a migration role, not a migration window

Moving live state between two foundations is the part of distributed design that usually happens once, badly, at an unsociable hour. This record treats it as a standing role instead of an incident.

The tension is continuity against correctness. A single cutover preserves neither: participants are told to stop, state is copied, and anything in flight is either lost or counted twice. Continuous movement means both sides are live at once, which in turn needs somebody accountable on both.

So migration is a role with a mandate, one of the default templates in the catalog — a bridge that executes movement between lineages. It is registered as an artifact like any other, which means the authority to move state is granted, bounded, and as visible as the authority to decide anything else, rather than existing as an operational exception. The record also carries the harder half of the problem. When a foundation splits and its registry is rebuilt on a new base, every reference that pointed into the old base must be re-anchored, and the record specifies that this happens atomically, one operation per object, so no object is ever briefly orphaned or briefly owned by nobody.

What it costs is speed, and someone has to hold the mandate for as long as the movement takes. What it proves is that one-off operations were converted into governed roles with an end, which is what makes them repeatable.