ModelForge/docs/architecture/SHADOW_AND_DUAL_READ.md

Shadow and dual read

Shadow targets are separate storage identities and are exposed only to evaluation/admin or an explicit project shadow route. Ordinary production consumers continue using the current binding. Compatible adapters may execute one request against current and shadow, but persist only result IDs, metrics, latency, errors and evidence references—not content.

Shadow completion records a MigrationShadowSession. Success reaches READY_FOR_CUTOVER; it never switches traffic. An isolated technical verdict and project-promotion verdict remain distinct.