Once the new release serves, bin/deploy-check.php opens the public pages, signs in as the check account named by DEPLOY_CHECK_EMAIL and DEPLOY_CHECK_PASSWORD and opens the member pages, and asks /deploy-check, which with DEPLOY_CHECK_TOKEN reports whether the database answers, whether the web server can write to every runtime folder, and which release answered. A page passes when it answers as a page should: a success status, HTML, a title, no PHP error text and no program code shown as text, which are the ways releases have actually broken. The result is in the deploy log and a failure is emailed to ERROR_ALERT_EMAIL.
The check is off until DEPLOY_CHECK=1 is set in the webhook's environment, so deploys are unchanged until then. With DEPLOY_CHECK_ROLLBACK=1 a page that fails points current back at the previous release and reloads PHP; a site that cannot be reached at all is reported and never rolled back. See deployment/README.md, "Deploy check".