Data separation is the first thing and you are already doing that.
The alternative to making changes to the live database (and that's not at all a good idea when they are schema changes), is to modify a copy of the data file and then import the records from your live file into the new copy, then swap the files. This import process can be scripted so that all records from all tables are imported and serial number fields get their "next serial value" settings updated so that it's all automatic.
I totally agree with the 'bad idea' comment and my initial feeling about the data import is even more scary. I will nonetheless try to find some examples of such scripted import/swap approaches.
I inherited the solution and it was VERY obviously built by someone with absolutely no design/programming background, so I don't get a very warm and fuzzy feeling thinking about what may happen. There are weird things happening already and I don't have an easy way to validate consistency and success (the same thing, really) after doing the data import.
I guess another good idea is to do more and smaller changes to limit the amount of things that COULD go wrong.
Thanks for taking the time to respond, I appreciate it!
For others reading this thread, if you make design changes to the table design on a "live" hosted database and you are disconnected by a network glitch in mid change, you can corrupt the file according to posts from TS personnel that I have seen here in the forum. From my own experience, I have also discovered that if you click OK to dismiss Manage | Database and apply the changes made, the update tables are briefly locked against any changes to their data by other users. If another user is running a script at the same instance that I do this, we don't always get an error message back, but now some of the edits that should have been performed by the script did not take place. You don't get any warning, so the only way you know that this happened is when reports or scripts don't display the data they should or fail to perform as expected.
I do make certain, small design changes to some of our larger files while they are hosted, but I also have taken the following safety measures: I make the change after close of business when I am sure that no one is editing a record or running a script that modifies data. I do this only on hosted files that makes frequent automatic back ups of the file so I can easily replace the file with a backup if I should get disconnected during the updated.