Production database migrated 0 -> 3 with row counts unchanged and both integrity checks clean. Records the two problems found while building it: the newer-schema guard was unreachable as first written, and create_control_plan -- the idempotency gate for every write -- was check-then-insert, so a duplicate request surfaced as an IntegrityError rather than as "already planned".