A broken-glass deploy skips manual approval while cleanup automation still assumes the abandoned candidate release owns the shared sandbox during a staged decommission

The emergency path works, but cleanup logic later tears down the wrong environment state. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.