Replace "pull main and restart" with a deployment you can reverse
Deployment is an SSH loop: pull the main branch on each of four servers, install dependencies, restart the process. It takes eleven minutes, occasionally drops requests, and last month one server ended up on a different commit than the others for two days. Design something better without introducing an orchestrator.
The fix that looks right
Adding a health check that returns 200 unconditionally so the rollout stops failing. It does stop failing — the gate now passes for every instance regardless of whether the application can serve, and the rollout proceeds confidently through all four servers into a fully broken fleet. The near-miss version is a health check that only proves the process is listening; it passes while the service cannot reach its database, so the rollout replaces every working instance with a broken one and reports success.