ModelForge/docs/architecture/ATOMIC_CUTOVER.md

Atomic cutover

Cutover is a durable journal around an external operation, not a claimed distributed transaction:

PREPARING -> LOCKING -> SWITCHING -> VERIFYING -> COMMITTING -> COMMITTED
                                         `-> ROLLING_BACK

Preparation performs a CAS/version check, exact observed-source check, approval recheck, current validation check and immutable rollback snapshot. The adapter then uses its safest atomic primitive (Qdrant alias update for ExampleRAG). ModelForge records CUTOVER_COMMITTED only after the adapter reports the expected external target plus bounded read-path/capability/smoke health. A stale alias is STALE_SOURCE; unhealthy post-switch truth enters rollback. Production execution additionally requires the matching approved M12 requires_reindex promotion plan.