[witbrock]

Migrated native-writer projects currently exist in Atlas, while public Von and the coding consumers use DGX. This adds a bounded project transfer with signed snapshots, verified file bytes, atomic publication, and an explicit source-release/destination-activation handoff. Original creators, Jira aliases, relationships, history and audiences are retained; copied assignments remain inert until a current actor deliberately assigns them.

Canonical task/concept/text mutations and durable execution check the project home. Read-only replicas expose their route and snapshot date. The transfer CLI retains receipts and rejects stale preflights, stale epochs and snapshot replay that would replace later work. Supporting fixes correct namespace restoration and prevent gzip platform variants from overwriting an archive's recorded bytes.

Validation:

• Targeted task, dispatch, ownership, restore and archive tests pass; real Mongo transaction tests cover interruption, retry, concurrent text changes and later-write preservation.
• An authenticated isolated restore recovered all 51 DGX collections. The first full project rehearsal verified 2,746 tasks, 26,979 text relations and 2,824 file copies through canonical read-back; Jira-alias search found the imported migration task.
• Signed previews cover all 43 projects in their original scopes. All 7,559 referenced files (3.63 GB) pass checksum verification. The full estate rehearsal verified all 5,945 tasks in 43 projects, preserved their original scopes and existing conversation/workflow inventories, and canonically read back every file.
• Canonical create/edit/assignment and existing-controller admission pass for both SAIL and personal projects in the isolated restore; an unrelated actor is denied. Assignment replaces the exact singleton edge even when profile visibility redacts the previous assignee. Dispatch requires a trusted actor, rejecting legacy identity headers. The latest affected backend run passed 139 tests.
• 33 affected frontend tests pass. A Chromium replay verified replica routing/freshness and creation controls, then their return to a writable state.

Native federation task.

Runtime boundary: this PR does not itself transfer production ownership. Activation requires a transaction-capable destination, fresh frozen snapshots, and fencing of older Atlas writers (including the offline SC client). Production project homes remain unchanged.