# Working

## STATE

**problem.** Replace the aging control/dispatch system that runs a utility's physical
operations. Bring up the new system, move operations onto it, shut the old one down and
reclaim its hardware. Two decades of undocumented downstream dependencies (tools, scripts,
reports, processes); some builders have left. Once old hardware is reclaimed, recovery takes
weeks. Team controls rollout plan, parallel-run, pre-switch verification, monitoring.
*Success:* operations continue AND no surprise dependency causes an outage that cannot be
quickly undone. *Failure:* a missed dependency or premature shutoff causes a non-recoverable
disruption.

**verbs run (why each):**
- **match** — anchored the meta-model "irreversible transition with hidden dependencies, must
  verify before a point of no return" to the catalog (semantic + 6-facet). Top archetypes:
  guarded_state_transition, checkpoint_and_rollback, irreversible_commitment_management;
  facet "hidden undocumented dependencies" surfaced dependency_exposure.
- **salience-rank / prune** — load-bearing: irreversibility (the cutover + hardware reclaim is
  the point of no return), the hidden-dependency discovery, verify-before-commit, staged
  exposure. Context-only: pure recovery/restore (rollback is *unavailable* post-reclaim),
  generic approval.
- **compose** — model nodes {old_system, new_system, hidden_dependencies, cutover_event,
  hardware_reclaim, monitoring}; edges old—(depended_on_by)—deps, new—(parallels)—old,
  cutover—(crosses)—point_of_no_return, reclaim—(makes irreversible)—cutover. Every operative
  prime (irreversibility, threshold, staged exposure, consent/review) annotates an edge;
  referential integrity holds.
- **lift L1** — skeleton: a system in a relied-upon state; a successor; an *irreversible*
  transition whose residue (reclaimed substrate, weeks-to-restore) cannot be undone; latent
  unknown couplings; an operator who controls timing, parallelism, verification, exposure.
  Every role has a witness; no domain terms.
- **evaluate-fit (gate)** — see anti-signature walk below.
- **lift L2** — scoped coverage map below.

**operative pattern (the ONE):** *Irreversible Commitment Management.* The decision asked for
is literally "design the switch so a hidden problem cannot become a sustained loss" — i.e.
govern the no-return threshold (cutover + hardware reclaim) so scrutiny, staging, and exposure
limits sit *before* finality. Checkpoint-and-rollback is rejected as the operative pattern: its
own anti-signature ("the change is inherently irreversible and can only be compensated, not
rolled back") trips once hardware is reclaimed — rollback is a *homolog* available only inside
the pre-reclaim window, not the governing pattern. Guarded-state-transition is the verify-gate
*mechanism*, subsumed as the Consent/Review Gate component here.

## evaluate-fit — anti-signature walk (Irreversible Commitment Management)
- *Ordinary reversible change* — NOT tripped: post-reclaim residue is weeks of lost dispatch.
- *Generic approval without finality* — NOT tripped: finality is the whole point.
- *Transition without irreversibility* — NOT tripped: rollback stops being meaningful at reclaim.
- *Failure response after event* — NOT tripped: we govern *before* commitment.
- *Learning experiment, contained failure* — NOT tripped: full cutover is system-wide, not small.
- *Psychological precommitment only* — NOT tripped: externally consequential act.
None disqualifies. Pattern fits.

