Cutover Plan

flowchart TB
  t1["T-7d · Dry run in staging<br/><i>full rehearsal, timed</i><br/>owner: Delivery"]
  t2["T-1d · Freeze changes · verify backups<br/>confirm rota and bridge<br/>owner: Ops"]
  t3["T-0 00:00 · Enable read-only on legacy<br/>owner: Ops"]
  t4["T-0 00:15 · Final delta migration<br/><i>est 90 min · checkpoint at 60</i><br/>owner: Data"]
  t5["T-0 01:45 · Reconcile counts + checksums<br/>owner: Data"]
  g1{"T-0 02:15 · GO / NO-GO<br/><i>criteria: 100% row match,<br/>0 critical defects, all owners present</i>"}
  t6["T-0 02:30 · Repoint DNS + feature flag<br/><i>TTL pre-lowered to 60s</i><br/>owner: Platform"]
  t7["T-0 02:45 · Smoke suite + 10 manual journeys<br/>owner: QA"]
  g2{"T-0 03:30 · Accept or roll back"}
  t8["T-0 03:30 · Open to 10% traffic<br/>owner: Platform"]
  t9["T-0 06:00 · 100% traffic<br/>owner: Platform"]
  t10["T+24h · Hypercare ends<br/>legacy kept read-only 30d"]
  rb(["ROLLBACK · revert DNS<br/>re-enable legacy writes<br/><i>est 20 min</i>"])
  pnr["POINT OF NO RETURN<br/><i>after first write to new system<br/>rollback needs reverse migration</i>"]

  t1 --> t2 --> t3 --> t4 --> t5 --> g1
  g1 -->|"no-go"| rb
  g1 -->|"go"| t6 --> t7 --> g2
  g2 -->|"roll back"| rb
  g2 -->|"accept"| t8 --> t9 --> t10
  t8 -.-> pnr

What it is

The go-live runbook on a clock, with an owner per step, timed estimates from a rehearsal, explicit go/no-go gates with criteria written in advance, and the point after which rollback is no longer a DNS change.

Writing the no-go criteria before the night is the entire discipline. At two in the morning, with everyone tired and the business waiting, criteria invented on the spot are always met.

When you produce it

Two to four weeks before go-live, rehearsed at least once end to end. The rehearsal is what turns the estimates into numbers.

Who reads it

Everyone on the bridge. The business sponsor, who makes the go/no-go call. Anyone being woken up if it goes wrong.

What good looks like

• Timings come from a rehearsal, not from optimism.
• Go/no-go criteria are objective and pre-agreed, and one named person decides.
• The point of no return is marked, and everyone knows when it passes.
• Rollback has its own timed procedure and has also been rehearsed.
• Communications are steps too — who tells customers, support and the business, and when.
• Hypercare has a defined end.

Common mistakes

• No rehearsal, so the ninety-minute migration takes five hours.
• Vague gates. "Looks fine" is not a criterion.
• An untested rollback, which is the same as no rollback.
• Decommissioning the legacy system immediately. Keep it read-only for weeks; it costs little and answers every reconciliation question.