Promote as a real deployment; version state and scope dropdowns

Turns promotion into a first-class deployment (action='promote') so it lands
in the deployments UI with before/after content, per-server restart tracking,
and one-click rollback. Non-beta matching-scope servers get restart_state=
pending so the existing sweep drains and restarts them the same way drift does.

Also adds a per-version state (untested/tested/test-failed) so the upload
flow can visibly signal that a beta must land before promotion, and swaps
the scope-value text box for game/map dropdowns populated from the fleet.
Beta rollback at ready-promote is now labelled Reject and marks the version
test-failed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/lib/server/fleet/beta.ts

@@ -331,6 +331,26 @@ export async function rollbackBeta(betaId: number): Promise<RollbackResult> {
     db()
         .prepare(`UPDATE betas SET state = 'rolled-back', closed_at = ? WHERE id = ?`)
         .run(nowIso(), betaId);
+
+    // Mark the version test-failed unless another beta for the same version
+    // still gates it as tested/promoted. Skip if the version is the currently-
+    // promoted one — that's authoritative, not a failure signal.
+    const stillOk = db()
+        .prepare(
+            `SELECT 1 FROM betas
+             WHERE script_version_id = ?
+               AND id <> ?
+               AND state IN ('ready-promote','promoted')
+             LIMIT 1`
+        )
+        .get(beta.script_version_id, betaId);
+    const isCurrent = script.current_version_id === beta.script_version_id;
+    if (!stillOk && !isCurrent) {
+        db()
+            .prepare(`UPDATE script_versions SET state = 'test-failed' WHERE id = ?`)
+            .run(beta.script_version_id);
+    }
+
     emit({ type: 'beta-state', betaId, state: 'rolled-back' });
 
     return { betaId, restored, dropped, warnings };
@@ -342,6 +362,12 @@ export interface PromoteResult {
     betaId: number;
     landed: string[];    // servers we wrote the promoted target to
     versionId: number;
+    deploymentId: string;
+}
+
+function promoteDeploymentId(betaId: number): string {
+    const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
+    return `dep-${stamp}-promote-${betaId}`;
 }
 
 export async function promoteBeta(betaId: number): Promise<PromoteResult> {
@@ -355,15 +381,86 @@ export async function promoteBeta(betaId: number): Promise<PromoteResult> {
     const bfile = betaFile(script.target_rel_path);
     const ofile = oldFile(script.target_rel_path);
 
-    const betaServers = listBetaServers(betaId).map((r) => r.server);
+    const betaServerSet = new Set(listBetaServers(betaId).map((r) => r.server));
     // For scoped scripts, promotion applies to every matching server (whether
     // or not they were in the beta). For unscoped, just the beta servers.
     const scopeServers = script.scope_type && script.scope_value
         ? serversMatchingScope(script.scope_type, script.scope_value)
         : [];
-    const allTargets = Array.from(new Set([...betaServers, ...scopeServers]));
+    const allTargets = Array.from(new Set([...betaServerSet, ...scopeServers]));
 
