Preserve runtime passwords when revalidating launch files

tests/unit/native-provisioning.test.ts

@@ -84,6 +84,40 @@ async function observations(server: string) {
     return [serverObservation(row), observationReader()(row), new MonitoringSnapshot().observe(row)];
 }
 
+describe('runtime configuration at dispatch', () => {
+    it.each([
+        ['t5', 'shared'], ['t5', 'generated'], ['t6', 'shared'], ['t6', 'generated']
+    ] as const)('dispatches %s with a promoted baseline and %s RCON password', async (game, source) => {
+        const { config, configFileForGame } = await import('../../src/lib/server/config.js');
+        if (source === 'generated') Object.assign(config.rcon, { password: '' });
+        const { createScript } = await import('../../src/lib/server/fleet/scripts.js');
+        const { db } = await import('../../src/lib/server/db/index.js');
+        const { script, version } = createScript({ name: 'Launch baseline', kind: 'baseline', scopeType: 'game', scopeValue: game,
+            content: Buffer.from('set rcon_password "password"\nset sv_voice "1"\n') });
+        db().prepare('UPDATE scripts SET current_version_id=? WHERE id=?').run(version.id, script.id);
+
+        const job = await queue(game);
+        await advance();
+        const operation = await operationFor(job.deploymentId);
+        expect(operation).toMatchObject({ kind: 'instance.create', state: 'pending' });
+        const payload = operation!.payload as { rconPassword: string; files: { path: string; contentBase64: string; sha256: string }[] };
+        expect(payload.rconPassword).toEqual(source === 'shared' ? 'test-password' : expect.stringMatching(/^[a-f0-9]{64}$/));
+        const configFile = configFileForGame(game);
+        const file = payload.files.find(file => file.path === `configs/${configFile}`)!;
+        const content = Buffer.from(file.contentBase64, 'base64');
+        expect(content.toString()).toContain(`set rcon_password "${payload.rconPassword}"`);
+        expect(content.toString()).not.toContain('set rcon_password "password"');
+        const hash = createHash('sha256').update(content).digest('hex');
+        expect(file.sha256).toBe(hash);
+        const { getServerScript } = await import('../../src/lib/server/fleet/inventory.js');
+        expect(getServerScript(job.name, configFile)).toMatchObject({ sha256: hash, size: content.length, source: 'native-create' });
+        const { recipeForDeployment } = await import('../../src/lib/server/fleet/launch-recipes.js');
+        expect(recipeForDeployment(job.deploymentId)!.recipe.files).toContainEqual(expect.objectContaining({
+            path: configFile, sha256: hash, size: content.length, content: content.toString('base64')
+        }));
+    });
+});
+
 describe('provisioning health handoff', () => {
     it.each(['create', 'start', 'restart', 'rebuild'] as const)('%s publishes verified game health before completion becomes visible', async action => {
         const job = await queue(); await advance();