Module migration 

Q39 slice B — background encrypt-on-rewrite migration.

Existing plaintext stores seal record-by-record in bounded LMDB batches (one write transaction per batch), tracked by the migration:v1 ledger row in the keyring DBI. The contract is deliberately simple and crash-safe:

• Only 16-byte keys (UUID records) in record galaxies are candidates; non-record DBIs (karma, dharma, associations, embeddings) are never touched, and raw non-record rows are skipped.
• Values that already carry the sealed-record magic are counted and skipped — re-running is idempotent.
• Plaintext values are decoded with the legacy codec and re-sealed through [crate::codec::seal_record], so a record that cannot be decoded is counted and skipped, never rewritten blind.
• The ledger is written after each committed batch. A crash between the batch commit and the ledger write re-scans a bounded prefix; sealing is idempotent, so the repeat is harmless.
• A keyring-absent store (mode off) has nothing to migrate and this module is a provable no-op (no ledger, no writes).

Design: docs/Q39_CRYPTO_ERASURE_DESIGN.md §7 (slice B); plan: planning/private/Q10_SLICE_B_PLAN_2026-09-19.md.

Structs

AtRestMigrationReport

Aggregate report for one migrate_at_rest_records invocation.

GalaxyAtRestCounts

Per-galaxy at-rest record inventory for the doctor (read-only; magic check only — values are never decrypted).

GalaxyMigrationReport

What happened to one galaxy in one migration pass.

Constants

DEFAULT_MIGRATION_BATCH

Default records per write transaction.

RECORD_GALAXIES

Galaxies whose entries are Memory records.

Functions

at_rest_record_counts

Count sealed vs plaintext records across the record galaxies.

migrate_at_rest_records

Migrate plaintext records to sealed records in bounded batches.

migration_ledger

Read the current migration ledger without migrating (doctor disclosure).