+/// The shape of every row's statement, or `None` for a result with no
+/// column to write, which has no statement.
+pub(super) fn insert_shape(
+    dialect: &dyn SqlDialect,
+    table: &TableRef,
+    columns: &[ResultColumn],
+    generated: &[String],
+) -> Option<InsertShape> {
+    let written: Vec<bool> = columns.iter().map(|column| !generated.contains(&column.name)).collect();
     let names: Vec<String> = columns
         .iter()
-        .map(|column| dialect.quote_identifier(&column.name))
+        .zip(&written)
+        .filter(|(_, written)| **written)
+        .map(|(column, _)| dialect.quote_identifier(&column.name))
         .collect();
-    Some(format!(
-        "INSERT INTO {} ({}) VALUES ",
-        dialect.quote_identifier(table),
-        names.join(", ")
-    ))
+    if names.is_empty() {
+        return None;
+    }
+    Some(InsertShape {
+        start: format!("INSERT INTO {} ({}) VALUES ", dialect.qualify(table), names.join(", ")),
+        written,
+    })
 }
 
 pub(super) fn insert_row<'a>(
     out: &mut String,
     dialect: &dyn SqlDialect,
-    start: &str,
+    shape: &InsertShape,
     columns: &[ResultColumn],
     row: impl IntoIterator<Item = &'a Value>,
 ) {
     let mut cells = row.into_iter();
     let values: Vec<String> = columns
         .iter()
-        .map(|column| match cells.next() {
-            Some(value) => literal(dialect, value, column),
-            // A row shorter than its header: the cell is absent, which
-            // is as close to unknown as SQL has.
-            None => "NULL".to_owned(),
+        .zip(&shape.written)
+        .filter_map(|(column, written)| {
+            let literal = match cells.next() {
+                Some(value) => literal(dialect, value, column),
+                // A row shorter than its header: the cell is absent,
+                // which is as close to unknown as SQL has.
+                None => "NULL".to_owned(),
+            };
+            written.then_some(literal)
         })
         .collect();
-    out.push_str(start);
+    out.push_str(&shape.start);
     out.push('(');
     out.push_str(&values.join(", "));
     out.push_str(");\n");
@@ -130,7 +152,39 @@ mod tests {
     use crate::dialect::{LiteralError, TestDialect};
 
     fn render(table: &str, columns: &[ResultColumn], rows: &[Vec<Value>]) -> String {
-        render_sql_insert(&TestDialect::default(), table, columns, rows)
+        render_sql_insert(
+            &TestDialect::default(),
+            &TableRef::unqualified(table),
+            columns,
+            &[],
+            rows,
+        )
+    }
+
+    #[test]
+    fn the_table_is_written_with_its_schema() {
+        let sql = render_sql_insert(
+            &TestDialect::default(),
+            &TableRef::new(Some("sales".to_owned()), "orders"),
+            &cols(&["id"]),
+            &[],
+            &[vec![Value::Int(1)]],
+        );
+
+        assert_eq!(sql, "INSERT INTO \"sales\".\"orders\" (\"id\") VALUES (1);\n");
+    }
+
+    #[test]
+    fn a_generated_column_is_left_to_the_server() {
+        let sql = render_sql_insert(
+            &TestDialect::default(),
+            &TableRef::unqualified("orders"),
+            &cols(&["id", "total", "name"]),
+            &["total".to_owned()],
+            &[vec![Value::Int(1), Value::Int(9), Value::Text("a".into())]],
+        );
+
+        assert_eq!(sql, "INSERT INTO \"orders\" (\"id\", \"name\") VALUES (1, 'a');\n");
     }
 
     #[test]
diff --git a/linux/crates/drivers/mysql/src/dialect.rs b/linux/crates/drivers/mysql/src/dialect.rs
index 262c11741f..81b4d455f6 100644
--- a/linux/crates/drivers/mysql/src/dialect.rs
+++ b/linux/crates/drivers/mysql/src/dialect.rs
@@ -451,8 +451,9 @@ mod tests {
 
         let sql = tablepro_core::export::render_sql_insert(
             &dialect(MySqlFlavour::MySql),
-            "t",
+            &tablepro_core::meta::TableRef::unqualified("t"),
             &columns,
+            &[],
             &[vec![Value::Int(1)]],
         );
 

From f7d0a8ba7e63f4131c874def72054fff0b4130b2 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:27:20 +0700
Subject: [PATCH 10/15] fix(linux-export): write BC dates and offset seconds as
 PostgreSQL does

---
 linux/crates/core/src/export/value_text.rs | 115 +++++++++++++++++++--
 1 file changed, 104 insertions(+), 11 deletions(-)

diff --git a/linux/crates/core/src/export/value_text.rs b/linux/crates/core/src/export/value_text.rs
index d9684088e1..412ceb8677 100644
--- a/linux/crates/core/src/export/value_text.rs
+++ b/linux/crates/core/src/export/value_text.rs
@@ -1,4 +1,4 @@
-use chrono::Timelike;
+use chrono::{Datelike, Timelike};
 
 use crate::column::{ColumnKind, ColumnType};
 use crate::value::{SqlDecimal, Value};
@@ -24,19 +24,21 @@ pub(super) fn kind_text(value: &Value, kind: &ColumnKind) -> Option<String> {
             offset_text(time.offset)
         )),
         Value::Timestamp(stamp) => temporal_text(stamp, |stamp| {
+            let (date, era) = calendar_date(stamp.date());
             format!(
-                "{}{}",
-                stamp.format("%Y-%m-%d %H:%M:%S"),
+                "{date} {}{}{era}",
+                stamp.format("%H:%M:%S"),
                 fraction_text(stamp.nanosecond(), kind.fractional_digits())
             )
         }),
         Value::TimestampTz(stamp) => temporal_text(stamp, |stamp| {
             let stamp = stamp.to_datetime();
+            let (date, era) = calendar_date(stamp.date_naive());
             format!(
-                "{}{}{}",
-                stamp.format("%Y-%m-%d %H:%M:%S"),
+                "{date} {}{}{}{era}",
+                stamp.format("%H:%M:%S"),
                 fraction_text(stamp.nanosecond(), kind.fractional_digits()),
-                stamp.format("%:z")
+                offset_text(*stamp.offset())
             )
         }),
         Value::Decimal(decimal) => Some(decimal_text(decimal, kind.decimal_scale())),
@@ -128,15 +130,27 @@ pub fn value_to_text(v: &Value) -> Option<String> {
         Value::Bytes(b) => Some(format!("0x{}", crate::hex::encode_lower(b))),
         Value::Uuid(u) => Some(u.to_string()),
         Value::Json(j) => Some(j.as_str().to_owned()),
-        Value::Date(d) => temporal_text(d, |date| date.format("%Y-%m-%d").to_string()),
+        Value::Date(d) => temporal_text(d, |date| {
+            let (date, era) = calendar_date(*date);
+            format!("{date}{era}")
+        }),
         // The fraction is kept as it came, never rounded to seconds.
         Value::Time(t) => Some(t.format(None)),
         Value::TimeTz(t) => Some(format!("{}{}", t.time.format(None), offset_text(t.offset))),
-        Value::Timestamp(t) => temporal_text(t, |stamp| stamp.format("%Y-%m-%d %H:%M:%S%.f").to_string()),
+        Value::Timestamp(t) => temporal_text(t, |stamp| {
+            let (date, era) = calendar_date(stamp.date());
+            format!("{date} {}{era}", stamp.format("%H:%M:%S%.f"))
+        }),
         // The original offset, not UTC: the row said what zone it was
         // written in and the export says the same.
         Value::TimestampTz(t) => temporal_text(t, |stamp| {
-            stamp.to_datetime().format("%Y-%m-%d %H:%M:%S%.f%:z").to_string()
+            let stamp = stamp.to_datetime();
+            let (date, era) = calendar_date(stamp.date_naive());
+            format!(
+                "{date} {}{}{era}",
+                stamp.format("%H:%M:%S%.f"),
+                offset_text(*stamp.offset())
+            )
         }),
         Value::Interval(i) => Some(i.to_string()),
         Value::Bits(b) => Some(b.to_string()),
@@ -166,11 +180,28 @@ fn temporal_text<T>(value: &crate::value::Temporal<T>, finite: impl Fn(&T) -> St
     }
 }
 
+/// An offset as PostgreSQL prints it, with the seconds a local mean
+/// time offset such as `+00:19:32` carries.
 fn offset_text(offset: chrono::FixedOffset) -> String {
     let total = offset.local_minus_utc();
     let sign = if total < 0 { '-' } else { '+' };
-    let minutes = total.abs() / 60;
-    format!("{sign}{:02}:{:02}", minutes / 60, minutes % 60)
+    let seconds = total.abs();
+    let (hours, minutes, seconds) = (seconds / 3600, seconds / 60 % 60, seconds % 60);
+    match seconds {
+        0 => format!("{sign}{hours:02}:{minutes:02}"),
+        _ => format!("{sign}{hours:02}:{minutes:02}:{seconds:02}"),
+    }
+}
+
+/// The date as PostgreSQL prints it, and the era that goes at the very
+/// end of the value. ISO year 0 is 1 BC, so it is written as such, and
+/// a year past 9999 keeps its digits with no sign.
+fn calendar_date(date: chrono::NaiveDate) -> (String, &'static str) {
+    let (year, era) = match date.year() {
+        year if year <= 0 => (1 - year, " BC"),
+        year => (year, ""),
+    };
+    (format!("{year:04}-{:02}-{:02}", date.month(), date.day()), era)
 }
 
 /// An array as JSON array text, which is the one spelling every engine
@@ -303,6 +334,68 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_date_before_year_one_is_written_as_postgresql_writes_it() {
+        assert_eq!(value_to_text(&date(0, 1, 1)).as_deref(), Some("0001-01-01 BC"));
+        assert_eq!(value_to_text(&date(-43, 3, 15)).as_deref(), Some("0044-03-15 BC"));
+        assert_eq!(value_to_text(&date(1, 1, 1)).as_deref(), Some("0001-01-01"));
+        assert_eq!(value_to_text(&date(10_000, 1, 1)).as_deref(), Some("10000-01-01"));
+
+        let column = typed("timestamp(0)", stamp(Some(0), TemporalZone::Naive));
+        let stamp = Value::Timestamp(Temporal::Finite(
+            NaiveDate::from_ymd_opt(0, 1, 1)
+                .expect("a date")
+                .and_hms_opt(10, 0, 0)
+                .expect("a time"),
+        ));
+        assert_eq!(value_text(&stamp, &column).as_deref(), Some("0001-01-01 10:00:00 BC"));
+        assert_eq!(value_to_text(&stamp).as_deref(), Some("0001-01-01 10:00:00 BC"));
+    }
+
+    #[test]
+    fn an_offset_with_seconds_keeps_them() {
+        let offset = chrono::FixedOffset::east_opt(5 * 3600 + 30 * 60 + 15).expect("an offset");
+        let time = crate::value::TimeWithOffset {
+            time: SqlTime::new(false, 12, 0, 0, 0).expect("a time"),
+            offset,
+        };
+        let stamp = Value::TimestampTz(Temporal::Finite(crate::value::OffsetTimestamp::from_datetime(
+            NaiveDate::from_ymd_opt(1890, 1, 1)
+                .expect("a date")
+                .and_hms_opt(12, 0, 0)
+                .expect("a time")
+                .and_local_timezone(offset)
+                .single()
+                .expect("one instant"),
+        )));
+
+        assert_eq!(
+            value_to_text(&Value::TimeTz(time)).as_deref(),
+            Some("12:00:00+05:30:15")
+        );
+        assert_eq!(
+            value_text(&Value::TimeTz(time), &typed("timetz", time_tz())).as_deref(),
+            Some("12:00:00+05:30:15")
+        );
+        assert_eq!(value_to_text(&stamp).as_deref(), Some("1890-01-01 12:00:00+05:30:15"));
+        assert_eq!(
+            value_text(&stamp, &typed("timestamptz", stamp_kind_offset())).as_deref(),
+            Some("1890-01-01 12:00:00+05:30:15")
+        );
+    }
+
+    fn time_tz() -> ColumnKind {
+        ColumnKind::Time {
+            fractional_digits: None,
+            with_offset: true,
+            range: TimeRange::TimeOfDay,
+        }
+    }
+
+    fn stamp_kind_offset() -> ColumnKind {
+        stamp(None, TemporalZone::Offset)
+    }
+
     #[test]
     fn value_to_text_names_the_non_finite_values() {
         assert_eq!(value_to_text(&Value::Float64(f64::NAN)), Some("NaN".to_owned()));

From 26074884104261fdac1edb4897a9336efa957264 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:27:44 +0700
Subject: [PATCH 11/15] perf(linux-import): plan CSV imports off the GTK
 thread, in row batches

---
 linux/crates/app/src/ui/workspace/import.rs   | 430 ++++++++++++++----
 .../core/src/dialect/insert_batch_limits.rs   |  24 +
 linux/crates/core/src/dialect/mod.rs          |   2 +
 linux/crates/core/src/dialect/sql_dialect.rs  |   8 +-
 linux/crates/core/src/dialect/test_dialect.rs |  15 +-
 linux/crates/core/src/dml/build_insert.rs     |  43 ++
 linux/crates/core/src/dml/mod.rs              |   2 +-
 linux/crates/core/src/import/import_plan.rs   | 301 +++++++++++-
 linux/crates/core/src/import/mod.rs           |   2 +-
 .../crates/drivers/clickhouse/src/dialect.rs  |  16 +-
 .../tests/integration/csv_import.rs           |  53 +++
 .../clickhouse/tests/integration/main.rs      |   1 +
 linux/crates/drivers/mssql/src/dialect.rs     |  14 +-
 .../mssql/tests/integration/csv_import.rs     |  85 +++-
 .../mysql/tests/integration/csv_import.rs     |  78 +++-
 .../postgres/tests/integration/csv_import.rs  |  78 +++-
 .../crates/drivers/sqlite/tests/csv_import.rs |  33 +-
 linux/crates/test-support/src/csv_import.rs   |   4 +-
 18 files changed, 1069 insertions(+), 120 deletions(-)
 create mode 100644 linux/crates/core/src/dialect/insert_batch_limits.rs
 create mode 100644 linux/crates/drivers/clickhouse/tests/integration/csv_import.rs

diff --git a/linux/crates/app/src/ui/workspace/import.rs b/linux/crates/app/src/ui/workspace/import.rs
index 8efe5b8009..4b8218d246 100644
--- a/linux/crates/app/src/ui/workspace/import.rs
+++ b/linux/crates/app/src/ui/workspace/import.rs
@@ -5,12 +5,20 @@ use gtk4::{gio, glib};
 use libadwaita::prelude::*;
 use relm4::{Component, ComponentController};
 
