zero-downtime-migration

Follow six sections: pre-migration backups and dry-runs, a rollout strategy with feature flags and canary stages, validation metrics, a rollback plan with ABORT conditions, a communication plan, and worst-case scenarios. Use dual write/read phases A through D to shift traffic gradually.

Dual write writes to both source and target systems while reading from the source first, then comparing both, then reading from the target. Phases progress from easy rollback (flag off) to a Point-of-No-Return gate requiring owner approval before cutover.

Skip it for build tool swaps like Webpack to Vite, local dev environment changes, internal-only tooling, and minor library updates without breaking changes. It is designed only for work where production traffic and user data are at stake.

Automatic ABORT triggers include error rate exceeding baseline by 1%p for 5 minutes, p95 latency up 50% for 10 minutes, and any critical path failure in payments or authentication. Dual-write mismatch above 0.1% warrants manual review as an abort candidate.

Traffic shifts progressively: 0% to 1% for 30 minutes, then 10% for an hour, 50% for six hours, then 100%. Each stage has explicit ABORT conditions tied to error rate, latency, and data consistency checksums.