Zero-Downtime Migrations: A Field Guide

Migrations fail not because of bad planning, but because of bad rollback. Here is our playbook.

Shadow traffic before you flip

Mirror 100% of production traffic to the new stack for 24-48 hours. Diff the responses. Fix divergences.

Dual-write at the data layer

Write to both old and new datastores. Backfill, verify, then read-flip.

Canary at 1%, then 10%, then 50%, then 100%

Hold each stage for one full traffic cycle (usually 24h). Never skip a stage to "save time".

Rollback path = release path

If you cannot describe rollback in 3 sentences, you are not ready to ship.