The migration command room was quieter than any investor meeting.
No cameras.
No market crowd.
Only dashboards, rollback clocks and people who knew that one careless shortcut could make customers wake up to the wrong balances.
Kamau split migration into cohorts.
“Clean identities first. High-risk forty-three remain excluded.”
Aisha required an independent checksum after every cohort rather than one grand check at the end.
“We will lose time,” an engineer said.
“Then use the rollback window we planned.”
The first cohort passed at 11:10 p.m.
The second passed after midnight.
At 12:47, a dormant-wallet cohort showed a small reconciliation difference above tolerance.
“Probably old fee rounding,” someone said.
“Pause the cohort.”
The problem turned out to be exactly that: a boring legacy fee conversion, unrelated to the manipulation case.
They fixed it, reran the checksum and continued.
At 1:52 the first settlement under the new architecture began.
Normal treasury reserve journals appeared, but the reporting layer did not classify them as customer repayments.
“Repayment rate is lower,” Njeri said.
“Expected,” Wekesa replied.
Real customer payments posted with customer-action sources.
A recycled-number test triggered human review instead of inheriting the old identity.
At 2:13, Aisha found herself watching the clock.
No ghost repayment appeared.
Then the system flagged one of the forty-three: duplicate estate claim plus active new-subscriber number.
“Hold remains,” Wekesa said.
“Good.”
The board wanted a success notice at four.
Kamau wanted to run the final cohort while two manual cases remained.
“Are they independent?” Aisha asked.
“Technically, the last cohort is clean.”
“Does the final summary checksum include unresolved identity exceptions?”
Kamau paused.
“Yes.”
“Then we wait.”
The pressure looked different from the acquisition snapshot, but the temptation was the same: declare green, repair later.
Aisha asked the board liaison to put any instruction on the change ticket. The liaison wrote that the success notice could be delayed until verification completed.
Pressure became an accountable decision instead of a phone call.
Manual reviewers used the same checklist for each high-risk account: closure reason, current subscriber status, debt or refund state and supporting identity record. Deceased cases received two reviewers.
Case forty-two cleared.
Case forty-three was Mama Atieno's old refund path. Ruth confirmed the verified estate destination through the established channel.
At 4:26, the final exception closed.
The last cohort ran.
Checksum matched.
Agent float matched.
Reserve disclosure matched.
Repayment sources matched.
No recycled number inherited historical debt.
Aisha asked five questions before giving go: checksum, unresolved high-risk cases, rollback readiness, agent-float match and reporting-source classification.
All five were green.
At 5:10 the first full settlement closed.
Support began receiving questions about the new customer ID printed on receipts. Instead of calling those users errors, the team logged the confusion as usability feedback and added clearer help text.
One agent called because a reserved amount looked large. Finance confirmed it was legitimate facility recovery with a visible release schedule.
Transparency did not make every reserve wrong.
It made the reason visible.
Before Aisha left, monitoring ownership passed to a fresh shift. The next operator repeated the thresholds and rollback criteria aloud.
A reform that worked only while Aisha was in the room was not a reform.
During monitoring, an agent called because a legitimate reserve facility now appeared more visibly than before and looked alarming. Finance explained the amount and release schedule through the new portal fields. That call became an important counterexample: transparency did not mean every reserve was misconduct. It meant the agent could see what portion was unavailable and why. Aisha logged the interaction as usability feedback rather than a control failure. The new architecture was doing something the old system had avoided—allowing people at the edge of the network to distinguish an ordinary restriction from an unexplained one.
The cutover team kept the old system in read-only fallback throughout the monitoring window. No one could post new transactions there, but reviewers could compare historical balances if the new mapping looked wrong. When the final checksum matched, Kamau did not immediately delete the fallback snapshot. Retention and destruction dates were recorded in the change plan. Aisha wanted rollback readiness without creating a permanent shadow database. The same discipline applied everywhere: preserve what is needed long enough to verify the transition, then stop keeping copies simply because storage makes forgetting easy.
The first clean settlement closed without a single ghost repayment.