Breaking schema changes need expand-contract discipline: add nullable columns, backfill in a worker, switch reads, then drop old fields. Skipping a step causes the 2 a.m. pages we all want to avoid.
Shadow databases catch drift early — but only if your CI runs `prisma migrate diff` on every PR. We treat failed migration checks as merge blockers.
Long-running backfills run in idempotent workers with progress metrics — never inside the migration transaction itself.
Every repo includes a rollback SQL snippet for the last three migrations. We have used it twice this year. Both times it saved a weekend.
Teach the expand-contract sequence in onboarding so junior engineers do not reach for destructive shortcuts under deadline pressure.
