Evolving Event Schemas Without Breaking Consumers

Event-driven systems decouple services beautifully — until you need to change an event schema. Suddenly the decoupling works against you. Producers and consumers deploy independently, messages sit in a queue for hours or days, and there's no HTTP 422 to tell you something broke. Schema changes done wrong silently corrupt state or crash workers at 2 AM.

This isn't a tooling problem you solve by picking the right message broker. It's a discipline problem. Here's the framework I apply before touching any event schema in production.