Snapshot the container right before the nightly migration

The 2am migration job is the one that goes wrong. You add a hoody-cron entry that fires at 1:55am: a curl to the snapshots URL, naming the snapshot pre-migration-$(date +%F). Five minutes later the migration runs. If it succeeds, the snapshot sits idle and costs nothing. If it fails, you restore in 30 seconds.

You used to write a runbook that started with "first, take a backup." The runbook now starts with "the backup already exists, named for today's date, taken five minutes before the change."

The cron job isn't doing the migration. It's making sure the migration is reversible.