fix(ci): deploy main after a merge when prod is not converged on it #3869

🤖 Generated by the Agentic Engineer

Evidence

#2838's decision splits the fix in two. The first half — reporting whether prod runs main from :latest's signed provenance — shipped in #3847 and was wired after every push to main in #3864.

Its verdicts are now observed on real pushes, not only in tests. Every run of 🧭 Observe Production Convergence since #3864 merged reported CONVERGED, naming the pushed commit:

So the reporter does not raise false alarms on ordinary merges. The race in #2838 is rare by design, so no real BEHIND has been seen yet; its handling is covered by the report's own tests (behind warns without failing, diverged warns without failing, unknown fails).

Problem

Today a BEHIND or DIVERGED verdict only leaves a warning on the main run. Nothing acts on it, so prod can still sit behind a merge until some later deploy happens to land — the exact outcome #2838 describes.

Hypothesis

If the post-merge check deploys main's tip whenever prod is behind it, a merge that lands just after another group's heal is always deployed within one run, and a converged prod is never redeployed.

Smallest useful change

After a push to main, when the convergence verdict is BEHIND, run the existing manual deploy of main (cd.yaml, under the same prod-deploy lock and gates). CONVERGED does nothing. UNKNOWN fails the check without deploying, as it does today.

DIVERGED keeps warning without deploying. The report itself notes it is expected for a moment whenever a queued merge group has deployed before it merges, so redeploying main on it would roll back a group that is about to land. The race in #2838 reads BEHIND once the later group merges, so BEHIND alone covers it.

Acceptance criteria

• BEHIND starts one deploy of main's tip under the prod-deploy concurrency lock, through the existing deploy gates (no new bypass).
• CONVERGED and DIVERGED start no deploy; UNKNOWN starts no deploy and stays red.
• The decision is tested for all four verdicts, and an ablation that always deploys (or never deploys) makes those tests fail.
• After merge, the next main push still reports CONVERGED and starts no deploy.

Success signal

Over the following month, every main run ends CONVERGED either directly or after its own redeploy, and no deploy starts on a CONVERGED verdict.

Rough size: S–M. Reaches production, so it carries the deploy lane's usual review and gates.