@intentius/chant 0.80.0 → 0.81.0

package/src/components/driver.test.ts

@@ -13,7 +13,8 @@
 import { describe, expect, it } from "vitest";
 import { CapabilityRegistry, type DeployContext } from "./capability";
 import { stubCapability } from "./verbs/stub";
-import { memoryGateLedgerPort } from "../op/gate";
+import { describeGateMismatch, memoryGateLedgerPort } from "../op/gate";
+import { componentPlanDigest } from "./gate-plan";
 import type { PendingGateInput } from "../lifecycle/gate-ledger";
 import {
   DependencyCycleError,
@@ -311,14 +312,17 @@ describe("runComponentDeploy — gate as fact (#2119)", () => {
 
   it("a resolution newer than the pending fact passes the gate and carries the approver", async () => {
     const { registry, calls } = registryWithCalls();
+    const planDigest = componentPlanDigest({ environment: "dev", component: gatedComponent() });
     const port = memoryGateLedgerPort({
       pending: [{
         version: 1, kind: "pending", op: "neo4j-cluster", gate: "approve-node-1",
         timestamp: "2026-09-05T10:00:00.000Z", expiresAt: "2026-09-07T10:00:00.000Z",
+        planDigest, environment: "dev",
       }],
       resolutions: [{
         version: 1, op: "neo4j-cluster", gate: "approve-node-1",
         resolvedBy: "alex", timestamp: "2026-09-05T11:00:00.000Z",
+        planDigest, environment: "dev",
       }],
     });
     const result = await runComponentDeploy(
@@ -332,6 +336,79 @@ describe("runComponentDeploy — gate as fact (#2119)", () => {
       .toEqual({ gate: "approve-node-1", resolvedBy: "alex", timestamp: "2026-09-05T11:00:00.000Z" });
   });
 
+  // #2574: a component gate approval is bound to the environment and the plan.
+  describe("approvals bound to environment and plan (#2574)", () => {
+    const run = (port: ReturnType<typeof memoryGateLedgerPort>, env: string, component = gatedComponent()) =>
+      runComponentDeploy(component, { env, component: "neo4j-cluster" }, registryWithCalls().registry, {}, undefined, { port, now: NOW });
+
+    it("the pending fact records the environment and the plan", async () => {
+      const port = memoryGateLedgerPort();
+      const result = await run(port, "staging");
+      expect(result.gate).toMatchObject({
+        environment: "staging",
+        planDigest: componentPlanDigest({ environment: "staging", component: gatedComponent() }),
+      });
+    });
+
+    it("an approval given for another environment does not pass the gate", async () => {
+      const port = memoryGateLedgerPort();
+      const staging = await run(port, "staging");
+      const approval = {
+        version: 1 as const, op: "neo4j-cluster", gate: "approve-node-1", resolvedBy: "alex",
+        timestamp: "2026-09-05T12:30:00.000Z",
+        planDigest: staging.gate!.planDigest!, environment: "staging",
+      };
+      const withApproval = memoryGateLedgerPort({ pending: [staging.gate!], resolutions: [approval] });
+
+      expect((await run(withApproval, "staging")).status).toBe("ok");
+      const prod = await run(withApproval, "prod");
+      expect(prod.status).toBe("gated");
+      expect(prod.gate).toMatchObject({ environment: "prod" });
+      // The staging approval is not this run's business, so it is not reported as a mismatch either.
+      expect(prod.gateMismatch).toBeUndefined();
+    });
+
+    it("an approval given for another plan in the same environment is refused and named", async () => {
+      const port = memoryGateLedgerPort();
+      const before = await run(port, "prod");
+      const approval = {
+        version: 1 as const, op: "neo4j-cluster", gate: "approve-node-1", resolvedBy: "alex",
+        timestamp: "2026-09-05T12:30:00.000Z",
+        planDigest: before.gate!.planDigest!, environment: "prod",
+      };
+      const changed = gatedComponent();
+      changed.deploy[1]!.steps.push({ kind: "cfn-deploy", stack: "extra" });
+      const result = await run(memoryGateLedgerPort({ pending: [before.gate!], resolutions: [approval] }), "prod", changed);
+
+      expect(result.status).toBe("gated");
+      expect(result.gateMismatch).toMatchObject({
+        approved: before.gate!.planDigest, planned: result.gate!.planDigest, environment: "prod", resolvedBy: "alex",
+      });
+      expect(result.gate!.planDigest).not.toBe(before.gate!.planDigest);
+    });
+
+    it("an approval recorded before the binding is refused, with the command that replaces it", async () => {
+      const legacyPending = {
+        version: 1 as const, kind: "pending" as const, op: "neo4j-cluster", gate: "approve-node-1",
+        timestamp: "2026-09-05T10:00:00.000Z", expiresAt: "2026-09-07T10:00:00.000Z",
+      };
+      const legacy = {
+        version: 1 as const, op: "neo4j-cluster", gate: "approve-node-1",
+        resolvedBy: "alex", timestamp: "2026-09-05T11:00:00.000Z",
+      };
+      const port = memoryGateLedgerPort({ pending: [legacyPending], resolutions: [legacy] });
+      const result = await run(port, "prod");
+
+      expect(result.status).toBe("gated");
+      expect(port.appended).toHaveLength(1);
+      expect(result.gateMismatch).toMatchObject({ resolvedBy: "alex", environment: "prod" });
+      expect(result.gateMismatch!.approved).toBeUndefined();
+      const message = describeGateMismatch("neo4j-cluster", "approve-node-1", result.gateMismatch!);
+      expect(message).toContain("predates environment- and plan-bound component gates (#2574)");
+      expect(message).toContain("chant approve neo4j-cluster approve-node-1 --env prod");
+    });
+  });
+
   it("the neo4j pilot's gated Node 1 phase ends the run pending approval", async () => {
     const registry = new CapabilityRegistry();
     for (const kind of ["cfn-deploy", "code-deploy", "wait-cluster-healthy"]) {

