BLUE/GREEN · CUTOVER AND ROLLBACK
Agent release: blue/green and rollback
Switch a streaming agent from blue to green, then roll back when green fails, and count dropped streams, lost sessions and rollback time.
Your experiment
Blue has three streaming conversations in flight needing 20 s, 45 s and 90 s more. Four minutes after the switch, green’s tool adapter starts failing and the release is rolled back. Start with a hard cut, a cold blue and a v2-only session format.
Play replays the computed run over sixty inspection seconds; Next event steps, Restart rewinds, Speed changes the pace and Inspection time scrubs. Any input change recomputes the run and rewinds it without autoplay.
Event trace
Computed data
Final metrics
Deterministic model: green fails about 30 requests per minute until traffic returns to blue; a warm blue takes 1 minute to restore and a cold one 6 minutes; a drained stream either finishes within the timeout or is dropped when it ends. Clients that can resume a stream elsewhere are not modelled. No deployment platform is used.
Cutover drops what is in flight
Blue (v1) is serving three streaming conversations that need 20 s, 45 s and 90 s more when the router switches to green (v2). With the opening Hard cut, all three are dropped. Set Cutover of in-flight streams to Drain blue before shutdown: with the default 60 s drain the 20 s and 45 s streams finish on blue and the 90 s one is dropped when the drain ends. A 120 s drain lets all three finish, and a 0 s drain is a hard cut by another name. Drain timeout applies only when draining.
Rollback needs somewhere to go
Four minutes after the switch, green’s tool adapter starts failing and the release gate orders a rollback. In the opening run blue was scaled to zero after the cutover, so it cold-starts and warms caches for 6 minutes while green fails about 30 requests a minute: 180 failed requests. Check Keep blue warm until green is proven and traffic returns in 1 minute with about 30 failures. Blue/green only gives an instant rollback while blue still exists.
Sessions written by green
Green writes 25 sessions before the rollback. With a v2-only format blue cannot read them and those users start over: SESSIONS LOST even after a perfect drain and a warm blue. Set Session format green writes to Format v1 can read, adding fields that v1 ignores, and the rollback keeps all 25. The rule is that each version must read what the other writes for as long as a switch back is possible.
The clean path
With a 120 s drain, a warm blue and the compatible format, nothing is dropped or lost and the rollback takes 1 minute: CLEAN SWITCH AND ROLLBACK. Remove any one of the three and a different failure appears, which is why the result names the first problem in the order streams, sessions, rollback time while the metrics list all three.
Reading the run and its limits
Play, Next event, Restart, Speed and Inspection time step through each stream at cutover, the failure, the rollback, the session check and the impact across sixty seconds; the table lists each item’s outcome. Streams cannot resume elsewhere in this model, the failure rate is constant and restore times are fixed. Real deployments also need two-way compatible tool contracts, caches and memory stores, not just session formats.