Migrate from Rork with a cutover you can prove, not hope for

Not every Rork project needs a full export-and-import, but you must establish what the destination owns and how an existing user is recognized. We classify records as authoritative, derived, or disposable; then choose an API backfill, database transfer, or compatibility lookup. Password hashes, social-provider subjects, sessions, and consent history deserve separate treatment—never assume a user ID alone is enough.

Create destination environments before changing DNS, and keep old and new configuration names in a sealed mapping rather than scattering values through code. Lower DNS TTL ahead of the window, verify certificates and webhook signatures, then rotate secrets after the destination proves it can receive traffic. We schedule domain ownership, mobile deep links, email sending, and third-party callbacks as one dependency graph.

A rollback is a rehearsed route back to the last known-good write authority, not a promise to restore a database snapshot later. Freeze schema changes, record the cutover cursor, preserve destination writes for reconciliation, and define how accounts created during the window are handled. We time-box reversal and name the decision-maker so uncertainty does not create split-brain data.

Use a fixture set that includes an old account, a new account, edge permissions, empty states, attachments, failed payments, and interrupted jobs. Replay key actions against both systems, compare visible outcomes and emitted side effects, and have an operator inspect diffs. The kill-switch comes only after monitoring stays quiet through a representative traffic rehearsal and support knows the new failure modes.