Staff-level platform architecture: validate and carry forward

1. Why can an eventual event consumer not decide whether a cutover is allowed? It may act on stale policy or a stale generation. A cutover needs the authoritative current value through a CAS and a current eligibility check; events suit ingestion and usage aggregation.
2. The top-scoring option breaks a residency rule. What happens to its score? Nothing; the option is removed before ranking. A score cannot buy back a hard constraint.
3. What must a one-page ADR contain, and what changes for a non-technical reader? Context, options, decision, consequences, reversal criteria, and evidence marked measured, assumed or proposed. For a data protection officer, lead with what stays where and what they must approve; keep the same facts.
4. A pilot canary degrades and nobody rolls back for 40 minutes. What shows the ownership gap, and what fixes it? An incident with no commander and a rollback request with no approver. Name the release owner as the pilot's single rollback decider in the runbook.
5. At the baseline inputs, what does each overlap month do to break-even? It adds three months: one month of delay, plus $8,000 of extra cost that takes two months of $4,000 savings to repay.
6. An approval is revoked after the control plane signs generation N+1 but before a cell pulls it. What happens? The cell's current eligibility check in its own authority store rejects N+1 and keeps N. A signature proves origin, not present permission.

60-second card: start from the incident; preserve runtime guarantees; choose versioned contracts and cells; keep route authority and the eligibility check in each cell, and sign opaque generations centrally; freeze changes, not service, on control-plane loss; roll back with a newer generation; veto on hard constraints before scoring; bind shadow evidence to its baseline; pilot with one writer; recheck rollback eligibility; count migration, overlap and support; name owners and revisit triggers.

Exit gates for this stage:

1. Explain. Give the Interview 5 whole-platform defence in about a minute without notes.
2. Draw. From memory, draw the after architecture with the cell route authority, the signed-generation flow and the control-plane outage path.
3. Defend. Write the decision-exercise ADR and memo section and pass its rubric. Then compute by hand the break-even for 900 migration hours, 80 shared hours a month and a four-month overlap, and check it in the lab (month 46; $30,000 more than staying independent over 36 months).
4. Diagnose. For "cutover rejected: stale evidence" and for "a cell's applied generation trails the published one past the staleness bound", name the cause, the safe action and the owner.
5. Build (build depth). Add retire(tenant, app, generation, window_ended, actor, reason) to labs/migration.py. It succeeds only when generation is current, the latest history row is the cutover that created it, and window_ended is true (the caller's evidence that one reversal window passed with no old-path traffic). In one transaction it raises the generation by one, keeps the route, clears previous so no route rollback remains, and appends a retire history row. Expected: after a cutover to generation 1 and an ended window, the route is unchanged at generation 2 with no previous route; with the window still open it raises and changes nothing; after a rollback it raises, because the latest row is a rollback. Write those three tests. Then run the fault-injection and lost-acknowledgement tests and explain the persisted state in each.

Review schedule: on day 1, redo Checkpoints 2 and 3 and the recall list without notes. On day 7, rewrite the ADR for a different changed constraint, such as double support demand, and rescore it. On day 21, run the full capstone, solo path if needed, and give Interview 5 aloud. These learner gates remain unassessed.

Read the architecture snapshot, decisions ADR-012 and ADR-013. Local content verification and learner completion are separate. This is the final stage. The next action is the capstone defence and an evidence-led pilot, not another module. Production integrations and deployment controls described here are proposals unless the validation report records an executed check.

• An eventual event consumer cannot decide a cutover because it may act on stale policy or a stale generation. Cutover needs the current authoritative value through a CAS and an eligibility check.
• If an approval is revoked after the control plane signs N+1 but before a cell pulls it, the cell's eligibility check rejects N+1 and keeps N.
• At the baseline inputs each overlap month adds three months to break-even. That is one month of delay plus $8,000 of extra cost that takes two months of $4,000 savings to repay.
• A one-page ADR holds context, options, decision, consequences, reversal criteria and evidence marked measured, assumed or proposed. For a data protection officer, lead with what stays where and keep the same facts.