pg_data and app_data volumes. Migrations are
forward-only and additive-first; the booting replica applies them exactly
once under a Postgres advisory lock (concurrent replicas wait, then find
nothing left to do). /readyz stays 503 until the schema is current.
Pinning versions
latest follows tagged releases. To pin, set in .env:
latest, X, X.Y, X.Y.Z; the main branch
publishes next and sha-<commit> for early testing.
Rollback
Take a backup before upgrading (./scripts/backup.sh). Rolling the image
back works while the schema is compatible (additive migrations tolerate the
previous app version). After a bad upgrade: