Lab #3138: extension push offers to promote a yanked version, and extension promote does not check for a yank

Summary

The CLI treats a yanked version like any other published version in both promote paths. extension push offers to promote a yanked version that sits on a lower channel. extension promote sends a yanked version to the server without checking first. Today the server accepts that promote (swamp-club#3040). Once #3040 is fixed the server refuses it, and the author gets an error only after picking an option the CLI should never have shown.

Where

Seen at swamp 0387ae0a.

src/libswamp/extensions/published_version_lookup.ts findPublishedVersion reads only version and channel from /api/v1/extensions/<name>/versions. The response already includes yankedAt (and the version view carries the yank), but the lookup drops it, so PublishedVersion cannot say a version is yanked.
src/domain/extensions/extension_publish_checks.ts evaluateVersionExists and src/cli/commands/extension_push.ts resolveExistingVersionResponse give choose (promote / bump / stop) for a version on a lower channel, even when that version is yanked.
src/libswamp/extensions/promote.ts extensionPromote (the resolveFromChannel path) checks the channel order but not the yank before calling the server.
src/infrastructure/http/extension_api_client.ts checkResponse keeps only the body's error and drops other fields such as reason.

Reproduce

swamp extension push <manifest> -y --channel beta          # @ns/ext@V on beta
swamp extension yank @ns/ext@V --reason test -y
swamp extension push <manifest> --channel rc               # interactive: offers "promote"
swamp extension promote @ns/ext V --channel rc             # calls the server without checking

Expected

The version stays taken after a yank, so push still refuses to re-publish it. But it should offer only bump or stop, and say the version is yanked, with the reason.
extension promote fails before calling the server, naming the yank and the reason.

Notes

The server-side refusal is swamp-club#3040: promote of a yanked version (or of a version of a yanked extension) returns 409 with error naming the yank and its reason. That is the guarantee; this issue covers the CLI experience only. The yanked versions must stay in the /versions list, because version uniqueness covers them.

@swamp/hetzner-cloud/servers: add power actions (poweron, shutdown, poweroff, reboot, reset)

serve check-config writes the extension catalog into the repo, though its help says nothing is written

extension push offers to promote a yanked version, and extension promote does not check for a yank

Manual: additionalFiles and binaries entries must be files, not directories

serve: token secret migration repoints a token even when copying its OAuth access token failed

Docs: extension push dry-run authentication verdict names the credential (follow-up to Lab 3088)

Docs: serve restricted-model-types matches any @ spelling; restriction warnings in serve and check-config

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

serve check-config: decide how to report restricted-model-types entries that cannot match

Session-start 'swamp model search --json' in the AGENTS.md template is unfulfillable - wire it to a hook or drop it

Flaky property test: analyzeExpression dot/bracket agreement fails when the generated model name is a CEL keyword

Accept usernames for user subjects in grant files

Docs: enable-managed-config should say to re-run config migrate when its push fails

Docs: grant file reference shows a stale format and omits resources and subjects

Flaky property test: analyzeExpression hyphenated dot access fails when modelName generates a CEL keyword ("in")

Docs: extension publishing reference is stale on bare specifiers, quality output and fmt config (swamp-club#3022)

swamp-extensions: replace bare import specifiers with npm:/jsr: specifiers in first-party extensions

A nested structural swamp that outlives the run that started it keeps skipping that run's lock while the holder writes

Show signal waits to remote clients and the dashboard

Settle expired signal waits from swamp serve

extension push/quality: structured acceptances for agents, a clearer title than For next time, and an optional reason

extension push: the undecided private-entitlement verdict still says the registry may start a trial at publish

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

Replayable state fragments: Git-reviewable desired state for resources changed by model methods

extension push: registry metadata and content hash label files relative to the repo dir, so a push with --extensions-dir records ../ paths

registry: store and show declared acceptances sent in contentMetadata.acceptances at confirm (swamp-club#3021)

serve HA: worker enrollment on a replica that lacks the enrollment token's definition may create a second definition (unverified)

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

Search and list output follows directory iteration order in the definition, workflow, vault and output repositories

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

Workflow load errors print the raw Zod issue dump instead of a readable message

Decide a stricter naming rule for workflow step and job names

serve: run scheduled workflows concurrently (per-workflow serialization), and report queue delay

Show expired approval gates as expired, with a Cancel action in the dashboard

digitalocean codegen leaves an orphaned security_secret.ts model file after its endpoint left the spec

Docs: doctor install reports a stale or failing autoupdate scheduler

auto-resolve: the Installing line prints the extension's entire multi-line description

s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards

Publish agent-facing projections of the manual: /llms.txt, .md pages, and llms-full.txt

Let agent-runner drive more agent CLIs (Kilo Code and others)

s3-datastore: every fast-path miss re-downloads every _index shard, so a busy serve pulls the whole index every poll (~230 GB/day S3 egress)

Feedback: Swamp as an approval-gated control plane for a small fleet

extension safety analyzer's Deno.Command( warning is a plain substring match

Tell timeouts apart from cancels in method-run records, and review the hidden 30 s fallback timer for step-called model methods

Run from a git worktree: definitions from the worktree, state from the shared repo

S3/GCS datastore: a push that fails after uploading drops its recorded deletes, so the retry brings deleted data back

Tests: bring the in-memory remote's default semantics up to @swamp/s3-datastore and @swamp/gcs-datastore 2026.10.01.1

Tell the pushing client when its extension contentMetadata fails validation

Extension datastore: query still returns an item after its delete is pulled

Cancel, reject and supersede of a parent run should settle its suspended nested child runs

Relationships

#3138 extension push offers to promote a yanked version, and extension promote does not check for a yank

Summary

Where

Reproduce

Expected

Notes

Open