package/src/components/driver.ts

@@ -47,9 +47,9 @@
  */
 
 import { topoSort } from "../codegen/topo-sort";
-import { evaluateGate, gitGateLedgerPort, type GateLedgerPort } from "../op/gate";
+import { evaluateGate, gitGateLedgerPort, type GateDigestMismatch, type GateLedgerPort } from "../op/gate";
 import { gateName } from "../op/gate-name";
-import { warnOnUnboundComponentApproval } from "./unbound-gate-approval";
+import { componentPlanDigest } from "./gate-plan";
 import type { PendingGateRecord } from "../lifecycle/gate-ledger";
 import type { CapabilityRegistry, DeployContext } from "./capability";
 import type { RunProgressEvent, RunProgressStatus } from "./run-progress";
@@ -168,6 +168,8 @@ export interface DriverComponentResult {
   gatePushed?: boolean;
   /** Set when `gatePushed` is false: why, in one line. */
   gatePushWarning?: string;
+  /** Present when `status === "gated"` because an approval stands for this gate, but for another plan or none (#2574). */
+  gateMismatch?: GateDigestMismatch;
 }
 
 export interface DriverRunResult {
@@ -189,6 +191,8 @@ export interface DriverRunResult {
   gatePushed?: boolean;
   /** Set when `gatePushed` is false: why, in one line. */
   gatePushWarning?: string;
+  /** Present when `status === "gated"` because an approval stands for another plan or none (#2574). */
+  gateMismatch?: GateDigestMismatch;
   /**
    * The accumulated cross-component/cross-stack outputs after the run — each
    * component's `publish` output and, for an applied stack, its `cfn-deploy`
@@ -371,6 +375,8 @@ class GateStop extends Error {
     /** Whether this run's own append reached the remote — see {@link DriverComponentResult.gatePushed} (#2310). */
     public readonly pushed?: boolean,
     public readonly pushWarning?: string,
+    /** Set when an approval stands for this gate but not for this plan (#2574). */
+    public readonly mismatch?: GateDigestMismatch,
   ) {
     super(`gate "${pending.gate}" is pending approval`);
     this.name = "GateStop";
@@ -386,6 +392,14 @@ function progressStatus(status: DriverComponentResult["status"]): RunProgressSta
 export interface GateContext {
   port: GateLedgerPort;
   now?: string;
+  /**
+   * The recorded digest each component is deployed at, for a promote or a
+   * rollback (#2574). It goes into the plan digest a gate approval is bound
+   * to, keyed by component name.
+   */
+  releases?: ReadonlyMap<string, string>;
+  /** This component's plan digest. Set by {@link runComponentDeploy}, never by a caller. */
+  planDigest?: string;
 }
 
