Fasil PM logoFasil PMProject & IT ConsultancyBook a call

At 02:03, a Load Balancer Died. The Plan Had Already Decided.

A load balancer died twelve minutes before the point of no return. The plan said N+1 or hold, so the cutover held at 50 percent, crossing 90 minutes late.

Programme
Project Falcon
Organisation
Atlas Bank
Phase
Closing
Template
Transition Plan
Post 20 of 22 following Project Falcon at Atlas Bank. Full program context is in Post 01. Previously, Post 19 told the January incident: detected in four minutes, diagnosed by a change log in nine, and closed with a corrective action about cross-party change governance that was always going to matter most on one specific night. This post is that night.

The Last Week Is Lists. The Last Night Is Gates.

By July, go-live is not a leap; it is the final step of a staircase the program has been climbing since April. Wave 1 took 5,000 customers on 13 April and exited on its criteria. Wave 2 pulled forward four days under the written rule. Wave 3 carried 400,000 from 25 May. By June's end, 455,000 Market A customers live on Falcon, with the legacy platform still carrying the remaining 1.65 million of the 2.1 million book. The night of 13 to 14 July moves the rest: a weighted-traffic cutover through the overnight low window, 5 percent, then 25, then 50, then the point of no return, then everything.

The final week is the unglamorous part the war stories skip. On 8 July, the full rollback was rehearsed one last time in staging, timed at 34 minutes. On 10 July, the cross-party change freeze went live: the contract amendment Lena Marquez closed on 12 March, corrective action CA-3 from the January incident, freezing vendor changes to any shared resource from 10 to 16 July and requiring 48-hour notification forever after. The shared rate-limiter that caused January cannot move this week, by signature. On the 11th, the comms freeze: nothing ships to customers except Marquez's pre-approved sequence. On the 12th, the final reconciliation snapshot and restore point. On the 13th at 18:00, the war room opens, Volkov's hypercare desk is staffed on-site per the terms agreed at the readiness board, and the food arrives, because someone on Ahmed Hassan's team learned from the January incident that a war room runs on logistics before it runs on heroics.

At 21:30, gate G1: the go/no-go roll-call. Not a discussion, a roll-call, each line of the readiness checklist answered aloud by its named owner against criteria written weeks earlier. It takes six minutes and it is the most theatrical thing the program has ever done on purpose, because saying “go” out loud, on the record, with your name attached, is different from nodding in a meeting.

Fasil Alemeye Abate: “Platform.” · Priya Raman: “Go.” · “Cutover engineering.” · Jin-ho Park: “Go.” · “Vendor and hypercare.” · Dmitri Volkov: “Go.” · “Compliance and regulatory notice.” · Amara Okonkwo: “Go. Both regulators notified per schedule.” · “Communications.” · Lena Marquez: “Go.” · “Production authority.” · Abebe Alemu: “Go. And I am staying for the PONR.”

Fatima Idris is in the room for G1, says nothing during the roll-call, and leaves at 22:05, which is the protocol working: the sponsor witnesses the decision and then removes the gravity well of her own presence from the floor. At 22:00, T-0. At 22:20, the HAProxy pair begins weighting 5 percent of live traffic onto Falcon. At 22:26, the first production transaction clears end to end in 142 milliseconds, and the room does not cheer; it checks the reconciliation feed, which is the correct emotional response and also the saddest sentence in this series.

Nothing about a good go-live is exciting. That is the entire point.

02:03. One NIC, Two Rules, Eighty-Four Minutes.

The ramp climbs cleanly: 25 percent at 23:30, 50 percent at 01:10, reconciliation lag holding under twelve seconds, error rate at 0.01 percent. At 02:15 comes gate G2, the point of no return: past it, the data synchronization direction reverses, Falcon becomes the system of record, and rollback stops being a procedure and becomes a project. The G2 criteria were written into the transition plan on 30 June. There are four. The room is reading them aloud when, at 02:03, HAProxy node lb-2 drops off the network. Not a drill, not a chaos exercise: a failed network interface card, the most ordinary hardware death in the world, choosing the most extraordinary twelve minutes of the program to die in.

