feat(stacks): live compose output and deploy history (#1499)

* feat(security): add exact-value redaction for compose output lines

* feat(stacks): emit compose output line by line via optional callback

* test(stacks): isolate collectProcess test from the DB init side effect

stacks.ts transitively imports db.ts and db/drizzle.ts, which run a
top-level seedDatabase() against better-sqlite3 -- unsupported under
Bun (oven-sh/bun#4290). Importing stacks.ts for a plain unit test
crashed at import time and, worse, leaked into unrelated test files
sharing the same bun test process (reproduced against
tests/semver-generic-v2.test.ts). Mock both modules' full export
surface before importing, mirroring tests/backups/route-guards.test.ts's
established mock.module(./db) pattern.

* refactor(stacks): extract collectProcess into a dependency-free core module

Testing it required importing stacks.ts, which transitively pulls in
db.ts and db/drizzle.ts -- both run a top-level seedDatabase() against
better-sqlite3, which does not load under Bun. That crash was cached
process-wide and broke an unrelated, previously-green test file
(tests/semver-generic-v2.test.ts) whenever the full suite ran.
Following the repo's established -core module pattern (nav-preferences-core,
ws-exec-core, etc.), collectProcess now lives in its own dependency-free
file and is re-exported from stacks.ts for its existing callers.

* feat(security): bridge line callbacks through redaction

makeLineForwarder wraps a raw line consumer with redactLine, dropping
withheld lines silently. This is the connector collectProcess-emitted
lines will pass through before reaching the job store.

* feat(stacks): thread onLine through the local compose execution path

executeLocalCompose, executeComposeViaHawser, and executeComposeCommand
all accept an optional onLine callback now, forwarded to whichever
execution path is chosen. The local path (executeLocalCompose) wires it
into collectProcess via makeLineForwarder, redacting against envVars and
secretVars -- deliberately not spawnEnv, which also carries PATH, HOME,
DOCKER_CONFIG and DOCKER_API_VERSION and would over-redact (HOME often
resolves to "/root", five characters, below the safe-replace threshold,
which would withhold every line containing it).

executeComposeViaHawser accepts the parameter for signature parity but
does not use it yet: its /_hawser/compose call is a single
request/response, not a stream, so it cannot report lines as they
happen. That lands in a follow-up task.

startStack, stopStack, restartStack, downStack, and deployStack gained
an onLine parameter (deployStack via a new DeployStackOptions field) and
pass it through to every executeComposeCommand call in their body.
redeployStackFromDir, removeStack, pullStackImages, pullStackService,
and updateStackService are deliberately left unchanged -- they don't run
behind the streaming job endpoints.

* feat(stacks): forward redacted compose output lines to the job store

Each of the five job endpoints (deploy/start/stop/restart/down) now
passes send as the onLine callback, wrapping each line in a
{type: 'line', line} progress event. The 'line' type distinguishes
these from the existing static {status} progress events the endpoints
already send.

* chore(tests): use English throughout, matching the repository language

* refactor(tests): rename identifiers to English

* feat(ui): readJobResponse forwards line messages to an optional callback

* feat(ui): show compose output while stack operations run

* feat(stacks): surface the final output block when an agent sends no lines

* feat(stacks): thread onLine through the create and compose endpoints

POST /api/stacks (create & start) and PUT /api/stacks/{name}/compose
(save & redeploy) both run deployStack inside createJobResponse but never
passed onLine, so no 'line' progress messages were emitted and any live
output view stayed empty until the job settled.

Both now forward lines exactly like the deploy endpoint does. A source-level
guard asserts every deployStack call under src/routes/api carries onLine —
the omission is invisible at runtime, so nothing else would catch the next one.

* feat(ui): show compose output for Create & Start and Save & redeploy

The five stack-row actions opened the output window; the stack modal's two
deploying paths did not, leaving the most common route after an edit —
Save & redeploy — with no visible progress.

The modal takes three optional callbacks and forwards to them. It holds no
output state and renders no window of its own: the loop stays on the page, so
closing the modal cannot tear down a running deploy. Callers that don't pass
them are unaffected.

* feat(hawser): route agent line messages to non-streaming compose requests

* feat(stacks): consume streamed compose lines from the agent

* refactor(logs): make LogViewer's title optional and path-safe

* fix(logs): strip the escape sequences compose actually emits

The first pattern accepted only digits and semicolons as CSI parameter bytes,
so it left private-mode sequences untouched -- including ESC[?25l and ESC[?25h,
which compose's progress display writes on every redraw. A stripper that misses
the sequences of the output it exists to clean does not do its job.

Match the CSI grammar instead: ESC [ , parameter bytes (0x30-0x3F, which is
where '?' lives), intermediate bytes (0x20-0x2F), one final byte (0x40-0x7E).

Also cover the backslash branch of the path-separator test, which the previous
case did not exercise.

* feat(stacks): show compose output in the full log viewer

* feat(stacks): summarise compose output into deploy facts

* feat(stacks): add a status line with duration to the compose output window

Measure wall-clock duration client-side (Date.now() at start, diff on
result) and format it with formatRunStatus() in ComposeOutputModal's
description: "Running…", "Succeeded · 6.2s", or "Failed · exit 1 · 0.9s".

Wires all five +page.svelte stack actions (start/stop/restart/redeploy/
down) plus StackModal's two own action paths (create+start, redeploy on
save) through the same startComposeOutput/finishComposeOutput state, so
every caller of the modal reports success/failure consistently. Without
the StackModal fix, its two actions would have reported every success as
"Failed" (ok defaulting to undefined).

exitCode is read defensively from the job result but StackOperationResult
carries no such field today, so it stays undefined until the server adds
one.

* feat(deploy-logs): add filesystem-backed log store for deploy runs

Provides appendRunLog/readRunLog/deleteRunLog/listRunLogIds/runLogPath
for per-run log files under DATA_DIR/deploy-logs. The run id is
validated (not sanitised) into a filename, so a route-parameter run id
can never resolve outside the log directory. usedBytes/budgetExceeded
compute directory usage against a 2 GiB budget for a later task to
enforce.

* fix(security): keep deploy logs out of the file browser

* test(fs-guard): stop the deploy-log test from leaking DATA_DIR

Bun runs every test file in one process. Setting DATA_DIR at module scope leaked
it into unrelated suites: selfhst-icons builds and creates its cache directory
under DATA_DIR, which fails when that points at a path the machine does not
have. Both selfhst tests went red once this file was added, while each file
passed on its own.

protectedPaths() reads the variable on every call rather than at import time, so
a plain import plus beforeAll/afterAll is enough -- the dynamic import was never
needed, and it was what made the leak module-scoped in the first place.

* fix(logs): let auto-scroll pause while the user reads earlier output

LogViewer's auto-scroll effect jumped to the bottom on every logs update
whenever autoScroll was true, with no way to opt out. In the compose
deploy output window autoScroll stays true for the whole run, so
scrolling up to read an earlier line got immediately overridden by the
next line arriving.

Restore the pause/resume behaviour the removed ComposeOutputModal
output pane used to have: track how close the viewport is to the
bottom on scroll, and skip the auto-scroll effect while the user is
more than 50px away from it. Scrolling back within range resumes it.

The auto-scroll effect's own scrollTop write triggers a 'scroll' event
too, so a flag suppresses handleLogScroll for the duration of that
write -- otherwise a fast enough stream of new lines could grow
scrollHeight again between the write and the event firing, misreading
our own jump as the user having scrolled up.

The distance check is extracted into isScrolledToBottom(), a pure
function, so it has a real test (including the exact-threshold
boundary case).

Also hide the Clear/Refresh buttons when no onClear/onRefresh handler
is supplied -- LogViewer's only current caller (ComposeOutputModal)
passes neither, so both buttons were rendered as inert dead clicks.

* feat(stacks): record only redacted output lines, never the result block

* fix(logs): lift a scroll-up pause when a fresh run starts

userScrolledUp was only ever set, never reset -- so scrolling up once
during a deploy paused auto-scroll for every later run of the same
page session, measured live: heights grew (392->1130px, 446->1130px)
but scrollTop stayed frozen once a prior scroll-up had set the flag,
even on a run nobody had scrolled during.

autoScroll going from false to true is the "a fresh run is starting"
signal (ComposeOutputModal's autoScroll={running} flips false->true at
the exact moment its parent clears composeOutputLines and starts a new
compose run) -- so that edge lifts the pause. Deliberately an edge, not
a level: reacting to autoScroll simply being true would re-lift the
pause on every single update while a run is already in progress,
defeating it entirely. shouldResetScrollPause() is a pure function
again, with a test for exactly that distinction (true -> true must stay
false) alongside the three other transitions.

* fix(logs): avoid state_referenced_locally on previousAutoScroll

npm run check flagged the previous run's seeding line (`let
previousAutoScroll = autoScroll`) as reading a prop in a plain
top-level initializer, which only captures its value once and usually
signals a bug. Leave it unset instead and let the effect seed it on
its first run, where reading autoScroll is tracked -- no behaviour
change, just where the initial read happens.

* feat(sse): hook an optional RunRecorder into both createJobResponse send paths

createJobResponse has two independent send() implementations: the JSON path
(Accept: application/json) and the streaming/job-poll path. A recorder wired
into only one of them would silently miss every deploy driven through the
other -- the UI keeps working, so nobody notices.

Add an optional third parameter, RunRecorder, with line() and end(). Both
send() closures now forward shouldRecord-qualifying lines to recorder.line();
end() is called on every path out of the operation (JSON: in a finally,
awaited before the response is enqueued; streaming: from the .then()/.catch()
that already drive completeJob/failJob, unawaited since the {jobId} response
already went out by the time the operation settles).

The interface is declared here, not built here: constructing a real recorder
needs db.ts, and importing that into sse.ts would make it unimportable under
Bun. Task 10 builds the recorder in the route and imports RunRecorder from
here. Until then both callers omit the third argument, which is exactly the
prior behaviour.

* feat(db): index schedule_executions by entity and environment

Powers per-stack/container deploy-run lookups without a full table scan.

* feat(schedules): register stack_deploy and deploy_log_reconcile types

Widen every schedule-type union that the run record (stack_deploy) and
the reconcile job (deploy_log_reconcile, upcoming) will need: the two
independent unions in src/lib/server/db.ts (ScheduleType) and
src/routes/api/schedules/+server.ts (ScheduleInfo.type, duplicated in
+page.svelte), plus SystemScheduleInfo.type in scheduler/index.ts so the
reconcile job can register as a system schedule alongside system_cleanup.

Give both types real labels in the schedules page instead of falling
into the generic system-job branches: the single-selected filter label,
the two new filter dropdown entries, and the execution detail dialog's
title chain. stack_deploy has no schedule until M3, so its entries are
inert until then -- added now so they aren't forgotten later.

Also cover the two places whose correct behaviour depends on treating
deploy_log_reconcile like the other system schedules: hiding it from
the filter list when "hide system jobs" is toggled, and rejecting an
attempt to pause/resume it through the per-item toggle endpoint the
same way system_cleanup already is (it's a global, settings-driven
schedule, not a per-item cron).

The manual-run endpoint's two type switches are deliberately left
untouched: stack_deploy has no schedule to run, and deploy_log_reconcile
has no trigger function yet (that lands with its own scheduler task).
Wiring a case now would either call nothing or reference a module that
doesn't exist.

npm run check: same 687 pre-existing errors/152 warnings before and
after (confirmed via git stash), only shifted line numbers where lines
were inserted -- no new problems introduced.

* fix(stacks): size the compose output window for build logs

The window was max-w-3xl (48rem) at 60vh. Compose and BuildKit lines are wide
-- step lines, image digests, container names -- so most of them wrapped or
needed horizontal scrolling, which defeats the point of showing them.

Widened to 90rem and 85vh, clamped with min() against the viewport so it still
fits on a laptop screen with a margin instead of overflowing.

* feat(schedules): record every stack_deploy run as a schedule_executions row

Add the run record that the rest of milestone 2 depends on: without it, deploy
logs land on disk with nothing pointing at them, execution history stays empty,
and the upcoming reconciler would treat every log file as orphaned and delete it.

deploy-run-record-core.ts (buildRunDetails, importfree) assembles the details
JSON -- options, summary, exit code, compose/env hash, log file name -- and
refuses to build it without a log file name, since that name is what ties the
record to its file. deploy-run-record.ts (createRunRecorder) is the
database-touching half: creates the schedule_type='stack_deploy',
schedule_id=0 row up front, chains line() calls onto appendRunLog so
concurrent writes can't scramble the log's order, and closes the row in
end() -- which must work even when no line ever arrived, since a deploy can
fail before compose produces any output.

Also switches on deploy-log-store's total-size budget (defined in an earlier
task, never called anywhere until now): once a run's log crosses it, further
lines are dropped, the file gets a line saying so, and details.truncated is
set.

Wires the recorder into both places that call deployStack from an HTTP
handler: the dedicated deploy endpoint and stack-create-with-immediate-start.
Both now read/compute the compose and effective env up front so a compose
hash, env hash, and the schedule_executions row all exist before the SSE job
stream opens -- createJobResponse takes the recorder as an already-resolved
value, not something it can await for itself.

stacks.ts gains an exitCode field on StackOperationResult, populated by the
local/direct compose path (which already had the number, just wasn't
returning it) and left unset on a timeout or over Hawser (protocol doesn't
carry one) -- the recorder falls back to a value consistent with success/
failure when it's missing.

bun test tests/: 2828 pass, 0 fail (baseline 2826 + this task's 2 new tests).

* fix(schedules): keep the deploy summary in sync with what actually got written

line() pushed its argument onto the in-memory buffer synchronously, but only
queued the file write onto the async chain. Called several times before the
chain gets to run any of them (the ordinary case -- compose output arrives in
bursts), a line already sitting in the buffer could still get skipped by the
file write once truncation kicks in partway through the queue, leaving the
eventual summary counting a line that was never actually persisted.

Move the push into the same guarded step as the write so both share one
fate: a line only ever ends up in the summary if it also ended up in the
file. Caught by re-reading the chaining logic after writing it, not by a
test -- verified instead with a live run against a real SQLite db (tsx,
temp DATA_DIR) confirming the three-line/no-line lifecycles still land
correctly. bun test tests/: still 2828 pass, 0 fail.

* feat(stacks): add deploy-run endpoints (list, single, log, delete)

Three routes under api/stacks/[name]/deploys/ each check stacks:view/edit for
themselves -- they do not inherit /api/jobs/{id}'s no-auth model. A shared
loadOwnedDeployRun helper confirms a run actually belongs to the requested
stack and checks environment access against the run's OWN environmentId
(never a caller-supplied env query param), closing the same cross-env bypass
class backups/route-guards.ts already closed for snapshot/config lookups.

getScheduleExecutions gained an entityName filter, the actual consumer of the
(entity_name, environment_id) index from the previous commit.

Also: extracted tests/helpers/db-fake.ts, a shared mock.module() registration
point for $lib/server/db, and moved tests/backups/route-guards.test.ts onto
it. Two test files each wholesale-mocking that module collided (confirmed:
whichever wins clobbers the other's needed export, deterministically) -- the
new helper avoids that by pre-declaring every export name any test needs as a
stable dispatcher, so later-registered implementations are still reachable
regardless of which file's import resolves the specifier first.

* feat(schedules): reconcile deploy-log files against stack_deploy records

Adds a dedicated deploy_log_reconcile schedule, modelled on system-cleanup.ts's
static jobs (own cron + enabled setting, own schedule_executions row) rather
than tacking it onto system_cleanup: the operator can see and disable it
independently.

planReconcile() is a pure decision core: a file with no matching record is
deleted (an orphan with nothing left to explain it); a record with no file is
only marked via details.logMissing, never deleted, since the run metadata
(when, who, what was built) stays valuable once the log text is gone. The
asymmetry is the point -- over-eager deletion here would destroy exactly the
record this job exists to protect.

run/+server.ts gained a deploy_log_reconcile case in both switches (env
resolution and dispatch) -- without it every manual trigger 400s, since both
switches already have a default that rejects unknown types.

ASSUMPTION flagged in deploy-log-reconcile.ts: the record side reads
schedule_executions rows with scheduleType 'stack_deploy' and treats
String(id) as the deploy-log run id. Nothing in this branch creates such a
row yet -- that is Task 10's createRunRecorder, not landed here (confirmed:
no t10/done ref exists). This is read-only against the existing, already
scheduled ScheduleType union, not a substitute for Task 10's write path, but
it is unverified against Task 10's actual output and needs a look once that
lands.

triggerDeployLogReconcile() is a separate function rather than a branch in
triggerSystemJob(): that function dispatches by a flat, type-less jobId
string, and DEPLOY_LOG_RECONCILE_ID (1) would otherwise collide with
SYSTEM_SCHEDULE_CLEANUP_ID (also 1, different scheduleType).

* fix(schedules): don't mark an in-progress deploy's record as logMissing

Read deploy-run-record.ts directly (Task 10's real code, in a sibling clone
not yet merged onto this branch) to check the assumption flagged in the
previous commit -- and it confirmed the record-id linkage is exactly right
(scheduleType 'stack_deploy', String(schedule_executions.id) as the deploy-log
run id), but also surfaced a race this job didn't guard against: the row is
created with status 'running' before the deploy has written a single line,
and the log file only comes into existence on the first line() call. A
reconcile firing in that window would mark an actively-running deploy as
logMissing, and nothing here ever re-checks or clears that flag once the file
does appear -- so the record would carry a false "log missing" permanently.

getScheduleExecutionIdsByType() now also returns status; records still
'queued'/'running' are excluded from markMissing candidacy (a later run will
catch them correctly once the deploy has actually finished) while remaining
in recordIds, so an already-written file for them stays protected from
deletion either way.

* test(schedules): extract the in-progress guard into a tested pure function

isEligibleForMissingMark() replaces the inline NON_TERMINAL_STATUSES array
check in deploy-log-reconcile.ts -- same decision, now importfree and covered
by its own tests (both non-terminal statuses excluded, every terminal status
included), with a mutation counter-test confirmed to go red for the right
reason before being reverted.

* fix(stacks): keep compose output visible below the editor on deploy

Save & redeploy and Create & Start used to hand live output off to a
separate window and close the stack modal immediately, so the editor
and the output were never visible at the same time -- forcing the user
to close the output window just to get back to the compose they were
editing.

The modal now keeps its own output state (lines, running, ok, ms, exit
code) and renders it inline below the editor instead of forwarding to
the page's shared ComposeOutputModal. Whether the modal closes after a
save is now a small pure function, shouldCloseAfterSave(deployed): a
plain save still closes, a deploy stays open so the output stays
visible.

Also fixes a pre-existing bug in the same code path: the error branch
called finishOutput(undefined, false) unconditionally, clobbering the
real ok/exitCode a prior successful finishOutput call had already
recorded when the job itself reported failure. Now guarded on
outputRunning so a real result from the server is never overwritten.

GitStackModal.svelte does not use the onOutput* props and needed no
changes.

* fix(stacks): clear docked deploy output when the modal reopens

StackModal is persistently mounted -- one instance is reused for every
stack. The new output* state introduced for the docked deploy output
was only ever assigned in startOutput(), so it survived close/reopen
just like the pre-existing compose-validate state does. Reopening the
modal for a different stack could show the previous stack's title,
lines and "Succeeded"/"Failed" status under the new stack's editor,
which reads as if something just ran for it.

Reset all seven output* fields in the same open-effect block that
already clears validate panel state on each open, for the same reason.

A reopen of the *same* stack while its own deploy is still running
loses the lines gathered so far, but the poll loop in sse-fetch.ts
keeps running regardless of the modal's open state (same as
ComposeOutputModal), so new lines resume arriving within one poll
interval; and if the job finishes before any new line does,
finishOutput's existing "outputLines.length === 0 && output" fallback
refills the whole transcript from the job's final output. That brief,
self-correcting gap was judged preferable to a stale result silently
misattributed to the wrong stack.

* fix(deploys): require env on the list endpoint to stop cross-environment leaks

GET /api/stacks/[name]/deploys treated `env` as optional. Omitting it left
envIdNum undefined, which skipped the enterprise environment-access check,
made auth.can() evaluate the caller's globally-merged permission instead of
their permission for one specific environment, and dropped the environment
filter from getScheduleExecutions() entirely -- returning stack_deploy runs
(timestamps, status, error text, details.userId) from every environment that
happens to have a same-named stack, regardless of what the caller's role
actually grants.

A stack name alone doesn't identify one environment, so there's no correct
behavior for a missing `env` beyond rejecting the request: parse and validate
it before the permission check runs, so auth.can() and canAccessEnvironment()
always see a definite id. Sibling routes under .../deploys already close this
class via loadOwnedDeployRun (env derived from the loaded run); this was the
one route deriving it from an optional query parameter instead.

* fix(schedules): isolate per-element failures in the reconcile job

Reproduced independently: one throwing deleteRunLog/updateScheduleExecution
call aborted the whole run -- and since the failing element is never
removed/marked, every LATER run failed at the exact same element again,
permanently. A harmless orphan file ordered before the failing one was still
removed; everything after it was not; the failed run's own `details` came
back null, so the partial progress wasn't even visible.

Both loops now wrap each element in its own try/catch (same shape as
scheduler/index.ts's scannerCleanupAllEnvs, which does this per-environment
for the same reason). Failures are counted and logged individually instead
of aborting.

Counts now reflect what actually happened, not what was planned:
deletedFiles/markedRecords only increment on success, plus a new `failed`
count. Previously markedCount was derived from plan.markMissing.length minus
skippedInProgress -- correct only by coincidence, since nothing before this
commit could fail mid-loop; a failing element would have inflated it to the
planned size.

A run with per-element failures is recorded as 'warning' rather than
'success' -- this repo's existing convention for "completed with a caveat"
(see the ScheduleStatus doc comment in db.ts), not 'failed', which stays
reserved for the run itself throwing (the outer catch, unchanged).

Tests (tests/deploy-log-reconcile-job.test.ts, new): one per loop, each with
a mutation counter-test confirmed to fail for the right reason (the element
after the failure was unreached; the reported count matched the plan instead
of the outcome), then reverted. $lib/server/db faked via
tests/helpers/db-fake.ts's shared registry (extended with the five exports
this job needs); $lib/server/deploy-log-store mocked directly since no other
test file claims it.

* fix(sse): reuse endFromResult on the streaming path so a failed run is recorded as failed

A failed docker compose run sends result:{success:false,error} and returns
normally -- it never throws. On the fire-and-forget streaming path (no Accept
header, the path every browser call takes), the .then() branch hardcoded
recorder.end(true) regardless of the result payload, so every such run was
persisted with status:"success" and errorMessage:null.

The JSON path already derives ok/error from the held-back result via
endFromResult(); reuse it here instead of duplicating success/failure logic,
using the result line the .then() branch already reads for completeJob().

* fix(deploy-run-record): redact known secret values out of the stored error text

DeployRunRecorder.end() wrote result.error verbatim into schedule_executions'
errorMessage/details on a failed run. That string is compose's raw, unredacted
stdout/stderr (deploy-recorder.ts's shouldRecord() deliberately excludes the
'result' event from the log file for this exact reason). GET
/api/schedules/executions returns errorMessage/details to every authenticated
user, with no stack/environment permission check -- so a secret that leaked
into compose's error output was readable across permission boundaries.

createRunRecorder() now takes the same merged secrets list its callers already
build for envHash, and end() runs the error text through the same redactLine()
the streamed lines already use before storing it. When redactLine withholds
the whole line (a too-short value matched), the row still closes "failed" with
a safe placeholder instead of no message at all -- a run stuck as "running"
forever is worse than one with a generic error.

* fix(stacks): auto-close after a successful deploy, stay open on failure

Operator decision (30.08.2026), after seeing the docked output live:
always keeping the modal open post-deploy was as wrong as always closing
it used to be. A plain save still closes as before. A deploy that
succeeded now closes too, just after a longer delay so the result is
still glimpsed. A deploy that failed keeps staying open.

shouldCloseAfterSave(deployed: boolean): boolean is replaced by
saveCloseTiming(deployed: boolean, ok: boolean): 'close' | 'close-delayed'
| 'stay-open', so the three operator-specified outcomes are each
individually representable and testable, instead of collapsing "closes"
into one boolean that couldn't distinguish "right away" from "after a
flash".

Verified there is no path at the two call sites where a failed deploy
resolves without throwing first: both POST /api/stacks and PUT
/api/stacks/{name}/compose always send an explicit `result` event with
success:false on failure, with an explicit `return` right after it, so
neither send() call falls through to the success path afterwards. The
'stay-open' branches at both call sites are therefore dead code today,
kept only so the switch stays exhaustive if that ever changes.

* feat(stack-modal): make the live output panel's height resizable

The output panel below the compose editor had a fixed height. Add a
horizontal drag divider (mirroring the existing vertical compose/env
split) so the panel can be resized between 15% and 70% of the combined
editor+output area, persisted to its own localStorage key.

Extract the clamp used by both splitters into clampSplitRatio() and fix
a latent bug along the way: Math.max(min, Math.min(max, value)) does
not clamp when value is NaN (Math.min/Math.max propagate NaN), which
happens for real when a container's measured size is briefly 0 during
a drag. The existing compose/env splitter had the same bug and now
uses the same fixed clamp.

* fix(stacks): record Save & redeploy (compose PUT) as a stack_deploy run

PUT /api/stacks/[name]/compose with restart:true redeployed the stack but
never built a run recorder, unlike the dedicated deploy endpoint and
stack-create-with-immediate-start. After a successful redeploy the modal
now auto-closes (recent change), so this was the only path where the
output of a successful deploy was fully lost -- no schedule_executions
row, no log file, nothing to look back at.

Wires createRunRecorder in identically to deploy/+server.ts: switches the
authoritative-paths lookup from getStackComposeFile to requireComposeFile
(same call, now also resolving secretVars/nonSecretVars), hashes the
just-submitted `content` (not a re-read off disk -- saveStackComposeFile
already wrote this exact string, and it's the same string handed to
deployStack), and hashes the merged effective env for envHash. Skipped
entirely when requireComposeFile unexpectedly fails right after a
successful save, so a run is never recorded with an empty secrets list.

restart:false (save only) is untouched -- no recorder is built, no row is
created.

Adds tests/helpers/authorize-fake.ts, mirroring db-fake.ts's dispatcher
pattern, and moves tests/deploy-endpoints.test.ts's inline authorize mock
onto it -- a second direct mock.module('$lib/server/authorize', ...) in
the new test file would have collided with that file's existing one.

bun test tests/: 2878 pass, 0 fail (baseline 2870 + this task's 8 new
tests). npm run check not yet run.

* fix(stack-modal): clamp the validate-panel width the same way, and rename accordingly

validatePanelWidth = Math.max(320, Math.min(560, w)) had the same NaN
gap as the two split-ratio clamps fixed earlier: if editorRowRef's
measured width is briefly 0 during a drag, w becomes NaN and the
"clamp" stays NaN.

clampSplitRatio never assumed a percentage, only value-vs-bounds
ordering, but its name did -- applying it to a pixel width buried that
under a misleading name. Renamed it (and its module/test file) to
clampNumber, with a doc comment that says plainly it works for both
percentage ratios and pixel distances, and a dedicated test proving
the pixel bounds (320-560) clamp exactly like the percentage bounds.

* feat(stack-modal): add a Deploys tab showing recorded run history

Adds a third history-style tab next to Backups: each recorded
stack-deploy run (GET /api/stacks/{name}/deploys, env required) as a
collapsed row -- status, relative time, duration, and a one-line
container/build summary -- expandable for the full picture: container
counts, whether the build came from cache or not, images built/pulled,
the deploy options used, a truncated-log notice, and on failure the
shortened last error line.

All of that text composition lives in deploy-run-view.ts as pure,
import-free functions (mirrors deploy-summary-core.ts's own reasoning:
no $lib/server import, so the test file runs under Bun without
dragging in better-sqlite3). The one case load-bearing enough to name
in its own doc comment: a run with no summary at all (compose produced
zero output lines) must read as "unknown", never silently as "zero
containers, nothing built" -- those are different facts.

No component test exists for DeploysPanel.svelte itself -- this repo
has no Svelte component test harness (no @testing-library/svelte, no
jsdom; @playwright/test is a dependency with zero test files). Manual
verification only for the component; the 37 new unit tests cover every
branch of the text-composition layer instead.

* perf(deploy-log-store): stop re-scanning deploy-logs/ on every appended line

DeployRunRecorder.line() called budgetExceeded() (a full readdir+stat over
every file in deploy-logs/) after every single line, so a deploy's cost grew
with both its own output AND the number of past runs' log files on disk.
Measured: 200 lines against 500 existing files took ~16.2s; against 50 files
~1.8s; with the scan removed entirely, ~49ms.

Replace that per-line full scan with SizeBudgetTracker: the directory total
excluding this run's own file is measured once, lazily, and cached; each
appended chunk's byte length is added to an in-memory running total (no
stat() involved); the cache is only re-measured once the run's own output
crosses 1 MiB since the last measurement. The budget itself is unchanged
(2 GiB, checked after each write per design doc §5) -- only how often the
directory gets re-scanned to check it.

This trades exactness for speed under concurrent writers: a run started
right after this run's baseline was measured is invisible to this run's
budget check until the next refresh. Documented on SizeBudgetTracker as an
intentional trade-off -- BUDGET_BYTES exists to catch a filled disk, not to
enforce a precise quota, and the old per-line scan had no locking against
concurrent appendRunLog() calls either.

Tests: SizeBudgetTracker's budget math (under/over/already-over-before-first-
byte), its refresh cadence (scans once for 200 small appends where the old
code would have scanned 200 times, and again once a single big append
crosses the refresh threshold), and the documented concurrent-writer gap.
Plus a DeployRunRecorder-level truncation test via an injected tiny-budget
tracker (SizeBudgetTracker now takes optional budgetBytes/measureOthers
params, DeployRunRecorder now takes an optional sizeBudget -- both test-only
seams, unused by production callers).

Refs branch-review.md H2.

* feat(stack-modal): load and show a deploy run's log on expand

Expanding a Deploys-tab row now fetches GET .../deploys/{id}/log into a
LogViewer, lazily -- never while the list itself loads. A run already
marked logMissing by deploy-log-reconcile skips the fetch entirely
instead of making a request that would just 404.

buildDeployLogPanelState (deploy-run-view.ts) turns the run into the
three independent facts the panel needs: whether the log is missing,
whether it was truncated, and whether the run has settled enough to
allow deleting it -- so a missing log never renders as an empty
viewer, and no delete action is offered while a run is still running.