 /** Run a single capability step. Never throws for a capability-run failure; returns a fail record instead. */
@@ -468,6 +482,9 @@ async function runPhase(
       const check = await evaluateGate(gates.port, {
         op: ctx.component,
         gate: gateName(gate),
+        // #2574: an approval counts only for this environment and this plan.
+        environment: ctx.env,
+        ...(gates.planDigest !== undefined ? { planDigest: gates.planDigest } : {}),
         ...(gate.description ? { description: gate.description } : {}),
         ...(gate.timeout ? { timeout: gate.timeout } : {}),
         ...(gates.now ? { now: gates.now } : {}),
@@ -478,9 +495,8 @@ async function runPhase(
         for (const skipped of phaseDef.steps.filter((s): s is DriverStep | DriverPhase => !isGateStep(s))) {
           gateRecords.push(skippedRecord(skipped));
         }
-        throw new GateStop(gateRecords, [], check.pending, check.pushed, check.pushWarning);
+        throw new GateStop(gateRecords, [], check.pending, check.pushed, check.pushWarning, check.mismatch);
       }
-      warnOnUnboundComponentApproval(ctx.component, gateName(gate), ctx.env, check.resolution);
       gateRecords.push({
         ...base,
         status: "ok" as const,
@@ -507,6 +523,7 @@ async function runPhase(
     pending?: PendingGateRecord;
     pushed?: boolean;
     pushWarning?: string;
+    mismatch?: GateDigestMismatch;
   }> => {
     if (isPhaseStep(entry)) {
       try {
@@ -524,6 +541,7 @@ async function runPhase(
             pending: err.pending,
             pushed: err.pushed,
             pushWarning: err.pushWarning,
+            mismatch: err.mismatch,
           };
         }
         throw err;
@@ -572,7 +590,7 @@ async function runPhase(
       const executed = results.flatMap((r) => r.executed);
       const withPending = results.find((r) => r.pending);
       if (withPending?.pending) {
-        throw new GateStop(records, executed, withPending.pending, withPending.pushed, withPending.pushWarning);
+        throw new GateStop(records, executed, withPending.pending, withPending.pushed, withPending.pushWarning, withPending.mismatch);
       }
       if (results.some((r) => r.failed)) throw new StepFailure(records, executed);
       return { records, executed };
@@ -586,7 +604,7 @@ async function runPhase(
       executed.push(...result.executed);
       if (result.pending) {
         for (const skipped of entries.slice(i + 1)) records.push(skippedRecord(skipped));
-        throw new GateStop(records, executed, result.pending, result.pushed, result.pushWarning);
+        throw new GateStop(records, executed, result.pending, result.pushed, result.pushWarning, result.mismatch);
       }
       if (result.failed) {
         for (const skipped of entries.slice(i + 1)) records.push(skippedRecord(skipped));
@@ -695,9 +713,22 @@ export async function runComponentDeploy(
   registry: CapabilityRegistry,
   componentOutputs: Record<string, Record<string, unknown>>,
   onProgress?: (event: RunProgressEvent) => void,
-  gates: GateContext = { port: gitGateLedgerPort() },
+  gateContext: GateContext = { port: gitGateLedgerPort() },
 ): Promise<DriverComponentResult> {
   const phaseOutputs: Record<string, Record<string, unknown>> = {};
+  // #2574: every gate this component reaches binds its approval to this
+  // environment and this composition, so an approval for staging or for last
+  // week's deploy cannot pass it.
+  const release = gateContext.releases?.get(component.name);
+  const gates: GateContext = {
+    ...gateContext,
+    planDigest: componentPlanDigest({
+      environment: ctx.env,
+      component,
+      ...(ctx.vars ? { vars: ctx.vars } : {}),
+      ...(release !== undefined ? { release } : {}),
+    }),
+  };
   const records: DriverStepRecord[] = [];
   const allExecuted: ExecutedStep[] = [];
 
