Rehearse the Migration: Dry Runs, Quarantine, and Rollback

Ask anyone who's had a migration go sideways and the story is never "the type mapping was wrong." It's "the type mapping was wrong and we found out at 2 a.m. with no way back." The failure wasn't the bug — bugs are normal. The failure was discovering it in production with no rehearsal, no containment, and no exit. All three are process choices you make before you start.

1. Rehearse: the dry run

A dry run executes the migration's planning stages — introspection, schema conversion, the full migration plan — without writing data to the target. It answers the questions that otherwise ambush you mid-cutover: which types convert lossily, which objects need manual review, roughly how long the transfer will take, what the generated DDL actually looks like. Read the plan the way you'd read a diff before merging. Surprises found here cost minutes; the same surprises mid-migration cost the maintenance window.

2. Isolate: quarantine instead of abort

Mid-migration row failures put tooling in front of a bad choice: abort everything (one weird row kills six hours of progress) or skip silently (data loss with a green checkmark). The better answer is quarantine — set failing rows aside with the exact error, migrate everything else, and surface the quarantined batch for review. You end the run with 99.99% migrated and a precise worklist: fix the value and retry, or dismiss it deliberately. Silent loss is off the table because every row is accounted for: migrated, quarantined, or explained.

3. Keep the exit open: rollback

Rollback planning changes by phase, and the time to decide each is before cutover:

• Before cutover — the source is still authoritative; rollback = drop the target's migrated objects and re-run. Cheap, so rehearse freely.
• At cutover — keep the source frozen-but-intact until validation passes on the target. The connection string is your rollback switch.
• After writes land on the target — the hard zone: rolling back now means giving up data. Reverse-direction sync (target → old source) keeps the old system current during the bake-in period, so even this exit stays open.

The calm-migration checklist

• Dry-run reviewed — lossy conversions and manual-review objects known up front.
• Rehearsed end-to-end on a staging copy at least once.
• Validation green: row counts, checksums, FK integrity — not just "it finished".
• Quarantine queue empty or every entry consciously dismissed.
• Rollback path written down and tested before cutover.

None of this makes migrations exciting. That's the point.