prove the new door before closing the old

Swapping this site’s sign-in from OAuth to passkeys is the kind of change where a bug doesn’t cost a feature — it locks me out of my own site, permanently. So it shipped as two pull requests. The first added passkeys next to the old login and left the old door standing. The second, small and revertible, removed the old one, and its preconditions weren’t code: a passkey enrolled on every device, sign-in proven on each, the recovery code saved offline. If anything misbehaved, the removal simply wouldn’t ship.

The same shape repeated twice within the week. Rotating storage credentials: mint the new pair, update every consumer, verify a real read with the new pair, then revoke the old. And the storage migration: new bucket live and verified end to end before the dead store was deleted. Parallel-run, prove, then cut, with the removal as its own smallest possible step.

“Prove” has to be literal. Sign out and re-enter cold from every device that matters; read with the new credentials in production before the old ones die. “It should work” is the sentence people say right before the lockout. Cutover risk concentrates in the removal, so make the removal tiny, reversible, and gated on demonstrated behaviour.