trueppm-api 0.4.0b2__py3-none-any.whl

trueppm_api/apps/msproject/parser.py

@@ -0,0 +1,1231 @@
+"""Parsers for MS Project .xml and .mpp files."""
+
+from __future__ import annotations
+
+import contextlib
+import logging
+import math
+import os
+import subprocess
+import tempfile
+import threading
+import xml.etree.ElementTree as ET
+from collections.abc import Callable
+from datetime import date
+
+from defusedxml.ElementTree import fromstring as _safe_fromstring
+from django.conf import settings
+
+from trueppm_api.apps.msproject.dataclasses import (
+    CONSTRAINT_TYPES_APPLIED_AS_SNET,
+    AssignmentData,
+    CalendarData,
+    CalendarExceptionData,
+    PredecessorLinkData,
+    ProjectData,
+    ResourceData,
+    TaskData,
+)
+from trueppm_api.apps.msproject.extended_attributes import (
+    DURATION1_FIELD_ID,
+    DURATION2_FIELD_ID,
+    DURATION3_FIELD_ID,
+    PERT_ALIAS_TOKENS,
+    PERT_ROLE_BY_FIELD_ID,
+)
+from trueppm_api.apps.scheduling.units import (
+    HOURS_PER_WORKING_DAY,
+    MSPDI_LAG_TENTHS_PER_WORKING_DAY,
+)
+
+logger = logging.getLogger(__name__)
+
+# MS Project PredecessorLink/Type values -> TruePPM dep_type.
+_LINK_TYPE_MAP = {
+    "0": "FF",
+    "1": "FS",
+    "2": "SF",
+    "3": "SS",
+}
+
+# MSPDI WeekDay/DayType (1=Sunday … 7=Saturday) -> TruePPM Calendar.working_days
+# bit (Mon=1, Tue=2, Wed=4, Thu=8, Fri=16, Sat=32, Sun=64). DayType 0 is the
+# legacy (2003-style) per-date exception form, handled separately.
+_DAY_TYPE_TO_BIT = {
+    "1": 64,  # Sunday
+    "2": 1,  # Monday
+    "3": 2,  # Tuesday
+    "4": 4,  # Wednesday
+    "5": 8,  # Thursday
+    "6": 16,  # Friday
+    "7": 32,  # Saturday
+}
+
+# Subprocess timeout for MPXJ (seconds).
+_MPXJ_TIMEOUT = 120
+
+# Sane upper bound for resource MaxUnits / assignment Units (#1720). MS Project
+# expresses these as fractions of a resource's capacity (1.0 = 100%); a value of
+# 10 already means ten full-time equivalents. Anything past this is either a
+# corrupt/hostile file or a non-finite value we clamp — the value flows into
+# resource-leveling and allocation math, so we bound it rather than let inf/NaN
+# or an astronomical figure poison those computations.
+_MAX_UNITS = 1_000.0
+
+# MSPDI <ConstraintType> codes and their MS Project names (#2891). Used in the
+# import warnings, so an operator reading "12 tasks carry Finish No Later Than"
+# sees the term their own plan uses.
+MSPDI_CONSTRAINT_NAMES: dict[int, str] = {
+    0: "As Soon As Possible",
+    1: "As Late As Possible",
+    2: "Must Start On",
+    3: "Must Finish On",
+    4: "Start No Earlier Than",
+    5: "Start No Later Than",
+    6: "Finish No Earlier Than",
+    7: "Finish No Later Than",
+}
+
+#: The one code whose partial mapping needs saying out loud (see
+#: ``CONSTRAINT_TYPES_APPLIED_AS_SNET`` in ``dataclasses``).
+_CONSTRAINT_TYPE_PARTIALLY_APPLIED = 2
+
+#: Codes that cost the operator nothing when dropped: MSPDI's default, and any
+#: code we actually apply.
+_CONSTRAINT_TYPES_NOT_A_LOSS: frozenset[int] = frozenset({0}) | CONSTRAINT_TYPES_APPLIED_AS_SNET
+
+#: MS Project's default task priority. MSPDI writes ``<Priority>`` on *every*
+#: task, so the warning has to key on a value the PM actually changed — otherwise
+#: every import reports a loss that did not happen.
+_MSPDI_DEFAULT_PRIORITY = 500
+
+
+def _int_or_none(raw: str) -> int | None:
+    """Read an integer element's text, or ``None`` when it is absent/unparseable."""
+    try:
+        return int((raw or "").strip())
+    except ValueError:
+        return None
+
+
+def _is_nonzero_msp_amount(raw: str) -> bool:
+    """True when an MSPDI duration or currency value carries a real quantity.
+
+    MS Project writes ``<Work>PT0H0M0S</Work>`` and ``<Cost>0</Cost>`` on tasks
+    that have neither, so "the element is present" is not evidence the PM entered
+    anything. Any digit other than zero is.
+    """
+    text = (raw or "").strip()
+    if not text:
+        return False
+    return any(ch.isdigit() and ch != "0" for ch in text)
+
+
+#: MSPDI task elements TruePPM has no column for, as
+#: ``(element name, warning phrase, "is this value meaningful?")``. Each entry is
+#: a **deliberate** non-import, and the warning is the entire mechanism by which
+#: the operator learns that — the importer previously dropped all of them with
+#: ``warnings == []``, so a plan that round-tripped came back subtly different
+#: with nothing said (#2891).
+#:
+#: The third element exists because a full MS Project export writes ``Priority``,
+#: ``Work`` and ``Cost`` on every row whether or not the PM set them. Counting
+#: those defaults as dropped data would bury the families that *were* set under
+#: noise, and a warning nobody can act on trains people to ignore the list. So
+#: each predicate answers "did this file actually carry something here?".
+#:
+#: Order is the order the warnings appear in the summary: schedule commitments
+#: first, then the estimating fields.
+_UNMAPPED_TASK_FIELDS: tuple[tuple[str, str, Callable[[str], bool]], ...] = (
+    ("Deadline", "deadline dates (TruePPM has no deadline field)", bool),
+    (
+        "Baseline",
+        "baselines (capture a TruePPM baseline after the import lands instead)",
+        bool,
+    ),
+    (
+        "Priority",
+        "task priority (MS Project's 0-1000 weight has no TruePPM equivalent)",
+        lambda raw: _int_or_none(raw) not in (None, _MSPDI_DEFAULT_PRIORITY),
+    ),
+    (
+        "Work",
+        "work / effort hours (TruePPM schedules on duration, not effort)",
+        _is_nonzero_msp_amount,
+    ),
+    ("Cost", "cost figures (TruePPM tracks no task cost)", _is_nonzero_msp_amount),
+)
+
+
+class MsProjectImportError(ValueError):
+    """The uploaded MS Project file is too large to import (row-count cap, #1721).
