@@ -3,8 +3,9 @@ name: Release
 # One workflow owns every npm publish, so each package trusts exactly this file
 # (npm trusted publishing pins the workflow filename and the npm-publish
 # environment). scripts/release-plan.mjs maps the triggering event to a mode:
-# dry-run (PR), nightly (schedule or dispatch), promote (dispatch stable), or
-# stable (a vX.Y.Z tag, created by promote or pushed by a maintainer).
+# dry-run (PR), nightly (schedule or dispatch on main), or stable (a vX.Y.Z tag on
+# main, which only a repository admin can create, normally by publishing a GitHub
+# release).
 on:
   pull_request:
     paths:
@@ -20,28 +21,15 @@ on:
     # Retried every few hours: a nightly waits for green CI on main's HEAD and
     # publishes at most once per UTC day.
     - cron: '23 */3 * * *'
+  # On main: publish a nightly now. On a vX.Y.Z tag: retry that stable release.
   workflow_dispatch:
-    inputs:
-      channel:
-        description: nightly publishes main now; stable promotes the latest nightly.
-        required: true
-        default: nightly
-        type: choice
-        options:
-          - nightly
-          - stable
-      version:
-        description: Stable version override (X.Y.Z). Defaults to the version the latest nightly previews.
-        required: false
-        type: string
 
 permissions: {}
 
 concurrency:
   group: >-
     ${{ github.event_name == 'pull_request' && format('release-pr-{0}', github.ref)
     || startsWith(github.ref, 'refs/tags/') && format('release-{0}', github.ref)
-    || inputs.channel == 'stable' && 'release-promote'
     || 'release-nightly' }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
@@ -74,41 +62,8 @@ jobs:
         name: Plan release
         env:
           GITHUB_TOKEN: ${{ github.token }}
-          RELEASE_CHANNEL: ${{ inputs.channel }}
-          RELEASE_VERSION: ${{ inputs.version }}
         run: node scripts/release-plan.mjs
 
-  promote:
-    name: Promote ${{ needs.plan.outputs.version }}
-    needs: plan
-    if: needs.plan.outputs.mode == 'promote'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      actions: write
-      contents: write
-    steps:
-      # A run started by GITHUB_TOKEN's tag push would not trigger; dispatching
-      # on the tag gives the stable run a github.sha (and npm provenance) of
-      # exactly the promoted commit.
-      - name: Tag the promoted nightly and start its stable release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: v${{ needs.plan.outputs.version }}
-          COMMIT: ${{ needs.plan.outputs.commit }}
-        run: |
-          set -euo pipefail
-          # Idempotent, so re-running a failed dispatch reuses the tag it already created.
-          tagged="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" --jq .object.sha 2>/dev/null || true)"
-          if [ -z "$tagged" ]; then
-            gh api "repos/$GITHUB_REPOSITORY/git/refs" -f "ref=refs/tags/$TAG" -f "sha=$COMMIT"
-          elif [ "$tagged" != "$COMMIT" ]; then
-            echo "$TAG already points at $tagged, not $COMMIT." >&2
-            exit 1
-          fi
-          gh workflow run release.yml --repo "$GITHUB_REPOSITORY" --ref "$TAG"
-          echo "Started the $TAG release from $COMMIT." >> "$GITHUB_STEP_SUMMARY"
-
   approve:
     name: Approve ${{ needs.plan.outputs.version }}
     needs: plan
@@ -217,7 +172,7 @@ jobs:
       - name: Tag the published commit
         env:
           GH_TOKEN: ${{ github.token }}
-          TAG: v${{ needs.plan.outputs.version }}
+          TAG: nightly/v${{ needs.plan.outputs.version }}
           COMMIT: ${{ needs.plan.outputs.commit }}
         run: |
           gh api "repos/$GITHUB_REPOSITORY/git/refs" -f "ref=refs/tags/$TAG" -f "sha=$COMMIT"
 
@@ -10,14 +10,12 @@ function run(overrides: Record<string, unknown> = {}) {
     event: 'schedule',
     ref: 'refs/heads/main',
     sha: MAIN,
-    channel: 'nightly',
-    requestedVersion: '',
     rootVersion: '0.21.25-dev',
     today: '20261011',
     runNumber: '42',
     tags: new Map([
       ['v0.21.24', 'c'.repeat(40)],
-      ['v0.21.25-nightly.20261010.41', NIGHTLY_COMMIT],
+      ['nightly/v0.21.25-nightly.20261010.41', NIGHTLY_COMMIT],
     ]),
     latestStable: '0.21.24',
     ciConclusion: 'success',
@@ -58,22 +56,7 @@ test('a nightly refuses a main whose -dev version trails the published release',
   assert.throws(() => planRelease(run({ latestStable: '0.21.25' })), /not ahead of the published/);
 });
 
