From baf1e9f0d1ab81408add67c668a121462866207e Mon Sep 17 00:00:00 2001
From: Martin Donadieu <martindonadieu@gmail.com>
Date: Sat, 1 Aug 2026 10:54:13 +0300
Subject: [PATCH 1/3] fix(channel): unlink rollout bundle when progressive
 rollout is disabled

Leaving the second bundle attached after disable looked broken in the console; clear rollout_version (and pause state) across API, console, and CLI.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 cli/src/channel/set.ts                        |  7 +++++-
 cli/src/index.ts                              |  2 +-
 src/pages/app/[app].channel.[channel].vue     | 21 ++++++++++++++--
 .../functions/_backend/public/channel/post.ts |  8 ++++++
 tests/channel-post.unit.test.ts               | 25 +++++++++++++++++++
 5 files changed, 59 insertions(+), 4 deletions(-)

diff --git a/cli/src/channel/set.ts b/cli/src/channel/set.ts
index 2991122b59..b34713aa67 100644
--- a/cli/src/channel/set.ts
+++ b/cli/src/channel/set.ts
@@ -424,8 +424,13 @@ export async function setChannelInternal(channel: string, appId: string, options
 
   if (rolloutEnable != null)
     channelPayload.rollout_enabled = !!rolloutEnable
-  if (rolloutDisable)
+  if (rolloutDisable) {
+    bundleLinkChanged = bundleLinkChanged || existingChannel.rollout_version != null
     channelPayload.rollout_enabled = false
+    channelPayload.rollout_version = null
+    channelPayload.rollout_paused_at = null
+    channelPayload.rollout_pause_reason = null
+  }
 
   if (rolloutPause) {
     channelPayload.rollout_paused_at = new Date().toISOString()
diff --git a/cli/src/index.ts b/cli/src/index.ts
index 2733585309..eb2b5f2ee2 100644
--- a/cli/src/index.ts
+++ b/cli/src/index.ts
@@ -583,7 +583,7 @@ Example: npx @capgo/cli@latest channel set production com.example.app --bundle 1
   .option('--rollout-percentage <rolloutPercentage>', `Rollout percentage from 0 to 100`, value => Number.parseFloat(value))
   .option('--rollout-percentage-bps <rolloutPercentageBps>', `Rollout percentage in basis points from 0 to 10000`, value => Number.parseInt(value, 10))
   .option('--rollout-enable', `Enable the configured rollout`)
-  .option('--rollout-disable', `Disable the configured rollout`)
+  .option('--rollout-disable', `Disable the configured rollout and unlink the rollout bundle`)
   .option('--rollout-pause', `Pause rollout exposure without rolling back selected devices`)
   .option('--rollout-resume', `Resume a paused rollout`)
   .option('--rollout-rollback', `Clear rollout state and return devices to stable`)
diff --git a/src/pages/app/[app].channel.[channel].vue b/src/pages/app/[app].channel.[channel].vue
index 14cb44ba01..14cf2bd515 100644
--- a/src/pages/app/[app].channel.[channel].vue
+++ b/src/pages/app/[app].channel.[channel].vue
@@ -234,7 +234,13 @@ async function getChannel(force = false) {
 async function saveChannelChanges(update: ChannelUpdate) {
   const changesStableVersion = Object.prototype.hasOwnProperty.call(update, 'version')
   const changesRolloutVersion = Object.prototype.hasOwnProperty.call(update, 'rollout_version')
-  const canUpdate = changesStableVersion || changesRolloutVersion
+  // Disable unlinks the rollout target; keep that on channel settings permission like the enable/disable toggle.
+  const isDisableRolloutUnlink = update.rollout_enabled === false
+    && Object.prototype.hasOwnProperty.call(update, 'rollout_version')
+    && update.rollout_version === null
+    && !Object.prototype.hasOwnProperty.call(update, 'version')
+    && !Object.prototype.hasOwnProperty.call(update, 'rollout_percentage_bps')
+  const canUpdate = (changesStableVersion || (changesRolloutVersion && !isDisableRolloutUnlink))
     ? canPromoteBundle.value
     : canUpdateChannelSettings.value
 
@@ -589,6 +595,17 @@ async function enableRollout() {
   await saveChannelChange('rollout_enabled', true as any)
 }
 
