1.3 KiB
Migration recovery
Batch checkpoints and generations make preflight/backfill/validation/shadow restart-safe. Matching complete batches are skipped; incomplete attempts resume from the durable cursor. Old workers cannot write into a new generation.
Cutover stages are persisted before external work. Startup reports non-terminal cutover journals but
does not guess external truth. A registered adapter/operator inspection submits the observed target,
fingerprint and health to reconciliation. Exact healthy target commits, exact healthy source records
rollback, and ambiguous truth becomes MANUAL_INTERVENTION_REQUIRED. Orphan shadows are retained
and surfaced for later explicit cleanup; never auto-deleted.
M16 reconciliation semantics
Migration is the one subsystem that deliberately does not resolve itself after an interruption. External alias truth cannot be inferred from a crash, so an interrupted cutover stays in its intermediate stage, is reported as requiring reconciliation, and waits for an operator working through the typed adapter.
That is the difference from lifecycle, which resolves: an incomplete lifecycle operation rolls back from its immutable snapshot exactly once, and a second control-plane start changes nothing.
See ADR-0045 for the resolve / report / fail-closed contract each subsystem declares.