+
+    A ``ValueError`` subclass so the import task's ``except Exception`` marks the
+    outbox row DEAD (deterministic failure — the same bytes always exceed the
+    cap) and surfaces ``str(exc)`` to the UI.
+    """
+
+
+def _finite_float(raw: str, default: float, *, low: float, high: float) -> float:
+    """Parse ``raw`` to a finite float clamped to ``[low, high]`` (#1720).
+
+    ``bulk_create`` bypasses the model field validators, so a crafted MSPDI file
+    could otherwise smuggle ``nan``, ``inf``/``-inf``, or ``1e999`` (which
+    Python parses to ``inf``) straight into a ``FloatField``. Non-finite floats
+    then poison CPM / Monte Carlo math and — because ``json.dumps`` emits bare
+    ``NaN``/``Infinity`` tokens — produce invalid JSON in API, sync, and webhook
+    bodies. We reject non-finite values by falling back to ``default`` and clamp
+    the finite range so the same choke point also caps absurd magnitudes.
+    """
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        return default
+    if not math.isfinite(value):
+        return default
+    return max(low, min(value, high))
+
+
+# Upper bound matches Task.duration's MaxValueValidator(36_525) (~100 years).
+# bulk_create() bypasses the model validators, so a crafted MSPDI file could
+# otherwise smuggle astronomical integer values into the database (e.g.
+# PT9999999999H gets us 1.25 billion days). Clamping in the helper is a single
+# choke point that covers every parser caller — primary Duration, PERT
+# Duration1/2/3, and any future Duration-typed ExtendedAttribute.
+_MAX_DURATION_DAYS = 36_525
+
+
+def _enforce_row_cap(kind: str, count: int, limit: int) -> None:
+    """Reject an import whose ``kind`` element count exceeds ``limit`` (#1721)."""
+    if count > limit:
+        raise MsProjectImportError(
+            f"MS Project file has too many {kind} ({count}); the import limit is "
+            f"{limit}. Split the file and import in batches."
+        )
+
+
+def _parse_duration_to_days(duration_str: str) -> int:
+    """Parse MS Project ISO 8601 duration string to working days.
+
+    MS Project uses PT<hours>H<minutes>M<seconds>S for task durations where
+    hours represent calendar hours. We convert to working days using 8h/day.
+    Also handles P<n>D and P<n>DT<n>H formats. The result is clamped to
+    ``[0, _MAX_DURATION_DAYS]`` because ``bulk_create`` skips the model's
+    ``MaxValueValidator(36_525)`` — see the constant above for rationale.
+    """
+    if not duration_str:
+        return 1
+
+    s = duration_str.strip()
+    if not s.startswith("P"):
+        return 1
+
+    s = s[1:]
+    days = 0
+    hours = 0
+
+    if "T" in s:
+        day_part, time_part = s.split("T", 1)
+    else:
+        day_part = s
+        time_part = ""
+
+    if day_part and day_part.endswith("D"):
+        with contextlib.suppress(ValueError):
+            days = int(day_part[:-1])
+
+    if time_part:
+        h_idx = time_part.find("H")
+        if h_idx > 0:
+            with contextlib.suppress(ValueError):
+                hours = int(time_part[:h_idx])
+
+    total_days = days + (hours // HOURS_PER_WORKING_DAY)
+    return max(0, min(total_days, _MAX_DURATION_DAYS))
+
+
+def _parse_lag_to_days(lag_tenths_of_minutes: str) -> int:
+    """Convert MS Project LinkLag (tenths of minutes) to working days.
+
+    MS Project stores lag in tenths of minutes, so one working day is
+    ``MSPDI_LAG_TENTHS_PER_WORKING_DAY`` (4800 = 480 min = 8h; #2290 unit seam).
+    """
+    if not lag_tenths_of_minutes:
+        return 0
+    try:
+        tenths = int(lag_tenths_of_minutes)
+    except ValueError:
+        return 0
+    return tenths // MSPDI_LAG_TENTHS_PER_WORKING_DAY
+
+
+def _positive_int_or_none(raw: str) -> int | None:
+    """Parse a calendar UID reference, mapping absent/none sentinels to ``None``.
+
+    Real calendar UIDs are positive; MSPDI uses ``-1`` for "no calendar"
+    (task-level) and ``0`` never refers to a calendar.
+    """
+    try:
+        value = int(raw)
+    except (TypeError, ValueError):
+        return None
+    return value if value > 0 else None
+
+
+def _time_to_minutes(raw: str) -> int | None:
+    """Parse an MSPDI time-of-day string (``HH:MM:SS``) to minutes since midnight."""
+    parts = raw.strip().split(":")
+    if len(parts) < 2:
+        return None
+    try:
+        hours, minutes = int(parts[0]), int(parts[1])
+    except ValueError:
+        return None
+    if not (0 <= hours <= 24 and 0 <= minutes < 60):
+        return None
+    return hours * 60 + minutes
+
+
+def _iso_date_or_none(raw: str) -> str | None:
+    """Take the ``YYYY-MM-DD`` prefix of an MSPDI datetime, or None if malformed.
+
+    Also the gate on MS Project's "no value" sentinels — ``NA`` and an empty
+    element both fail ``fromisoformat`` and come back as None, which is what lets
+    ``<ActualStart>NA</ActualStart>`` stay unset rather than landing in
+    ``Task.actual_start`` as a fabricated date (#2891).
+    """
+    candidate = raw.strip()[:10]
+    try:
+        date.fromisoformat(candidate)
+    except ValueError:
+        return None
+    return candidate
+
+
+def _parse_calendar_exception_dates(exc_el: ET.Element, ns: str) -> tuple[str | None, str | None]:
+    """Extract the (start, end) ISO dates from an ``<Exception>`` element.
+
+    MSPDI has two encodings in the wild: the schema's ``<TimePeriod>``
+    (``FromDate``/``ToDate``, written by MS Project 2007+ and MPXJ) and the
+    ``EnteredStartDate``/``EnteredFinishDate`` pair some exporters emit instead.
+    Prefer TimePeriod, fall back to the Entered* pair.
+    """
+    period = exc_el.find(f"{ns}TimePeriod")
+    if period is not None:
+        start = period.findtext(f"{ns}FromDate") or ""
+        end = period.findtext(f"{ns}ToDate") or ""
+    else:
+        start = exc_el.findtext(f"{ns}EnteredStartDate") or ""
+        end = exc_el.findtext(f"{ns}EnteredFinishDate") or ""
+    return _iso_date_or_none(start), _iso_date_or_none(end)
+
+
+def _weekday_working_hours(day_el: ET.Element, ns: str) -> float:
+    """Sum a working ``<WeekDay>``'s ``<WorkingTime>`` shifts into hours.
+
+    Zero-length and reversed (``To <= From``) shifts are ignored so a malformed
+    entry contributes nothing rather than a negative total.
