Run production database schema changes without incidents, split additive runtime DDL from risky one-shot migrations, guard migration scripts with an expected-host check and a read-only preflight, rehearse the exact command on a disposable branch copied from production (Neon or similar branching Postgres), and verify with post-run catalog queries plus an API smoke. Use whenever adding indexes or constraints, changing primary keys, backfilling, dropping anything, or running any script against a production database URL.