-test('promotion tags the latest nightly commit with the version it previewed', () => {
-  const promoted = run({ event: 'workflow_dispatch', channel: 'stable' });
-  assert.deepEqual(planRelease(promoted), {
-    mode: 'promote',
-    version: '0.21.25',
-    commit: NIGHTLY_COMMIT,
-    nightly: 'v0.21.25-nightly.20261010.41',
-  });
-  assert.equal(planRelease({ ...promoted, requestedVersion: '0.22.0' }).version, '0.22.0');
-  assert.throws(() => planRelease({ ...promoted, requestedVersion: '0.21.23' }), /not ahead/);
-  assert.throws(() => planRelease({ ...promoted, requestedVersion: '0.22' }), /X\.Y\.Z/);
-  assert.throws(() => planRelease({ ...promoted, requestedVersion: '0.21.24' }), /already tagged/);
-  assert.throws(() => planRelease({ ...promoted, tags: new Map() }), /No nightly/);
-});
-
-test('a stable tag publishes its own commit when it is on main', () => {
+test('a stable tag publishes its own commit once it is on main and its CI passed', () => {
   const stable = run({ event: 'workflow_dispatch', ref: 'refs/tags/v0.21.25', onMain: true });
   assert.deepEqual(planRelease(stable), {
     mode: 'stable',
@@ -85,6 +68,10 @@ test('a stable tag publishes its own commit when it is on main', () => {
   assert.equal(planRelease({ ...stable, latestStable: '0.21.25' }).mode, 'stable');
   assert.throws(() => planRelease({ ...stable, latestStable: '0.21.26' }), /older than/);
   assert.throws(() => planRelease({ ...stable, onMain: false }), /not on main/);
+  assert.throws(
+    () => planRelease({ ...stable, ciConclusion: 'in_progress' }),
+    /run Release on v0\.21\.25/,
+  );
   assert.throws(() => planRelease({ ...stable, ref: 'refs/tags/v0.21.25-rc.1' }), /vX\.Y\.Z tag/);
 });
 
 
@@ -24,13 +24,14 @@ test('a nightly is refused unless main carries a -dev version', () => {
 test('the latest nightly orders by base, then date, then run number', () => {
   const tags = [
     'v0.21.24',
-    'v0.21.25-nightly.20261009.9',
-    'v0.21.25-nightly.20261010.10',
-    'v0.21.25-nightly.20261010.12',
-    'v0.21.24-nightly.20261011.13',
-    'evidence/v0.21.26-nightly.20261012.14',
+    'nightly/v0.21.25-nightly.20261009.9',
+    'nightly/v0.21.25-nightly.20261010.10',
+    'nightly/v0.21.25-nightly.20261010.12',
+    'nightly/v0.21.24-nightly.20261011.13',
+    'v0.21.26-nightly.20261012.14',
+    'evidence/v0.21.26-nightly.20261012.15',
   ];
-  assert.equal(latestNightlyTag(tags), 'v0.21.25-nightly.20261010.12');
+  assert.equal(latestNightlyTag(tags), 'nightly/v0.21.25-nightly.20261010.12');
   assert.equal(latestNightlyTag(['v0.21.24']), null);
 });
 
 
@@ -13,8 +13,7 @@ import {
 /**
  * Decides what one `.github/workflows/release.yml` run does, from the event that started it:
  *   pull_request              dry-run: build and verify every package, publish nothing
- *   schedule / nightly        nightly: publish main's HEAD under the `nightly` dist-tag
- *   dispatch stable on main   promote: tag the latest nightly's commit and start its stable run
+ *   schedule / dispatch       nightly: publish main's HEAD under the `nightly` dist-tag
  *   vX.Y.Z tag                stable: publish that commit under the `latest` dist-tag
  * `tags` maps remote tag names to commits; `ciConclusion` and `onMain` describe `sha`.
  */
@@ -26,7 +25,7 @@ export function planRelease(run) {
   if (run.ref !== 'refs/heads/main') {
     throw new Error(`Releases run from main or a vX.Y.Z tag, not ${run.ref}.`);
   }
-  return run.channel === 'stable' ? planPromotion(run) : planNightly(run);
+  return planNightly(run);
 }
 
 function planNightly(run) {
@@ -48,16 +47,6 @@ function planNightly(run) {
   return { mode: 'nightly', version, distTag: 'nightly', commit: run.sha };
 }
 
