Seed scripts that run on every deploy — how do you keep them idempotent?

Rules that keep seeds safe to re-run:

• Key every row by something stable (slug, handle, or a deterministic id) and use upsert on it. Never create without checking.
• Don't increment counters in seeds — recompute aggregates from rows (count, sum) so a second run lands on the same number.
• Keep timestamps deterministic (relative to a stored anchor), otherwise every deploy "changes" data.
• Never seed secrets; never print them.
• Make the seed skippable with an env flag for environments that shouldn't get it.

Then test it the boring way: run it twice and diff row counts.