* fix(deploys): scope stacks:view/edit permission checks to the run's own environment (H1)

GET/DELETE .../deploys/{runId} and GET .../deploys/{runId}/log checked
auth.can('stacks', 'view'|'edit') without an environmentId, which falls back
to the caller's globally-merged permission (OR across every role, per every
environment). A caller with stacks:view/edit scoped to environment A could
therefore read, or delete, a deploy run belonging to environment B, as long
as they also had SOME role granting stacks:view/edit somewhere -- and
loadOwnedDeployRun's own canAccessEnvironment check does not close this,
since it only confirms "has some role for this environment", not "has
stacks:view/edit specifically for this environment".

Add a second, run-scoped check via can('stacks', <action>, run.environmentId
?? undefined) AFTER loadOwnedDeployRun resolves the run -- in addition to,
not instead of, the existing un-scoped gate, so the pre-existing "no
permission anywhere" 403 tests keep their exact prior behavior. This is the
same derive-environment-then-check pattern api/git/stacks/[id]/+server.ts and
its env-files route already use for their own nullable environmentId. The
sibling list route (deploys/+server.ts) already documents and closes this
exact bug class for itself; this closes it for the three single-run routes
too.

Regression tests confirm the scoped check is what closes the gap: reverting
just the two source files turns the three "denied" tests red with the
pre-fix symptom (200 instead of 403), while the "allowed" tests stay green.

* fix(deploys): list route treats the local environment (env omitted) as reachable, not a 400 (H3)

On a single (local-only) environment install -- the normal case -- every
deploy run is recorded with environment_id = NULL: createRunRecorder()
writes it that way whenever the triggering request carried no envId, which
is always true for the local environment, because appendEnvParam()
($lib/stores/environment.ts) only appends an `env` query param when envId is
truthy. GET .../deploys required `env` as a parseable integer and 400'd
otherwise -- and there was no integer a caller could pass that matched a
NULL row (env=0 included; environment ids are never 0). The result: on a
fresh, single-environment Dockhand install, EVERY recorded deploy run was
completely unreachable through this endpoint.

The data layer already supported this -- getScheduleExecutions() maps
`environmentId: null` to `isNull(...)` -- only this route couldn't express
"give me the null-environment runs" at all.

Fix: two `env` shapes now both resolve to `environmentId: null` ("the local
environment") -- the parameter OMITTED entirely (the shape the UI actually
sends), and the literal string "null" (for direct/curl callers). Anything
else must still parse as an integer; a genuinely invalid value is still a
hard 400, so "list runs, unspecified environment" never silently means "all
environments merged". The permission check maps the null case to
`can('stacks', 'view', undefined)` -- the same "no environment context"
global-permission check api/git/stacks/[id]/+server.ts already uses for ITS
nullable environmentId -- so a caller still needs stacks:view somewhere to
see local-environment runs; canAccessEnvironment() is skipped for null (there
is no environment record to check access against).

Test coverage updated in the same file the pre-fix "missing env -> 400" and
"cross-environment leak" tests lived in, since both encoded the very
behavior this fixes (the leak test now confirms the null filter itself
still excludes a different, non-null environment's runs -- the security
property that motivated requiring `env` in the first place is unchanged).
Reverting just the route file turns the two H3-labeled tests red with the
pre-fix symptom (400 instead of 200).

* fix(openapi): move loadOwnedDeployRun-produced 400/404 into prose, closing the CI status-code-drift gate (B1)

`npm run generate:openapi:check` (.github/workflows/openapi.yml:49) failed
with 5 Gate-4 (status-code drift) issues: GET/DELETE .../deploys/{runId}
documented resp-400 and resp-404, and GET .../deploys/{runId}/log documented
resp-400, but all three of those specific codes are produced by the SHARED
loadOwnedDeployRun() helper (deploy-run-access.ts) -- not by a literal
`status: 400` / `error(400)` in the handler's OWN body text, which is all
scripts/generate-openapi.ts's static scanner (analyzeHandlerBody) can see.
statusDrift > 0 is a hard failure.

Fix: move that information into the `description:` field as prose instead of
resp-400/resp-404 lines -- the same pattern already used by
POST /api/backup/destinations/{id}/task for its own guard-produced codes.
Nothing is undocumented: the codes and their meaning are still explained,
just not as a formal schema-level response entry the generator expects to
find literally in the handler it's annotating. The log route's resp-404 line
stays as-is (its "Log not found" 404 IS literal in that handler's own body,
alongside loadOwnedDeployRun's 404 which is now covered by the same prose).

Also regenerates src/lib/openapi.generated.json and static/openapi.json
(--check writes both as a side effect of running) -- picks up this fix plus
unrelated, already-existing drift from earlier commits on this branch that
had never been regenerated (the deploy_log_reconcile schedule type additions
to two already-annotated schedule endpoints).

Verified: `npm run generate:openapi:check` was Exit 1 ("Hard failures: 1",
the 5 issues above) before this commit, at this branch's HEAD, in a fresh
clone with `npm install` -- Exit 0 ("Hard failures: 0") after.

tests/deploy-run-openapi-drift.test.ts reproduces Gate 4's own drift check
directly against these three routes' annotations (via the same
parseAnnotations/splitMethodBodies/analyzeHandlerBody the generator itself
uses) rather than shelling out to the full generator, which scans and
rewrites the entire route tree for what is a narrow, three-file regression.
Reverting just the two doc-comment edits reproduces the exact stale-code
sets from the CI report (["400","404"] and ["400"]).

* fix(stack-modal): stop duplicating a failed run's full error text

The expanded row's error box rendered the raw errorMessage (compose's
full stderr) verbatim, right above the new log panel from this same
task -- for a failed run, that meant showing almost the same text
twice. Task 17's own spec called for the shortened last error line
here (the same text the collapsed row already truncates to), not the
raw message; the box now shows view.errorSummary instead. The full
text has exactly one place now: the LogViewer beneath it.

* fix(stack-modal): fetch deploy runs for the local environment too

envId === null is not "no environment selected" -- per the list route's
H3 fix (.../deploys/+server.ts), it IS the local environment: a
single-environment install's own deploy calls never send an env param
either (appendEnvParam only appends one when envId is truthy), so
every one of its runs is recorded with environmentId === null, and the
route now resolves an omitted env to exactly that filter.

The guard that skipped the fetch and showed 'No environment selected.'
predates that fix, from when the endpoint hard-required env and would
400 without it. With the endpoint now accepting the omitted shape, the
guard silently kept the tab empty on the most common install shape
even though the API would have answered. Removed -- onMount fetches
unconditionally, appendEnvParam already produces the right URL for
both the local (null) and a specific (numeric) environment.

No pure-function decision to extract here: the branch this replaced
IS the fix, not a rule with two live outcomes -- appendEnvParam
already forms the correct request for both envId shapes, so there is
nothing left in the component to test beyond what deploy-endpoints.
test.ts already covers at the route.

* feat(git-stacks): record stack_deploy runs for every git-stack deploy trigger

deployGitStack() is the single function every git-stack deploy trigger funnels
through -- the manual Deploy button, a config-update-then-redeploy, both webhook
methods, create-and-deploy, and (via runGitStackSync) the cron scheduler and the
schedules page's "run now". Wire the stack_deploy run recorder in there, not at
a single HTTP route: wiring it only at the route level (the way compose PUT and
the non-git deploy endpoint already do it) would leave every other caller --
crucially the cron- and webhook-triggered ones, the truly unattended runs the
deploy-verlauf design doc's Meilenstein 5 is about -- unrecorded.

composeHash is taken from the content actually synced from git; envHash/secrets
mirror the same (deliberately approximate) DB-var resolution the non-git routes
already use. Every real call site now passes an explicit triggeredBy (manual/
webhook/cron) instead of the previous unconditional default, and the manual
routes forward auth.user?.id and an onLine callback so SSE progress streaming is
unchanged for HTTP callers.

Added tests/helpers/stacks-fake.ts (mirroring db-fake.ts's collision-safe
registration pattern) since syncGitStack -- deployGitStack's sync step -- is a
same-module collaborator that can't be faked via mock.module(), so the new test
drives a real git sync against a local repo served by a real `git daemon`
subprocess, faking only the $lib/server/stacks boundary (deployStack). Migrated
the existing compose-redeploy test to the same shared helper, since a second
direct mock.module('$lib/server/stacks', ...) call would have collided with it.

* docs(backups): note that a restore's redeploy has no stack_deploy run record

Backup restore's redeploy calls redeployStackFromDir directly, bypassing the
deployGitStack()/compose-route path createRunRecorder is wired into -- so it
gets no stack_deploy row and no log file. Left unrecorded on purpose (its own
piece of work, no structural blocker), but that was invisible in the code: no
comment, no marker, nothing to distinguish it from an oversight for a reader
who doesn't already know the history.

* fix(git-stacks): coerce forceRecreate to boolean for the run recorder's options

syncResult.updated is boolean | undefined; DeployRunOptions.forceRecreate wants a
strict boolean. Caught by a differential tsc run against the parent commit (the
only genuinely new type error introduced by the previous commit -- everything
else tsc reported was pre-existing, just line-shifted).

* fix(api): thread build/pull/forceRecreate through stack create & redeploy

POST /api/stacks and PUT /api/stacks/[name]/compose always deployed with
build:false and no pullPolicy, regardless of what the request sent -- a
stack whose compose declares a build: section silently never rebuilt on
"Create & Start" or "Save & redeploy" (the saved compose change just ran
against the stale local image). Both endpoints now accept pull, build,
and forceRecreate in the request body and forward them to deployStack()
and the run recorder, matching the contract the dedicated deploy endpoint
(POST /api/stacks/[name]/deploy) already uses.

PUT .../compose defaults forceRecreate to true when the field is omitted,
preserving its prior hardcoded behavior for a caller that has not been
updated to send it explicitly (env var changes need --force-recreate to
take effect). POST /api/stacks (Create & Start) has no such compatibility
concern -- there is nothing to recreate on a brand new stack -- so it
defaults all three to false when omitted.

pull:false intentionally leaves pullPolicy undefined rather than mapping
to a "never"/"missing" policy: deployStack() treats an undefined
pullPolicy as "do not pull", and its own post-deploy pending-update badge
reconciliation is gated on the same field, so unchecking Pull images also
means a stale "update available" badge on that stack will not clear until
the next pull. Documented at both call sites, not just left implicit.

Regenerated static/openapi.json and src/lib/openapi.generated.json for the
new pull/build/forceRecreate body fields on both @openapi blocks.

* feat(stacks): let Save & redeploy / Create & Start pick pull/build/force-recreate

"Save & redeploy" and "Create & Start" in the stack edit dialog silently
never rebuilt a service with a build: section (see the paired API commit).
Fixing the endpoints alone isn't enough without a way for the operator to
actually ask for a build -- both buttons are now wrapped by RedeployPopover
instead of deploying immediately, offering the same Pull/Build/Force
recreate checkboxes already used for redeploying from the stack grid.

RedeployPopover gains:
- triggerVariant="button" + triggerClass, so it can render as a full
  labeled trigger styled like the shadcn Button component (buttonVariants)
  instead of only the small icon-only trigger the stack grid rows use.
- defaultPull/defaultBuild/defaultForceRecreate + reason, re-seeded into
  the checkboxes on every open (not just once at mount) so a caller whose
  default tracks live content -- "does the compose have a build: section
  right now" -- stays correct across repeated opens.

"Build images" is pre-checked whenever the compose file declares a build:
section for any service (compose-build-detect.ts, extracted as a plain
function with its own test rather than left inline in the component, the
same way save-close-policy.ts is). "Pull images" defaults to unchecked for
both buttons (unlike the grid's redeploy popover, which defaults it on) --
Save/Create already run against whatever images are already local, pulling
is an explicit extra step here. "Force recreate" defaults to checked for
Save & redeploy only, preserving its prior always-on behavior now that the
API also accepts a caller opting it off; Create & Start defaults it off
since there is nothing to recreate on a brand new stack.

pendingSaveOptions carries the chosen options through the path-change
confirmation dialog the same way pendingSaveRestart already does, so
re-entering handleSave() after the operator confirms a compose/env file
move still deploys with what they actually picked in the popover.

* chore: drop internal planning-doc references from comments

Comments and test descriptions referenced an internal milestone label and
design-doc section number that mean nothing to anyone outside this repo's
own planning process. Reworded to be self-contained -- no behavior change.

* refactor(stacks): split "Save & redeploy" / "Create & Start" into main + arrow

The previous shape had the whole button open the popover before deploying
anything -- correct behavior, wrong ergonomics. The common case (just save
and redeploy, or just create and start, with sane defaults) now takes one
click again: the label is a real, directly clickable button. A separate
small chevron button to its right opens the same Pull/Build/Force recreate
popover for the cases that need it. Two independently focusable <button>
elements sitting flush together, not one element whose behavior depends on
click position.

RedeployPopover's triggerVariant switches from 'button' (removed, was a
label-plus-icon trigger wrapping the whole action) to 'chevron' (a small
square trigger meant to sit attached to a separate main button the caller
renders itself -- the popover no longer owns the main button at all).

saveRedeployDefaults/createStartDefaults in StackModal are the single
source of truth for "what a direct click deploys with", shared between
each main button's own onclick and the popover's defaultPull/defaultBuild/
defaultForceRecreate props next to it, so the one-click path and the
pick-then-Deploy path can never quietly diverge on what "the default"
means.

The two existing icon-only redeploy triggers in the stack grid (RedeployPopover
used there via the unchanged 'icon' variant) are untouched -- they were
already the "click opens a menu" shape by design, since there is no separate
main button in a table row to split off from.

* feat(logs): follow the caller's own theme in LogViewer

LogViewer defaulted to a hardcoded dark theme regardless of the
editor's own light/dark toggle. Add a theme prop (defaulting to
'dark', so any caller that doesn't pass it renders unchanged) and
wire it through the two places that already have an editor theme in
scope: StackModal's docked output panel and, forwarded through a new
theme prop on DeploysPanel, the Deploys tab's expanded run log.

ComposeOutputModal has no editor in scope (opened straight from the
stack list) — its Dialog.Content already follows the app-wide
light/dark switch via bg-background, so it reads that switch once on
mount instead, mirroring the existing pattern in ComposeGraphViewer's
graphTheme.

Search-match highlighting gets a light-mode override, scoped to
.log-viewer-light so it doesn't touch the shared (unscoped)
.search-match rule other components such as LogsPanel still rely on:
the base rule's near-white text is illegible against the pale amber
highlight once the panel itself goes light.

* fix(stacks): pass DeploysPanel's theme prop under its own name

{editorTheme} is Svelte's shorthand for a prop literally named
editorTheme -- DeploysPanel's Props interface declares theme, not
editorTheme, so this silently passed an unknown prop and left theme
at its 'dark' default. svelte-check caught it: 'editorTheme' does not
exist in type 'Props'. bun test doesn't type-check props, which is
why it stayed green through the first commit.

* fix(sse): guard RunRecorder.end() against a second call if it throws

createJobResponse's fire-and-forget path calls recorder.end() in its
.then() branch. If that call itself throws, the rejection lands in
.catch(), which unconditionally called recorder.end() again -- breaking
the RunRecorder contract that end() runs exactly once.

Track whether the .then() branch already reached its end() call and
skip the .catch() call when it did, regardless of whether end() itself
resolved or rejected.

* test(fs-guard): remove redundant DATA_DIR assignment before the import

isProtectedPath() only reads process.env.DATA_DIR lazily inside its own
call, not at module-import time, so the beforeAll/afterAll pin already
in this file is sufficient on its own -- the extra assignment right
before the dynamic import did nothing.

Verified by measurement, not assumption: this file passes standalone,
paired with selfhst-icons.test.ts in both file orders, and as part of
the full suite, all without the removed line.

* refactor(components): move LogViewer out of the logs route

LogViewer.svelte lived under src/routes/logs/ but was never used by
that route (LogsPanel.svelte and +page.svelte render container/system
logs their own way). Its only three consumers -- ComposeOutputModal,
StackModal, and DeploysPanel, all under src/routes/stacks/ -- imported
it cross-route with a relative path, which is what shared components
under src/lib/components/ exist to avoid.

Moved it there and repointed all three imports at the $lib alias. No
internal change: every import inside LogViewer.svelte already used
$lib/... aliases, none were relative to its old location.

* test(types): fix svelte-check type errors in two test files

deploy-run-record-core.test.ts: d.summary is DeploySummary | undefined
on RunDetails, so d.summary.containersStarted possibly-undefined'd.
Switched to optional chaining -- the assertion stays just as strong
since expect(undefined).toBe(2) still fails, the RHS is a hard literal.

deploy-run-view.test.ts: both test.each((input, expected) => ...)
callbacks had their params implicitly typed 'any'. Both formatTrigger
and formatStatusLabel take/return plain strings, so annotated both
params 'string', matching the explicit-annotation style test.each
already uses elsewhere in this repo (stack-filename.test.ts).

* feat(settings): make deploy-log reconcile schedule configurable

setDeployLogReconcileCron/setDeployLogReconcileEnabled existed in db.ts
with no caller outside of it and the scheduler startup path -- there was
no way to disable or reschedule the daily reconcile job (which deletes
orphaned deploy-log files) short of writing to the settings table by
hand. Wire both into the general settings GET/POST route, the client
settings store, and a new toggle+cron block on the General settings
tab, following the existing scannerCleanupCron/scannerCleanupEnabled
pattern in the same files.

refreshSystemJobs() already read these getters before this change; it
just never had anything to react to.

* fix(format): read naive server timestamps as UTC in formatRelativeTime

formatRelativeTime() parsed its input with a bare `new Date(...)`, so a
naive PG timestamp (e.g. "2026-08-30 20:36:11.534" - no "Z"/offset, the
form Drizzle hands back for a `timestamp without time zone` column) got
read as browser-local time instead of UTC. A deploy from a couple of
minutes ago rendered as "2h ago" for anyone outside UTC.

date-format.ts already solved exactly this for formatDateTime() via
parseTimestamp() (#1183), but formatRelativeTime() lives in the
import-light utils/format module and was never switched over, even
though every caller passes the same raw server value to both functions
side by side.

Switch formatRelativeTime() to parseTimestamp() as well. Behavior is
unchanged for Date instances, epoch numbers, and already-zoned strings;
only the previously-mishandled naive-string case is fixed.

Added a TZ-forced (America/New_York) test block that reproduces the
bug and verifies the fix; reverting the change makes those three tests
fail with "in the future" (a 4h forward misinterpretation), confirming
they fail for the right reason.

* fix(tests): inject the reconcile job's log-store calls instead of mocking the module

mock.module() freezes a module's export shape for the whole test process, not
just the file that calls it. The reconcile job's test replaced
'$lib/server/deploy-log-store' with a two-export factory, so every module that
resolved the same specifier afterwards lost the other eight -- deploy-run-record.ts
imports appendRunLog, runLogFileName and SizeBudgetTracker from there and threw
"Export named ... not found".

Whether it triggered depended purely on the order bun walks tests/, which is why
the suite was green locally and red in CI.

The test's own comment reasoned that no other test file claimed that specifier.
That was the wrong question: the collision is with source modules, not test files.

runDeployLogReconcileJob() now takes its two filesystem calls as an optional deps
parameter, defaulting to the real ones. The test passes fakes and no longer
touches the module registry, so there is nothing left to collide.

* fix(deploy): redact provider-resolved secrets from stored deploy errors

Deploy run records (schedule_executions.errorMessage, readable by every
authenticated user via GET /api/schedules/executions) were redacted only
against the secret list a caller had at recorder-construction time --
DB-only nonSecretVars/secretVars, captured BEFORE deployStack() calls
resolveProviderEnvVars() and merges in the bound secret provider's
values (Bitwarden/1Password/Keepass/Proton/Vault/Infisical bulk pulls or
inline refs). A provider-resolved secret that surfaced in compose's raw
stderr therefore passed straight through DeployRunRecorder.end()'s
redaction and into errorMessage unredacted.

Add StackOperationResult.resolvedSecrets, populated once in deployStack()
(the single call site after resolveProviderEnvVars, covering both the
local and Hawser paths) from the post-resolution secretVars -- the same
set executeComposeCommand already redacts streamed lines against. Add
RunRecorder.addSecrets()/DeployRunRecorder.addSecrets() to extend the
redaction list after construction, and call it from every stack_deploy
run-record caller (the three createRunRecorder-based API routes and
deployGitStack, the funnel every git-stack deploy trigger -- including
the unattended cron/webhook ones -- goes through) right after
deployStack() returns and before the recorder is closed.

Regression tests assert on the stored value, not just field presence,
and were verified against a temporarily neutered addSecrets() (the
secret leaked verbatim, confirming they fail for the right reason)
before being restored to pass.

* fix(deploy-logs): scope deploy-log directory and size budget per environment

Before this fix, deploy-log-store.ts kept ALL environments' deploy-run log
files in a single shared deploy-logs/ directory and enforced a single
BUDGET_BYTES total across all of them (SizeBudgetTracker). A user with
deploy rights in one environment could fill that shared budget with a noisy
deploy, silently truncating deploy logs and summaries belonging to every
other environment -- a multi-tenant audit-trail integrity violation.

- deploy-log-store.ts: every path/size function now takes an `envId` and
  resolves to deploy-logs/<envDirName(envId)>/ (envDirName(null) => "null").
  SizeBudgetTracker measures "everything else" scoped to its own run's
  environment only. Added envDirName/parseEnvDirName, listEnvDirNames() for
  reconcile-job discovery, and a readRunLog() fallback to the pre-F5 flat
  path (unreleased feature, no production data in that layout -- fallback
  exists purely as a robustness measure).
- deploy-run-record.ts: DeployRunRecorder threads its envId through to
  appendRunLog() and its default SizeBudgetTracker.
- db.ts: getScheduleExecutionIdsByType() now also returns environmentId, so
  the reconcile job can group records per environment.
- deploy-log-reconcile.ts: reconciles PER ENVIRONMENT (union of directories
  on disk and environments referenced by records), so an orphan file in one
  environment can never be deleted -- or a record marked logMissing --
  because of a same-numbered file/record in a different environment.
- Both single-run routes (GET/DELETE .../deploys/[runId], GET .../log) now
  pass run.environmentId through to readRunLog()/deleteRunLog().

Tests: new cross-environment isolation coverage at the SizeBudgetTracker,
DeployRunRecorder, and reconcile-job levels, each proven against a reverted
(shared-directory) mutation to confirm it fails for the right reason before
being reverted back. Full suite: 3011 pass / 0 fail (was 2987 pass / 0 fail).

* fix(deploy): forbid deleting a non-terminal deploy run

DELETE /api/stacks/[name]/deploys/[runId] deleted the schedule_executions
row and the on-disk log file with no check on the run's status, so a
caller could delete their OWN still-running deploy's record. The
background deploy process keeps going after that: recorder.line()
recreates the just-deleted log file via appendRunLog(), recorder.end()'s
updateScheduleExecution() becomes a silent no-op (UPDATE WHERE id=x, 0
rows), and the default-enabled reconcile job then treats the recreated
file as an orphan and purges it -- erasing every trace of a deploy that
actually ran and had real host side effects.

Add isTerminalRunStatus() (deploy-run-access.ts) as an explicit allow-list
of the run-closing statuses (success/failed/skipped/warning/error/
cancelled/stale) and use it to gate the DELETE handler: a non-terminal
status (queued/running, or anything this code doesn't recognize -- the
status column is free text) now returns 409 and touches neither the log
file nor the database row. The check runs after the existing
ownership/permission checks, so an unauthorized or wrong-stack caller
still gets 403/404 rather than learning the run's status via a 409.

Deliberately its own allow-list rather than reusing
deploy-log-reconcile-core.ts's isEligibleForMissingMark(): that helper
fails OPEN for an unrecognized status because marking logMissing is
reversible metadata-only. Deleting a run is not reversible, so this
check fails CLOSED instead.

* test(deploy): guard that deployStack records the secret set it redacts against

A review found F4's single production line -- stacks.ts's
`result.resolvedSecrets = Object.values(secretVars)` -- had zero coverage:
deleting it left the whole targeted suite green. The two tests that reference
`resolvedSecrets` fake deployStack wholesale and hand-set the field, proving the
downstream recorder wiring but never that the real stacks.ts populates it.

A behaviour test of the real deployStack() is infeasible in this suite, established
empirically, not assumed:
  - tests/helpers/stacks-fake.ts mock.module()s $lib/server/stacks at import time,
    freezing that specifier for the whole Bun process; two suites load it, so
    `import { deployStack }` resolves to the fake for the entire run, and Bun has no
    per-file process isolation to escape it.
  - pulling the real $lib/server/stacks into a test's import graph instantiates
    better-sqlite3, which Bun does not support and crashes at load (reproduced).

So this follows the pattern the suite already uses for deployStack-internal
invariants (deploy-stack-online.test.ts, stack-create-start-build-options.test.ts):
a source guard, with comments stripped before matching and a vacuity guard. It pins
the wiring resolveProviderEnvVars -> secretVars -> executeComposeCommand (redaction)
AND -> result.resolvedSecrets (recording). Counter-tested: each assertion goes red
for its own mutation, including the exact deletion the review demonstrated.

* chore(openapi): regenerate spec after rebase onto upstream/main

* test(stacks): fake requireEnvAccess in the compose-endpoint auth stub

The old merge commit into this branch had manually patched this fake to
add requireEnvAccess (compose/+server.ts calls it, and authEnabled is
false here so the real implementation is a no-op) -- that fixup lived
only in the merge commit itself, not in any single commit, so a plain
rebase onto upstream/main dropped it. Restored; full suite is green
(3212 pass, 0 fail).

* docs(openapi): document deployLogReconcileCron/Enabled in the settings body

upstream's new Gate 7 (body-field drift check) caught that this PR's
deployLogReconcileCron/deployLogReconcileEnabled fields were read in
POST /api/settings/general but never listed in its @openapi body
annotation. Documented them and regenerated the spec; all openapi
gates and the full test suite (3221 pass, 0 fail) are green.

* fix(deploy-log-reconcile): protect an in-flight deploy's file from a TOCTOU orphan-delete

The reconcile job snapshots stack_deploy records once via
getScheduleExecutionIdsByType() before walking each environment's files.
A deploy whose record is created after that snapshot has no matching id
yet, but its log file can already exist by the time this environment's
listRunLogIds() runs -- indistinguishable from a genuine orphan by id
alone, and previously deleted on the spot while still being written to.

Add getRunLogMtimeMs() (deploy-log-store.ts) and use it as a second
signal alongside the records snapshot: a delete candidate whose file was
modified within the last 5 minutes is left alone this run instead of
deleted, since appendRunLog() keeps bumping a live deploy's mtime for as
long as it keeps writing. A later reconcile run will see the by-then-
created record and correctly never touch the file again -- nothing is
lost, it is just given one more cycle to prove itself real, the same
trade-off isEligibleForMissingMark() already makes on the other side of
this race.

* fix(git): record a stack_deploy run for the UI's manual deploy button

deployGitStack's doc comment claimed it was the single function every
git-stack deploy trigger funnels through, and wired the stack_deploy run
recorder in there on that basis. deployGitStackWithProgress -- the UI's
"Deploy" button (deploy-stream/+server.ts) -- runs its own clone/read/
deploy pipeline instead of calling deployGitStack (it needs its own
discrete onProgress stages, not deployGitStack's onLine streaming), so
it was the one caller that reached deployStack() without ever going
through createRunRecorder: webhook, cron, and config-update-triggered
deploys were recorded, the manual button was not.

Wire the same recorder setup into deployGitStackWithProgress, right
before its own deployStack() call, mirroring deployGitStack's shape
(composeHash/envHash/secrets from the DB-only vars, addSecrets() for the
provider-resolved values deployStack() only reveals after it returns,
end() closing the row on every path out). onLine mirrors output into the
run's log file without being forwarded to onProgress, so the existing
progress-stage streaming is untouched.

