Zero-Downtime Schema Migration Crew

A migration team for schema changes on live tables where the failure mode is a lock queue rather than a wrong statement. The plan is decomposed into individually deployable expand / migrate / contract steps, each annotated with its reverse step and the application version it requires. A lock risk analyst binds every forecast to the engine version and names the queue exposure - the pile-up of ordinary readers behind a waiting strong-lock statement - and writes the preflight checks (oldest transaction, idle-in-transaction sessions, vacuum activity, replica lag, leftover invalid indexes). Backfills are chunked, one transaction per chunk, checkpointed with the data, idempotent by predicate, and throttled on replica lag, connection saturation and application error rate. The compatibility window fixes code-before-schema deploy order, dual-write before backfill, a read switch gated on verification rather than a date, and enumeration of consumers outside the deploy. Reversals are executed on the clone from the exact state the forward step leaves, including partial-failure states, and destructive steps require a retention artifact with a verified restore. The rehearsal gate measures lock hold, waiter pile-up, latency and lag under a load profile that includes a long-running transaction, performs an abort drill, and returns uncertified rather than pass when no representative clone exists.