+use std::ops::Range;
+use std::time::Duration;
+
+use tablepro_core::dialect::SqlDialect;
 use tablepro_core::edit::CellInput;
-use tablepro_core::import::{ImportColumn, plan_import};
+use tablepro_core::import::{ImportColumn, ImportPlan, plan_import};
 use tablepro_core::meta::TableRef;
-use tablepro_core::{WriteKind, WriteReport};
+use tablepro_core::{CallOptions, DriverError, WriteKind};
+use tablepro_session::runtime::Tasks;
 use tablepro_session::{OperationError, OperationKind, Session};
+use tokio_util::sync::CancellationToken;
 
+use crate::services::history_service::HistoryService;
+use crate::ui::error_text::{driver_message, operation_error_message};
 use crate::ui::file_read::{FileReadError, read_capped_file};
 use crate::ui::import_dialog::{CsvImport, MAX_CSV_FILE_BYTES};
 
@@ -22,6 +30,11 @@ use crate::workspace::RanStatements;
 /// announces it, so a failed import has something to read back.
 const IMPORT_LOG_SAMPLE: usize = 3;
 
+/// What each statement of an import adds to the save deadline. A
+/// statement carries up to a thousand rows, so this bounds a server that
+/// stopped answering rather than one that is merely slow.
+const IMPORT_TIME_PER_STATEMENT: Duration = Duration::from_secs(5);
+
 impl WorkspaceModel {
     /// Ask for a CSV, then read it and the table's columns together so
     /// the mapping dialog opens with both.
@@ -124,58 +137,251 @@ impl WorkspaceModel {
         self.import_dialog = Some(dialog);
     }
 
-    /// Read the whole file, turn every row into an INSERT and write them
-    /// as one batch, so a file either lands whole or not at all.
+    /// Read the whole file, turn its rows into INSERTs and write them as
+    /// one batch, so a file either lands whole or not at all. The file
+    /// is read and planned on the blocking pool, never on this thread.
     pub(super) fn on_import_csv_run(&self, import: CsvImport) {
-        let Some(session) = self.context.active.get() else {
+        let Some((session, dialect)) = self
+            .context
+            .active
+            .get()
+            .and_then(|session| session.current_dialect().map(|dialect| (session, dialect)))
+        else {
             self.show_toast(&crate::i18n::gettext("Connect to a database first."));
             return;
         };
-        let rows = match import_rows(&import) {
-            Ok(rows) => rows,
-            Err(message) => {
-                self.show_error_alert(&crate::i18n::gettext("Couldn't Import"), &message);
-                return;
-            }
-        };
-        if rows.is_empty() {
-            self.show_toast(&crate::i18n::gettext("That file has no rows to import."));
-            return;
-        }
-
-        let count = rows.len();
-        let table = TableRef::new(import.schema.clone(), import.table.clone());
         let history = Some(self.history.clone());
         let connection = self.context.active.metadata();
-        let dialect = session.current_dialect();
+        let tasks = self.context.tasks.clone();
+        let work = run_import(ImportRun {
+            session,
+            dialect,
+            import,
+            cancel: CancellationToken::new(),
+            tasks: tasks.clone(),
+            history,
+            connection,
+        });
         let input = self.input.clone();
-        drop(self.context.tasks.spawn_task(async move {
-            let written = write_import(&session, table, import.columns, rows).await;
-            match written {
-                Ok((sql, report)) => {
-                    // An import changes the database, so it belongs in
-                    // the same history as a statement run from the editor.
-                    let touched = report.total_rows().and_then(|rows| i64::try_from(rows).ok());
-                    RanStatements::starting(history, connection, dialect, sql)
-                        .finished(touched, tablepro_storage::query_history::Outcome::Success)
-                        .await;
-                    input.deliver(WorkspaceInput::RefreshPage);
-                    input.deliver(WorkspaceInput::ShowToast(crate::i18n::ngettext_f(
-                        "Imported {n} row.",
-                        "Imported {n} rows.",
-                        u32::try_from(count).unwrap_or(u32::MAX),
-                        &[("n", &count.to_string())],
-                    )));
-                }
-                Err(error) => {
-                    let message = crate::ui::error_text::operation_error_message(&error);
-                    input.deliver(WorkspaceInput::ShowAlert {
-                        title: crate::i18n::gettext("Couldn't Import"),
-                        body: message,
-                    });
-                }
+        let _delivery = crate::runtime::spawn_and_deliver(&tasks, work, move |finished| match finished {
+            Ok(Ok(rows)) => {
+                input.deliver(WorkspaceInput::RefreshPage);
+                input.deliver(WorkspaceInput::ShowToast(crate::i18n::ngettext_f(
+                    "Imported {n} row.",
+                    "Imported {n} rows.",
+                    u32::try_from(rows).unwrap_or(u32::MAX),
+                    &[("n", &rows.to_string())],
+                )));
             }
-        }));
+            Ok(Err(ImportEnd::Empty)) => input.deliver(WorkspaceInput::ShowToast(crate::i18n::gettext(
+                "That file has no rows to import.",
+            ))),
+            Ok(Err(ImportEnd::Stopped)) => {
+                input.deliver(WorkspaceInput::RefreshPage);
+                input.deliver(WorkspaceInput::ShowToast(crate::i18n::gettext("Import stopped.")));
+            }
+            Ok(Err(ImportEnd::Failed(message))) => input.deliver(WorkspaceInput::ShowAlert {
+                title: crate::i18n::gettext("Couldn't Import"),
+                body: message,
+            }),
+            Err(failure) => input.deliver(WorkspaceInput::ShowAlert {
+                title: crate::i18n::gettext("Couldn't Import"),
+                body: crate::ui::error_text::task_failure_message(&failure),
+            }),
+        });
+    }
+}
+
+/// Everything an import needs once it leaves the GTK thread.
+struct ImportRun {
+    session: Arc<Session>,
+    dialect: Arc<dyn SqlDialect>,
+    import: CsvImport,
+    cancel: CancellationToken,
+    tasks: Tasks,
+    history: Option<HistoryService>,
+    connection: Option<tablepro_session::ConnectionMetadata>,
+}
+
+/// Why an import wrote nothing, or not everything.
+#[derive(Debug)]
+enum ImportEnd {
+    Empty,
+    Stopped,
+    Failed(String),
+}
+
+/// Read and plan the file on the blocking pool, then write the plan.
+/// Gives back how many rows landed.
+async fn run_import(run: ImportRun) -> Result<usize, ImportEnd> {
+    let ImportRun {
+        session,
+        dialect,
+        import,
+        cancel,
+        tasks,
+        history,
+        connection,
+    } = run;
+    let first_line = first_data_line(&import);
+    let planning_dialect = dialect.clone();
+    let planned = tasks
+        .spawn_blocking_task(move || plan_file(&import, &*planning_dialect))
+        .await
+        .map_err(|failure| ImportEnd::Failed(crate::ui::error_text::task_failure_message(&failure)))??;
+    let Some((plan, rows)) = planned else {
+        return Err(ImportEnd::Empty);
+    };
+    if cancel.is_cancelled() {
+        return Err(ImportEnd::Stopped);
+    }
+    let sql: Vec<String> = plan
+        .batch
+        .steps
+        .iter()
+        .map(|step| step.statement.sql().to_owned())
+        .collect();
+    tracing::info!(
+        rows,
+        statements = sql.len(),
+        sample = ?sql.iter().take(IMPORT_LOG_SAMPLE).collect::<Vec<_>>(),
+        "importing a CSV"
+    );
+    let batch = Arc::new(plan.batch);
+    let written = session
+        .run_cancellable(
+            OperationKind::Save(WriteKind::RowChanges),
+            &cancel,
+            move |lease, options| {
+                let batch = batch.clone();
+                let options = import_call(options, batch.len());
+                async move { Ok(lease.write_batch(&batch, options).await?) }
+            },
+        )
+        .await;
+    match written {
+        Ok(report) => {
+            // An import changes the database, so it belongs in the same
+            // history as a statement run from the editor.
+            let touched = report.total_rows().and_then(|rows| i64::try_from(rows).ok());
+            RanStatements::starting(history, connection, Some(dialect), sql)
+                .finished(touched, tablepro_storage::query_history::Outcome::Success)
+                .await;
+            Ok(rows)
+        }
+        Err(OperationError::Cancelled) => Err(ImportEnd::Stopped),
+        Err(error) => Err(ImportEnd::Failed(import_failure_text(
+            &error,
+            &plan.step_rows,
+            first_line,
+        ))),
+    }
+}
+
+/// The call the write runs under: the save deadline, and as long again
+/// as every statement may take on top of it, so a large file is not cut
+/// off by the deadline a single edit gets.
+fn import_call(options: CallOptions, statements: usize) -> CallOptions {
+    let extra = IMPORT_TIME_PER_STATEMENT.saturating_mul(u32::try_from(statements).unwrap_or(u32::MAX));
+    CallOptions::new(
+        options.deadline().map(|deadline| deadline + extra),
+        options.cancel().clone(),
+    )
+}
+
+/// The header takes the first line when there is one, so the first data
+/// row is line 2 in the file the user is looking at.
+fn first_data_line(import: &CsvImport) -> usize {
+    match import.options.has_header {
+        true => 2,
+        false => 1,
+    }
+}
+
+/// The plan for the whole file and how many rows it writes, `None` for
+/// a file with no rows, or what to tell the user about the file instead.
+fn plan_file(import: &CsvImport, dialect: &dyn SqlDialect) -> Result<Option<(ImportPlan, usize)>, ImportEnd> {
+    let rows = import_rows(import).map_err(ImportEnd::Failed)?;
+    if rows.is_empty() {
+        return Ok(None);
+    }
+    let count = rows.len();
+    let table = TableRef::new(import.schema.clone(), import.table.clone());
+    let plan = plan_import(dialect, &table, &import.columns, rows).map_err(|error| {
+        ImportEnd::Failed(crate::ui::error_text::operation_error_message(&OperationError::Build(
+            error,
+        )))
+    })?;
+    Ok(Some((plan, count)))
+}
+
+/// Why the write failed, told as the lines of the file the failing
+/// statement held rather than as a statement number the user never saw.
+fn import_failure_text(error: &OperationError, step_rows: &[Range<usize>], first_line: usize) -> String {
+    let lines = |index: usize| {
+        step_rows
+            .get(index)
+            .map(|rows| (first_line + rows.start, first_line + rows.end.saturating_sub(1)))
+    };
+    match error {
+        OperationError::Driver(DriverError::RolledBack {
+            statement_index,
+            source,
+        }) => match lines(*statement_index) {
+            Some((first, last)) if first == last => crate::i18n::gettext_f(
+                "Line {line} could not be written: {error}. The import was rolled back, so no rows were added.",
+                &[("line", &first.to_string()), ("error", &driver_message(source))],
+            ),
+            Some((first, last)) => crate::i18n::gettext_f(
+                "Lines {first} to {last} could not be written: {error}. The import was rolled back, so no rows were added.",
+                &[
+                    ("first", &first.to_string()),
+                    ("last", &last.to_string()),
+                    ("error", &driver_message(source)),
+                ],
+            ),
+            None => operation_error_message(error),
+        },
+        OperationError::Driver(DriverError::PartiallyApplied {
+            statement_index,
+            source,
+            ..
+        }) => {
+            let written: usize = step_rows
+                .iter()
+                .take(*statement_index)
+                .map(ExactSizeIterator::len)
+                .sum();
+            let count = u32::try_from(written).unwrap_or(u32::MAX);
+            match lines(*statement_index) {
+                Some((first, last)) if first == last => crate::i18n::ngettext_f(
+                    "Line {line} could not be written: {error}. The {written} row before it stays in the table, which has no transaction to undo it.",
+                    "Line {line} could not be written: {error}. The {written} rows before it stay in the table, which has no transaction to undo them.",
+                    count,
+                    &[
+                        ("line", &first.to_string()),
+                        ("error", &driver_message(source)),
+                        ("written", &written.to_string()),
+                    ],
+                ),
+                // A table without transactions can keep the rows of a
+                // multi-row statement that came before the one it
+                // refused.
+                Some((first, last)) => crate::i18n::ngettext_f(
+                    "Lines {first} to {last} could not be written: {error}. The table has no transaction to undo the import, so the {written} row before them stays, and some of these lines may have been written too.",
+                    "Lines {first} to {last} could not be written: {error}. The table has no transaction to undo the import, so the {written} rows before them stay, and some of these lines may have been written too.",
+                    count,
+                    &[
+                        ("first", &first.to_string()),
+                        ("last", &last.to_string()),
+                        ("error", &driver_message(source)),
+                        ("written", &written.to_string()),
+                    ],
+                ),
+                None => operation_error_message(error),
+            }
+        }
+        _ => operation_error_message(error),
     }
 }
 
@@ -207,35 +413,6 @@ async fn read_columns(session: Arc<Session>, table: TableRef) -> Result<Vec<Impo
         .await
 }
 
