A deployment that was never built from the remote
A change merged into a client repository on 23 September. A week later it still was not on the live site. The obvious conclusion, and the one reached first, was that the Vercel project had never been connected to the repository.
That conclusion was wrong. Running the connect command returned "already connected".
What had actually happened is stranger and more useful. Production was being deployed by hand, from a laptop, by CLI. Those deployments carry git metadata, so in the dashboard they look exactly like deployments triggered by a push. The running production build came from a commit that did not exist on GitHub at all. Meanwhile the remote head carried the merged change and had never been built.
The webhook had never fired for one reason only: nobody had ever pushed.
The check that distinguishes the two
A deployment whose commit cannot be found on the remote was not built from the remote, whatever the rest of its metadata implies. Two fields separate them and both were visible the whole time:
source, which readscliorgit- the
-git-<branch>-alias, which only a genuine git deployment is given
Neither was checked before the first diagnosis was offered. "This project is not wired up" and "this project is wired up and nobody is using the wire" have completely different fixes, and only one of them was needed here.
The part that was worse than the deploy
The laptop held fifty-eight unpushed commits, not two. Git reported "ahead 58, behind 0" until a fetch revealed the merged change sitting unpulled. Nearly a month of work on a live client site existed in exactly one place, on one machine, with no copy anywhere.
That was resolved carefully rather than quickly: a structured merge test with
git merge-tree --write-tree to confirm the merge was clean before attempting it, and a
scan of the entire unpushed history for committed secrets before any of it went to a
remote. Both came back clean. The push alone then triggered a production deployment, with
source: git this time, and the change went live without anyone deploying anything.
The lesson is not about Vercel. It is that a backup you have not tested is a story you tell yourself, and a deploy pipeline nobody uses is not a pipeline.