Feedback no autonomous deploy or merge data altering

Justin stopped an in-progress session after it built, committed, merged, and deployed a recurring-subscription de-dup change without pausing for review, and the merge logic itself was wrong (it folded two separate Canva subs — his and Krystal's — and folded YouTube TV price-history rows as if they were duplicates).

Why: Two compounding mistakes: (1) the fold heuristic (brand+amount) was too coarse for real subscription identity, destroying genuine distinctions on live prod data; (2) the agent kept deploying after each build without stopping to let Justin review, so the bad merge went live before he could catch it.

How to apply: For any change to shared/financial data display or categorization logic, do NOT chain build -> commit -> merge -> deploy autonomously, even if a slot/worktree build passes clean. Default workflow: build -> verify in an isolated slot -> show Justin the diff/output -> stop. Only merge/deploy when Justin explicitly says to, every single time, not just the first time in a session. This applies beyond this one feature — any autonomous multi-step pipeline that ends in a prod-affecting action needs an explicit checkpoint before the last step, especially when the change touches user-owned/shared data (subscriptions, finances) where 'looks like a duplicate' can be a false positive specific to context the agent doesn't have (e.g., multi-user shared accounts, price-change history).

[auto-memory session 86183751-1c8f-47ba-bcc8-7ed0bdf2ed40, confidence 0.90, mode direct]