What happens next is the 30 March rehearsal collecting its dividend. The active/active pair does what it was exercised to do: lb-1 absorbs the full load in eleven seconds, 0.03 percent of requests error during the redistribution, and the platform settles. Nobody stands up. Two people who were not in the March exercise look around to see if they should be alarmed and take their cue from the people who were. The failover, the single event the entire DR condition C1 existed for, is over before most of the room knows it happened. That is the good news. The bad news is arithmetic: an active/active pair with one node down is not a pair. It is a single point of failure carrying half of a bank, four minutes before the gate that makes the migration irreversible.

And here the night meets the sentence written in June. G2 criterion two reads: edge tier at N+1 redundancy, verified, at gate time. One node is N. The plan does not say “use judgment.” It says hold.

Jin-ho Park: “Replacement NIC is ninety minutes if we wake the data center now. Or we promote the cold standby into the pair, sixty to seventy minutes with verification. Either way we are not N+1 at 02:15. For what it is worth, lb-1 is healthy and carried the March exercise alone for an hour.”
Abebe Alemu: “Noted, and the plan does not have a clause for what it is worth. N+1 or hold; we wrote it when we were rested specifically so we would not renegotiate it when we were not. We hold at fifty percent, inside the rollback window, and we promote the standby. Wake the data center anyway; I want the NIC too.”

The hold begins at 02:15. It is the least dramatic crisis imaginable: half the bank's traffic running clean on Falcon, half still on legacy, both reconciling, while two engineers bring a standby node into the pair and the rest of the room watches dashboards that refuse to misbehave. The standby is promoted and verified at 03:27. Park re-runs the G2 checklist from the top, all four criteria, because a gate interrupted is a gate restarted. At 03:39 the edge tier is N+1 again. At 03:45, G2 passes and the point of no return is crossed, 90 minutes behind plan, 30 minutes inside the two-hour float the plan carried for exactly this class of night.

The hardest call of the night was made three weeks earlier, in a conference room, by people who were not tired.

The Press Release Does Not Care About N+1

At 03:05, mid-hold, the second front opens. Samuel Osei has been watching the timeline slip from the executive channel, and Samuel Osei has a 07:00 press embargo, a morning-show interview slot for the retail leadership, and a campaign that has been waiting since April.

Samuel Osei: “The embargo lifts at 07:00 whether you are at fifty percent or a hundred. I cannot have the bank announcing a completed migration while half the book is still on the old platform. Either commit to me right now that you finish by 06:30, or someone tells me what I am supposed to do with a press release that is about to be wrong.”

The answer is that nobody commits a cutover to a press schedule at three in the morning, and nobody has to, because Post 07 already solved this. Marquez's pre-approved template library, built after the seven-day review war of month six, contains a contingency variant for exactly this scenario: a phased-completion release, accurate at any ramp percentage, with the embargo moved to 10:00. Marquez has it out of the library, adjusted, and re-cleared inside twenty minutes, because re-clearing a pre-approved template is a formality and clearing a fresh one at 03:00 is a hostage negotiation. The embargo moves three hours. The interview slot survives. The release that goes out at 10:00 describes a migration that completed at 05:10, which is to say: by managing the announcement instead of the cutover, the program made the announcement true. Osei's last message in the thread, at 05:14, is one word, and it is “Withdrawn.”

The ramp resumes from the hold: 75 percent at 04:20, 100 percent at 05:10. At 05:18, someone puts the legacy platform's traffic graph on the main screen as it falls to zero, a heart monitor in reverse, and the room takes its one collective breath of the night. Reconciliation closes clean at 05:55. Gate G3, the 100 percent verification, passes at 06:10 with the edge tier re-verified at N+1, per the second sentence the June flag added.

Then the morning, because go-live is a 24-hour window and customers wake up. At 08:32, the first true morning peak hits and OTP delivery times for login verification spike: the SMSC aggregator route is congesting under the full book's authentication load. Eighteen months ago this exact service was R06, the three-way ownership dispute of Post 06 that nobody owned until the three-role model gave it a service owner, an operations owner, and an escalation owner by name. At 08:33 the operations owner is paged. At 08:39 the escalation owner has the telco aggregator on a bridge. At 08:50 traffic is failing over to the secondary SMSC route and delivery times are back under threshold. Eighteen minutes, no committee, no confusion about whose problem it is, because that question was settled in writing in month five. The first customer complaint of the Falcon era, logged at 09:12, is that the new app icon is a slightly different shade of blue. Lena Marquez prints it and pins it to the war room wall.

