Demo release gate

Approve sends the “your demo is ready” email. The emailer refuses to send unless ready_email_allowed is true in the database.

Demo infrastructure one-shots

Preview-environment operations. The DB one-shots are idempotent and safe to re-run.