Abstract
Software increasingly spans a continuum of independently owned services and heterogeneous stores across regions, and data residency rules force live data to move between regions without interrupting service. A single logical entity spans many services, and no component knows its full dependency graph in advance. An early design that centralized this knowledge reported success while silently omitting data it had never been taught about—a failure invisible to conventional health metrics. We rebuilt it into a contract-based migration platform for a messaging service, resting on three ideas: a stable five-API service contract that keeps domain knowledge with each service; typed dependency semantics that make declarations executable policy; and runtime graph expansion that guarantees completeness without knowing the full graph. It ran 6–10 million migrations per day at 99.9% first-attempt success, growing from 7 to 15 services with no contract change.