+    """
+    total = 0.0
+    times_el = day_el.find(f"{ns}WorkingTimes")
+    for wt in times_el.findall(f"{ns}WorkingTime") if times_el is not None else []:
+        frm = _time_to_minutes(wt.findtext(f"{ns}FromTime") or "")
+        to = _time_to_minutes(wt.findtext(f"{ns}ToTime") or "")
+        if frm is not None and to is not None and to > frm:
+            total += (to - frm) / 60.0
+    return total
+
+
+def _legacy_weekday_exception(
+    day_el: ET.Element, ns: str, name: str, *, working: bool, warnings: list[str]
+) -> CalendarExceptionData | None:
+    """Parse a legacy (2003-style) dated ``<WeekDay DayType=0>`` exception.
+
+    These encode an exception as a dated WeekDay entry rather than an
+    ``<Exceptions>`` child but share the non-working-only constraint: a working
+    exception is unrepresentable and warned+skipped, and an undated one is
+    dropped silently. Returns ``None`` when nothing usable was found.
+    """
+    start, end = _parse_calendar_exception_dates(day_el, ns)
+    if working:
+        warnings.append(
+            f"Calendar '{name}': working-time exception "
+            f"{start or '?'} to {end or '?'} is not supported and was skipped"
+        )
+        return None
+    if start and end:
+        return CalendarExceptionData(start=start, end=end)
+    return None
+
+
+def _parse_weekday_definitions(
+    cal_el: ET.Element, ns: str, name: str, warnings: list[str]
+) -> tuple[int, list[float], list[CalendarExceptionData]]:
+    """Walk ``<WeekDays>`` into (working-day mask, per-day hours, legacy exceptions).
+
+    The mask starts from the Mon-Fri default and each listed ``<WeekDay>``
+    overrides its own day; a resulting all-non-working week is guarded back to
+    Mon-Fri (the model's ``validate_working_day_mask`` invariant — a maskless
+    calendar would spin the engine's calendar walk, and the importer writes rows
+    without running field validators). Legacy dated exceptions are collected here
+    so they precede the ``<Exceptions>`` block's rows in the final list.
+    """
+    mask = 31  # Mon–Fri baseline; listed WeekDay entries override per day.
+    day_hours: list[float] = []
+    exceptions: list[CalendarExceptionData] = []
+
+    weekdays_el = cal_el.find(f"{ns}WeekDays")
+    day_els = weekdays_el.findall(f"{ns}WeekDay") if weekdays_el is not None else []
+    for day_el in day_els:
+        mask = _apply_weekday_entry(
+            day_el, ns, name, mask, day_hours=day_hours, exceptions=exceptions, warnings=warnings
+        )
+
+    if mask & 0b111_1111 == 0:
+        warnings.append(
+            f"Calendar '{name}': no working weekday defined; defaulted to Monday-Friday"
+        )
+        mask = 31
+
+    return mask, day_hours, exceptions
+
+
+def _apply_weekday_entry(
+    day_el: ET.Element,
+    ns: str,
+    name: str,
+    mask: int,
+    *,
+    day_hours: list[float],
+    exceptions: list[CalendarExceptionData],
+    warnings: list[str],
+) -> int:
+    """Fold one ``<WeekDay>`` entry into the mask, appending any hours/exception.
+
+    Returns the updated mask. ``day_hours`` and ``exceptions`` are appended in
+    place (the same accumulate-in-place convention the surrounding parser uses
+    for ``warnings``). A ``DayType=0`` entry is a legacy dated exception; an
+    unrecognized DayType is ignored.
+    """
+    day_type = (day_el.findtext(f"{ns}DayType") or "").strip()
+    working = (day_el.findtext(f"{ns}DayWorking") or "").strip() == "1"
+    if day_type == "0":
+        exc = _legacy_weekday_exception(day_el, ns, name, working=working, warnings=warnings)
+        if exc is not None:
+            exceptions.append(exc)
+        return mask
+    bit = _DAY_TYPE_TO_BIT.get(day_type)
+    if bit is None:
+        return mask
+    if working:
+        mask |= bit
+        hours = _weekday_working_hours(day_el, ns)
+        if hours > 0:
+            day_hours.append(hours)
+    else:
+        mask &= ~bit
+    return mask
+
+
+def _parse_calendar_exceptions(
+    cal_el: ET.Element, ns: str, name: str, warnings: list[str]
+) -> list[CalendarExceptionData]:
+    """Parse the ``<Exceptions>`` block into non-working ``CalendarExceptionData`` rows.
+
+    Working exceptions (``DayWorking=1``, e.g. a make-up Saturday) cannot be
+    expressed by ``CalendarException`` (non-working only) and are warned+skipped,
+    as are entries whose date range is missing or reversed.
+    """
+    exceptions: list[CalendarExceptionData] = []
+    exceptions_el = cal_el.find(f"{ns}Exceptions")
+    for exc_el in exceptions_el.findall(f"{ns}Exception") if exceptions_el is not None else []:
+        exc_name = (exc_el.findtext(f"{ns}Name") or "").strip()
+        start, end = _parse_calendar_exception_dates(exc_el, ns)
+        working = (exc_el.findtext(f"{ns}DayWorking") or "0").strip() == "1"
+        if working:
+            warnings.append(
+                f"Calendar '{name}': working-time exception "
+                f"'{exc_name or (start or '?')}' is not supported and was skipped"
+            )
+            continue
+        if start is None or end is None or end < start:
+            warnings.append(
+                f"Calendar '{name}': exception '{exc_name or '?'}' has an "
+                f"unparseable date range and was skipped"
+            )
+            continue
+        exceptions.append(CalendarExceptionData(start=start, end=end, name=exc_name))
+    return exceptions
+
+
+def _modal_hours_per_day(day_hours: list[float]) -> float:
+    """Collapse per-day working totals to the single ``Calendar.hours_per_day`` scalar.
+
+    Most common daily total wins (ties break toward the first seen): one scalar
+    has to represent the week, and the modal day length is what duration
+    conversion (days -> real dates) should assume. Defaults to 8.0 with no data
+    and is clamped to a sane [1, 24] range.
+    """
+    if not day_hours:
+        return 8.0
+    hours = max(day_hours, key=day_hours.count)
+    return max(1.0, min(hours, 24.0))
+
+
+def _parse_one_calendar(cal_el: ET.Element, ns: str, warnings: list[str]) -> CalendarData | None:
+    """Parse a single ``<Calendar>`` element, or ``None`` to skip it.
+
+    Non-integer UIDs and non-base calendars (``IsBaseCalendar != 1``) are
+    skipped; per-resource calendars have no TruePPM equivalent and importing
+    them would only pollute the shared calendar library.
