# ADR-0036: External-truth cutover and reconciliation

## Status

Accepted in M13 on 2026-08-26.

## Decision

Cutover uses a durable operation journal, immediate CAS/source check and adapter-owned atomic
primitive. Database commit follows verified external identity and health. Startup reconciliation
requires measured external truth and chooses commit, rollback or manual intervention conservatively.

## Consequences

ModelForge does not pretend to provide a distributed transaction. Crash windows are explicit,
idempotent and auditable; ambiguous state cannot silently become production.