Deployment connections and inbound authorization
Key Takeaway
A deployment connection alone doesn't let change sets move. The receiving org must allow inbound changes from the org that uploads them.
A deployment connection is the link between two related Salesforce orgs that lets change sets move between them. The org receiving changes must also authorize inbound change sets from the org that uploads them. This extra layer of security enforces a planned promotion path and keeps an org's setup metadata from being overwritten by mistake.
Where deployment connections exist
A deployment connection must exist between two Salesforce orgs before you can upload a change set from one to the other. You can't create a deployment connection between arbitrary orgs. Instead, connections are created between all orgs affiliated with a production org.
For example, imagine a production org with two sandboxes. There is a connection between production and each sandbox, and there is also a connection between the two sandboxes.