The Cutover, as It Ran · Traffic on Falcon vs the Plan
Weighted traffic percentage through the window. The plateau is the 84-minute N+1 hold; the dotted line is the 30 June plan. The program finished 70 minutes behind plan and 30 minutes inside its own float, which is what float is for.
100% 50% 0% 22:00 00:00 02:00 04:00 06:00 08:00 02:03 lb-2 NIC fails failover: 11s, 0.03% err 02:15 G2: hold (N+1 rule) 03:27 standby promoted 03:45 PONR crossed 05:10 at 100% · 05:18 legacy flat 08:32-08:50 OTP route failover (R06 three-role model, 18 min) actual plan (30 June) 84-minute hold at 50%

The window closes the way it opened: with a gate. Hypercare runs through the day on Volkov's desk and the program's own rotas, restructured since March so that no human is primary in two places. At 21:55, Fasil Alemeye Abate signs the transition certificate; at 22:00, gate G4, the hypercare-day exit review, confirms its criteria: zero Severity-1, two Severity-3 (the OTP route and a statement-formatting defect), reconciliation balanced to zero, complaint volume below the wave 3 baseline. Day one closed with 1.9 million transactions processed and a screening path that never went above 174 milliseconds. The 90-day production telemetry clock for the regulator's OBS-1 starts tonight. Eighteen months, and the most accurate description of the decisive day is that almost nothing happened, twice, on schedule.

Drafting the Decision Gates with SCQA

A transition plan is mostly tables, and the tables are mostly fine; the part that decides whether the night survives contact with reality is the decision gates, and gates fail in one specific way: they are written as checklists when they need to be written as decisions. The drafting framework for the gates was SCQA: Situation, Complication, Question, Answer, from Barbara Minto's Pyramid Principle, one of the most cited structures in business communication. Its use as a gate-specification pattern is the practitioner adaptation here, and the fit is exact. A gate is a Situation (the state the program should be in at this moment), a Complication (the specific ways that state might not be true), a Question (the single binary the gate exists to answer), and an Answer (the criteria, the authority who reads them, and what hold means). Written this way, a gate cannot be vague about its own complication, which is precisely the discipline that put the words “N+1, verified, at gate time” into G2 instead of “infrastructure healthy.” At 02:15, “infrastructure healthy” would have been a debate. N+1 was a sentence.

Prompt · Transition Plan Decision Gates · 28 June 2026
You are drafting the decision gates for a banking platform cutover (Transition Plan TP-001). Write each gate in SCQA: SITUATION (expected state at gate time), COMPLICATION (specific failure conditions that could be true at that moment), QUESTION (the single binary this gate answers), ANSWER (pass criteria, measurable; the named authority who reads the gate; the defined meaning of HOLD at this gate, including maximum hold duration and what triggers rollback instead). CONTEXT. 13-14 July 2026 overnight cutover, remaining 1.65M of 2.1M Market A customers, weighted HAProxy ramp 5/25/50/75/100%. Window 22:00-06:00 technical, hypercare day to 22:00. Rollback rehearsed 8 Jul: 34 min. Cross-party vendor change freeze 10-16 Jul (CA-3 amendment). Reconciliation lag SLO: <30s. Two-hour schedule float. Point of no return: data-sync direction reversal at ~50% stage. GATES TO DRAFT: G1 (21:30): go/no-go roll-call. Named owners answer per line. G2 (02:15 planned): point of no return. This is the gate where the migration becomes irreversible. Be exhaustive in the COMPLICATION section: list the concrete states (infrastructure, data, error rate, staffing) under which crossing would be negligent even if everything "feels" fine. G3 (post-100%): full-traffic verification. G4 (22:00): hypercare-day exit and transition certificate. For every criterion, state HOW it is verified (which dashboard, which query, which human), not just the threshold. Flag any gate where you believe the draft criteria are insufficient to decide a realistic edge case, and name the edge case.

