Rollback Needs Both Columns

You have to replace orders.total (dollars, numeric) with orders.total_cents (bigint). The service runs a rolling deploy across 60 instances, and the rule is that at any moment you must be able to send 100 percent of traffic back to the previous binary, which reads and writes orders.total.

Which sequence keeps that true throughout?

Add total_cents, ship code that reads and writes only total_cents, drop total in the same release, and rely on the pre-deploy snapshot if a rollback is needed.

Add total_cents and backfill it; ship code that writes both columns but still reads total; ship code that reads total_cents; wait out the rollback window; stop writing total; drop total.

Rename and convert the column in one migration, and ship the binary that uses it in the same release so schema and code never disagree.

Ship the new binary first so it fails loudly on the missing column, confirm from the error rate that the rollout reached every instance, then run the migration.