ModelForge/docs/architecture/adr/0036-external-truth-cutover-and-reconciliation.md

ADR-0036: External-truth cutover and reconciliation

Status

Accepted in M13 on 2026-08-26.

Decision

Cutover uses a durable operation journal, immediate CAS/source check and adapter-owned atomic primitive. Database commit follows verified external identity and health. Startup reconciliation requires measured external truth and chooses commit, rollback or manual intervention conservatively.

Consequences

ModelForge does not pretend to provide a distributed transaction. Crash windows are explicit, idempotent and auditable; ambiguous state cannot silently become production.