Function deploy 

pub fn deploy(
    approved: Option<&str>,
    manifest_path: &Path,
    migrations_dir: &Path,
    consent: Consent,
) -> Result<DeployOutcome, Vec<DoctorFailure>>

fz deploy --plan <digest>: applies exactly the approved plan — by recording it, bound to its digest, in .harness-deploy.json beside the manifest. It refuses:

• without --plan at all (approval is the point);
• a digest that does not match a plan recomputed now, naming what moved since the recorded deployment;
• a production venture without --i-am-deploying-to-production — the second consent, deliberately unlike the first;
• a plan that removes modules without --i-am-removing-modules, a consent separate from the production one.

Writing the composition itself — compiling, standing up the Worker, applying migrations — stays with the needs-human steps fz build and the wrangler flow own. Running the same approved deploy twice is safe: the second run records nothing and reports changed: false.

Errors

Coded failures for every refusal above, plus unreadable inputs and a record that cannot be written.