Plan a Zero-Downtime Migration to a New Data Store

We're migrating a live service from one data store to another (e.g. a different database engine, a managed service replacing a self-hosted one, or a major schema change that's easier to treat as a new store) and it has to happen without downtime or data loss, since it's serving production traffic the whole time.

Here's the situation:
- Current store and new store: [DESCRIBE — e.g. self-hosted Postgres to a managed Postgres, MySQL to DynamoDB, a single table's schema being redesigned]
- Approximate data volume and write rate: [DESCRIBE]
- Read/write patterns: [DESCRIBE — e.g. mostly reads with occasional writes, high write volume, any batch jobs that touch this data]
- Anything about the current store that's hard to replicate in the new one: [DESCRIBE — e.g. transactions spanning multiple tables, a specific consistency guarantee, triggers, full-text search]

Help me build a phased migration plan covering:
1. **Dual-write phase**: how to start writing to both stores safely, including what to do about writes that succeed on one store and fail on the other, and whether dual-writing needs to be synchronous or can tolerate the new store lagging.
2. **Backfill**: how to move existing data into the new store without a dual-write window is enough on its own — including whether the backfill needs to run in a way that tolerates concurrent dual-writes to the same rows without clobbering newer data.
3. **Verification**: a concrete way to check the two stores agree before cutting over — not just row counts, but a sampling or checksum strategy that would actually catch silent data mismatches.
4. **Cutover**: how to switch reads (and then writes) to the new store with a fast, safe rollback path if something looks wrong immediately after — what the rollback actually requires given that the old store may have stopped receiving writes.
5. **Decommission criteria**: what has to be true before it's safe to stop dual-writing and retire the old store, including how long to keep it as a cold fallback.

For each phase, call out the specific failure mode that phase is designed to prevent, and flag anything about my described situation that makes a phase riskier than the general case.

Sign in to upvote this prompt.