The contract you already shipped
The moment a second file reads a colour variable, that variable is an API. Consumers include your own components, user overrides, and the embed pages other people host — the last group cannot be migrated by a find-and-replace.
Alias on rename, never redirect
When a token's name must change, keep the old name as an alias pointing at the new value for one release, and print the deprecation in the token table itself. The site's /integrations/tokens page prints the pairs, so the alias cannot rot in a comment.
What you must not do is change the value under the old name. That is a silent breaking change wearing a migration's clothing.
- Name tokens by role (surface, ink, accent), never by colour (blue-400).
- One accent per theme; a second accent is a new decision, not a new token.
- Contrast is part of the contract — the catalog computes it per pair and publishes the failures.