Forward Only

The Rollback Path Everyone Keeps

Every migration plan has a rollback section, and on cutover day Soul Vault had one too. The pilot log records Dad's terms for the move, and one of them was that moving it back is Dad's hand only. The old folder implementation was still installed, still selectable by the pointer, and the old notes were untouched. If the new store had misbehaved in the first hours, one pointer edit would have sent every reader back.

By 17:12 KST the same day, the new store had carried the vault for three and a half hours, writes had landed from several Macs, and the question changed from "can we go back?" to "what does keeping the way back cost?" Dad's answer (Coop todo 1110-40) was a rule: forward only. Only Delta may be selected. Problems are fixed in place.

What a Kept Rollback Costs

A rollback path is not free to keep. It is a second implementation that must stay installed on every Mac, a second set of tests that must stay green, and a second store that stops receiving writes the moment you move forward. That last cost is the subtle one. The longer you run on the new store, the more the old one is a snapshot of the past. Rolling back to it after a day is not undoing a change; it is throwing away a day of memory and calling it safety.

It also hides problems, by the same logic as a fallback. If the escape hatch is one edit away, the natural response to a bug in the new store is to flip back and investigate later. With no hatch, the bug is fixed where it lives, today.

What Forward Only Did

A retired backend named anywhere, as backend or as a read-rollout selection, fails with backend_not_available before anything is opened. Even code that constructs a pointer object by hand cannot select it.
The retired implementation's modules and its Delta share were removed from the codebase. The common contract suite now runs against Delta alone; tests that were only about the removed implementation were retired, and everything they protected that still matters (pointer rejection, bootstrap, history, quarantine) stays covered against Delta.
Contract v6 removed the retired implementation's examples from the root's comments. No rule changed.
Pointer generation 5 removed the retired implementation's metadata from the record, with backend, store, rollout and gate unchanged.

What Forward Only Did Not Do

Forward only is about what may be selected, not about destroying evidence. Dad's old soul folders stay where they were, as his data. Soul Vault's installer refuses to move or delete them, and the store's first commit preserved every note byte for byte (481 notes, every hash matching), so nothing in the old tree is the only copy of anything. The original cutover receipts stay in the repository's pilot log and an archived review as history, explicitly "never instructions for a current backend".

That pairing is the pattern worth keeping: retire the path aggressively, keep the evidence carefully. The way back is closed; the record of how you came is not.

Code

What a Mac with an old record sees after forward-only (illustrative)·text

$ soul-vault bootstrap --harness codex
identity not loaded: backend_not_available: <path>: backend '<retired>' is retired or unavailable;
Soul Vault is forward only on Delta. Problems are fixed in place; no retired tree is served

STOP. The soul vault did not load for codex. ...

# the fix is in place, not around: pull cwkFirelink so the record is current

Retire the path, keep the evidence·text

removed                                    kept
-----------------------------------------  -------------------------------------------
retired implementation modules             Dad's old soul folders, untouched (his data)
its Delta share                            the first-import commit, 481 notes, hashes equal
retired-only tests                         pointer / bootstrap / history / quarantine tests
retired examples in root comments (v6)     the pilot log and archived cutover review
retired metadata in the pointer (gen 5)    git history of every pointer generation

Exercise

For a migration you have done or are planning, write the rollback section with an expiry: the condition under which the way back is closed, who decides, and what is removed at that moment (code, tests, config entries). Then write the evidence section: what is kept untouched and where, so that closing the way back destroys nothing anyone might need to read later.

Hint

A useful expiry condition is the first write the old store will never see. From that moment, rolling back is no longer undoing the migration; it is losing data.