Corrected deployGitStack's doc comment, which is no longer accurate now
that a second call site exists, and extended the existing source-level
guard test (previously asserting exactly one createRunRecorder call in
the whole file) to check both functions individually.

tests/backups/route-guards.test.ts

@@ -4,10 +4,15 @@
  * #14). Security-critical + fail-closed, so every deny branch is pinned here.
  *
  * The module transitively imports the DB/engine via ./index, so we mock.module()
- * ./index and ../../db BEFORE importing it — the guard LOGIC under test is pure
- * (decisions over an injected AuthorizationContext + the two resolver results).
+ * ./index and register a getBackupConfig fake via ../helpers/db-fake (see that
+ * file for why: mock.module() replaces $lib/server/db WHOLESALE for the entire
+ * process, so this file no longer registers its own separate mock.module() for
+ * it — that used to collide with any other file doing the same) — the guard
+ * LOGIC under test is pure (decisions over an injected AuthorizationContext +
+ * the two resolver results).
  */
 import { describe, it, expect, mock, beforeAll } from 'bun:test';
+import { registerDbFake } from '../helpers/db-fake';
 
 // Controllable fakes for the heavy imports, set per-test.
 let resolveResult: { envId: number | null | undefined; resolved: boolean } | (() => never) = { envId: 5, resolved: true };
@@ -30,9 +35,7 @@ mock.module('../../src/lib/server/backups/index', () => ({
 		return out;
 	},
 }));
-mock.module('../../src/lib/server/db', () => ({
-	getBackupConfig: async (id: number) => configById(id),
-}));
+registerDbFake('getBackupConfig', async (id: number) => configById(id));
 
 let rg: typeof import('../../src/lib/server/backups/route-guards');
 beforeAll(async () => { rg = await import('../../src/lib/server/backups/route-guards'); });

tests/clamp-number.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, test } from 'bun:test';
+import { clampNumber } from '../src/lib/utils/clamp-number';
+
+// One test per case (not one test with several assertions) -- same reasoning as
+// save-close-policy.test.ts: a failure in one case must not hide the others behind a
+// single aborted test run.
+describe('clampNumber', () => {
+	test('a value below the minimum is pulled up to the minimum', () => {
+		expect(clampNumber(5, 15, 70)).toBe(15);
+	});
+
+	test('a value above the maximum is pulled down to the maximum', () => {
+		expect(clampNumber(90, 15, 70)).toBe(70);
+	});
+
+	test('a value already inside the bounds is left unchanged', () => {
+		expect(clampNumber(42, 15, 70)).toBe(42);
+	});
+
+	test('NaN is not passed through -- it falls back to the minimum', () => {
+		// This is the real-world trigger: the dragged container's height (or width) is
+		// briefly 0 (e.g. mid-drag while a panel is transitioning), so the ratio/distance
+		// computation divides by zero and produces NaN. Math.max(30, Math.min(80, NaN))
+		// itself evaluates to NaN -- any NaN operand makes both Math.min and Math.max
+		// return NaN, so the naive clamp does not clamp at all.
+		expect(clampNumber(NaN, 15, 70)).toBe(15);
+	});
+
+	test('a negative proposal is clamped to the minimum, not left negative', () => {
+		expect(clampNumber(-20, 15, 70)).toBe(15);
+	});
+
+	test('positive Infinity clamps to the maximum via the ordinary Math.min/max path', () => {
+		// Unlike NaN, Infinity is a well-ordered number -- Math.min(max, Infinity) is
+		// max, so no special-casing is needed for it to land on the maximum.
+		expect(clampNumber(Infinity, 15, 70)).toBe(70);
+	});
+
+	// The bounds above (15-70) are a percentage split ratio. This repo has a second,
+	// independent caller with pixel bounds (the validate-panel width resizer,
+	// 320-560px) -- proving the same function clamps correctly regardless of unit,
+	// since it only compares `value` against `min`/`max` and never assumes a unit.
+	test('pixel-range bounds (not a percentage) clamp the same way', () => {
+		expect(clampNumber(200, 320, 560)).toBe(320);
+		expect(clampNumber(9999, 320, 560)).toBe(560);
+		expect(clampNumber(NaN, 320, 560)).toBe(320);
+	});
+});

tests/compose-build-detect.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test } from 'bun:test';
+import { hasBuildSection } from '../src/lib/utils/compose-build-detect';
+
+describe('hasBuildSection', () => {
+	test('no services at all -- false', () => {
+		expect(hasBuildSection('networks:\n  default: {}\n')).toBe(false);
+	});
+
+	test('every service uses only image: -- false', () => {
+		const compose = 'services:\n  app:\n    image: demo:1\n  db:\n    image: postgres:16\n';
+		expect(hasBuildSection(compose)).toBe(false);
+	});
+
+	// build: can be a bare string (`build: ./dir`)...
+	test('build: as a bare string on one service -- true', () => {
+		const compose = 'services:\n  app:\n    build: ./app\n  db:\n    image: postgres:16\n';
+		expect(hasBuildSection(compose)).toBe(true);
+	});
+
+	// ...or an object (`build: {context: ., dockerfile: ...}`) -- both forms must be
+	// detected the same way (truthy check, not typeof), matching
+	// ComposeGraphViewer.svelte's `config.image || (config.build ? 'build' : 'custom')`.
+	test('build: as an object with context/dockerfile on one service -- true', () => {
+		const compose = 'services:\n  app:\n    build:\n      context: .\n      dockerfile: Dockerfile\n  db:\n    image: postgres:16\n';
+		expect(hasBuildSection(compose)).toBe(true);
+	});
+
+	test('only the SECOND service has build: -- still true (checks every service, not just the first)', () => {
+		const compose = 'services:\n  db:\n    image: postgres:16\n  app:\n    build: ./app\n';
+		expect(hasBuildSection(compose)).toBe(true);
+	});
+
+	test('invalid YAML mid-edit -- false, does not throw', () => {
+		expect(hasBuildSection('services:\n  app:\n    build: [unterminated')).toBe(false);
+	});
+
+	test('empty content -- false', () => {
+		expect(hasBuildSection('')).toBe(false);
+	});
+});

tests/deploy-duration.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, test } from 'bun:test';
+import { formatRunStatus } from '../src/lib/utils/run-status';
+
+describe('formatRunStatus', () => {
+	test('reports success with a duration', () => {
+		expect(formatRunStatus({ running: false, ok: true, ms: 6200 })).toBe('Succeeded · 6.2s');
+	});
+
+	test('reports failure with the exit code when one is known', () => {
+		expect(formatRunStatus({ running: false, ok: false, ms: 900, exitCode: 1 }))
+			.toBe('Failed · exit 1 · 0.9s');
+	});
+
+	test('says nothing about duration while still running', () => {
+		expect(formatRunStatus({ running: true })).toBe('Running…');
+	});
+});

tests/deploy-endpoints.test.ts

@@ -0,0 +1,569 @@
+/**
+ * Authorization + data-shape tests for the three deploy-run routes under
+ * api/stacks/[name]/deploys/. These do NOT inherit the no-auth model of
+ * GET/DELETE /api/jobs/{id} (unguessable UUID, ten-minute in-memory job) --
+ * every route here checks stacks:view/stacks:edit for itself, against a
+ * small sequential integer id that persists forever in schedule_executions.
+ *
+ * $lib/server/db transitively loads better-sqlite3 (ERR_DLOPEN_FAILED under
+ * Bun), so it has to be faked before the route modules are imported -- same
+ * problem tests/backups/route-guards.test.ts already solved. Fakes for it are
+ * registered via ../helpers/db-fake (registerDbFake), NOT via a separate
+ * mock.module('$lib/server/db', ...) call here -- see that helper's doc
+ * comment for why a second direct call collides with route-guards.test.ts's
+ * (mock.module() replaces the whole module for the whole process; whichever
+ * of the two files registers last wins for BOTH, deterministically, and the
+ * loser's import throws "Export named 'X' not found").
+ *
+ * $lib/server/authorize is faked via tests/helpers/authorize-fake.ts (same
+ * collision reason as the db fake above -- see that helper's doc comment), driven
+ * by a per-test `authState`. $lib/server/deploy-log-store is NOT mocked: it only
+ * touches node:fs/promises, so real file operations against a throwaway DATA_DIR
+ * exercise the actual read/delete paths.
+ */
+import { describe, test, expect, beforeAll, beforeEach, afterAll } from 'bun:test';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { registerDbFake } from './helpers/db-fake';
+import { registerAuthorizeFake } from './helpers/authorize-fake';
+
+// -- $lib/server/authorize: fully replaced, driven by `authState` ----------
+
+let authState: {
+	authEnabled: boolean;
+	isAuthenticated: boolean;
+	isEnterprise: boolean;
+	can: boolean;
+	// H1 regression coverage needs `can()` to answer DIFFERENTLY depending on
+	// which environmentId it's asked about (a caller can have stacks:view for
+	// environment 1 but not environment 9) -- a single flat boolean can't
+	// express that. Left undefined, `can` (the flat boolean below) is the
+	// answer for every environmentId, unchanged from before -- every
+	// pre-existing test in this file that never touches canByEnv keeps its
+	// original behavior. Set only by the tests that specifically exercise
+	// per-environment scoping.
+	canByEnv?: (environmentId: number | undefined) => boolean;
+	accessibleEnvs: number[] | 'all';
+};
+
+function resetAuthState() {
+	authState = { authEnabled: true, isAuthenticated: true, isEnterprise: false, can: true, canByEnv: undefined, accessibleEnvs: 'all' };
+}
+resetAuthState();
+
+registerAuthorizeFake(async () => ({
+	authEnabled: authState.authEnabled,
+	isAuthenticated: authState.isAuthenticated,
+	isEnterprise: authState.isEnterprise,
+	can: async (_resource: string, _action: string, environmentId?: number) =>
+		authState.canByEnv ? authState.canByEnv(environmentId) : authState.can,
+	canAccessEnvironment: async (id: number) =>
+		authState.accessibleEnvs === 'all' || authState.accessibleEnvs.includes(id)
+}));
+
+// -- $lib/server/db: an in-memory schedule_executions fake -----------------
+
+let execStore: Map<number, any>;
+let deletedIds: number[];
+let lastListFilters: any;
+
+function resetDbState() {
+	execStore = new Map();
+	deletedIds = [];
+	lastListFilters = undefined;
+}
+resetDbState();
+
+registerDbFake('getScheduleExecution', async (id: number) => execStore.get(id));
+registerDbFake('deleteScheduleExecution', async (id: number) => {
+	deletedIds.push(id);
+	execStore.delete(id);
+});
+registerDbFake('getScheduleExecutions', async (filters: any) => {
+	lastListFilters = filters;
+	const all = [...execStore.values()].filter(
+		(e) =>
+			(filters.scheduleType === undefined || e.scheduleType === filters.scheduleType) &&
+			(filters.entityName === undefined || e.entityName === filters.entityName) &&
+			(filters.environmentId === undefined || e.environmentId === filters.environmentId)
+	);
+	return { executions: all, total: all.length, limit: filters.limit ?? 50, offset: 0 };
+});
+
+// -- Real deploy-log-store against a throwaway DATA_DIR ---------------------
+//
+// DATA_DIR is process-global and read at call time by every other test file
+// too (belatedly discovered the hard way for exactly this variable in
+// tests/fs-guard.test.ts / tests/selfhst-icons.test.ts -- a file that sets it
+// and never restores it can break an unrelated, later-running file). Save and
+// restore the prior value so this file leaves no trace once its tests finish.
+
+const previousDataDir = process.env.DATA_DIR;
+let dataDir: string;
+beforeAll(async () => {
+	dataDir = await mkdtemp(join(tmpdir(), 'dv-t12-deploy-logs-'));
+	process.env.DATA_DIR = dataDir;
+});
+afterAll(async () => {
+	await rm(dataDir, { recursive: true, force: true });
+	if (previousDataDir === undefined) {
+		delete process.env.DATA_DIR;
+	} else {
+		process.env.DATA_DIR = previousDataDir;
+	}
+});
+
+const { appendRunLog, readRunLog, deleteRunLog } = await import('../src/lib/server/deploy-log-store');
+
+// -- Routes under test, imported AFTER all the fakes above are registered ---
+
+const listRoute = await import('../src/routes/api/stacks/[name]/deploys/+server');
+const runRoute = await import('../src/routes/api/stacks/[name]/deploys/[runId]/+server');
+const logRoute = await import('../src/routes/api/stacks/[name]/deploys/[runId]/log/+server');
+
+// -- Fixtures ----------------------------------------------------------------
+
+const STACK = 'demo-stack';
+
+const RUN = {
+	id: 1,
+	scheduleType: 'stack_deploy',
+	scheduleId: 0,
+	environmentId: null,
+	entityName: STACK,
+	triggeredBy: 'manual',
+	triggeredAt: '2026-01-01T00:00:00.000Z',
+	startedAt: null,
+	completedAt: null,
+	duration: 4200,
+	status: 'success',
+	errorMessage: null,
+	details: { summary: 'ok' },
+	logs: null,
+	createdAt: null
+};
+
+function makeEvent(over: { params?: Record<string, string>; url?: string } = {}) {
+	return {
+		params: { name: STACK, runId: '1', ...over.params },
+		url: new URL(over.url ?? 'http://x/'),
+		cookies: { get: () => undefined } as any
+	} as any;
+}
+
+beforeEach(async () => {
+	resetAuthState();
+	resetDbState();
+	// Every test defaults to runId '1' -- clear its log file so tests don't
+	// leak content into each other via the shared DATA_DIR. F5 fix: the log
+	// file now lives under its OWN environment's directory, and this file's
+	// tests use both RUN's default (environmentId: null) and an overridden
+	// environmentId: 9 -- clear both so leftovers from either can't leak
+	// between tests.
+	await deleteRunLog(null, '1');
+	await deleteRunLog(9, '1');
+});
+
+// =============================================================================
+// GET /api/stacks/[name]/deploys (list)
+// =============================================================================
+
+describe('GET /api/stacks/[name]/deploys (list)', () => {
+	test('no session -> 401 at the permission check, not a later error', async () => {
+		authState.isAuthenticated = false;
+		const res = await listRoute.GET(makeEvent());
+		expect(res.status).toBe(401);
+		expect((await res.json()).error).toBe('Authentication required');
+	});
+
+	// H3 regression: on a single (local-only) environment install, EVERY
+	// recorded run had environmentId === NULL and was completely unreachable
+	// through this route -- `env` was hard-required, and there was no value a
+	// caller could pass that matched a NULL row (env=0 included; environment
+	// ids are never 0). See the module doc comment for the full chain.
+	test('H3: omitted env -> 200, treated as the LOCAL environment (environmentId null), not a 400', async () => {
+		execStore.set(1, { ...RUN, environmentId: null });
+		const res = await listRoute.GET(makeEvent()); // no ?env=
+		expect(res.status).toBe(200);
+		const body = await res.json();
+		expect(body.runs).toHaveLength(1);
+		expect(body.runs[0].id).toBe(1);
+		expect(lastListFilters.environmentId).toBe(null);
+	});
+
+	test('H3: env=null (the literal string) -> the SAME local-environment result as omitting env', async () => {
+		execStore.set(1, { ...RUN, environmentId: null });
+		const res = await listRoute.GET(makeEvent({ url: 'http://x/?env=null' }));
+		expect(res.status).toBe(200);
+		const body = await res.json();
+		expect(body.runs).toHaveLength(1);
+		expect(lastListFilters.environmentId).toBe(null);
+	});
+
+	test('non-numeric, non-"null" env -> 400 (still not a value getScheduleExecutions can filter on)', async () => {
+		const res = await listRoute.GET(makeEvent({ url: 'http://x/?env=abc' }));
+		expect(res.status).toBe(400);
+		expect((await res.json()).error).toBe(
+			'env query parameter must be an integer, or omitted/"null" for the local environment'
+		);
+	});
+
+	test('cross-environment leak: omitting env must NOT surface a run from a DIFFERENT (non-null) environment', async () => {
+		authState.isEnterprise = true;
+		authState.accessibleEnvs = 'all'; // access is not the point of this test -- the null filter itself is
+		execStore.set(1, { ...RUN, environmentId: null }); // local run, matches the omitted-env filter
+		execStore.set(2, { ...RUN, id: 2, environmentId: 9 }); // foreign, non-null env, same stack name
+		const res = await listRoute.GET(makeEvent()); // no ?env=
+		expect(res.status).toBe(200);
+		const body = await res.json();
+		expect(body.runs).toHaveLength(1);
+		expect(body.runs[0].id).toBe(1);
+		expect(JSON.stringify(body)).not.toContain('"environmentId":9');
+	});
+
+	test('caller lacking stacks:view for the local environment (global merge) -> 403, even though env is omitted', async () => {
+		authState.can = false;
+		const res = await listRoute.GET(makeEvent());
+		expect(res.status).toBe(403);
+		expect((await res.json()).error).toBe('Permission denied');
+	});
+
+	test('authenticated but lacking permission -> 403', async () => {
+		authState.can = false;
+		const res = await listRoute.GET(makeEvent({ url: 'http://x/?env=1' }));
+		expect(res.status).toBe(403);
+		expect((await res.json()).error).toBe('Permission denied');
+	});
+
+	test('lists only runs for THIS stack, without log text', async () => {
+		execStore.set(1, { ...RUN, environmentId: 1 });
+		execStore.set(2, { ...RUN, id: 2, environmentId: 1, entityName: 'other-stack' });
+		const res = await listRoute.GET(makeEvent({ url: 'http://x/?env=1' }));
+		expect(res.status).toBe(200);
+		const body = await res.json();
+		expect(body.runs).toHaveLength(1);
+		expect(body.runs[0].id).toBe(1);
+		expect(body.runs[0]).not.toHaveProperty('logs');
+		expect(lastListFilters.scheduleType).toBe('stack_deploy');
+		expect(lastListFilters.entityName).toBe(STACK);
+		expect(lastListFilters.environmentId).toBe(1);
+	});
+
+	test('skips a non-deploy schedule execution that happens to share the entity name', async () => {
+		execStore.set(1, { ...RUN, environmentId: 1, scheduleType: 'backup' });
+		const res = await listRoute.GET(makeEvent({ url: 'http://x/?env=1' }));
+		const body = await res.json();
+		expect(body.runs).toHaveLength(0);
+	});
+});
+
+// =============================================================================
+// GET /api/stacks/[name]/deploys/[runId] (single)
+// =============================================================================
+
+describe('GET /api/stacks/[name]/deploys/[runId] (single)', () => {
+	test('no session -> 401 at the permission check, not a later error', async () => {
+		authState.isAuthenticated = false;
+		const res = await runRoute.GET(makeEvent());
+		expect(res.status).toBe(401);
+		expect((await res.json()).error).toBe('Authentication required');
+	});
+
+	test('authenticated but lacking permission -> 403', async () => {
+		authState.can = false;
+		const res = await runRoute.GET(makeEvent());
+		expect(res.status).toBe(403);
+		expect((await res.json()).error).toBe('Permission denied');
+	});
+
+	test('nonexistent run -> 404', async () => {
+		const res = await runRoute.GET(makeEvent({ params: { runId: '999' } }));
+		expect(res.status).toBe(404);
+		expect((await res.json()).error).toBe('Deploy run not found');
+	});
+
+	test('run belonging to a DIFFERENT stack -> the SAME 404 as nonexistent', async () => {
+		execStore.set(1, { ...RUN, entityName: 'other-stack' });
+		const res = await runRoute.GET(makeEvent());
+		expect(res.status).toBe(404);
+		expect((await res.json()).error).toBe('Deploy run not found');
+	});
+
+	test('non-numeric run id -> 400', async () => {
+		const res = await runRoute.GET(makeEvent({ params: { runId: 'abc' } }));
+		expect(res.status).toBe(400);
+	});
+
+	test('cross-environment bypass: a caller-accessible env does not grant access to a DIFFERENT run env', async () => {
+		authState.isEnterprise = true;
+		authState.accessibleEnvs = [1]; // caller can access env 1
+		execStore.set(1, { ...RUN, environmentId: 9 }); // but this run belongs to env 9
+		const res = await runRoute.GET(makeEvent());
+		expect(res.status).toBe(403);
+	});
+
+	test('accessible run -> 200 with metadata, no log text', async () => {
+		execStore.set(1, RUN);
+		const res = await runRoute.GET(makeEvent());
+		expect(res.status).toBe(200);
+		const body = await res.json();
+		expect(body.id).toBe(1);
+		expect(body.duration).toBe(4200);
+		expect(body).not.toHaveProperty('logs');
+	});
+});
+
+// =============================================================================
+// DELETE /api/stacks/[name]/deploys/[runId]
+// =============================================================================
+
+describe('DELETE /api/stacks/[name]/deploys/[runId]', () => {
+	test('no session -> 401 at the permission check, not a later error', async () => {
+		authState.isAuthenticated = false;
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(401);
+		expect((await res.json()).error).toBe('Authentication required');
+	});
+
+	test('authenticated but lacking permission -> 403', async () => {
+		authState.can = false;
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(403);
+		expect((await res.json()).error).toBe('Permission denied');
+	});
+
+	test('run belonging to a DIFFERENT stack -> 404, nothing deleted', async () => {
+		execStore.set(1, { ...RUN, entityName: 'other-stack' });
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(404);
+		expect(deletedIds).toEqual([]);
+		expect(execStore.has(1)).toBe(true);
+	});
+
+	test('deletes the DB record AND the log file', async () => {
+		execStore.set(1, RUN); // RUN.environmentId is null
+		await appendRunLog(null, '1', 'some deploy output');
+		expect(await readRunLog(null, '1')).toBe('some deploy output');
+
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(200);
+		expect((await res.json()).success).toBe(true);
+		expect(deletedIds).toEqual([1]);
+		expect(execStore.has(1)).toBe(false);
+		expect(await readRunLog(null, '1')).toBeNull();
+	});
+
+	test('a terminal, non-success status (failed) is still deletable', async () => {
+		execStore.set(1, { ...RUN, status: 'failed' });
+		await appendRunLog(null, '1', 'compose exploded');
+
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(200);
+		expect((await res.json()).success).toBe(true);
+		expect(deletedIds).toEqual([1]);
+		expect(execStore.has(1)).toBe(false);
+		expect(await readRunLog(null, '1')).toBeNull();
+	});
+
+	// Finding B: DELETE had no status check at all -- a caller could delete
+	// their OWN still-running deploy's record. The background deploy process
+	// keeps writing to the log file after the record is gone (appendRunLog
+	// recreates it), updateScheduleExecution() on end() becomes a silent
+	// no-op (UPDATE WHERE id=x, 0 rows), and the default-enabled reconcile
+	// job then purges the recreated file as an orphan -- erasing every trace
+	// of a deploy that actually ran and had real host side effects.
+	test('Finding B: a RUNNING run cannot be deleted -> 409, nothing touched', async () => {
+		execStore.set(1, { ...RUN, status: 'running' });
+		await appendRunLog(null, '1', 'still going...');
+
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(409);
+		expect((await res.json()).error).toBe('Cannot delete a running deploy run');
+		expect(deletedIds).toEqual([]);
+		expect(execStore.has(1)).toBe(true);
+		expect(await readRunLog(null, '1')).toBe('still going...');
+	});
+
+	test('Finding B: a QUEUED run cannot be deleted -> 409, nothing touched', async () => {
+		execStore.set(1, { ...RUN, status: 'queued' });
+
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(409);
+		expect(deletedIds).toEqual([]);
+		expect(execStore.has(1)).toBe(true);
+	});
+
+	// Fail-safe direction: a status this repo's ScheduleStatus type doesn't
+	// even list (never actually produced by this code, but the column is
+	// free text -- see db.ts's ScheduleStatus comment) must NOT be treated as
+	// terminal just because it isn't 'queued'/'running'. Guessing "finished"
+	// for an unrecognized status is exactly the kind of assumption that lets
+	// a genuinely in-progress run slip through under a status this code
+	// hasn't been taught about yet.
+	test('Finding B: an unrecognized status is treated as NOT terminal (fail safe) -> 409', async () => {
+		execStore.set(1, { ...RUN, status: 'some-future-status' });
+
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(409);
+		expect(deletedIds).toEqual([]);
+		expect(execStore.has(1)).toBe(true);
+	});
+
+	test('Finding B: the 404 (wrong stack) still wins over the running-run 409 -- ownership is checked first', async () => {
+		execStore.set(1, { ...RUN, status: 'running', entityName: 'other-stack' });
+
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(404);
+		expect((await res.json()).error).toBe('Deploy run not found');
+	});
+
+	test('Finding B: the 403 (permission denied) still wins over the running-run 409', async () => {
+		authState.can = false;
+		execStore.set(1, { ...RUN, status: 'running' });
+
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(403);
+		expect((await res.json()).error).toBe('Permission denied');
+	});
+});
+
+// =============================================================================
+// GET /api/stacks/[name]/deploys/[runId]/log
+// =============================================================================
+
+describe('GET /api/stacks/[name]/deploys/[runId]/log', () => {
+	test('no session -> 401 at the permission check, not a later error', async () => {
+		authState.isAuthenticated = false;
+		const res = await logRoute.GET(makeEvent());
+		expect(res.status).toBe(401);
+		expect((await res.json()).error).toBe('Authentication required');
+	});
+
+	test('authenticated but lacking permission -> 403', async () => {
+		authState.can = false;
+		const res = await logRoute.GET(makeEvent());
+		expect(res.status).toBe(403);
+		expect((await res.json()).error).toBe('Permission denied');
+	});
+
+	test('run belonging to a DIFFERENT stack -> 404, log file never touched', async () => {
+		execStore.set(1, { ...RUN, entityName: 'other-stack' }); // still environmentId: null
+		await appendRunLog(null, '1', 'secret content for the other stack');
+		const res = await logRoute.GET(makeEvent());
+		expect(res.status).toBe(404);
+		expect((await res.json()).error).toBe('Deploy run not found');
+	});
+
+	test('run exists but the log file does not -> 404, does not wrongly look safe', async () => {
+		execStore.set(1, RUN);
+		const res = await logRoute.GET(makeEvent());
+		expect(res.status).toBe(404);
+		expect((await res.json()).error).toBe('Log not found');
+	});
+
+	test('cross-environment bypass applies here too', async () => {
+		authState.isEnterprise = true;
+		authState.accessibleEnvs = [1];
+		execStore.set(1, { ...RUN, environmentId: 9 });
+		await appendRunLog(9, '1', 'should not be reachable');
+		const res = await logRoute.GET(makeEvent());
+		expect(res.status).toBe(403);
+	});
+
+	test('returns the log text as text/plain', async () => {
+		execStore.set(1, RUN); // RUN.environmentId is null
+		await appendRunLog(null, '1', 'line one\nline two');
+		const res = await logRoute.GET(makeEvent());
+		expect(res.status).toBe(200);
+		expect(res.headers.get('content-type')).toContain('text/plain');
+		expect(await res.text()).toBe('line one\nline two');
+	});
+});
+
+
+// =============================================================================
+// H1 regression: env-scoped permission on the three single-run routes
+//
+// Reproduces the branch-review scenario: a caller has stacks:view/edit for
+// SOME environment (which alone is enough to pass the coarse, un-scoped
+// `can('stacks', 'view'|'edit')` gate every route still runs first -- see
+// "authenticated but lacking permission -> 403" above) but NOT for the
+// environment the run under test actually belongs to. Before the fix, none
+// of the three routes checked permission against run.environmentId at all,
+// so the coarse gate's global OR-across-roles merge was the only check --
+// a caller scoped to environment 1 could read/delete a run that belongs to
+// environment 9.
+// =============================================================================
+
+describe('H1: permission is scoped to the RUN\'s own environment, not the global merge', () => {
+	beforeEach(() => {
+		authState.isEnterprise = true;
+		authState.accessibleEnvs = 'all'; // isolate this from the SEPARATE canAccessEnvironment check (already correct, see "kein Befund")
+	});
+
+	test('GET single run: caller has stacks:view broadly (passes the coarse gate) but NOT for env 9, and the run belongs to env 9 -> 403, not the 200 the pre-fix global merge produced', async () => {
+		authState.canByEnv = (envId) => envId !== 9; // granted everywhere EXCEPT env 9 -- still passes the coarse can('stacks','view') gate (called with environmentId=undefined), so this isolates the NEW scoped check
+		execStore.set(1, { ...RUN, environmentId: 9 });
+		const res = await runRoute.GET(makeEvent());
+		expect(res.status).toBe(403);
+		expect((await res.json()).error).toBe('Permission denied');
+	});
+
+	test('GET single run: caller has stacks:view for the run\'s OWN env -> 200', async () => {
+		authState.canByEnv = (envId) => envId === undefined || envId === 9; // undefined: satisfies the coarse gate; 9: satisfies the scoped check
+		execStore.set(1, { ...RUN, environmentId: 9 });
+		const res = await runRoute.GET(makeEvent());
+		expect(res.status).toBe(200);
+		expect((await res.json()).id).toBe(1);
+	});
+
+	test('DELETE: caller has stacks:edit broadly but NOT for env 9, and the run belongs to env 9 -> 403, nothing deleted', async () => {
+		authState.canByEnv = (envId) => envId !== 9;
+		execStore.set(1, { ...RUN, environmentId: 9 });
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(403);
+		expect(deletedIds).toEqual([]);
+		expect(execStore.has(1)).toBe(true);
+	});
+
+	test('DELETE: caller has stacks:edit for the run\'s OWN env -> 200, both halves deleted', async () => {
+		authState.canByEnv = (envId) => envId === undefined || envId === 9;
+		execStore.set(1, { ...RUN, environmentId: 9 });
+		await appendRunLog(9, '1', 'output');
+		const res = await runRoute.DELETE(makeEvent());
+		expect(res.status).toBe(200);
+		expect(deletedIds).toEqual([1]);
+		expect(await readRunLog(9, '1')).toBeNull();
+	});
+
+	test('GET log: caller has stacks:view broadly but NOT for env 9, and the run belongs to env 9 -> 403, log file never read', async () => {
+		authState.canByEnv = (envId) => envId !== 9;
+		execStore.set(1, { ...RUN, environmentId: 9 });
+		await appendRunLog(9, '1', 'env-9-only secret output');
+		const res = await logRoute.GET(makeEvent());
+		expect(res.status).toBe(403);
+	});
+
+	test('GET log: caller has stacks:view for the run\'s OWN env -> 200 with the log text', async () => {
+		authState.canByEnv = (envId) => envId === undefined || envId === 9;
+		execStore.set(1, { ...RUN, environmentId: 9 });
+		await appendRunLog(9, '1', 'env-9 output');
+		const res = await logRoute.GET(makeEvent());
+		expect(res.status).toBe(200);
+		expect(await res.text()).toBe('env-9 output');
+	});
+
+	test('a run with NO environment (local install, environmentId null) checks against the global merge, not against a specific env', async () => {
+		// null run.environmentId maps to `can(..., undefined)` (the `?? undefined`
+		// in the fix) -- there is no per-environment role to scope against for a
+		// run that was never attributed to one. canByEnv(undefined) is the same
+		// check the coarse gate above already performs, so this is really
+		// confirming the scoped check does not ITSELF reject a local run once the
+		// coarse gate already let it through.
+		authState.canByEnv = (envId) => envId === undefined;
+		execStore.set(1, { ...RUN, environmentId: null });
+		const res = await runRoute.GET(makeEvent());
+		expect(res.status).toBe(200);
+	});
+});

