Request: writing a migration that can be rolled back

## What situation should this cover? Writing a database migration that will run against production data. ## What goes wrong without it? Irreversible schema changes taken during an incident, migrations that lock a large table and cause an outage, and deploys where old and new application code cannot both run against the same schema. ## Who would know this? Anyone who has done a zero-downtime deploy. Should cover: expand-then-contract, why a destructive change must be a separate later deploy, backfilling in batches, and testing the down migration rather than assuming it works.