Live migrations

Move live data while preserving authority and history

A backfill copies version 1 after a user has already saved version 2. A deleted record can reappear if the migration treats absence as the only evidence of deletion. Switching readers back is unsafe if new writes exist only in the new store.

Follow the migration method, then drive the local recovery schedules. Name the write authority, versions, deletion records, replay checkpoint, and retirement boundary. Extend the same reasoning to a hot tenant and regional recovery.