The rollback that couldn't roll back
One release contains both the code that stops using a column and the migration that drops it. It deploys, a bug appears, and the deploy is rolled back in seconds.
The binary reverts. The schema does not. Every request now fails on a column that no longer exists, and the only ways out are an emergency fix under a full outage or a restore with data loss.
Outside every boundary: New code (rolling out), Old code (still running; FAILED: broken), Schema, an empty slot for the ships first, alone, an empty slot for the ships last, much later Connections: ships first, alone calls Schema — additive · reversible (step 1) Old code calls Schema — still works New code calls Schema — uses the new column (step 2) ships last, much later calls Schema — destructive · last (step 3)