Category 8 of 10
Data integrity and migrations
Schema changes are reversible, destructive steps are gated, environments are separate.
v1.0 · verified on 2026-09-21
Schema changes are rehearsed on a copy of production data before they run on production.
Migrations are reversible with a tested down path
automated On a staging copy of production data, run the release's migrations up, down and up again.
All three runs complete without error and row counts match before and after.
Destructive changes are gated behind a verified backup
manual For any migration that drops, truncates or rewrites data, confirm a backup taken within 24 hours restores into a scratch database.
The restore completes and a spot check of 10 rows matches production before the change is approved.
Development and production data stores are separate
manual Read the connection configuration for every environment and every tool or agent with database access.
No development, preview or agent environment holds a production connection string.
Cascade deletes are reviewed
manual In staging, delete one parent record of each type and list the rows removed by cascade.
The removed rows match the written deletion policy for that record type.
Concurrent writes on money and inventory paths are safe
automated Fire 20 parallel requests that spend the same balance or claim the same item.
Exactly the allowed number succeed; the stored balance or stock equals the expected value.
Dots: Starter, Growth, Scale. Compare plan limits.
Failure patterns these items catch
- criticalDestructive change without a verified backup
A drop, truncate or rewrite runs against production without a restore having been tested.
- criticalDevelopment and production share a database
Local runs, previews or agent sessions point at the production connection string.
- highMigration with no down path
The schema change cannot be undone, so a rollback of the release means restoring from backup.
- highCascade delete removes more than intended
Deleting a parent record silently removes children the product meant to keep.
- highRace on balance or inventory writes
Two simultaneous requests both read the old value and both succeed, so a balance goes negative or an item sells twice.
Ask which plan runs these items
Email with your team size, cadence and stacks. We reply within 24 hours on business days.