Cut a 40-year-old core banking system over to a modern distributed ledger — without a single minute of downtime.

Northmark's core banking platform — a mainframe-era COBOL ledger with a complex mesh of middleware accreted over four decades — was approaching a regulatory inflection point. New open-banking mandates required sub-second settlement visibility that the existing system could not provide without fundamental re-architecture.

The bank had attempted two prior modernization programs. Both stalled on the same problem: the core could not be taken offline, not even for a single batch window, without cascading effects across branch operations, partner integrations, and real-time payment rails.

When we joined, the initial directive was narrow: design a migration strategy. Three months in, the engagement expanded to end-to-end delivery.

Rather than a flag-day cutover, we proposed a dual-ledger architecture: the legacy COBOL core and a new event-sourced ledger running side-by-side, mediated by a dual-write bridge that treated both as authoritative, reconciled per-transaction, and allowed reads to be progressively routed to the new system as confidence accrued.

The bridge itself became the engineering centerpiece. Written in Rust for its latency budget, it maintained a per-account vector clock, detected divergence within 50ms, and could roll back or replay either side with an operator-level audit trail. We ran it in shadow mode for four months before a single customer byte touched the new ledger.

No hero deployments. No late-night cowboy runs. We instrumented divergence, ran property-based tests against production traffic shadows, and held a weekly migration review where any of the 42 engineers on the squad could veto the next weekend's cutover slice.

Seven slices were vetoed. Three were rolled back mid-weekend. All without customer impact. That's the system working.