fix: complete server pull deployment setup

tests/browser/forgeflow.spec.mjs

@@ -74,8 +74,11 @@ async function assertScrollableWhenOverflowing(page, selector) {
     return metrics.connected && metrics.clientHeight > 0;
   }).toBe(true);
   if (metrics.scrollHeight > metrics.clientHeight + 1) {
-    await target.evaluate((element) => { element.scrollTop = element.scrollHeight; });
-    await expect.poll(() => target.evaluate((element) => element.scrollTop)).toBeGreaterThan(0);
+    await expect.poll(() => target.evaluate((element) => {
+      if (element.scrollHeight <= element.clientHeight + 1) return 1;
+      element.scrollTop = element.scrollHeight;
+      return element.scrollTop;
+    })).toBeGreaterThan(0);
   }
 }
 test("shell, overview, repositories and settings remain responsive and accessible", async ({ page }, testInfo) => {

tests/unraid-deployment.test.mjs

@@ -40,6 +40,36 @@ test("server release directories resolve to the stable deployment root", () => {
   assert.equal(deploymentRootCandidate("ludarium/source/deploy"), "ludarium/source/deploy");
 });
 
+test("inventory refresh preserves a repository deployment root above its Compose working directory", () => {
+  const service = new UnraidDeploymentService({});
+  const existing = {
+    id: "profile", provider: "ssh-unraid", serverId: "server", environment: "production",
+    branch: "main", deploymentMode: "server-git", remoteFolder: "App/source",
+    composeWorkingDir: "/mnt/user/appdata/App/source/ops", composeProject: "app",
+    composeFiles: ["ops/compose.yml"], composeServices: ["web"], containerName: "app-web",
+    workloadIdentity: { linkSource: "automatic-compose" }, preservePaths: [".env"],
+  };
+  const workload = {
+    workloadId: "workload", kind: "compose-project", displayName: "app",
+    remoteFolderCandidate: "App/source/ops", selector: { kind: "compose-project", composeProject: "app" },
+    compose: {
+      project: "app", workingDir: "/mnt/user/appdata/App/source/ops",
+      configFiles: ["/mnt/user/appdata/App/source/ops/compose.yml"], services: ["web"],
+    },
+    containers: [{ name: "app-web", running: true, service: "web", mounts: [], ports: [] }],
+    metadata: {}, dockerMan: null,
+  };
+  const refreshed = service.refreshedProfileFromWorkload(
+    { fullName: "Owner/App", name: "App", defaultBranch: "main", sshUrl: "git@gitea.test:Owner/App.git" },
+    { id: "server", name: "Server", basePath: "/mnt/user/appdata" },
+    workload,
+    existing,
+  );
+  assert.equal(refreshed.remoteFolder, "App/source");
+  assert.equal(refreshed.composeWorkingDir, "/mnt/user/appdata/App/source/ops");
+  assert.deepEqual(refreshed.composeFiles, ["ops/compose.yml"]);
+});
+
 test("server inspection key-value payload is decoded safely", () => {
   const b64 = (value) => Buffer.from(value).toString("base64");
   const parsed = parseInspection(
@@ -86,6 +116,22 @@ test("server pull provisions a pinned repository-scoped key and records access m
   assert.equal(result.remoteSha, "a".repeat(40));
 });
 
+test("write-access inspection parses the remote permission report through the access module", async () => {
+  const encoded = (value) => Buffer.from(value).toString("base64");
+  const profile = { id: "profile", provider: "ssh-unraid", serverId: "server", remoteFolder: "App", composeFiles: ["compose.yml"] };
+  const service = new UnraidDeploymentService({
+    store: {
+      getDeploymentProfile: () => profile,
+      getServer: () => ({ id: "server", basePath: "/mnt/user/appdata" }),
+    },
+    ssh: { exec: async () => ({ stdout: `__FORGEFLOW_PERMISSIONS__\nI\t${encoded("deploy")}\t1000\t1000\t${encoded("users")}\tfalse\tfalse\nP\t${encoded("project-root")}\t${encoded("Project folder")}\t${encoded("/mnt/user/appdata/App")}\tdirectory\ttrue\ttrue\ttrue\ttrue\ttrue\ttrue\t${encoded("deploy")}\t${encoded("users")}\t2775\t${encoded("/mnt/user/appdata/App")}\t${encoded("Read/write probe passed.")}\n` }) },
+  });
+  const report = await service.inspectWriteAccess({ repository: { fullName: "Owner/App" }, profileId: "profile" });
+  assert.equal(report.ready, true);
+  assert.equal(report.identity.user, "deploy");
+  assert.equal(report.targets[0].effectiveWritable, true);
+});
+
 test("server pull verification proves a repository-scoped read-only key and exact commit parity", async () => {
   const sha = "c".repeat(40);
   const profile = {