Decision record
One serialized commit queue, and no cancellation
The first GitOps workflow failed for an embarrassingly concrete reason: it wrote to `config/rc-appset`, while the real manifests lived under `config/bank-appset`. It also allowed an in-progress deployment update to be cancelled by a newer run, which is unsafe for a repository acting as deployment authority. I replaced it with one serialized GitOps commit queue — cancellation disabled, environment validated, no-op updates made explicit, rebase before push. After that, every release became a commit with a reproducible image SHA, and rollback became a Git revert that ArgoCD could reconcile.