+    """
+    uid_str = (cal_el.findtext(f"{ns}UID") or "").strip()
+    try:
+        uid = int(uid_str)
+    except ValueError:
+        return None
+    if (cal_el.findtext(f"{ns}IsBaseCalendar") or "").strip() != "1":
+        return None
+    name = (cal_el.findtext(f"{ns}Name") or "").strip() or f"Imported calendar {uid}"
+
+    mask, day_hours, exceptions = _parse_weekday_definitions(cal_el, ns, name, warnings)
+    # Legacy dated exceptions (from the WeekDays walk) precede the <Exceptions>
+    # block's rows, matching the original single-pass append order.
+    exceptions.extend(_parse_calendar_exceptions(cal_el, ns, name, warnings))
+
+    return CalendarData(
+        uid=uid,
+        name=name,
+        working_days=mask,
+        hours_per_day=_modal_hours_per_day(day_hours),
+        exceptions=exceptions,
+    )
+
+
+def _parse_calendars(root: ET.Element, ns: str, warnings: list[str]) -> list[CalendarData]:
+    """Parse the ``<Calendars>`` block into ``CalendarData`` rows (#1769).
+
+    Only *base* calendars are returned: MS Project requires project and task
+    calendars to be base calendars, and per-resource calendars
+    (``IsBaseCalendar=0``, one auto-generated per resource) have no TruePPM
+    equivalent — importing them would only pollute the shared calendar library.
+
+    Fidelity notes (each degradation is deliberate; see the field-coverage
+    matrix in the docs):
+
+    - The weekday mask starts from the Mon-Fri default and applies whatever
+      ``<WeekDay>`` entries the file lists. Genuine MS Project exports list all
+      seven days, fully overwriting the default; sparse third-party files only
+      shift the days they mention instead of losing the whole week.
+    - ``Calendar.hours_per_day`` is a single scalar, so per-day
+      ``<WorkingTimes>`` collapse to the most common daily total across working
+      days (ties break toward the first seen). Shift start/end times are not
+      preserved — TruePPM schedules in whole working days.
+    - Exceptions that *add* working time (``DayWorking=1``, e.g. a make-up
+      Saturday) cannot be expressed by ``CalendarException`` (non-working only)
+      and are skipped with a warning.
+    """
+    calendars_el = root.find(f"{ns}Calendars")
+    if calendars_el is None:
+        return []
+
+    calendars: list[CalendarData] = []
+    for cal_el in calendars_el.findall(f"{ns}Calendar"):
+        cal = _parse_one_calendar(cal_el, ns, warnings)
+        if cal is not None:
+            calendars.append(cal)
+    return calendars
+
+
+def _child_text(el: ET.Element, ns: str, tag: str) -> str:
+    """Return a namespaced child's text, or ``""`` when absent or empty."""
+    child = el.find(f"{ns}{tag}")
+    return child.text if child is not None and child.text else ""
+
+
+def _enforce_row_caps(root: ET.Element, ns: str) -> None:
+    """Reject an oversized import before any objects are materialized (#1721).
+
+    The upload SIZE is bounded but the row count is not. A 50 MB MSPDI encodes
+    ~1M tasks; without this cap the importer builds ~1M Task objects, computes
+    WBS over all of them, and bulk-creates the lot — exhausting worker memory
+    and holding a giant transaction open. Reject outright (like the risk-CSV
+    importer's MAX_ROWS) before building anything, counting directly off the
+    element tree so we never materialize the objects.
+    """
+    max_rows = getattr(settings, "MSPROJECT_MAX_ROWS", 20_000)
+    _enforce_row_cap("tasks", len(root.findall(f".//{ns}Task")), max_rows)
+    _enforce_row_cap("resources", len(root.findall(f".//{ns}Resource")), max_rows)
+    _enforce_row_cap("dependencies", len(root.findall(f".//{ns}PredecessorLink")), max_rows)
+    _enforce_row_cap("calendars", len(root.findall(f".//{ns}Calendar")), max_rows)
+    _enforce_row_cap("calendar exceptions", len(root.findall(f".//{ns}Exception")), max_rows)
+
+
+def _parse_resources(
+    root: ET.Element, ns: str
+) -> tuple[list[ResourceData], dict[int, ResourceData]]:
+    """Parse ``<Resources>`` into (ordered list, ``{uid: ResourceData}`` lookup)."""
+    resources: list[ResourceData] = []
+    resource_map: dict[int, ResourceData] = {}
+    resources_el = root.find(f"{ns}Resources")
+    if resources_el is None:
+        return resources, resource_map
+    for res_el in resources_el.findall(f"{ns}Resource"):
+        uid_str = _child_text(res_el, ns, "UID")
+        name = _child_text(res_el, ns, "Name")
+        if not uid_str or not name:
+            continue
+        uid = int(uid_str)
+        if uid == 0:
+            continue
+        max_units_str = _child_text(res_el, ns, "MaxUnits")
+        # Finite-guard + clamp (#1720): reject nan/inf/1e999 and cap absurd
+        # capacities before the value reaches a bulk_create'd FloatField.
+        max_units = (
+            _finite_float(max_units_str, 1.0, low=0.0, high=_MAX_UNITS) if max_units_str else 1.0
+        )
+        rd = ResourceData(uid=uid, name=name, max_units=max_units)
+        resource_map[uid] = rd
+        resources.append(rd)
+    return resources, resource_map
+
+
+def _parse_assignments(
+    root: ET.Element, ns: str, resource_map: dict[int, ResourceData]
+) -> dict[int, list[AssignmentData]]:
+    """Parse ``<Assignments>`` into ``{task_uid: [AssignmentData]}`` (indexed by task UID)."""
+    task_assignments: dict[int, list[AssignmentData]] = {}
+    assignments_el = root.find(f"{ns}Assignments")
+    if assignments_el is None:
+        return task_assignments
+    for asgn_el in assignments_el.findall(f"{ns}Assignment"):
+        task_uid_str = _child_text(asgn_el, ns, "TaskUID")
+        res_uid_str = _child_text(asgn_el, ns, "ResourceUID")
+        if not task_uid_str or not res_uid_str:
+            continue
+        task_uid = int(task_uid_str)
+        res_uid = int(res_uid_str)
+        if res_uid == 0 or res_uid not in resource_map:
+            continue
+        units_str = _child_text(asgn_el, ns, "Units")
+        # Finite-guard + clamp (#1720), same rationale as MaxUnits above.
+        units = _finite_float(units_str, 1.0, low=0.0, high=_MAX_UNITS) if units_str else 1.0
+        task_assignments.setdefault(task_uid, []).append(
+            AssignmentData(task_uid=task_uid, resource_uid=res_uid, units=units)
+        )
+    return task_assignments
+
+
+def _parse_predecessor_links(task_el: ET.Element, ns: str) -> list[PredecessorLinkData]:
+    """Parse a task's ``<PredecessorLink>`` children into dependency rows."""
