A dual-write window, and the check that ran nightly

Six weeks of writing two columns, and a check that they agree.

SELECT COUNT(*) FROM orders
WHERE status_v2 IS NOT NULL
  AND status_v2 <> status;

-- zero every night, except one:
--   2026-02-19: 1,204 rows
--   cause: a bulk UPDATE written as raw SQL by a
--   support script, touching status and not status_v2.

The nightly agreement check is what makes a dual-write window safe, and it caught exactly the failure it exists for — a writer that bypasses the model. Without it the divergence would have been discovered at cutover, when the old column is dropped and twelve hundred orders have the wrong status.