+    // Snapshot what's on-disk at every target BEFORE we write, so the promote
+    // deployment can be rolled back later. For beta servers the real "before"
+    // state is the .OLD file (or nothing), not the current -beta.gsc.
+    interface Snapshot {
+        server: string;
+        priorVersionId: number | null;
+        priorSha: string | null;
+        priorSize: number | null;
+        priorContent: Buffer | null;
+        hadFile: boolean;
+    }
+    const snapshots: Snapshot[] = [];
+    for (const name of allTargets) {
+        const dest = destOf(name);
+        if (betaServerSet.has(name)) {
+            // Prior state is captured in the beta_servers row + .OLD file.
+            const bs = db()
+                .prepare(`SELECT had_original, prior_version_id FROM beta_servers WHERE beta_id = ? AND server = ?`)
+                .get(betaId, name) as { had_original: number; prior_version_id: number | null } | undefined;
+            if (bs?.had_original) {
+                const backupPath = join(dest, ofile);
+                let priorContent: Buffer | null = null;
+                let priorSha: string | null = null;
+                let priorSize: number | null = null;
+                if (existsSync(backupPath)) {
+                    priorContent = await readFile(backupPath);
+                    priorSha = sha256Buffer(priorContent);
+                    priorSize = priorContent.byteLength;
+                } else if (bs.prior_version_id) {
+                    const pv = getVersion(bs.prior_version_id);
+                    if (pv) {
+                        priorContent = pv.content;
+                        priorSha = pv.sha256;
+                        priorSize = pv.size;
+                    }
+                }
+                snapshots.push({
+                    server: name,
+                    priorVersionId: bs.prior_version_id,
+                    priorSha,
+                    priorSize,
+                    priorContent,
+                    hadFile: true
+                });
+            } else {
+                snapshots.push({ server: name, priorVersionId: null, priorSha: null, priorSize: null, priorContent: null, hadFile: false });
+            }
+        } else {
+            // Non-beta matching-scope server — the current on-disk target is
+            // its "before".
+            const targetPath = join(dest, script.target_rel_path);
+            if (existsSync(targetPath)) {
+                const priorContent = await readFile(targetPath);
+                const inv = getServerScript(name, script.target_rel_path);
+                snapshots.push({
+                    server: name,
+                    priorVersionId: inv?.script_version_id ?? null,
+                    priorSha: sha256Buffer(priorContent),
+                    priorSize: priorContent.byteLength,
+                    priorContent,
+                    hadFile: true
+                });
+            } else {
+                snapshots.push({ server: name, priorVersionId: null, priorSha: null, priorSize: null, priorContent: null, hadFile: false });
+            }
+        }
+    }
+
+    // Now write files. Failures are per-server and don't abort the promote —
+    // the deployment record captures who succeeded and who didn't.
     const landed: string[] = [];
+    const failures = new Map<string, string>();
     for (const name of allTargets) {
         const dest = destOf(name);
         const targetPath = join(dest, script.target_rel_path);
@@ -381,14 +478,74 @@ export async function promoteBeta(betaId: number): Promise<PromoteResult> {
                 removeScript(name, ofile);
             }
             await writeFile(targetPath, version.content);
-            recordScript(name, script.target_rel_path, version.id, version.sha256, version.size, `promote:${betaId}`);
             landed.push(name);
         } catch (err) {
-            // Best-effort continue; error will surface via the beta detail UI.
+            const msg = (err as Error).message;
+            failures.set(name, msg);
             console.error(`[promote] ${name} failed:`, err);
         }
     }
 