tests/deploy-log-reconcile-job.test.ts

@@ -0,0 +1,317 @@
+/**
+ * Tests for runDeployLogReconcileJob() itself -- the database/filesystem-touching glue
+ * around planReconcile() (see deploy-log-reconcile.test.ts for the pure decision core).
+ *
+ * $lib/server/db transitively loads better-sqlite3 (ERR_DLOPEN_FAILED under Bun), so it
+ * has to be faked via ../helpers/db-fake (registerDbFake), same as
+ * tests/deploy-endpoints.test.ts -- NOT via a separate mock.module('$lib/server/db', ...)
+ * call here, see that helper's doc comment for why a second direct call collides.
+ *
+ * The three deploy-log-store calls are INJECTED (runDeployLogReconcileJob's `deps` param)
+ * rather than mock.module()'d. An earlier version did mock the module, reasoning that no
+ * other test file claimed it -- but the collision that matters is with SOURCE modules, not
+ * test files: mock.module() freezes the export shape process-wide, and deploy-run-record.ts
+ * imports appendRunLog/runLogFileName/SizeBudgetTracker from the same specifier. Whether it
+ * blew up depended on the order bun walks tests/, so it was green locally and red in CI.
+ * Injection has no process-wide effect at all.
+ *
+ * F5 fix: the fake filesystem layer below is keyed PER ENVIRONMENT (envDirName(envId) ->
+ * fileIds[]), mirroring deploy-log-store.ts's real per-environment directories -- this is
+ * what lets the tests below prove the reconcile job never mixes one environment's files
+ * with another's, even when two environments happen to hold a file with the exact same
+ * numeric run id (envDirName/parseEnvDirName are imported for real -- pure functions, no
+ * filesystem -- purely to build the fake's keys the same way production code would).
+ */
+import { beforeEach, describe, expect, mock, test } from 'bun:test';
+import { registerDbFake } from './helpers/db-fake';
+import { envDirName } from '../src/lib/server/deploy-log-store';
+
+// -- $lib/server/db: an in-memory schedule_executions fake -----------------
+
+let nextExecId: number;
+let executions: Map<number, any>;
+let stackDeployRecords: Array<{ id: number; status: string; details: any; environmentId: number | null }>;
+let throwOnUpdate: Set<number>;
+
+function resetDbState() {
+	nextExecId = 1;
+	executions = new Map();
+	stackDeployRecords = [];
+	throwOnUpdate = new Set();
+}
+resetDbState();
+
+registerDbFake('getDeployLogReconcileEnabled', async () => true);
+registerDbFake('getScheduleExecutionIdsByType', async (scheduleType: string) =>
+	scheduleType === 'stack_deploy' ? stackDeployRecords : []
+);
+registerDbFake('createScheduleExecution', async (data: any) => {
+	const id = nextExecId++;
+	const row = { id, ...data, details: data.details ?? null };
+	executions.set(id, row);
+	return row;
+});
+registerDbFake('updateScheduleExecution', async (id: number, data: any) => {
+	if (throwOnUpdate.has(id)) throw new Error(`update failed for record ${id}`);
+	const row = executions.get(id) ?? { id };
+	const updated = { ...row, ...data };
+	executions.set(id, updated);
+	return updated;
+});
+registerDbFake('appendScheduleExecutionLog', async () => {});
+
+// -- $lib/server/deploy-log-store: fully replaced (no other file mocks it) -
+//
+// Keyed by envDirName(envId) -> fileIds[], the same per-environment shape
+// deploy-log-store.ts's real listRunLogIds()/deleteRunLog() work against (F5 fix).
+
+let filesByEnvKey: Map<string, string[]>;
+let deletedFiles: Array<{ envId: number | null; id: string }>;
+let throwOnDeleteKeys: Set<string>; // `${envDirName(envId)}:${fileId}`
+// mtime (ms since epoch) per delete candidate, keyed the same way as throwOnDeleteKeys.
+// Defaults (see getRunLogMtimeMs below) to something WELL outside the reconcile job's
+// grace period, so every existing "orphan gets deleted" assertion in this file keeps
+// meaning exactly what it always did -- only a test that explicitly seeds a RECENT
+// mtime here is exercising the TOCTOU guard at all.
+let mtimeMsByKey: Map<string, number>;
+
+function resetFsState() {
+	filesByEnvKey = new Map();
+	deletedFiles = [];
+	throwOnDeleteKeys = new Set();
+	mtimeMsByKey = new Map();
+}
+resetFsState();
+
+const storeDeps = {
+	listEnvDirNames: async () => [...filesByEnvKey.keys()],
+	listRunLogIds: async (envId: number | null) => filesByEnvKey.get(envDirName(envId)) ?? [],
+	deleteRunLog: async (envId: number | null, fileId: string) => {
+		const key = `${envDirName(envId)}:${fileId}`;
+		if (throwOnDeleteKeys.has(key)) throw new Error(`delete failed for ${key}`);
+		deletedFiles.push({ envId, id: fileId });
+	},
+	getRunLogMtimeMs: async (envId: number | null, fileId: string) => {
+		const key = `${envDirName(envId)}:${fileId}`;
+		return mtimeMsByKey.get(key) ?? Date.now() - 24 * 60 * 60 * 1000; // default: a day old
+	}
+};
+
+// runDeployLogReconcileJob is imported AFTER both mocks are registered above, so its own
+// import of '../../db' / '../../deploy-log-store' resolves to the faked module records.
+const { runDeployLogReconcileJob } = await import('../src/lib/server/scheduler/tasks/deploy-log-reconcile');
+
+beforeEach(() => {
+	resetDbState();
+	resetFsState();
+});
+
+/** The reconcile job's own execution row -- the one created inside runDeployLogReconcileJob. */
+function ownExecution(): any {
+	return [...executions.values()].find((e) => e.scheduleType === 'deploy_log_reconcile');
+}
+
+describe('runDeployLogReconcileJob', () => {
+	test('one failing delete does not stop later orphan files from being removed', async () => {
+		// All three are orphans: no stack_deploy record exists for any of them, all
+		// in the SAME (null) environment.
+		filesByEnvKey.set(envDirName(null), ['a', 'b', 'c']);
+		throwOnDeleteKeys = new Set([`${envDirName(null)}:b`]);
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		// The one AFTER the failing element must still have been reached.
+		expect(deletedFiles).toEqual([
+			{ envId: null, id: 'a' },
+			{ envId: null, id: 'c' }
+		]);
+
+		const exec = ownExecution();
+		// Real outcome (2), not the planned one (3) -- the point of Befund 2.
+		expect(exec.details.deletedFiles).toBe(2);
+		expect(exec.details.failed).toBe(1);
+		// A run that hit a per-element failure is not indistinguishable from a clean one.
+		expect(exec.status).toBe('warning');
+	});
+
+	test('one failing mark does not stop later records from being marked logMissing', async () => {
+		// No files on disk at all -- every record below is missing its file.
+		stackDeployRecords = [
+			{ id: 10, status: 'success', details: null, environmentId: null },
+			{ id: 11, status: 'success', details: null, environmentId: null },
+			{ id: 12, status: 'success', details: null, environmentId: null }
+		];
+		for (const r of stackDeployRecords) executions.set(r.id, { ...r });
+		throwOnUpdate = new Set([11]);
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		expect(executions.get(10).details.logMissing).toBe(true);
+		expect(executions.get(12).details.logMissing).toBe(true);
+		// The failing record's details were never reached, so they stay as seeded.
+		expect(executions.get(11).details).toBe(null);
+
+		const exec = ownExecution();
+		expect(exec.details.markedRecords).toBe(2);
+		expect(exec.details.failed).toBe(1);
+		expect(exec.status).toBe('warning');
+	});
+
+	test('a clean run with nothing to fail is reported as success, not warning', async () => {
+		filesByEnvKey.set(envDirName(null), ['a']);
+		stackDeployRecords = [{ id: 20, status: 'success', details: null, environmentId: null }];
+		executions.set(20, { id: 20, status: 'success', details: null });
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		const exec = ownExecution();
+		expect(exec.status).toBe('success');
+		expect(exec.details.failed).toBe(0);
+		// 'a' has no record and gets deleted; the id-20 record has no file and gets marked.
+		expect(exec.details.deletedFiles).toBe(1);
+		expect(exec.details.markedRecords).toBe(1);
+	});
+
+	// -------------------------------------------------------------------------
+	// F5 fix: per-environment reconciliation. THE cross-environment isolation
+	// tests -- every id below is deliberately reused ACROSS environments to
+	// prove the reconcile job never confuses one environment's file/record with
+	// another's just because they share a run id.
+	// -------------------------------------------------------------------------
+
+	test("env A's orphan cleanup never deletes env B's file, even when they share a run id and env B's file legitimately belongs to a record", async () => {
+		filesByEnvKey.set(envDirName(1), ['42']); // orphan in env 1: no record anywhere for id 42 in env 1
+		filesByEnvKey.set(envDirName(2), ['42']); // env 2's OWN file for its OWN record with the same numeric id
+		stackDeployRecords = [{ id: 42, status: 'success', details: null, environmentId: 2 }];
+		executions.set(42, { id: 42, status: 'success', details: null });
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		// Env 1's orphan is deleted...
+		expect(deletedFiles).toEqual([{ envId: 1, id: '42' }]);
+		// ...but env 2's file, which legitimately belongs to record 42, is NOT
+		// treated as missing (it has a matching file in ITS OWN environment) and
+		// is never touched by the delete pass either.
+		expect(executions.get(42).details).toBeNull();
+	});
+
+	test('an orphan file living under one environment is never confused with a DIFFERENT environment holding the same run id', async () => {
+		// Both environments have a file with the SAME id and NEITHER has any record
+		// at all -- both are genuinely orphans, each in its own right.
+		filesByEnvKey.set(envDirName(1), ['shared-id']);
+		filesByEnvKey.set(envDirName(2), ['shared-id']);
+		stackDeployRecords = [];
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		expect(deletedFiles).toContainEqual({ envId: 1, id: 'shared-id' });
+		expect(deletedFiles).toContainEqual({ envId: 2, id: 'shared-id' });
+		expect(deletedFiles).toHaveLength(2);
+	});
+
+	test("a record's own file, missing from its OWN environment, is correctly marked logMissing even when an unrelated environment holds a same-numbered file", async () => {
+		// Record id 501 deliberately avoids id 1 -- this fake's createScheduleExecution
+		// always assigns the reconcile job's OWN execution row id 1 first (nextExecId
+		// starts at 1 every test), which would otherwise clobber a manually seeded
+		// `executions.set(1, ...)` entry for an unrelated stack_deploy record.
+		filesByEnvKey.set(envDirName(2), ['501']); // orphan file living in env 2, wrong environment for record id 501
+		stackDeployRecords = [{ id: 501, status: 'success', details: null, environmentId: 1 }];
+		executions.set(501, { id: 501, status: 'success', details: null });
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		// The record belongs to env 1, which has NO file -- correctly marked
+		// missing, not "found" via env 2's unrelated same-numbered file.
+		expect(executions.get(501).details.logMissing).toBe(true);
+		// Env 2's file has no record in env 2 either -- it is correctly deleted as
+		// its OWN environment's orphan, not because it was mistaken for record 501's.
+		expect(deletedFiles).toEqual([{ envId: 2, id: '501' }]);
+	});
+
+	test('a still-running record in one environment is not marked missing, while a DIFFERENT environment\'s terminal record with the same id correctly is', async () => {
+		// No files anywhere -- both records are "missing their file" by definition,
+		// but only the terminal one should actually be marked.
+		stackDeployRecords = [
+			{ id: 5, status: 'running', details: null, environmentId: 1 },
+			{ id: 5, status: 'success', details: null, environmentId: 2 }
+		];
+		executions.set(5, { id: 5, status: 'running', details: null }); // last-write-wins in this fake, matches env 2's terminal status for the assertion below
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		const exec = ownExecution();
+		// One skipped (still running, env 1), one marked (terminal, env 2).
+		expect(exec.details.skippedInProgress).toBe(1);
+		expect(exec.details.markedRecords).toBe(1);
+	});
+
+	test('an environment that only has a directory on disk (no records at all, e.g. a deleted environment) still has its orphan files reconciled', async () => {
+		filesByEnvKey.set(envDirName(7), ['old-run']);
+		stackDeployRecords = []; // environment 7 has no records in the database at all
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		expect(deletedFiles).toEqual([{ envId: 7, id: 'old-run' }]);
+	});
+
+	test('an environment that only has a record (no directory on disk yet) still gets that record considered for markMissing', async () => {
+		// listEnvDirNames() would never discover environment 3 on its own -- it has
+		// no directory at all -- so the record-side union is what makes this work.
+		stackDeployRecords = [{ id: 99, status: 'success', details: null, environmentId: 3 }];
+		executions.set(99, { id: 99, status: 'success', details: null });
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		expect(executions.get(99).details.logMissing).toBe(true);
+	});
+
+	// -------------------------------------------------------------------------
+	// TOCTOU guard: `records` is a single snapshot taken at the start of the job
+	// (getScheduleExecutionIdsByType), while a NEW deploy's file can appear on disk
+	// (listRunLogIds) moments later, for a run whose own record simply postdates
+	// that snapshot -- indistinguishable from a genuine orphan by id alone. See the
+	// module doc comment for the full race.
+	// -------------------------------------------------------------------------
+
+	test("a file with no matching record but a RECENT mtime is left alone -- it may belong to a deploy that started after the records snapshot", async () => {
+		filesByEnvKey.set(envDirName(null), ['fresh']);
+		// No record for 'fresh' in `stackDeployRecords` at all -- exactly what an
+		// in-flight deploy whose row postdates the snapshot looks like.
+		mtimeMsByKey.set(`${envDirName(null)}:fresh`, Date.now() - 1000); // 1s old
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		expect(deletedFiles).toEqual([]);
+		const exec = ownExecution();
+		expect(exec.details.skippedRecent).toBe(1);
+		expect(exec.details.deletedFiles).toBe(0);
+		// A recency skip is not a failure -- the run still reports success.
+		expect(exec.status).toBe('success');
+	});
+
+	test('a genuinely old orphan file (no record, no recent write) is still deleted -- the grace period does not protect real orphans forever', async () => {
+		filesByEnvKey.set(envDirName(null), ['stale']);
+		mtimeMsByKey.set(`${envDirName(null)}:stale`, Date.now() - 60 * 60 * 1000); // 1h old
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		expect(deletedFiles).toEqual([{ envId: null, id: 'stale' }]);
+		const exec = ownExecution();
+		expect(exec.details.skippedRecent).toBe(0);
+		expect(exec.details.deletedFiles).toBe(1);
+	});
+
+	test('a recency skip in one environment does not stop a genuinely old orphan in ANOTHER environment from being deleted', async () => {
+		filesByEnvKey.set(envDirName(1), ['fresh-in-env-1']);
+		mtimeMsByKey.set(`${envDirName(1)}:fresh-in-env-1`, Date.now());
+		filesByEnvKey.set(envDirName(2), ['stale-in-env-2']);
+		mtimeMsByKey.set(`${envDirName(2)}:stale-in-env-2`, Date.now() - 60 * 60 * 1000);
+
+		await runDeployLogReconcileJob('manual', storeDeps);
+
+		expect(deletedFiles).toEqual([{ envId: 2, id: 'stale-in-env-2' }]);
+		const exec = ownExecution();
+		expect(exec.details.skippedRecent).toBe(1);
+		expect(exec.details.deletedFiles).toBe(1);
+	});
+});

tests/deploy-log-reconcile.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from 'bun:test';
+import { planReconcile, isEligibleForMissingMark } from '../src/lib/server/deploy-log-reconcile-core';
+
+describe('planReconcile', () => {
+	test('deletes a file whose run record is gone', () => {
+		const plan = planReconcile({ fileIds: ['a', 'b'], recordIds: ['a'] });
+		expect(plan.deleteFiles).toEqual(['b']);
+		expect(plan.markMissing).toEqual([]);
+	});
+
+	test('marks a record whose file is gone but never deletes the record', () => {
+		// The metadata -- when, who, what was built, which digest -- stays valuable
+		// even when the log itself is gone.
+		const plan = planReconcile({ fileIds: [], recordIds: ['a'] });
+		expect(plan.markMissing).toEqual(['a']);
+		expect(plan.deleteFiles).toEqual([]);
+	});
+
+	test('leaves matching pairs alone', () => {
+		const plan = planReconcile({ fileIds: ['a'], recordIds: ['a'] });
+		expect(plan.deleteFiles).toEqual([]);
+		expect(plan.markMissing).toEqual([]);
+	});
+});
+
+describe('isEligibleForMissingMark', () => {
+	// A still-running deploy may simply not have written its first log line yet --
+	// marking it here would produce a false "log missing" that nothing later clears.
+	test('excludes still in-progress runs', () => {
+		expect(isEligibleForMissingMark('queued')).toBe(false);
+		expect(isEligibleForMissingMark('running')).toBe(false);
+	});
+
+	test('includes every terminal state', () => {
+		for (const status of ['success', 'failed', 'skipped', 'warning', 'error', 'cancelled', 'stale']) {
+			expect(isEligibleForMissingMark(status)).toBe(true);
+		}
+	});
+});

tests/deploy-log-store.test.ts

@@ -0,0 +1,334 @@
+import { describe, expect, test, beforeEach, afterEach } from 'bun:test';
+import { mkdtemp, writeFile, mkdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+	runLogFileName,
+	envDirName,
+	parseEnvDirName,
+	SizeBudgetTracker,
+	usedBytesExcluding
+} from '../src/lib/server/deploy-log-store';
+
+describe('runLogFileName', () => {
+	test('builds a name from a plain run id', () => {
+		expect(runLogFileName('a1b2c3')).toBe('a1b2c3.log');
+	});
+
+	test('rejects anything that is not a plain id, so a run id can never become a path', () => {
+		// The run id reaches this function from a route parameter. A traversal attempt must
+		// throw rather than resolve to a file outside the log directory.
+		expect(() => runLogFileName('../../etc/passwd')).toThrow();
+		expect(() => runLogFileName('a/b')).toThrow();
+		expect(() => runLogFileName('')).toThrow();
+	});
+});
+
+describe('envDirName / parseEnvDirName -- F5 per-environment directory naming', () => {
+	test('a numeric environment id becomes its own string, an environment-less run becomes "null"', () => {
+		expect(envDirName(1)).toBe('1');
+		expect(envDirName(42)).toBe('42');
+		expect(envDirName(null)).toBe('null');
+	});
+
+	test('rejects a non-integer environment id rather than silently stringifying it', () => {
+		// environmentId always comes from a database column (number | null) -- this is a
+		// defensive backstop, the same posture runLogFileName's ID regex takes for runId.
+		expect(() => envDirName(1.5)).toThrow();
+		expect(() => envDirName(NaN)).toThrow();
+	});
+
+	test('parseEnvDirName is the exact inverse of envDirName for every value envDirName can produce', () => {
+		expect(parseEnvDirName(envDirName(1))).toBe(1);
+		expect(parseEnvDirName(envDirName(42))).toBe(42);
+		expect(parseEnvDirName(envDirName(null))).toBe(null);
+	});
+
+	test('parseEnvDirName rejects a directory name that is not one of envDirName\'s own outputs', () => {
+		// listEnvDirNames() (deploy-log-store.ts) only returns directories, so this should
+		// not normally see a stray file name -- but a hand-created or unexpected directory
+		// must not be silently misread as some arbitrary environment id.
+		expect(() => parseEnvDirName('not-an-env')).toThrow();
+		expect(() => parseEnvDirName('-1')).toThrow();
+		expect(() => parseEnvDirName('1.5')).toThrow();
+	});
+});
+
+// ---------------------------------------------------------------------------
+// SizeBudgetTracker -- see deploy-log-store.ts's doc comment on the class for
+// the performance problem this replaces (a full directory re-scan on every
+// appended line) and the concurrency trade-off it makes instead. The F5 fix
+// (per-environment directory/budget scoping) is covered by its own describe
+// block further down.
+// ---------------------------------------------------------------------------
+
+// deploy-log-store.ts reads process.env.DATA_DIR on every call (logDir()), not at
+// import time -- so it's enough to point it at a fresh scratch dir per test and put
+// the previous value back afterwards. Bun runs a whole test file in ONE process: a
+// DATA_DIR left set would leak into unrelated suites (see
+// test-coverage-pflicht.md's "prozessweite Zustände werden geklammert" -- this is
+// exactly the trap fs-guard.test.ts fell into once already).
+const previousDataDir = process.env.DATA_DIR;
+let scratchDir: string;
+
+beforeEach(async () => {
+	scratchDir = await mkdtemp(join(tmpdir(), 'deploy-log-store-'));
+	process.env.DATA_DIR = scratchDir;
+});
+afterEach(async () => {
+	if (previousDataDir === undefined) delete process.env.DATA_DIR;
+	else process.env.DATA_DIR = previousDataDir;
+	await rm(scratchDir, { recursive: true, force: true });
+});
+
+/** Writes N other-run log files of `sizeEach` bytes each directly into ONE
+ *  environment's scratch deploy-logs/<envDirName>/ dir, bypassing appendRunLog so the
+ *  byte count is exact and no SizeBudgetTracker is involved in creating the fixture. */
+async function seedOtherRunFiles(envId: number | null, count: number, sizeEach: number): Promise<void> {
+	const dir = join(scratchDir, 'deploy-logs', envDirName(envId));
+	await mkdir(dir, { recursive: true });
+	for (let i = 0; i < count; i++) {
+		await writeFile(join(dir, `other-${i}.log`), 'x'.repeat(sizeEach));
+	}
+}
+
+describe('SizeBudgetTracker', () => {
+	test('does NOT flag a run that stays well under the budget', async () => {
+		await seedOtherRunFiles(null, 5, 1000); // 5 KB of "other" runs already on disk
+		const tracker = new SizeBudgetTracker(null, 'run-under', 1_000_000); // 1 MB budget
+		let exceeded = false;
+		for (let i = 0; i < 20; i++) {
+			exceeded = await tracker.recordAppend(100); // 20 * 100 B = 2 KB of own output
+		}
+		expect(exceeded).toBe(false);
+	});
+
+	test('flags a run once its own output plus the rest of the directory crosses the budget', async () => {
+		await seedOtherRunFiles(null, 3, 300); // 900 B of "other" runs already on disk
+		const tracker = new SizeBudgetTracker(null, 'run-over', 1000); // 1000 B budget
+		let exceeded = false;
+		// 900 B baseline + 10*100 B own = 1900 B, well past the 1000 B budget.
+		for (let i = 0; i < 10 && !exceeded; i++) {
+			exceeded = await tracker.recordAppend(100);
+		}
+		expect(exceeded).toBe(true);
+	});
+
+	// Gegenversuch (test-coverage-pflicht.md): a tracker that never re-reads the
+	// directory -- cachedOtherBytes stuck at 0 forever, e.g. because refresh() was
+	// never called -- would let a run with a large pre-existing "other" total sail
+	// straight past the budget using only its own (small) byte count. This is the
+	// mutation the previous test guards against; this test isolates the SAME
+	// mechanism from a different angle (pre-existing total alone is already over
+	// budget, before this run writes a single byte).
+	test('flags a run immediately if the directory is already over budget before this run writes anything', async () => {
+		await seedOtherRunFiles(null, 2, 600); // 1200 B of "other" runs, already over a 1000 B budget
+		const tracker = new SizeBudgetTracker(null, 'run-preexisting', 1000);
+		const exceeded = await tracker.recordAppend(1); // first byte this run ever writes
+		expect(exceeded).toBe(true);
+	});
+
+	test('re-scans the directory on the FIRST call, then NOT again until the refresh threshold is crossed', async () => {
+		await seedOtherRunFiles(null, 500, 10); // matches the reviewer's 500-file benchmark shape
+		let scans = 0;
+		const countingMeasure = async (envId: number | null, excludeRunId: string) => {
+			scans++;
+			return usedBytesExcluding(envId, excludeRunId);
+		};
+		// Refresh threshold set to 1000 B of own output for this test, independent of
+		// the 1 MiB production constant -- REFRESH_AFTER_OWN_BYTES is not exported, so
+		// this drives the same code path (loaded flag + threshold check) at a size
+		// this test can actually cross without allocating a real MiB of strings.
+		const tracker = new SizeBudgetTracker(null, 'run-scan-count', 10_000_000, countingMeasure);
+
+		// 200 appends of 10 B each = 2000 B of own output, matching the reviewer's
+		// 200-line benchmark. This is the exact scenario that used to cost one full
+		// directory scan PER call (200 scans of 500 files); a working tracker must
+		// not do that.
+		for (let i = 0; i < 200; i++) {
+			await tracker.recordAppend(10);
+		}
+		expect(scans).toBe(1); // one lazy scan on the first call, none after
+		expect(scans).toBeLessThan(200); // the actual regression this fixes
+	});
+
+	test('re-scans again once accumulated own bytes cross the refresh threshold', async () => {
+		await seedOtherRunFiles(null, 5, 10);
+		let scans = 0;
+		const countingMeasure = async (envId: number | null, excludeRunId: string) => {
+			scans++;
+			return usedBytesExcluding(envId, excludeRunId);
+		};
+		// A tiny budget just to construct the tracker; refresh cadence is driven by
+		// the module-private REFRESH_AFTER_OWN_BYTES (1 MiB in production), not by
+		// this budget value.
+		const tracker = new SizeBudgetTracker(null, 'run-refresh', 100_000_000, countingMeasure);
+
+		await tracker.recordAppend(10); // scan #1 (lazy load)
+		expect(scans).toBe(1);
+
+		// Push well past 1 MiB of own output in one shot -- the tracker must re-scan
+		// rather than trust a MiB-stale cache indefinitely.
+		await tracker.recordAppend(2 * 1024 * 1024);
+		expect(scans).toBe(2);
+	});
+
+	test('concurrent runs are invisible to each other between refreshes -- documented trade-off, not a bug', async () => {
+		// Two trackers for two DIFFERENT runs sharing the same directory. Tracker A's
+		// baseline is measured before B writes anything; B's own bytes are then
+		// invisible to A until A refreshes again. This is exactly the imprecision
+		// SizeBudgetTracker's doc comment describes -- this test pins the size of
+		// that gap so a future change can't silently widen it without this test
+		// noticing.
+		const trackerA = new SizeBudgetTracker(null, 'run-a', 10_000_000);
+
+		await trackerA.recordAppend(100); // A's baseline measured now: directory is empty
+
+		// B writes 50 KB of real output AFTER A's baseline was taken, into the SAME
+		// environment (null) as A -- this test is about same-environment concurrency,
+		// not cross-environment isolation (see the F5 describe block below for that).
+		const bDir = join(scratchDir, 'deploy-logs', envDirName(null));
+		await mkdir(bDir, { recursive: true });
+		await writeFile(join(bDir, 'run-b.log'), 'y'.repeat(50_000));
+
+		// A has not crossed its own refresh threshold (well under 1 MiB of its own
+		// output), so its cached view of "everything else" still does not include
+		// B's 50 KB -- that is the documented gap, reproduced here.
+		const stillBlind = await trackerA.recordAppend(100);
+		expect(stillBlind).toBe(false);
+
+		// A fresh tracker (or a refreshed one) DOES see it -- the gap is temporary,
+		// not a permanent miss.
+		const freshView = await usedBytesExcluding(null, 'run-a');
+		expect(freshView).toBeGreaterThanOrEqual(50_000);
+	});
+});
+
+// ---------------------------------------------------------------------------
+// F5 fix: per-environment directory/budget scoping. THE key regression test --
+// see F5-REPORT.md for the counter-test run against this block with the fix
+// reverted (envDirName() collapsed to a single shared directory).
+// ---------------------------------------------------------------------------
+
+describe('SizeBudgetTracker -- per-environment scoping (F5)', () => {
+	test('filling environment A\'s budget does not truncate environment B\'s run (separate directories) -- THE key F5 regression test', async () => {
+		// Environment A already has 950 B of ANOTHER run's output on disk -- right up
+		// against a 1000 B budget, entirely on its own, before environment A's own
+		// run under test has written a single byte. This is deliberately close to the
+		// budget by itself: under the pre-fix shared directory, these 950 B would be
+		// visible to EVERY environment's tracker, not just environment A's own.
+		await seedOtherRunFiles(1, 1, 950);
+		const trackerA = new SizeBudgetTracker(1, 'run-a', 1000);
+		// Environment A's own run pushes ITS OWN environment over budget, as expected.
+		const exceededA = await trackerA.recordAppend(100); // 950 + 100 = 1050 > 1000
+		expect(exceededA).toBe(true);
+
+		// Environment B has NOTHING of its own on disk and the SAME 1000 B budget.
+		// Its run writes a small, unrelated 100 B chunk -- nowhere near 1000 B on its
+		// own. Against the pre-fix SHARED directory/budget, environment A's 950 B
+		// fixture above would land in the exact same directory environment B's
+		// tracker scans, so B's tiny write would ALSO read as over budget (950 + 100
+		// = 1050 > 1000) even though environment B's run never came close to writing
+		// 1000 B itself -- exactly the silent cross-tenant truncation F5 fixes.
+		const trackerB = new SizeBudgetTracker(2, 'run-b', 1000);
+		const exceededB = await trackerB.recordAppend(100);
+		expect(exceededB).toBe(false);
+	});
+
+	test('two environments\' own files never appear in each other\'s usedBytesExcluding() total', async () => {
+		await seedOtherRunFiles(1, 3, 1000); // 3 KB in environment 1
+		await seedOtherRunFiles(2, 1, 50); // 50 B in environment 2
+
+		const totalForEnv1 = await usedBytesExcluding(1, 'irrelevant-run-id');
+		const totalForEnv2 = await usedBytesExcluding(2, 'irrelevant-run-id');
+
+		expect(totalForEnv1).toBe(3000);
+		expect(totalForEnv2).toBe(50);
+	});
+
+	test('a run\'s own log file lives under its own environment\'s directory, and NOT under a different environment\'s directory with the same run id', async () => {
+		const { appendRunLog, runLogPath } = await import('../src/lib/server/deploy-log-store');
+		await appendRunLog(1, 'shared-id', 'env-1 output\n');
+		await appendRunLog(2, 'shared-id', 'env-2 output\n');
+
+		const { readFile } = await import('node:fs/promises');
+		expect(await readFile(runLogPath(1, 'shared-id'), 'utf8')).toBe('env-1 output\n');
+		expect(await readFile(runLogPath(2, 'shared-id'), 'utf8')).toBe('env-2 output\n');
+		expect(runLogPath(1, 'shared-id')).not.toBe(runLogPath(2, 'shared-id'));
+	});
+});
+
+describe('listEnvDirNames -- F5 environment discovery for the reconcile job', () => {
+	test('lists every environment directory currently on disk, and nothing else', async () => {
+		const { listEnvDirNames } = await import('../src/lib/server/deploy-log-store');
+		await seedOtherRunFiles(1, 1, 10);
+		await seedOtherRunFiles(2, 1, 10);
+		await seedOtherRunFiles(null, 1, 10);
+
+		const names = (await listEnvDirNames()).sort();
+		expect(names).toEqual(['1', '2', 'null']);
+	});
+
+	test('excludes a stray FILE directly under deploy-logs/ (the pre-F5 flat legacy layout)', async () => {
+		const { listEnvDirNames } = await import('../src/lib/server/deploy-log-store');
+		const dir = join(scratchDir, 'deploy-logs');
+		await mkdir(dir, { recursive: true });
+		await writeFile(join(dir, 'legacy-run.log'), 'old flat-layout content');
+		await seedOtherRunFiles(1, 1, 10);
+
+		const names = await listEnvDirNames();
+		expect(names).toEqual(['1']);
+	});
+
+	test('returns an empty list when deploy-logs/ does not exist yet', async () => {
+		const { listEnvDirNames } = await import('../src/lib/server/deploy-log-store');
+		expect(await listEnvDirNames()).toEqual([]);
+	});
+});
+
+describe('readRunLog -- F5 back-compat fallback to the pre-F5 flat legacy path', () => {
+	test('finds a file at the new per-environment path first', async () => {
+		const { appendRunLog, readRunLog } = await import('../src/lib/server/deploy-log-store');
+		await appendRunLog(1, 'r1', 'new layout content');
+		expect(await readRunLog(1, 'r1')).toBe('new layout content');
+	});
+
+	test('falls back to the pre-F5 flat path when no per-environment file exists', async () => {
+		const { readRunLog } = await import('../src/lib/server/deploy-log-store');
+		const dir = join(scratchDir, 'deploy-logs');
+		await mkdir(dir, { recursive: true });
+		await writeFile(join(dir, 'legacy.log'), 'old flat layout content');
+
+		expect(await readRunLog(1, 'legacy')).toBe('old flat layout content');
+	});
+
+	test('a run with a file at NEITHER the per-environment nor the legacy path returns null', async () => {
+		const { readRunLog } = await import('../src/lib/server/deploy-log-store');
+		expect(await readRunLog(1, 'nowhere')).toBeNull();
+	});
+});
+
+describe('deleteRunLog -- F5 clears both the per-environment AND the legacy flat path', () => {
+	test('removes a file at the new per-environment path', async () => {
+		const { appendRunLog, readRunLog, deleteRunLog } = await import('../src/lib/server/deploy-log-store');
+		await appendRunLog(1, 'r1', 'content');
+		await deleteRunLog(1, 'r1');
+		expect(await readRunLog(1, 'r1')).toBeNull();
+	});
+
+	test('also removes a leftover legacy flat-path file for the same run id, so it cannot outlive its own deletion', async () => {
+		const { readRunLog, deleteRunLog } = await import('../src/lib/server/deploy-log-store');
+		const dir = join(scratchDir, 'deploy-logs');
+		await mkdir(dir, { recursive: true });
+		await writeFile(join(dir, 'legacy.log'), 'stale legacy content');
+
+		await deleteRunLog(1, 'legacy');
+
+		expect(await readRunLog(1, 'legacy')).toBeNull();
+	});
+
+	test('deleting a nonexistent run\'s log is a no-op, not an error', async () => {
+		const { deleteRunLog } = await import('../src/lib/server/deploy-log-store');
+		await expect(deleteRunLog(1, 'never-existed')).resolves.toBeUndefined();
+	});
+});

