COBOL → Rust Migration:
27x Throughput · 847ms → 34ms · Zero Downtime

Q2 close in 8 weeks. $400M in daily payment batches. Same-day ACH deadline missed last quarter. The board asked for a downtime window. There wasn't one.

The Problem Class

A COBOL batch payment core accumulating 40+ years of sediment: undocumented PERFORM THRU chains, implicit REDEFINES overlaps, and PIC V9 arithmetic boundary conditions that no living developer had full mental model of. P50 latency at 847ms meant real-time settlement was impossible. Throughput ceilings were blocking regulatory deadlines on same-day ACH.

Standard modernization playbooks said: plan a blackout window, run parallel systems for 6 months, accept 12-18 months of risk. The client had neither the runway nor the appetite for a dual-stack burn rate. The only viable path was zero-downtime strangler-fig migration, validated by deterministic replay at every stage gate.

The Replay Architecture

Before touching a single line, every COBOL batch was instrumented to emit a deterministic replay log: input record, intermediate computed values, output record, and a SHA-256 chain-of-custody across the batch run. The Rust implementation was required to produce byte-identical output for every historical replay artifact. Behavioral equivalence was binary, not "close enough."

Every COBOL module was replaced independently. Each replacement required 100% replay equivalence before the traffic-splitting proxy routed live volume to the Rust path. No module went live without its replay gate cleared.

The COBOL Surface Area

Three failure classes required explicit engineering, not just rewrite:

• PICTURE clause arithmetic — Every PIC V9 declaration re-derived in Rust using checked_add/checked_mul with explicit overflow guards. No silent truncation path exists in the Rust implementation.
• REDEFINES memory overlap — COBOL REDEFINES clauses share memory regions across incompatible types. Each overlap was mapped, documented, and replaced with Rust enum variants with explicit discriminants.
• PERFORM THRU control flow — Implicit fall-through PERFORM chains translated to explicit Rust state machines. Every execution path enumerated and tested against replay artifacts.

Performance Profile

The latency improvement was not the goal — it was the consequence of eliminating COBOL's sequential batch I/O model. Rust's async I/O, zero-copy record parsing, and SIMD-accelerated numeric operations collapsed P50 from 847ms to 34ms. Throughput improvement of 27× emerged from the same architectural change: Rust's ownership model made safe parallelism tractable without the data-race surface area that would have made COBOL parallel processing impossible.

What Made It Zero-Downtime

The traffic-splitting proxy maintained three states per module: COBOL-only, shadow (COBOL live + Rust shadow with diff logging), and Rust-only. No module moved from shadow to Rust-only until 30 days of zero diffs in the shadow log. The migration ran for 18 months. The cutover event never happened — because there was no single moment to cut over from.

The last COBOL module went dark on a Tuesday at 2:47 PM. No alert fired. No page went out. No one in the call center knew. That was the proof of done.

Audit Artifacts

The project produced three audit deliverables: a pre-migration COBOL arithmetic surface-area report (filed with internal model risk), a post-migration behavioral equivalence attestation (signed, SHA-256-anchored replay artifacts), and an 18-month operational performance report against the client's model-risk performance thresholds. All three remain available for review on demand.