fix: make server discovery and audits read-only

tests/configuration-backup.test.mjs

@@ -1,8 +1,13 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 import backupModule from '../src/main/configuration-backup.cjs';
+import configModule from '../src/main/config-store.cjs';
 
 const { sanitizeConfiguration, createEncryptedBackup, readEncryptedBackup } = backupModule;
+const { ConfigStore } = configModule;
 
 test('configuration backups exclude credentials and operation history', () => {
   const clean = sanitizeConfiguration({
@@ -25,3 +30,16 @@ test('configuration backups round-trip with authenticated encryption', () => {
   assert.equal(restored.configuration.gitea.encryptedToken, null);
   assert.throws(() => readEncryptedBackup(serialized, 'incorrect passphrase'), /could not be decrypted/i);
 });
+
+test('recovery snapshots preserve the exact in-memory configuration before a mutation', async (context) => {
+  const directory = await mkdtemp(path.join(tmpdir(), 'forgeflow-config-snapshot-'));
+  context.after(() => rm(directory, { recursive: true, force: true }));
+  const store = new ConfigStore(directory);
+  store.data.workspaceRoots = ['C:/Projects'];
+  store.data.deploymentProfiles = { 'jens/example': [{ id: 'production', provider: 'gitea-actions' }] };
+  await store.save();
+  const before = `${JSON.stringify(store.data, null, 2)}\n`;
+  const snapshot = await store.createRecoverySnapshot('server reconciliation / production');
+  assert.equal(await readFile(snapshot.filePath, 'utf8'), before);
+  assert.equal(snapshot.reason, 'server-reconciliation-production');
+});

tests/unraid-deployment.test.mjs

@@ -114,7 +114,7 @@ test("server workload inventory links running containers to exact Gitea checkout
   );
 });
 
-test("automatic server discovery adopts and verifies a running Gitea deployment", async () => {
+test("server discovery is read-only and explicit reconciliation adopts a verified deployment", async () => {
   const b64 = (value) => Buffer.from(value).toString("base64");
   const sha = "b".repeat(40);
   const container = {
@@ -155,7 +155,7 @@ test("automatic server discovery adopts and verifies a running Gitea deployment"
     },
     gitea: { getBranch: async () => ({ commit: { id: sha } }) },
   });
-  const result = await service.discoverServerWorkloads("unraid", [
+  const repositories = [
     {
       fullName: "Jens/Portfolio",
       name: "Portfolio",
@@ -163,7 +163,16 @@ test("automatic server discovery adopts and verifies a running Gitea deployment"
       cloneUrl: "https://gitea.itworx.tech/Jens/Portfolio.git",
       sshUrl: "git@gitea.itworx.tech:Jens/Portfolio.git",
     },
-  ]);
+  ];
+  const discovery = await service.discoverServerWorkloads("unraid", repositories);
+  assert.equal(discovery.adopted, 0);
+  assert.equal(discovery.verified, 0);
+  assert.equal(profiles.length, 0);
+  assert.equal(states.size, 0);
+
+  const preview = await service.planServerInventoryReconciliation("unraid", repositories, { autoLink: true });
+  assert.equal(preview.plan.summary.additions, 1);
+  const result = await service.reconcileServerInventory("unraid", repositories, { autoLink: true, expectedPlanId: preview.plan.id });
   assert.equal(result.adopted, 1);
   assert.equal(result.verified, 1);
   assert.equal(profiles[0].containerName, "Portfolio");