tests/deploy-recorder.test.ts

@@ -0,0 +1,28 @@
+// tests/deploy-recorder.test.ts
+import { describe, expect, test } from 'bun:test';
+import { shouldRecord } from '../src/lib/server/deploy-recorder';
+
+describe('shouldRecord', () => {
+	test('records redacted output lines', () => {
+		expect(shouldRecord('progress', { type: 'line', line: 'Container web Started' })).toBe(true);
+	});
+
+	test('never records the result event, which carries the unredacted output block', () => {
+		// deploy/+server.ts sends { success, output: result.output }, and result.output is
+		// stdout || stderr straight from compose -- it never passes through redactLine.
+		// Recording it would put secrets on disk permanently.
+		expect(shouldRecord('result', { success: true, output: 'DB_PASSWORD=hunter2' })).toBe(false);
+	});
+
+	test('does not record the static status labels', () => {
+		expect(shouldRecord('progress', { status: 'Deploying stack...' })).toBe(false);
+	});
+
+	// TWO conditions carry this guard, and each needs its own case -- otherwise removing
+	// one of them leaves every test green. The case below is reached only by the event
+	// check: a 'result' payload that DOES carry type: 'line' passes the second condition
+	// and is stopped by the first one alone.
+	test('rejects a result event even when it carries a line-shaped payload', () => {
+		expect(shouldRecord('result', { type: 'line', line: 'Container web Started' })).toBe(false);
+	});
+});

tests/deploy-run-openapi-drift.test.ts

@@ -0,0 +1,67 @@
+/**
+ * B1 regression: the three single-run deploy routes' @openapi annotations
+ * must not claim a response code that never appears literally in the
+ * handler's own body -- that is exactly Gate 4 of
+ * scripts/generate-openapi.ts's `--check` (statusCodes drift), the CI tor
+ * .github/workflows/openapi.yml:49 runs. This file reproduces that one
+ * gate's logic directly against these three routes' actual source (via the
+ * SAME parseAnnotations/splitMethodBodies/analyzeHandlerBody the generator
+ * itself uses), rather than shelling out to the full generator -- which
+ * scans and regenerates the ENTIRE route tree and would make this a slow,
+ * broad-scoped test for what is a narrow, three-file regression.
+ *
+ * Before the fix: GET and DELETE .../deploys/{runId} documented resp-400 and
+ * resp-404 as `resp-NNN:` lines, and GET .../deploys/{runId}/log documented
+ * resp-400 -- but all three of those specific codes are produced by the
+ * SHARED loadOwnedDeployRun() helper (deploy-run-access.ts), not by a
+ * literal `status: 400` / `error(400)` in the handler's own body text, which
+ * is all the generator's static scanner can see. Fixed by moving that
+ * information into the `description:` field as prose (the same pattern
+ * POST /api/backup/destinations/{id}/task already uses for its own
+ * guard-produced codes), which this test also confirms is still readable.
+ */
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseAnnotations, splitMethodBodies, analyzeHandlerBody } from '../scripts/openapi/lib';
+
+const ROUTES: { file: string; methods: ('GET' | 'DELETE')[] }[] = [
+	{ file: 'src/routes/api/stacks/[name]/deploys/[runId]/+server.ts', methods: ['GET', 'DELETE'] },
+	{ file: 'src/routes/api/stacks/[name]/deploys/[runId]/log/+server.ts', methods: ['GET'] }
+];
+
+describe('B1: deploy-run routes have no status-code drift (Gate 4)', () => {
+	for (const { file, methods } of ROUTES) {
+		const content = readFileSync(join(import.meta.dir, '..', file), 'utf-8');
+		const annotations = parseAnnotations(content);
+		const bodies = splitMethodBodies(content);
+
+		for (const method of methods) {
+			test(`${method} ${file}: every documented response code appears literally in the handler body`, () => {
+				const ann = annotations[method];
+				const body = bodies[method];
+				expect(ann).toBeDefined();
+				expect(body).toBeDefined();
+				if (!ann || !body) return; // unreachable, satisfies the type checker
+
+				const analysis = analyzeHandlerBody(body);
+				const codeCodes = new Set(analysis.statusCodes.filter((c) => c !== '200'));
+				const docCodes = Object.keys(ann.responses).filter((c) => c !== '200');
+
+				// This IS Gate 4's own drift condition, reproduced directly: a
+				// documented code with no matching status()/error() call in the
+				// SAME handler's body text is exactly what turned CI red.
+				const stale = docCodes.filter((c) => !codeCodes.has(c));
+				expect(stale).toEqual([]);
+			});
+		}
+
+		test(`${file}: the 400/404 codes loadOwnedDeployRun() produces are still documented, in prose`, () => {
+			for (const method of methods) {
+				const ann = annotations[method];
+				expect(ann?.description).toBeDefined();
+				expect(ann!.description).toMatch(/loadOwnedDeployRun/);
+			}
+		});
+	}
+});

tests/deploy-run-record-core.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, test } from 'bun:test';
+import { buildRunDetails } from '../src/lib/server/deploy-run-record-core';
+
+describe('buildRunDetails', () => {
+	test('carries the options, the summary and the log file name', () => {
+		const d = buildRunDetails({
+			options: { pull: false, build: true, forceRecreate: true },
+			summary: { containersCreated: 2, containersStarted: 2, containersRecreated: 0,
+			           imagesBuilt: ['app:1'], imagesPulled: [], buildSteps: 3, buildStepsCached: 1,
+			           digest: undefined },
+			exitCode: 0,
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			logFile: '01J8-abc.log'
+		});
+		expect(d.options.build).toBe(true);
+		expect(d.summary?.containersStarted).toBe(2);
+		expect(d.logFile).toBe('01J8-abc.log');
+		expect(d.exitCode).toBe(0);
+	});
+
+	// The log file name is what ties record and file together. Task 13 deletes any file
+	// whose id has no record -- if the name is missing here, the reconciler eats the log.
+	test('refuses to build details without a log file name', () => {
+		expect(() => buildRunDetails({ options: { pull: false, build: false, forceRecreate: false },
+			summary: undefined, exitCode: 0, composeHash: 'a', envHash: 'b', logFile: '' }))
+			.toThrow(/logFile/);
+	});
+});

tests/deploy-run-record.test.ts

@@ -0,0 +1,476 @@
+// tests/deploy-run-record.test.ts
+/**
+ * Exercises the database-touching half of the stack_deploy run record
+ * (deploy-run-record.ts) against a faked $lib/server/db -- see
+ * tests/helpers/db-fake.ts's doc comment for why a fake is unavoidable under Bun
+ * (db.ts transitively loads better-sqlite3, ERR_DLOPEN_FAILED) and why it must be
+ * registered through registerDbFake() rather than a second mock.module() call.
+ *
+ * Deliberately never calls recorder.line(): end() awaits `this.tail`, which is
+ * `Promise.resolve()` when line() was never invoked, so these tests never touch
+ * deploy-log-store.ts (no real filesystem needed).
+ */
+import { describe, test, expect } from 'bun:test';
+import { registerDbFake } from './helpers/db-fake';
+
+// -- $lib/server/db fake: an in-memory schedule_executions row ------------
+
+let stored: {
+	created?: Record<string, unknown>;
+	updates: Array<Record<string, unknown>>;
+};
+
+function resetDbState() {
+	stored = { created: undefined, updates: [] };
+}
+resetDbState();
+
+registerDbFake('createScheduleExecution', async (data: Record<string, unknown>) => {
+	stored.created = data;
+	return {
+		id: 1,
+		...data,
+		triggeredAt: new Date().toISOString(),
+		startedAt: null,
+		completedAt: null,
+		duration: null,
+		errorMessage: null,
+		details: data.details ?? null,
+		logs: null,
+		createdAt: null
+	};
+});
+registerDbFake('updateScheduleExecution', async (id: number, data: Record<string, unknown>) => {
+	stored.updates.push(data);
+	return { id, ...data };
+});
+
+// Imported AFTER the fakes are registered above -- same ordering constraint
+// tests/deploy-endpoints.test.ts documents for $lib/server/db.
+const { createRunRecorder } = await import('../src/lib/server/deploy-run-record');
+
+/** The db-fake update() call that closed the row (status !== 'running'), i.e. the
+ *  one written by end(), as opposed to createRunRecorder's own startedAt update. */
+function endUpdate() {
+	return stored.updates.find((u) => u.status !== undefined);
+}
+
+describe('DeployRunRecorder.end() -- secret redaction of the stored error text', () => {
+	// A known, invented value that can't coincidentally appear in a timestamp or id.
+	const SECRET = 'zzz-kanarienvogel-4711';
+
+	test('a failed run whose error text carries a known secret does NOT store that secret', async () => {
+		resetDbState();
+		const recorder = await createRunRecorder({
+			stackName: 'demo',
+			envId: null,
+			triggeredBy: 'manual',
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			secrets: [SECRET]
+		});
+
+		await recorder.end(false, undefined, `compose up failed: DB_PASSWORD=${SECRET} rejected`);
+
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		expect(String(update?.errorMessage)).not.toContain(SECRET);
+		expect(JSON.stringify(update?.details)).not.toContain(SECRET);
+	});
+
+
+	test('status is "failed" and NOT the redacted-line placeholder itself', async () => {
+		resetDbState();
+		const recorder = await createRunRecorder({
+			stackName: 'demo',
+			envId: null,
+			triggeredBy: 'manual',
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			secrets: [SECRET]
+		});
+
+		await recorder.end(false, undefined, `boom: ${SECRET}`);
+
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		// Asserting presence of the placeholder alone would stay green even if no
+		// secret had ever been in the line (test-coverage-pflicht.md's warning about
+		// "enthaelt ***" tests) -- so this only checks the redacted text is safe to
+		// store, not that a placeholder specifically appears.
+		expect(String(update?.errorMessage)).toContain('***');
+	});
+
+	test('a successful run stores errorMessage: null regardless of secrets', async () => {
+		resetDbState();
+		const recorder = await createRunRecorder({
+			stackName: 'demo',
+			envId: null,
+			triggeredBy: 'manual',
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			secrets: [SECRET]
+		});
+
+		await recorder.end(true);
+
+		const update = endUpdate();
+		expect(update?.status).toBe('success');
+		expect(update?.errorMessage).toBeNull();
+	});
+
+	// redactLine() withholds the WHOLE line (returns null) when a too-short secret
+	// value appears, rather than risk replacing an unrelated substring. The run must
+	// still close as "failed" -- a run stuck as "running" forever is worse than a
+	// run with a generic message.
+	test('when redaction withholds the whole line, the run still ends "failed" with a safe, non-null message', async () => {
+		resetDbState();
+		const shortSecret = 'ab12cd'; // < MIN_REPLACEABLE_LENGTH (8) in secret-redaction.ts
+		const recorder = await createRunRecorder({
+			stackName: 'demo',
+			envId: null,
+			triggeredBy: 'manual',
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			secrets: [shortSecret]
+		});
+
+		await recorder.end(false, undefined, `token ${shortSecret} invalid`);
+
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		expect(update?.errorMessage).not.toBeNull();
+		expect(String(update?.errorMessage)).not.toContain(shortSecret);
+	});
+
+	test('an error with no secrets configured is stored unchanged (no false positives)', async () => {
+		resetDbState();
+		const recorder = await createRunRecorder({
+			stackName: 'demo',
+			envId: null,
+			triggeredBy: 'manual',
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			secrets: []
+		});
+
+		await recorder.end(false, undefined, 'exit code 1');
+
+		const update = endUpdate();
+		expect(update?.errorMessage).toBe('exit code 1');
+	});
+});
+
+// F4 fix: deployStack() resolves a bound secret provider's values (Bitwarden/
+// 1Password/etc. bulk pulls or inline refs) INTERNALLY, strictly after a caller
+// (a route, or deployGitStack in git.ts) already built its recorder from the
+// DB-only vars it had at construction time. addSecrets() is how the caller feeds
+// those later-known values in before end() redacts the stored error text.
+describe('DeployRunRecorder.addSecrets() -- provider-resolved secrets added AFTER construction', () => {
+	const LATE_SECRET = 'zzz-spaetzuendung-9000';
+
+	test('a secret added via addSecrets() after construction (with an EMPTY construction-time list) is still redacted from the stored error', async () => {
+		resetDbState();
+		const recorder = await createRunRecorder({
+			stackName: 'demo',
+			envId: null,
+			triggeredBy: 'manual',
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			// Mirrors the route's construction-time list BEFORE deployStack() resolves
+			// provider secrets -- this is the F4 bug's exact starting condition.
+			secrets: []
+		});
+
+		recorder.addSecrets([LATE_SECRET]);
+
+		await recorder.end(false, undefined, `compose up failed: PROVIDER_TOKEN=${LATE_SECRET} rejected`);
+
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		expect(String(update?.errorMessage)).not.toContain(LATE_SECRET);
+		expect(String(update?.errorMessage)).toContain('***');
+	});
+
+	test('addSecrets() ADDS to, rather than replaces, secrets already known at construction', async () => {
+		resetDbState();
+		const CONSTRUCTION_SECRET = 'yyy-bekannt-von-anfang-an';
+		const recorder = await createRunRecorder({
+			stackName: 'demo',
+			envId: null,
+			triggeredBy: 'manual',
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			secrets: [CONSTRUCTION_SECRET]
+		});
+
+		recorder.addSecrets([LATE_SECRET]);
+
+		await recorder.end(
+			false,
+			undefined,
+			`compose up failed: A=${CONSTRUCTION_SECRET} B=${LATE_SECRET} rejected`
+		);
+
+		const update = endUpdate();
+		expect(String(update?.errorMessage)).not.toContain(CONSTRUCTION_SECRET);
+		expect(String(update?.errorMessage)).not.toContain(LATE_SECRET);
+	});
+
+	test('calling addSecrets() with an empty array changes nothing (the common case: deployStack() failed before resolving any provider secrets)', async () => {
+		resetDbState();
+		const recorder = await createRunRecorder({
+			stackName: 'demo',
+			envId: null,
+			triggeredBy: 'manual',
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			secrets: []
+		});
+
+		recorder.addSecrets([]);
+
+		await recorder.end(false, undefined, 'exit code 1');
+
+		const update = endUpdate();
+		expect(update?.errorMessage).toBe('exit code 1');
+	});
+});
+
+// ---------------------------------------------------------------------------
+// DeployRunRecorder.line() -- the size-budget path (SizeBudgetTracker,
+// deploy-log-store.ts). Unlike every test above, THIS block deliberately DOES
+// call line() and DOES touch the real filesystem (via appendRunLog) -- it is
+// the exception to this file's opening doc comment, and exists specifically
+// to prove the budget still triggers truncation after replacing the old
+// per-line full-directory-scan with SizeBudgetTracker's cached/incremental
+// check. A tiny injected SizeBudgetTracker (see DeployRunRecorder's
+// constructor) stands in for BUDGET_BYTES (2 GiB in production) -- nothing
+// here writes gigabytes of data to prove the same code path.
+// ---------------------------------------------------------------------------
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { beforeEach, afterEach } from 'bun:test';
+import { SizeBudgetTracker } from '../src/lib/server/deploy-log-store';
+
+const previousDataDirForLineTests = process.env.DATA_DIR;
+let lineTestsScratchDir: string;
+
+beforeEach(async () => {
+	lineTestsScratchDir = await mkdtemp(join(tmpdir(), 'deploy-run-record-'));
+	process.env.DATA_DIR = lineTestsScratchDir;
+});
+afterEach(async () => {
+	if (previousDataDirForLineTests === undefined) delete process.env.DATA_DIR;
+	else process.env.DATA_DIR = previousDataDirForLineTests;
+	await rm(lineTestsScratchDir, { recursive: true, force: true });
+});
+
+describe('DeployRunRecorder.line() -- size-budget truncation', () => {
+	test('a run whose output crosses a tiny injected budget ends up truncated: true', async () => {
+		resetDbState();
+		const { DeployRunRecorder } = await import('../src/lib/server/deploy-run-record');
+		// 50 B budget -- five ~11 B lines ("line-N\n") cross it comfortably without
+		// waiting on anything close to the real 2 GiB BUDGET_BYTES.
+		const tinyBudget = new SizeBudgetTracker(null, '1', 50);
+		const recorder = new DeployRunRecorder(
+			1,
+			Date.now(),
+			{
+				options: { pull: false, build: false, forceRecreate: false },
+				composeHash: 'aaa',
+				envHash: 'bbb',
+				secrets: [],
+				envId: null
+			},
+			tinyBudget
+		);
+
+		for (let i = 0; i < 10; i++) {
+			recorder.line(`line-${i}`);
+		}
+		await recorder.end(true);
+
+		const update = endUpdate();
+		expect((update?.details as Record<string, unknown> | undefined)?.truncated).toBe(true);
+	});
+
+	// Gegenversuch counterpart to the test above, and the "doesn't trigger too
+	// early" half of the requirement: a run whose total output stays under the
+	// budget must NOT be marked truncated.
+	test('a run whose output stays under the injected budget ends up truncated: false', async () => {
+		resetDbState();
+		const { DeployRunRecorder } = await import('../src/lib/server/deploy-run-record');
+		const generousBudget = new SizeBudgetTracker(null, '2', 1_000_000);
+		const recorder = new DeployRunRecorder(
+			2,
+			Date.now(),
+			{
+				options: { pull: false, build: false, forceRecreate: false },
+				composeHash: 'aaa',
+				envHash: 'bbb',
+				secrets: [],
+				envId: null
+			},
+			generousBudget
+		);
+
+		for (let i = 0; i < 10; i++) {
+			recorder.line(`line-${i}`);
+		}
+		await recorder.end(true);
+
+		const update = endUpdate();
+		// buildRunDetails() only puts `truncated` in the object when it's true (see
+		// deploy-run-record-core.ts) -- so "not truncated" is undefined, not false.
+		expect((update?.details as Record<string, unknown> | undefined)?.truncated).toBeUndefined();
+	});
+
+	test('once truncated, further line() calls stop appending -- the truncation notice is the last thing written', async () => {
+		resetDbState();
+		const { readRunLog } = await import('../src/lib/server/deploy-log-store');
+		const { DeployRunRecorder } = await import('../src/lib/server/deploy-run-record');
+		const tinyBudget = new SizeBudgetTracker(null, '3', 20); // crosses after ~2 lines
+		const recorder = new DeployRunRecorder(
+			3,
+			Date.now(),
+			{
+				options: { pull: false, build: false, forceRecreate: false },
+				composeHash: 'aaa',
+				envHash: 'bbb',
+				secrets: [],
+				envId: null
+			},
+			tinyBudget
+		);
+
+		for (let i = 0; i < 20; i++) {
+			recorder.line(`this-line-should-not-all-land-${i}`);
+		}
+		await recorder.end(true);
+
+		const log = await readRunLog(null, '3');
+		expect(log).not.toBeNull();
+		expect(log).toContain('[deploy log truncated: size budget exceeded]');
+		// Not every one of the 20 lines can have landed -- otherwise truncation
+		// never actually stopped anything, it just decorated a full log.
+		expect((log ?? '').split('\n').length).toBeLessThan(22);
+	});
+});
+
+// ---------------------------------------------------------------------------
+// F5 fix: DeployRunRecorder threads its envId through to BOTH the log file's
+// on-disk path AND its SizeBudgetTracker's default construction -- proven
+// end to end here, without injecting a custom SizeBudgetTracker (so this
+// exercises DeployRunRecorder's OWN `new SizeBudgetTracker(this.envId, ...)`
+// default, not a test double standing in for it).
+// ---------------------------------------------------------------------------
+
+describe('DeployRunRecorder -- envId threading to the log file path (F5)', () => {
+	test('two runs in DIFFERENT environments write to two DIFFERENT log files, never colliding even with the same executionId space', async () => {
+		resetDbState();
+		const { readRunLog, runLogPath } = await import('../src/lib/server/deploy-log-store');
+		const { DeployRunRecorder } = await import('../src/lib/server/deploy-run-record');
+
+		const recorderA = new DeployRunRecorder(4001, Date.now(), {
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			secrets: [],
+			envId: 1
+		});
+		const recorderB = new DeployRunRecorder(4002, Date.now(), {
+			options: { pull: false, build: false, forceRecreate: false },
+			composeHash: 'aaa',
+			envHash: 'bbb',
+			secrets: [],
+			envId: 2
+		});
+
+		recorderA.line('environment 1 output');
+		recorderB.line('environment 2 output');
+		await recorderA.end(true);
+		await recorderB.end(true);
+
+		expect(await readRunLog(1, '4001')).toContain('environment 1 output');
+		expect(await readRunLog(2, '4002')).toContain('environment 2 output');
+		// Not merely different content -- genuinely different files on disk.
+		expect(runLogPath(1, '4001')).not.toBe(runLogPath(2, '4002'));
+	});
+
+	// THE end-to-end counterpart to the pure SizeBudgetTracker-level regression
+	// test in deploy-log-store.test.ts: environment A's run is deliberately
+	// pushed PAST its own size budget and truncated. Environment B's run, with
+	// the SAME budget and an unrelated one-line output, must NOT be affected --
+	// proving DeployRunRecorder.line()'s real truncation path (appendRunLog +
+	// SizeBudgetTracker.recordAppend together, not either in isolation) is
+	// scoped per environment, exactly as task-lead described: "filling A's
+	// budget does NOT truncate B's run".
+	test('truncating environment A\'s run does not truncate environment B\'s unrelated run, even with the same tiny budget', async () => {
+		resetDbState();
+		const { readRunLog } = await import('../src/lib/server/deploy-log-store');
+		const { DeployRunRecorder } = await import('../src/lib/server/deploy-run-record');
+
+		const budgetA = new SizeBudgetTracker(1, '4101', 50);
+		const budgetB = new SizeBudgetTracker(2, '4102', 50);
+
+		const recorderA = new DeployRunRecorder(
+			4101,
+			Date.now(),
+			{
+				options: { pull: false, build: false, forceRecreate: false },
+				composeHash: 'aaa',
+				envHash: 'bbb',
+				secrets: [],
+				envId: 1
+			},
+			budgetA
+		);
+		const recorderB = new DeployRunRecorder(
+			4102,
+			Date.now(),
+			{
+				options: { pull: false, build: false, forceRecreate: false },
+				composeHash: 'aaa',
+				envHash: 'bbb',
+				secrets: [],
+				envId: 2
+			},
+			budgetB
+		);
+
+		// Environment A runs to completion FIRST and fully lands on disk (including
+		// its truncation notice) before environment B writes a single byte -- this
+		// removes any ambiguity about interleaving between the two recorders'
+		// independent async append chains, so a failure below can only mean B's
+		// directory scan actually saw A's bytes, not a timing accident.
+		for (let i = 0; i < 10; i++) {
+			recorderA.line(`line-${i}`);
+		}
+		await recorderA.end(true);
+
+		// Environment B: ONE short line, nowhere near 50 B on its own, written
+		// strictly AFTER environment A has already exceeded its own budget.
+		recorderB.line('untouched');
+		await recorderB.end(true);
+
+		const logA = await readRunLog(1, '4101');
+		const logB = await readRunLog(2, '4102');
+
+		expect(logA).toContain('[deploy log truncated: size budget exceeded]');
+		// Environment B's single line survives completely, with no truncation
+		// notice -- it was never anywhere near ITS OWN 50 B budget, and
+		// environment A's bytes (in a DIFFERENT directory) never counted
+		// against it.
+		expect(logB).toBe('untouched\n');
+	});
+});

tests/deploy-run-view.test.ts

@@ -0,0 +1,291 @@
+/**
+ * deploy-run-view — pure text/label composition for the Stack modal's Deploys tab.
+ * Import-free by design (see deploy-run-view.ts's doc comment) so it runs under Bun
+ * without pulling in $lib/server (better-sqlite3, ERR_DLOPEN_FAILED).
+ *
+ * Run with: bun test tests/deploy-run-view.test.ts
+ */
+import { describe, test, expect } from 'bun:test';
+import {
+	formatStatusLabel,
+	formatTrigger,
+	formatRunDuration,
+	formatContainerSummary,
+	formatBuildStatus,
+	formatOptionChips,
+	lastErrorLine,
+	buildDeployRunView,
+	buildDeployLogPanelState,
+	type DeployRun,
+	type DeployRunSummary
+} from '../src/lib/utils/deploy-run-view';
+
+const summary = (over: Partial<DeployRunSummary> = {}): DeployRunSummary => ({
+	containersCreated: 0,
+	containersRecreated: 0,
+	containersStarted: 0,
+	imagesBuilt: [],
+	imagesPulled: [],
+	buildSteps: 0,
+	buildStepsCached: 0,
+	...over
+});
+
+const run = (over: Partial<DeployRun> = {}): DeployRun => ({
+	id: 1,
+	triggeredBy: 'manual',
+	duration: 1500,
+	status: 'success',
+	errorMessage: null,
+	details: { options: { pull: false, build: false, forceRecreate: false } },
+	...over
+});
+
+describe('formatBuildStatus', () => {
+	test('every build step came from cache', () => {
+		expect(formatBuildStatus(summary({ buildSteps: 3, buildStepsCached: 3 }))).toBe(
+			'Built from cache (3 steps)'
+		);
+	});
+
+	test('a single cached step is not pluralized wrong', () => {
+		expect(formatBuildStatus(summary({ buildSteps: 1, buildStepsCached: 1 }))).toBe(
+			'Built from cache'
+		);
+	});
+
+	test('partially built — some steps from cache, some not', () => {
+		expect(formatBuildStatus(summary({ buildSteps: 4, buildStepsCached: 1 }))).toBe(
+			'Built (4 steps, 1 from cache)'
+		);
+	});
+
+	test('built with no cache hits at all', () => {
+		expect(formatBuildStatus(summary({ buildSteps: 2, buildStepsCached: 0 }))).toBe(
+			'Built (2 steps)'
+		);
+	});
+
+	test('nothing built — a run that never touched the build step', () => {
+		expect(formatBuildStatus(summary({ buildSteps: 0, buildStepsCached: 0 }))).toBe(
+			'Nothing built'
+		);
+	});
+
+	test('no summary at all reads as unknown, not as "nothing built"', () => {
+		expect(formatBuildStatus(undefined)).toBe('Build status unknown');
+	});
+});
+
+describe('formatContainerSummary', () => {
+	test('no summary recorded says so explicitly — never "0 containers"', () => {
+		const text = formatContainerSummary(undefined);
+		expect(text).toBe('No summary recorded for this run');
+		expect(text).not.toMatch(/0/);
+	});
+
+	test('a run with zero container changes reads distinctly from "no summary"', () => {
+		expect(formatContainerSummary(summary())).toBe('No container changes');
+	});
+
+	test('created and started are joined, recreated omitted when zero', () => {
+		expect(
+			formatContainerSummary(summary({ containersCreated: 3, containersStarted: 1 }))
+		).toBe('3 created, 1 started');
+	});
+
+	test('all three counts present appear in created, recreated, started order', () => {
+		expect(
+			formatContainerSummary(
+				summary({ containersCreated: 1, containersRecreated: 2, containersStarted: 3 })
+			)
+		).toBe('1 created, 2 recreated, 3 started');
+	});
+});
+
+describe('formatOptionChips', () => {
+	test('no options recorded yields no chips', () => {
+		expect(formatOptionChips(undefined)).toEqual([]);
+	});
+
+	test('all flags false yields no chips', () => {
+		expect(formatOptionChips({ pull: false, build: false, forceRecreate: false })).toEqual([]);
+	});
+
+	test('every true flag becomes its own chip, in a fixed order', () => {
+		expect(formatOptionChips({ pull: true, build: true, forceRecreate: true })).toEqual([
+			'Pull',
+			'Build',
+			'Force recreate'
+		]);
+	});
+
+	test('a single flag yields a single chip', () => {
+		expect(formatOptionChips({ pull: true, build: false, forceRecreate: false })).toEqual(['Pull']);
+	});
+});
+
+describe('formatTrigger', () => {
+	test.each([
+		['manual', 'Manual'],
+		['cron', 'Scheduled'],
+		['webhook', 'Webhook'],
+		['startup', 'Startup']
+	])('%s -> %s', (input: string, expected: string) => {
+		expect(formatTrigger(input)).toBe(expected);
+	});
+
+	test('an unrecognized trigger value is not swallowed silently', () => {
+		expect(formatTrigger('something-new')).toBe('something-new');
+	});
+});
+
+describe('formatStatusLabel', () => {
+	test.each([
+		['success', 'Success'],
+		['failed', 'Failed'],
+		['running', 'Running']
+	])('%s -> %s', (input: string, expected: string) => {
+		expect(formatStatusLabel(input)).toBe(expected);
+	});
+
+	test('an unrecognized status value is passed through, not hidden', () => {
+		expect(formatStatusLabel('mystery')).toBe('mystery');
+	});
+});
+
+describe('formatRunDuration', () => {
+	test('null/undefined duration (a run still in progress or never started)', () => {
+		expect(formatRunDuration(null)).toBe('—');
+		expect(formatRunDuration(undefined)).toBe('—');
+	});
+
+	test('sub-second durations render in milliseconds', () => {
+		expect(formatRunDuration(340)).toBe('340ms');
+	});
+
+	test('sub-minute durations render with one decimal of seconds', () => {
+		expect(formatRunDuration(13515)).toBe('13.5s');
+	});
+
+	test('minute-scale durations render as Nm Ns', () => {
+		expect(formatRunDuration(125000)).toBe('2m 5s');
+	});
+});
+
+describe('lastErrorLine', () => {
+	test('no error message at all', () => {
+		expect(lastErrorLine(null)).toBeNull();
+		expect(lastErrorLine(undefined)).toBeNull();
+		expect(lastErrorLine('')).toBeNull();
+	});
+
+	test('a short single-line message is returned unchanged', () => {
+		expect(lastErrorLine('exit code 1')).toBe('exit code 1');
+	});
+
+	test('a multi-line message keeps only its last non-empty line', () => {
+		const msg = 'Pulling image...\nBuilding...\nError: container failed to start\n';
+		expect(lastErrorLine(msg)).toBe('Error: container failed to start');
+	});
+
+	test('a long single-line message is cut to maxLen with an ellipsis marker', () => {
+		const long = 'x'.repeat(300);
+		const result = lastErrorLine(long, 50);
+		expect(result?.length).toBe(50);
+		expect(result?.endsWith('…')).toBe(true);
+		expect(result?.startsWith('x'.repeat(49))).toBe(true);
+	});
+});
+
+describe('buildDeployRunView', () => {
+	test('a run without a summary (no output at all) never claims to know container/build facts', () => {
+		const view = buildDeployRunView(run({ details: { options: { pull: true, build: false, forceRecreate: false } } }));
+		expect(view.containerSummary).toBe('No summary recorded for this run');
+		expect(view.buildStatus).toBe('Build status unknown');
+		expect(view.imagesBuilt).toEqual([]);
+		expect(view.imagesPulled).toEqual([]);
+	});
+
+	test('truncated is surfaced only when the record actually says so', () => {
+		expect(buildDeployRunView(run()).truncated).toBe(false);
+		expect(
+			buildDeployRunView(
+				run({ details: { options: { pull: false, build: false, forceRecreate: false }, truncated: true } })
+			).truncated
+		).toBe(true);
+	});
+
+	test('a failed run with a long error message carries the shortened last line', () => {
+		const longError = `Step 1 ok\nStep 2 ok\n${'boom '.repeat(60)}`;
+		const view = buildDeployRunView(run({ status: 'failed', errorMessage: longError }));
+		expect(view.errorSummary).not.toBeNull();
+		expect(view.errorSummary!.length).toBeLessThanOrEqual(200);
+		expect(view.statusLabel).toBe('Failed');
+	});
+
+	test('a successful run never surfaces an error summary even if errorMessage is set', () => {
+		const view = buildDeployRunView(run({ status: 'success', errorMessage: 'leftover text' }));
+		expect(view.errorSummary).toBeNull();
+	});
+
+	test('a running run in progress has no error summary and reads as Running', () => {
+		const view = buildDeployRunView(run({ status: 'running', duration: null, errorMessage: null }));
+		expect(view.errorSummary).toBeNull();
+		expect(view.statusLabel).toBe('Running');
+		expect(view.duration).toBe('—');
+	});
+
+	test('option chips and images pass through from the run summary', () => {
+		const view = buildDeployRunView(
+			run({
+				details: {
+					options: { pull: true, build: true, forceRecreate: false },
+					summary: summary({ imagesBuilt: ['app:1'], imagesPulled: ['redis:7'] })
+				}
+			})
+		);
+		expect(view.optionChips).toEqual(['Pull', 'Build']);
+		expect(view.imagesBuilt).toEqual(['app:1']);
+		expect(view.imagesPulled).toEqual(['redis:7']);
+	});
+});
+
+describe('buildDeployLogPanelState', () => {
+	test('a normal completed run: log fetchable, not truncated, deletable', () => {
+		const state = buildDeployLogPanelState(run({ status: 'success' }));
+		expect(state).toEqual({ logMissing: false, truncated: false, deletable: true });
+	});
+
+	test('a run reconciled as logMissing short-circuits to logMissing -- regardless of truncated', () => {
+		const state = buildDeployLogPanelState(
+			run({ status: 'success', details: { logMissing: true, truncated: true } })
+		);
+		expect(state.logMissing).toBe(true);
+	});
+
+	test('a truncated run surfaces truncated independently of logMissing', () => {
+		const state = buildDeployLogPanelState(run({ status: 'failed', details: { truncated: true } }));
+		expect(state.logMissing).toBe(false);
+		expect(state.truncated).toBe(true);
+	});
+
+	test('a running run is never deletable, even though its log is not missing', () => {
+		const state = buildDeployLogPanelState(run({ status: 'running', details: undefined }));
+		expect(state.deletable).toBe(false);
+		expect(state.logMissing).toBe(false);
+	});
+
+	test('mutating the run to running after it was deletable flips deletable back off', () => {
+		// Regression guard for a hand-rolled `run.status !== "running"` check drifting
+		// out of sync with this function if someone inlines the condition again later.
+		const base = run({ status: 'success' });
+		expect(buildDeployLogPanelState(base).deletable).toBe(true);
+		expect(buildDeployLogPanelState({ ...base, status: 'running' }).deletable).toBe(false);
+	});
+
+	test('a run with no details at all reads as available, not truncated, deletable', () => {
+		const state = buildDeployLogPanelState(run({ status: 'success', details: null }));
+		expect(state).toEqual({ logMissing: false, truncated: false, deletable: true });
+	});
+});

