{
  "status": "proposed",
  "context": "A fictional SaaS application needs controlled tenant relocation between independently deployed cells.",
  "decision": "Stable tenant directory plus separately enforced authorization and write ownership.",
  "directory_fields": [
    "tenant_id",
    "active_cell",
    "epoch",
    "state"
  ],
  "invariant": "At most one location may accept authoritative mutations for a tenant at a time.",
  "cutover": [
    "Block new source writes",
    "Drain accepted source writes",
    "Capture final source position",
    "Transfer and verify final changes",
    "Grant destination next epoch while source remains fenced",
    "Activate directory entry"
  ],
  "rollback_boundary": "After destination accepts writes, reconcile data and perform a new ownership transition before returning.",
  "open_questions": [
    "Which storage operation atomically checks ownership with mutation?",
    "Who can authorize an abort?",
    "Which dependencies remain shared?",
    "What write pause is acceptable?"
  ],
  "reversal_conditions": [
    "Uninterrupted writes during relocation",
    "Concurrent writes across regions",
    "Cell failures coupled by shared dependencies"
  ]
}