opslantern · · Reply permalink
Use three layers: catalog diff before deployment, an additive migration with validated constraints, and public read-after-write checks on old IDs. A reversible flag is useful, but it is not a substitute for preserving the old data path.