+async function disableRollout() {
+  if (await saveChannelChanges({
+    rollout_enabled: false,
+    rollout_version: null,
+    rollout_paused_at: null,
+    rollout_pause_reason: null,
+  })) {
+    await askUpdateNotificationAfterBundleChange()
+  }
+}
+
 async function saveRolloutPercentage(value: string) {
   const percentage = Number.parseFloat(value)
   if (Number.isNaN(percentage) || percentage < 0 || percentage > 100) {
@@ -1051,7 +1068,7 @@ async function copyCurlCommand() {
                       <button class="min-h-11 d-btn d-btn-ghost" :disabled="!canPromoteBundle" @click="openSelectRolloutVersion()">
                         {{ t('set-rollout-target') }}
                       </button>
-                      <button class="min-h-11 d-btn d-btn-outline" :disabled="rolloutActionsDisabled" @click="saveChannelChange('rollout_enabled', !channel.rollout_enabled as any)">
+                      <button class="min-h-11 d-btn d-btn-outline" :disabled="rolloutActionsDisabled" @click="channel.rollout_enabled ? disableRollout() : enableRollout()">
                         {{ channel.rollout_enabled ? t('disable') : t('enable') }}
                       </button>
                       <button class="min-h-11 d-btn d-btn-outline" :disabled="rolloutPauseDisabled" @click="toggleRolloutPause()">
diff --git a/supabase/functions/_backend/public/channel/post.ts b/supabase/functions/_backend/public/channel/post.ts
index 9cb56294a5..aa6f3d5e5a 100644
--- a/supabase/functions/_backend/public/channel/post.ts
+++ b/supabase/functions/_backend/public/channel/post.ts
@@ -470,6 +470,14 @@ export async function post(c: Context<MiddlewareKeyVariables>, body: ChannelSet,
     channel.rollout_paused_at = null
     channel.rollout_pause_reason = null
   }
+
+  // Disabling progressive rollout unlinks the second bundle so both stay connected only while rollout is active.
+  if (body.rolloutEnabled === false && body.rolloutVersion === undefined && !body.rollback && !body.promoteToStable) {
+    channel.rollout_version = null
+    channel.rollout_paused_at = null
+    channel.rollout_pause_reason = null
+  }
+
   if (!existingChannel && requestedVersionName) {
     const createdChannel = await createAndPromoteChannelInTransaction(c, channel, requestedVersionName, apikey)
     return c.json({ ...BRES, ...createdChannel })
diff --git a/tests/channel-post.unit.test.ts b/tests/channel-post.unit.test.ts
index 79879f5fbb..6e1bd885cc 100644
--- a/tests/channel-post.unit.test.ts
+++ b/tests/channel-post.unit.test.ts
@@ -342,6 +342,31 @@ describe('public channel post', () => {
     expect(updateOrCreateChannel).toHaveBeenCalledWith(c, expect.objectContaining({ version: 456, rollout_version: null }), 42, false)
   })
 
+  it('unlinks the rollout bundle when progressive rollout is disabled', async () => {
+    supabaseAdmin.mockImplementation(() => buildAdminChain({
+      existingChannelId: 42,
+      existingChannelVersion: 123,
+      existingRolloutVersion: 456,
+    }))
+    const { post } = await import('../supabase/functions/_backend/public/channel/post.ts')
+    const c = context()
+
+    await post(c, {
+      app_id: 'com.test.disable-rollout',
+      channel: 'production',
+      rolloutEnabled: false,
+    }, apiKey())
+
+    expect(checkPermission).toHaveBeenCalledWith(c, 'channel.update_settings', { appId: 'com.test.disable-rollout', channelId: 42 })
+    expect(checkPermission).not.toHaveBeenCalledWith(c, 'channel.promote_bundle', expect.anything())
+    expect(updateOrCreateChannel).toHaveBeenCalledWith(c, expect.objectContaining({
+      rollout_enabled: false,
+      rollout_version: null,
+      rollout_paused_at: null,
+      rollout_pause_reason: null,
+    }), 42, true)
+  })
+
   it('creates and promotes a new channel in one transaction after its scoped grant exists', async () => {
     const { post } = await import('../supabase/functions/_backend/public/channel/post.ts')
     const c = context()

