Owner: Farah Qureshi. Cluster: member ledger. Three weekends.
Three weekends onto a new Postgres cluster for the member ledger. The old primary stays up until weekend 3 finishes its writes and is demoted to a replica. Backups are taken before each window opens.
Before weekend 1
Restore last month's backup onto the new cluster and diff the counts before the window is announced.
Freeze schema changes on the ledger from the Friday before weekend 1. Hotfixes wait until Monday.
Tell members the app will be down for maintenance.
Phases
Weekend 1: build the replica and compare row counts, table by table, before any read moves.
Weekend 2: move read traffic. Writes stay on the old primary until the counts still match.
Weekend 3: move writes, then make the old primary a replica once the new primary is taking them.
Member-facing window: not set on the phases.Each phase tells members: Saturday 01:00 to 03:00.
Name that window on weekend 1, weekend 2, and weekend 3.
Rollback
Point reads and writes back at the old primary. It stays writable through weekend 3.
Do not drop the old primary until a weekday of clean reads has passed on the new cluster.
Who decides
Farah calls the window. Grant does not move it.
down for maintenance
Grant Holloway
Members will ask what this window means. Can we say balances are read-only?
Aisha Bello
Use the status-page line from March. Read-only, not down.
Member-facing window
Aisha Bello
@agent add the member-facing maintenance window to each phase.
agent
Added Saturday 01:00 to 03:00 on each phase. Leaving the thread open so you can check every phase.
Start with @agent to ask the agent
ResolveReply
Fictional example: an Oxbeam Credit Union ledger cutover in Gander, with a support thread and a scripted agent connect reply.
How cutover plans get reviewed today
A pasted plan is fine the hour it is written. By the next change, reviewers are commenting on a stale copy and the author is editing a different file.
A war-room screenshare shows the current plan to whoever is in the room. Support, which has to tell members what they will see, is often not in that room. A PR is a poor place for a plan that will change three more times before Friday.
Three weekends, one live plan
Farah Qureshi's agent drafts the member-ledger cutover for Oxbeam Credit Union: three weekends onto a new Postgres cluster. Farah runs gander watch on plans/ledger-db-cutover.md and sends the link to Aisha Bello in SRE and Grant Holloway in support.
Grant highlights a sentence and says members will ask what 'maintenance' means. Aisha replies with the status-page wording they used last quarter. That thread stays human.
Aisha starts a new comment: "@agent add the member-facing maintenance window to each phase." Farah's agent adds a Saturday 01:00 to 03:00 window on every phase, replies, and leaves the thread open because the edit touches the whole plan. Grant sees it on the original link. The plan stays local until the cutover is committed.
Who's in the doc
WriterSRESupport leadThe author's agent
Writer Platform engineer. Runs the agent and sends the one link.
SRE Checks backups, the window, and the rollback.
Support lead Checks what members will see, and when.
The author's agent Has the phase list. Updates it when SRE uses agent connect.
Reviewers only need a browser. Talk to each other in normal threads. Use agent connect when you want the draft changed.
Agents that fit migration and rollout plans
Claude CodeThe plan lives next to the migration code. MCP returns agent connect to that session.
CodexCodex drafts the cutover. The MCP config carries the comment back.
CursorReviewers use the link. The author keeps the file in the repo workspace.
Grok BuildA headless run can refresh the plan in a watched folder between rehearsals.