+    // Build the deployment record. Only landed servers get deployment_files
+    // rows — a failed write leaves the prior file on disk, so recording it as
+    // if it changed would corrupt any future rollback.
+    const depId = promoteDeploymentId(betaId);
+    const startedAt = nowIso();
+    const priorScriptVersionId = script.current_version_id;
+
+    const insertDep = db().prepare(
+        `INSERT INTO deployments
+         (id, action, started_at, triggered_by, script_id, script_version_id, prior_version_id, beta_id)
+         VALUES (?, 'promote', ?, 'ui', ?, ?, ?, ?)`
+    );
+    const insertDepServer = db().prepare(
+        `INSERT INTO deployment_servers
+         (deployment_id, server, files_changed, restart_state, players, checked_at, restarted_at, attempts, error)
+         VALUES (?, ?, ?, ?, NULL, NULL, ?, 0, ?)`
+    );
+    const insertDepFile = db().prepare(
+        `INSERT INTO deployment_files
+         (deployment_id, server, verb, rel_path, sha256_before, sha256_after, content_before, content_after)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+
+    db().transaction(() => {
+        insertDep.run(depId, startedAt, script.id, version.id, priorScriptVersionId, betaId);
+        for (const snap of snapshots) {
+            if (failures.has(snap.server)) {
+                // Record the failure but no file row — nothing changed on disk.
+                insertDepServer.run(depId, snap.server, 0, 'failed', null, failures.get(snap.server)!);
+                continue;
+            }
+            const verb = snap.hadFile ? 'updated' : 'added';
+            insertDepFile.run(
+                depId,
+                snap.server,
+                verb,
+                script.target_rel_path,
+                snap.priorSha,
+                version.sha256,
+                snap.priorContent,
+                version.content
+            );
+
+            // Beta servers are already at the new bytes AND already restarted
+            // during the beta's own state machine. Non-beta matching servers
+            // got the file just now and still need to drain-and-restart, which
+            // the deployment sweep handles.
+            if (betaServerSet.has(snap.server)) {
+                const bsRestartedAt = db()
+                    .prepare(`SELECT restarted_at FROM beta_servers WHERE beta_id = ? AND server = ?`)
+                    .get(betaId, snap.server) as { restarted_at: string | null } | undefined;
+                insertDepServer.run(depId, snap.server, 1, 'done', bsRestartedAt?.restarted_at ?? startedAt, null);
+            } else {
+                insertDepServer.run(depId, snap.server, 1, 'pending', null, null);
+            }
+
+            recordScript(snap.server, script.target_rel_path, version.id, version.sha256, version.size, `promote:${depId}`);
+        }
+    })();
+
     // Update the script's canonical version and close out the beta + wipe archive.
     db().prepare('UPDATE scripts SET current_version_id = ? WHERE id = ?').run(version.id, script.id);
     db().prepare(`UPDATE betas SET state = 'promoted', closed_at = ? WHERE id = ?`).run(nowIso(), betaId);
@@ -397,8 +554,14 @@ export async function promoteBeta(betaId: number): Promise<PromoteResult> {
     if (existsSync(archive)) await rm(archive, { recursive: true, force: true });
 
     emit({ type: 'beta-state', betaId, state: 'promoted' });
+    emit({
+        type: 'deployment-opened',
+        deploymentId: depId,
+        action: 'promote',
+        servers: landed
+    });
 
-    return { betaId, landed, versionId: version.id };
+    return { betaId, landed, versionId: version.id, deploymentId: depId };
 }
 
