fix(release): develop to main

config/deployment-matrix.yml

@@ -283,6 +283,8 @@ clusters:
     # The list below mirrors every app that has a stg-mt values.yaml in
     # lerian-internal-gitops (environments/benedita/helmfile/applications/stg-mt).
     # When an app gains or loses that directory, update this list to match.
+    # plugin-access-manager is the deliberate exception: it has that directory
+    # but takes no beta there (see its entry).
     app_extra_envs:
       billing-worker:
         beta: ["stg-mt"]
@@ -303,12 +305,17 @@ clusters:
       notifications:
         beta: ["stg-mt"]
       # plugin-access-manager also runs a multi-tenant install under cross/
-      # (ArgoCD app benedita-plugin-access-manager-cross) that tracks every
-      # release type. It cannot use app_helmfile_env: that override would
-      # replace dev-st/stg-*/prd-st instead of adding cross to them.
+      # (ArgoCD app benedita-plugin-access-manager-cross). It cannot use
+      # app_helmfile_env: that override would replace dev-st/stg-*/prd-st
+      # instead of adding cross to them.
+      #
+      # Each multi-tenant env follows ONE channel, and stg-mt gets no beta. Caradhras
+      # publishes here too (gitops_app_name: plugin-access-manager), and a beta runs its
+      # migrations on that env's database; an rc or stable cut before them then
+      # crash-loops against the newer schema. It happened with v1.7.1 on cross
+      # (2026-10-23) and an rc on stg-mt (2026-10-26). stg-mt keeps the rc it gets from
+      # the normal tag expansion; cross follows stable, like tenant-manager's cross.
       plugin-access-manager:
-        beta: ["stg-mt", "cross"]
-        rc: ["cross"]
         stable: ["cross"]
       plugin-br-bank-transfer:
         beta: ["stg-mt"]