-/// Write the rows as one batch on the connection that runs it, giving
-/// back the SQL it ran for the history.
-async fn write_import(
-    session: &Session,
-    table: TableRef,
-    columns: Vec<ImportColumn>,
-    rows: Vec<Vec<CellInput>>,
-) -> Result<(Vec<String>, WriteReport), OperationError> {
-    let rows = Arc::new(rows);
-    session
-        .run(OperationKind::Save(WriteKind::RowChanges), move |lease, options| {
-            let table = table.clone();
-            let columns = columns.clone();
-            let rows = rows.clone();
-            async move {
-                let batch = plan_import(&*lease.dialect(), &table, &columns, &rows)?;
-                let sql: Vec<String> = batch.steps.iter().map(|step| step.statement.sql().to_owned()).collect();
-                tracing::info!(
-                    rows = rows.len(),
-                    sample = ?sql.iter().take(IMPORT_LOG_SAMPLE).collect::<Vec<_>>(),
-                    "importing a CSV"
-                );
-                let report = lease.write_batch(&batch, options).await?;
-                Ok((sql, report))
-            }
-        })
-        .await
-}
-
 /// Every row of the file as the cells to insert, or the first row that
 /// could not be read.
 ///
@@ -245,9 +422,7 @@ fn import_rows(import: &CsvImport) -> Result<Vec<Vec<CellInput>>, String> {
     use tablepro_core::import::{read_csv, row_to_cells};
 
     let sheet = read_csv(&import.bytes, &import.options, None).map_err(|error| error.to_string())?;
-    // The header takes the first line when there is one, so the first
-    // data row is line 2 in the file the user is looking at.
-    let first_line = if import.options.has_header { 2 } else { 1 };
+    let first_line = first_data_line(import);
     sheet
         .rows
         .iter()
@@ -279,7 +454,7 @@ fn import_rows(import: &CsvImport) -> Result<Vec<Vec<CellInput>>, String> {
 mod tests {
     use tablepro_core::column::{ColumnDefault, ColumnKind, ColumnType, TextLength};
     use tablepro_core::ddl::{ColumnAttributes, ColumnDefinition, IdentityStyle, TableDefinition};
-    use tablepro_core::{ColumnInfo, LivenessPolicy, Value};
+    use tablepro_core::{ColumnInfo, LivenessPolicy, Value, WriteReport};
     use tablepro_session::fakes::{FakeConnector, FakeCredentialSource};
     use tablepro_session::operation::DefaultDeadlines;
     use tablepro_session::{SessionDeps, SessionHealth};
@@ -379,24 +554,101 @@ mod tests {
         assert_eq!(*session.health().borrow(), SessionHealth::Online);
     }
 
+    fn run(session: Arc<Session>, import: CsvImport, cancel: CancellationToken) -> ImportRun {
+        ImportRun {
+            session,
+            dialect: Arc::new(tablepro_test_support::FakeDialect),
+            import,
+            cancel,
+            tasks: crate::test_support::paused_tasks(),
+            history: None,
+            connection: None,
+        }
+    }
+
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
-    async fn an_import_is_one_batch_with_an_insert_per_row() {
+    async fn an_import_writes_its_rows_as_one_multi_row_statement() {
         let mut script = ConnectionScript::default();
         script
             .write_batch
-            .always(FakeReply::ok(WriteReport::new(vec![Some(1), Some(1)])));
+            .always(FakeReply::ok(WriteReport::new(vec![Some(2)])));
         let (session, connection) = session(script);
-        let import = import("name,city\nAda,London\nGrace,\n");
-        let rows = import_rows(&import).unwrap();
+        let started = tokio::time::Instant::now();
 
-        let (sql, report) = write_import(&session, TableRef::unqualified("people"), import.columns, rows)
-            .await
-            .unwrap();
+        let rows = run_import(run(
+            session,
+            import("name,city\nAda,London\nGrace,\n"),
+            CancellationToken::new(),
+        ))
+        .await
+        .unwrap();
 
-        assert_eq!(sql.len(), 2);
-        assert!(sql.iter().all(|statement| statement.starts_with("INSERT")), "{sql:?}");
-        assert_eq!(report.total_rows(), Some(2));
+        assert_eq!(rows, 2);
         assert_eq!(CallCounters::get(&connection.counters().write_batch), 1);
+        let sql = connection.observed_sql("write_batch");
+        assert!(
+            sql.iter()
+                .flatten()
+                .any(|sql| sql.contains("VALUES (") && sql.contains("), (")),
+            "the rows went one statement each: {sql:?}"
+        );
+        let deadline = connection.observed_deadlines("write_batch")[0].expect("a deadline");
+        assert!(
+            deadline >= started + DefaultDeadlines::ROW_CHANGES + IMPORT_TIME_PER_STATEMENT,
+            "the deadline did not grow with the import"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn a_stopped_import_says_it_stopped() {
+        let mut script = ConnectionScript::default();
+        script.write_batch.always(FakeReply::UntilStopped);
+        let (session, connection) = session(script);
+        let cancel = CancellationToken::new();
+        let stop = cancel.clone();
+
+        let running = crate::test_support::paused_tasks().spawn_task(run_import(run(
+            session,
+            import("name,city\nAda,London\n"),
+            cancel,
+        )));
+        while CallCounters::get(&connection.counters().write_batch) == 0 {
+            tokio::task::yield_now().await;
+        }
+        stop.cancel();
+
+        assert!(matches!(running.await.unwrap(), Err(ImportEnd::Stopped)));
+    }
+
+    #[test]
+    fn a_failed_statement_is_told_as_the_lines_it_held() {
+        let steps = vec![0..1_000, 1_000..1_500];
+        let rolled_back = OperationError::Driver(DriverError::RolledBack {
+            statement_index: 1,
+            source: Box::new(DriverError::server("null value in column \"city\"")),
+        });
+        let partial = OperationError::Driver(DriverError::PartiallyApplied {
+            applied: 1,
+            statement_index: 1,
+            failed_outcome: tablepro_core::StatementOutcome::Failed,
+            source: Box::new(DriverError::server("null value in column \"city\"")),
+        });
+
+        let rolled_back = import_failure_text(&rolled_back, &steps, 2);
+        let partial = import_failure_text(&partial, &steps, 2);
+
+        assert!(
+            rolled_back.starts_with("Lines 1002 to 1501 could not be written: "),
+            "{rolled_back}"
+        );
+        assert!(
+            rolled_back.ends_with("The import was rolled back, so no rows were added."),
+            "{rolled_back}"
+        );
+        assert!(
+            partial.contains("so the 1000 rows before them stay, and some of these lines may"),
+            "{partial}"
+        );
     }
 
     #[test]
diff --git a/linux/crates/core/src/dialect/insert_batch_limits.rs b/linux/crates/core/src/dialect/insert_batch_limits.rs
new file mode 100644
index 0000000000..046417e1a2
--- /dev/null
+++ b/linux/crates/core/src/dialect/insert_batch_limits.rs
@@ -0,0 +1,24 @@
+/// How much one multi-row INSERT may carry on an engine. A batch of rows
+/// is cut into statements that each stay within all three.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct InsertBatchLimits {
+    /// Rows in one VALUES list.
+    pub rows: usize,
+    /// Parameters bound to one statement.
+    pub params: usize,
+    /// The values one statement carries, measured as their text, so a
+    /// statement stays well inside the engine's packet or request size.
+    pub value_bytes: usize,
+}
+
+impl InsertBatchLimits {
+    /// Within what PostgreSQL (65,535 parameters), MySQL (65,535
+    /// placeholders, a 4 MiB packet on older servers) and SQLite (32,766
+    /// variables) accept. A thousand rows already make one round trip
+    /// a small share of the time a statement takes.
+    pub const DEFAULT: Self = Self {
+        rows: 1_000,
+        params: 30_000,
+        value_bytes: 1 << 20,
+    };
+}
diff --git a/linux/crates/core/src/dialect/mod.rs b/linux/crates/core/src/dialect/mod.rs
index e7811dea48..6cb321fe0f 100644
--- a/linux/crates/core/src/dialect/mod.rs
+++ b/linux/crates/core/src/dialect/mod.rs
@@ -4,6 +4,7 @@
 mod bind_error;
 mod bind_target;
 mod dialect_capabilities;
+mod insert_batch_limits;
 mod keyset_direction;
 mod like_form;
 mod literal_error;
@@ -15,6 +16,7 @@ mod test_dialect;
 pub use bind_error::BindError;
 pub use bind_target::BindTarget;
 pub use dialect_capabilities::DialectCapabilities;
+pub use insert_batch_limits::InsertBatchLimits;
 pub use keyset_direction::KeysetDirection;
 pub use like_form::{LikeCase, LikeForm};
 pub use literal_error::LiteralError;
diff --git a/linux/crates/core/src/dialect/sql_dialect.rs b/linux/crates/core/src/dialect/sql_dialect.rs
index 1bfb37ccdc..61d0d6e4b2 100644
--- a/linux/crates/core/src/dialect/sql_dialect.rs
+++ b/linux/crates/core/src/dialect/sql_dialect.rs
@@ -5,7 +5,8 @@ use crate::sql_syntax::{ExpressionSyntaxError, HistoryRecording, SqlGrammar, Typ
 use crate::value::Value;
 
 use super::{
-    BindError, BindTarget, DialectCapabilities, KeysetDirection, LikeCase, LikeForm, LiteralError, Placeholder,
+    BindError, BindTarget, DialectCapabilities, InsertBatchLimits, KeysetDirection, LikeCase, LikeForm, LiteralError,
+    Placeholder,
 };
 
 /// How one engine spells SQL.
@@ -148,6 +149,11 @@ pub trait SqlDialect: Send + Sync + std::fmt::Debug {
         format!("DELETE FROM {table_sql} WHERE {predicate_sql}")
     }
 
+    /// How much one multi-row INSERT may carry.
+    fn insert_batch_limits(&self) -> InsertBatchLimits {
+        InsertBatchLimits::DEFAULT
+    }
+
     /// Insert a row of nothing but defaults, where the engine has a
     /// spelling for it.
     fn insert_default_row(&self, table_sql: &str) -> Option<String> {
diff --git a/linux/crates/core/src/dialect/test_dialect.rs b/linux/crates/core/src/dialect/test_dialect.rs
index 3044c014e2..348df538cd 100644
--- a/linux/crates/core/src/dialect/test_dialect.rs
+++ b/linux/crates/core/src/dialect/test_dialect.rs
@@ -9,7 +9,10 @@ use crate::sql_syntax::{
 use crate::statement::{BoundParam, ParamType};
 use crate::value::Value;
 
-use super::{BindError, BindTarget, DialectCapabilities, KeysetDirection, LiteralError, Placeholder, SqlDialect};
+use super::{
+    BindError, BindTarget, DialectCapabilities, InsertBatchLimits, KeysetDirection, LiteralError, Placeholder,
+    SqlDialect,
+};
 
 /// The one ANSI dialect the core builders' own tests share.
 ///
@@ -25,6 +28,7 @@ pub struct TestDialect {
     default_row: bool,
     count_all: &'static str,
     grammar: SqlGrammar,
+    insert_limits: InsertBatchLimits,
     binds: Mutex<Vec<RecordedBind>>,
 }
 
@@ -62,6 +66,7 @@ impl Default for TestDialect {
             default_row: true,
             count_all: "COUNT(*)",
             grammar: SqlGrammar::PostgreSql,
+            insert_limits: InsertBatchLimits::DEFAULT,
             binds: Mutex::new(Vec::new()),
         }
     }
@@ -102,6 +107,10 @@ impl TestDialect {
         Self { grammar, ..self }
     }
 
+    pub fn with_insert_limits(self, insert_limits: InsertBatchLimits) -> Self {
+        Self { insert_limits, ..self }
+    }
+
     pub fn targets(&self) -> Vec<RecordedTarget> {
         self.recorded().into_iter().map(|bind| bind.target).collect()
     }
@@ -239,6 +248,10 @@ impl SqlDialect for TestDialect {
         self.count_all
     }
 
+    fn insert_batch_limits(&self) -> InsertBatchLimits {
+        self.insert_limits
+    }
+
     fn insert_default_row(&self, table_sql: &str) -> Option<String> {
         self.default_row
             .then(|| format!("INSERT INTO {table_sql} DEFAULT VALUES"))
diff --git a/linux/crates/core/src/dml/build_insert.rs b/linux/crates/core/src/dml/build_insert.rs
index 415bfb65b7..a3124de0dc 100644
--- a/linux/crates/core/src/dml/build_insert.rs
+++ b/linux/crates/core/src/dml/build_insert.rs
@@ -3,6 +3,7 @@ use crate::dialect::{BindTarget, SqlDialect};
 use crate::edit::CellInput;
 use crate::meta::TableRef;
 use crate::statement::{Statement, StatementBuilder};
+use crate::value::Value;
 
 use super::BuildSqlError;
 
@@ -59,3 +60,45 @@ pub fn build_insert(
     ));
     Ok(builder.finish())
 }
+
+/// One INSERT of several rows into the same columns, each row holding
+/// one value per column, in column order.
+///
+/// One statement takes one round trip for every row in it, and
+/// ClickHouse makes one part of it rather than one per row.
+pub fn build_multi_row_insert(
+    dialect: &dyn SqlDialect,
+    table: &TableRef,
+    columns: &[&ColumnInfo],
+    rows: Vec<Vec<Value>>,
+) -> Result<Statement, BuildSqlError> {
+    if columns.is_empty() || rows.is_empty() {
+        return Err(BuildSqlError::NoInsertValues);
+    }
+    let mut builder = StatementBuilder::new();
+    let mut tuples = Vec::with_capacity(rows.len());
+    for row in rows {
+        if row.len() != columns.len() {
+            return Err(BuildSqlError::LengthMismatch {
+                expected: columns.len(),
+                found: row.len(),
+            });
+        }
+        let mut markers = Vec::with_capacity(columns.len());
+        for (&column, value) in columns.iter().zip(row) {
+            markers.push(builder.bind(dialect, value, BindTarget::Column(column))?);
+        }
+        tuples.push(format!("({})", markers.join(", ")));
+    }
+    let names: Vec<String> = columns
+        .iter()
+        .map(|column| dialect.quote_identifier(&column.name))
+        .collect();
+    builder.push_sql(&format!(
+        "INSERT INTO {} ({}) VALUES {}",
+        dialect.qualify(table),
+        names.join(", "),
+        tuples.join(", ")
+    ));
+    Ok(builder.finish())
+}
diff --git a/linux/crates/core/src/dml/mod.rs b/linux/crates/core/src/dml/mod.rs
index df340d9bb6..c833ec9cb9 100644
--- a/linux/crates/core/src/dml/mod.rs
+++ b/linux/crates/core/src/dml/mod.rs
@@ -15,7 +15,7 @@ mod predicate;
 mod tests;
 
 pub use build_delete::build_delete;
-pub use build_insert::build_insert;
+pub use build_insert::{build_insert, build_multi_row_insert};
 pub use build_key_probe::build_key_probe;
 pub use build_sql_error::BuildSqlError;
 pub use build_update::build_update;
diff --git a/linux/crates/core/src/import/import_plan.rs b/linux/crates/core/src/import/import_plan.rs
index a2caff74a3..d72d614589 100644
--- a/linux/crates/core/src/import/import_plan.rs
+++ b/linux/crates/core/src/import/import_plan.rs
@@ -1,30 +1,303 @@
+use std::ops::Range;
+
 use crate::column::ColumnInfo;
 use crate::dialect::SqlDialect;
-use crate::dml::{BuildSqlError, build_insert};
+use crate::dml::{BuildSqlError, build_insert, build_multi_row_insert};
 use crate::edit::CellInput;
 use crate::meta::TableRef;
 use crate::statement::GuardedStatement;
+use crate::value::Value;
 use crate::{ForeignKeyMode, WriteBatch, WriteKind};
 
 use super::ImportColumn;
 
