Move write authority, not just data

What This Concept Is

Data ownership names the component authorized to change a business fact and the contract through which others request changes. Copying rows does not transfer that authority. A safe migration must decide which writer is authoritative at every phase, including retries and failures.

Why It Matters Here

A service split can create two independently deployed writers over one shared invariant. Clean code boundaries do not prevent an old process from issuing a late database write. The migration needs enforcement where writes take effect, not only a routing flag in an API gateway.

Concrete Example

The lab starts with old owner at epoch 0. A write carries both owner and epoch. Freeze disables writes and increments the epoch; stale requests cannot regain authority by arriving late. Cutover increments it again, selects the new owner and resumes writes. Aborting before cutover also increments the epoch rather than reviving old credentials.

Epochs are authority generations, not wall-clock timestamps. The reference checks them atomically inside a sequential model. A production design must persist and enforce them with the mutation, or use an equivalent storage/permission mechanism that excludes stale writers. Merely adding a token to a request without checking it has no protective effect.

Common Confusion / Misconception

A database per service does not require one physical database server per service instance. The important architectural property is controlled ownership and access. Conversely, a separate database with uncoordinated dual writes can still violate the business invariant. Service boundaries should follow capabilities and invariants, not table names.

How To Use It

Extend the original capability map with writer identities, credentials, storage enforcement and the exact authority-transfer point. Trace in-flight requests across that point. State whether traffic is blocked, retried or served read-only during migration. The lab chooses a brief write freeze and does not promise zero downtime.

Check Yourself

Why can routing changes leave stale writers active? Why does abort change the epoch? Where must a fence be checked? What business rule would make a proposed split require redesign rather than a copying script?

Mini Drill or Application

Draw old/new writer states and permitted transitions. Attempt writes using old ownership and old epochs before freeze, during freeze and after cutover. Implement an equivalent enforced denial in the original extraction spike and retain the actual failure output.

Read This Only If Stuck

Microservices Patterns — data ownership. Database per service explains private persistent data and contract-based access. This model's epochs are an original exercise, not a mandated implementation of that pattern.