# L2 Coverage Audit — One-Way Cutover (C′)

Key: `coverage_keys/L2_oneway_cutover.md`. Judged FUNCTION, not vocabulary; same standard for both. Only text between ===RECOMMENDATION_BEGIN/END=== judged.

## Design X — d39

| # | Component | Status | Note |
|---|---|---|---|
| 1 | Dependency discovery (active surfacing) | COVERED | Instrument old system, record every connection over full cycle; live traffic not docs. |
| 2 | Dependency map + criticality classification | MISSING | Lists consumer types and "least critical first," but no recorded/typed map or explicit blast-radius ranking step. |
| 3 | Owner assignment for critical dependencies | MISSING | Names a reclaim decision-maker only; no accountable owner per critical dependency. |
| 4 | Discovery-completeness / residual-unknown stance [HARD] | COVERED | Unexplained = live dependency until disproven; soak built assuming non-daily deps still surface; "nothing irreversible until everything reversible exhausted." |
| 5 | Parallel-run / shadow before cutover | COVERED | Shadow run, same inputs, reconcile divergences over full cycle. |
| 6 | Readiness criteria + verification before switch | COVERED | Agreement-over-full-cycle earns control; reclaim evidence-gated. |
| 7 | Point-of-no-return + decouple shutdown [HARD] | COVERED | Two distinct events; reclaim is the only true PONR; hold old warm, earned by evidence not calendar. |
| 8 | Bounded / staged exposure | COVERED | Cut over in slices, smallest/least-critical first; failure bounded to its slice. |
| 9 | Post-cutover monitoring tuned to missed dependency [HARD] | COVERED | Soak monitoring watches for report fails, script errors, process stalls = unmasked hidden deps. |
| 10 | Fallback path + explicit trigger [HARD] | COVERED | Pre-defined health/dependency signals auto-trigger fallback; immediate and rehearsed. |
| 11 | Reversibility / rollback-residue assessment | COVERED | Pre-reclaim final check: no consumer still reading/writing old; reclaim leaves no residue. |
| 12 | Decision authority + finality gate | COVERED | Named decision-maker signs off; reclaim is a separate, later gate. |
| 13 | Finality record | COVERED | Short record of what was verified and on what evidence before reclaim. |

**X totals: 11/13 covered. HARD 4/4 covered. MISSING: #2, #3.**

## Design Y — d05

| # | Component | Status | Note |
|---|---|---|---|
| 1 | Dependency discovery (active surfacing) | COVERED | Exhaustive audit via logs, code repos, operator interviews, incident history, contracts. |
| 2 | Dependency map + criticality classification | COVERED | Registry maintained; classified by type; ranked critical by consequence. |
| 3 | Owner assignment for critical dependencies | COVERED | "Assign an owner—the person or team responsible," with clear accountability. |
| 4 | Discovery-completeness / residual-unknown stance [HARD] | COVERED | Parallel run "to discover the dependencies you missed"; assumes one may survive into cutover; discovery window not calendar. |
| 5 | Parallel-run / shadow before cutover | COVERED | Run old and new side-by-side as a discovery window; reconciliation implied. |
| 6 | Readiness criteria + verification before switch | COVERED | Evidence-based gate, test matrix, stop-discovering-for-N-days, all gates pass. |
| 7 | Point-of-no-return + decouple shutdown [HARD] | MISSING | Bundles "shut down old AND reclaim hardware" into one go/no-go commitment; no decoupling of shutdown from cutover, no soak keeping old warm — the exact HARD trap. |
| 8 | Bounded / staged exposure | MISSING | Cutover framed as a single switch; no waves/slices to limit blast radius. |
| 9 | Post-cutover monitoring tuned to missed dependency [HARD] | COVERED | Watches failed integration calls, "used to work," report mysteriously stopped — divergence/dep-health, not uptime. |
| 10 | Fallback path + explicit trigger [HARD] | COVERED | Pre-defined rollback trigger (severity/duration/signal); tested, rehearsed procedure; named authority. |
| 11 | Reversibility / rollback-residue assessment | MISSING | Notes restore window is limited, but never assesses what reverting would NOT restore (new-system data, state drift, switched consumers). |
| 12 | Decision authority + finality gate | COVERED | Explicit gate; clear authority who can decide rollback. |
| 13 | Finality record | MISSING | Ongoing registry ownership only; no capture of authority/evidence/assumptions/closure at cutover. |

**Y totals: 9/13 covered. HARD 3/4 covered. MISSING: #7 [HARD], #8, #11, #13.**