@@ -722,6 +753,7 @@ export async function runComponentDeploy(
         gate: err.pending,
         ...(err.pushed !== undefined ? { gatePushed: err.pushed } : {}),
         ...(err.pushWarning ? { gatePushWarning: err.pushWarning } : {}),
+        ...(err.mismatch ? { gateMismatch: err.mismatch } : {}),
       };
     }
 
@@ -875,6 +907,8 @@ export interface InterpretRunOptions {
   gates?: GateLedgerPort;
   /** ISO-8601 "now" for gate decisions, so a test is deterministic. */
   now?: string;
+  /** The recorded digest a promote or rollback deploys, per component (#2574). Part of the plan a gate approval is bound to. */
+  releases?: ReadonlyMap<string, string>;
 }
 
 /**
@@ -908,6 +942,7 @@ export async function runInterpretDriver(
   const gates: GateContext = {
     port: options.gates ?? gitGateLedgerPort(),
     ...(options.now ? { now: options.now } : {}),
+    ...(options.releases ? { releases: options.releases } : {}),
   };
 
   onProgress?.({ type: "run-start", waves });
@@ -959,6 +994,7 @@ export async function runInterpretDriver(
           gate: gated.gate,
           ...(gated.gatePushed !== undefined ? { gatePushed: gated.gatePushed } : {}),
           ...(gated.gatePushWarning ? { gatePushWarning: gated.gatePushWarning } : {}),
+          ...(gated.gateMismatch ? { gateMismatch: gated.gateMismatch } : {}),
         }
       : {}),
   };

package/src/components/gate-plan.ts

@@ -0,0 +1,53 @@
+/**
+ * The plan a component gate approval is bound to (#2574).
+ *
+ * An Op gate binds the digest of the change set its Plan phase produced
+ * (#2300). A component has no Plan phase: what it will do is its composition,
+ * run against one environment. So the digest is taken over that, with the
+ * same `computePlanDigest` Op gates use.
+ *
+ * ## What it covers
+ *
+ * - The environment. An approval for staging never answers prod.
+ * - The composition as this run executes it: `deploy` and `rollback` phases
+ *   with every step's authored input. A promote and a rollback run a
+ *   transformed composition (`./promote.ts`), and a rollback's pins the
+ *   recorded digest into it, so each differs from a plain deploy's.
+ * - The release being deployed, when the caller names one. A promote checks
+ *   its publish output against a recorded digest that is not in the
+ *   composition, so it passes that digest here.
+ * - `vars`, the environment config the caller resolved ahead of the run.
+ *
+ * ## What it leaves out
+ *
+ * Anything decided during the run: outputs of earlier phases (a fresh build's
+ * digest differs on every build that is not reproducible, and binding it
+ * would make an approval unusable by the run that consumes it) and outputs of
+ * upstream components. The run id and the time are left out for the reasons
+ * `../lifecycle/plan-digest.ts` gives.
+ */
+
+import { computePlanDigest } from "../lifecycle/plan-digest";
+import type { DriverComponent } from "./driver";
+
+/** What a component gate's plan digest is taken over. */
+export interface ComponentGatePlan {
+  environment: string;
+  component: DriverComponent;
+  vars?: Record<string, unknown>;
+  /** The recorded digest a promote or rollback deploys, when the caller has one. */
+  release?: string;
+}
+
+/** The plan digest a component gate records and approves. */
+export function componentPlanDigest(plan: ComponentGatePlan): string {
+  const { component } = plan;
+  return computePlanDigest("component-deploy", {
+    environment: plan.environment,
+    component: component.name,
+    deploy: component.deploy,
+    rollback: component.rollback ?? null,
+    vars: plan.vars ?? null,
+    release: plan.release ?? null,
+  });
+}

package/src/components/promote.test.ts

@@ -4,20 +4,25 @@
 
 import { describe, test, expect } from "vitest";
 import { CapabilityRegistry, type DeployContext } from "./capability";
-import { memoryGateLedgerPort, type GateLedgerPort } from "../op/gate";
+import { describeGateMismatch, memoryGateLedgerPort, type GateLedgerPort } from "../op/gate";
+import { componentPlanDigest } from "./gate-plan";
 import type { GateResolutionRecord } from "../lifecycle/gate-ledger";
 import type { DriverComponent } from "./driver";
 import type { ReleaseRecord } from "../lifecycle/release-ledger";
 import {
   planPromotion,
   planRollback,
+  planRedeploy,
   rollbackRecord,
+  redeployRecord,
   selectRelease,
   withoutBuildSteps,
   runPromotion,
   promotionRecord,
   gateApprover,
   promoteArchivePaths,
+  hasPublishStep,
+  parseDigestPins,
   type PromotionPlan,
 } from "./promote";
 
