TSB post-incident file, as promised, because it deserves the full autopsy treatment: the bank migrated 5.4 million customers off its former parent’s platform in one weekend cutover (years of dual-running deemed too expensive) and the new platform buckled on contact with Monday. Two weeks on: intermittent lockouts continue, fraudsters are feasting on the confusion (phishing loves an outage, since customers expect weird bank emails during one), the CEO is before Parliament, and the eventual independent review will be read aloud in this industry for a decade. Preliminary lessons, all archive reruns performed at national scale: big-bang cutovers are a choice to discover all failure modes simultaneously; rollback plans that can’t actually be executed are theater; and “the test environment worked” is the epitaph on every migration tombstone. Banking is now a distributed-systems discipline with a marble lobby. Regulators noticed. “Operational resilience” is about to become a compliance term. Mark it.
The lighter ledger: Avengers Infinity War opened to the biggest box office ever and ended with half the universe dissolving via finger-snap, the boldest to-be-continued in franchise history, and the office’s spoiler-embargo protocol (48 hours, honor system, one violation, one consequence involving the offender’s keyboard and packing peanuts) held. And the Champions League semi-finals have delivered a second leg for the ages (Real Madrid holding off Bayern), with Liverpool, who haven’t reached the final in 11 years, simultaneously storming the European stage under Klopp, breaking football’s entire expected-suffering model.
TIL: dual-running cost vs. cutover risk is the migration trade, and it’s priced wrong industry-wide because dual-running costs appear on this quarter’s budget while cutover risk appears on some future incident commander’s pager. Time-shifted accountability: the root cause under the root causes.