A naive rename.

The field had the wrong name, so fixing it seemed obvious. But that field had been read by the mini program for six months, and two scripts depended on it.

The change took three minutes. The cleanup took two days. Across those two days I kept asking: what would I have done if I had treated it as a contract from the start?

Extend, don't replace.

The answer is unglamorous. Add the new field and let both coexist. Migrate the consumers one at a time. Delete the old field only once nothing reads it.

Slow — but every step is reversible. A single atomic rename is safe in exactly one moment: when nobody is using it.

Next week.

Write this into the interface doc, and leave a comment on the old field explaining why it is still alive.