-/// The rows as one batch, so the engine runs them in one transaction
-/// where it has one and a file either lands whole or not at all.
+/// The write that lands a file's rows in a table.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ImportPlan {
+    /// One batch, so the engine runs it in one transaction where it has
+    /// one and a file either lands whole or not at all.
+    pub batch: WriteBatch,
+    /// The rows each step writes, as indexes into the rows planned, so a
+    /// failed step can be told as the lines of the file it held.
+    pub step_rows: Vec<Range<usize>>,
+}
+
+/// The rows as multi-row INSERTs, each within what the engine takes in
+/// one statement. Consecutive rows that write the same columns share a
+/// statement; a row whose fields left a different set of columns to the
+/// server starts a new one.
+///
+/// Steps are unguarded, as a grid insert is: an INSERT has no row it
+/// could have missed, and SQL Server counts trigger rows in its own.
 pub fn plan_import(
     dialect: &dyn SqlDialect,
     table: &TableRef,
     columns: &[ImportColumn],
-    rows: &[Vec<CellInput>],
-) -> Result<WriteBatch, BuildSqlError> {
+    rows: Vec<Vec<CellInput>>,
+) -> Result<ImportPlan, BuildSqlError> {
+    let limits = dialect.insert_batch_limits();
     let infos: Vec<ColumnInfo> = columns.iter().map(|column| column.info.clone()).collect();
-    let steps = rows
+    let mut steps = Vec::new();
+    let mut step_rows = Vec::new();
+    let mut rows = rows.into_iter().enumerate().peekable();
+    while let Some((first, cells)) = rows.next() {
+        let shape = written_columns(&infos, &cells);
+        let width = shape.iter().filter(|written| **written).count();
+        if width == 0 {
+            // Nothing but defaults has no VALUES list to share.
+            steps.push(GuardedStatement::unguarded(build_insert(
+                dialect, table, &infos, &cells,
+            )?));
+            step_rows.push(first..first + 1);
+            continue;
+        }
+        let mut bytes = row_bytes(&cells);
+        let mut group = vec![written_values(cells, &shape)];
+        while let Some((_, next)) = rows.peek() {
+            let size = row_bytes(next);
+            let fits = group.len() < limits.rows
+                && (group.len() + 1) * width <= limits.params
+                && bytes + size <= limits.value_bytes
+                && written_columns(&infos, next) == shape;
+            if !fits {
+                break;
+            }
+            bytes += size;
+            if let Some((_, next)) = rows.next() {
+                group.push(written_values(next, &shape));
+            }
+        }
+        let count = group.len();
+        let written: Vec<&ColumnInfo> = infos
+            .iter()
+            .zip(&shape)
+            .filter_map(|(column, written)| written.then_some(column))
+            .collect();
+        steps.push(GuardedStatement::unguarded(build_multi_row_insert(
+            dialect, table, &written, group,
+        )?));
+        step_rows.push(first..first + count);
+    }
+    Ok(ImportPlan {
+        batch: WriteBatch::new(WriteKind::RowChanges, table.clone(), steps, ForeignKeyMode::Enforced),
+        step_rows,
+    })
+}
+
+/// Which columns a row writes: every one it has a value for that the
+/// server does not compute.
+fn written_columns(columns: &[ColumnInfo], cells: &[CellInput]) -> Vec<bool> {
+    columns
         .iter()
-        .map(|cells| build_insert(dialect, table, &infos, cells).map(GuardedStatement::unguarded))
-        .collect::<Result<Vec<_>, _>>()?;
-    Ok(WriteBatch::new(
-        WriteKind::RowChanges,
-        table.clone(),
-        steps,
-        ForeignKeyMode::Enforced,
-    ))
+        .zip(cells)
+        .map(|(column, cell)| !column.is_generated && cell.value().is_some())
+        .collect()
+}
+
+fn written_values(cells: Vec<CellInput>, shape: &[bool]) -> Vec<Value> {
+    cells
+        .into_iter()
+        .zip(shape)
+        .filter_map(|(cell, written)| match (cell, written) {
+            (CellInput::Value(value), true) => Some(value),
+            _ => None,
+        })
+        .collect()
+}
+
+/// About how much of a statement a row's values take, as text.
+fn row_bytes(cells: &[CellInput]) -> usize {
+    cells.iter().filter_map(CellInput::value).map(value_bytes).sum()
+}
+
+fn value_bytes(value: &Value) -> usize {
+    match value {
+        Value::Text(text) => text.len(),
+        // Engines that take bytes as text take them as hex.
+        Value::Bytes(bytes) => bytes.len() * 2,
+        Value::Json(json) => json.as_str().len(),
+        Value::Other(other) => other.text.len(),
+        Value::Array(values) => values.iter().map(value_bytes).sum::<usize>() + 2,
+        _ => 16,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::column::{ColumnDefault, ColumnKind, ColumnType, IntegerKind, IntegerWidth, ReadForm, TextLength};
+    use crate::dialect::{InsertBatchLimits, TestDialect};
+
+    fn column(name: &str, kind: ColumnKind) -> ImportColumn {
+        ImportColumn {
+            info: ColumnInfo {
+                name: name.to_owned(),
+                column_type: ColumnType {
+                    name: "t".to_owned(),
+                    kind,
+                    catalog: None,
+                    dynamic_storage: false,
+                    read_form: ReadForm::Native,
+                },
+                nullable: true,
+                primary_key: false,
+                is_auto_increment: false,
+                is_generated: false,
+                default: ColumnDefault::None,
+                comment: None,
+            },
+            server_filled: false,
+        }
+    }
+
+    fn columns() -> Vec<ImportColumn> {
+        vec![
+            column(
+                "id",
+                ColumnKind::Integer(IntegerKind {
+                    width: IntegerWidth::W64,
+                    signed: true,
+                }),
+            ),
+            column(
+                "name",
+                ColumnKind::Text {
+                    length: TextLength::Unbounded,
+                },
+            ),
+        ]
+    }
+
+    fn row(id: i64, name: &str) -> Vec<CellInput> {
+        vec![
+            CellInput::Value(Value::Int(id)),
+            CellInput::Value(Value::Text(name.to_owned())),
+        ]
+    }
+
+    fn table() -> TableRef {
+        TableRef::new(Some("public".to_owned()), "people")
+    }
+
+    #[test]
+    fn rows_that_write_the_same_columns_share_one_statement() {
+        let plan = plan_import(
+            &TestDialect::default(),
+            &table(),
+            &columns(),
+            vec![row(1, "ada"), row(2, "grace")],
+        )
+        .expect("the plan");
+
+        assert_eq!(plan.batch.steps.len(), 1);
+        assert_eq!(
+            plan.batch.steps[0].statement.sql(),
+            r#"INSERT INTO "public"."people" ("id", "name") VALUES ($1, $2), ($3, $4)"#
+        );
+        assert_eq!(
+            plan.batch.steps[0]
+                .statement
+                .params()
+                .iter()
+                .map(|param| param.value().clone())
+                .collect::<Vec<_>>(),
+            vec![
+                Value::Int(1),
+                Value::Text("ada".to_owned()),
+                Value::Int(2),
+                Value::Text("grace".to_owned()),
+            ]
+        );
+        assert_eq!(plan.step_rows, vec![0..2]);
+    }
+
+    #[test]
+    fn a_statement_stops_at_the_engines_row_and_parameter_limits() {
+        let rows = (0..2_500).map(|id| row(id, "x")).collect();
+        let by_rows = plan_import(&TestDialect::default(), &table(), &columns(), rows).expect("the plan");
+        let narrow = TestDialect::default().with_insert_limits(InsertBatchLimits {
+            params: 5,
+            ..InsertBatchLimits::DEFAULT
+        });
+        let by_params =
+            plan_import(&narrow, &table(), &columns(), (0..5).map(|id| row(id, "x")).collect()).expect("the plan");
+
+        assert_eq!(by_rows.step_rows, vec![0..1_000, 1_000..2_000, 2_000..2_500]);
+        assert_eq!(by_params.step_rows, vec![0..2, 2..4, 4..5]);
+        assert!(
+            by_params
+                .batch
+                .steps
+                .iter()
+                .all(|step| step.statement.params().len() <= 5),
+            "a statement bound more than the engine takes"
+        );
+    }
+
+    #[test]
+    fn a_statement_stops_before_its_values_outgrow_the_byte_budget() {
+        let dialect = TestDialect::default().with_insert_limits(InsertBatchLimits {
+            value_bytes: 100,
+            ..InsertBatchLimits::DEFAULT
+        });
+        let long = "x".repeat(60);
+
+        let plan = plan_import(
+            &dialect,
+            &table(),
+            &columns(),
+            vec![row(1, &long), row(2, &long), row(3, "short")],
+        )
+        .expect("the plan");
+
+        assert_eq!(plan.step_rows, vec![0..1, 1..3]);
+    }
+
+    #[test]
+    fn a_row_that_leaves_a_column_to_the_server_starts_a_statement() {
+        let defaulted = vec![CellInput::Value(Value::Int(3)), CellInput::Default];
+
+        let plan = plan_import(
+            &TestDialect::default(),
+            &table(),
+            &columns(),
+            vec![row(1, "ada"), defaulted, row(4, "alan")],
+        )
+        .expect("the plan");
+
+        assert_eq!(plan.step_rows, vec![0..1, 1..2, 2..3]);
+        assert_eq!(
+            plan.batch.steps[1].statement.sql(),
+            r#"INSERT INTO "public"."people" ("id") VALUES ($1)"#
+        );
+    }
+
+    #[test]
+    fn a_row_of_nothing_but_defaults_is_a_default_row_insert() {
+        let plan = plan_import(
+            &TestDialect::default(),
+            &table(),
+            &columns(),
+            vec![vec![CellInput::Default, CellInput::Default]],
+        )
+        .expect("the plan");
+
+        assert_eq!(
+            plan.batch.steps[0].statement.sql(),
+            r#"INSERT INTO "public"."people" DEFAULT VALUES"#
+        );
+    }
+
+    #[test]
+    fn a_generated_column_is_never_written() {
+        let mut columns = columns();
+        columns[1].info.is_generated = true;
+
+        let plan = plan_import(&TestDialect::default(), &table(), &columns, vec![row(1, "ada")]).expect("the plan");
+
+        assert_eq!(
+            plan.batch.steps[0].statement.sql(),
+            r#"INSERT INTO "public"."people" ("id") VALUES ($1)"#
+        );
+    }
 }
diff --git a/linux/crates/core/src/import/mod.rs b/linux/crates/core/src/import/mod.rs
index 059c6eb8b9..eee2d117ad 100644
--- a/linux/crates/core/src/import/mod.rs
+++ b/linux/crates/core/src/import/mod.rs
@@ -9,4 +9,4 @@ pub use csv_import::{
     CsvImportOptions, CsvRowError, CsvSheet, ImportError, MAX_PREVIEW_ROWS, read_csv, row_to_cells, suggest_mapping,
 };
 pub use import_column::ImportColumn;
-pub use import_plan::plan_import;
+pub use import_plan::{ImportPlan, plan_import};
diff --git a/linux/crates/drivers/clickhouse/src/dialect.rs b/linux/crates/drivers/clickhouse/src/dialect.rs
index 83d57f6126..f0c2bca214 100644
--- a/linux/crates/drivers/clickhouse/src/dialect.rs
+++ b/linux/crates/drivers/clickhouse/src/dialect.rs
@@ -4,8 +4,8 @@ use tablepro_core::column::{
 };
 use tablepro_core::ddl::DdlDialect;
 use tablepro_core::dialect::{
-    BindError, BindTarget, DialectCapabilities, KeysetDirection, LikeCase, LikeForm, LiteralError, Placeholder,
-    SqlDialect,
+    BindError, BindTarget, DialectCapabilities, InsertBatchLimits, KeysetDirection, LikeCase, LikeForm, LiteralError,
+    Placeholder, SqlDialect,
 };
 use tablepro_core::export::value_to_text;
 use tablepro_core::meta::{EngineRowId, EngineRowIdPart, TableRef};
@@ -189,6 +189,18 @@ impl SqlDialect for ClickHouseDialect {
         None
     }
 
+    /// Every INSERT makes a part, so a statement carries as many rows as
+    /// its parameters allow. They travel in the request URL, which the
+    /// HTTP client caps at 64 KiB, and escaping can take a value to six
+    /// times its length there.
+    fn insert_batch_limits(&self) -> InsertBatchLimits {
+        InsertBatchLimits {
+            rows: 10_000,
+            params: 1_000,
+            value_bytes: 8 << 10,
+        }
+    }
+
     /// No FINAL, so unmerged duplicates of a sorting key count.
     fn key_probe(&self, table_sql: &str, predicate_sql: &str) -> String {
         format!("SELECT count() FROM (SELECT 1 FROM {table_sql} WHERE {predicate_sql} LIMIT 2)")
diff --git a/linux/crates/drivers/clickhouse/tests/integration/csv_import.rs b/linux/crates/drivers/clickhouse/tests/integration/csv_import.rs
new file mode 100644
index 0000000000..3a8524bbe0
--- /dev/null
+++ b/linux/crates/drivers/clickhouse/tests/integration/csv_import.rs
@@ -0,0 +1,53 @@
+//! The CSV import against ClickHouse, through the same plan the app
+//! runs.
+
+use tablepro_core::import::CsvImportOptions;
+use tablepro_test_support::import_csv;
+
+use crate::support::{CALL, connect, count, quoted, setup, start, table, unique, within};
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_large_file_lands_in_a_few_parts_rather_than_one_per_row() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    let name = unique("readings");
+    setup(
+        connection.as_ref(),
+        &[&format!(
+            "CREATE TABLE {} (id UInt32, label String, taken Date) ENGINE = MergeTree ORDER BY id",
+            quoted(&name)
+        )],
+    )
+    .await;
+    let mut csv = String::from("id,label,taken\n");
+    for id in 1..=2_500 {
+        csv.push_str(&format!("{id},reading {id},2024-01-02\n"));
+    }
+
+    let report = import_csv(
+        connection.as_ref(),
+        &table(&name),
+        csv.as_bytes(),
+        &CsvImportOptions::default(),
+        within(CALL),
+    )
+    .await
+    .expect("the import");
+
+    let statements = report.rows_affected.len() as u64;
+    assert!(statements <= 25, "{statements} statements for 2,500 rows");
+    assert_eq!(
+        count(connection.as_ref(), &format!("SELECT count() FROM {}", quoted(&name))).await,
+        2_500
+    );
+    let parts = count(
+        connection.as_ref(),
+        &format!("SELECT count() FROM system.parts WHERE database = currentDatabase() AND table = '{name}' AND active"),
+    )
+    .await;
+    assert!(
+        parts <= statements,
+        "{parts} parts from {statements} statements: the rows went one part each"
+    );
+}
diff --git a/linux/crates/drivers/clickhouse/tests/integration/main.rs b/linux/crates/drivers/clickhouse/tests/integration/main.rs
index c4200f848e..c44c0fa5f6 100644
--- a/linux/crates/drivers/clickhouse/tests/integration/main.rs
+++ b/linux/crates/drivers/clickhouse/tests/integration/main.rs
@@ -7,6 +7,7 @@
 )]
 
 mod conformance_engine;
+mod csv_import;
 mod ddl;
 mod keys_and_decimals;
 mod metadata;
diff --git a/linux/crates/drivers/mssql/src/dialect.rs b/linux/crates/drivers/mssql/src/dialect.rs
index fa51698434..0cf8b23c52 100644
--- a/linux/crates/drivers/mssql/src/dialect.rs
+++ b/linux/crates/drivers/mssql/src/dialect.rs
@@ -4,8 +4,8 @@ use tablepro_core::column::{
 };
 use tablepro_core::ddl::DdlDialect;
 use tablepro_core::dialect::{
-    BindError, BindTarget, DialectCapabilities, KeysetDirection, LikeCase, LikeForm, LiteralError, Placeholder,
-    SqlDialect,
+    BindError, BindTarget, DialectCapabilities, InsertBatchLimits, KeysetDirection, LikeCase, LikeForm, LiteralError,
+    Placeholder, SqlDialect,
 };
 use tablepro_core::meta::{EngineRowId, EngineRowIdPart};
 use tablepro_core::sql_syntax::{
@@ -245,6 +245,16 @@ impl SqlDialect for MssqlDialect {
         "COUNT_BIG(*)"
     }
 
