OrbitTv/docs/cutover-plan.md

Coordinated cutover: the exact plan

This is a proposal from 4 November 2026. Nothing here has been done. The cutover runs only on Paul's explicit approval of this plan.

Aim

Launch the finished, curated Orbit network everywhere at once, instead of letting each channel's old committed week run out until about 10 November. The cutover rewrites, once, every scheduled channel's bookings that haven't started yet. After that, the normal rule returns: committed bookings are never rewritten.

What it does, per channel

At the cutover moment T, for all 30 scheduled channels:

1. Keep everything that has started by T, including the programme on air. Nothing playing is interrupted.
2. Drop the bookings that haven't started. They never aired, so they don't count. Each channel's place, meaning its episode positions, shuffle-deck positions and which films it has shown, is rebuilt from what has actually gone out: its saved aired cursor, brought up to T with the kept programmes. It isn't taken from the old plan's tail, which had already moved past the unaired bookings.
   • Weighted tallies start level, because the old ones counted bookings that never aired.
   • Run-restart times and each block's last show are rebuilt from the kept programmes.
3. Rebook seven days from the end of the programme on air, with today's rules. All channels are cut back first, then rebooked in turn, each avoiding every other channel, so nothing avoids a booking that's about to disappear.

Not touched: the Drive-In's plan and tickets, suggestion choices, failed-file records, episode pools, settings and playback notes.

Impact (simulation on box copies from 4 November 10:05)

Full table: docs/replays/cutover-simulation-2026-11-04.md (CutoverSimulationTest). The simulation used T = 4 November 13:00.

• Programmes kept: 1,356 that had started by T, including the programme on air on every channel.
• Unaired bookings dropped: 7,378, across all 30 channels.
• New bookings: 8,613, to 11 November. No gaps at any seam, and no clashes between channels.
• Places corrected: 509 shows across the series channels had an old plan tail that had moved past episodes that were only booked, not aired. After the cutover each resumes from what actually aired; Vortex alone has 81. Film channels rest from actual showings.
• What arrives straight away:
  • Presentation keys: 282 new bookings carry one, so special idents start at once. Riot's blocks, After Dark's nights, Horror's Slasher Saturday, Gold's Sunday, Three's Scottish night, Ring X's nights and the rest no longer wait until 10 November.
  • Events the old committed week didn't have: the first PPV Sunday (8 November 19:08, WrestleMania III) and Joe Bob Saturday on After Dark (7 November 21:19).

Procedure

Each step happens only after Paul's approval, at a time when nothing is being watched.

1. Prerequisites:
   • The release with every approved change is installed. Today that would be 0.99.8, plus any of the audit findings Paul approves first.
   • The simulation is re-run on fresh copies, and Paul approves the exact time.
2. Stop Orbit (am force-stop), so no top-up runs during the change.
3. Full snapshot, three ways:
   • The whole no_backup/schedule folder, every file including the .prev copies, copied to this machine.
   • The same folder copied on the box to no_backup/schedule-rollback-<time>.
   • A SHA-256 manifest of every file.
4. Prove the rollback before any change. Restore the box copy over the live folder and check that every file's SHA-256 matches the manifest. This rehearses exactly the restore that rollback uses, on identical bytes.
5. Compute the new plan and progress files on this machine from that exact snapshot, with T taken at that moment: 60 files, the schedule and progress for 30 channels.
6. Write them to the box (adb push, then run-as cp into no_backup/schedule) and check every file's SHA-256 on the box against this machine. The .prev copies keep the old plans. If a new file were ever unreadable, the app falls back to the old plan rather than nothing.
7. Start Orbit and verify:
   • Every channel loads its new plan with added=0 and clashes=0, and there's no crash.
   • Each channel's first new programme starts as its on-air programme ends.
   • Cursors match the simulation.
   • Playback and idents work.
8. Record installation separately from on-air checks. The never-rewrite rule then applies again.

Rollback

At any time after the cutover:

1. Stop Orbit.
2. Copy no_backup/schedule-rollback-<time> back over no_backup/schedule, and check the manifest.
3. Start Orbit.

The box then has exactly its pre-cutover schedules. The programmes that aired in between are simply re-recorded at the next top-up. The rollback copy is kept on the box until Paul says it can go.

Questions for Paul

1. Should the audit findings be fixed first, so the cutover launches them too? Those are the film-channel events as appointments and the catalogue hybrid on ToonZ, Tots, Odyssey and Three. Option C needs your title approval too, if you want it in.
2. Do you approve this procedure? If so, pick a time when nothing is being watched.