@@ -102,6 +107,72 @@ describe("planning", () => {
   });
 });
 
+describe("pinning each component to a digest (#2602)", () => {
+  // api's pinned release is older than its latest one: another pipeline
+  // recorded sha256:newer while this one ran.
+  const records = [
+    rec("api", "staging", "sha256:built", "2026-01-02T00:00:00Z"),
+    rec("api", "staging", "sha256:newer", "2026-01-03T00:00:00Z"),
+    rec("web", "staging", "sha256:web", "2026-01-02T00:00:00Z"),
+    rec("infra", "staging", "sha256:infra", "2026-01-02T00:00:00Z"),
+  ];
+  const declared = ["api", "web", "infra"];
+
+  test("promotes exactly the pinned components at the pinned digests, not the latest", () => {
+    const plan = planPromotion({
+      from: "staging", to: "prod", sourceRecords: records, declared,
+      pins: { web: "sha256:web", api: "sha256:built" },
+    });
+    expect("items" in plan).toBe(true);
+    const { items, notPromoted } = plan as PromotionPlan;
+    expect(items.map((i) => [i.component, i.digest, i.source.timestamp])).toEqual([
+      ["api", "sha256:built", "2026-01-02T00:00:00Z"],
+      ["web", "sha256:web", "2026-01-02T00:00:00Z"],
+    ]);
+    expect(notPromoted).toEqual([]);
+  });
+
+  test("a pinned digest the source never recorded fails", () => {
+    const plan = planPromotion({ from: "staging", to: "prod", sourceRecords: records, declared, pins: { api: "sha256:nope" } });
+    expect("error" in plan && plan.error).toMatch(/sha256:nope is not recorded for "api" in "staging"/);
+  });
+
+  test("a pinned component this checkout does not declare fails", () => {
+    const plan = planPromotion({ from: "staging", to: "prod", sourceRecords: records, declared, pins: { gone: "sha256:x" } });
+    expect("error" in plan && plan.error).toMatch(/"gone" is not declared/);
+  });
+
+  test("pins and --component do not mix", () => {
+    const plan = planPromotion({ from: "staging", to: "prod", sourceRecords: records, declared, component: "api", pins: { api: "sha256:built" } });
+    expect("error" in plan && plan.error).toMatch(/does not take --component/);
+  });
+
+  test("parseDigestPins reads <component>=<digest> values", () => {
+    expect(parseDigestPins(["api=sha256:a", "web=sha256:w"])).toEqual({ pins: { api: "sha256:a", web: "sha256:w" } });
+    expect(parseDigestPins(["api=sha256:a", "api=sha256:a"])).toEqual({ pins: { api: "sha256:a" } });
+  });
+
+  test("parseDigestPins refuses an empty digest, a bare digest, and two digests for one component", () => {
+    const err = (values: string[]) => {
+      const parsed = parseDigestPins(values);
+      return "error" in parsed ? parsed.error : undefined;
+    };
+    expect(err(["api="])).toMatch(/names no digest; the run that deployed "api" recorded no release/);
+    expect(err(["sha256:a"])).toMatch(/needs --component/);
+    expect(err(["=sha256:a"])).toMatch(/names no component/);
+    expect(err(["api=sha256:a", "api=sha256:b"])).toMatch(/pins "api" twice/);
+  });
+
+  test("hasPublishStep finds a publish step, nested phases included", () => {
+    expect(hasPublishStep(service("api"))).toBe(true);
+    expect(hasPublishStep({ name: "infra", deploy: [{ phase: "Apply", steps: [{ kind: "apply" }] }] })).toBe(false);
+    expect(hasPublishStep({
+      name: "nested",
+      deploy: [{ phase: "Outer", steps: [{ phase: "Inner", steps: [{ kind: "publish-artifact" }] }] }],
+    })).toBe(true);
+  });
+});
+
 describe("taking the build out of a composition", () => {
   test("build steps go, publish and apply stay", () => {
     const prepared = withoutBuildSteps(service("api"));
@@ -216,10 +287,24 @@ describe("running a promotion", () => {
     expect(first.gate?.gate).toBe("prod-release");
     expect(ran).not.toContain("prod:api:apply");
 
