For Railway private-registry credential changes, determine the actual environment write

General lesson: For Railway private-registry credential changes, determine the actual environment write scope before mutating an existing service. On a non-fork environment, serviceInstanceUpdate documents fanout to other non-fork environments; an environment-config patch may silently omit deploy.registryCredentials. Compare the authoritative live environment.config.services[serviceId].deploy.registryCredentials, not deployment.meta.serviceManifest snapshots, when preflighting whether a cross-environment update would change existing settings. This method supports a risk assessment; matching current values does not make a fanout write environment-scoped or remove the need for approval.