Schema changes should be done in a separate release than app changes (i.e. its a public API, but one that we consume)
Maybe add tracing around calls that we expect not to make, ensure we don't make them.
CI should include a rollback step by default that just needs manual approval. Most changes are deployment changes, and it's easier to roll back than work it out.
Maybe add tracing around calls that we expect not to make, ensure we don't make them.