Every in-place deploy needs --allow-replace, and that turns off the check meant to stop one that replaces the instance.
aws_ecr_lifecycle_policy.pds's rule 2 names var.container_image_tag, and a change to a lifecycle policy replaces it, so every release's plan replaces that policy. The 2026-10-14 deploy of 36250f0b7251 planned 1 to add, 1 to change, 1 to destroy: the release parameter updated in place, and the lifecycle policy replaced. scripts/deploy-pds.sh refused it: "refusing a plan that replaces anything; --allow-replace applies it". With --allow-replace it applied correctly, but the same flag would also have let an aws_instance.pds replacement through unasked.
The guard could ignore a replaced aws_ecr_lifecycle_policy and still refuse anything else. Or the policy could stop naming the tag, so that a release leaves it alone.
🤖 Generated with Claude Code
Fixed by #1190 on main: d53c90ff stops naming the release tag in the ECR lifecycle policy, so a routine in-place release plans with no replacement and needs no --allow-replace.