+    /// A remote procedure call takes at most 2,100 parameters, and a
+    /// VALUES list at most 1,000 rows.
+    fn insert_batch_limits(&self) -> InsertBatchLimits {
+        InsertBatchLimits {
+            rows: 1_000,
+            params: 2_000,
+            ..InsertBatchLimits::DEFAULT
+        }
+    }
+
     /// The lock hints hold the probed key until commit, so the row cannot
     /// change between the probe and the write.
     fn key_probe(&self, table_sql: &str, predicate_sql: &str) -> String {
diff --git a/linux/crates/drivers/mssql/tests/integration/csv_import.rs b/linux/crates/drivers/mssql/tests/integration/csv_import.rs
index 3c948d52af..3a6bd76966 100644
--- a/linux/crates/drivers/mssql/tests/integration/csv_import.rs
+++ b/linux/crates/drivers/mssql/tests/integration/csv_import.rs
@@ -1,9 +1,9 @@
 //! The CSV import against SQL Server, through the same plan the app
 //! runs.
 
-use tablepro_core::Value;
 use tablepro_core::import::CsvImportOptions;
-use tablepro_test_support::import_csv;
+use tablepro_core::{DriverError, Value};
+use tablepro_test_support::{CsvImportFailure, import_csv};
 
 use crate::support::{CALL, connect, dbo, rows, setup, start, within};
 
@@ -34,3 +34,84 @@ async fn an_identity_column_is_numbered_by_the_server() {
         "IDENTITY refuses a value without IDENTITY_INSERT, so the server numbers the row"
     );
 }
+
+/// The file as `id,label,taken` rows, one per id.
+fn readings(ids: impl IntoIterator<Item = u32>) -> String {
+    let mut csv = String::from("id,label,taken\n");
+    for id in ids {
+        csv.push_str(&format!("{id},reading {id},2024-01-02\n"));
+    }
+    csv
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_large_file_lands_in_a_few_multi_row_statements() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    setup(
+        connection.as_ref(),
+        &["CREATE TABLE dbo.readings (id int PRIMARY KEY, label nvarchar(50) NOT NULL, taken date)"],
+    )
+    .await;
+
+    let report = import_csv(
+        connection.as_ref(),
+        &dbo("readings"),
+        readings(1..=2_500).as_bytes(),
+        &CsvImportOptions::default(),
+        within(CALL),
+    )
+    .await
+    .expect("the import");
+
+    // Three columns and SQL Server's 2,000 parameters make 666 rows a
+    // statement.
+    assert_eq!(report.rows_affected.len(), 4, "{report:?}");
+    assert_eq!(
+        rows(
+            connection.as_ref(),
+            "SELECT count(*), min(id), max(id) FROM dbo.readings"
+        )
+        .await,
+        vec![vec![Value::Int(2_500), Value::Int(1), Value::Int(2_500)]]
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_row_that_fails_in_a_later_statement_rolls_the_whole_file_back() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    setup(
+        connection.as_ref(),
+        &["CREATE TABLE dbo.readings (id int PRIMARY KEY, label nvarchar(50) NOT NULL, taken date)"],
+    )
+    .await;
+
+    // Line 1,202 repeats the first id, inside the second statement of
+    // 666 rows.
+    let outcome = import_csv(
+        connection.as_ref(),
+        &dbo("readings"),
+        readings((1..=1_200).chain([1]).chain(1_201..=1_500)).as_bytes(),
+        &CsvImportOptions::default(),
+        within(CALL),
+    )
+    .await;
+
+    assert!(
+        matches!(
+            outcome,
+            Err(CsvImportFailure::Driver(DriverError::RolledBack {
+                statement_index: 1,
+                ..
+            }))
+        ),
+        "{outcome:?}"
+    );
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT count(*) FROM dbo.readings").await,
+        vec![vec![Value::Int(0)]]
+    );
+}
diff --git a/linux/crates/drivers/mysql/tests/integration/csv_import.rs b/linux/crates/drivers/mysql/tests/integration/csv_import.rs
index 77c8ffbb1a..306ea65f3a 100644
--- a/linux/crates/drivers/mysql/tests/integration/csv_import.rs
+++ b/linux/crates/drivers/mysql/tests/integration/csv_import.rs
@@ -1,9 +1,9 @@
 //! The CSV import against MySQL, through the same plan the app runs.
 
-use tablepro_core::Value;
 use tablepro_core::import::CsvImportOptions;
+use tablepro_core::{DriverError, Value};
 use tablepro_test_fixtures::MysqlFlavour;
-use tablepro_test_support::import_csv;
+use tablepro_test_support::{CsvImportFailure, import_csv};
 
 use crate::support::{CALL, connect, rows, setup, start, table, within};
 
@@ -33,3 +33,77 @@ async fn a_file_keeps_its_ids_for_an_auto_increment_column() {
         vec![vec![Value::Int(100)]]
     );
 }
+
+/// The file as `id,label,taken` rows, one per id.
+fn readings(ids: impl IntoIterator<Item = u32>) -> String {
+    let mut csv = String::from("id,label,taken\n");
+    for id in ids {
+        csv.push_str(&format!("{id},reading {id},2024-01-02\n"));
+    }
+    csv
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_large_file_lands_in_a_few_multi_row_statements() {
+    let fixture = start(MysqlFlavour::Mysql).await;
+    let connection = connect(&fixture, false).await;
+    setup(
+        connection.as_ref(),
+        &["CREATE TABLE readings (id int PRIMARY KEY, label text NOT NULL, taken date) ENGINE = InnoDB"],
+    )
+    .await;
+
+    let report = import_csv(
+        connection.as_ref(),
+        &table("readings"),
+        readings(1..=2_500).as_bytes(),
+        &CsvImportOptions::default(),
+        within(CALL),
+    )
+    .await
+    .expect("the import");
+
+    assert_eq!(report.rows_affected, vec![Some(1_000), Some(1_000), Some(500)]);
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT count(*), min(id), max(id) FROM readings").await,
+        vec![vec![Value::Int(2_500), Value::Int(1), Value::Int(2_500)]]
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_row_that_fails_in_a_later_statement_rolls_the_whole_file_back() {
+    let fixture = start(MysqlFlavour::Mysql).await;
+    let connection = connect(&fixture, false).await;
+    setup(
+        connection.as_ref(),
+        &["CREATE TABLE readings (id int PRIMARY KEY, label text NOT NULL, taken date) ENGINE = InnoDB"],
+    )
+    .await;
+
+    // Line 1,202 repeats the first id, inside the second statement.
+    let outcome = import_csv(
+        connection.as_ref(),
+        &table("readings"),
+        readings((1..=1_200).chain([1]).chain(1_201..=1_500)).as_bytes(),
+        &CsvImportOptions::default(),
+        within(CALL),
+    )
+    .await;
+
+    assert!(
+        matches!(
+            outcome,
+            Err(CsvImportFailure::Driver(DriverError::RolledBack {
+                statement_index: 1,
+                ..
+            }))
+        ),
+        "{outcome:?}"
+    );
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT count(*) FROM readings").await,
+        vec![vec![Value::Int(0)]]
+    );
+}
diff --git a/linux/crates/drivers/postgres/tests/integration/csv_import.rs b/linux/crates/drivers/postgres/tests/integration/csv_import.rs
index 2638b92908..7fc1bcf752 100644
--- a/linux/crates/drivers/postgres/tests/integration/csv_import.rs
+++ b/linux/crates/drivers/postgres/tests/integration/csv_import.rs
@@ -2,8 +2,8 @@
 //! runs.
 
 use tablepro_core::import::CsvImportOptions;
-use tablepro_core::{TableRef, Value};
-use tablepro_test_support::import_csv;
+use tablepro_core::{DriverError, TableRef, Value};
+use tablepro_test_support::{CsvImportFailure, import_csv};
 
 use crate::support::{CALL, connect, rows, setup, start, within};
 
@@ -48,3 +48,77 @@ async fn a_file_keeps_its_ids_where_the_identity_takes_them() {
         "GENERATED ALWAYS refuses a value, so the server numbers the row"
     );
 }
+
+/// The file as `id,label,taken` rows, one per id.
+fn readings(ids: impl IntoIterator<Item = u32>) -> String {
+    let mut csv = String::from("id,label,taken\n");
+    for id in ids {
+        csv.push_str(&format!("{id},reading {id},2024-01-02\n"));
+    }
+    csv
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_large_file_lands_in_a_few_multi_row_statements() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    setup(
+        connection.as_ref(),
+        &["CREATE TABLE readings (id int PRIMARY KEY, label text NOT NULL, taken date)"],
+    )
+    .await;
+
+    let report = import_csv(
+        connection.as_ref(),
+        &TableRef::new(Some("public".to_owned()), "readings"),
+        readings(1..=2_500).as_bytes(),
+        &CsvImportOptions::default(),
+        within(CALL),
+    )
+    .await
+    .expect("the import");
+
+    assert_eq!(report.rows_affected, vec![Some(1_000), Some(1_000), Some(500)]);
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT count(*), min(id), max(id) FROM readings").await,
+        vec![vec![Value::Int(2_500), Value::Int(1), Value::Int(2_500)]]
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_row_that_fails_in_a_later_statement_rolls_the_whole_file_back() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    setup(
+        connection.as_ref(),
+        &["CREATE TABLE readings (id int PRIMARY KEY, label text NOT NULL, taken date)"],
+    )
+    .await;
+
+    // Line 1,202 repeats the first id, inside the second statement.
+    let outcome = import_csv(
+        connection.as_ref(),
+        &TableRef::new(Some("public".to_owned()), "readings"),
+        readings((1..=1_200).chain([1]).chain(1_201..=1_500)).as_bytes(),
+        &CsvImportOptions::default(),
+        within(CALL),
+    )
+    .await;
+
+    assert!(
+        matches!(
+            outcome,
+            Err(CsvImportFailure::Driver(DriverError::RolledBack {
+                statement_index: 1,
+                ..
+            }))
+        ),
+        "{outcome:?}"
+    );
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT count(*) FROM readings").await,
+        vec![vec![Value::Int(0)]]
+    );
+}
diff --git a/linux/crates/drivers/sqlite/tests/csv_import.rs b/linux/crates/drivers/sqlite/tests/csv_import.rs
index bb8223e749..487e5a104d 100644
--- a/linux/crates/drivers/sqlite/tests/csv_import.rs
+++ b/linux/crates/drivers/sqlite/tests/csv_import.rs
@@ -116,7 +116,7 @@ async fn a_file_lands_in_the_table_with_its_values_typed() {
     .await
     .expect("the import");
 
-    assert_eq!(affected, vec![Some(1), Some(1)]);
+    assert_eq!(affected, vec![Some(2)], "both rows go in one statement");
     let rows = query(
         connection.as_ref(),
         "SELECT id, name, score, note FROM people ORDER BY id",
@@ -209,6 +209,37 @@ async fn an_empty_field_is_kept_as_an_empty_string_over_the_default() {
     connection.close().await.expect("the close");
 }
 
+#[tokio::test]
+async fn a_large_file_lands_in_a_few_multi_row_statements() {
+    let (_directory, connection) = open().await.expect("a database file");
+    create(
+        connection.as_ref(),
+        "CREATE TABLE readings (id INTEGER PRIMARY KEY, label TEXT NOT NULL)",
+    )
+    .await
+    .expect("the table");
+    let mut csv = String::from("id,label\n");
+    for id in 1..=2_500 {
+        csv.push_str(&format!("{id},reading {id}\n"));
+    }
+
+    let affected = import(
+        connection.as_ref(),
+        "readings",
+        csv.as_bytes(),
+        &CsvImportOptions::default(),
+    )
+    .await
+    .expect("the import");
+
+    assert_eq!(affected, vec![Some(1_000), Some(1_000), Some(500)]);
+    let rows = query(connection.as_ref(), "SELECT count(*), max(id) FROM readings")
+        .await
+        .expect("the count");
+    assert_eq!(rows.rows[0], vec![Value::Int(2_500), Value::Int(2_500)]);
+    connection.close().await.expect("the close");
+}
+
 #[tokio::test]
 async fn a_row_the_table_cannot_hold_leaves_the_table_as_it_was() {
     let (_directory, connection) = open().await.expect("a database file");
diff --git a/linux/crates/test-support/src/csv_import.rs b/linux/crates/test-support/src/csv_import.rs
index 084b9c210c..783e96737c 100644
--- a/linux/crates/test-support/src/csv_import.rs
+++ b/linux/crates/test-support/src/csv_import.rs
@@ -41,9 +41,9 @@ pub async fn import_csv(
         .map(|(index, row)| row_to_cells(row, &mapping, &columns, options, first_line + index))
         .collect::<Result<Vec<_>, _>>()
         .map_err(CsvImportFailure::Row)?;
-    let batch = plan_import(connection.dialect().as_ref(), table, &columns, &rows).map_err(CsvImportFailure::Build)?;
+    let plan = plan_import(connection.dialect().as_ref(), table, &columns, rows).map_err(CsvImportFailure::Build)?;
     connection
-        .write_batch(&batch, call)
+        .write_batch(&plan.batch, call)
         .await
         .map_err(CsvImportFailure::Driver)
 }

