Can you walk back through it?
Give a decision the care it costs to undo. Most doors swing both ways, so most decisions should be fast.
Same team, same week, two doors
The ledger team makes two calls in the week of 9 March. Ask each the same three questions and they come apart.
One-way door
Which database holds the new ledger service?
- Undoing costs
- Moving 40 million ledger entries, dual writes and a reconciliation to the cent. Two engineers for a quarter.
- Who is affected
- Finance, the auditors, and every service that reads a balance.
- We find out
- At the first month-end close under real load, six months away.
Slow on purpose. A one-page decision record, a load test on data shaped like production, and a review from Ana, who ran the last ledger migration. Decided Friday, after three days.
Two-way door
Should ledger_v2_reads start off for everyone, or on for 5% of internal accounts?
- Undoing costs
- One config change, live in two minutes.
- Who is affected
- Forty internal test accounts, all on this team.
- We find out
- By five o’clock, from the error dashboard.
Fast on purpose. Priya picks 5% at standup, posts it in the channel, and it is live by 10:15. If the dashboard goes red, she flips it back.
Two ways to get it wrong
The same team a year earlier, on the payouts service, with the processes swapped.
Two-way door, one-way process
The flag name went to an RFC. Three meetings, eleven comments on naming conventions, eight days. The rollout slipped a week, roughly thirty engineer-hours spent on something reversible in an hour. The name changed again in April anyway.
One-way door, two-way process
The database was picked in a Slack thread on a Tuesday afternoon: “the one we know, let’s just go.” In month four, finance asked for a cross-account balance report it could not answer. The migration took fourteen weeks and froze every feature behind it.
Three questions to sort a door
Ask them before choosing how much process a decision gets, not after.
- What does undoing cost?
- In hours, people and data. Minutes is a two-way door. A quarter is not.
- Who is affected?
- Your team only, or customers, finance and other services that build on it.
- How long until we know?
- If the answer arrives today, try it. If it arrives in six months, think now.
Doors close behind you
The flag stayed two-way for eleven days. On day twelve the v2 path began writing entries the old reader could not parse, and switching it off would have stranded them. Nobody decided to lock that door. Ask the three questions again once data or customers start to depend on a choice.
Spend the week on the door that locks behind you, and the afternoon on every other one.