R2.3 · Keep the legacy route alive behind a written cutover gate

Theme	R2 · Resilience and capacity
Domain	Infrastructure and integration
Status	Proposed
Needs client validation	Yes
Anchored in	Assessment finding D-01 · the readiness review — Unleash provisioning in backlog, gate plan G1–G5
Open questions	Takes a position on 22; depends on 25
Deliverables	D2.1 · D3.1

Concern

Every other control in this theme covers a failure of a dependency. Nothing covers a failure of the new surface itself.

D-01 records that the fallback does not exist. There is no bypass route, no static degraded-mode page, no classic-view toggle and no documented rollback to the legacy page. After cutover the dashboard is the only post-login route to every BU portal, so a defect in the dashboard is an outage of all Canadian digital servicing — including for customers whose own business unit is healthy.

The flag system named for this is not available. Unleash appears in the ADS for rollout rather than for continuity, and the readiness review records its provisioning still in backlog. A continuity control that depends on an unprovisioned platform is a plan, not a control.

A transition plan without the trigger is not a transition plan. The implementation roadmap makes the point in its own words: a transition plan that does not specify the bypass route, how it is triggered and who can trigger it is not one. Today the bypass is argued for in prose and specified nowhere.

Recommendation

Keep the legacy Product Selection route alive behind a flag, and write the gate that retires it.

This is the cheapest control in the theme and the only one that covers total failure of the new surface. It is also the one most likely to be traded away under schedule pressure, which is why it carries its own page rather than sitting inside the degradation contract.

Specify the trigger, not just the route. What condition fires the bypass, whether it is automatic or manual, who is authorised to fire it at 02:00, and how long the switch takes to take effect. A bypass nobody is authorised to use during an incident is decorative.

Retire it against a written gate, not a date. The gate names what has to be true: the DR drill passed, the degradation contract of R2.1 tested against the published budget of R2.2, and a stated observation period at production volume. The readiness review's own G1–G5 gate plan is the natural place to hang it.

Name the cost of keeping it. The legacy route has to keep working, which means it stays in regression scope and inherits the identity changes of R1.1. That cost is small and it is not zero, and stating it is what stops the bypass being quietly dropped as free.

What it changes

It gives open question 22 an answer with a shape. The question asks whether the legacy page survives and for how long. "Until the gate passes" is answerable, auditable and does not require anyone to predict a date.

It converts a rollback assumption into a tested path. The architecture decision deck proposes a rollback SLO under five minutes. That number only means something if the route it rolls back to is live and exercised.

It puts a control on the critical path that has an owner. The offsite register names the programme sponsor as the owner of this decision — one of the few items in the theme with an owner already named, which is why it is the easiest of the four to close.

What we are not recommending

Retiring the legacy route at cutover. It is the only control covering a failure of the new surface, and it costs almost nothing to keep for a defined period.

Keeping it indefinitely. Two post-login routes is a permanent tax on every downstream change and a second surface for the identity work to cover. The gate exists so the bypass ends.

Building a new static degraded-mode page instead. The legacy Product Selection page already works, is already tested and already routes to every BU portal. Building a replacement for it is the expensive way to get less.

Depending on Unleash specifically. The recommendation is that a continuity switch exists and is exercisable. Which flag platform carries it is an implementation choice, and one that should not block the control on a backlog item.

Dependencies and open questions

• Open question 22 — whether the legacy Product Selection page survives as a bypass, and for how long. This page is the argument for yes, gated rather than dated.
• Open question 25 — environment provisioning. The gate requires a DR drill and a tested degradation contract, and neither is possible without environments.
• A named authority for firing the bypass during an incident, which is adjacent to the unowned shared runtime recorded at open question 14.