Defer server file changes until guarded restart activation

Persist beta, promotion, drift, and rollback payloads until occupancy and restart-capacity checks pass. Preserve rollback snapshots and campaign ordering, and allow held rollback campaigns to resume safely.

Fixes #28

Validation: 805 tests passed, Svelte checks clean, production build passed.

README.md

@@ -390,6 +390,17 @@ RCON parsing (fake UDP socket).
 
 Campaigns (`/campaigns`) tracks script/config updates, drift reconciliation, restart progress, file diffs, and rollbacks. Existing campaign records are preserved in the original database tables. The campaign API lives at `/api/campaigns`; legacy detail API endpoints remain available for compatibility.
 
+Beta deployments, promotions, drift repairs, and rollbacks stage their file changes
+in SQLite. Live server files and inventory remain unchanged while waiting for an
+empty or stopped server, other operations, and rolling restart capacity. Provisioning
+captures rollback snapshots and applies the staged changes immediately before
+requesting the restart. Failed file activation blocks that restart. Queued changes
+survive application restarts; cancelling an unapplied beta discards its pending
+changes. Manual beta rollback holds both file restoration and restart until
+**Resume when empty** is selected on its rollback campaign.
+Finish pending file campaigns before opening a beta on their servers; this keeps
+an older queued change from overwriting the version tested by the new beta.
+
 Deleting a server preserves its name, recorded beta progress and test evidence,
 campaign results and file diffs, provisioning and maintenance history, and match
 records. Historical entries show **Deleted** and omit live server links and