admin
b57150e3ab
internal/stacks/migrate.go: crash-safe, resumable namespace migration over the controller's /mnt RW mount. Two entry points (whole-namespace + per-app) share one journaled pipeline: validate -> stop -> copy (rsync -a --checksum, additive; conflict- merge walk for non-app content) -> verify -> flip+redeploy (RedeployFromEnv) -> cleanup. CLEANUP (the only destructive step) is gated on all units verified AND all apps redeployed. Single-flight; mutual exclusion with the backup orchestrator (Change 3). Non-hollow tests incl. mutation-proven collision + cleanup-gate companions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>