Production Risks of Async Dual Writes

The article explains why asynchronous dual-write strategies used for zero-downtime database migrations frequently cause hidden data-consistency problems. It describes the Expand-Contract pattern (expand writes to both old and new schemas, backfill, validate, then contract) and shows how non-atomic dual writes can create prolonged divergence when one write succeeds and the other fails. The author outlines how Stripe mitigates these risks in large-scale migrations using shadow writes, idempotent operations with retries, and continuous automated reconciliation jobs that detect and repair discrepancies. The piece lists common implementation mistakes—assuming cross-database atomicity, poor read strategies during transition, and missing observability/reconciliation—and gives interview-style questions and recommended technical approaches for handling dual-write failures safely.