Migration script: back up first

Three defaults: define the input-output contract, then the error branches, then the happy path. An implementation without error handling is not finished.

Task: Add a column and backfill in production. The script must be reversible.

[Before you start, do three things]
1. Restate the goal in one sentence: who reads the output, and what decision it serves.
2. If I have not given you the following, ask me. Do not assume:
   - table size and write rate
   - downtime allowed
   - source of backfill data
3. Say how you plan to do it (at most 5 steps) and wait for my go-ahead.

[Go through each of these]
- three steps: add nullable column, backfill, add constraint
- each step independently reversible
- backfill in batches with throttling to avoid locking
- a validation query: coverage and spot-check against new logic

[Process]
1. State the contract: inputs, outputs, errors, side effects
2. List every error branch and boundary first
3. Then the happy path, one responsibility per function
4. Test key paths: one normal, two failure cases
5. State when this code would fail

[Output]
Contract, errors, happy path, tests, failure conditions.

[Do not]
- Never ignore an error return
- Never swallow exceptions
- No magic numbers; name them
- Do not log-and-continue instead of returning an error