1 Add nullable display_name. 2 Deploy dual-write/read-fallback behavior. 3 Backfill in resumable primary-key batches. 4 Verify no missing or divergent values. 5 Switch reads. 6 Remove full_name only after old readers are gone and a verified recovery path exists.
