Dual-write cutover needs a checklist—not a brave night.
Turning on dual-write feels safe. Weeks later nobody owns the comparison, rollback is theoretical, and writing everything twice has quietly become the architecture. It only works as a phase with a clear end and someone in charge.
When cutting over with dual-write, use the TWIMCO Dual-Write Cutover Checklist: name the source of truth by phase, assign the compare job owner, define freeze and rollback, and write done-means for when dual-write ends. Dual-write without a compare owner is two lies staying warm.
Dual-write is a phase, not a lifestyle
Teams turn on dual-write to feel safe. Both systems get the update. Weeks later nobody owns the comparison, the freeze rules are fuzzy, rollback is theoretical, and "done" never arrives because writing twice became the architecture.
Dual-write can be a responsible phase. It is only responsible if you can say which system is in charge this week, who compares them, what freeze means, how you go back, and what the end looks like.
The checklist
Authority by phase. For each important object, which system wins before the cut, during the overlap, and after. One story for unlike objects will lie.
Compare owner. A job that finds mismatches is not a person who decides what they mean. Name the person before you flip the switch.
Freeze. Which writes stop, and who may break the freeze.
Rollback. The trigger, and the person allowed to go back. Untested rollback is a sentence.
Done. The record conditions that mean you stop writing twice. If done has no date, dual-write is the new permanent design. Admit that, or end it.
How the work moves
Dual-write checklist spine
- SoT by phase
Authoritative system per entity per phase.
- Compare owner
Who reads mismatches and can halt.
- Freeze
What pauses when severity trips.
- Rollback
Triggers, owner, stop-new-write steps.
- Done-means
When dual-write ends and flags die.
Dual-write without a compare job is just two systems diverging on a schedule.
Run the phases
Do not enable the overlap until the compare owner has looked at a dry run. Mismatches on day one are the point. Mismatches on day forty, with no owner, are how you grow a reconcile team.
Revisit the authority row when the phase changes. A map that still says "both" after you meant to finish is a bug in the plan, not a nuance.
How it fails
Nobody wants to own the end, so both writes stay on. The compare dashboard exists and no decision comes out of it. The first real mismatch is when someone invents a rollback. One authority story is forced onto objects that do not share a truth.
Those are the reasons the page exists. Fill it for a real set of entities, not for the idea of a migration.
Sequence of work
Dual-write phases
- Phase A
Dual-write; reads on old SoT; compare on.
- Phase B
Cohort reads on new SoT; freeze rules live.
- Phase C
Single write; done-means checked.
- After
Temporary flags removed or ticketed.
Put this into practice
Fill authority-by-phase for the objects you are actually moving. Name the compare owner before dual-write is enabled. Write the end condition so the overlap has a death date.
That cutover belongs with business process automation.
Related work: Paddle8.
We build alongside the people doing the work.
Bring us the problem you’re thinking about.