data-change-safetylisted

# Data Change Safety Use this pack when a mission materially changes persistent data, schema shape, existing records or recovery risk. Do not load it for read-only queries or ordinary application-code changes with no data mutation surface. ## What this pack does It converts real rehearsal and recovery observations into a deterministic safety decision. It does not treat a migration file, ORM diff or model confidence as proof that the change is safe. ## Before evaluation Record the planned change and the actual change reference. Classify the change as one of: - `MIGRATION` - `BACKFILL` - `DATA_TRANSFORM` - `DESTRUCTIVE_CLEANUP` Declare whether the change is destructive. `DESTRUCTIVE_CLEANUP` must always set `destructive=true`. Account explicitly for all four durable execution controls: - `idempotency` - `resumability` - `chunking` - `compatibility` Each control is either `required=true` with observable evidence, or `required=false` with status `N_A`. Do not omit a control simply because it looks inconvenient or irrelevant. ## Rehearse with real data tooling Resolve `database_admin` through M4/tool resolution. Rehearse only against a non-production `SANDBOX` or `PREVIEW` surface with representative fixtures. Production is a target environment, not a rehearsal environment. Collect: - reviewed-plan and actual-change references; - scope-match status; - rehearsal environment, fixture, execution and verification evidence; - pre/post critical data invariants; - evidence