---
id: WF-PFM-INT-008
title: Move a connection to another release
trigger: The initiating integration administrator starts this flow.
product_area: platform
module: integrations
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
  - CAP-PFM-INT-004
moves:
  - STATE-PFM-INT-003
  - STATE-PFM-INT-006
crosses: []
idempotency: >-
  The open check mechanism reuses target verification work; a successful prior move is reflected in the
  current pin.
concurrency: Result recording checks the account status before moving its pin.
hops:
  - 'n': 1
    actor_or_service: Integration administrator
    action: Request a release update for the account link.
    anchor: >-
      services-platform:modules/integrations/services/connections/connection-operations.ts:requestVersionUpdate
    seam: sync
    on_failure: Present the refused request on account detail.
    left_inconsistent: The existing release pin remains.
    observer: The administrator
    provenance: observed
    source: >-
      services-platform:modules/integrations/services/connections/connection-operations.ts:requestVersionUpdate
  - 'n': 2
    actor_or_service: Integrations service
    action: >-
      Require a usable account and a published release of the same integration; check access newly introduced
      by the target.
    anchor: >-
      services-platform:modules/integrations/services/installations/installation-lifecycle.ts:unacceptedNewAccess
    seam: sync
    on_failure: Refuse newly requested access outside existing declaration or acceptance.
    left_inconsistent: The target is not submitted for verification.
    observer: The administrator
    provenance: observed
    source: >-
      services-platform:modules/integrations/services/connections/connection-operations.ts:requestVersionUpdate
  - 'n': 3
    actor_or_service: Verification job
    action: Check the same provider account against the target release before changing its pin.
    anchor: 'services-platform:modules/integrations/services/connections/verify-connection.ts'
    seam: state_machine
    on_failure: Retain the old release and record verification failure.
    left_inconsistent: The provider check may have run while the original pin remains.
    observer: Job history
    provenance: observed
    source: 'services-platform:modules/integrations/services/connections/verify-connection.ts'
  - 'n': 4
    actor_or_service: Verification job
    action: 'After successful verification, update the pin and features and reassess dependent capability bindings.'
    anchor: 'services-platform:modules/integrations/services/connections/transition.ts:recordConnectionCheck'
    seam: sync
    on_failure: Rollback a failed result write.
    left_inconsistent: No partial pin or binding reassessment commits.
    observer: Binding history and Needs Attention
    provenance: observed
    source: 'services-platform:modules/integrations/services/connections/transition.ts:recordConnectionCheck'
evidence:
  - >-
    services-platform at ad3f6a65: modules/integrations/services/connections/connection-operations.ts,
    verify-connection.ts; services/installations/installation-lifecycle.ts
  - 'services-platform:modules/integrations/services/connections/connection-operations.ts:requestVersionUpdate'
  - >-
    services-platform:modules/integrations/tests/integration/services/bindings/invalidation.integration.spec.js#invalidates
    its active bindings with connection_suspended, at the next revision
controls: [TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Move a connection to another release

## What It Does

A release update checks a target deployment before changing the account pin. Only newly introduced access is compared with the preceding declaration and customer acceptance. Successful verification refreshes features and dependent bindings.

## The Flow

```mermaid
sequenceDiagram
  participant P0 as Integration administrator
  participant P1 as Integrations service
  participant P2 as Verification job
  P0->>P0: 1. Request a release update for the account link.
  P1->>P1: 2. Require a usable account and a published release of the same integration
  P2->>P2: 3. Check the same provider account against the target release before changing its pin.
  P2->>P2: 4. After successful verification
```

## When Something Fails

Present the refused request on account detail. The existing release pin remains. Refuse newly requested access outside existing declaration or acceptance. The target is not submitted for verification. Retain the old release and record verification failure. The provider check may have run while the original pin remains. Rollback a failed result write. No partial pin or binding reassessment commits.

## Open Design Questions

Product must decide whether release updates should recheck all target access against current acceptance rather than only newly introduced access.