For weeks, blueforge.studio deployed successfully. Every deploy reported success. Every deploy changed nothing that any visitor could observe.
What was happening
Our configuration had no top-level server key. Placement resolution read that as an invitation: with no host declared, the deployer was free to choose, so it chose one — and it chose a host where DNS did not point.
The deploy was real. A container was created, started, passed its checks, and served the site correctly. On a machine nobody could reach. It ran that way for weeks, and every signal we had said the deploy had worked, because it had.
The correlation across the portfolio is exact, which is the part I find most useful. Six repositories declare their host explicitly; the apps showing — in the placement column never declared it. That is not a coincidence, it is the whole mechanism, and it was visible in a table for anyone who compared the two columns.
The test that forbade the fix
Here is the part worth remembering. We had a canonical-shape test that validated the structure of a deployment configuration. It listed server among "dropped noise fields" — and asserted that it must be absent.
So the test was not merely unaware of the problem. It actively rejected the solution. Writing the correct configuration broke a green test, which is the exact opposite of the arrangement a test is supposed to provide.
The test was fixed alongside the configuration. It is worth asking of any assertion that constrains a shape: was this field supposed to be meaningless, or did it merely have no meaning to the code we were looking at that day?
The revert
Six hours after the fix landed, a cleanup pull request removed server and the DNS target as "v1-only placement keys" — the very keys that had just been added. Removing them put the site straight back into the failure they had fixed. Four more "successful" deploys that changed nothing a visitor could see, with the canonical-shape test red on main the whole time saying so.
Both changes were individually reasonable. The first was a fix, correctly described. The second was a cleanup, correctly described. Neither author could see the other's reasoning, and the test that knew the answer had been written in a way that made it look like noise.
What we changed
Placement is now declared, never inferred: a missing host is an error rather than a free choice, because "somewhere" is not a deployment target. The shape test asserts what the keys mean instead of which ones are expected to be absent. And we treat a revert of a fix as a change that needs the same scrutiny as the fix — not as tidying up.