pub fn check_pair(coverage: &Meta, release: &Meta) -> Result<(), PairError>
The invariant deploy relies on: same commit, same run, same builder image.
Attempts deliberately need not match — see the module docs.