From 310cb89ae7a02dda2fc8e68e65e85bc695f57ba1 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Sun, 30 Aug 2026 23:38:02 -0700
Subject: [PATCH] docs: document deployment ref policies

---
 docs/site/README.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/site/README.md b/docs/site/README.md
index 6c7f3882af8..71fb4d2ecb2 100644
--- a/docs/site/README.md
+++ b/docs/site/README.md
@@ -96,7 +96,10 @@ deployment needs `basePath`, first move the route tree to an unprefixed
    - `VERCEL_TOKEN`
    - `VERCEL_ORG_ID`
    - `VERCEL_PROJECT_ID` (docs project, not the marketing site)
-4. Protect the `docs-production` GitHub environment with required reviewers.
+4. Protect the `docs-production` GitHub environment with required reviewers and
+   custom deployment branch policies for `main` and `v*` tags. The release-cut
+   dispatch runs from `main`; the direct published-release fallback runs from a
+   stable tag, while the workflow still authorizes only exact stable tags.
 5. Add the three rewrites above to the `www.onorca.dev` marketing project. A
    Vercel custom domain cannot delegate only `/docs` by itself; the default zone
    must proxy both page/API/media requests and `/docs-static` assets. Remove the