From 499769f22151bc2d8258a6e9b0b835cc12f9cd44 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:27:58 +0700
Subject: [PATCH 12/15] fix(linux-import): ask before a close stops a running
 CSV import

---
 linux/crates/app/src/ui/workspace/import.rs   |  57 ++--
 .../app/src/ui/workspace/import_ledger.rs     | 263 ++++++++++++++++++
 linux/crates/app/src/ui/workspace/mod.rs      |  10 +
 linux/po/POTFILES.in                          |   1 +
 4 files changed, 306 insertions(+), 25 deletions(-)
 create mode 100644 linux/crates/app/src/ui/workspace/import_ledger.rs

diff --git a/linux/crates/app/src/ui/workspace/import.rs b/linux/crates/app/src/ui/workspace/import.rs
index 4b8218d246..ab4c6ade4f 100644
--- a/linux/crates/app/src/ui/workspace/import.rs
+++ b/linux/crates/app/src/ui/workspace/import.rs
@@ -150,6 +150,9 @@ impl WorkspaceModel {
             self.show_toast(&crate::i18n::gettext("Connect to a database first."));
             return;
         };
+        let Some(ticket) = self.imports.begin() else {
+            return;
+        };
         let history = Some(self.history.clone());
         let connection = self.context.active.metadata();
         let tasks = self.context.tasks.clone();
@@ -157,37 +160,41 @@ impl WorkspaceModel {
             session,
             dialect,
             import,
-            cancel: CancellationToken::new(),
+            cancel: ticket.cancel.clone(),
             tasks: tasks.clone(),
             history,
             connection,
         });
+        let imports = self.imports.clone();
         let input = self.input.clone();
-        let _delivery = crate::runtime::spawn_and_deliver(&tasks, work, move |finished| match finished {
-            Ok(Ok(rows)) => {
-                input.deliver(WorkspaceInput::RefreshPage);
-                input.deliver(WorkspaceInput::ShowToast(crate::i18n::ngettext_f(
-                    "Imported {n} row.",
-                    "Imported {n} rows.",
-                    u32::try_from(rows).unwrap_or(u32::MAX),
-                    &[("n", &rows.to_string())],
-                )));
-            }
-            Ok(Err(ImportEnd::Empty)) => input.deliver(WorkspaceInput::ShowToast(crate::i18n::gettext(
-                "That file has no rows to import.",
-            ))),
-            Ok(Err(ImportEnd::Stopped)) => {
-                input.deliver(WorkspaceInput::RefreshPage);
-                input.deliver(WorkspaceInput::ShowToast(crate::i18n::gettext("Import stopped.")));
+        let _delivery = crate::runtime::spawn_and_deliver(&tasks, work, move |finished| {
+            imports.settle(ticket.id);
+            match finished {
+                Ok(Ok(rows)) => {
+                    input.deliver(WorkspaceInput::RefreshPage);
+                    input.deliver(WorkspaceInput::ShowToast(crate::i18n::ngettext_f(
+                        "Imported {n} row.",
+                        "Imported {n} rows.",
+                        u32::try_from(rows).unwrap_or(u32::MAX),
+                        &[("n", &rows.to_string())],
+                    )));
+                }
+                Ok(Err(ImportEnd::Empty)) => input.deliver(WorkspaceInput::ShowToast(crate::i18n::gettext(
+                    "That file has no rows to import.",
+                ))),
+                Ok(Err(ImportEnd::Stopped)) => {
+                    input.deliver(WorkspaceInput::RefreshPage);
+                    input.deliver(WorkspaceInput::ShowToast(crate::i18n::gettext("Import stopped.")));
+                }
+                Ok(Err(ImportEnd::Failed(message))) => input.deliver(WorkspaceInput::ShowAlert {
+                    title: crate::i18n::gettext("Couldn't Import"),
+                    body: message,
+                }),
+                Err(failure) => input.deliver(WorkspaceInput::ShowAlert {
+                    title: crate::i18n::gettext("Couldn't Import"),
+                    body: crate::ui::error_text::task_failure_message(&failure),
+                }),
             }
-            Ok(Err(ImportEnd::Failed(message))) => input.deliver(WorkspaceInput::ShowAlert {
-                title: crate::i18n::gettext("Couldn't Import"),
-                body: message,
-            }),
-            Err(failure) => input.deliver(WorkspaceInput::ShowAlert {
-                title: crate::i18n::gettext("Couldn't Import"),
-                body: crate::ui::error_text::task_failure_message(&failure),
-            }),
         });
     }
 }
diff --git a/linux/crates/app/src/ui/workspace/import_ledger.rs b/linux/crates/app/src/ui/workspace/import_ledger.rs
new file mode 100644
index 0000000000..0c5fb8d009
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/import_ledger.rs
@@ -0,0 +1,263 @@
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+use std::future::Future;
+use std::rc::Rc;
+
+use futures::channel::oneshot;
+use futures::future::LocalBoxFuture;
+use tablepro_session::runtime::{HoldToken, ProcessHold};
+use tokio_util::sync::CancellationToken;
+
+use crate::i18n::{gettext, ngettext_f};
+use crate::ui::format::plural_count;
+use crate::workspace::{CloseBlockPrompt, CloseBlocker, InhibitReason, WindowInhibitor};
+
+/// The CSV imports a workspace has running.
+///
+/// Each one holds the process, so quitting while one writes lets it
+/// commit or roll back and report, and closing the window asks before
+/// it stops one. While any runs, the session is asked not to log out or
+/// suspend under it.
+pub(crate) struct ImportLedger {
+    hold: Rc<dyn ProcessHold>,
+    inhibitor: RefCell<WindowInhibitor>,
+    state: RefCell<LedgerState>,
+}
+
+#[derive(Default)]
+struct LedgerState {
+    next: u64,
+    running: BTreeMap<u64, Running>,
+    waiters: Vec<oneshot::Sender<()>>,
+    /// The workspace shut down: its close already asked about the
+    /// imports, and a new one would have no window to report to.
+    shut_down: bool,
+}
+
+struct Running {
+    cancel: CancellationToken,
+    _hold: HoldToken,
+}
+
+/// A started import: its id to settle it by, and the token that stops
+/// it.
+#[derive(Debug, Clone)]
+pub(crate) struct ImportTicket {
+    pub id: u64,
+    pub cancel: CancellationToken,
+}
+
+impl ImportLedger {
+    pub(crate) fn new(hold: Rc<dyn ProcessHold>, inhibitor: WindowInhibitor) -> Rc<Self> {
+        Rc::new(Self {
+            hold,
+            inhibitor: RefCell::new(inhibitor),
+            state: RefCell::default(),
+        })
+    }
+
+    /// Record an import, unless the workspace has shut down.
+    pub(crate) fn begin(&self) -> Option<ImportTicket> {
+        let ticket = {
+            let mut state = self.state.borrow_mut();
+            if state.shut_down {
+                return None;
+            }
+            state.next += 1;
+            let ticket = ImportTicket {
+                id: state.next,
+                cancel: CancellationToken::new(),
+            };
+            state.running.insert(
+                ticket.id,
+                Running {
+                    cancel: ticket.cancel.clone(),
+                    _hold: self.hold.acquire(),
+                },
+            );
+            ticket
+        };
+        self.refresh_inhibitor();
+        Some(ticket)
+    }
+
+    /// The import ended. A second call for the same one does nothing.
+    pub(crate) fn settle(&self, id: u64) {
+        let (finished, woken) = {
+            let mut state = self.state.borrow_mut();
+            let finished = state.running.remove(&id);
+            let woken = match state.running.is_empty() {
+                true => std::mem::take(&mut state.waiters),
+                false => Vec::new(),
+            };
+            (finished, woken)
+        };
+        self.refresh_inhibitor();
+        // The hold goes only after the state is consistent, in case
+        // dropping it ends the main loop.
+        drop(finished);
+        for waiter in woken {
+            let _ = waiter.send(());
+        }
+    }
+
+    pub(crate) fn in_flight(&self) -> usize {
+        self.state.borrow().running.len()
+    }
+
+    /// Resolves once no import is running.
+    pub(crate) fn when_idle(&self) -> impl Future<Output = ()> + use<> {
+        let receiver = match self.in_flight() {
+            0 => None,
+            _ => {
+                let (sender, receiver) = oneshot::channel();
+                self.state.borrow_mut().waiters.push(sender);
+                Some(receiver)
+            }
+        };
+        async move {
+            if let Some(receiver) = receiver {
+                // A ledger dropped with imports running wakes nobody,
+                // and a waiter that outlived it has nothing to wait on.
+                let _ = receiver.await;
+            }
+        }
+    }
+
+    /// Stop every running import. Each settles once its driver has
+    /// answered the stop.
+    pub(crate) fn cancel_all(&self) {
+        for running in self.state.borrow().running.values() {
+            running.cancel.cancel();
+        }
+    }
+
+    /// Stop every running import and refuse new ones, for a workspace
+    /// that is going away.
+    pub(crate) fn shut_down(&self) {
+        self.state.borrow_mut().shut_down = true;
+        self.cancel_all();
+    }
+
+    fn refresh_inhibitor(&self) {
+        let reason = (self.in_flight() > 0).then_some(InhibitReason::SavingChanges);
+        self.inhibitor.borrow_mut().update(reason);
+    }
+}
+
+impl CloseBlocker for ImportLedger {
+    fn blocking(&self) -> Option<CloseBlockPrompt> {
+        let running = self.in_flight();
+        (running > 0).then(|| CloseBlockPrompt {
+            heading: gettext("Stop Imports?"),
+            body: ngettext_f(
+                "{n} CSV import is still running. Stopping it rolls back the rows it wrote, unless the table has no transactions.",
+                "{n} CSV imports are still running. Stopping them rolls back the rows they wrote, unless the table has no transactions.",
+                plural_count(running as u64),
+                &[("n", &running.to_string())],
+            ),
+            keep_label: gettext("_Keep Importing"),
+            stop_label: gettext("_Stop Imports"),
+        })
+    }
+
+    fn stop(&self) -> LocalBoxFuture<'static, ()> {
+        self.cancel_all();
+        Box::pin(self.when_idle())
+    }
+}
+
+impl std::fmt::Debug for ImportLedger {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ImportLedger")
+            .field("in_flight", &self.in_flight())
+            .finish_non_exhaustive()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::Cell;
+
+    use gtk4 as gtk;
+    use tablepro_session::runtime::CountingHold;
+
+    use super::*;
+    use crate::workspace::InhibitTarget;
+
+    /// Counts the inhibitions held.
+    #[derive(Clone, Default)]
+    struct Session {
+        held: Rc<Cell<u32>>,
+    }
+
+    impl InhibitTarget for Session {
+        fn inhibit(&self, _flags: gtk::ApplicationInhibitFlags, _reason: &str) -> u32 {
+            self.held.set(self.held.get() + 1);
+            self.held.get()
+        }
+
+        fn uninhibit(&self, _cookie: u32) {
+            self.held.set(self.held.get() - 1);
+        }
+    }
+
+    fn ledger() -> (Rc<ImportLedger>, Rc<CountingHold>, Session) {
+        let hold = Rc::new(CountingHold::new());
+        let session = Session::default();
+        let ledger = ImportLedger::new(hold.clone(), WindowInhibitor::new(session.clone()));
+        (ledger, hold, session)
+    }
+
+    #[test]
+    fn a_running_import_holds_the_process_and_asks_before_a_close() {
+        let (ledger, hold, session) = ledger();
+        assert_eq!(ledger.blocking(), None);
+
+        let ticket = ledger.begin().expect("an import starts");
+        let prompt = ledger.blocking().expect("a running import blocks the close");
+
+        assert_eq!(prompt.heading, "Stop Imports?");
+        assert!(
+            prompt.body.starts_with("1 CSV import is still running."),
+            "{}",
+            prompt.body
+        );
+        assert_eq!(hold.live(), 1);
+        assert_eq!(session.held.get(), 1);
+
+        ledger.settle(ticket.id);
+
+        assert_eq!(ledger.blocking(), None);
+        assert_eq!(hold.live(), 0);
+        assert_eq!(session.held.get(), 0);
+    }
+
+    #[tokio::test]
+    async fn stop_cancels_the_import_and_waits_for_it_to_settle() {
+        let (ledger, _, _) = ledger();
+        let ticket = ledger.begin().expect("an import starts");
+
+        let mut stopped = ledger.stop();
+        assert!(ticket.cancel.is_cancelled(), "the stop did not reach the write");
+        assert!(
+            futures::poll!(&mut stopped).is_pending(),
+            "the stop ended before the import settled"
+        );
+        ledger.settle(ticket.id);
+
+        stopped.await;
+        assert_eq!(ledger.in_flight(), 0);
+    }
+
+    #[test]
+    fn a_workspace_that_shut_down_starts_no_import() {
+        let (ledger, _, _) = ledger();
+        let running = ledger.begin().expect("an import starts");
+
+        ledger.shut_down();
+
+        assert!(running.cancel.is_cancelled());
+        assert!(ledger.begin().is_none());
+    }
+}
diff --git a/linux/crates/app/src/ui/workspace/mod.rs b/linux/crates/app/src/ui/workspace/mod.rs
index 63f8584233..ff044cec38 100644
--- a/linux/crates/app/src/ui/workspace/mod.rs
+++ b/linux/crates/app/src/ui/workspace/mod.rs
@@ -10,6 +10,7 @@ mod finished_work;
 mod health_banner;
 mod imp;
 mod import;
+mod import_ledger;
 mod row_ops;
 mod saves;
 mod session_watches;
@@ -149,6 +150,8 @@ pub(crate) struct WorkspaceModel {
     close_guards: Rc<CloseGuards>,
     /// The exports running from this workspace's grids.
     exports: Rc<ExportLedger>,
+    /// The CSV imports running into this workspace's tables.
+    imports: Rc<import_ledger::ImportLedger>,
     /// Whether the window was last told there is something to lose.
     reported_dirty: Cell<Option<bool>>,
     history_dialog: Option<HistoryDialog>,
@@ -501,6 +504,10 @@ impl Workspace {
         );
         let persistence = workspace_persistence::WorkspacePersistence::new(storage.workspaces().clone());
         let exports = workspace.export_ledger(&window, &tasks, &context, &input);
+        let imports = import_ledger::ImportLedger::new(
+            context.hold.clone(),
+            WindowInhibitor::new(ApplicationInhibit::new(&window)),
+        );
         let sidebar = sidebar::build(&workspace, &input, sidebar::SidebarAffordances::for_session(&session));
         let WorkspaceTabParts {
             tab_view,
@@ -560,6 +567,7 @@ impl Workspace {
             workspace_handle,
             close_guards,
             exports: exports.clone(),
+            imports: imports.clone(),
             reported_dirty: Cell::new(None),
             history_dialog: None,
             saved_queries_dialog: None,
@@ -573,6 +581,7 @@ impl Workspace {
         };
         imp.model.replace(Some(model));
         workspace.register_close_blocker(exports);
+        workspace.register_close_blocker(imports);
         workspace
     }
 