## SCOPED COVERAGE MAP — Irreversible Commitment Management (13 components)

1. **Irreversibility Check** — [instantiated]. Explicit rule: the irreversible residue is
   reclaiming/repurposing the old hardware (weeks to rebuild), not the software switch itself.
2. **Consequence Scope** — [instantiated]. Enumerate every downstream consumer of the old
   system (tools, scripts, reports, processes) by observing live traffic, not memory.
3. **Point-of-No-Return Marker** — [instantiated]. Two visible gates: cutover, then a separate,
   later "decommission/reclaim" gate. The reclaim is the true threshold.
4. **Consent or Review Gate** — [instantiated]. A named reclaim-authorization sign-off with
   evidence criteria; the verify-before-switch checks (guarded-transition homolog) feed it.
5. **Staged Commitment Path** — [instantiated]. Cut over function-by-function/feeder-by-feeder,
   not big-bang; each wave reversible before the next.
6. **Simulation or Pilot Probe** — [instantiated]. Run the new system in shadow/parallel
   against live operations and reconcile outputs before any real cutover.
7. **Exposure Limit** — [instantiated]. Cap each wave's blast radius; a wave's failure can only
   affect that slice while the old path still carries the rest.
8. **Compensation Rule** — [correctly_declined]. The design's whole aim is to keep rollback
   *available* until verified, so no irreversible harm needs post-hoc restitution; adding a
   compensation regime would over-build for harm we are structurally preventing.
9. **Finality Record** — [instantiated]. A decommission record: what was verified, by whom, on
   what evidence, before reclaim authority is granted.
10. **Cooling-Off Period** — [instantiated as homolog: the hold-old-warm soak window]. Mandatory
    observation period running the old system idle-but-recoverable after cutover before reclaim.
11. **Independent Review Panel** — [correctly_declined]. Single team controls the rollout and the
    risk is technical-dependency, not contested authority/rights; a separate panel would add
    governance theater without earning its place. (Reviewer-independence is discharged lightly
    by requiring the verifier of a slice not be its implementer — noted, not a panel.)
12. **Impact Monitoring Signal** — [instantiated]. The monitoring the team controls: per-slice
    health + dependency-liveness alarms that arm rollback and gate the soak window.
13. **Rollback Residue Assessment** — [instantiated]. Before granting reclaim, confirm no hidden
    consumer still reads the old system, so that turning it off leaves no residue.

No component is [missing]. Gate passed; coverage complete; one pattern only (no bolt-ons).

COST: ~8 operations, ~14000 tokens.

===RECOMMENDATION_BEGIN===
Treat this as two separate events, not one. The first event is moving operations onto the new
system. The second, much later event is turning the old system off and giving its hardware
back. The danger is collapsing them: the moment the hardware is reclaimed, recovery takes
weeks, so that is the only true point of no return. Everything before it must be reversible,
and the reclaim must be earned by evidence, not scheduled by calendar.

Begin by discovering what actually depends on the old system rather than trusting anyone's
memory. Before changing anything, instrument the old system to record every connection it
serves over a full operating cycle that spans peak demand, end-of-month and end-of-quarter
reporting, and any seasonal jobs: which tools call it, which scripts read its outputs, which
reports pull from it, which downstream processes consume its dispatch decisions. The list of
its real consumers comes from watching live traffic, not from documentation. Anything that
touches the old system but cannot be explained is treated as a live dependency until proven
otherwise.

Stand the new system up beside the old one and run it in parallel against real operations
without letting it control anything. For a sustained period it shadows the live system:
receiving the same inputs, producing the same dispatch decisions, generating the same reports.
Reconcile its outputs against the old system continuously and investigate every divergence.
Only the new system's agreement with reality over a full cycle, including the heavy reporting
periods, earns it the right to take control.

Move operations in slices, never all at once. Cut over one function, feeder, or operating area
at a time, smallest and least critical first. After each slice goes live on the new system,
keep the old system fully running and able to take that slice back within minutes; define in
advance the health and dependency signals that automatically trigger that fallback, so the
decision is not argued about while operations degrade. A slice may fail only within its own
boundary; the rest of operations stay on the proven path. Advance to the next slice only after
the current one has run clean for a defined window. The fallback for any single slice is
immediate and rehearsed; the cost of a missed dependency is a quick, contained reversal rather
than an outage.

Keep the old system alive and warm well past full cutover. Once every slice runs on the new
system, do not touch the hardware. Hold the old system idle but instantly recoverable through
a mandatory soak period long enough to cover a complete operating and reporting cycle, because
many of the undocumented dependencies are not daily; they surface at month-end, quarter-end,
or during a rare operating condition. During the soak, monitoring watches for anything still
reaching toward the old system: a report that fails, a script that errors, a process that
stalls. Each such event is an unmasked hidden dependency, repaired on the new system while the
old one is still there to fall back to.

Make reclaim a deliberate, evidence-gated act with its own authorization. The hardware is
reclaimed only after a final check confirms that nothing is still reading from or writing to
the old system: connection logs show no live consumers, every previously observed dependency
is accounted for on the new system, and the soak period passed clean through at least one full
heavy cycle. A named decision-maker signs off on a short record stating what was verified and
on what evidence before reclaim proceeds. To keep the verification honest, whoever confirms a
slice is clear should not be the same person who implemented it.

The final operating rule: nothing irreversible happens until everything reversible has been
exhausted. Keep the old system recoverable, advance only on proven slices, and reclaim its
hardware only when monitoring and logs prove, across a full operating cycle, that nothing
depends on it anymore.
===RECOMMENDATION_END===
