Database Migrations Without Panic

Expand, migrate, contract. Add the new shape first, dual-write when needed, backfill with observability, then remove the old path only after readers have moved. This pattern keeps deploys reversible.

Practical takeaway

Make the next action explicit: define the contract, test the unhappy path, add the smallest useful measurement, and document the tradeoff that future maintainers will need.