TSB post-incident file, as promised (#129), because it deserves the full autopsy treatment: the bank migrated 5.4 million customers off its former parent’s platform in ONE weekend cutover — years of dual-running deemed too expensive — and the new platform buckled on contact with Monday. Two weeks on: intermittent lockouts continue, fraudsters are feasting on the confusion (phishing loves an outage — customers EXPECT weird bank emails during one), the CEO is before Parliament, and the eventual independent review will be read aloud in this industry for a decade. Preliminary lessons, all archive reruns performed at national scale: big-bang cutovers are a choice to discover all failure modes simultaneously (#019); rollback plans that can’t actually be executed are theater (#099’s one-way doors); and “the test environment worked” is the epitaph on every migration tombstone. Banking is now a distributed-systems discipline with a marble lobby. Regulators noticed. “Operational resilience” is about to become a compliance term — mark it.
The lighter ledger: Avengers Infinity War opened to the biggest box office ever and ended with half the universe dissolving via finger-snap — the boldest to-be-continued in franchise history, and the office’s spoiler-embargo protocol (48 hours, honor system, one violation, one consequence involving the offender’s keyboard and packing peanuts) HELD. And the Champions League semi-finals have delivered a second leg for the ages (Real Madrid holding off Bayern!), with Liverpool — who haven’t reached the final in 11 years — simultaneously storming the European stage under Klopp, breaking football’s entire expected-suffering model.
TIL: dual-running cost vs. cutover risk is THE migration trade, and it’s priced wrong industry-wide because dual-running costs appear on THIS quarter’s budget while cutover risk appears on some future incident commander’s pager. Time-shifted accountability: the root cause under the root causes.