[Polichinel]

Why

Before deploying v1.14.0 the operator asked whether the one-line tag write I had given them was really the deploy procedure. It was not — it is the exact mistake C-343 (Tier 2, open) exists to prevent, and the reason the question had to be asked is that C-343's own correction was partial.

#431 registered C-343 and fixed scripts/refresh_pipeline.sh and docs/guides/server_quickref.md. Four more copies of the one-step claim were still live, and they are the ones an operator reads.

Document	What it said
docs/guides/hetzner_deployment_guide.md	the tag file, then "That's it." — and this is the file refresh_pipeline.sh points to "for full detail"
docs/guides/server_operations.md	a local git tag && git push (cannot trigger the publish workflow, and cannot be run at all under branch protection) plus the tag file; no checkout, no uv sync
docs/ADRs/022_tag_based_deployment_gate.md	"One-line rollback" listed as a benefit of the gate; a three-step deploy with neither checkout nor uv sync; a Verify block naming the tag file and git describe but not the installed distribution — the one of the three that was actually wrong in August
docs/guides/data_serving_guide.md	told newcomers that writing the old tag name back puts you back on known-good code

The ADR is the worst of the four, because it is the governing document and it sold the defect as a feature.

What changed

• server_quickref.md is the single operational home, and grew the verification block it was missing: step 4 checks all three sources — tag file, checked-out tag, and installed distribution version, the only one that reflects uv sync. Also states that step 1 alone is not a deploy, and that a rollback is a deploy.
• The four stale documents now point there, each carrying "if they disagree, the quickref wins." No second copy of the commands anywhere — that duplication is what Release ritual documents a procedure branch protection made impossible #402 is about and what let these drift.
• ADR-022 gets a dated amendment in the ADR-027 style rather than a rewrite. The Decision it records is sound: the gate does refuse to start without a valid tag and does check that tag out. What was wrong was the inference that the checkout makes the tag file sufficient. The amendment states both reasons (bash has already buffered the script; uv sync is never invoked) and notes the entry is still open.
• C-343 updated, not duplicated — same code locations, same problem type, so this merges into the existing entry per the dedup rule. The update is honest that it weakens the entry's own "corrected in the same PR as this entry" claim: the correction reached two of six copies and the stale four outlived it by two months and one release.

Verification

Check	Result
uv run ruff check .	clean
uv run pytest (full, unpiped)	exit 0, zero FAILED lines
bash docs/validate_docs.sh	PASSED
uv run pytest tests/test_docs_citations.py	7 passed — no file.sh:N citations introduced
all register-reading test files	41 passed, every one run

No source, test or dependency changes; header counts unchanged (an amendment, not a new entry).

Also worth noting for the record: the first full-suite run failed test_falsification_deploy_v160.py::TestF2ReleaseTopology::test_main_is_ancestor_of_development. Not a topology break — remote main and development are healthy; the local development ref was two commits stale at 801177d, and this gate reads local refs by design. Fast-forwarded to 47fa8b4 and it passes. The gate did its job.

What this does not fix

Nothing mechanically prevents a seventh copy, or prevents the procedure being skipped on the box. The pre-flight check that would — comparing $DEPLOY_TAG against the HEAD the script started from, failing loud per ADR-011 rather than self-correcting one run late — is still #424 and still unbuilt. C-343 stays open.

Refs #424, #402. Closes nothing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EfeuULbPTqrx4qtNki5dy9