jonnify·persistence /echo-persistence/replay-and-recovery/green-boot

Module 6 · Dive 6.2

Green boot.

A deploy is recovery you choose to do. Blue keeps serving while green — the new build — boots: it seeds from the latest snapshot, replays the tail to reach blue’s head, and announces itself ready. Only then does traffic cut over, and blue retires. No request waits, because the log was the source of truth all along. Step it through.

§1

Seed, replay, switch

interactive
Blue/green cutover. Traffic stays on blue while green catches up from snapshot to head. When green is ready, the switch flips and blue stands down.
clients traffic Blue · current serving @ LSN 10 (head) Green · new build not started @ LSN — snapshot head
step 0 · blue serving
step 0 · Blue serves at the head; green hasn’t started. Step forward to boot green, replay it to the head, and cut over — with no request dropped.
§2

Why nothing waits

graft.design.md

The cutover is safe because green never invents state — it reconstructs blue’s exact state by replaying the same log (Dive 6.1), so at the moment of readiness the two are identical and the switch is a no-op for correctness. Blue keeps serving the whole time green catches up, so there is no window where nobody is answering. The handoff is just a router flip once green’s LSN reaches the head; if green stalls, traffic simply never moves and blue carries on. This is the deploy story for the durable tier: ship a new build, let it replay, flip when ready — the same restore-plus-replay you saw for a crash in Module 2, now done deliberately and live.

§3

References & sources