From 48bd5a615e4b3b6fbbe8c355066b8902b999174c Mon Sep 17 00:00:00 2001
From: Martin Donadieu <martindonadieu@gmail.com>
Date: Sun, 2 Aug 2026 15:31:42 +0300
Subject: [PATCH 2/3] fix(channel): align disable-unlink with promote_bundle
 trigger

Require promote when unlinking on disable, and always clear rollout_version even if the request also sends a rollout target.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 cli/src/channel/set.ts                        |  2 +-
 src/pages/app/[app].channel.[channel].vue     | 11 ++---
 .../functions/_backend/public/channel/post.ts | 11 +++--
 tests/channel-post.unit.test.ts               | 48 ++++++++++++++++++-
 4 files changed, 59 insertions(+), 13 deletions(-)

diff --git a/cli/src/channel/set.ts b/cli/src/channel/set.ts
index b34713aa67..c307fa264d 100644
--- a/cli/src/channel/set.ts
+++ b/cli/src/channel/set.ts
@@ -190,7 +190,7 @@ export async function setChannelInternal(channel: string, appId: string, options
   }
 
   const hasStableBundlePromotion = bundle != null || latest === true || latestRemote === true
-  const hasRolloutTargetChange = rolloutBundle != null || rolloutRollback === true || rolloutPromote === true
+  const hasRolloutTargetChange = rolloutBundle != null || rolloutRollback === true || rolloutPromote === true || rolloutDisable === true
   const hasRolloutConfiguration = rolloutPercentage != null
     || rolloutPercentageBps != null
     || rolloutEnable != null
diff --git a/src/pages/app/[app].channel.[channel].vue b/src/pages/app/[app].channel.[channel].vue
index 14cf2bd515..0ec3dd1763 100644
--- a/src/pages/app/[app].channel.[channel].vue
+++ b/src/pages/app/[app].channel.[channel].vue
@@ -234,13 +234,8 @@ async function getChannel(force = false) {
 async function saveChannelChanges(update: ChannelUpdate) {
   const changesStableVersion = Object.prototype.hasOwnProperty.call(update, 'version')
   const changesRolloutVersion = Object.prototype.hasOwnProperty.call(update, 'rollout_version')
-  // Disable unlinks the rollout target; keep that on channel settings permission like the enable/disable toggle.
-  const isDisableRolloutUnlink = update.rollout_enabled === false
-    && Object.prototype.hasOwnProperty.call(update, 'rollout_version')
-    && update.rollout_version === null
-    && !Object.prototype.hasOwnProperty.call(update, 'version')
-    && !Object.prototype.hasOwnProperty.call(update, 'rollout_percentage_bps')
-  const canUpdate = (changesStableVersion || (changesRolloutVersion && !isDisableRolloutUnlink))
+  // Unlinking rollout_version (including disable) requires promote_bundle — matches refresh_channel_rollout_id.
+  const canUpdate = changesStableVersion || changesRolloutVersion
     ? canPromoteBundle.value
     : canUpdateChannelSettings.value
 
