25 lines
1.3 KiB
Markdown
25 lines
1.3 KiB
Markdown
# Migration recovery
|
|
|
|
Batch checkpoints and generations make preflight/backfill/validation/shadow restart-safe. Matching
|
|
complete batches are skipped; incomplete attempts resume from the durable cursor. Old workers cannot
|
|
write into a new generation.
|
|
|
|
Cutover stages are persisted before external work. Startup reports non-terminal cutover journals but
|
|
does not guess external truth. A registered adapter/operator inspection submits the observed target,
|
|
fingerprint and health to reconciliation. Exact healthy target commits, exact healthy source records
|
|
rollback, and ambiguous truth becomes `MANUAL_INTERVENTION_REQUIRED`. Orphan shadows are retained
|
|
and surfaced for later explicit cleanup; never auto-deleted.
|
|
|
|
|
|
## M16 reconciliation semantics
|
|
|
|
Migration is the one subsystem that deliberately does not resolve itself after an interruption.
|
|
External alias truth cannot be inferred from a crash, so an interrupted cutover stays in its
|
|
intermediate stage, is reported as requiring reconciliation, and waits for an operator working
|
|
through the typed adapter.
|
|
|
|
That is the difference from lifecycle, which resolves: an incomplete lifecycle operation rolls back
|
|
from its immutable snapshot exactly once, and a second control-plane start changes nothing.
|
|
|
|
See ADR-0045 for the resolve / report / fail-closed contract each subsystem declares.
|