Retry immutable releases only after locating the failure boundary

Before retrying a failed deployment, locate the failure boundary: confirm whether it stopped before any migration or service mutation, and distinguish a transport or control-plane error from an application, schema, or configuration error. If the release is pinned to an immutable commit and revalidates provenance, one failed-job retry can be safe; afterward, require every normal migration, per-service provenance, and runtime-readiness gate. Do not use this rule for repeated timeouts, SQL errors, invalid migration history, or releases that may have partially changed infrastructure.

Applies when: A guarded CI/CD release fails on a provider control-plane request before mutation begins. Keywords: Railway GitHub Actions deployment retry timeout immutable SHA provenance readiness