@@ -1068,7 +1063,7 @@ async function copyCurlCommand() {
                       <button class="min-h-11 d-btn d-btn-ghost" :disabled="!canPromoteBundle" @click="openSelectRolloutVersion()">
                         {{ t('set-rollout-target') }}
                       </button>
-                      <button class="min-h-11 d-btn d-btn-outline" :disabled="rolloutActionsDisabled" @click="channel.rollout_enabled ? disableRollout() : enableRollout()">
+                      <button class="min-h-11 d-btn d-btn-outline" :disabled="channel.rollout_enabled ? rolloutTargetActionsDisabled : rolloutEnableDisabled" @click="channel.rollout_enabled ? disableRollout() : enableRollout()">
                         {{ channel.rollout_enabled ? t('disable') : t('enable') }}
                       </button>
                       <button class="min-h-11 d-btn d-btn-outline" :disabled="rolloutPauseDisabled" @click="toggleRolloutPause()">
diff --git a/supabase/functions/_backend/public/channel/post.ts b/supabase/functions/_backend/public/channel/post.ts
index aa6f3d5e5a..58f58ffb3e 100644
--- a/supabase/functions/_backend/public/channel/post.ts
+++ b/supabase/functions/_backend/public/channel/post.ts
@@ -390,7 +390,12 @@ export async function post(c: Context<MiddlewareKeyVariables>, body: ChannelSet,
   if (body.autoPauseAction && !['pause', 'rollback', 'notify'].includes(body.autoPauseAction)) {
     throw simpleError('invalid_auto_pause_action', 'Auto-pause action must be pause, rollback, or notify', { autoPauseAction: body.autoPauseAction })
   }
-  const changesRolloutTarget = body.rolloutVersion !== undefined || !!body.rollback || !!body.promoteToStable
+  const disablesRollout = body.rolloutEnabled === false && !body.rollback && !body.promoteToStable
+  // Clearing rollout_version (disable unlink / explicit target / rollback / promote) is gated by the DB trigger with channel.promote_bundle.
+  const changesRolloutTarget = body.rolloutVersion !== undefined
+    || !!body.rollback
+    || !!body.promoteToStable
+    || (disablesRollout && existingRolloutVersion != null)
   if (changesRolloutTarget) {
     if (existingChannelId === null) {
       throw simpleError('cannot_find_channel', 'Cannot find channel', { app_id: body.app_id, channel: body.channel })
@@ -471,8 +476,8 @@ export async function post(c: Context<MiddlewareKeyVariables>, body: ChannelSet,
     channel.rollout_pause_reason = null
   }
 
-  // Disabling progressive rollout unlinks the second bundle so both stay connected only while rollout is active.
-  if (body.rolloutEnabled === false && body.rolloutVersion === undefined && !body.rollback && !body.promoteToStable) {
+  // Disabling progressive rollout always unlinks the second bundle (ignore any parallel rolloutVersion).
+  if (disablesRollout) {
     channel.rollout_version = null
     channel.rollout_paused_at = null
     channel.rollout_pause_reason = null
diff --git a/tests/channel-post.unit.test.ts b/tests/channel-post.unit.test.ts
index 6e1bd885cc..b2f56432b0 100644
--- a/tests/channel-post.unit.test.ts
+++ b/tests/channel-post.unit.test.ts
@@ -358,7 +358,7 @@ describe('public channel post', () => {
     }, apiKey())
 
     expect(checkPermission).toHaveBeenCalledWith(c, 'channel.update_settings', { appId: 'com.test.disable-rollout', channelId: 42 })
-    expect(checkPermission).not.toHaveBeenCalledWith(c, 'channel.promote_bundle', expect.anything())
+    expect(checkPermission).toHaveBeenCalledWith(c, 'channel.promote_bundle', { appId: 'com.test.disable-rollout', channelId: 42 })
     expect(updateOrCreateChannel).toHaveBeenCalledWith(c, expect.objectContaining({
       rollout_enabled: false,
       rollout_version: null,
@@ -367,6 +367,52 @@ describe('public channel post', () => {
     }), 42, true)
   })
 
+  it('forces unlink on disable even when rolloutVersion is also sent', async () => {
+    supabaseAdmin.mockImplementation(() => buildAdminChain({
+      existingChannelId: 42,
+      existingChannelVersion: 123,
+      existingRolloutVersion: 456,
+      versionId: 789,
+    }))
+    const { post } = await import('../supabase/functions/_backend/public/channel/post.ts')
+    const c = context()
+
+    await post(c, {
+      app_id: 'com.test.disable-with-version',
+      channel: 'production',
+      rolloutEnabled: false,
+      rolloutVersion: '2.0.0',
+    }, apiKey())
+
+    expect(updateOrCreateChannel).toHaveBeenCalledWith(c, expect.objectContaining({
+      rollout_enabled: false,
+      rollout_version: null,
+    }), 42, true)
+  })
+
+  it('does not require promote when disabling with no linked rollout bundle', async () => {
+    supabaseAdmin.mockImplementation(() => buildAdminChain({
+      existingChannelId: 42,
+      existingChannelVersion: 123,
+      existingRolloutVersion: null,
+    }))
+    const { post } = await import('../supabase/functions/_backend/public/channel/post.ts')
+    const c = context()
+
+    await post(c, {
+      app_id: 'com.test.disable-no-rollout',
+      channel: 'production',
+      rolloutEnabled: false,
+    }, apiKey())
+
+    expect(checkPermission).toHaveBeenCalledWith(c, 'channel.update_settings', { appId: 'com.test.disable-no-rollout', channelId: 42 })
+    expect(checkPermission).not.toHaveBeenCalledWith(c, 'channel.promote_bundle', expect.anything())
+    expect(updateOrCreateChannel).toHaveBeenCalledWith(c, expect.objectContaining({
+      rollout_enabled: false,
+      rollout_version: null,
+    }), 42, true)
+  })
+
   it('creates and promotes a new channel in one transaction after its scoped grant exists', async () => {
     const { post } = await import('../supabase/functions/_backend/public/channel/post.ts')
     const c = context()

