From: Petra Vogelsang <p.vogelsang@blauwal-logistik.example>
To: Projekt LEUCHTFEUER programme list <leuchtfeuer@blauwal-logistik.example>
Date: Tue, 2 Apr 2024 18:05:00 +0200
Subject: Cutover strategy (AP-3) — my proposal, before it goes to the steering committee

Dear all,

I promised the kickoff a written cutover-strategy proposal by early April, so here it is, from me
personally and in plain words, before the PMO turns it into a slide with a traffic light on it.

The question on the table is whether we take the remaining warehouses over to QUAYSTONE one at a
time, or switch the whole estate in a single coordinated weekend. You all know people who have
done the second kind. Some of them still speak at conferences about it; the others have stories
they only tell after the second beer.

Let me be direct about where I stand, and equally direct that this is where I *stand*, not a law
of nature: **I think a big-bang cutover would be reckless for this company**, and I will argue
against it in every room where it comes up. We run physical goods through physical halls. When a
warehouse loses its system, trucks queue on real asphalt, and every hour of confusion is somebody's
delivery promise broken. We are sailors on this one: you don't take the whole fleet out of harbour
at once on a ship class nobody aboard has ever sailed. You send one boat first, in fair weather,
with your best crew, and you watch how she answers the helm.

There is a story I keep coming back to when this discussion gets brave. In 1994 the first Ariane 5
tore itself apart forty seconds into its maiden flight, because one leftover piece of software
crammed a 64-bit value into a 16-bit slot. The old code had worked for years on the old rocket —
nobody re-tested it on the new one. That is a big-bang cutover in a single image: one untested
conversion, everything riding on one launch, no second boat. I would rather be teased for
caution than remembered for fireworks.

So my proposal, concretely:

**First, SEAGULL sails alone.** The Walle pilot goes first, exactly as decided, and it gets a
proper hold point afterwards: we do not touch a second site until the pilot has run stably and the
lessons are written down where the next site can read them. A pilot whose lessons stay in people's
heads is just a rehearsal for repeating the same mistakes with more witnesses.

**Then, warehouse by warehouse, in small convoys.** After the hold point we take the remaining
sites in small groups, orders of two at most, each with its own go/no-go decision on data
readiness, trained crew, and interface tests. Any site that is not ready waits for the next
convoy. No heroics, no "we'll fix it live", no site dragged across the line to keep a date on a
chart looking green.

**And the date serves the sequence, not the other way round.** If holding the line on quality
costs us calendar, we pay in calendar. I would rather explain a late arrival than a shipwreck.

I know the single-cutover camp has real arguments — one migration window, one set of interface
freezes, less time running two systems in parallel. I have weighed them and I remain where I am.
The steering committee decides, as it should; if it decides against me, I will execute the other
plan loyally and keep my metaphors to myself.

Comments in writing until the 12th, please, so the committee sees the disagreements and not just
the conclusions.

Fair winds,
Petra
