Migration-037 ledger schema, rkey-purity (digest of the old URI, never SubmissionRkey), state-machine + crash-resume at every state, verify- before-delete (CID re-read), no-forge fallback (no-creds → left legacy, census gates completion), never-re-decides (structural + behavioral). Deliverable B retiered T2→T1: the e2e constitution forbids the DB-clone assert the ledger requires; outer proof is real-PDS+Postgres T1, the pipeline leg already covered by author_post_contract for any producer. PRD §11 deploy runbook added (legacy removal + fingerprint retype deferred to a post-prod-drain follow-up — prod still holds community.post at merge time). Rule-7 stubs only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>