feat(contracts): add emergency migration flow for paused rounds

apps/onchain/contracts/crowdfund_vault/src/errors.rs

@@ -36,4 +36,19 @@ pub enum CrowdfundError {
     RefundWindowNotOpen = 30,
     Reentrancy = 31,
     AlreadyExecuted = 32,
+    // ── Emergency migration (issue #1047) ─────────────────────────────────────
+    /// The contract is not in a paused state; emergency migration requires pause.
+    EmergencyMigrationRequiresPause = 33,
+    /// A migration plan has already been registered for this project.
+    MigrationPlanAlreadyExists = 34,
+    /// No migration plan was found for this project.
+    MigrationPlanNotFound = 35,
+    /// The migration plan has already been executed; it cannot be run twice.
+    MigrationAlreadyExecuted = 36,
+    /// The recipient address supplied for migration is invalid (e.g. the contract itself).
+    InvalidMigrationRecipient = 37,
+    /// The migration amount exceeds the project's current on-chain balance.
+    MigrationAmountExceedsBalance = 38,
+    /// The migration plan was vetoed by a second admin; it cannot proceed.
+    MigrationPlanVetoed = 39,
 }

apps/onchain/contracts/crowdfund_vault/src/events.rs

@@ -212,3 +212,52 @@ pub struct StorageMigratedEvent {
     pub admin: Address,
     pub storage_version: u32,
 }
+
+// ── Emergency migration events (issue #1047) ──────────────────────────────────
+
+/// Emitted when an admin registers an emergency migration plan for a paused round.
+/// Off-chain monitors should alert on this event for governance review.
+///
+/// Data kept to two fields to stay within Soroban's contractevent data-field limit.
+/// The full plan (including recipient, reason, and proposed_at) can be read from
+/// on-chain storage via `get_emergency_migration_plan`.
+#[contractevent]
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct EmrgMigrProposedEvent {
+    /// Admin who registered the plan.
+    #[topic]
+    pub proposed_by: Address,
+    /// Project with stranded funds.
+    #[topic]
+    pub project_id: u64,
+    /// Amount to be migrated (as proposed).
+    pub amount: i128,
+}
+
+#[contractevent]
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct EmrgMigrExecutedEvent {
+    /// Admin who executed the plan.
+    #[topic]
+    pub executed_by: Address,
+    /// Project from which funds were migrated.
+    #[topic]
+    pub project_id: u64,
+    /// Exact amount transferred to the recipient.
+    pub amount: i128,
+}
+
+/// Emitted when an admin vetoes a pending emergency migration plan.
+/// A vetoed plan can never be executed.
+#[contractevent]
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct EmergencyMigrationVetoedEvent {
+    /// Admin who issued the veto.
+    #[topic]
+    pub vetoed_by: Address,
+    /// The project for which the plan was vetoed.
+    #[topic]
+    pub project_id: u64,
+    /// Ledger timestamp of the veto.
+    pub vetoed_at: u64,
+}