The four main public properties now share one deployment discipline without becoming one repository or one website.
Trillsverse.com, Lultrills.com, MyMindMine.com, and ReallyThatMagazine.com each retain their own source authority and product role. A sovereign production controller on the Trillsverse host watches their canonical branches and performs convergence without GitHub Actions.
Candidate before promotion
A new source commit is not treated as live merely because it merged. The controller fetches the target commit, builds a candidate, promotes that exact release, then checks local health plus public apex and www HTTPS health.
The health contract reports the exact deployed commit. That turns statements such as ‘the site is updated’ into something falsifiable: the public host either reports the target SHA or it does not.
Rollback is part of release, not an apology after release
If promotion fails verification, the controller attempts rollback instead of leaving a broken release in place. Release receipts preserve which source was attempted, what was previously live, and whether convergence succeeded.
Separate read-only deploy keys keep sibling repositories fetchable by production without converting the release path into a broad write credential.
Why it matters editorially
ReallyThat now uses the same distinction in its coverage. A source-level feature can be reported as merged or in development, but it should not be called live until production proves the matching commit. That rule is why recent MyMindMine and ReallyThat releases carried separate MERGED and VERIFIED states.
The result is less glamorous than a redesign and more important than one: four independently evolving public systems now have a shared definition of what live actually means.