+    pred_links: list[PredecessorLinkData] = []
+    for pred_el in task_el.findall(f"{ns}PredecessorLink"):
+        pred_uid_str = _child_text(pred_el, ns, "PredecessorUID")
+        if not pred_uid_str:
+            continue
+        link_type_str = _child_text(pred_el, ns, "Type") or "1"
+        link_lag_str = _child_text(pred_el, ns, "LinkLag") or "0"
+        pred_links.append(
+            PredecessorLinkData(
+                predecessor_uid=int(pred_uid_str),
+                dep_type=_LINK_TYPE_MAP.get(link_type_str, "FS"),
+                lag_days=_parse_lag_to_days(link_lag_str),
+            )
+        )
+    return pred_links
+
+
+def _resolve_task_pert_estimates(
+    task_el: ET.Element,
+    ns: str,
+    pert_role_to_field_id: dict[str, str],
+    task_name: str,
+    *,
+    is_milestone: bool,
+    warnings: list[str],
+) -> tuple[int | None, int | None, int | None]:
+    """Resolve a task's ``(optimistic, most_likely, pessimistic)`` PERT triple.
+
+    PERT three-point values come in as per-task ``<ExtendedAttribute>`` children
+    matching the FieldIDs detected at project level. Values are ISO-8601
+    durations parsed via the same ``_parse_duration_to_days`` helper used for the
+    primary Duration field. The triple is dropped (all three set to ``None``)
+    when it cannot be safely imported:
+
+    - Milestones (ADR-0093 Q5): MS Project leaves these empty in practice; if a
+      file violates that we still drop — silently, since milestones with
+      three-point values are common file noise from PMs who blanket-applied
+      estimates and there's nothing the user needs to do.
+    - All-or-none (Q3): the scheduler engine requires all three for PERT-Beta
+      sampling (engine.py:892), so a partial triple would surface as a
+      half-populated UI with no Monte Carlo effect — drop all three and warn.
+    - Ordering (#2002): even a complete triple is unusable if it violates
+      optimistic <= most_likely <= pessimistic. The engine rejects it
+      (engine._validate_project) and, because the importer marks estimates
+      accepted, the invalid row would detonate the first CPM/Monte-Carlo run
+      after import — drop all three and warn.
+    """
+    opt_days, ml_days, pess_days = (
+        _extract_pert_task_values(task_el, ns, pert_role_to_field_id)
+        if pert_role_to_field_id
+        else (None, None, None)
+    )
+    if is_milestone and (opt_days, ml_days, pess_days) != (None, None, None):
+        opt_days = ml_days = pess_days = None
+
+    present = sum(v is not None for v in (opt_days, ml_days, pess_days))
+    if 0 < present < 3:
+        missing = []
+        if opt_days is None:
+            missing.append("Optimistic")
+        if ml_days is None:
+            missing.append("Most Likely")
+        if pess_days is None:
+            missing.append("Pessimistic")
+        warnings.append(
+            f"Task '{task_name}': partial three-point estimate "
+            f"(missing {', '.join(missing)}), all three values skipped"
+        )
+        opt_days = ml_days = pess_days = None
+
+    if (
+        opt_days is not None
+        and ml_days is not None
+        and pess_days is not None
+        and not opt_days <= ml_days <= pess_days
+    ):
+        warnings.append(
+            f"Task '{task_name}': three-point estimate out of order "
+            f"(optimistic ≤ most likely ≤ pessimistic required; got "
+            f"{opt_days} ≤ {ml_days} ≤ {pess_days}), all three values skipped"
+        )
+        opt_days = ml_days = pess_days = None
+
+    return opt_days, ml_days, pess_days
+
+
+def _derive_task_status(start_str: str, raw_percent: float) -> str | None:
+    """Derive task status from the RAW file percent, gated on having a start (#1768).
+
+    Keyed on the raw 0-100 value so it is independent of how percent is stored
+    downstream (the 0-1-vs-0-100 question, #1759). A task with no start has its
+    percent clamped to 0 by the importer (ADR-0057 Q5), so it must stay
+    NOT_STARTED — return ``None`` (the importer's default) rather than
+    IN_PROGRESS, so status and progress can never disagree.
+    """
+    from trueppm_api.apps.projects.models import TaskStatus
+
+    if not start_str:
+        return None
+    if raw_percent >= 100.0:
+        return TaskStatus.COMPLETE.value
+    if raw_percent > 0.0:
+        return TaskStatus.IN_PROGRESS.value
+    return None
+
+
+def _parse_one_task(
+    task_el: ET.Element,
+    ns: str,
+    pert_role_to_field_id: dict[str, str],
+    task_assignments: dict[int, list[AssignmentData]],
+    warnings: list[str],
+) -> TaskData | None:
+    """Parse a single ``<Task>`` element into ``TaskData``, or ``None`` to skip it.
+
+    Skips UID-less / UID-0 rows and warns on a missing name — the same guards as
+    the original single-pass loop.
+    """
+    uid_str = _child_text(task_el, ns, "UID")
+    name = _child_text(task_el, ns, "Name")
+    if not uid_str:
+        return None
+    uid = int(uid_str)
+    if uid == 0:
+        return None
+    if not name:
+        warnings.append(f"Task UID {uid}: missing name, skipped")
+        return None
+
+    outline_level_str = _child_text(task_el, ns, "OutlineLevel")
+    pct_str = _child_text(task_el, ns, "PercentComplete")
+    start_str = _child_text(task_el, ns, "Start")
+    # Summary detection happens later (the importer rebuilds WBS), so we only
+    # know milestones here; summary filtering is left to the importer.
+    is_milestone = _child_text(task_el, ns, "Milestone") == "1"
+
+    opt_days, ml_days, pess_days = _resolve_task_pert_estimates(
+        task_el,
+        ns,
+        pert_role_to_field_id,
+        name,
+        is_milestone=is_milestone,
+        warnings=warnings,
+    )
+
+    # Finite-guard + clamp to [0, 100] (#1720): MS Project PercentComplete is
+    # 0-100. nan/inf/1e999 (and any out-of-range figure) is rejected/clamped
+    # before it reaches progress + EVM math. Task.percent_complete is the same
+    # 0-100 scale, so we keep the value on that scale (an earlier /100 divided it
+    # into a 0-1 fraction that the importer then wrote straight into the 0-100
+    # field — a 75% task landed as 0.75%). The same value drives status inference.
