Verify deployed artifacts before choosing a minimal-change base
A reported release SHA is a label, not an attestation of the running artifact. Before a narrow gateway rollout, compare the deployed routing/configuration and application files against the proposed base; an older labeled base can accidentally undo already-live behavior. Keep code…