Small database migrations need a rollback note before they ship

Last month I almost treated a small database migration like routine work. It was only adding a nullable column and backfilling a few rows, so I planned to run it during a normal deploy window. The problem showed up in staging when the backfill held a lock longer than expected and one API path started timing out. Nothing broke in a dramatic way, but the log told me the same thing would be ugly in…