SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

There are a series of steps to run through the migrations without downtime, we plan to update the release notes with a detailed guide

but roughly (all steps are with v1.14.0 of spicedb):
- run `spicedb migrate add-xid-columns`
- update spicedb to 1.14 with  `--datastore-migration-phase=write-both-read-old`
- run `spicedb migrate add-xid-constraints`
- update spicedb with the flag `--datastore-migration-phase=write-both-read-new`
- run `spicedb migrate drop-id-constraints`
- update spicedb to remove the `--datastore-migration-phase` flag

the next release of the operator will support walking through these phases automatically, but those are the manual steps

if you skip those and run `spicedb migrate head` and update, you may see an increased error rate as the migrations run for the reasons you note. but that may be acceptable depending on your use case

If only for safety, I definitely want to migrate slowly 😅  there's no going back after `drop-id-constraints`

you can stay on `write-both-read-new` as long as you like to verify before running the last migration