deploy.yml: rename env var alias 3DPRINT_DB_PASSWORD -> PRINT3D_DB_PASSWORD in provision-secrets. Shell/env var identifiers cannot start with a digit (POSIX); this invalid key was likely poisoning the entire environment block for this step, explaining why SWARM_MANAGER_IP read empty specifically in provision-secrets/deploy/verify (which all declare 20-30 secrets) while working fine in the isolated 2-secret debug step. The underlying Woodpecker secret name (3dprint_db_password) is unchanged -- only the YAML alias and its $-reference were renamed.

.woodpecker/deploy.yml

@@ -54,7 +54,7 @@ steps:
         from_secret: ssh_key
       SWARM_MANAGER_IP:
         from_secret: swarm_manager_ip
-      3DPRINT_DB_PASSWORD:
+      PRINT3D_DB_PASSWORD:
         from_secret: 3dprint_db_password
       GAMMA_AUTH_TOKEN:
         from_secret: gamma_auth_token
@@ -149,7 +149,7 @@ steps:
               echo "  Manual only — skipping";;
             3dprint)
               ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
+                create_or_update_secret '3dprint_db_password' '${PRINT3D_DB_PASSWORD}'";;
             gamma)
               ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;