Miracle's release tag and private source backup now come from the same frozen Git tree that Railway receives. The release controller checks the source before and after testing, deploys only that tested tree, and verifies the commit's tree ID before creating a tag.
- Files written by another local process during deployment cannot enter the release record.
- Ignored credentials, local analysis state, dependency folders, and generated logs cannot enter the deployment snapshot.
- Late edits remain safely visible and uncommitted for a future release.
- The previous release deployed the correct email and Notes source, but two unreferenced internal analysis modules entered its later Git tag. Those modules never ran in production and are removed from this release record.
No member data, to-dos, email receipts, or Notes content was affected.