You raise two separate issues, which I will address separately.
1. Should the Bitocracy even have the power to move user funds?
I will answer is a qualified yes. Part of the reason is, I am not sure it is even possible to construct the protocol as upgradable, without having the ability to migrate funds. It is possible to deploy upgrades and then hope the liquidity moves, and this sounds like a theoretically ideal mechanism. However, the practical implications would require the users to move from where there is liquidity, to where there is not. This introduces a collective action problem, which is exactly what having a Bitocracy is designed to overcome. In other words, without this ability, the protocol becomes un-upgradable. Every “upgrade” would basically be a competing system.
Ok, so why not just shut down the old system, as you suggest. I think this is strictly worse. If we are working to build an uncensorable system, we should not have the ability to shut it down.
So, how can we make the system uncensorable if we can move funds?
think the answer is that when we have a proposal that would move funds, we allow ample time for users to withdraw their funds AND the ability to refuse to have their funds moved.
Fine, but this still puts a huge amount of power in the hands of the Bitocracy! Yes, indeed it does - and that should be written on the tin, which is why we are discussing it. It should require very high consensus. Currently that would be at least 70% of the vote and it should always be opt out - currently there is a minimum of 3 days to opt out - but this should be expanded in the future.
2. Should we have users migrate to the rollup without this mechanism?
I’m not sure. My sense is that the protocol is young, the planned migration is being signalled early and the migration would be easiest for users if it was a programmatic migration. That said, if there is a good may to migrate users (ie. by shutting down the main UI) then maybe we can try it first and discover that we don’t need upgradable contracts after all.
However, I am concerned that this might create a danger of making the current UI too important. So its a complicated matter.
So I am glad we are having this debate.