# Migration recovery

Batch checkpoints and generations make preflight/backfill/validation/shadow restart-safe. Matching
complete batches are skipped; incomplete attempts resume from the durable cursor. Old workers cannot
write into a new generation.

Cutover stages are persisted before external work. Startup reports non-terminal cutover journals but
does not guess external truth. A registered adapter/operator inspection submits the observed target,
fingerprint and health to reconciliation. Exact healthy target commits, exact healthy source records
rollback, and ambiguous truth becomes `MANUAL_INTERVENTION_REQUIRED`. Orphan shadows are retained
and surfaced for later explicit cleanup; never auto-deleted.


## M16 reconciliation semantics

Migration is the one subsystem that deliberately does not resolve itself after an interruption.
External alias truth cannot be inferred from a crash, so an interrupted cutover stays in its
intermediate stage, is reported as requiring reconciliation, and waits for an operator working
through the typed adapter.

That is the difference from lifecycle, which resolves: an incomplete lifecycle operation rolls back
from its immutable snapshot exactly once, and a second control-plane start changes nothing.

See ADR-0045 for the resolve / report / fail-closed contract each subsystem declares.