 // ---------- helpers used by API layer ----------

src/lib/server/fleet/rollback.ts

@@ -0,0 +1,197 @@
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { destOf } from '../config.js';
+import { db } from '../db/index.js';
+import { emit } from '../pipeline/bus.js';
+import { recordScript, removeScript } from './inventory.js';
+import { getVersion } from './scripts.js';
+
+// Roll a promoted script back to whatever version was current before the
+// promote landed. Uses the deployment_files snapshots already captured at
+// promote time — no on-disk archaeology needed.
+//
+// Semantics:
+//   - Reverses only the file writes recorded in deployment_files. Servers that
+//     failed at promote time (no file row) are left alone.
+//   - Restores scripts.current_version_id to the promote row's prior_version_id.
+//   - Marks the original promote as rolled_back_by = <new deployment id>.
+//   - Records a fresh action='rollback' deployment with pending server rows so
+//     the sweep drains-and-restarts every affected server. Beta servers that
+//     were still running the promoted bytes get restarted the same as any
+//     other; the beta itself is not touched (it stays in state='promoted').
+
+export class RollbackError extends Error {
+    constructor(message: string, public readonly kind: 'no-such-deployment' | 'not-promote' | 'already-rolled-back') {
+        super(message);
+    }
+}
+
+interface DeploymentRow {
+    id: string;
+    action: string;
+    script_id: number | null;
+    script_version_id: number | null;
+    prior_version_id: number | null;
+    rolled_back_by: string | null;
+}
+
+interface FileRow {
+    id: number;
+    server: string;
+    verb: 'added' | 'updated' | 'removed';
+    rel_path: string;
+    sha256_before: string | null;
+    sha256_after: string | null;
+    content_before: Buffer | null;
+    content_after: Buffer | null;
+}
+
+function nowIso(): string {
+    return new Date().toISOString();
+}
+
+function rollbackDeploymentId(promoteId: string): string {
+    const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
+    return `dep-${stamp}-rollback-${promoteId}`;
+}
+
+export interface RollbackDeploymentResult {
+    deploymentId: string;      // the new rollback deployment
+    reverses: string;          // the promote deployment id
+    scriptId: number | null;
+    priorVersionId: number | null;
+    affectedServers: string[];
+}
+
+export async function rollbackPromoteDeployment(promoteId: string): Promise<RollbackDeploymentResult> {
+    const dep = db()
+        .prepare(`SELECT id, action, script_id, script_version_id, prior_version_id, rolled_back_by
+                  FROM deployments WHERE id = ?`)
+        .get(promoteId) as DeploymentRow | undefined;
+    if (!dep) throw new RollbackError(`no such deployment ${promoteId}`, 'no-such-deployment');
+    if (dep.action !== 'promote') throw new RollbackError(`deployment ${promoteId} is action='${dep.action}', not 'promote'`, 'not-promote');
+    if (dep.rolled_back_by) throw new RollbackError(`deployment ${promoteId} already rolled back by ${dep.rolled_back_by}`, 'already-rolled-back');
+
+    const fileRows = db()
+        .prepare(
+            `SELECT id, server, verb, rel_path, sha256_before, sha256_after, content_before, content_after
+             FROM deployment_files WHERE deployment_id = ? ORDER BY server, rel_path`
+        )
+        .all(promoteId) as FileRow[];
+
+    const newDepId = rollbackDeploymentId(promoteId);
+    const startedAt = nowIso();
+
+    // Group by server so each server gets exactly one deployment_servers row.
+    const perServer = new Map<string, FileRow[]>();
+    for (const f of fileRows) {
+        const arr = perServer.get(f.server);
+        if (arr) arr.push(f);
+        else perServer.set(f.server, [f]);
+    }
+
+    const affectedServers: string[] = [];
+    const perServerFailures = new Map<string, string>();
+
+    for (const [server, files] of perServer) {
+        const dest = destOf(server);
+        try {
+            for (const f of files) {
+                const abs = join(dest, f.rel_path);
+                await mkdir(join(dest, dirname(f.rel_path)), { recursive: true });
+                if (f.verb === 'added') {
+                    // Promote created this file — undo by removing it.
+                    if (existsSync(abs)) await rm(abs, { force: true });
+                    removeScript(server, f.rel_path);
+                } else if (f.verb === 'updated' && f.content_before) {
+                    await writeFile(abs, f.content_before);
+                    // Restore inventory to the prior version if we can identify it.
+                    const priorVer = dep.prior_version_id ? getVersion(dep.prior_version_id) : null;
+                    recordScript(
+                        server,
+                        f.rel_path,
+                        priorVer?.id ?? null,
+                        f.sha256_before!,
+                        f.content_before.byteLength,
+                        `rollback:${newDepId}`
+                    );
+                } else if (f.verb === 'removed' && f.content_before) {
+                    // Should not occur on a promote row, but handle symmetrically.
+                    await writeFile(abs, f.content_before);
+                    recordScript(server, f.rel_path, null, f.sha256_before!, f.content_before.byteLength, `rollback:${newDepId}`);
+                }
+            }
+            affectedServers.push(server);
+        } catch (err) {
+            perServerFailures.set(server, (err as Error).message);
+        }
+    }
+
+    // Write the new rollback deployment + mark the original.
+    const insertDep = db().prepare(
+        `INSERT INTO deployments
+         (id, action, started_at, triggered_by, script_id, script_version_id, prior_version_id, beta_id)
+         VALUES (?, 'rollback', ?, 'ui', ?, ?, ?, NULL)`
+    );
+    const insertDepServer = db().prepare(
+        `INSERT INTO deployment_servers
+         (deployment_id, server, files_changed, restart_state, players, checked_at, restarted_at, attempts, error)
+         VALUES (?, ?, ?, ?, NULL, NULL, NULL, 0, ?)`
+    );
+    // Mirror the promote's deployment_files into the rollback row so it's
+    // browsable as a diff (before/after swapped).
+    const insertDepFile = db().prepare(
+        `INSERT INTO deployment_files
+         (deployment_id, server, verb, rel_path, sha256_before, sha256_after, content_before, content_after)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+
+    db().transaction(() => {
+        insertDep.run(
+            newDepId,
+            startedAt,
+            dep.script_id,
+            dep.prior_version_id,   // this rollback lands the *prior* version, so that's now current
+            dep.script_version_id,  // what was in place immediately before this rollback
+        );
+        for (const [server, files] of perServer) {
+            if (perServerFailures.has(server)) {
+                insertDepServer.run(newDepId, server, 0, 'failed', perServerFailures.get(server)!);
+                continue;
+            }
+            insertDepServer.run(newDepId, server, files.length, 'pending', null);
+            for (const f of files) {
+                const invertedVerb =
+                    f.verb === 'added' ? 'removed'
+                    : f.verb === 'removed' ? 'added'
+                    : 'updated';
+                insertDepFile.run(
+                    newDepId,
+                    server,
+                    invertedVerb,
+                    f.rel_path,
+                    f.sha256_after,
+                    f.sha256_before,
+                    f.content_after,
+                    f.content_before
+                );
+            }
+        }
+        db().prepare(`UPDATE deployments SET rolled_back_by = ? WHERE id = ?`).run(newDepId, promoteId);
+        // Restore the script's current version pointer.
+        if (dep.script_id !== null) {
+            db().prepare(`UPDATE scripts SET current_version_id = ? WHERE id = ?`).run(dep.prior_version_id, dep.script_id);
+        }
+    })();
+
+    emit({ type: 'deployment-opened', deploymentId: newDepId, action: 'rollback', servers: affectedServers });
+
+    return {
+        deploymentId: newDepId,
+        reverses: promoteId,
+        scriptId: dep.script_id,
+        priorVersionId: dep.prior_version_id,
+        affectedServers
+    };
+}

