The cutover window is tight. If we hold the read replica until the backfill drains we lose the rollback path, so I would rather split this into two deploys.

One caveat: the backfill job reads from the same connection pool as the API. We should cap it at eight workers or the request latency will spike during business hours.

Added a dashboard for pool saturation so we can watch it live. Alert fires at 80 percent for five minutes.