tests/deploy-stack-online.test.ts

@@ -0,0 +1,89 @@
+/**
+ * Regression guard: every deployStack() call in an API route must pass onLine.
+ *
+ * The compose output window is fed by 'progress' messages of shape
+ * {type:'line', line}. A route that runs deployStack inside createJobResponse but
+ * forgets `onLine: (line) => send('progress', { type: 'line', line })` still works
+ * — it just shows the user an empty output window until the job settles. Nothing
+ * fails, so the omission is invisible: POST /api/stacks (create & start) and
+ * PUT /api/stacks/{name}/compose (save & redeploy) both shipped without it while
+ * the five stack-row actions had it.
+ *
+ * deployStack talks to the Docker socket and the DB, so we can't drive these
+ * handlers end-to-end here. Instead we assert at the source level that every
+ * deployStack call under src/routes/api carries onLine — the same shape of check
+ * as tests/encryption-rotation-coverage.test.ts (a list that silently omitted
+ * one entry).
+ */
+// @ts-expect-error -- bun:test is a runtime built-in with no types installed
+import { describe, test, expect } from 'bun:test';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join, relative } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const apiRoot = join(here, '..', 'src', 'routes', 'api');
+
+function serverFiles(dir: string): string[] {
+	const found: string[] = [];
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) found.push(...serverFiles(full));
+		else if (entry.name === '+server.ts') found.push(full);
+	}
+	return found;
+}
+
+// Returns the text of each deployStack(...) argument list, paren-balanced so a
+// nested call or object literal doesn't cut the match short.
+function deployStackCalls(source: string): string[] {
+	const calls: string[] = [];
+	const marker = 'deployStack(';
+
+	for (let at = source.indexOf(marker); at !== -1; at = source.indexOf(marker, at + 1)) {
+		// Skip identifiers that merely end in "deployStack(" (e.g. runRedeployStack().
+		const before = source[at - 1];
+		if (before && /[A-Za-z0-9_$]/.test(before)) continue;
+
+		let depth = 0;
+		for (let i = at + marker.length - 1; i < source.length; i++) {
+			if (source[i] === '(') depth++;
+			else if (source[i] === ')') {
+				depth--;
+				if (depth === 0) {
+					calls.push(source.slice(at, i + 1));
+					break;
+				}
+			}
+		}
+	}
+	return calls;
+}
+
+const callsByFile = new Map<string, string[]>();
+for (const file of serverFiles(apiRoot)) {
+	const calls = deployStackCalls(readFileSync(file, 'utf8'));
+	if (calls.length > 0) callsByFile.set(relative(join(here, '..'), file), calls);
+}
+
+describe('API routes stream compose output', () => {
+	// Without this the suite would pass vacuously if the scan ever stopped
+	// finding anything (renamed directory, changed route layout).
+	test('the scan finds the known deployStack routes', () => {
+		expect([...callsByFile.keys()].sort()).toEqual([
+			'src/routes/api/stacks/+server.ts',
+			'src/routes/api/stacks/[name]/compose/+server.ts',
+			'src/routes/api/stacks/[name]/deploy/+server.ts'
+		]);
+	});
+
+	test('every deployStack call passes onLine', () => {
+		const missing: string[] = [];
+		for (const [file, calls] of callsByFile) {
+			for (const call of calls) {
+				if (!call.includes('onLine')) missing.push(file);
+			}
+		}
+		expect(missing).toEqual([]);
+	});
+});

tests/deploy-stack-resolved-secrets-source.test.ts

@@ -0,0 +1,115 @@
+/**
+ * Source guard: deployStack() must record the SAME secret set it redacts against.
+ *
+ * F4 makes `deployStack()` attach the resolved secret VALUES to its result so the
+ * per-route stack_deploy recorder can redact them out of a stored deploy error
+ * (deploy-run-record.ts -> RunRecorder.addSecrets -> redactLine). The single
+ * production line that carries F4 is, in src/lib/server/stacks.ts:
+ *
+ *     result.resolvedSecrets = Object.values(secretVars);
+ *
+ * where `secretVars` is the post-`resolveProviderEnvVars` set that
+ * `executeComposeCommand(...)` just redacted the streamed lines against. If that
+ * one line is deleted, resolvedSecrets stays undefined and the recorder redacts
+ * against nothing -- a provider-resolved secret in a thrown/returned deploy error
+ * would be stored in cleartext. A code review demonstrated the gap by mutation:
+ * deleting the line left the entire targeted suite green, because the two tests
+ * that reference `resolvedSecrets` (git-stack-deploy-run-record.test.ts,
+ * stack-compose-redeploy-run-record.test.ts) fake `deployStack` wholesale and
+ * hand-set the field in their fixtures -- they prove the DOWNSTREAM wiring, never
+ * that the real stacks.ts populates it.
+ *
+ * WHY THIS IS A SOURCE GUARD AND NOT A BEHAVIOUR TEST (empirically established,
+ * not assumed):
+ *   1. `tests/helpers/stacks-fake.ts` calls mock.module('$lib/server/stacks', ...)
+ *      at import time, which -- per its own doc comment and Bun's single-process
+ *      test model -- freezes that specifier's exports for the ENTIRE run. Two
+ *      existing suites import it, so in a full `bun test` run `import { deployStack }`
+ *      resolves to the fake dispatcher, never the real function. There is no
+ *      per-file process isolation in Bun to escape this.
+ *   2. Independently: pulling the real `$lib/server/stacks` into a test's import
+ *      graph evaluates a module chain that instantiates `better-sqlite3`, which
+ *      Bun does not support ("'better-sqlite3' is not yet supported in Bun") and
+ *      crashes at load. Reproduced twice while investigating this fix.
+ * Either blocker alone makes a real-`deployStack` behaviour test impossible here;
+ * that is why the whole suite fakes deployStack and guards its internal invariants
+ * at the source level (see deploy-stack-online.test.ts, stack-create-start-build-
+ * options.test.ts). This guard follows that established pattern.
+ *
+ * WHAT THIS GUARD CANNOT PROVE (honest limits of source matching): it matches
+ * TEXT, so it cannot prove `secretVars` is populated correctly at runtime (covered
+ * by resolveProviderEnvVars' own tests and the redaction tests), and a matching
+ * string inside a comment would satisfy it -- so comments are stripped before
+ * matching. It proves only the wiring: the derivation of `secretVars`, its use as
+ * the executeComposeCommand secret argument, and its assignment to resolvedSecrets.
+ */
+// @ts-expect-error -- bun:test is a runtime built-in with no types installed
+import { describe, test, expect } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const stacksPath = join(here, '..', 'src', 'lib', 'server', 'stacks.ts');
+
+// Strip // line comments and /* */ block comments so a matching string inside a
+// comment cannot satisfy the guard (the trap called out in test-coverage-pflicht).
+function stripComments(src: string): string {
+	return src
+		.replace(/\/\*[\s\S]*?\*\//g, '')
+		.replace(/(^|[^:])\/\/[^\n]*/g, '$1'); // avoid eating "http://" etc. (rare here)
+}
+
+// Extract the brace-balanced body of `export async function deployStack(...) { ... }`.
+function deployStackBody(src: string): string {
+	const sig = src.indexOf('export async function deployStack(');
+	if (sig === -1) return '';
+	const open = src.indexOf('{', sig);
+	if (open === -1) return '';
+	let depth = 0;
+	for (let i = open; i < src.length; i++) {
+		if (src[i] === '{') depth++;
+		else if (src[i] === '}') {
+			depth--;
+			if (depth === 0) return src.slice(open + 1, i);
+		}
+	}
+	return '';
+}
+
+const raw = readFileSync(stacksPath, 'utf8');
+const body = stripComments(deployStackBody(raw));
+
+describe('deployStack records the secret set it redacts against (F4 source guard)', () => {
+	// Vacuity guard: if the function can no longer be located, every assertion
+	// below would pass on an empty string. Fail loudly instead.
+	test('the deployStack body is located and non-trivial', () => {
+		expect(body.length).toBeGreaterThan(500);
+	});
+
+	test('secretVars is derived from resolveProviderEnvVars (the redaction input)', () => {
+		const ok = /\bsecretVars\b[\s\S]{0,80}=\s*await\s+resolveProviderEnvVars\s*\(/.test(body);
+		expect(ok, `${stacksPath}: deployStack no longer derives \`secretVars\` from ` +
+			`\`await resolveProviderEnvVars(...)\`. F4 records exactly the set that was ` +
+			`redacted; if the derivation changed, update this guard AND confirm the recorder ` +
+			`still receives the redacted set.`).toBe(true);
+	});
+
+	test('the same secretVars is passed to executeComposeCommand as its secret argument', () => {
+		const call = body.match(/executeComposeCommand\(([\s\S]*?)\n\t*\);/);
+		expect(call, `${stacksPath}: could not find the executeComposeCommand(...) call in ` +
+			`deployStack -- the F4 guard cannot verify the redaction/record share \`secretVars\`.`).toBeTruthy();
+		expect(/\bsecretVars\b/.test(call ? call[1] : ''),
+			`${stacksPath}: deployStack's executeComposeCommand(...) call no longer passes ` +
+			`\`secretVars\` as the secret argument. The recorded set (result.resolvedSecrets) ` +
+			`must be the SAME set the compose lines were redacted against.`).toBe(true);
+	});
+
+	test('result.resolvedSecrets is assigned Object.values(secretVars) (the F4 line)', () => {
+		const ok = /result\.resolvedSecrets\s*=\s*Object\.values\(\s*secretVars\s*\)/.test(body);
+		expect(ok, `${stacksPath}: the F4 line \`result.resolvedSecrets = Object.values(secretVars)\` ` +
+			`is gone from deployStack. Without it the stack_deploy recorder redacts against nothing ` +
+			`and a provider-resolved secret can be stored in a deploy error in cleartext. If you ` +
+			`intentionally moved this wiring, update this guard to match the new location.`).toBe(true);
+	});
+});

tests/deploy-summary-core.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, test } from 'bun:test';
+import { summarize } from '../src/lib/server/deploy-summary-core';
+
+const REAL_RUN = [
+	' Image alpine:3.21 Pulling ',
+	' Image alpine:3.21 Pulled ',
+	' Image progprobe-built:1 Building ',
+	' Image progprobe-built:1 Built ',
+	' Network probea_default Creating ',
+	' Network probea_default Creating ',
+	' Network probea_default Created ',
+	' Network probea_default Created ',
+	' Container probea-plain-1 Creating ',
+	' Container probea-built-1 Creating ',
+	' Container probea-built-1 Created ',
+	' Container probea-plain-1 Created ',
+	' Container probea-built-1 Starting ',
+	' Container probea-plain-1 Starting ',
+	' Container probea-plain-1 Started ',
+	' Container probea-built-1 Started ',
+	'#5 CACHED',
+	'#6 DONE 1.0s',
+	'#7 DONE 2.7s',
+	'#9 exporting manifest list sha256:3e3a42937811aaaabbbbccccddddeeeeffff0000111122223333444455556666'
+];
+
+describe('summarize', () => {
+	test('counts each container once in the measured run', () => {
+		const s = summarize(REAL_RUN);
+		expect(s.containersCreated).toBe(2);
+		expect(s.containersStarted).toBe(2);
+		expect(s.containersRecreated).toBe(0);
+	});
+
+	// REAL_RUN cannot prove deduplication: in the measured output every container line
+	// appears exactly once (only the *network* line repeats, and CONTAINER does not match
+	// network lines). Replacing the Set with a counter leaves the test above green. This
+	// case supplies the repetition explicitly -- it is the only one that fails when the
+	// Set is removed.
+	test('counts a container once even when compose repeats the same transition', () => {
+		const s = summarize([
+			' Container web-1 Created ',
+			' Container web-1 Created ',
+			' Container web-1 Started ',
+			' Container web-1 Started '
+		]);
+		expect(s.containersCreated).toBe(1);
+		expect(s.containersStarted).toBe(1);
+	});
+
+	test('separates images built from images pulled', () => {
+		const s = summarize(REAL_RUN);
+		expect(s.imagesBuilt).toEqual(['progprobe-built:1']);
+		expect(s.imagesPulled).toEqual(['alpine:3.21']);
+	});
+
+	test('reports how much of the build came from cache', () => {
+		const s = summarize(REAL_RUN);
+		expect(s.buildSteps).toBe(3);
+		expect(s.buildStepsCached).toBe(1);
+	});
+
+	test('picks up the image digest from the buildkit export line', () => {
+		expect(summarize(REAL_RUN).digest)
+			.toBe('sha256:3e3a42937811aaaabbbbccccddddeeeeffff0000111122223333444455556666');
+	});
+
+	test('counts recreated containers separately from merely started ones', () => {
+		const s = summarize([
+			' Container a Recreate ',
+			' Container a Recreated ',
+			' Container a Starting ',
+			' Container a Started '
+		]);
+		expect(s.containersRecreated).toBe(1);
+		expect(s.containersCreated).toBe(0);
+	});
+
+	test('an image that was already local produces no pull entry at all', () => {
+		// Measured: compose emits neither Pulling nor Pulled for an image that is present.
+		// Absence is the only signal, so the summary must not invent one.
+		expect(summarize([' Container a Started ']).imagesPulled).toEqual([]);
+	});
+});

tests/format-relative-time.test.ts

@@ -4,7 +4,7 @@
  *
  * Run with: bun test tests/unit/format-relative-time.test.ts
  */
-import { describe, test, expect } from 'bun:test';
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
 import { formatRelativeTime } from '../src/lib/utils/format';
 
 // Build a timestamp `n` seconds in the past relative to now, so the tests are
@@ -68,3 +68,57 @@ describe('formatRelativeTime — input forms & edges', () => {
 		expect(formatRelativeTime(undefined as unknown as string)).toBe('');
 	});
 });
+
+// #1183 follow-up (reported live: a deploy from ~2 minutes ago showed "2h ago"):
+// the server hands back a NAIVE timestamp (PG `timestamp without time zone`,
+// e.g. "2026-08-30 20:36:11.534" - space separator, no "Z"/offset). Every
+// caller of formatRelativeTime passes exactly that value, right alongside
+// formatDateTime() which already reads it as UTC via parseTimestamp() (see
+// date-format-tz.test.ts). formatRelativeTime used to parse it with a bare
+// `new Date(...)`, which treats a zone-less string as browser-local time -
+// correct only when the browser happens to run in UTC, which is exactly why
+// this stayed invisible in a UTC test browser.
+//
+// TZ is forced to a non-UTC zone for this block only, so the bug reproduces
+// regardless of the host/CI timezone. Restored in afterAll: bun runs every
+// test file in one process, so a dangling override would leak into whichever
+// file happens to run next.
+describe('formatRelativeTime — a naive server timestamp is read as UTC, not local time', () => {
+	const originalTZ = process.env.TZ;
+
+	beforeAll(() => {
+		process.env.TZ = 'America/New_York'; // UTC-4 in August - deliberately not UTC
+	});
+
+	afterAll(() => {
+		if (originalTZ === undefined) delete process.env.TZ;
+		else process.env.TZ = originalTZ;
+	});
+
+	// Same instant in two forms: a proper zoned ISO string, and the naive
+	// space-separated form Drizzle hands back for a `timestamp without time
+	// zone` column. Deriving the expectation from the zoned form (rather than
+	// hardcoding a bucket string) keeps the assertion meaningful independent
+	// of whichever zone the suite happens to run under.
+	const naiveFrom = (d: Date) => d.toISOString().replace('T', ' ').replace('Z', '');
+
+	test('a naive PG-style string reports the same age as its zoned equivalent (5m ago)', () => {
+		const instant = new Date(Date.now() - 5 * 60 * 1000);
+		expect(formatRelativeTime(naiveFrom(instant))).toBe(formatRelativeTime(instant.toISOString()));
+		expect(formatRelativeTime(naiveFrom(instant))).toBe('5m ago');
+	});
+
+	test('a two-minute-old naive deploy timestamp reads "2m ago" - the reported bug', () => {
+		// Under the bug, "20:36:11" gets read as 20:36:11 America/New_York and
+		// re-anchored 4h later in UTC than the true instant, so
+		// Date.now() - ms goes negative and this would report "in the future"
+		// instead of "2m ago".
+		const instant = new Date(Date.now() - 2 * 60 * 1000);
+		expect(formatRelativeTime(naiveFrom(instant))).toBe('2m ago');
+	});
+
+	test('a naive timestamp from several hours ago still reads the correct bucket', () => {
+		const instant = new Date(Date.now() - 3 * 60 * 60 * 1000);
+		expect(formatRelativeTime(naiveFrom(instant))).toBe('3h ago');
+	});
+});

tests/fs-guard-deploy-logs.test.ts

@@ -0,0 +1,35 @@
+// @ts-expect-error -- bun:test is a runtime built-in with no types installed
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
+import { isProtectedPath } from '../src/lib/server/fs-guard';
+
+// protectedPaths() reads process.env.DATA_DIR on every call, not at import time, so a plain
+// import is enough -- but the variable has to be set while these assertions run, and put back
+// afterwards. Bun runs every test file in ONE process: a stray DATA_DIR leaks into unrelated
+// suites, and selfhst-icons creates its cache directory under DATA_DIR, which fails when that
+// points somewhere this machine does not have.
+const previousDataDir = process.env.DATA_DIR;
+beforeAll(() => {
+	process.env.DATA_DIR = '/app/data';
+});
+afterAll(() => {
+	if (previousDataDir === undefined) delete process.env.DATA_DIR;
+	else process.env.DATA_DIR = previousDataDir;
+});
+
+describe('isProtectedPath', () => {
+	test('protects the deploy log directory', () => {
+		// Deploy logs can carry secrets. The file browser is open by design, so the
+		// directory has to be named here or the API's permission check is bypassable.
+		expect(isProtectedPath('/app/data/deploy-logs')).toBe(true);
+		expect(isProtectedPath('/app/data/deploy-logs/abc.log')).toBe(true);
+	});
+
+	test('still protects what it protected before', () => {
+		expect(isProtectedPath('/app/data/db')).toBe(true);
+		expect(isProtectedPath('/proc/1/environ')).toBe(true);
+	});
+
+	test('leaves the rest of the container browsable', () => {
+		expect(isProtectedPath('/app/data/stacks')).toBe(false);
+	});
+});

tests/fs-guard.test.ts

@@ -3,20 +3,26 @@ import { mkdtempSync, mkdirSync, symlinkSync, writeFileSync, rmSync } from 'node
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 
-// Pin DATA_DIR before the import below so the guard computes /app/data paths. This runs
-// at module load (Bun runs all test files in one process), so it must be RESTORED after
-// this file or it leaks /app/data into every later file - e.g. selfhst-icons then does
-// mkdirSync('/app/data/...') and fails EACCES on CI (#1535).
-const __prevDataDir = process.env.DATA_DIR;
-process.env.DATA_DIR = '/app/data';
+// Pin DATA_DIR via beforeAll/afterAll so the guard computes /app/data paths for this
+// file's tests, and put it back afterwards so the change doesn't leak into unrelated
+// suites. Bun runs every test file in one process: selfhst-icons reads DATA_DIR and
+// mkdirSync's a cache directory under it, which fails with EACCES on a machine that has
+// no /app.
+//
+// isProtectedPath() only reads process.env.DATA_DIR lazily, inside its own call -- not
+// at import time -- so beforeAll (which runs before any test body, hence before any
+// isProtectedPath() call) is sufficient on its own; no separate assignment before the
+// import below is needed. Measured, not assumed: this file passes standalone, paired
+// with selfhst-icons.test.ts in both file orders, and as part of the full suite.
+const previousDataDir = process.env.DATA_DIR;
+beforeAll(() => { process.env.DATA_DIR = '/app/data'; });
+afterAll(() => {
+	if (previousDataDir === undefined) delete process.env.DATA_DIR;
+	else process.env.DATA_DIR = previousDataDir;
+});
 
 const { isProtectedPath } = await import('../src/lib/server/fs-guard');
 
-afterAll(() => {
-	if (__prevDataDir === undefined) delete process.env.DATA_DIR;
-	else process.env.DATA_DIR = __prevDataDir;
-});
-
 describe('isProtectedPath (file-browser secret guard, H1)', () => {
 	test('blocks the database directory and its contents', () => {
 		expect(isProtectedPath('/app/data/db')).toBe(true);

