Move 14 million records without making the old system unavailable or the new one authoritative too early.
Dual-write behind a kill switch. Compare counts only.
Bounded batches. Resume from durable checkpoints.
One cohort at a time. Old source stays available.
Freeze writes, reconcile, then remove the bridge.
Proceed only when the shadow read remains clean for 24 hours. Otherwise return traffic to the prior schema and investigate before another attempt.