diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 71d0b8b..e5b10b9 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -75,6 +75,19 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm lint
       - run: pnpm typecheck
+      # wrangler.jsonc names code that no TypeScript gate checks: entrypoints,
+      # and Durable Object classes the entrypoint must export. Rename a class
+      # without its binding and lint, typecheck and test all stay green — the
+      # first failure is the deploy below, after migrations have been applied.
+      # `--containers-rollout none` keeps this to the bundle: without it a dry
+      # run still builds every container image, which the deploy jobs then
+      # build again. BEFORE `pnpm test`, deliberately: these cost seconds and
+      # the suite costs minutes, so on the main-push run a config that names
+      # missing code reds this job without waiting out the suite. After
+      # `typecheck`, also deliberately: a real code error should fail with the
+      # typechecker's message, not esbuild's.
+      - run: pnpm exec wrangler deploy --dry-run --containers-rollout none
+      - run: pnpm exec wrangler deploy --dry-run --containers-rollout none -c apps/substrate/wrangler.jsonc
       - run: pnpm test
 
   # The substrate deploys BEFORE the dispatcher, and its own job rather than a
diff --git a/AGENTS.md b/AGENTS.md
index 5a9ca36..f2a6f68 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,7 +4,7 @@ BYOC CI/CD that offloads the expensive half of GitHub Actions onto a Cloudflare
 
 ## Status
 
-Working monorepo: Effect-TS DSL (`packages/core`), capability layers (`packages/runtime-cf`), run definitions (`runs/`), the dispatcher Worker (`apps/dispatcher`), the substrate (`apps/substrate`), and the bundled CLIs (`packages/demo-agent`, `packages/review-agent`). Deployed via `wrangler deploy` with container images built in-repo (`infra/Dockerfile.sandbox*`); CI runs `pnpm lint && pnpm typecheck && pnpm test` (`deploy.yml`).
+Working monorepo: Effect-TS DSL (`packages/core`), capability layers (`packages/runtime-cf`), run definitions (`runs/`), the dispatcher Worker (`apps/dispatcher`), the substrate (`apps/substrate`), and the bundled CLIs (`packages/demo-agent`, `packages/review-agent`). Deployed via `wrangler deploy` with container images built in-repo (`infra/Dockerfile.sandbox*`); CI runs `pnpm lint && pnpm typecheck`, then `wrangler deploy --dry-run` for both workers — so a Worker config that names missing code fails before anything deploys — then `pnpm test` (`deploy.yml`).
 
 ## Architecture