-    resolutions.push({ version: 1, kind: "resolution", op: "api", gate: "prod-release", resolvedBy: "alice", timestamp: "2026-01-03T00:01:00Z" });
+    // `chant approve` copies the pending fact's environment and plan (#2574).
+    const bound = { planDigest: first.gate!.planDigest!, environment: first.gate!.environment! };
+    expect(bound.environment).toBe("prod");
+    resolutions.push({ version: 1, kind: "resolution", op: "api", gate: "prod-release", resolvedBy: "alice", timestamp: "2026-01-03T00:01:00Z", ...bound });
     const second = await runPromotion({ ...opts, now: "2026-01-03T00:02:00Z" });
     expect(second.status).toBe("ok");
     expect(gateApprover(second.results[0])).toBe("alice");
+
+    // The same approval does not pass a promote of another release (#2574).
+    const other = await runPromotion({
+      ...opts,
+      plan: planFor("api", "sha256:other"),
+      registry: fakeRegistry({ api: "sha256:other" }).registry,
+      now: "2026-01-03T00:03:00Z",
+    });
+    expect(other.status).toBe("gated");
+    expect(other.gateMismatch).toMatchObject({ approved: bound.planDigest, resolvedBy: "alice", environment: "prod" });
+    expect(other.gate?.planDigest).not.toBe(bound.planDigest);
   });
 
   test("dependencies outside the promotion do not block it", async () => {
@@ -300,6 +385,195 @@ describe("choosing the release a rollback restores", () => {
   });
 });
 
