migrate-contracts-safelylisted

# Migrate Contracts Safely Use an expand-migrate-contract sequence so producers, consumers, and stored data can move independently without an unsafe flag day. Read `references/evidence.md` when selecting phases, compatibility guarantees, or cutover signals. If delegation is explicitly authorized, apply `delegate-work` to separate consumer inventory, external compatibility research, security review, and delivery verification; never assign overlapping migration writes. ## Set the operating boundary - Default to review or planning unless implementation is explicitly requested. - Never execute a production migration, delete production data, remove a live contract, or perform a cutover without explicit authorization. - Inventory producers, consumers, stored representations, supported versions, owners, deployment order, and the required compatibility window. - Define the old and new invariants, failure semantics, observability signals, and rollback constraints. ## Expand - Introduce the new contract in a backward-compatible form while preserving the old path. - Version migration and backfill code with the application change that depends on it. - Make data migration steps idempotent, restartable, observable, and safe under partial failure. - Add adapters, feature controls, dual-read or dual-write paths only when the migration requires them. - Define the exact evidence and state that permit every temporary mechanism to be removed. ## Migrate - Move producers and consumers in