Boot the Release Against a Copy of Production Before You Switch

Terminal sketch of a deploy preflight: the new release starts on a spare port against a VACUUM INTO copy of the database; a 200 from /healthz allows the switch, a crash aborts it.

A health check after the switch only tells you how long the outage was. Starting the new release on a spare port against a VACUUM INTO copy of the live SQLite database catches broken dependencies, syntax errors and failing migrations while the old version keeps serving — and a deliberately broken release proved it with HTTP 200 the whole way through.