+describe("choosing the release a redeploy puts back (#2604)", () => {
+  const history = [
+    rec("api", "prod", "sha256:a", "2026-01-01T00:00:00Z"),
+    rec("api", "prod", "sha256:b", "2026-01-02T00:00:00Z", "run-2"),
+  ];
+  const plan = (input: Partial<Parameters<typeof planRedeploy>[0]>) =>
+    planRedeploy({ env: "prod", records: history, declared: ["api"], component: "api", ...input });
+
+  test("the release the ledger records as current", () => {
+    const p = plan({});
+    if ("error" in p) throw new Error(p.error);
+    expect(p.from).toBe("prod");
+    expect(p.to).toBe("prod");
+    expect(p.items).toEqual([{ component: "api", digest: "sha256:b", source: history[1] }]);
+  });
+
+  test("a --digest naming the current release is accepted", () => {
+    const p = plan({ digest: "sha256:b" });
+    expect("items" in p && p.items[0].digest).toBe("sha256:b");
+  });
+
+  test("a --digest naming any other release is refused and points at rollback", () => {
+    const p = plan({ digest: "sha256:a" });
+    expect("error" in p && p.error).toMatch(/sha256:a is not the current release of "api" in "prod" \(that is sha256:b\)/);
+    expect("error" in p && p.error).toMatch(/chant components rollback prod --component api --digest sha256:a/);
+  });
+
+  test("a component with no release in the environment is refused", () => {
+    const p = plan({ records: [] });
+    expect("error" in p && p.error).toMatch(/no release of "api" is recorded in "prod"/);
+  });
+
+  test("a component this checkout does not declare is refused", () => {
+    const p = plan({ declared: ["web"] });
+    expect("error" in p && p.error).toMatch(/not declared in this checkout/);
+  });
+
+  test("the record names the release it put back", () => {
+    const p = plan({});
+    if ("error" in p) throw new Error(p.error);
+    const record = redeployRecord(p.items[0], "prod", { runId: "run-5", actor: "bob", timestamp: "2026-01-05T00:00:00Z" });
+    expect(record).toMatchObject({
+      env: "prod",
+      digest: "sha256:b",
+      redeploys: { env: "prod", runId: "run-2", timestamp: "2026-01-02T00:00:00Z" },
+    });
+    expect(record).not.toHaveProperty("restores");
+    expect(record).not.toHaveProperty("promotedFrom");
+  });
+
+  test("a refusal from the pinned composition names the redeploy", () => {
+    const c = service("api");
+    c.deploy[2].steps[0] = { kind: "apply", image: "@Publish.uri" };
+    const p = withoutBuildSteps(c, { pinDigest: "sha256:b", verb: "a redeploy" });
+    expect("error" in p && p.error).toMatch(/but a redeploy knows only the recorded digest/);
+  });
+});
+
+describe("a redeploy's gate approval is bound like a rollback's (#2574, #2604)", () => {
+  /** A gated service, pinned the way `chant components redeploy` pins it. */
+  const gatedService = (): DriverComponent => {
+    const c = service("api");
+    c.deploy[2].steps.unshift({ kind: "gate", gate: "prod-release" });
+    return c;
+  };
+  const pinned = (digest: string): DriverComponent => {
+    const p = withoutBuildSteps(gatedService(), { pinDigest: digest, verb: "a redeploy" });
+    if ("error" in p) throw new Error(p.error);
+    return p.component;
+  };
+  const redeployOf = (records: ReleaseRecord[]): PromotionPlan => {
+    const p = planRedeploy({ env: "prod", records, declared: ["api"], component: "api" });
+    if ("error" in p) throw new Error(p.error);
+    return p;
+  };
+  /** A ledger port whose resolutions the test writes, as `chant approve` would. */
+  const ledger = () => {
+    const resolutions: GateResolutionRecord[] = [];
+    const memory = memoryGateLedgerPort();
+    const gates: GateLedgerPort = {
+      async read(op) {
+        const read = await memory.read(op);
+        return { ...read, resolutions: [...resolutions] };
+      },
+      appendPending: (input) => memory.appendPending(input),
+    };
+    return { resolutions, gates };
+  };
+  const approval = (bound: Partial<GateResolutionRecord>, timestamp: string): GateResolutionRecord => ({
+    version: 1,
+    kind: "resolution",
+    op: "api",
+    gate: "prod-release",
+    resolvedBy: "alice",
+    timestamp,
+    ...bound,
+  });
+
+  test("the pending fact records prod and the redeploy's plan, and an approval of it lets the same redeploy through", async () => {
+    const { resolutions, gates } = ledger();
+    const { registry, ran } = fakeRegistry({ api: "sha256:unused" });
+    const plan = redeployOf([rec("api", "prod", "sha256:b", "2026-01-02T00:00:00Z", "run-2")]);
+    const opts = { plan, components: [pinned("sha256:b")], registry, gates };
+
+    const first = await runPromotion({ ...opts, now: "2026-01-05T00:00:00Z" });
+    expect(first.status).toBe("gated");
+    expect(first.gate?.environment).toBe("prod");
+    expect(first.gate?.planDigest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(ran).toEqual([]);
