Skip to main content

Ownership migration assessment and calibration

Attempt before calibration. Score 0 absent/incorrect, 1 prompted/incomplete, 2 independently correct evidence with limits, 3 fresh transfer. All six categories require level 2; finite model tests do not replace the actual extraction and storage experiment.

Required evidence​

  • MC1 — Ownership: connect capability, business invariant, data writer and team owner. Explain why the proposed boundary improves the stated scenario and what coupling remains.
  • MC2 — Merge semantics: predict stale/duplicate/delete behavior, same-version conflicts and empty-string values. Provide three independent traces before reference use.
  • MC3 — Cutover: implement the archive contract; reject incomplete coverage, extra target keys, payload mismatch and writes during freeze. Preserve no-mutation-on-rejection evidence.
  • MC4 — Actual migration: perform backfill/change capture and consistent-boundary reconciliation on the original service's storage; enforce stale-writer denial at the mutation boundary. Show interrupted copying and restart behavior with traces.
  • MC5 — Recovery: demonstrate pre-cutover abort and a specified post-cutover recovery that preserves acknowledged new-owner writes. Explain routing/fence persistence and reverse-compatibility requirements.
  • MC6 — Decomposition judgment: retain the original network extraction, contract tests, observability, deadline/retry/idempotency/deployment evidence and tax ledger. Review the decision against a modular-monolith alternative and document remaining risks.

Calibration — after attempting​

Version 3 deletion must survive versions 1 and 2 arriving afterward. Empty string remains data. Equal-version conflicting payloads are refused. Exact equality includes missing/extra keys, versions and tombstones; equal row counts are not sufficient. Freeze prevents new old-owner writes while reconciliation establishes a common boundary.

Aborting in frozen old phase keeps the old owner but advances its authority epoch. Neither the initial nor the frozen-phase token is valid after abort. After cutover, stale old writes and further backfill are refused. Once the new owner writes, old-store rollback requires a separate reconciliation protocol; the reference rejects it.

The model's successful transition does not prove a real gateway and database changed atomically. Tests must establish enforcement and restart behavior in the actual implementation. Trusted copy provenance and indefinite tombstone retention are assumptions, not production security or retention policies.

Delayed transfer​

After at least 48 hours, review a fresh trace with an omitted partition and a new-owner write before recovery. Identify the unsafe transition without reference code. Repair weak categories, preserve first attempts and disclose assistance. Independent service experiments remain distinct from author reference checks.