+    raw_percent = _finite_float(pct_str, 0.0, low=0.0, high=100.0) if pct_str else 0.0
+
+    return TaskData(
+        uid=uid,
+        name=name,
+        duration_days=_parse_duration_to_days(_child_text(task_el, ns, "Duration")),
+        outline_number=_child_text(task_el, ns, "OutlineNumber"),
+        outline_level=int(outline_level_str) if outline_level_str else 0,
+        is_milestone=is_milestone,
+        percent_complete=raw_percent,
+        status=_derive_task_status(start_str, raw_percent),
+        notes=_child_text(task_el, ns, "Notes"),
+        start=start_str[:10] if start_str else None,
+        calendar_uid=_positive_int_or_none(_child_text(task_el, ns, "CalendarUID")),
+        optimistic_duration_days=opt_days,
+        most_likely_duration_days=ml_days,
+        pessimistic_duration_days=pess_days,
+        constraint_type=_int_or_none(_child_text(task_el, ns, "ConstraintType")),
+        constraint_date=_iso_date_or_none(_child_text(task_el, ns, "ConstraintDate")),
+        actual_start=_iso_date_or_none(_child_text(task_el, ns, "ActualStart")),
+        actual_finish=_iso_date_or_none(_child_text(task_el, ns, "ActualFinish")),
+        predecessor_links=_parse_predecessor_links(task_el, ns),
+        resource_assignments=task_assignments.get(uid, []),
+    )
+
+
+def _warn_unmapped_task_fields(tasks_el: ET.Element, ns: str, warnings: list[str]) -> None:
+    """Report every field family the import does **not** carry over, with counts.
+
+    This is the whole of #2891's "minimum for beta": before it, an MSPDI carrying
+    constraints, deadlines, baselines, priorities, work and cost imported with
+    ``ProjectData.warnings == []``. A PM migrating a plan got dates TruePPM had
+    recomputed from scratch, believed they were the dates they had committed to,
+    and found out at the next governance review.
+
+    Counts rather than a flat list of names, because "3 of 480 tasks" and "412 of
+    480 tasks" are different decisions for the operator: the first is a note, the
+    second means the migration needs a plan.
+
+    Scans the raw XML rather than the parsed ``TaskData`` deliberately — most of
+    these families have no dataclass field to inspect, and adding one per family
+    purely to count it would imply the importer does something with it.
+    """
+    task_elements = tasks_el.findall(f"{ns}Task")
+    total = len(task_elements)
+    if not total:
+        return
+
+    for element_name, phrase, is_meaningful in _UNMAPPED_TASK_FIELDS:
+        count = sum(
+            1
+            for task_el in task_elements
+            if _carries_value(task_el, ns, element_name, is_meaningful)
+        )
+        if count:
+            warnings.append(f"Not imported: {phrase} — set on {count} of {total} tasks.")
+
+    _warn_unmapped_constraints(task_elements, ns, total, warnings)
+
+
+def _carries_value(
+    task_el: ET.Element, ns: str, element_name: str, is_meaningful: Callable[[str], bool]
+) -> bool:
+    """True when a task element carries a value worth reporting as dropped.
+
+    ``<Baseline>`` is a container (its data lives in child ``<Start>`` /
+    ``<Finish>`` elements, not in its own text), so presence-with-children counts
+    as a value; every other family is judged on its text by its own predicate.
+    """
+    child = task_el.find(f"{ns}{element_name}")
+    if child is None:
+        return False
+    if len(child):
+        return True
+    return is_meaningful(child.text or "")
+
+
+def _warn_unmapped_constraints(
+    task_elements: list[ET.Element], ns: str, total: int, warnings: list[str]
+) -> None:
+    """Report constraint codes TruePPM cannot express, grouped by MS Project name.
+
+    Split out from the table-driven families above because a constraint is not
+    all-or-nothing: two of the eight codes land on ``Task.planned_start`` and the
+    rest have no home, so the warning has to name *which* ones were lost. A
+    single "constraints were dropped" line would be wrong for the file whose
+    constraints were all SNET and carried across perfectly.
+    """
+    unmapped: dict[int, int] = {}
+    partially_applied = 0
+    # Codes outside MSPDI's defined 0-7 are collapsed into ONE bucket rather than
+    # getting a line each. Two reasons, both structural: the code is read straight
+    # off the file, so a per-code line makes the *number of warnings* attacker-
+    # chosen (20,000 tasks each declaring a different code = 20,000 lines, ~3.4 MB
+    # in one `TaskRun.result_summary` JSONField), and this list is now served over
+    # the API rather than being write-only — so its length needs a bound at the
+    # point of writing, not at the point of reading. The same reasoning already
+    # applies per-string to the PERT `<Alias>` warning below, which truncates
+    # reflected text to 100 chars; length is the axis that became reachable.
+    unrecognized_tasks = 0
+    unrecognized_codes: set[int] = set()
+    for task_el in task_elements:
+        code = _int_or_none(_child_text(task_el, ns, "ConstraintType"))
+        if code is None:
+            continue
+        if code == _CONSTRAINT_TYPE_PARTIALLY_APPLIED:
+            partially_applied += 1
+        elif code in MSPDI_CONSTRAINT_NAMES:
+            if code not in _CONSTRAINT_TYPES_NOT_A_LOSS:
+                unmapped[code] = unmapped.get(code, 0) + 1
+        else:
+            unrecognized_tasks += 1
+            unrecognized_codes.add(code)
+
+    # Bounded by construction: at most one line per *defined* MSPDI code.
+    for code in sorted(unmapped):
+        warnings.append(
+            f"Not imported: '{MSPDI_CONSTRAINT_NAMES[code]}' constraints — set on "
+            f"{unmapped[code]} of {total} tasks. TruePPM models only "
+            "start-no-earlier-than, so these tasks are scheduled from their "
+            "dependencies alone."
+        )
+    if unrecognized_tasks:
+        # Deliberately reports how *many* distinct codes, never the codes
+        # themselves: a `<ConstraintType>` integer is unbounded up to Python's
+        # 4,300-digit int limit, so echoing it hands the file control of this
+        # string's length.
+        warnings.append(
+            f"Not imported: {len(unrecognized_codes)} constraint type(s) this file "
+            f"declares that are not defined by MS Project — found on "
+            f"{unrecognized_tasks} of {total} tasks. Those tasks are scheduled from "
+            "their dependencies alone."
+        )
+    if partially_applied:
+        name = MSPDI_CONSTRAINT_NAMES[_CONSTRAINT_TYPE_PARTIALLY_APPLIED]
+        warnings.append(
+            f"Partially imported: '{name}' constraints on {partially_applied} of "
+            f"{total} tasks became start-no-earlier-than dates. The start is "
+            "pinned; TruePPM cannot also stop the task starting later."
+        )
+
+
+def _parse_tasks(
+    root: ET.Element,
+    ns: str,
+    pert_role_to_field_id: dict[str, str],
+    task_assignments: dict[int, list[AssignmentData]],
+    warnings: list[str],
+) -> list[TaskData]:
+    """Parse ``<Tasks>`` into ``TaskData`` rows (per-task skips/warnings applied)."""
