A hot table needs a column renamed and retyped, across many running instances. What constraint dictates the whole sequence?

What is being tested

Whether you can derive the expand-and-contract sequence from first principles rather than reciting it.

The constraint

At no point can you assume all instances run the same code. During any rollout, old and new coexist for minutes — and with mobile or partner clients, for months or years.

Therefore every intermediate state must be readable and writable by both versions. That single constraint produces the entire sequence.

The sequence

1. Add the new column — nullable, no default requiring a table rewrite. Nothing reads it. Rollback: drop it.
2. Dual-write — write both, read only the old. Rollback: revert the code; the old column is still complete.
3. Backfill in batches, rate-limited, resumable from a cursor, in chunks short enough not to hold locks.
4. Verify — compare old and new over a sample, ideally all rows, including rows written during the backfill. This is what catches the type conversion that silently truncated something.
5. Read from new behind a flag, small percentage first, comparing results. Rollback is a flag flip.
6. Read from new everywhere. Still dual-writing; rollback still a flag flip.
7. Stop writing the old column. The first genuinely one-way door.
8. Drop the old column, after a soak measured in weeks.

What people get wrong

Combining steps 2 and 5 — deploying dual-write and new-read together — so a rollback mid-rollout leaves rows written only to the new column and invisible to the old code.

Forgetting the other writers: batch jobs, admin tools, data pipelines, the analytics extract. Every one needs the same treatment.

Backfilling in one statement, locking the table for the duration.

Dropping the old column the same week. The rollback you need is always the one you already discarded.

The general principle

An additive change is reversible; a destructive change is not. Sequence so that every irreversible step happens last, alone, after verification — and so the number of irreversible steps is as small as you can make it.