stash encrypt and stash decrypt copy their gates, status and next-step text by hand — decide whether to share them #1222

Background

stash encrypt * (forward: plaintext to encrypted) and stash decrypt * (reverse: encrypted to plaintext, added in #1193) each take a database column through the same phases: dual-writing, backfill, cutover and drop. The shared backfill engine lives in @cipherstash/migrate. The commands around it live in the CLI.

Problem

Several pieces exist once per direction, kept in step by hand:

• the dual-write gate (cli/src/commands/decrypt/backfill.ts and its encrypt counterpart);
• the coverage check, written once as a TypeScript query (countUndecrypted / countUnencrypted) and again as SQL inside the generated drop migration (decrypt/drop.ts, encrypt/drop.ts);
• status rendering and progress formatting;
• the mapping from phase to next command (decrypt/plan.ts);
• the "keep dual-writing until the drop is applied" guidance, which appears in four CLI strings and two shipped skills.

In #1193, single fixes to these had to touch six or more files at once.

Proposal

This is deliberately a decision issue. Make the decision once #1217 has landed, because #1217 moves the lifecycle and naming rules into one ColumnMigration module and may remove much of this duplication by itself.

1. After stash decrypt lifecycle rules are re-derived in each command — give the migration lifecycle one owning module #1217, list the duplication that is left.
2. If it is still large, add a direction descriptor: source and target roles, events, and one predicate builder that produces both the TypeScript query and the drop-migration SQL. One generic gate, status and plan module would use it. Next-step text would be keyed by phase change instead of written per command.
3. If it is small, close this issue and keep the two command families separate.

Relationship to other work

• stash decrypt lifecycle rules are re-derived in each command — give the migration lifecycle one owning module #1217: this was step 4 there, split out on purpose.