+    tasks: list[TaskData] = []
+    tasks_el = root.find(f"{ns}Tasks")
+    if tasks_el is None:
+        return tasks
+    # Before building anything: account for what this file carries that the
+    # import will not (#2891). Runs first so the "what was dropped" lines lead
+    # the summary rather than trailing the per-task notes.
+    _warn_unmapped_task_fields(tasks_el, ns, warnings)
+    for task_el in tasks_el.findall(f"{ns}Task"):
+        td = _parse_one_task(task_el, ns, pert_role_to_field_id, task_assignments, warnings)
+        if td is not None:
+            tasks.append(td)
+    _reconcile_actuals(tasks, warnings)
+    return tasks
+
+
+def _reconcile_actuals(tasks: list[TaskData], warnings: list[str]) -> None:
+    """Drop an actual date the file's own progress contradicts, and say how many.
+
+    On the REST path an actual date only ever appears as a *consequence* of a
+    status transition — ``TaskSerializer`` sets ``actual_start`` on the move to
+    IN_PROGRESS and ``actual_finish`` on COMPLETE, and clears the latter on
+    reopen. The importer writes through ``bulk_create``, which runs no validation
+    and no model ``clean()``, so importing an actual date straight from the file
+    creates states the API itself cannot reach: an ``<ActualFinish>`` on a task
+    the same file declares 0% complete lands as a finished-but-not-started task.
+
+    That is not a cosmetic inconsistency. ``actual_finish`` is read
+    unconditionally downstream — schedule variance, and the sprint forecast
+    resolver, which returns it as the authoritative date the moment it is
+    non-null — so an unreconciled actual silently corrupts variance and forecast
+    reporting rather than looking wrong on the task.
+
+    So the file's *progress* stays authoritative and the contradicting actual is
+    dropped, matching this module's standing contract everywhere else: keep the
+    row, drop the offending field, and report it. Reported as two aggregate lines
+    rather than one per task, so a 20,000-row file cannot turn this into 20,000
+    warnings.
+    """
+    # Imported lazily, exactly as `_derive_task_status` does and for the same
+    # reason: this module stays ORM-free at import time. Reading the enum rather
+    # than hardcoding its two values also means the pair cannot silently drift out
+    # of lockstep with the model.
+    from trueppm_api.apps.projects.models import TaskStatus
+
+    terminal_statuses = {TaskStatus.REVIEW.value, TaskStatus.COMPLETE.value}
+
+    dropped_starts = 0
+    dropped_finishes = 0
+    for td in tasks:
+        # A start with no progress at all is the contradiction; any progress, or
+        # an explicitly terminal status from the source, makes it coherent.
+        terminal = td.status in terminal_statuses
+        if td.actual_start is not None and td.percent_complete <= 0.0 and not terminal:
+            td.actual_start = None
+            dropped_starts += 1
+        # A finish only makes sense on work the file says is done.
+        if td.actual_finish is not None and td.percent_complete < 100.0 and not terminal:
+            td.actual_finish = None
+            dropped_finishes += 1
+        # And a finish can never precede the start it belongs to.
+        if (
+            td.actual_start is not None
+            and td.actual_finish is not None
+            and td.actual_finish < td.actual_start
+        ):
+            td.actual_finish = None
+            dropped_finishes += 1
+
+    if dropped_starts:
+        warnings.append(
+            f"Not imported: actual start dates on {dropped_starts} task(s) — the file "
+            "reports no progress on them, and TruePPM cannot record work as started "
+            "on a task that has not started."
+        )
+    if dropped_finishes:
+        warnings.append(
+            f"Not imported: actual finish dates on {dropped_finishes} task(s) — the "
+            "file does not report them as complete, or the finish preceded the start."
+        )
+
+
+def parse_xml(xml_content: bytes) -> ProjectData:
+    """Parse MS Project XML content into a ProjectData structure.
+
+    Handles both namespaced (Project 2003+) and non-namespaced XML.
+    """
+    # Parse with defusedxml (#771): it forbids entity expansion and external-
+    # entity resolution by default, defending against billion-laughs / XXE on the
+    # user-uploaded file. The 10 MB upload cap in MsProjectImportView bounds size
+    # but does NOT stop entity expansion — that was the prior, incorrect rationale.
+    root = _safe_fromstring(xml_content)
+
+    # Detect namespace
+    ns = ""
+    if root.tag.startswith("{"):
+        ns = root.tag.split("}")[0] + "}"
+
+    _enforce_row_caps(root, ns)
+
+    project_data = ProjectData(
+        name=_child_text(root, ns, "Name"),
+        start_date=(
+            _child_text(root, ns, "StartDate")[:10] if _child_text(root, ns, "StartDate") else None
+        ),
+        calendar_uid=_positive_int_or_none(_child_text(root, ns, "CalendarUID")),
+    )
+
+    # --- Parse calendars (#1769) ---
+    project_data.calendars = _parse_calendars(root, ns, project_data.warnings)
+
+    # --- Parse project-level ExtendedAttribute definitions (#798, ADR-0093) ---
+    # Build a {role: field_id} map (e.g. {"optimistic": "188743783"}) for the
+    # three PERT roles. Files with no ExtendedAttributes block produce an empty
+    # map and three-point import is silently skipped.
+    pert_role_to_field_id = _parse_pert_extended_attribute_defs(root, ns, project_data.warnings)
+
+    # --- Parse resources, assignments, and tasks ---
+    project_data.resources, resource_map = _parse_resources(root, ns)
+    task_assignments = _parse_assignments(root, ns, resource_map)
+    project_data.tasks = _parse_tasks(
+        root, ns, pert_role_to_field_id, task_assignments, project_data.warnings
+    )
+
+    return project_data
+
+
+def _parse_pert_extended_attribute_defs(
+    root: ET.Element, ns: str, warnings: list[str]
+) -> dict[str, str]:
+    """Detect which FieldIDs the file uses for the three PERT roles.
+
+    Walks ``<ExtendedAttributes>/<ExtendedAttribute>`` and returns
+    ``{role: field_id}`` for roles (optimistic / most_likely / pessimistic)
+    backed by the canonical Duration1/2/3 FieldIDs. Duration4 is informational
+    (formula slot) and ignored.
+
+    Refuses to bind a role when the FieldID matches but the alias text
+    contradicts (e.g. someone repurposed Duration1 with alias 'Risk Score') —
+    the FieldID is the interchange contract, but a contradicting alias is
+    strong evidence the slot has been reused.
+    """
+    ea_block = root.find(f"{ns}ExtendedAttributes")
+    if ea_block is None:
+        return {}
+    bound: dict[str, str] = {}
+    for ea in ea_block.findall(f"{ns}ExtendedAttribute"):
+        binding = _bind_pert_role(ea, ns, warnings)
+        if binding is not None:
+            role, field_id = binding
+            bound[role] = field_id
+    return bound
+
+
+def _bind_pert_role(ea: ET.Element, ns: str, warnings: list[str]) -> tuple[str, str] | None:
+    """Resolve one ``<ExtendedAttribute>`` to a ``(role, field_id)`` PERT binding.
