Migrations are forward-only with a documented rollback. No “down migration” that destroys data.
No schema change without a deploy plan if the column is used by running code. Ship in two steps: (1) add nullable + dual-write, (2) backfill + flip read, (3) drop old.
Indexes after queries, not before. Profile actual query patterns before adding an index. Indexes cost on writes.
PII columns are explicit: tagged in the column comment and in connectors/<source>.md` frontmatter `pii_columns. Never query without the user naming the column.
No SELECT * in production code. Name columns.
Foreign keys with ON DELETE behavior specified. Default to RESTRICT unless you mean otherwise.