deploy-ceremonylisted

# Deploy ceremony (backend) The project's recurring failure mode is **ghost-debt**: Functions/rules merged to `main` but never deployed, tracked only in scattered `⚠️ NOT deployed` memory notes. This ceremony makes deploy state a single queryable fact (the `backend-deployed` git tag) and a discoverable log (`docs/DEPLOY-LEDGER.md`), and refuses to let a deploy finish without recording itself. Scope: this is the **backend** deploy (Cloud Functions + `firestore.rules` + `firestore.indexes.json` + hosting). It is **not** the client release ceremony (`tool/release.sh`) and it does **not** satisfy the release-readiness gate — see the warning in step 5. ## Live-users note (supersedes the old "no-clients deploy freely" note) Real users are LIVE — the no-clients era is over. Client-compat gating applies: a rules/Functions tightening that can deny a shipped client's writes ships client-first or same-release (the `⚠️ old clients PERMISSION_DENIED` notes #290/#318/#294 govern again), and backend deploys ride RELEASES, not individual merges — run this ceremony at release time, not after every merge. See CLAUDE.md → Workflow for the governing rule; if [[no-clients-deploy-freely]] still exists in memory, it is stale. ## Step 1 — show what's pending ```bash bash tool/pending_deploy.sh rihla-safar ``` - Exit 0 (nothing pending) → stop; prod already matches `main`. - Exit 1 → it prints the merged-but-undeployed backend commits + file delta. Read them. State out loud what is about to