fix(openapi): harden story 2.1 production lifecycle

apps/admin-api/tests/integration/openapi_import.rs

@@ -81,6 +81,7 @@ async fn previews_openapi_and_creates_draft_operations() {
         .unwrap();
 
     assert_eq!(created.created.len(), 1);
+    assert_eq!(created.created[0].operation_key, "GET /v2/latest");
     assert_eq!(created.created[0].name, "latest_rates");
     assert!(created.skipped.is_empty());
 
@@ -176,6 +177,46 @@ async fn previews_openapi_and_creates_draft_operations() {
     assert_eq!(renamed.findings[0].code, "operation_name_renamed");
 }
 
+#[tokio::test]
+#[serial]
+async fn unknown_selected_operations_are_persisted_in_the_canonical_replay() {
+    let registry = test_registry().await;
+    let service = test_service(
+        registry,
+        test_storage_root("openapi_import_unknown_replay"),
+        test_auth_settings(),
+        test_secret_crypto(),
+    );
+    let workspace_id = WorkspaceId::new("ws_default");
+    let preview = service
+        .preview_openapi_import(&workspace_id, openapi_upload())
+        .await
+        .unwrap();
+    let payload = OpenApiImportCreatePayload {
+        selected_operation_keys: vec!["GET /v2/latest".to_owned(), "GET /missing".to_owned()],
+        server_url: Some("https://api.frankfurter.dev".to_owned()),
+        conflict_mode: "skip".to_owned(),
+    };
+
+    let first = service
+        .create_openapi_import(
+            &workspace_id,
+            &preview.job_id.as_str().into(),
+            payload.clone(),
+        )
+        .await
+        .unwrap();
+    let replayed = service
+        .create_openapi_import(&workspace_id, &preview.job_id.as_str().into(), payload)
+        .await
+        .unwrap();
+
+    assert_eq!(first.created, replayed.created);
+    assert_eq!(first.skipped, replayed.skipped);
+    assert_eq!(first.skipped.len(), 1);
+    assert_eq!(first.skipped[0].operation_key, "GET /missing");
+}
+
 #[tokio::test]
 #[serial]
 async fn concurrent_openapi_import_replays_the_same_atomic_result() {
@@ -231,6 +272,55 @@ async fn concurrent_openapi_import_replays_the_same_atomic_result() {
     assert!(conflicting_replay.is_err());
 }
 
+#[tokio::test]
+#[serial]
+async fn apply_fails_closed_when_the_preview_parser_contract_drifts() {
+    let registry = test_registry().await;
+    let service = test_service(
+        registry.clone(),
+        test_storage_root("openapi_import_parser_drift"),
+        test_auth_settings(),
+        test_secret_crypto(),
+    );
+    let workspace_id = WorkspaceId::new("ws_default");
+    let preview = service
+        .preview_openapi_import(&workspace_id, openapi_upload())
+        .await
+        .unwrap();
+    let job_id: crank_registry::ImportJobId = preview.job_id.as_str().into();
+    sqlx::query(
+        "update import_jobs
+            set preview_payload = jsonb_set(preview_payload, '{preview_digest}', to_jsonb($1::text))
+          where id = $2",
+    )
+    .bind("0".repeat(64))
+    .bind(job_id.as_str())
+    .execute(registry.pool())
+    .await
+    .unwrap();
+
+    let result = service
+        .create_openapi_import(
+            &workspace_id,
+            &job_id,
+            OpenApiImportCreatePayload {
+                selected_operation_keys: vec!["GET /v2/latest".to_owned()],
+                server_url: Some("https://api.frankfurter.dev".to_owned()),
+                conflict_mode: "rename".to_owned(),
+            },
+        )
+        .await;
+
+    assert!(result.is_err());
+    assert!(
+        service
+            .list_operations(&workspace_id)
+            .await
+            .unwrap()
+            .is_empty()
+    );
+}
+
 fn openapi_upload() -> OpenApiUpload {
     OpenApiUpload {
         bytes: OPENAPI3.as_bytes().to_vec(),