The June Flag That Ran the Night

AI Draft · TP-001 Gates · G2 Complication (Extract) and Edge-Case Flag

G2: POINT OF NO RETURN (extract). Situation: 50% of traffic on Falcon, reconciliation bidirectional, rollback available at 34 minutes. Complication: this is the last moment at which a rollback is a procedure. States under which crossing is negligent include: reconciliation lag above SLO; error rate above 0.1%; any open Severity-1 or Severity-2; staffing below the defined minimum for the post-PONR phases; degraded redundancy anywhere in the path that becomes single-point-of-failure once legacy stops accepting traffic. Question: does the program convert Falcon to system of record now? Answer: all criteria below pass, read aloud by the production authority (CTO), or HOLD up to 120 minutes within the rollback window; past 120 minutes, rollback executes by default and the cutover reschedules.

AI flagged (edge case): “The draft G2 criteria as supplied include platform health, data lag, error rate, and staffing, but contain no explicit redundancy criterion for the edge tier. Edge case: a single HAProxy node failure shortly before G2. The active/active design will mask it; every health dashboard will show green, because the surviving node carries the load successfully. The gate as drafted would pass while the program crosses its irreversible threshold on a single point of failure. Recommend an explicit criterion: edge tier at N+1 redundancy, verified at gate time, with re-verification at G3, since a masked failure can equally precede the 100% stage. Note: this is exactly the failure class your March DR exercise demonstrated the platform survives; the exercise proved the failover works, not that crossing PONR without redundancy is acceptable.”

Read that flag again, slowly, knowing what happened at 02:03. The machine did not predict a NIC failure. It did something more useful: it noticed that the gate's criteria had a blind spot precisely where the platform's own resilience would hide a problem, that green dashboards and a safe state are not the same thing, and that the March exercise had been quietly miscategorized in everyone's head as proof of safety when it was proof of recovery. The humans wrote the N+1 criterion into G2 and its re-verification into G3 on 30 June. Fifteen days later, at 02:15 in the morning, with half a bank in the air and a press embargo inbound, the room did not have to be wise. It had to read a sentence. The entire eighteen-month thesis of this series is compressed into that exchange: judgment exercised early, encoded precisely, so that the night shift inherits decisions instead of dilemmas.

TP-001 Transition Plan, Gate Summary as Executed

Transition PlanTP-001 · v1.2 (as executed)
Market A Full Cutover: 13-14 July 2026
Project Falcon · Atlas Bank · Transition Director Fasil Alemeye Abate · Cutover Lead J. Park · Production Authority A. Alemu
Status Executed T-0 13 Jul 22:00 · 100% 14 Jul 05:10 · Certificate 14 Jul 21:55 · Sev-1 zero

Gates, as Executed

G1 · Go/No-Go21:30, roll-call by named owner against pre-written lines. Result: unanimous go, 6 minutes. Sponsor present, then departed per protocol.
G2 · Point of No ReturnPlanned 02:15. Criteria: reconciliation lag <30s (Dynatrace query Q-17, read by Raman); error rate <0.1%; no open Sev-1/Sev-2; minimum staffing roster confirmed; edge tier N+1, verified at gate time. Executed: HOLD invoked 02:15 on N+1 criterion (lb-2 NIC failure 02:03, failover 11s, 0.03% errors); standby promoted 03:27; full checklist re-run; passed 03:45, 30 min inside the 120-min hold ceiling. Authority: A. Alemu.
G3 · 100% VerificationSmoke pack (44 checks), reconciliation closure, N+1 re-verification per the June flag. Passed 06:10. Legacy traffic zero from 05:18.
G4 · Hypercare Exit22:00. Zero Sev-1; two Sev-3 (OTP route failover 08:32-08:50 via R06 three-role model; statement formatting defect, fix scheduled). Reconciliation balanced to zero. Complaints below wave-3 baseline. Transition certificate signed 21:55.

