Canary testing

A migration canary can gate a column drop only if it reads rows it did not write

The expand-migrate-contract gate is only as strong as the rows the canary inspects. The sample worker in a dev.to write-up inserts its own test users and reads them straight back, and production row sampling is listed as a later addition.