feat: add npm run update for safe API deploys

Ship schema to replicas without the data repair that disables subscriptions and stalls replication.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/DEPLOY.md

@@ -122,27 +122,21 @@ cp deploy/replicas.env.example deploy/replicas.env   # once; add real DSNs
 bash deploy/sync-replica-schema.sh --init            # once, when schemas already match
 ```
 
-For every release on **publisher** (`/var/www/superadmin/api`):
+For every release, on the publisher (`/var/www/superadmin/api`) and on each replica API directory:
 
 ```bash
-git pull
-npm run replicas:sync      # 1) DDL on replicas  2) migrate deploy  3) repair data drift if any
-npx prisma generate
-npm run build
-pm2 restart superadmin-api
+npm run update
 ```
 
+On the publisher this pulls, installs, applies DDL on the replicas before `prisma migrate deploy`, refreshes subscriptions with `copy_data=false`, builds, and restarts `superadmin-api`. On a replica (no `deploy/replicas.env`) the same command only pulls, installs, generates, builds, and restarts. It does not run `sync-replica-data.sh`.
+
 Check only:
 
 ```bash
 npm run replicas:check     # schema + subscription + row counts (settings, tenants, …)
 ```
 
-Force data realign from publisher (rare — e.g. after fixing subscriber permissions):
-
-```bash
-npm run replicas:repair-data
-```
+Do not use `npm run replicas:sync` or `npm run replicas:repair-data` for a release. Both run the data repair, which disables a subscription and recopies rows without advancing the replication origin. The apply worker then dies replaying old WAL. `npm run update` is the release command.
 
 `replicas:sync` runs `sync-replica-data.sh --repair-if-needed` automatically when
 `settings` / `setting_templates` / `tenants` counts differ from publisher.