@@ -897,6 +906,7 @@ impl WorkspaceModel {
         // The close asked about them already; one started since has no
         // window left to finish in.
         self.exports.shut_down();
+        self.imports.shut_down();
         self.context.active.take();
     }
 
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index 1316fc369b..b2361fd75b 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -439,6 +439,7 @@ crates/app/src/ui/workspace/finished_work.rs
 crates/app/src/ui/workspace/health_banner.rs
 crates/app/src/ui/workspace/imp.rs
 crates/app/src/ui/workspace/import.rs
+crates/app/src/ui/workspace/import_ledger.rs
 crates/app/src/ui/workspace/mod.rs
 crates/app/src/ui/workspace/row_ops.rs
 crates/app/src/ui/workspace/saves.rs

From b9e1ecd4649fd3e14f9c209f58dd68d31fa99101 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:28:06 +0700
Subject: [PATCH 13/15] fix(linux-import): refuse a CSV record wider than 4,096
 fields

---
 linux/crates/app/src/ui/import_dialog.rs   |  5 +-
 linux/crates/core/src/import/csv_import.rs | 59 +++++++++++++++++++---
 linux/crates/core/src/import/mod.rs        |  3 +-
 3 files changed, 59 insertions(+), 8 deletions(-)

diff --git a/linux/crates/app/src/ui/import_dialog.rs b/linux/crates/app/src/ui/import_dialog.rs
index 7838f78874..ca87bf9a6b 100644
--- a/linux/crates/app/src/ui/import_dialog.rs
+++ b/linux/crates/app/src/ui/import_dialog.rs
@@ -261,12 +261,15 @@ impl ImportCsvDialog {
             .chain(self.sheet.headers.iter().cloned())
             .collect();
         let choice_refs: Vec<&str> = choices.iter().map(String::as_str).collect();
+        // One list for every row: each row keeps its own selection, and
+        // a wide file is held once rather than once per column.
+        let choices = gtk::StringList::new(&choice_refs);
         let suggested = suggest_mapping(&self.sheet.headers, &self.columns);
 
         for (column, field) in self.columns.iter().zip(&suggested) {
             let row = adw::ComboRow::builder()
                 .title(glib::markup_escape_text(&column.info.name))
-                .model(&gtk::StringList::new(&choice_refs))
+                .model(&choices)
                 .sensitive(!column.server_filled)
                 .build();
             row.set_selected(field.map_or(0, |index| index as u32 + 1));
diff --git a/linux/crates/core/src/import/csv_import.rs b/linux/crates/core/src/import/csv_import.rs
index fceb660d6c..1ae1fa7101 100644
--- a/linux/crates/core/src/import/csv_import.rs
+++ b/linux/crates/core/src/import/csv_import.rs
@@ -11,6 +11,12 @@ use super::ImportColumn;
 /// gigabyte file still opens the dialog at once.
 pub const MAX_PREVIEW_ROWS: usize = 50;
 
+/// The most fields one record may have. No engine takes a table this
+/// wide (MySQL stops at 4,096 columns), and every row of the preview is
+/// padded to the widest, so a line of nothing but commas must not decide
+/// how much is allocated.
+pub const MAX_FIELDS: usize = 4_096;
+
 #[derive(Debug, Error, PartialEq, Eq)]
 pub enum ImportError {
     #[error("the file is not valid UTF-8 at byte {offset}")]
@@ -21,6 +27,9 @@ pub enum ImportError {
 
     #[error("the file has no columns in it")]
     NoColumns,
+
+    #[error("line {line} has more than {limit} fields")]
+    TooManyFields { line: u64, limit: usize },
 }
 
 /// What a row could not be turned into, named well enough for the user
@@ -88,12 +97,13 @@ pub fn read_csv(bytes: &[u8], options: &CsvImportOptions, limit: Option<usize>)
         .from_reader(bytes);
 
     let headers: Vec<String> = match options.has_header {
-        true => reader
-            .headers()
-            .map_err(|error| ImportError::Malformed(error.to_string()))?
-            .iter()
-            .map(str::to_owned)
-            .collect(),
+        true => {
+            let header = reader
+                .headers()
+                .map_err(|error| ImportError::Malformed(error.to_string()))?;
+            within_width(header)?;
+            header.iter().map(str::to_owned).collect()
+        }
         false => Vec::new(),
     };
 
@@ -107,6 +117,7 @@ pub fn read_csv(bytes: &[u8], options: &CsvImportOptions, limit: Option<usize>)
             truncated = true;
             break;
         }
+        within_width(&record)?;
         rows.push(record.iter().map(str::to_owned).collect());
     }
 
@@ -131,6 +142,17 @@ pub fn read_csv(bytes: &[u8], options: &CsvImportOptions, limit: Option<usize>)
     })
 }
 
+/// Refuse a record wider than `MAX_FIELDS` before its fields are copied.
+fn within_width(record: &csv::StringRecord) -> Result<(), ImportError> {
+    match record.len() > MAX_FIELDS {
+        true => Err(ImportError::TooManyFields {
+            line: record.position().map_or(1, csv::Position::line),
+            limit: MAX_FIELDS,
+        }),
+        false => Ok(()),
+    }
+}
+
 /// A starting mapping: each table column takes the CSV field whose
 /// header matches its name, ignoring case and surrounding space.
 ///
@@ -350,6 +372,31 @@ mod tests {
         assert_eq!(error, ImportError::NotUtf8 { offset: 6 });
     }
 
+    #[test]
+    fn a_record_wider_than_any_table_is_refused_before_it_is_padded() {
+        let mut file = String::from("a,b\n1,2\n");
+        file.push_str(&",".repeat(MAX_FIELDS));
+        file.push('\n');
+        let header = format!("{}\n1\n", ",".repeat(MAX_FIELDS));
+
+        assert_eq!(
+            read_csv(file.as_bytes(), &options(), Some(MAX_PREVIEW_ROWS)),
+            Err(ImportError::TooManyFields {
+                line: 3,
+                limit: MAX_FIELDS
+            })
+        );
+        assert_eq!(
+            read_csv(header.as_bytes(), &options(), None),
+            Err(ImportError::TooManyFields {
+                line: 1,
+                limit: MAX_FIELDS
+            })
+        );
+        let widest = format!("{}\n", ",".repeat(MAX_FIELDS - 1));
+        assert!(read_csv(widest.as_bytes(), &options(), None).is_ok());
+    }
+
     #[test]
     fn an_empty_file_has_no_columns() {
         assert_eq!(read_csv(b"", &options(), None), Err(ImportError::NoColumns));
diff --git a/linux/crates/core/src/import/mod.rs b/linux/crates/core/src/import/mod.rs
index eee2d117ad..145663e5c1 100644
--- a/linux/crates/core/src/import/mod.rs
+++ b/linux/crates/core/src/import/mod.rs
@@ -6,7 +6,8 @@ mod import_column;
 mod import_plan;
 
 pub use csv_import::{
-    CsvImportOptions, CsvRowError, CsvSheet, ImportError, MAX_PREVIEW_ROWS, read_csv, row_to_cells, suggest_mapping,
+    CsvImportOptions, CsvRowError, CsvSheet, ImportError, MAX_FIELDS, MAX_PREVIEW_ROWS, read_csv, row_to_cells,
+    suggest_mapping,
 };
 pub use import_column::ImportColumn;
 pub use import_plan::{ImportPlan, plan_import};

From 7b104d70543b509404a21b8bf621cde539e999f6 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 16:28:28 +0700
Subject: [PATCH 14/15] fix(linux-import): report CSV problems inside the
 import dialog

---
 linux/crates/app/src/ui/import_dialog.rs    | 119 +++++++++++++++++---
 linux/crates/app/src/ui/workspace/import.rs |   5 +-
 2 files changed, 104 insertions(+), 20 deletions(-)

diff --git a/linux/crates/app/src/ui/import_dialog.rs b/linux/crates/app/src/ui/import_dialog.rs
index ca87bf9a6b..c8f7ca31b2 100644
--- a/linux/crates/app/src/ui/import_dialog.rs
+++ b/linux/crates/app/src/ui/import_dialog.rs
@@ -6,7 +6,9 @@ use relm4::prelude::*;
 use relm4::{adw, gtk};
 
 use tablepro_core::export::CsvDelimiter;
-use tablepro_core::import::{CsvImportOptions, CsvSheet, ImportColumn, MAX_PREVIEW_ROWS, read_csv, suggest_mapping};
+use tablepro_core::import::{
+    CsvImportOptions, CsvSheet, ImportColumn, ImportError, MAX_PREVIEW_ROWS, read_csv, suggest_mapping,
+};
 
 use crate::runtime::DeliverInput;
 
@@ -29,6 +31,8 @@ pub struct ImportCsvDialog {
     bytes: Vec<u8>,
     columns: Vec<ImportColumn>,
     sheet: CsvSheet,
+    /// Why the file could not be read under the options as they stand.
+    read_error: Option<String>,
     options: CsvImportOptions,
     /// One row per table column, in column order. The selected index is
     /// 0 for "Skip" and the field number plus one otherwise.
@@ -78,7 +82,6 @@ pub struct CsvImport {
 #[derive(Debug)]
 pub enum ImportCsvDialogOutput {
     Import(Box<CsvImport>),
-    ShowToast(String),
 }
 
 impl Component for ImportCsvDialog {
@@ -149,8 +152,14 @@ impl Component for ImportCsvDialog {
             .build();
         page.add(&mapping_group);
 
-        let summary = gtk::Label::builder().xalign(0.0).wrap(true).build();
-        summary.add_css_class("dim-label");
+        // Problems with the file are told here, inside the dialog that
+        // covers the window a toast would go to, and long enough to read.
+        let summary = gtk::Label::builder()
+            .xalign(0.0)
+            .wrap(true)
+            .wrap_mode(gtk::pango::WrapMode::WordChar)
+            .selectable(true)
+            .build();
         let summary_group = adw::PreferencesGroup::new();
         summary_group.add(&summary);
         page.add(&summary_group);
@@ -172,6 +181,7 @@ impl Component for ImportCsvDialog {
             bytes: init.bytes,
             columns: init.columns,
             sheet: CsvSheet::default(),
+            read_error: None,
             options: CsvImportOptions::default(),
             mapping_rows: Rc::new(RefCell::new(Vec::new())),
             mapping_group,
@@ -192,13 +202,11 @@ impl Component for ImportCsvDialog {
             ImportCsvDialogInput::MappingChanged => {
                 self.options = self.read_options();
                 self.show_samples();
+                self.show_summary();
             }
             ImportCsvDialogInput::Import => {
                 let mapping = self.mapping();
-                if mapping.iter().all(Option::is_none) {
-                    let _ = sender.output(ImportCsvDialogOutput::ShowToast(crate::i18n::gettext(
-                        "Every column is set to Skip, so there is nothing to import.",
-                    )));
+                if self.blocker().is_some() {
                     return;
                 }
                 let _ = sender.output(ImportCsvDialogOutput::Import(Box::new(CsvImport {
@@ -240,12 +248,11 @@ impl ImportCsvDialog {
         match read_csv(&self.bytes, &self.options, Some(MAX_PREVIEW_ROWS)) {
             Ok(sheet) => {
                 self.sheet = sheet;
-                self.import_button.set_sensitive(true);
+                self.read_error = None;
             }
             Err(error) => {
                 self.sheet = CsvSheet::default();
-                self.import_button.set_sensitive(false);
-                let _ = sender.output(ImportCsvDialogOutput::ShowToast(error.to_string()));
+                self.read_error = Some(import_error_text(&error));
             }
         }
         self.rebuild_mapping(sender);
@@ -293,17 +300,40 @@ impl ImportCsvDialog {
         }
     }
 
+    /// What stands in the way of importing, if anything.
+    fn blocker(&self) -> Option<String> {
+        if let Some(error) = &self.read_error {
+            return Some(error.clone());
+        }
+        if self.sheet.rows.is_empty() {
+            return Some(crate::i18n::gettext("The file has no rows to import."));
+        }
+        if self.mapping().iter().all(Option::is_none) {
+            return Some(crate::i18n::gettext(
+                "Every column is set to Skip. Pick a field for at least one column to import.",
+            ));
+        }
+        None
+    }
+
     fn show_summary(&self) {
-        let text = match self.sheet.headers.is_empty() {
-            true => crate::i18n::gettext("The file could not be read."),
-            false if self.sheet.truncated => crate::i18n::gettext_f(
+        let blocker = self.blocker();
+        self.import_button.set_sensitive(blocker.is_none());
+        let text = match blocker {
+            Some(blocker) => {
+                self.summary.remove_css_class("dim-label");
+                self.summary.add_css_class("error");
+                self.summary.set_label(&blocker);
+                return;
+            }
+            None if self.sheet.truncated => crate::i18n::gettext_f(
                 "{fields} fields. Showing the first {rows} rows; the whole file is imported.",
                 &[
                     ("fields", &self.sheet.headers.len().to_string()),
                     ("rows", &self.sheet.rows.len().to_string()),
                 ],
             ),
-            false => crate::i18n::ngettext_f(
+            None => crate::i18n::ngettext_f(
                 "{fields} fields, {rows} row.",
                 "{fields} fields, {rows} rows.",
                 self.sheet.rows.len() as u32,
@@ -313,6 +343,8 @@ impl ImportCsvDialog {
                 ],
             ),
         };
+        self.summary.remove_css_class("error");
+        self.summary.add_css_class("dim-label");
         self.summary.set_label(&text);
     }
 
