Logical–Physical Migration Split

Split a high-risk storage or topology migration into two phases with different rollback costs. In the logical phase, the target topology is made real to every client — through views, routing rules, proxies, or flags — while the physical layout underneath stays unchanged; the system behaves, from the application's perspective, as if the migration had already happened. Because nothing has physically moved, rollback is a configuration change measured in seconds, and the new behavior can be ramped gradually under live production traffic. Only after the logical world has proven itself does the physical phase run: data actually moves, and the hard-to-reverse step executes against a topology that is no longer novel.

The insight behind the split is that most migration risk lives in the new behavior, not in the data movement. Wrong routing, unsupported query shapes, application assumptions about transactions or ordering — these are the failures that cause incidents, and they can all be exercised without relocating a byte. Rehearsing them where reversal is cheap converts unknown unknowns into found bugs; the physical step then carries only the risks that genuinely require moving data to discover. Shadow techniques compound the effect: replaying or mirroring live traffic through the candidate topology and comparing results against the incumbent turns production itself into the test harness, without production depending on the outcome.

The same shape appears wherever a one-way door can be preceded by a cheap dress rehearsal: expand/contract schema migrations that add the new structure before any code depends on it; branch-by-abstraction refactors that route through an interface before swapping implementations; dark reads and shadow traffic that compare a candidate system's answers against the incumbent's before cutover. The common discipline is ordering — sequence the migration so that every reversible validation happens before the irreversible step, never after.