+
+    resolutions.push(approval({ planDigest: first.gate!.planDigest!, environment: "prod" }, "2026-01-05T00:01:00Z"));
+    const second = await runPromotion({ ...opts, now: "2026-01-05T00:02:00Z" });
+    expect(second.status).toBe("ok");
+    expect(gateApprover(second.results[0])).toBe("alice");
+    expect(ran).toEqual(["prod:api:apply"]);
+  });
+
+  test("an approval for another environment, for a plain deploy, or from before #2574 does not pass it", async () => {
+    const { resolutions, gates } = ledger();
+    const { registry, ran } = fakeRegistry({ api: "sha256:unused" });
+    const plan = redeployOf([rec("api", "prod", "sha256:b", "2026-01-02T00:00:00Z", "run-2")]);
+    const opts = { plan, components: [pinned("sha256:b")], registry, gates };
+    const first = await runPromotion({ ...opts, now: "2026-01-05T00:00:00Z" });
+    const planned = first.gate!.planDigest!;
+
+    // The same plan approved for staging is not read at all in prod.
+    resolutions.push(approval({ planDigest: planned, environment: "staging" }, "2026-01-05T00:01:00Z"));
+    const staging = await runPromotion({ ...opts, now: "2026-01-05T00:02:00Z" });
+    expect(staging.status).toBe("gated");
+    expect(staging.gateMismatch).toBeUndefined();
+
+    // An approval of a plain deploy to prod is for another plan.
+    const deployPlan = componentPlanDigest({ environment: "prod", component: gatedService() });
+    resolutions.push(approval({ planDigest: deployPlan, environment: "prod" }, "2026-01-05T00:03:00Z"));
+    const plain = await runPromotion({ ...opts, now: "2026-01-05T00:04:00Z" });
+    expect(plain.status).toBe("gated");
+    expect(plain.gateMismatch).toMatchObject({ approved: deployPlan, planned, environment: "prod" });
+
+    // One recorded before #2574 names neither, and the refusal says how to approve again.
+    resolutions.push(approval({}, "2026-01-05T00:05:00Z"));
+    const old = await runPromotion({ ...opts, now: "2026-01-05T00:06:00Z" });
+    expect(old.status).toBe("gated");
+    expect(old.gateMismatch).toMatchObject({ planned, environment: "prod" });
+    expect(old.gateMismatch?.approved).toBeUndefined();
+    expect(describeGateMismatch("api", "prod-release", old.gateMismatch!)).toMatch(
+      /predates environment- and plan-bound component gates \(#2574\).*chant approve api prod-release --env prod$/,
+    );
+    expect(ran).toEqual([]);
+  });
+
+  test("an approval of one redeploy does not pass a redeploy of a release recorded since", async () => {
+    const { resolutions, gates } = ledger();
+    const { registry } = fakeRegistry({ api: "sha256:unused" });
+    const b = rec("api", "prod", "sha256:b", "2026-01-02T00:00:00Z", "run-2");
+    const first = await runPromotion({ plan: redeployOf([b]), components: [pinned("sha256:b")], registry, gates, now: "2026-01-05T00:00:00Z" });
+    const approved = first.gate!.planDigest!;
+    resolutions.push(approval({ planDigest: approved, environment: "prod" }, "2026-01-05T00:01:00Z"));
+
+    const c = rec("api", "prod", "sha256:c", "2026-01-06T00:00:00Z", "run-3");
+    const next = await runPromotion({ plan: redeployOf([b, c]), components: [pinned("sha256:c")], registry, gates, now: "2026-01-06T00:01:00Z" });
+    expect(next.status).toBe("gated");
+    expect(next.gateMismatch).toMatchObject({ approved, resolvedBy: "alice", environment: "prod" });
+    expect(next.gate?.planDigest).not.toBe(approved);
+  });
+
+  test("a current release recorded with a legacy digest (#2514) binds the approval to that digest as recorded", async () => {
+    const legacy = `sha256:${"0a1b2c3d".repeat(8)}`;
+    const { resolutions, gates } = ledger();
+    const { registry, ran } = fakeRegistry({ api: "sha256:unused" });
+    const opts = {
+      plan: redeployOf([rec("api", "prod", legacy, "2026-01-02T00:00:00Z", "run-2")]),
+      components: [pinned(legacy)],
+      registry,
+      gates,
+    };
+    const first = await runPromotion({ ...opts, now: "2026-01-05T00:00:00Z" });
+    expect(first.status).toBe("gated");
+    const planned = first.gate!.planDigest!;
+    expect(planned).toBe(componentPlanDigest({ environment: "prod", component: pinned(legacy), release: legacy }));
+    expect(planned).not.toBe(legacy);
+
+    resolutions.push(approval({ planDigest: planned, environment: "prod" }, "2026-01-05T00:01:00Z"));
+    const second = await runPromotion({ ...opts, now: "2026-01-05T00:02:00Z" });
+    expect(second.status).toBe("ok");
+    expect(second.results[0].records.find((r) => r.kind === "apply")?.output).toEqual({ applied: legacy });
+    expect(ran).toEqual(["prod:api:apply"]);
+  });
+});
+
 describe("pinning the publish step for a rollback", () => {
   test("the publish step is replaced by the recorded digest", () => {
     const p = withoutBuildSteps(service("api"), { pinDigest: "sha256:b" });