-function planPromotion(run) {
-  const nightly = latestNightlyTag([...run.tags.keys()]);
-  if (!nightly) throw new Error('No nightly has been published to promote.');
-  const version = run.requestedVersion || nightlyBase(nightly.slice(1));
-  if (!isReleaseVersion(version)) throw new Error(`${version} is not an X.Y.Z release version.`);
-  if (run.tags.has(`v${version}`)) throw new Error(`v${version} is already tagged.`);
-  assertAheadOfStable(run, version);
-  return { mode: 'promote', version, commit: run.tags.get(nightly), nightly };
-}
-
 function planStable(run, tag) {
   const version = tag.slice(1);
   if (!tag.startsWith('v') || !isReleaseVersion(version)) {
@@ -68,6 +57,11 @@ function planStable(run, tag) {
     throw new Error(`${version} is older than the published ${run.latestStable}.`);
   }
   if (!run.onMain) throw new Error(`${tag} is not on main.`);
+  if (run.ciConclusion !== 'success') {
+    throw new Error(
+      `CI on ${run.sha} is ${run.ciConclusion}. Once it passes, run Release on ${tag} to publish it.`,
+    );
+  }
   const previousTag = previousReleaseTag([...run.tags.keys()], version) ?? '';
   return { mode: 'stable', version, distTag: 'latest', commit: run.sha, previousTag };
 }
@@ -84,10 +78,12 @@ function assertAheadOfStable(run, version) {
   }
 }
 
-/** Remote tags by name, resolved to the commit each one points at. */
+/** Remote release and nightly tags by name, resolved to the commit each one points at. */
 function remoteTags() {
   const tags = new Map();
-  const output = execFileSync('git', ['ls-remote', '--tags', 'origin', 'v*'], { encoding: 'utf8' });
+  const output = execFileSync('git', ['ls-remote', '--tags', 'origin', 'v*', 'nightly/*'], {
+    encoding: 'utf8',
+  });
   for (const line of output.split('\n').filter(Boolean)) {
     const [commit, name] = line.split('\t');
     const tag = name.replace(/^refs\/tags\//, '');
@@ -138,14 +134,12 @@ async function readRun(env) {
     event,
     ref,
     sha: env.GITHUB_SHA,
-    channel: env.RELEASE_CHANNEL || 'nightly',
-    requestedVersion: env.RELEASE_VERSION,
     rootVersion: JSON.parse(fs.readFileSync('package.json', 'utf8')).version,
     today: new Date().toISOString().slice(0, 10).replaceAll('-', ''),
     runNumber: env.GITHUB_RUN_NUMBER,
     tags: event === 'pull_request' ? new Map() : remoteTags(),
     latestStable: onBranch || onTag ? await latestStable() : null,
-    ciConclusion: onBranch ? await ciConclusion(env) : undefined,
+    ciConclusion: onBranch || onTag ? await ciConclusion(env) : undefined,
     onMain: onTag ? await isOnMain(env) : undefined,
   };
 }
 
@@ -5,7 +5,7 @@ import { pathToFileURL } from 'node:url';
 
 // Version strings across the release channels. `main` carries `X.Y.Z-dev`, naming the release
 // it is building towards; a nightly publishes that base as `X.Y.Z-nightly.<YYYYMMDD>.<run>`; a
-// stable release promotes a nightly's commit to `X.Y.Z`. Registry scanners diff the tool surface
+// stable release publishes a tagged commit on `main` as `X.Y.Z`. Registry scanners diff the tool surface
 // per version string, so neither `main` nor a nightly may ever carry a published stable version.
 const RELEASE = /^(\d+)\.(\d+)\.(\d+)$/;
 const DEVELOPMENT = /^(\d+)\.(\d+)\.(\d+)-dev$/;
@@ -31,18 +31,25 @@ export function nightlyVersion(developmentVersion, date, runNumber) {
   return `${match.slice(1, 4).join('.')}-nightly.${date}.${runNumber}`;
 }
 
-/** The `X.Y.Z` a nightly previews: the version its promotion publishes by default. */
+/** The `X.Y.Z` release a nightly previews. */
 export function nightlyBase(version) {
   const match = NIGHTLY.exec(version);
   if (!match) throw new Error(`${version} is not a nightly version.`);
   return match.slice(1, 4).join('.');
 }
 
-/** The newest `vX.Y.Z-nightly.<date>.<run>` tag, ordered by base, then date, then run. */
+/**
+ * Nightly tags live outside `v*`, which only repository admins may create: the release workflow
+ * tags each nightly itself, and no nightly tag ref may deploy to the npm-publish environment.
+ */
+const NIGHTLY_TAG_PREFIX = 'nightly/v';
+
+/** The newest `nightly/vX.Y.Z-nightly.<date>.<run>` tag, ordered by base, then date, then run. */
 export function latestNightlyTag(tags) {
   const nightlies = tags
-    .map((tag) => ({ tag, match: NIGHTLY.exec(tag.replace(/^v/, '')) }))
-    .filter((entry) => entry.tag.startsWith('v') && entry.match);
+    .filter((tag) => tag.startsWith(NIGHTLY_TAG_PREFIX))
+    .map((tag) => ({ tag, match: NIGHTLY.exec(tag.slice(NIGHTLY_TAG_PREFIX.length)) }))
+    .filter((entry) => entry.match);
   nightlies.sort((a, b) => {
     const [left, right] = [a.match, b.match].map((match) => match.slice(1).map(Number));
     return right.reduce((order, part, index) => order || part - left[index], 0);