A broken-glass deploy skips manual approval

The emergency path works, but cleanup logic later tears down the wrong environment state. The functional path still exists, but one hidden dependency still assumes the old boundary between shared and isolated resources. A hidden dependency still assumes the old shared-service boundary even though the visible workflow stayed intact. The visible workflow still functions, but one dependency continues to assume the previous shared ownership contract.