From 23bcf1bff727206092da4b688301420b09226e3c Mon Sep 17 00:00:00 2001
From: Martin Donadieu <martindonadieu@gmail.com>
Date: Sun, 2 Aug 2026 15:39:24 +0300
Subject: [PATCH 3/3] fix(channel): gate disable promote only when unlinking

CLI checks promote_bundle on --rollout-disable only if a rollout bundle is linked; console Disable needs both promote and update_settings.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 cli/src/channel/set.ts                    | 6 ++++--
 src/pages/app/[app].channel.[channel].vue | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/cli/src/channel/set.ts b/cli/src/channel/set.ts
index c307fa264d..3103c30881 100644
--- a/cli/src/channel/set.ts
+++ b/cli/src/channel/set.ts
@@ -190,7 +190,7 @@ export async function setChannelInternal(channel: string, appId: string, options
   }
 
   const hasStableBundlePromotion = bundle != null || latest === true || latestRemote === true
-  const hasRolloutTargetChange = rolloutBundle != null || rolloutRollback === true || rolloutPromote === true || rolloutDisable === true
+  const hasRolloutTargetChange = rolloutBundle != null || rolloutRollback === true || rolloutPromote === true
   const hasRolloutConfiguration = rolloutPercentage != null
     || rolloutPercentageBps != null
     || rolloutEnable != null
@@ -227,9 +227,11 @@ export async function setChannelInternal(channel: string, appId: string, options
     throw new Error(`Cannot find channel ${channel}`)
   }
 
+  // Disable unlinks only when a rollout bundle is linked; match API promote gating.
+  const disableUnlinksRollout = rolloutDisable === true && existingChannel.rollout_version != null
   if (hasSettingsUpdate)
     await checkAppExistsAndHasPermissionOrgErr(supabase, options.apikey, appId, 'channel.update_settings', silent, true, existingChannel.id)
-  if (hasBundlePromotion)
+  if (hasBundlePromotion || disableUnlinksRollout)
     await checkAppExistsAndHasPermissionOrgErr(supabase, options.apikey, appId, 'channel.promote_bundle', silent, true, existingChannel.id)
 
   const orgId = existingChannel.owner_org
diff --git a/src/pages/app/[app].channel.[channel].vue b/src/pages/app/[app].channel.[channel].vue
index 0ec3dd1763..de4b069c6c 100644
--- a/src/pages/app/[app].channel.[channel].vue
+++ b/src/pages/app/[app].channel.[channel].vue
@@ -1063,7 +1063,7 @@ async function copyCurlCommand() {
                       <button class="min-h-11 d-btn d-btn-ghost" :disabled="!canPromoteBundle" @click="openSelectRolloutVersion()">
                         {{ t('set-rollout-target') }}
                       </button>
-                      <button class="min-h-11 d-btn d-btn-outline" :disabled="channel.rollout_enabled ? rolloutTargetActionsDisabled : rolloutEnableDisabled" @click="channel.rollout_enabled ? disableRollout() : enableRollout()">
+                      <button class="min-h-11 d-btn d-btn-outline" :disabled="channel.rollout_enabled ? (rolloutTargetActionsDisabled || rolloutControlsDisabled) : rolloutEnableDisabled" @click="channel.rollout_enabled ? disableRollout() : enableRollout()">
                         {{ channel.rollout_enabled ? t('disable') : t('enable') }}
                       </button>
                       <button class="min-h-11 d-btn d-btn-outline" :disabled="rolloutPauseDisabled" @click="toggleRolloutPause()">