tests/git-stack-deploy-run-record.test.ts

@@ -0,0 +1,529 @@
+/**
+ * Wires the stack_deploy run recorder into `deployGitStack()` (git.ts) itself, not
+ * into any single HTTP route. deployGitStack is the function every git-stack deploy
+ * trigger EXCEPT ONE funnels through -- a config-update-then-redeploy, both webhook
+ * methods, create-and-deploy, and (via runGitStackSync) the cron scheduler and the
+ * schedules page's "run now". Wiring the recorder at a single route (the way
+ * compose/+server.ts does it for non-git stacks) would leave every OTHER caller
+ * unrecorded -- crucially the cron- and webhook-triggered ones, the truly unattended
+ * runs the design doc's Meilenstein 5 is about.
+ *
+ * The one exception is the UI's own "Deploy" button, which streams live progress via
+ * deployGitStackWithProgress() -- a SEPARATE clone/read/deploy pipeline (it does not
+ * call deployGitStack at all) that therefore needed, and was missing, its OWN copy of
+ * this same recorder wiring. Reported by a reviewer and confirmed by reading both
+ * functions side by side: deployGitStack's recorder wiring never touches it. See the
+ * second describe block below for its coverage, and the Gegenprobe block at the
+ * bottom for why the guard there now expects TWO createRunRecorder call sites, not
+ * one.
+ *
+ * `syncGitStack()` (also in git.ts) is a private collaborator of deployGitStack,
+ * called as a plain in-module function reference, not through an imported
+ * specifier -- so unlike the non-git deploy routes' $lib/server/stacks dependency,
+ * it CANNOT be faked via mock.module(). This suite therefore drives a REAL git
+ * sync against a throwaway local repository served over `git://` by a real `git
+ * daemon` subprocess (loopback only, ephemeral port) -- a bare filesystem path or
+ * `file://` URL is deliberately rejected by git-url-safety.ts (SSRF guard) and
+ * this test does not, and should not, work around that. Only the boundary below
+ * deployGitStack -- $lib/server/stacks' deployStack() -- is faked, exactly the
+ * boundary the compose-PUT/dedicated-deploy-route tests already fake for the
+ * same reason (no real `docker compose` in a unit test).
+ *
+ * $lib/server/db and $lib/server/stacks are faked via the shared helpers -- see
+ * their doc comments for why a second direct mock.module() call for either would
+ * collide with other files that already own those specifiers for this process.
+ */
+import { describe, test, expect, beforeAll, afterAll, beforeEach, mock } from 'bun:test';
+import { mkdtemp, rm, writeFile, mkdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawn, spawnSync, type ChildProcess } from 'node:child_process';
+import { registerDbFake } from './helpers/db-fake';
+import { registerStacksFake } from './helpers/stacks-fake';
+
+// notifyGitSync (git.ts) wraps sendEventNotification in its own try/catch and never
+// lets it affect the deploy outcome, so a no-op stub is all this suite needs -- and
+// all it should assert on; which notification fired for which trigger belongs to a
+// test of notifyGitSync itself, not this one. No other file in the suite mocks this
+// specifier (as of this writing), so a single direct mock.module() call here is safe
+// -- see tests/helpers/stacks-fake.ts's doc comment for why db/stacks can't do the same.
+mock.module('$lib/server/notifications', () => ({
+	sendEventNotification: async () => {}
+}));
+
+// -- $lib/server/db: an in-memory schedule_executions fake, plus the git-stack -----
+// -- lookups deployGitStack/syncGitStack need. Same shape as
+// tests/stack-compose-redeploy-run-record.test.ts's fake for the schedule_executions
+// half; the git-specific reads/writes below are new to this file.
+
+let created: Array<Record<string, unknown>>;
+let updates: Array<Record<string, unknown>>;
+let nextId: number;
+let gitStackUpdates: Array<Record<string, unknown>>;
+let upsertedSources: Array<Record<string, unknown>>;
+
+function resetDbState() {
+	created = [];
+	updates = [];
+	nextId = 1;
+	gitStackUpdates = [];
+	upsertedSources = [];
+}
+resetDbState();
+
+registerDbFake('createScheduleExecution', async (data: Record<string, unknown>) => {
+	const row = {
+		id: nextId++,
+		...data,
+		triggeredAt: new Date().toISOString(),
+		startedAt: null,
+		completedAt: null,
+		duration: null,
+		errorMessage: null,
+		details: data.details ?? null,
+		logs: null,
+		createdAt: null
+	};
+	created.push(row);
+	return row;
+});
+registerDbFake('updateScheduleExecution', async (id: number, data: Record<string, unknown>) => {
+	updates.push({ id, ...data });
+	return { id, ...data };
+});
+
+/** The update() call that CLOSED the row (status !== 'running'), i.e. the one written
+ *  by DeployRunRecorder.end() -- same helper shape as the compose-redeploy suite's
+ *  endUpdate(). Only ever at most one per test: every case here deploys exactly once. */
+function endUpdate() {
+	return updates.find((u) => u.status !== undefined);
+}
+
+/** All stack_deploy rows created for THIS suite's stack, as opposed to the
+ *  git_stack_sync bookkeeping row a caller like git-stack-sync.ts creates separately
+ *  (a different scheduleType, not exercised by this file -- this suite calls
+ *  deployGitStack directly, the layer below that bookkeeping). */
+function stackDeployRows() {
+	return created.filter((r) => r.scheduleType === 'stack_deploy');
+}
+
+let nonSecretVars: Record<string, string>;
+let secretVars: Record<string, string>;
+
+registerDbFake('getSecretEnvVarsAsRecord', async () => secretVars);
+registerDbFake('getNonSecretEnvVarsAsRecord', async () => nonSecretVars);
+registerDbFake('updateGitStack', async (id: number, data: Record<string, unknown>) => {
+	gitStackUpdates.push({ id, ...data });
+	return null;
+});
+registerDbFake('upsertStackSource', async (data: Record<string, unknown>) => {
+	upsertedSources.push(data);
+});
+
+// -- $lib/server/stacks: only deployStack (and getStackDir, used for the post-
+// -- success stack_sources bookkeeping) are faked -- everything ABOVE that
+// -- boundary (deployGitStack, syncGitStack) runs for real.
+
+let deployStackCalls: Array<{ onLine?: (line: string) => void }>;
+let deployStackResult: { success: boolean; output?: string; error?: string; resolvedSecrets?: string[] };
+let deployStackOnLines: string[];
+
+function resetStacksState() {
+	deployStackCalls = [];
+	deployStackResult = { success: true, output: 'deployed' };
+	deployStackOnLines = ['Container demo-stack-app-1  Started'];
+}
+resetStacksState();
+
+registerStacksFake('deployStack', async (options: { onLine?: (line: string) => void }) => {
+	deployStackCalls.push(options);
+	for (const line of deployStackOnLines) options.onLine?.(line);
+	return deployStackResult;
+});
+registerStacksFake('getStackDir', async (stackName: string) => join('/tmp/stub-stacks', stackName));
+
+// -- A real local git remote, served over git:// by a real `git daemon` -----------
+//
+// DATA_DIR is process-global and read at IMPORT time by git.ts (GIT_REPOS_DIR) and
+// at call time by deploy-log-store.ts -- same precaution tests/deploy-endpoints.test.ts
+// and the compose-redeploy suite already document for this shared env var.
+
+const previousDataDir = process.env.DATA_DIR;
+let workDir: string;
+let daemon: ChildProcess;
+let daemonPort: number;
+const STACK = 'demo-git-stack';
+
+function run(cmd: string, args: string[], cwd: string): void {
+	const result = spawnSync(cmd, args, { cwd, encoding: 'utf8' });
+	if (result.status !== 0) {
+		throw new Error(`${cmd} ${args.join(' ')} failed: ${result.stderr}`);
+	}
+}
+
+/** Waits for the daemon to actually accept connections (spawn is async) by polling
+ *  a real `git ls-remote` against it, rather than a fixed sleep. */
+async function waitForDaemon(port: number, deadlineMs: number): Promise<void> {
+	const start = Date.now();
+	let lastError: string | undefined;
+	while (Date.now() - start < deadlineMs) {
+		const probe = spawnSync('git', ['ls-remote', `git://127.0.0.1:${port}/remote.git`], {
+			encoding: 'utf8',
+			timeout: 2000
+		});
+		if (probe.status === 0) return;
+		lastError = probe.stderr;
+		await new Promise((r) => setTimeout(r, 100));
+	}
+	throw new Error(`git daemon on port ${port} never became ready: ${lastError}`);
+}
+
+beforeAll(async () => {
+	workDir = await mkdtemp(join(tmpdir(), 'dv-git-deploy-run-record-'));
+	process.env.DATA_DIR = workDir;
+
+	// Seed the bare "remote" repo with one commit on main, containing a compose file
+	// at the repo-relative path the fixture GitStackWithRepo below points at.
+	const bareDir = join(workDir, 'remote.git');
+	const scratchDir = join(workDir, 'scratch');
+	await mkdir(bareDir, { recursive: true });
+	run('git', ['init', '--bare', '-b', 'main', bareDir], workDir);
+	run('git', ['clone', bareDir, scratchDir], workDir);
+	run('git', ['config', 'user.email', '[email protected]'], scratchDir);
+	run('git', ['config', 'user.name', 'Test'], scratchDir);
+	await writeFile(join(scratchDir, 'compose.yaml'), 'services:\n  app:\n    image: demo:1\n');
+	run('git', ['add', 'compose.yaml'], scratchDir);
+	run('git', ['commit', '-m', 'initial'], scratchDir);
+	run('git', ['push', 'origin', 'main'], scratchDir);
+
+	daemonPort = 20000 + Math.floor(Math.random() * 20000);
+	daemon = spawn(
+		'git',
+		[
+			'daemon',
+			'--reuseaddr',
+			'--export-all',
+			`--base-path=${workDir}`,
+			`--port=${daemonPort}`,
+			'--listen=127.0.0.1'
+		],
+		{ stdio: 'ignore' }
+	);
+	await waitForDaemon(daemonPort, 5000);
+}, 15000);
+
+afterAll(async () => {
+	daemon?.kill();
+	await rm(workDir, { recursive: true, force: true });
+	if (previousDataDir === undefined) {
+		delete process.env.DATA_DIR;
+	} else {
+		process.env.DATA_DIR = previousDataDir;
+	}
+});
+
+// -- Route/function under test, imported AFTER DATA_DIR is set and all fakes are ---
+// -- registered (git.ts reads DATA_DIR at module-load time for GIT_REPOS_DIR).
+
+const { deployGitStack, deployGitStackWithProgress } = await import('../src/lib/server/git');
+const { readRunLog, deleteRunLog } = await import('../src/lib/server/deploy-log-store');
+const { hashComposeContent } = await import('../src/lib/server/deploy-run-record-core');
+
+let gitStackId: number;
+
+function repoUrl(): string {
+	return `git://127.0.0.1:${daemonPort}/remote.git`;
+}
+
+function makeGitStack(overrides: Partial<Record<string, unknown>> = {}) {
+	return {
+		id: gitStackId,
+		stackName: STACK,
+		environmentId: null,
+		repositoryId: 1,
+		composePath: 'compose.yaml',
+		branch: null,
+		envFilePath: null,
+		autoUpdate: false,
+		autoUpdateSchedule: 'daily' as const,
+		autoUpdateCron: '',
+		webhookEnabled: false,
+		webhookSecret: null,
+		contextDir: null,
+		buildOnDeploy: false,
+		noBuildCache: false,
+		repullImages: false,
+		forceRedeploy: false,
+		lastSync: null,
+		lastCommit: null,
+		syncStatus: 'idle',
+		syncError: null,
+		syncedFiles: null,
+		createdAt: new Date().toISOString(),
+		updatedAt: new Date().toISOString(),
+		repository: {
+			id: 1,
+			name: 'test-repo',
+			url: repoUrl(),
+			branch: 'main',
+			credentialId: null
+		},
+		...overrides
+	};
+}
+
+let nextGitStackId = 1;
+
+beforeEach(async () => {
+	resetDbState();
+	resetStacksState();
+	// A fresh, never-before-used stack id per test -- getStackRepoPath() derives the
+	// on-disk clone path from it (stack-<id>, since environmentId is null), so this
+	// also gives every test its own clone directory. Without this, a later test could
+	// inherit an earlier test's already-cloned repo at the SAME commit and silently
+	// take the "no changes" skip path instead of the deploy path it meant to test.
+	gitStackId = nextGitStackId++;
+	nonSecretVars = { PUBLIC_VAR: 'v1' };
+	secretVars = { DB_PASSWORD: 's3cr3t-value' };
+
+	registerDbFake('getGitStack', async () => makeGitStack());
+	registerDbFake('getGitRepository', async () => makeGitStack().repository);
+
+	// nextId always restarts at 1 above, so every test's (at most one) row reuses
+	// runId '1' -- clear its log file so tests don't leak content into each other via
+	// the shared DATA_DIR (same precaution the compose-redeploy suite documents).
+	await deleteRunLog(null, '1');
+});
+
+describe('deployGitStack -- stack_deploy run record (git-triggered deploys)', () => {
+	test('a manual-triggered deploy creates exactly one stack_deploy row, closed as success, with a readable log', async () => {
+		const result = await deployGitStack(gitStackId, { triggeredBy: 'manual', force: true });
+
+		expect(result.success).toBe(true);
+		expect(deployStackCalls).toHaveLength(1); // the sync->deploy path really ran
+
+		const rows = stackDeployRows();
+		expect(rows).toHaveLength(1);
+		expect(rows[0].entityName).toBe(STACK);
+		expect(rows[0].triggeredBy).toBe('manual');
+		expect(rows[0].scheduleId).toBe(0);
+
+		const update = endUpdate();
+		expect(update?.status).toBe('success');
+		expect(update?.errorMessage).toBeNull();
+
+		const runId = String(rows[0].id);
+		const log = await readRunLog(null, runId);
+		expect(log).toContain('Container demo-stack-app-1  Started');
+	});
+
+	test('composeHash matches the content actually synced from the git repository', async () => {
+		await deployGitStack(gitStackId, { triggeredBy: 'manual', force: true });
+
+		const update = endUpdate();
+		const details = update?.details as { composeHash: string };
+		expect(details.composeHash).toBe(hashComposeContent('services:\n  app:\n    image: demo:1\n'));
+	});
+
+	test('a cron-triggered deploy (the unattended case this wiring exists for) is recorded with triggeredBy=cron', async () => {
+		await deployGitStack(gitStackId, { triggeredBy: 'cron', force: false });
+
+		const rows = stackDeployRows();
+		expect(rows).toHaveLength(1);
+		expect(rows[0].triggeredBy).toBe('cron');
+	});
+
+	test('a webhook-triggered deploy is recorded with triggeredBy=webhook and no userId', async () => {
+		await deployGitStack(gitStackId, { triggeredBy: 'webhook', force: false });
+
+		const rows = stackDeployRows();
+		expect(rows).toHaveLength(1);
+		expect(rows[0].triggeredBy).toBe('webhook');
+		const update = endUpdate();
+		const details = update?.details as { userId?: number };
+		expect(details.userId).toBeUndefined();
+	});
+
+	test('a secret value in the deploy error text is redacted before it is stored', async () => {
+		deployStackResult = { success: false, error: 'compose up failed: DB_PASSWORD=s3cr3t-value rejected' };
+		deployStackOnLines = [];
+
+		const result = await deployGitStack(gitStackId, { triggeredBy: 'manual', force: true });
+
+		expect(result.success).toBe(false);
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		expect(String(update?.errorMessage)).not.toContain('s3cr3t-value');
+	});
+
+	// F4 fix: deployStack() resolves a bound secret provider's values INTERNALLY,
+	// after deployGitStack()'s `recorder` above was already built from the DB-only
+	// nonSecretVars/secretVars this suite's fixture returns. A provider-resolved
+	// secret (never in that DB-only set) is simulated via the fake's
+	// resolvedSecrets -- exactly StackOperationResult's real shape -- and must still
+	// be redacted from the stored error, via recorder.addSecrets(). This is the
+	// unattended (cron/webhook) path deployGitStack's own doc comment calls out --
+	// exactly where a bound secret provider is most likely to be in play unattended.
+	test('F4 regression: a provider-resolved secret (unknown at recorder construction) is redacted before it is stored', async () => {
+		const PROVIDER_SECRET = 'zzz-bulk-provider-9000';
+		deployStackResult = {
+			success: false,
+			error: `compose up failed: PROVIDER_TOKEN=${PROVIDER_SECRET} rejected`,
+			resolvedSecrets: [PROVIDER_SECRET]
+		};
+		deployStackOnLines = [];
+
+		const result = await deployGitStack(gitStackId, { triggeredBy: 'cron', force: true });
+
+		expect(result.success).toBe(false);
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		expect(String(update?.errorMessage)).not.toContain(PROVIDER_SECRET);
+	});
+
+	test('a second, unchanged sync (force=false, nothing to deploy) creates NO additional stack_deploy row', async () => {
+		// First call: the clone directory for this test's stack id does not exist yet,
+		// so getPreviousCommit() (git.ts) returns null -> commitChanged is always true
+		// on a first sync -> updated=true -> shouldDeploy=true even with force:false.
+		// This deploys for real and records exactly one row, same as the tests above.
+		const first = await deployGitStack(gitStackId, { triggeredBy: 'cron', force: false });
+		expect(first.success).toBe(true);
+		expect(first.skipped).toBeUndefined();
+		expect(stackDeployRows()).toHaveLength(1);
+
+		// Second call, same stack id, remote repository untouched in between:
+		// syncGitStack reads the ACTUAL previous commit off the clone directory the
+		// first call just left on disk (real git, not a fake), re-clones, and finds
+		// the same commit -> commitChanged=false -> updated=false -> with force:false
+		// and this fixture's forceRedeploy:false, shouldDeploy is false -> skip. The
+		// recorder-creation block in git.ts sits AFTER that `if (!shouldDeploy) return`
+		// branch, so a skip must create no new row at all.
+		const second = await deployGitStack(gitStackId, { triggeredBy: 'cron', force: false });
+		expect(second.success).toBe(true);
+		expect(second.skipped).toBe(true);
+		expect(deployStackCalls).toHaveLength(1); // still just the first call's deploy
+		expect(stackDeployRows()).toHaveLength(1); // no row added for the skipped second call
+	});
+});
+
+describe("deployGitStackWithProgress -- stack_deploy run record (the UI 'Deploy' button)", () => {
+	// deployGitStackWithProgress runs its OWN clone/read/deploy pipeline (it does not
+	// call deployGitStack), reporting 5 discrete stages via onProgress rather than
+	// deployGitStack's onLine -- see its doc comment in git.ts. It was, until this
+	// fix, the one caller of deployStack() that never went through createRunRecorder
+	// at all: every test below is red without the fix (verified by reverting it and
+	// re-running this file), because no stack_deploy row is created in the first
+	// place.
+
+	test('a manual UI deploy creates exactly one stack_deploy row, closed as success, with a readable log', async () => {
+		const progressEvents: Array<{ status: string; message?: string }> = [];
+		const result = await deployGitStackWithProgress(gitStackId, (data) => progressEvents.push(data));
+
+		expect(result.success).toBe(true);
+		expect(deployStackCalls).toHaveLength(1); // the clone->deploy path really ran
+
+		const rows = stackDeployRows();
+		expect(rows).toHaveLength(1);
+		expect(rows[0].entityName).toBe(STACK);
+		expect(rows[0].triggeredBy).toBe('manual');
+		expect(rows[0].scheduleId).toBe(0);
+
+		const update = endUpdate();
+		expect(update?.status).toBe('success');
+		expect(update?.errorMessage).toBeNull();
+
+		const runId = String(rows[0].id);
+		const log = await readRunLog(null, runId);
+		expect(log).toContain('Container demo-stack-app-1  Started');
+
+		// onLine mirrors deploy output into the run record's log file WITHOUT being
+		// forwarded to onProgress -- that callback's own contract is the 5 discrete
+		// stage messages this function sends itself, not raw compose output lines.
+		expect(progressEvents.some((e) => e.message?.includes('Container demo-stack-app-1'))).toBe(false);
+		expect(progressEvents.some((e) => e.status === 'complete')).toBe(true);
+	});
+
+	test('composeHash matches the content actually read from the cloned repository', async () => {
+		await deployGitStackWithProgress(gitStackId, () => {});
+
+		const update = endUpdate();
+		const details = update?.details as { composeHash: string };
+		expect(details.composeHash).toBe(hashComposeContent('services:\n  app:\n    image: demo:1\n'));
+	});
+
+	test('a secret value in the deploy error text is redacted before it is stored', async () => {
+		deployStackResult = { success: false, error: 'compose up failed: DB_PASSWORD=s3cr3t-value rejected' };
+		deployStackOnLines = [];
+
+		const result = await deployGitStackWithProgress(gitStackId, () => {});
+
+		expect(result.success).toBe(false);
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		expect(String(update?.errorMessage)).not.toContain('s3cr3t-value');
+	});
+
+	// F4 fix, same rationale as deployGitStack's own regression test above: a
+	// provider-resolved secret is only known AFTER deployStack() returns, so it must
+	// be fed into the recorder via addSecrets() before end() closes the row, or it
+	// bypasses redaction entirely.
+	test('F4 regression: a provider-resolved secret (unknown at recorder construction) is redacted before it is stored', async () => {
+		const PROVIDER_SECRET = 'zzz-bulk-provider-9000';
+		deployStackResult = {
+			success: false,
+			error: `compose up failed: PROVIDER_TOKEN=${PROVIDER_SECRET} rejected`,
+			resolvedSecrets: [PROVIDER_SECRET]
+		};
+		deployStackOnLines = [];
+
+		const result = await deployGitStackWithProgress(gitStackId, () => {});
+
+		expect(result.success).toBe(false);
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		expect(String(update?.errorMessage)).not.toContain(PROVIDER_SECRET);
+	});
+});
+
+describe('deployGitStack / deployGitStackWithProgress -- Gegenprobe: removing either recorder wiring turns its own describe block above red', () => {
+	async function readGitTsSource(): Promise<string> {
+		const { readFile } = await import('node:fs/promises');
+		const { dirname } = await import('node:path');
+		const { fileURLToPath } = await import('node:url');
+		const here = dirname(fileURLToPath(import.meta.url));
+		return readFile(join(here, '..', 'src', 'lib', 'server', 'git.ts'), 'utf8');
+	}
+
+	/**
+	 * Isolates one exported function's own body: from its exact `export async
+	 * function NAME(` signature up to (not including) the next top-level `export `.
+	 * Good enough for these two specific, non-nested, sequentially-declared
+	 * functions in this one file -- NOT a general-purpose brace matcher, and this
+	 * guard cannot tell WHICH call site broke if the slicing itself were ever wrong.
+	 * The behavioral tests in both describe blocks above are what actually prove
+	 * each function records a run; this is a second, cheap line of defense on top
+	 * of them, not a replacement for them.
+	 */
+	function functionBody(source: string, name: string): string {
+		const signature = `export async function ${name}(`;
+		const start = source.indexOf(signature);
+		if (start === -1) throw new Error(`function ${name} not found in git.ts`);
+		const nextExport = source.indexOf('\nexport ', start + signature.length);
+		return nextExport === -1 ? source.slice(start) : source.slice(start, nextExport);
+	}
+
+	test('deployGitStack calls createRunRecorder', async () => {
+		const body = functionBody(await readGitTsSource(), 'deployGitStack');
+		expect(body.match(/createRunRecorder\(/g) ?? []).toHaveLength(1);
+	});
+
+	test('deployGitStackWithProgress ALSO calls createRunRecorder -- this is the exact gap Finding 2 closes', async () => {
+		const body = functionBody(await readGitTsSource(), 'deployGitStackWithProgress');
+		expect(body.match(/createRunRecorder\(/g) ?? []).toHaveLength(1);
+	});
+
+	test('exactly two createRunRecorder call sites in the whole file, one per function', async () => {
+		const matches = (await readGitTsSource()).match(/createRunRecorder\(/g) ?? [];
+		expect(matches).toHaveLength(2);
+	});
+});

tests/hawser-line-routing.test.ts

@@ -0,0 +1,54 @@
+/**
+ * Unit tests for dispatchStreamMessage — the PURE 'stream' message routing logic, extracted
+ * from hawser.ts's handleHawserWsMessage into hawser-core.ts. No DB import, so it is
+ * unit-testable directly (importing hawser.ts pulls in db/drizzle -> better-sqlite3, which
+ * bun's test runner can't load — see nav-preferences-core.test.ts for the same pattern).
+ * hawser.ts re-exports dispatchStreamMessage so callers get it from one import site.
+ *
+ * Compose requests are sent with streaming: false and land in connection.pendingRequests
+ * only. The message dispatcher's 'stream' case used to look up pendingStreamRequests
+ * exclusively, so any line message for a non-streaming request vanished silently -- no error,
+ * no warning. dispatchStreamMessage is the fix: it also checks a second, independent registry
+ * (lineHandlers) for a matching callback.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { dispatchStreamMessage, type StreamDispatchTarget } from '../src/lib/server/hawser-core.js';
+
+describe('dispatchStreamMessage', () => {
+	test('decodes a line message and passes it to the callback', () => {
+		const seen: string[] = [];
+		const conn: StreamDispatchTarget = { pendingStreamRequests: new Map(), lineHandlers: new Map() };
+		conn.lineHandlers!.set('req-1', (l: string) => seen.push(l));
+
+		// This is how it really arrives: Go encodes []byte as base64.
+		dispatchStreamMessage(conn, { requestId: 'req-1', data: Buffer.from('first line').toString('base64') });
+
+		expect(seen).toEqual(['first line']);
+	});
+
+	test('silently drops line messages with no registered callback', () => {
+		const conn: StreamDispatchTarget = { pendingStreamRequests: new Map(), lineHandlers: new Map() };
+		expect(() => dispatchStreamMessage(conn, { requestId: 'unknown', data: 'eA==' })).not.toThrow();
+	});
+
+	test('prefers pendingStreamRequests over lineHandlers for the same requestId', () => {
+		const streamSeen: unknown[] = [];
+		const lineSeen: string[] = [];
+		const conn: StreamDispatchTarget = { pendingStreamRequests: new Map(), lineHandlers: new Map() };
+		conn.pendingStreamRequests!.set('req-2', { onData: (d: unknown) => streamSeen.push(d) });
+		conn.lineHandlers!.set('req-2', (l: string) => lineSeen.push(l));
+
+		dispatchStreamMessage(conn, { requestId: 'req-2', data: 'raw-not-decoded' });
+
+		expect(streamSeen).toEqual(['raw-not-decoded']);
+		expect(lineSeen).toEqual([]);
+	});
+
+	test('tolerates a missing lineHandlers map (defensive, matches pendingStreamRequests handling)', () => {
+		const conn: StreamDispatchTarget = { pendingStreamRequests: new Map() };
+		expect(() =>
+			dispatchStreamMessage(conn, { requestId: 'req-3', data: Buffer.from('x').toString('base64') })
+		).not.toThrow();
+	});
+});

tests/helpers/authorize-fake.ts

@@ -0,0 +1,42 @@
+import { mock } from 'bun:test';
+
+/**
+ * Shared registration point for faking `$lib/server/authorize`.
+ *
+ * Same collision problem tests/helpers/db-fake.ts documents for $lib/server/db:
+ * mock.module() replaces a module's exports WHOLESALE for the entire test process,
+ * and Bun freezes the exported shape the first time ANY file resolves the specifier
+ * -- so a second, independent `mock.module('$lib/server/authorize', ...)` call
+ * elsewhere in the suite would silently clobber (or be clobbered by) this one,
+ * depending on which file's import happens to run first.
+ *
+ * `authorize` is the module's only export, so a single dispatcher is enough: it
+ * looks up `impl` AT CALL TIME (not at import time), so registerAuthorizeFake()
+ * works no matter which test file calls it, or when, exactly like db-fake.ts's
+ * per-name dispatchers.
+ *
+ * Do NOT add a separate mock.module('$lib/server/authorize', ...) or
+ * mock.module('.../authorize', ...) call anywhere else in the suite -- that
+ * reintroduces the collision this file exists to avoid.
+ */
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type AnyFn = (...args: any[]) => any;
+
+let impl: AnyFn | undefined;
+
+export function registerAuthorizeFake(fn: AnyFn): void {
+	impl = fn;
+}
+
+mock.module('$lib/server/authorize', () => ({
+	authorize: (...args: unknown[]) => {
+		if (!impl) {
+			throw new Error(
+				'authorize-fake: authorize() was called but no test file has registered an implementation yet ' +
+					'(registerAuthorizeFake(fn) must run before the test that calls it)'
+			);
+		}
+		return impl(...args);
+	}
+}));

tests/helpers/db-fake.ts

@@ -0,0 +1,96 @@
+import { mock } from 'bun:test';
+
+/**
+ * Shared registration point for faking `$lib/server/db`.
+ *
+ * $lib/server/db can't be imported for real under Bun (it transitively loads
+ * better-sqlite3, which throws ERR_DLOPEN_FAILED), so every test file that
+ * exercises a route/module built on top of it has to fake the whole thing.
+ *
+ * Two Bun behaviours make a naive shared registry fail, both confirmed
+ * empirically (undocumented):
+ *
+ * 1. mock.module() replaces a module's exports WHOLESALE for the ENTIRE test
+ *    process -- no per-file scoping without `bun test --isolate` (not used
+ *    by this suite). Two files independently calling
+ *    `mock.module('$lib/server/db', () => ({ onlyWhatIMeed }))` clobber each
+ *    other completely -- whichever registers "later" wins for BOTH files.
+ *
+ * 2. Bun does not evaluate every test file's top-level code before running
+ *    any test body. It runs files one at a time. The FIRST time ANY code,
+ *    from ANY file, resolves the `$lib/server/db` specifier (`import(...)`
+ *    or a static import chain reaching it), Bun freezes the resulting module
+ *    namespace object for the specifier -- confirmed by trying (a) a Proxy
+ *    that reads a shared, still-mutable bag live, and (b) re-calling
+ *    mock.module() with a fresh object literal right before each file's own
+ *    import: neither picks up a key added by a file that runs AFTER the
+ *    first-ever resolution. Once resolved, a specifier's export set is fixed
+ *    for the rest of the process, no matter how many more times
+ *    mock.module() is called for it afterwards.
+ *
+ * The fix that DOES work: pre-declare every export name any test file will
+ * ever need, ONCE, right here, each as a thin dispatcher function that looks
+ * up its real implementation in `impls` AT CALL TIME (not at import time).
+ * These dispatcher functions themselves are stable references, present in
+ * the very first module snapshot regardless of which file resolves the
+ * specifier first. `registerDbFake(name, fn)` only ever changes what a
+ * dispatcher DELEGATES to -- it never needs to add a new key to the frozen
+ * snapshot, so it works no matter which file calls it, or when.
+ *
+ * Adding a new $lib/server/db export a test needs? Add its name to
+ * KNOWN_EXPORTS below, then call `registerDbFake('yourExportName', fn)` from
+ * your test file. Do NOT add a separate `mock.module('$lib/server/db', ...)`
+ * or `mock.module('.../db', ...)` call anywhere else in the suite -- that
+ * reintroduces the collision this file exists to avoid.
+ */
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type AnyFn = (...args: any[]) => any;
+
+/** Every $lib/server/db export any test file fakes, across the whole suite. */
+const KNOWN_EXPORTS = [
+	'getBackupConfig',
+	'getScheduleExecution',
+	'deleteScheduleExecution',
+	'getScheduleExecutions',
+	'getDeployLogReconcileEnabled',
+	'getScheduleExecutionIdsByType',
+	'createScheduleExecution',
+	'updateScheduleExecution',
+	'appendScheduleExecutionLog',
+	'getGitStack',
+	'getGitRepository',
+	'getGitCredential',
+	'updateGitRepository',
+	'updateGitStack',
+	'upsertStackSource',
+	'getEnvironment',
+	'getSecretEnvVarsAsRecord',
+	'getNonSecretEnvVarsAsRecord'
+] as const;
+
+const impls: Record<string, AnyFn> = {};
+
+export function registerDbFake(name: (typeof KNOWN_EXPORTS)[number], fn: AnyFn): void {
+	impls[name] = fn;
+}
+
+function dispatcher(name: string): AnyFn {
+	return (...args: unknown[]) => {
+		const impl = impls[name];
+		if (!impl) {
+			throw new Error(
+				`db-fake: '${name}' was called but no test file has registered an implementation for it yet ` +
+					`(registerDbFake('${name}', ...) must run before the test that calls it)`
+			);
+		}
+		return impl(...args);
+	};
+}
+
+const moduleShape: Record<string, AnyFn> = {};
+for (const name of KNOWN_EXPORTS) {
+	moduleShape[name] = dispatcher(name);
+}
+
+mock.module('$lib/server/db', () => moduleShape);

tests/helpers/stacks-fake.ts

@@ -0,0 +1,57 @@
+import { mock } from 'bun:test';
+
+/**
+ * Shared registration point for faking `$lib/server/stacks`.
+ *
+ * Mirrors tests/helpers/db-fake.ts exactly, for the same two reasons documented
+ * there: mock.module() replaces a module's exports WHOLESALE for the entire test
+ * process, and once ANY file resolves the '$lib/server/stacks' specifier its export
+ * set is frozen for the rest of the run. A second direct `mock.module('$lib/server/
+ * stacks', ...)` call anywhere in the suite collides with whichever one resolved
+ * first -- exactly the situation this file exists to avoid (see
+ * tests/stack-compose-redeploy-run-record.test.ts's doc comment, which predicted this
+ * exact need before a second file existed).
+ *
+ * Adding a new $lib/server/stacks export a test needs? Add its name to
+ * KNOWN_EXPORTS below, then call `registerStacksFake('yourExportName', fn)` from your
+ * test file. Do NOT add a separate mock.module('$lib/server/stacks', ...) call
+ * anywhere else in the suite.
+ */
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type AnyFn = (...args: any[]) => any;
+
+/** Every $lib/server/stacks export any test file fakes, across the whole suite. */
+const KNOWN_EXPORTS = [
+	'getStackComposeFile',
+	'saveStackComposeFile',
+	'requireComposeFile',
+	'deployStack',
+	'getStackDir'
+] as const;
+
+const impls: Record<string, AnyFn> = {};
+
+export function registerStacksFake(name: (typeof KNOWN_EXPORTS)[number], fn: AnyFn): void {
+	impls[name] = fn;
+}
+
+function dispatcher(name: string): AnyFn {
+	return (...args: unknown[]) => {
+		const impl = impls[name];
+		if (!impl) {
+			throw new Error(
+				`stacks-fake: '${name}' was called but no test file has registered an implementation for it yet ` +
+					`(registerStacksFake('${name}', ...) must run before the test that calls it)`
+			);
+		}
+		return impl(...args);
+	};
+}
+
+const moduleShape: Record<string, AnyFn> = {};
+for (const name of KNOWN_EXPORTS) {
+	moduleShape[name] = dispatcher(name);
+}
+
+mock.module('$lib/server/stacks', () => moduleShape);

