deploy-remote.sh already printed the sha it landed on; nothing compared it to the sha the caller wanted. On 2026-08-08 the box checked out a commit four hours stale, passed every health gate, and reported RESULT=ok — the mirror it fetches from had fallen behind knot and a clean checkout of the wrong commit looks exactly like a clean checkout of the right one. The caller resolves the ref against knot and hands it down as EXPECT. The box refuses before npm ci and the restart, so a lagging mirror now costs a failed deploy instead of a bounced server running code nobody chose.