@@ -330,6 +362,24 @@ impl ImportCsvDialog {
     }
 }
 
+/// What went wrong reading the file, in words the user can act on.
+pub(crate) fn import_error_text(error: &ImportError) -> String {
+    match error {
+        ImportError::NotUtf8 { offset } => crate::i18n::gettext_f(
+            "The file isn't UTF-8 text from byte {offset} on. Save it as UTF-8 and import it again.",
+            &[("offset", &offset.to_string())],
+        ),
+        ImportError::Malformed(detail) => {
+            crate::i18n::gettext_f("The file couldn't be read as CSV: {error}", &[("error", detail)])
+        }
+        ImportError::NoColumns => crate::i18n::gettext("The file has no columns."),
+        ImportError::TooManyFields { line, limit } => crate::i18n::gettext_f(
+            "Line {line} has more than {limit} fields, more than any table holds. Check the delimiter.",
+            &[("line", &line.to_string()), ("limit", &limit.to_string())],
+        ),
+    }
+}
+
 /// The first few values of one field, as one line.
 fn sample_text(sheet: &CsvSheet, field: usize, options: &CsvImportOptions) -> String {
     let values: Vec<String> = sheet
@@ -506,16 +556,51 @@ mod dialog_tests {
     }
 
     #[gtk4::test]
-    fn a_file_that_is_not_csv_leaves_the_import_button_off() {
+    fn a_file_that_is_not_csv_leaves_the_import_button_off_and_says_why_in_the_dialog() {
         let dialog = ImportCsvDialog::builder().launch(ImportCsvDialogInit {
             schema: None,
             table: "people".to_owned(),
             columns: vec![column("id")],
-            bytes: Vec::new(),
+            bytes: b"id\n\xff\n".to_vec(),
         });
 
         crate::test_support::drain_main_context();
 
         assert!(!dialog.model().import_button.is_sensitive());
+        assert_eq!(
+            dialog.model().summary.label().as_str(),
+            "The file isn't UTF-8 text from byte 3 on. Save it as UTF-8 and import it again."
+        );
+        assert!(dialog.model().summary.has_css_class("error"));
+    }
+
+    #[gtk4::test]
+    fn every_column_set_to_skip_turns_the_import_button_off() {
+        let dialog = launch("name,id\nada,1\n");
+        crate::test_support::drain_main_context();
+        assert!(dialog.model().import_button.is_sensitive());
+
+        for row in dialog.model().mapping_rows.borrow().iter() {
+            row.set_selected(0);
+        }
+        crate::test_support::drain_main_context();
+
+        assert!(!dialog.model().import_button.is_sensitive());
+        assert_eq!(
+            dialog.model().summary.label().as_str(),
+            "Every column is set to Skip. Pick a field for at least one column to import."
+        );
+    }
+
+    #[gtk4::test]
+    fn a_file_with_only_a_header_has_nothing_to_import() {
+        let dialog = launch("name,id\n");
+        crate::test_support::drain_main_context();
+
+        assert!(!dialog.model().import_button.is_sensitive());
+        assert_eq!(
+            dialog.model().summary.label().as_str(),
+            "The file has no rows to import."
+        );
     }
 }
diff --git a/linux/crates/app/src/ui/workspace/import.rs b/linux/crates/app/src/ui/workspace/import.rs
index ab4c6ade4f..fae483fca4 100644
--- a/linux/crates/app/src/ui/workspace/import.rs
+++ b/linux/crates/app/src/ui/workspace/import.rs
@@ -20,7 +20,7 @@ use tokio_util::sync::CancellationToken;
 use crate::services::history_service::HistoryService;
 use crate::ui::error_text::{driver_message, operation_error_message};
 use crate::ui::file_read::{FileReadError, read_capped_file};
-use crate::ui::import_dialog::{CsvImport, MAX_CSV_FILE_BYTES};
+use crate::ui::import_dialog::{CsvImport, MAX_CSV_FILE_BYTES, import_error_text};
 
 use super::{WorkspaceInput, WorkspaceModel};
 use crate::runtime::DeliverInput;
@@ -129,7 +129,6 @@ impl WorkspaceModel {
                 move |_, out| {
                     input.deliver(match out {
                         ImportCsvDialogOutput::Import(import) => WorkspaceInput::ImportCsvRun(import),
-                        ImportCsvDialogOutput::ShowToast(text) => WorkspaceInput::ShowToast(text),
                     });
                 }
             });
@@ -428,7 +427,7 @@ async fn read_columns(session: Arc<Session>, table: TableRef) -> Result<Vec<Impo
 fn import_rows(import: &CsvImport) -> Result<Vec<Vec<CellInput>>, String> {
     use tablepro_core::import::{read_csv, row_to_cells};
 
-    let sheet = read_csv(&import.bytes, &import.options, None).map_err(|error| error.to_string())?;
+    let sheet = read_csv(&import.bytes, &import.options, None).map_err(|error| import_error_text(&error))?;
     let first_line = first_data_line(import);
     sheet
         .rows

From 51c2c2275a291dd51a314d28b1911ec3e3fc045a Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Sat, 17 Oct 2026 19:01:25 +0700
Subject: [PATCH 15/15] chore(linux): regenerate the translation template

---
 linux/po/tablepro.pot | 154 ++++++++++++++++++++++++++++++++++++++----
 1 file changed, 139 insertions(+), 15 deletions(-)

diff --git a/linux/po/tablepro.pot b/linux/po/tablepro.pot
index 7547cbe495..550f156122 100644
--- a/linux/po/tablepro.pot
+++ b/linux/po/tablepro.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: tablepro 0.1.0\n"
 "Report-Msgid-Bugs-To: https://github.com/TableProApp/TablePro/issues\n"
-"POT-Creation-Date: 2026-10-17 09:29+0000\n"
+"POT-Creation-Date: 2026-10-17 11:45+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -345,6 +345,11 @@ msgid ""
 "Couldn't copy: the column “{column}” holds a value TablePro couldn't read"
 msgstr ""
 
+#: crates/app/src/ui/clipboard/clipboard_copy.rs
+#, rust-format
+msgid "Couldn't copy: the column “{column}” holds a control character"
+msgstr ""
+
 #: crates/app/src/ui/clipboard/clipboard_copy.rs
 msgid "This row has a value that can't be written as SQL"
 msgstr ""
@@ -1844,13 +1849,6 @@ msgid_plural "{rows} rows"
 msgstr[0] ""
 msgstr[1] ""
 
-#: crates/app/src/ui/export/export_failure_text.rs
-#, rust-format
-msgid ""
-"The column “{column}” holds a value TablePro couldn't read, so it can't be "
-"written to the file."
-msgstr ""
-
 #: crates/app/src/ui/export/export_failure_text.rs
 msgid ""
 "This statement returned more than one result, so it can't be exported as one "
@@ -1901,6 +1899,27 @@ msgid ""
 "available."
 msgstr ""
 
+#: crates/app/src/ui/export/export_failure_text.rs
+#, rust-format
+msgid ""
+"The column “{column}” holds a value TablePro couldn't read, so it can't be "
+"written to the file."
+msgstr ""
+
+#: crates/app/src/ui/export/export_failure_text.rs
+#, rust-format
+msgid ""
+"The column “{column}” holds a control character XML can't carry. Export it "
+"as CSV or JSON instead."
+msgstr ""
+
+#: crates/app/src/ui/export/export_failure_text.rs
+#, rust-format
+msgid ""
+"The column “{column}” holds a value longer than the {limit} characters an "
+"Excel cell holds. Export it as CSV instead."
+msgstr ""
+
 #: crates/app/src/ui/export/export_failure_text.rs
 #, rust-format
 msgid "An Excel sheet holds {limit} rows, and this result has {got}."
@@ -1928,6 +1947,7 @@ msgid "Couldn't Export"
 msgstr ""
 
 #: crates/app/src/ui/export/export_failure_text.rs
+#: crates/app/src/ui/grid/row_json_dialog.rs
 #: crates/app/src/ui/history_dialog/history_export.rs
 #: crates/app/src/workspace/close_guard.rs
 msgid "_Close"
@@ -2291,6 +2311,17 @@ msgid_plural "… ({count} more items)"
 msgstr[0] ""
 msgstr[1] ""
 
+#: crates/app/src/ui/grid/row_json_dialog.rs
+msgid "Can't Show Row as JSON"
+msgstr ""
+
+#: crates/app/src/ui/grid/row_json_dialog.rs
+#, rust-format
+msgid ""
+"The column “{column}” holds a value TablePro couldn't read, so the row has "
+"no JSON to show."
+msgstr ""
+
 #: crates/app/src/ui/grid/row_json_dialog.rs
 msgid "Long values are shortened here. Copy includes them in full."
 msgstr ""
@@ -2660,11 +2691,11 @@ msgid ""
 msgstr ""
 
 #: crates/app/src/ui/import_dialog.rs
-msgid "Every column is set to Skip, so there is nothing to import."
+msgid "Skip"
 msgstr ""
 
 #: crates/app/src/ui/import_dialog.rs
-msgid "Skip"
+msgid "The database fills this column"
 msgstr ""
 
 #: crates/app/src/ui/import_dialog.rs
@@ -2672,7 +2703,12 @@ msgid "Uses the column's own default"
 msgstr ""
 
 #: crates/app/src/ui/import_dialog.rs
-msgid "The file could not be read."
+msgid "The file has no rows to import."
+msgstr ""
+
+#: crates/app/src/ui/import_dialog.rs
+msgid ""
+"Every column is set to Skip. Pick a field for at least one column to import."
 msgstr ""
 
 #: crates/app/src/ui/import_dialog.rs
@@ -2688,6 +2724,29 @@ msgid_plural "{fields} fields, {rows} rows."
 msgstr[0] ""
 msgstr[1] ""
 
+#: crates/app/src/ui/import_dialog.rs
+#, rust-format
+msgid ""
+"The file isn't UTF-8 text from byte {offset} on. Save it as UTF-8 and import "
+"it again."
+msgstr ""
+
+#: crates/app/src/ui/import_dialog.rs
+#, rust-format
+msgid "The file couldn't be read as CSV: {error}"
+msgstr ""
+
+#: crates/app/src/ui/import_dialog.rs
+msgid "The file has no columns."
+msgstr ""
+
+#: crates/app/src/ui/import_dialog.rs
+#, rust-format
+msgid ""
+"Line {line} has more than {limit} fields, more than any table holds. Check "
+"the delimiter."
+msgstr ""
+
 #: crates/app/src/ui/import_dialog.rs
 msgid "NULL"
 msgstr ""
@@ -3626,18 +3685,60 @@ msgstr ""
 msgid "The table's columns could not be read."
 msgstr ""
 
+#: crates/app/src/ui/workspace/import.rs
+#, rust-format
+msgid "Imported {n} row."
+msgid_plural "Imported {n} rows."
+msgstr[0] ""
+msgstr[1] ""
+
+#: crates/app/src/ui/workspace/import.rs
+msgid "That file has no rows to import."
+msgstr ""
+
+#: crates/app/src/ui/workspace/import.rs
+msgid "Import stopped."
+msgstr ""
+
 #: crates/app/src/ui/workspace/import.rs
 msgid "Couldn't Import"
 msgstr ""
 
 #: crates/app/src/ui/workspace/import.rs
-msgid "That file has no rows to import."
+#, rust-format
+msgid ""
+"Line {line} could not be written: {error}. The import was rolled back, so no "
+"rows were added."
 msgstr ""
 
 #: crates/app/src/ui/workspace/import.rs
 #, rust-format
-msgid "Imported {n} row."
-msgid_plural "Imported {n} rows."
+msgid ""
+"Lines {first} to {last} could not be written: {error}. The import was rolled "
+"back, so no rows were added."
+msgstr ""
+
+#: crates/app/src/ui/workspace/import.rs
+#, rust-format
+msgid ""
+"Line {line} could not be written: {error}. The {written} row before it stays "
+"in the table, which has no transaction to undo it."
+msgid_plural ""
+"Line {line} could not be written: {error}. The {written} rows before it stay "
+"in the table, which has no transaction to undo them."
+msgstr[0] ""
+msgstr[1] ""
+
+#: crates/app/src/ui/workspace/import.rs
+#, rust-format
+msgid ""
+"Lines {first} to {last} could not be written: {error}. The table has no "
+"transaction to undo the import, so the {written} row before them stays, and "
+"some of these lines may have been written too."
+msgid_plural ""
+"Lines {first} to {last} could not be written: {error}. The table has no "
+"transaction to undo the import, so the {written} rows before them stay, and "
+"some of these lines may have been written too."
 msgstr[0] ""
 msgstr[1] ""
 
@@ -3650,6 +3751,29 @@ msgstr ""
 msgid "Line {line}, column {column}: {reason} (the value was “{text}”)"
 msgstr ""
 
+#: crates/app/src/ui/workspace/import_ledger.rs
+msgid "Stop Imports?"
+msgstr ""
+
+#: crates/app/src/ui/workspace/import_ledger.rs
+#, rust-format
+msgid ""
+"{n} CSV import is still running. Stopping it rolls back the rows it wrote, "
+"unless the table has no transactions."
+msgid_plural ""
+"{n} CSV imports are still running. Stopping them rolls back the rows they "
+"wrote, unless the table has no transactions."
+msgstr[0] ""
+msgstr[1] ""
+
+#: crates/app/src/ui/workspace/import_ledger.rs
+msgid "_Keep Importing"
+msgstr ""
+
+#: crates/app/src/ui/workspace/import_ledger.rs
+msgid "_Stop Imports"
+msgstr ""
+
 #: crates/app/src/ui/workspace/saves.rs
 msgid "Saved"
 msgstr ""
@@ -4286,7 +4410,7 @@ msgid "Verify TLS, keep connections read-only, and reconnect on drop"
 msgstr ""
 
 #: data/app.tablepro.TablePro.metainfo.xml.in.in
-msgid "Export results to CSV, TSV, JSON and SQL"
+msgid "Export results to CSV, JSON, SQL, Excel, Markdown, HTML and XML"
 msgstr ""
 
 #: data/app.tablepro.TablePro.metainfo.xml.in.in