Cutover is a control, not an event

Replatforming a public system is not the interesting part. Keeping the public information service running while you do it is.

We treat the cutover as a control with its own evidence. Traffic stays on the live routes until the new system has passed the same accessibility and authorization checks as the old one. The switch is reversible until the moment it is not, and that moment is recorded.

A migration that takes a service offline to succeed has not succeeded. It has moved the risk onto the people who depend on the service. The measure we care about is simple. Did the public notice, and did authorization hold its date.

If the answer to both is no and yes, the cutover worked.