src/lib/server/fleet/scripts.ts

@@ -13,6 +13,8 @@ export interface ScriptRow {
     created_at: string;
 }
 
+export type ScriptVersionState = 'untested' | 'tested' | 'test-failed';
+
 export interface ScriptVersionRow {
     id: number;
     script_id: number;
@@ -21,6 +23,7 @@ export interface ScriptVersionRow {
     size: number;
     content: Buffer;
     notes: string | null;
+    state: ScriptVersionState;
     uploaded_at: string;
 }
 
@@ -233,3 +236,30 @@ export function serversMatchingScope(scopeType: ScopeType | null, scopeValue: st
         .all(scopeValue) as Array<{ name: string }>;
     return rows.map((r) => r.name);
 }
+
+// Distinct game IDs present in the registered fleet. Powers the scope=game
+// dropdown so operators can only pick values that will match at least one
+// server.
+export function listDistinctGames(): string[] {
+    const rows = db()
+        .prepare(`SELECT DISTINCT game FROM servers WHERE game IS NOT NULL AND game <> '' ORDER BY game`)
+        .all() as Array<{ game: string }>;
+    return rows.map((r) => r.game);
+}
+
+// Distinct maps grouped by their game. Scope=map is chained (pick game → pick
+// map) so the UI can filter map options to those valid under the selected game.
+export function listMapsByGame(): Record<string, string[]> {
+    const rows = db()
+        .prepare(
+            `SELECT DISTINCT game, map FROM servers
+             WHERE game IS NOT NULL AND game <> '' AND map IS NOT NULL AND map <> ''
+             ORDER BY game, map`
+        )
+        .all() as Array<{ game: string; map: string }>;
+    const out: Record<string, string[]> = {};
+    for (const r of rows) {
+        (out[r.game] ??= []).push(r.map);
+    }
+    return out;
+}