+
+    Returns ``None`` when the element is not a bindable PERT slot: missing/empty
+    FieldID, a non-PERT or formula (Duration4) FieldID, or a FieldID whose alias
+    text contradicts the slot (evidence the slot has been repurposed — warned).
+    """
+    fid_el = ea.find(f"{ns}FieldID")
+    if fid_el is None:
+        return None
+    field_id = (fid_el.text or "").strip()
+    if not field_id:
+        return None
+    role = PERT_ROLE_BY_FIELD_ID.get(field_id)
+    if role is None or role == "expected":
+        # Either not a PERT slot, or the formula slot (Duration4) we never import.
+        return None
+    alias_el = ea.find(f"{ns}Alias")
+    alias_raw = alias_el.text if alias_el is not None else None
+    alias_text = (alias_raw or "").strip().lower()
+    if alias_text:
+        expected_tokens = PERT_ALIAS_TOKENS.get(field_id, ())
+        if not any(tok in alias_text for tok in expected_tokens):
+            # Truncate the reflected alias before surfacing it in the import
+            # summary — a multi-megabyte <Alias> would bloat the warnings list
+            # (and any frontend rendering it). 100 chars is enough to diagnose.
+            alias_display = (alias_raw or "")[:100]
+            warnings.append(
+                f"Project ExtendedAttribute FieldID {field_id} has "
+                f"non-standard alias '{alias_display}'; three-point "
+                f"estimate ({role}) skipped"
+            )
+            return None
+    return role, field_id
+
+
+def _extract_pert_task_values(
+    task_el: ET.Element, ns: str, pert_role_to_field_id: dict[str, str]
+) -> tuple[int | None, int | None, int | None]:
+    """Pull a task's Duration1/2/3 ExtendedAttribute values, in working days.
+
+    Returns ``(optimistic, most_likely, pessimistic)`` with ``None`` for any
+    role whose FieldID was either not defined at project level or not present
+    on this task. Uses the same ``_parse_duration_to_days`` helper as the
+    primary Duration field so working-day semantics (8h/day floor) match.
+    """
+    opt_fid = pert_role_to_field_id.get("optimistic")
+    ml_fid = pert_role_to_field_id.get("most_likely")
+    pess_fid = pert_role_to_field_id.get("pessimistic")
+    values: dict[str, int | None] = {
+        DURATION1_FIELD_ID: None,
+        DURATION2_FIELD_ID: None,
+        DURATION3_FIELD_ID: None,
+    }
+    for ea in task_el.findall(f"{ns}ExtendedAttribute"):
+        fid_el = ea.find(f"{ns}FieldID")
+        val_el = ea.find(f"{ns}Value")
+        if fid_el is None or val_el is None:
+            continue
+        fid = (fid_el.text or "").strip()
+        if fid not in values:
+            continue
+        raw = (val_el.text or "").strip()
+        if not raw:
+            continue
+        values[fid] = _parse_duration_to_days(raw)
+    return (
+        values.get(opt_fid) if opt_fid else None,
+        values.get(ml_fid) if ml_fid else None,
+        values.get(pess_fid) if pess_fid else None,
+    )
+
+
+def parse_mpp(mpp_content: bytes) -> ProjectData:
+    """Parse MS Project .mpp binary file via MPXJ subprocess.
+
+    Raises:
+        RuntimeError: If MPXJ JAR is not available or conversion fails.
+    """
+    jar_path = getattr(settings, "MPXJ_JAR_PATH", "/opt/mpxj/mpxj-cli.jar")
+    if not os.path.isfile(jar_path):
+        raise RuntimeError(
+            "MPXJ JAR not found. .mpp import requires Java and the MPXJ CLI JAR. "
+            f"Expected at: {jar_path}. Set MPXJ_JAR_PATH in settings to override."
+        )
+
+    max_output = getattr(settings, "MPXJ_MAX_OUTPUT_MB", 512) * 1024 * 1024
+    max_heap = getattr(settings, "MPXJ_MAX_HEAP_MB", 512)
+
+    with tempfile.NamedTemporaryFile(suffix=".mpp", delete=False) as tmp:
+        tmp.write(mpp_content)
+        tmp_path = tmp.name
+
+    try:
+        # Bounded stdout streaming (#1722). The old capture_output=True buffered
+        # MPXJ's entire stdout with no limit, so a decompression-bomb .mpp — small
+        # enough to pass the 50 MB upload cap — could expand to multi-GB XML and
+        # OOM the worker. We stream stdout in chunks and abort the moment the total
+        # crosses MPXJ_MAX_OUTPUT_MB, killing the JVM. `-Xmx` is a second bound:
+        # even a bomb that balloons MPXJ's in-memory model dies with a JVM OOM
+        # (non-zero exit) rather than driving the host into swap. stderr is small
+        # (error text only) and read after EOF, so it cannot deadlock the pipe.
+        proc = subprocess.Popen(
+            ["java", f"-Xmx{max_heap}m", "-jar", jar_path, tmp_path, "-o", "xml"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        # Watchdog: preserve the original hard timeout even though we no longer use
+        # subprocess.run's timeout= (a blocking read on a hung, silent JVM would
+        # otherwise never return).
+        timed_out = threading.Event()
+
+        def _kill_on_timeout() -> None:
+            timed_out.set()
+            proc.kill()
+
+        timer = threading.Timer(_MPXJ_TIMEOUT, _kill_on_timeout)
+        timer.start()
+
+        chunks: list[bytes] = []
+        total = 0
+        try:
+            assert proc.stdout is not None
+            while True:
+                chunk = proc.stdout.read(65536)
+                if not chunk:
+                    break
+                total += len(chunk)
+                if total > max_output:
+                    proc.kill()
+                    raise RuntimeError(
+                        "MPXJ produced more than "
+                        f"{max_output // (1024 * 1024)} MB of XML — aborting as a "
+                        "likely decompression bomb."
+                    )
+                chunks.append(chunk)
+            proc.wait()
+        finally:
+            timer.cancel()
+
+        if timed_out.is_set():
+            raise RuntimeError(f"MPXJ conversion timed out after {_MPXJ_TIMEOUT}s")
+
+        if proc.returncode != 0:
+            stderr_bytes = proc.stderr.read() if proc.stderr is not None else b""
+            stderr = stderr_bytes.decode("utf-8", errors="replace")
+            raise RuntimeError(f"MPXJ conversion failed (exit {proc.returncode}): {stderr[:500]}")
+
+        xml_output = b"".join(chunks)
+        if not xml_output:
+            raise RuntimeError("MPXJ produced no output")
+
+        return parse_xml(xml_output)
+    finally:
+        with contextlib.suppress(OSError):
+            os.unlink(tmp_path)