diff --git a/OPERATIONS.md b/OPERATIONS.md
index 0a839aa..f59fa7e 100644
--- a/OPERATIONS.md
+++ b/OPERATIONS.md
@@ -76,17 +76,21 @@ So release to the local mirror and run the live check **before** opening a pull
 | `hugo.yaml`, `layouts/` | Permalink and taxonomy changes move URLs underneath the redirects that point at them. |
 
 ```sh
+set -e
 set -a; . ~/.secrets/Blog.local.production.env; set +a
-ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh
-checks/check-live-urls.sh "$SITE_BASE_URL"
+RELEASE="$(git rev-parse --short HEAD)"
+ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh "" "$RELEASE"
+EXPECT_RELEASE="$RELEASE" checks/check-live-urls.sh "$SITE_BASE_URL"
 ```
 
-Name the file in both places, even when it is the default, since `make-release.sh` sources `ENV_FILE` independently of the shell above and a value already exported earlier in the same session would otherwise win silently over the sourced one:
+Name the file in both places, even when it is the default, since `make-release.sh` sources `ENV_FILE` independently of the shell above and a value already exported earlier in the same session would otherwise win silently over the sourced one. The empty first argument leaves the deploy root at the sourced `DEPLOY_ROOT`, and `RELEASE` is reused so `EXPECT_RELEASE` verifies the release the command just built rather than skipping the release-stamp guard. `set -e` matters here too: a failed `git rev-parse` would otherwise leave `RELEASE` empty, which silently skips the check's own release-stamp verification instead of failing loud:
 
 ```sh
+set -e
 set -a; . ~/.secrets/Blog.local.staging.env; set +a
-ENV_FILE=~/.secrets/Blog.local.staging.env deploy/make-release.sh
-checks/check-live-urls.sh "$SITE_BASE_URL"
+RELEASE="$(git rev-parse --short HEAD)"
+ENV_FILE=~/.secrets/Blog.local.staging.env deploy/make-release.sh "" "$RELEASE"
+EXPECT_RELEASE="$RELEASE" checks/check-live-urls.sh "$SITE_BASE_URL"
 ```
 
 **There is no restart step, and that depends on one flag.** The container runs `caddy run --watch`, which re-adapts the config on a timer and reloads it in process. Re-adapting re-executes every `import`, so a new release's `Caddyfile` and `maps/*.map` are picked up through the unchanged `/config/Caddyfile` that the watcher actually names. Measured on this host: content is live the instant the symlink moves, and the rules follow within about a quarter of a second.
@@ -142,6 +146,7 @@ Three properties of how the credential is handled, each there for a reason worth
 ## Deploying
 
 ```sh
+set -e
 RELEASE="$(git rev-parse --short HEAD)"
 SITE_BASE_URL=<base-url> deploy/make-release.sh <deploy-root> "$RELEASE"
 EXPECT_RELEASE="$RELEASE" checks/check-live-urls.sh <base-url>
diff --git a/README.md b/README.md
index 6996220..b36127e 100644
--- a/README.md
+++ b/README.md
@@ -178,9 +178,11 @@ checks/check-url-parity.py public
 Build a release and verify it against a running server:
 
 ```sh
+set -e
 set -a; . ~/.secrets/Blog.local.production.env; set +a
-ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh
-checks/check-live-urls.sh "$SITE_BASE_URL"
+RELEASE="$(git rev-parse --short HEAD)"
+ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh "" "$RELEASE"
+EXPECT_RELEASE="$RELEASE" checks/check-live-urls.sh "$SITE_BASE_URL"
 ```
 
 The deploy root and the base URL come from a file per environment in `~/.secrets/`, named `Blog.<server>.<environment>.env`, copied from [example.env][env-example] and selected with `ENV_FILE`. `~/.secrets/Blog.local.production.env` is the one read when `ENV_FILE` is unset. The real files live on the host, never in this checkout.
diff --git a/deploy/README.md b/deploy/README.md
index 6c36bad..63411ac 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -53,9 +53,11 @@ neither. Seven facts are the whole contract:
 ## Building a release
 
 ```sh
+set -e
 set -a; . ~/.secrets/Blog.local.production.env; set +a
-ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh
-checks/check-live-urls.sh "$SITE_BASE_URL"
+RELEASE="$(git rev-parse --short HEAD)"
+ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh "" "$RELEASE"
+EXPECT_RELEASE="$RELEASE" checks/check-live-urls.sh "$SITE_BASE_URL"
 ```
 
 The deploy root and the base URL are the only host-specific values, and they pair per