Dual-view migration states Diagram

Forward rail

The new view replays shared history, then consumes to the tip
Only one view serves each read percent; the flag is reversible
Cutover needs criteria, not courage: mismatches plus lag plus hold time

Gates that hold

Shadow compares every read while serving zero live percent
Canary grows 5 to 50 to 100 only while mismatches stay zero
Lag has a bound; an unbounded new view never cutsover

Rollback is a state

Rollback is a real state: one flag flip back to the old view
The old view keeps serving until retirement, so rollback is instant
After a fix the migration re-enters at canary, never at cutover