Roll deployment restarts through a shared fleet-wide recovery limit

src/lib/server/db/schema.sql

@@ -199,6 +199,18 @@ CREATE TABLE IF NOT EXISTS deployment_servers (
 
 CREATE INDEX IF NOT EXISTS idx_deployment_servers_state ON deployment_servers(restart_state);
 
+-- Fleet-wide restart slots shared by deployments and betas. A successful API
+-- response does not release a slot: the server must recover first. Persisting
+-- these rows also protects the fleet across Electric Cherry process restarts.
+CREATE TABLE IF NOT EXISTS restart_rollout (
+    server       TEXT PRIMARY KEY REFERENCES servers(name) ON DELETE CASCADE,
+    requested_at TEXT NOT NULL,
+    checked_at   TEXT,
+    healthy_at   TEXT,
+    players      INTEGER,
+    error        TEXT
+);
+
 CREATE TABLE IF NOT EXISTS deployment_files (
     id             INTEGER PRIMARY KEY AUTOINCREMENT,
     deployment_id  TEXT NOT NULL REFERENCES deployments(id) ON DELETE CASCADE,