# Atomic cutover

Cutover is a durable journal around an external operation, not a claimed distributed transaction:

```text
PREPARING -> LOCKING -> SWITCHING -> VERIFYING -> COMMITTING -> COMMITTED
                                         `-> ROLLING_BACK
```

Preparation performs a CAS/version check, exact observed-source check, approval recheck, current
validation check and immutable rollback snapshot. The adapter then uses its safest atomic primitive
(Qdrant alias update for ExampleRAG). ModelForge records `CUTOVER_COMMITTED` only after the adapter
reports the expected external target plus bounded read-path/capability/smoke health. A stale alias is
`STALE_SOURCE`; unhealthy post-switch truth enters rollback. Production execution additionally
requires the matching approved M12 `requires_reindex` promotion plan.