Skip to main content

Distinguish abort from post-cutover recovery

What This Concept Is​

Abort returns to the existing authority before ownership transfer. Post-cutover rollback must account for every write accepted by the new owner. Reverting deployment code and reverting data authority are separate operations with different preconditions.

Why It Matters Here​

A migration plan that says “flip the flag back” may be safe before new writes begin and destructive afterward. The original extraction spike needs a tested rollback boundary, not only a reversible deployment command.

Concrete Example​

Old and new stores match at sequence 4. Cutover transfers authority. The new owner writes x at sequence 5; old still holds sequence 3 for x. Selecting old now loses the acknowledged new value. The reference deliberately rejects abort after cutover and blocks further backfill writes to the new owner.

Recovery options include fixing forward, stopping writes and reconciling back under a new fence, or a separately designed reverse synchronization protocol. None is implemented by this reference. Each requires explicit loss/availability expectations and tests, including reverse-schema compatibility.

Common Confusion / Misconception​

A successful migration in one process does not establish crash safety of routing and fencing metadata. A copy method can accept trusted stream records in a model while an actual migration endpoint must authenticate provenance. A sampled dual-read comparison is a diagnostic; it is not an ownership transfer or proof of complete coverage.

How To Use It​

Write phase-specific abort/recovery procedures and who can execute them. Identify the point after which old-store rollback needs reconciliation. In the real service spike, interrupt backfill, deny stale writers, lose a response near cutover and restart the coordinator. Observe authoritative state before allowing clients to resume. Keep a tax ledger for deployment, monitoring, consistency and human recovery work.

Check Yourself​

Which new fact makes flag-only rollback unsafe? What happens if routing changes but the storage fence does not? How will a restarted coordinator learn whether transfer completed? Which assumptions of the model omit these failures?

Mini Drill or Application​

Perform one pre-cutover abort and one post-cutover failure drill on the original implementation. For the latter choose a defined recovery path and preserve acknowledged data. Defend keeping the extracted service versus merging deployment back while retaining a logical module boundary.

Read This Only If Stuck​

Microservices Patterns and Patterns of Legacy Displacement for incremental change framing. Select one relevant pattern after writing the migration's own invariant and recovery limits.