Standing Protections in Force

Change freezeCross-party freeze 10-16 Jul incl. vendor shared resources, per CA-3 contract amendment (signed 12 Mar 2026); 48h vendor notification permanent thereafter. The January rate-limiter cannot recur by signature.
RollbackStage-indexed rollback to 50%; rehearsed 8 Jul at 34 min; expires at PONR, after which the defined contingency is documented degraded-mode operation, not the slogan “roll forward.”
CommsPre-approved sequence (Post 07 library) incl. phased-completion contingency release; embargo movable by comms lead without fresh legal review. Invoked 03:25; embargo 07:00 to 10:00.
RegulatoryMarket A regulator notified at T-0 and at certificate; Market C OBS-1 90-day production telemetry window opened 14 Jul (owner A. Okonkwo).

What the Human Changed

What the Human Changed (AI Draft to Executed TP-001)
  1. Adopted the N+1 criterion and extended it to G3. The flag asked for redundancy verification at the PONR; Fasil and Alemu wrote it into both G2 and G3, because a masked failure does not care which gate it precedes. The G2 instance decided the night; the G3 instance is why 06:10 was a verification and not an assumption.
  2. Put a ceiling and a default on HOLD. The draft defined hold without an expiry. An open-ended hold at 02:00 becomes a slow-motion argument. The executed plan caps G2 holds at 120 minutes inside the rollback window, after which rollback executes by default and the cutover reschedules: the plan decides against proceeding, so that exhausted people never have to.
  3. Replaced “roll forward” with a documented degraded-mode plan. The draft's post-PONR contingency was the industry's favorite two-word slogan. The executed plan specifies which services shed load, in what order, with what customer messaging, if the irreversible state degrades. It was never invoked, which is the only acceptable fate for that section.
  4. Made every criterion name its instrument and its reader. “Reconciliation lag under 30 seconds” became “query Q-17, read aloud by Raman.” A threshold without a named reader is a threshold nobody owns at 03:00; the roll-call format of G1 was extended into every gate for the same reason.
  5. Scheduled the sponsor's exit. Not in the AI's draft and not in anyone's, originally: the protocol line that the sponsor attends G1 and then leaves the floor, receiving the SITREP cadence from Post 19's playbook instead. Written after January proved that the most dangerous thing in a war room is well-intentioned seniority. Idris approved the clause herself, which is the sentence that says the most about month eighteen versus month eight.
The Future Payoff

The night's record becomes the spine of the final two posts. The 84-minute hold, the gate that decided itself, and the R06 eighteen-minute failover are the lead exhibits of the lessons register (Post 21), where the question is which of these behaviors were luck and which were structure. The OBS-1 telemetry window that opened at the certificate runs to mid-October and lands inside the twelve-month value review (Post 22), alongside B04's cost-to-serve trajectory, whose clock started on 1 August when legacy decommissioning began. And the transition certificate itself, one page, four gate signatures, is the document Post 22 will hold up against the business case signed 546 days earlier.

Eighteen months, $14.78M, twenty services, one held breath at 02:03, and a first complaint about the shade of an icon. What remains is the discipline most programs skip: writing down what was learned while it is still true (Post 21), and standing in front of the benefits plan twelve months later to ask whether any of it was worth it (Post 22).

The Takeaway
On the night, you do not rise to the occasion. You fall to your runbook.
Go-live mythology celebrates the heroic save: the 03:00 insight, the engineer who just knew. Falcon's night contained no heroics, and that absence was engineered. The hardest decision, holding half a bank at 50 percent for 84 minutes with a press embargo inbound, was not made at 02:15; it was made on 30 June, when rested people converted a machine's observation about masked failures into one measurable sentence and gave it authority over their future, tired selves. Everything else that worked that night worked for the same reason: the failover was boring because March rehearsed it, the OTP spike died in eighteen minutes because month five named its owners, the embargo moved without drama because month six pre-approved the words. A transition plan is not a schedule with tables. It is the set of decisions you refuse to make at three in the morning, made early, made specific, and signed. The occasion will come either way. Choose what you fall to.

A fictional case study for teaching purposes. Atlas Bank, Project Falcon and all named individuals are invented. Technologies are industry-standard and publicly available.