A logistics platform is migrating a system that coordinates live vehicle dispatch. What controls reduce migration risk when the operation cannot pause?

The controls, roughly in order of value

• Progressive rollout by a meaningful dimension. Not a random percentage of requests but a coherent unit — one city, one vehicle class, one customer segment — so that a problem is contained and its blast radius is describable. Random percentage rollouts for a stateful physical operation split an entity's history across two systems, which is worse than either.
• Shadow comparison before serving. Run the new dispatch logic against live inputs, compare its decisions with the old system's, and explain every difference before it acts on anything.
• A fast rollback that has been exercised. The ability to return to the old system in minutes, tested under realistic conditions, not documented and assumed.
• A defined halt condition with a named person authorised to invoke it, agreed before the rollout. During an incident there is no time to negotiate who may stop it.
• Continuous reconciliation between the two systems' views of state, so divergence is detected in hours rather than in a customer complaint.

The physical-world complications

• Decisions cause movement, and movement is not reversible. A vehicle dispatched incorrectly is a real cost, so the tolerance for a wrong decision is much lower than for a wrong page render — which argues for a longer shadow period.
• In-flight work spans the cutover. A trip assigned by the old system and completed after the switch must be handled, which means the new system must accept in-flight states it did not create.
• Operations staff are part of the system. They have learned the old system's behaviour, and a change in how dispatch decides is a change in their working model. Training and a communication plan are migration controls, not a nicety.

The measurement that determines readiness

Not the absence of differences but the explanation of them. A shadow run where every difference is understood — this one is an improvement, this one is a timing artefact, this one is a bug now fixed — is evidence. One with a small number of unexplained differences is not, however small the number, because the unexplained ones are by definition the ones you do not understand.