Skip to content

Migration Wave Plan

Sequenced cohort process — instantiates Managed Retreat

Breaks the retreat into sequenced cohorts with an explicit order, cadence, and cutoff for each, moving the longest-lead and least-mobile elements early enough to keep the rest movable.

A Migration Wave Plan is the ordering and timing of the retreat: instead of one final move, it divides the subject into cohorts and schedules them in waves, each with its own start, cadence, and cutoff. Its defining principle is sequencing by constraint, not convenience — the longest-lead, least-mobile, most path-dependent elements go early, because leaving them for last is what strands a retreat when the horizon closes. It answers who moves, in what order, by when; it does not decide whether each wave is ready to go, nor hold open the channel the cohorts travel through.

Example

An engineering org must vacate a leased datacenter whose contract will not be renewed. Rather than a single cutover weekend, its Migration Wave Plan sorts ~200 services into waves. Wave one is the stateless, low-risk services — easy, but chosen first not for being easy: they go first to prove the corridor and the receiving zone under low stakes. The genuinely hard cohorts — a stateful database cluster with an ≈11-week data-sync lead time, and a legacy service no one fully owns — are scheduled to start early on the calendar even though they finish late in the sequence, because their long lead time is the real constraint; begin them last and the lease expires mid-transfer. Each wave carries an explicit cutoff: if it has not cleared by its date, it is escalated and the next wave's window is protected rather than letting one slip cascade into the closing lease deadline.

How it works

  • Sort by lead time and mobility, not ease. The schedule is built backward from the closing horizon, so the elements that take longest to move start soonest.
  • Prove the path on a low-stakes cohort first. An early, reversible wave validates the corridor and destination before the irreplaceable cohorts commit.
  • Give every wave a cutoff. Each cohort has a date past which it is escalated or re-planned, so one wave's slippage does not silently eat the next wave's window.
  • Protect the sequence, not the average. The plan defends the latest-starting critical cohort's room, because that is where the retreat actually fails.

Tuning parameters

  • Wave granularity — many small cohorts vs. a few large ones. Fine-grained lowers per-wave risk and eases rollback but multiplies coordination; coarse is simpler but bets more on each move.
  • Sequencing rule — order by lead time, by risk, by dependency, or by mobility. The choice determines which failure mode the plan is optimized against.
  • Wave overlap — whether a wave starts before the prior one finishes. Overlap compresses the schedule against the horizon but strains shared capacity and the corridor.
  • Cutoff strictness — how hard each wave's deadline bites. Hard cutoffs protect downstream waves; soft ones absorb variance but let slippage propagate.
  • Buffer placement — where slack sits. Buffer on the critical cohort protects the whole plan; buffer spread thin protects nothing in particular.

When it helps, and when it misleads

Its strength is that it defeats the most common way an orderly retreat fails — running out of runway on the one element that could never move fast — by pulling long-lead, low-mobility cohorts forward and defending their room explicitly. Waves also make the retreat learnable: each cohort informs the next.

The seductive error is cream-skimming: sequencing the easy, visible cohorts first to show progress, which leaves the hardest, least-mobile subjects for last against a horizon that is now much closer. A wave plan optimized for early wins is optimized for late catastrophe. It can also be run backwards — reverse-engineered from a politically fixed end date so the sequence "fits" regardless of real lead times. The discipline is to build the schedule from the critical cohort's lead time — the longest pole[1] — and to protect that cohort's window above headline progress.

How it implements the components

  • staged_retreat_sequence — the plan is the ordered sequence of preparation, partial moves, and cutoffs that replaces a single final move.
  • response_timing_window — it assigns each wave its start, cadence, and cutoff against the closing horizon, so timing is explicit rather than emergent.

It does not check that a given wave is actually ready to go (that's Migration Readiness Assessment), keep the channel the cohorts travel open (that's Controlled Corridor), or run old and new side by side during a wave (that's Parallel Site or System Run).

Notes

The wave plan and the readiness gate are deliberately separate: the plan says a cohort should move now; the gate says it may. Fusing them tempts a team to declare readiness because the schedule demands it — the very inversion that strands the hard cohorts the plan exists to protect.

References

[1] In the critical path method, total duration is set by the longest dependent chain of tasks; the "long pole" is the element whose lead time — not whose difficulty — governs the schedule, which is why a retreat is sequenced from it. ↩