tests/log-viewer-props.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test } from 'bun:test';
+import { downloadFileName, stripAnsi } from '../src/lib/utils/log-download-name';
+
+describe('downloadFileName', () => {
+	test('uses the title when one is given', () => {
+		expect(downloadFileName('web-1')).toBe('web-1-logs.txt');
+	});
+
+	test('falls back to a neutral name when no title is given', () => {
+		expect(downloadFileName(undefined)).toBe('logs.txt');
+	});
+
+	test('strips path separators so a title can never escape the download name', () => {
+		expect(downloadFileName('../../etc/passwd')).toBe('etcpasswd-logs.txt');
+		expect(downloadFileName('..\\..\\windows\\system32')).toBe('windowssystem32-logs.txt');
+	});
+
+	// One case per transformation -- otherwise removing .trim() leaves every test green.
+	test('trims surrounding whitespace', () => {
+		expect(downloadFileName('  web-1  ')).toBe('web-1-logs.txt');
+	});
+});
+
+describe('stripAnsi', () => {
+	test('removes ANSI escape sequences', () => {
+		expect(stripAnsi('\u001b[32mok\u001b[0m')).toBe('ok');
+	});
+
+	// docker compose hides and shows the cursor on every progress redraw. '?' is a CSI
+	// parameter byte, so a digits-and-semicolons pattern leaves these behind -- in exactly
+	// the output this viewer is built to show.
+	test('removes private-mode sequences, which is what compose emits', () => {
+		expect(stripAnsi('\u001b[?25lbuilding\u001b[?25h')).toBe('building');
+		expect(stripAnsi('\u001b[?2004hx')).toBe('x');
+	});
+
+	test('leaves text without escape sequences untouched', () => {
+		expect(stripAnsi('Container web-1  Started')).toBe('Container web-1  Started');
+	});
+});

tests/save-close-policy.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, test } from 'bun:test';
+import { saveCloseTiming } from '../src/lib/utils/save-close-policy';
+
+// Three separate tests, one per case (not one test with three assertions) -- so a
+// failure in one case doesn't hide the other two behind a single aborted test run.
+describe('saveCloseTiming', () => {
+	test('a plain save closes', () => {
+		expect(saveCloseTiming(false, true)).toBe('close');
+	});
+
+	test('a successful deploy closes, but only after a delay', () => {
+		expect(saveCloseTiming(true, true)).toBe('close-delayed');
+	});
+
+	test('a failed deploy stays open', () => {
+		expect(saveCloseTiming(true, false)).toBe('stay-open');
+	});
+});

tests/scroll-position.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, test } from 'bun:test';
+import { isScrolledToBottom, shouldResetScrollPause } from '../src/lib/utils/scroll-position';
+
+describe('isScrolledToBottom', () => {
+	test('is true when the element is exactly at the end', () => {
+		expect(isScrolledToBottom(400, 500, 100)).toBe(true);
+	});
+
+	test('is true within the default 50px threshold', () => {
+		expect(isScrolledToBottom(370, 500, 100)).toBe(true);
+	});
+
+	// One case at the boundary and one just past it -- otherwise an off-by-one in the
+	// comparison (< vs <=) leaves every other test green.
+	test('is true exactly at the threshold and false one pixel past it', () => {
+		expect(isScrolledToBottom(350, 500, 100)).toBe(true);
+		expect(isScrolledToBottom(349, 500, 100)).toBe(false);
+	});
+
+	test('is false once the user has scrolled well up from the end', () => {
+		expect(isScrolledToBottom(100, 500, 100)).toBe(false);
+	});
+
+	test('accepts a custom threshold', () => {
+		expect(isScrolledToBottom(390, 500, 100, 5)).toBe(false);
+		expect(isScrolledToBottom(395, 500, 100, 5)).toBe(true);
+	});
+});
+
+describe('shouldResetScrollPause', () => {
+	test('lifts the pause when a fresh run starts (false -> true)', () => {
+		expect(shouldResetScrollPause(false, true)).toBe(true);
+	});
+
+	// This is the case that catches the bug reported live: a viewer scrolls up during one
+	// run, and every later run of the same page session stays paused because nothing ever
+	// clears it. A naive "reset whenever autoScroll is true" implementation returns true
+	// here too -- which reads as similar but re-lifts the pause on every update while a run
+	// is already in progress, defeating the pause entirely. Only the false -> true edge
+	// (a *new* run starting) may lift it.
+	test('does not re-lift the pause on every update while a run is already in progress', () => {
+		expect(shouldResetScrollPause(true, true)).toBe(false);
+	});
+
+	test('does nothing when a run ends (true -> false)', () => {
+		expect(shouldResetScrollPause(true, false)).toBe(false);
+	});
+
+	test('does nothing while idle (false -> false)', () => {
+		expect(shouldResetScrollPause(false, false)).toBe(false);
+	});
+});

tests/secret-redaction.test.ts

@@ -0,0 +1,32 @@
+import { describe, test, expect } from 'bun:test';
+import { redactLine } from '../src/lib/server/secret-redaction';
+
+describe('redactLine', () => {
+	test('replaces a known value exactly', () => {
+		const line = 'Error: connection to postgres://user:sup3rgeheim-passwort-42@db failed';
+		expect(redactLine(line, ['sup3rgeheim-passwort-42'])).toBe(
+			'Error: connection to postgres://user:***@db failed'
+		);
+	});
+
+	test('replaces every occurrence, not just the first', () => {
+		expect(redactLine('a=tokenwert-lang-genug b=tokenwert-lang-genug', ['tokenwert-lang-genug'])).toBe(
+			'a=*** b=***'
+		);
+	});
+
+	test('withholds the whole line when a secret is too short to replace safely', () => {
+		// "test" would match inside "latest", "testing", "attest" -- replacing would be nonsense
+		expect(redactLine('Pulling image alpine:latest', ['test'])).toBeNull();
+	});
+
+	test('leaves a line without any secret unchanged', () => {
+		const line = 'Container app-1  Started';
+		expect(redactLine(line, ['sup3rgeheim-passwort-42'])).toBe(line);
+	});
+
+	test('ignores empty and blank secrets', () => {
+		const line = 'Container app-1  Started';
+		expect(redactLine(line, ['', '  '])).toBe(line);
+	});
+});

tests/sse-fetch-lines.test.ts

@@ -0,0 +1,69 @@
+/**
+ * readJobResponse's optional line callback — the "live output" hookup used by the UI.
+ * Mocks global fetch to drive watchJob's polling loop through a scripted sequence of
+ * job states, without a real server.
+ *
+ * Run with: bun test tests/sse-fetch-lines.test.ts
+ */
+
+import { describe, test, expect } from 'bun:test';
+import { readJobResponse } from '../src/lib/utils/sse-fetch';
+
+interface JobLine {
+	event?: string;
+	data: unknown;
+}
+
+interface JobState {
+	status: 'running' | 'done' | 'error';
+	lines: JobLine[];
+	result?: unknown;
+}
+
+// Not production code — a small test double for the /api/jobs/{jobId} polling
+// endpoint that watchJob() calls. Returns the given states in order, then keeps
+// returning the last one if polled again.
+function mockJobPolling(states: JobState[]): typeof fetch {
+	let call = 0;
+	return (async () => {
+		const state = states[Math.min(call, states.length - 1)];
+		call++;
+		return new Response(JSON.stringify({ id: 'x', ...state }), {
+			status: 200,
+			headers: { 'Content-Type': 'application/json' }
+		});
+	}) as typeof fetch;
+}
+
+describe('readJobResponse with a line callback', () => {
+	test('reports line messages to the callback', async () => {
+		const seen: string[] = [];
+		// Simulate the job poll response: first running with one line, then done with both.
+		globalThis.fetch = mockJobPolling([
+			{ status: 'running', lines: [{ event: 'progress', data: { type: 'line', line: 'first' } }] },
+			{
+				status: 'done',
+				lines: [
+					{ event: 'progress', data: { type: 'line', line: 'first' } },
+					{ event: 'progress', data: { type: 'line', line: 'second' } }
+				],
+				result: { success: true }
+			}
+		]);
+
+		await readJobResponse(new Response(JSON.stringify({ jobId: 'x' })), (l) => seen.push(l));
+		expect(seen).toEqual(['first', 'second']);
+	});
+
+	test('stays unchanged without a callback', async () => {
+		globalThis.fetch = mockJobPolling([
+			{
+				status: 'done',
+				lines: [{ event: 'progress', data: { type: 'line', line: 'ignored' } }],
+				result: { success: true }
+			}
+		]);
+		const result = await readJobResponse(new Response(JSON.stringify({ jobId: 'x' })));
+		expect(result.success).toBe(true);
+	});
+});

tests/sse-run-recorder.test.ts

@@ -0,0 +1,188 @@
+// tests/sse-run-recorder.test.ts
+import { describe, expect, test } from 'bun:test';
+import { createJobResponse, type RunRecorder } from '../src/lib/server/sse';
+
+/** A fake RunRecorder that records every line() call and resolves `ended` when end() fires. */
+function createFakeRecorder() {
+	const lines: string[] = [];
+	let resolveEnded!: (v: { ok: boolean; exitCode?: number; error?: string }) => void;
+	const ended = new Promise<{ ok: boolean; exitCode?: number; error?: string }>((resolve) => {
+		resolveEnded = resolve;
+	});
+	const recorder: RunRecorder = {
+		line(line: string) {
+			lines.push(line);
+		},
+		addSecrets() {
+			// Not exercised by this file's tests -- they cover createJobResponse's own
+			// line()/end() plumbing, not the F4 addSecrets() wiring (see
+			// deploy-run-record.test.ts and the route-level regression tests for that).
+		},
+		async end(ok: boolean, exitCode?: number, error?: string) {
+			resolveEnded({ ok, exitCode, error });
+		}
+	};
+	return { recorder, lines, ended };
+}
+
+/** Sends a status line (not recordable), two progress lines (recordable), and an
+ *  unredacted result (never recordable) -- exercises shouldRecord's real filter. */
+const runOperation = async (send: (event: string, data: unknown) => void) => {
+	send('progress', { status: 'Deploying stack...' });
+	send('progress', { type: 'line', line: 'Container web Started' });
+	send('progress', { type: 'line', line: 'Container web Healthy' });
+	send('result', { success: true, output: 'DB_PASSWORD=hunter2' });
+};
+
+describe('createJobResponse RunRecorder hook', () => {
+	test('records qualifying lines on the JSON path (Accept: application/json)', async () => {
+		const { recorder, lines, ended } = createFakeRecorder();
+		const request = new Request('http://x', { headers: { Accept: 'application/json' } });
+
+		const response = createJobResponse(runOperation, request, recorder);
+		await response.json();
+		const end = await ended;
+
+		expect(lines).toEqual(['Container web Started', 'Container web Healthy']);
+		expect(end.ok).toBe(true);
+		expect(end.error).toBeUndefined();
+	});
+
+	test('records the SAME qualifying lines on the streaming path (no Accept header)', async () => {
+		const { recorder, lines, ended } = createFakeRecorder();
+		const request = new Request('http://x');
+
+		createJobResponse(runOperation, request, recorder);
+		await ended;
+
+		expect(lines).toEqual(['Container web Started', 'Container web Healthy']);
+	});
+
+	test('both send() implementations feed the recorder identical lines', async () => {
+		const jsonSide = createFakeRecorder();
+		const streamSide = createFakeRecorder();
+
+		const jsonResponse = createJobResponse(
+			runOperation,
+			new Request('http://x', { headers: { Accept: 'application/json' } }),
+			jsonSide.recorder
+		);
+		await jsonResponse.json();
+		await jsonSide.ended;
+
+		createJobResponse(runOperation, new Request('http://x'), streamSide.recorder);
+		await streamSide.ended;
+
+		expect(streamSide.lines).toEqual(jsonSide.lines);
+		expect(jsonSide.lines).toEqual(['Container web Started', 'Container web Healthy']);
+	});
+
+	test('streaming path: end() reports ok=false with the error message when the operation throws', async () => {
+		const { recorder, ended } = createFakeRecorder();
+
+		createJobResponse(
+			async () => {
+				throw new Error('boom');
+			},
+			new Request('http://x'),
+			recorder
+		);
+
+		const end = await ended;
+		expect(end.ok).toBe(false);
+		expect(end.error).toBe('boom');
+	});
+
+	test('streaming path: end() reports ok=false with the error message on a failed result that RESOLVES (no throw) -- this is the path every browser call takes, since neither +page.svelte nor StackModal.svelte set an Accept header', async () => {
+		const { recorder, ended } = createFakeRecorder();
+		const request = new Request('http://x'); // no Accept header -> fire-and-forget path
+
+		createJobResponse(
+			async (send) => {
+				// A failed docker compose up does NOT throw -- it sends a failed result and
+				// returns normally. That lands this in the .then() branch below, never .catch().
+				send('result', { success: false, error: 'compose up failed: exit 1' });
+			},
+			request,
+			recorder
+		);
+
+		const end = await ended;
+		expect(end.ok).toBe(false);
+		expect(end.error).toBe('compose up failed: exit 1');
+	});
+
+	// Companion to the test above: a resolving (non-throwing) SUCCESS must still end up
+	// ok=true on the streaming path, so the fix doesn't flip the polarity for the common case.
+	test('streaming path: end() reports ok=true on a successful result that resolves (no throw)', async () => {
+		const { recorder, ended } = createFakeRecorder();
+		const request = new Request('http://x');
+
+		createJobResponse(
+			async (send) => {
+				send('result', { success: true, output: 'done' });
+			},
+			request,
+			recorder
+		);
+
+		const end = await ended;
+		expect(end.ok).toBe(true);
+		expect(end.error).toBeUndefined();
+	});
+
+	test('JSON path: end() reports ok=false with the error message on a failed result', async () => {
+		const { recorder, ended } = createFakeRecorder();
+		const request = new Request('http://x', { headers: { Accept: 'application/json' } });
+
+		const response = createJobResponse(
+			async (send) => {
+				send('result', { success: false, error: 'compose failed' });
+			},
+			request,
+			recorder
+		);
+		await response.json();
+
+		const end = await ended;
+		expect(end.ok).toBe(false);
+		expect(end.error).toBe('compose failed');
+	});
+
+	test('streaming path: a recorder.end() that itself throws is never called twice', async () => {
+		// Guards RunRecorder's "end() is called exactly once" contract from sse.ts's own
+		// side: if the .then() branch's recorder.end() call throws, that rejection must
+		// not cause .catch() to invoke end() again.
+		let calls = 0;
+		const recorder: RunRecorder = {
+			line() {},
+			addSecrets() {},
+			async end() {
+				calls++;
+				throw new Error('recorder failure');
+			}
+		};
+		const request = new Request('http://x'); // no Accept header -> fire-and-forget path
+
+		createJobResponse(
+			async (send) => {
+				send('result', { success: true, output: 'done' });
+			},
+			request,
+			recorder
+		);
+
+		// Let the .then()/.catch() microtasks (including the rejected recorder.end() call
+		// and its handling) settle before asserting.
+		await new Promise((resolve) => setTimeout(resolve, 20));
+
+		expect(calls).toBe(1);
+	});
+
+	test('omitting the recorder changes nothing (backward compat)', async () => {
+		const request = new Request('http://x', { headers: { Accept: 'application/json' } });
+		const response = createJobResponse(runOperation, request);
+		const body = await response.json();
+		expect(body).toEqual({ success: true, output: 'DB_PASSWORD=hunter2' });
+	});
+});

tests/stack-compose-redeploy-run-record.test.ts

@@ -0,0 +1,427 @@
+/**
+ * Task 21: `PUT /api/stacks/[name]/compose` (Save & redeploy) must produce the same
+ * stack_deploy schedule_executions row + log file the dedicated deploy endpoint
+ * (deploy/+server.ts, Task 10 / deploy-run-record.ts) already produces.
+ *
+ * Before this task, restart:true saved the compose file and redeployed WITHOUT ever
+ * building a run recorder: the deploy ran, but afterwards no row and no log file
+ * existed. Found live against the running test instance (task-21-brief.md), not by a
+ * failing test -- deploy-stack-online.test.ts's own doc comment already notes routes
+ * silently ship without wiring like this, invisibly, because nothing fails when it's
+ * missing.
+ *
+ * This calls the route's PUT handler DIRECTLY (composeRoute.PUT), never through any
+ * router/dispatch layer -- so "this test accidentally exercises the deploy endpoint
+ * instead" is structurally impossible; the object under test IS this file's export.
+ * What every "row created" assertion is instead paired with is a restart:false
+ * counterpart proving the SAME fakes yield ZERO rows when there is no deploy -- so a
+ * spurious pass can't hide behind lenient fakes that always produce a row regardless
+ * of what was actually requested.
+ *
+ * $lib/server/db and $lib/server/authorize are faked via the shared helpers -- see
+ * their doc comments for why a second direct mock.module() call for either would
+ * collide with tests/deploy-endpoints.test.ts, which already owns both specifiers for
+ * this process (mock.module() replaces a module's exports WHOLESALE for the entire
+ * test run, and Bun freezes the exported shape at first resolution).
+ *
+ * $lib/server/stacks is faked via tests/helpers/stacks-fake.ts, the same shared,
+ * collision-safe registration point db-fake.ts/authorize-fake.ts already use for
+ * their specifiers -- like db.ts it pulls in better-sqlite3 (ERR_DLOPEN_FAILED under
+ * Bun), so it can't be imported for real here either. This used to be a direct
+ * mock.module() call in this file; it moved into the shared helper once a second
+ * file (tests/git-stack-deploy-run-record.test.ts) needed to fake $lib/server/stacks
+ * too -- exactly the situation this doc comment originally predicted.
+ *
+ * (A second consumer for this fake was considered -- POST /api/stacks/+server.ts --
+ * but that route also drags in $lib/server/docker -> hawser.ts -> ./db/drizzle.js, a
+ * SEPARATE specifier from $lib/server/db that touches better-sqlite3 directly and
+ * can't be faked the same way. That route's build/pull/forceRecreate coverage is a
+ * source-level check instead, see stack-create-start-build-options.test.ts.)
+ *
+ * The dedicated deploy endpoint (deploy/+server.ts) is deliberately NOT imported here
+ * to double-check its own recording: it additionally pulls in $lib/server/audit ->
+ * $lib/server/license -> $lib/server/notifications/index.ts, none of which this task
+ * touches, and faking that whole chain just to re-prove an unrelated route wasn't
+ * broken would be its own maintenance burden. The "still records exactly once, not
+ * two" check for that route is done at the SOURCE level instead, at the bottom of this
+ * file -- deploy/+server.ts is untouched by this task's diff, so a source-level guard
+ * is sufficient evidence, not a shortcut.
+ */
+import { describe, test, expect, beforeAll, beforeEach, afterAll } from 'bun:test';
+import { mkdtemp, rm, readFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { registerDbFake } from './helpers/db-fake';
+import { registerAuthorizeFake } from './helpers/authorize-fake';
+import { registerStacksFake } from './helpers/stacks-fake';
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+// -- $lib/server/authorize: always permitted (auth disabled) ----------------
+
+registerAuthorizeFake(async () => ({
+	authEnabled: false,
+	isAuthenticated: true,
+	isEnterprise: false,
+	can: async () => true,
+	canAccessEnvironment: async () => true,
+	// upstream/main added this gate (requireEnvAccess) to compose/+server.ts after this
+	// fake was written; authEnabled is false here, so the real implementation would be a
+	// no-op (see src/lib/server/authorize.ts) -- mirror that instead of leaving it undefined.
+	requireEnvAccess: async () => null
+}));
+
+// -- $lib/server/db: an in-memory schedule_executions fake -------------------
+
+let created: Array<Record<string, unknown>>;
+let updates: Array<Record<string, unknown>>;
+let nextId: number;
+
+function resetDbState() {
+	created = [];
+	updates = [];
+	nextId = 1;
+}
+resetDbState();
+
+registerDbFake('createScheduleExecution', async (data: Record<string, unknown>) => {
+	const row = {
+		id: nextId++,
+		...data,
+		triggeredAt: new Date().toISOString(),
+		startedAt: null,
+		completedAt: null,
+		duration: null,
+		errorMessage: null,
+		details: data.details ?? null,
+		logs: null,
+		createdAt: null
+	};
+	created.push(row);
+	return row;
+});
+registerDbFake('updateScheduleExecution', async (id: number, data: Record<string, unknown>) => {
+	updates.push({ id, ...data });
+	return { id, ...data };
+});
+
+/** The update() call that CLOSED the row (status !== 'running'), i.e. the one written
+ *  by DeployRunRecorder.end() -- as opposed to createRunRecorder's own startedAt
+ *  update. Same helper shape as tests/deploy-run-record.test.ts's endUpdate(). */
+function endUpdate() {
+	return updates.find((u) => u.status !== undefined);
+}
+
+// -- Real deploy-log-store against a throwaway DATA_DIR ----------------------
+//
+// DATA_DIR is process-global and read at call time by every other test file too
+// (tests/fs-guard.test.ts's doc comment, referenced by tests/deploy-endpoints.test.ts)
+// -- save and restore the prior value so this file leaves no trace once it finishes.
+
+const previousDataDir = process.env.DATA_DIR;
+let dataDir: string;
+beforeAll(async () => {
+	dataDir = await mkdtemp(join(tmpdir(), 'dv-t21-deploy-logs-'));
+	process.env.DATA_DIR = dataDir;
+});
+afterAll(async () => {
+	await rm(dataDir, { recursive: true, force: true });
+	if (previousDataDir === undefined) {
+		delete process.env.DATA_DIR;
+	} else {
+		process.env.DATA_DIR = previousDataDir;
+	}
+});
+
+const { readRunLog, deleteRunLog } = await import('../src/lib/server/deploy-log-store');
+const { hashComposeContent, hashEnvFingerprint } = await import('../src/lib/server/deploy-run-record-core');
+
+// -- $lib/server/stacks: mocked WHOLESALE ------------------------------------
+
+let saveCalls: Array<{ name: string; content: string; envId: number | null | undefined }>;
+let requireComposeResult: Record<string, unknown>;
+let deployStackCalls: Array<{ onLine?: (line: string) => void; build?: boolean; pullPolicy?: string; forceRecreate?: boolean }>;
+let deployStackResult: { success: boolean; output?: string; error?: string; resolvedSecrets?: string[] };
+let deployStackOnLines: string[];
+
+function resetStacksState() {
+	saveCalls = [];
+	deployStackCalls = [];
+	deployStackResult = { success: true, output: 'deployed' };
+	deployStackOnLines = ['Container demo-stack-app-1  Started'];
+	requireComposeResult = {
+		success: true,
+		content: 'services:\n  app:\n    image: demo:1\n',
+		nonSecretVars: { PUBLIC_VAR: 'v1' },
+		secretVars: { DB_PASSWORD: 's3cr3t-value' },
+		stackDir: '/tmp/demo-stack',
+		composePath: '/tmp/demo-stack/compose.yaml',
+		envPath: '/tmp/demo-stack/.env',
+		sourceType: 'internal'
+	};
+}
+resetStacksState();
+
+registerStacksFake('getStackComposeFile', async () => {
+	throw new Error('getStackComposeFile: not exercised here -- only the GET handler uses it, this suite only calls PUT');
+});
+registerStacksFake('saveStackComposeFile', async (name: string, content: string, _create: boolean, envId?: number | null) => {
+	saveCalls.push({ name, content, envId });
+	return { success: true };
+});
+registerStacksFake('requireComposeFile', async (_name: string, _envId?: number | null) => requireComposeResult);
+registerStacksFake('deployStack', async (options: { onLine?: (line: string) => void; build?: boolean; pullPolicy?: string; forceRecreate?: boolean }) => {
+	deployStackCalls.push(options);
+	for (const line of deployStackOnLines) options.onLine?.(line);
+	return deployStackResult;
+});
+
+// -- Route under test, imported AFTER all the fakes above are registered ----
+
+const composeRoute = await import('../src/routes/api/stacks/[name]/compose/+server');
+
+// -- Fixtures ------------------------------------------------------------------
+
+const STACK = 'demo-stack';
+
+/** `Accept: application/json` forces createJobResponse's synchronous JSON path
+ *  (sse-parser.ts prefersJSON()), so the returned Response only resolves once the
+ *  whole operation -- deploy AND recorder.end() -- has actually finished. Without it
+ *  the "fire and forget" path would return {jobId} before the row closes, and every
+ *  assertion below would race the background completion. */
+function makeComposeEvent(body: Record<string, unknown>) {
+	const request = new Request('http://x/', {
+		method: 'PUT',
+		headers: { 'content-type': 'application/json', accept: 'application/json' },
+		body: JSON.stringify(body)
+	});
+	return {
+		params: { name: STACK },
+		request,
+		url: new URL('http://x/'),
+		cookies: { get: () => undefined } as any
+	} as any;
+}
+
+beforeEach(async () => {
+	resetDbState();
+	resetStacksState();
+	// nextId always restarts at 1 above, so every test's (at most one) row reuses
+	// runId '1' -- clear its log file so tests don't leak content into each other via
+	// the shared DATA_DIR (same precaution tests/deploy-endpoints.test.ts documents).
+	await deleteRunLog(null, '1');
+});
+
+describe('PUT /api/stacks/[name]/compose -- restart:true (Save & redeploy)', () => {
+	test('creates exactly one stack_deploy schedule_executions row, closed as success, with a readable log', async () => {
+		const content = 'services:\n  app:\n    image: demo:2\n';
+
+		const res = await composeRoute.PUT(makeComposeEvent({ content, restart: true }));
+		expect(res.status).toBe(200);
+		expect((await res.json()).success).toBe(true);
+
+		expect(created).toHaveLength(1);
+		expect(created[0].scheduleType).toBe('stack_deploy');
+		expect(created[0].scheduleId).toBe(0);
+		expect(created[0].entityName).toBe(STACK);
+		expect(created[0].triggeredBy).toBe('manual');
+
+		const update = endUpdate();
+		expect(update?.status).toBe('success');
+		expect(update?.errorMessage).toBeNull();
+
+		const runId = String(created[0].id);
+		const log = await readRunLog(null, runId);
+		expect(log).toContain('Container demo-stack-app-1  Started');
+	});
+
+	test('composeHash is derived from the just-SUBMITTED content, not from requireComposeFile()\'s (possibly stale) content', async () => {
+		const submitted = 'services:\n  app:\n    image: demo:3\n';
+		// Deliberately different from `submitted` -- if the route ever hashed
+		// composeInfo.content instead of the request body's `content`, this test
+		// would catch it: the stored hash would match THIS string, not `submitted`.
+		requireComposeResult = { ...requireComposeResult, content: 'STALE-CONTENT-NEVER-HASHED' };
+
+		// Draining the body (.json()) is required, not cosmetic: createJobResponse's JSON
+		// path only finishes recorder.end() inside the ReadableStream's start(), which
+		// only runs to completion once the stream is actually consumed.
+		await (await composeRoute.PUT(makeComposeEvent({ content: submitted, restart: true }))).json();
+
+		const update = endUpdate();
+		const details = update?.details as { composeHash: string };
+		expect(details.composeHash).toBe(hashComposeContent(submitted));
+		expect(details.composeHash).not.toBe(hashComposeContent('STALE-CONTENT-NEVER-HASHED'));
+	});
+
+	test('envHash covers the MERGE of non-secret and secret vars, same shape deploy/+server.ts already uses', async () => {
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true }))).json();
+
+		const update = endUpdate();
+		const details = update?.details as { envHash: string };
+		const expected = hashEnvFingerprint({ PUBLIC_VAR: 'v1', DB_PASSWORD: 's3cr3t-value' });
+		expect(details.envHash).toBe(expected);
+	});
+
+	test('a secret value in the deploy error text is redacted before it is stored (the envHash-covered vars double as the redaction list)', async () => {
+		deployStackResult = { success: false, error: 'compose up failed: DB_PASSWORD=s3cr3t-value rejected' };
+		deployStackOnLines = [];
+
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true }))).json();
+
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		expect(String(update?.errorMessage)).not.toContain('s3cr3t-value');
+	});
+
+	// F4 fix: deployStack() resolves a bound secret provider's values INTERNALLY, after
+	// the route's `recorder` above was already built from requireComposeResult's DB-only
+	// secretVars/nonSecretVars. A provider-resolved secret (never in that DB-only set) is
+	// simulated via the fake's resolvedSecrets -- exactly StackOperationResult's shape --
+	// and must still be redacted from the stored error, via recorder.addSecrets().
+	test('F4 regression: a provider-resolved secret (unknown at recorder construction) is redacted before it is stored', async () => {
+		const PROVIDER_SECRET = 'zzz-bulk-provider-7000';
+		deployStackResult = {
+			success: false,
+			error: `compose up failed: PROVIDER_TOKEN=${PROVIDER_SECRET} rejected`,
+			resolvedSecrets: [PROVIDER_SECRET]
+		};
+		deployStackOnLines = [];
+
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true }))).json();
+
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+		expect(String(update?.errorMessage)).not.toContain(PROVIDER_SECRET);
+	});
+
+	test('a failed deploy still closes the row as "failed", never left "running"', async () => {
+		deployStackResult = { success: false, error: 'exit code 1' };
+		deployStackOnLines = [];
+
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true }))).json();
+
+		expect(created).toHaveLength(1);
+		const update = endUpdate();
+		expect(update?.status).toBe('failed');
+	});
+});
+
+/**
+ * Before this fix, restart:true ALWAYS deployed with build:false and no pullPolicy,
+ * regardless of what the caller sent -- a stack whose compose declares a `build:`
+ * section silently never rebuilt on "Save & redeploy", the saved compose change just
+ * ran against the stale local image. These assertions are made at the deployStack()
+ * CALL, not the HTTP response's success flag: a response can be {success:true} even
+ * when build/pull were dropped on the floor (that IS the bug this fixes), so
+ * status:200 alone proves nothing here.
+ */
+describe('PUT /api/stacks/[name]/compose -- restart:true build/pull/forceRecreate options', () => {
+	test('build:true in the request body reaches deployStack({build:true})', async () => {
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true, build: true }))).json();
+
+		expect(deployStackCalls).toHaveLength(1);
+		expect(deployStackCalls[0].build).toBe(true);
+	});
+
+	test('omitting build deploys with build:false -- an explicit opt-out, not a broken default', async () => {
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true }))).json();
+
+		expect(deployStackCalls[0].build).toBe(false);
+	});
+
+	test('pull:true is translated to pullPolicy:"always" -- deployStack has no separate pull flag, only pullPolicy', async () => {
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true, pull: true }))).json();
+
+		expect(deployStackCalls[0].pullPolicy).toBe('always');
+	});
+
+	test('pull:false leaves pullPolicy undefined (not "never" or "missing") -- deployStack treats a missing pullPolicy as "do not pull", which is also why it skips its own post-deploy pending-update badge reconciliation in that case (stacks.ts, untouched by this task)', async () => {
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true, pull: false }))).json();
+
+		expect(deployStackCalls[0].pullPolicy).toBeUndefined();
+	});
+
+	test('forceRecreate:false is honored -- previously this branch hardcoded true unconditionally, so opting out was impossible', async () => {
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true, forceRecreate: false }))).json();
+
+		expect(deployStackCalls[0].forceRecreate).toBe(false);
+	});
+
+	test('omitting forceRecreate entirely still force-recreates -- preserves the prior hardcoded behavior for a caller that has not been updated to send it explicitly (env var changes need --force-recreate to take effect)', async () => {
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true }))).json();
+
+		expect(deployStackCalls[0].forceRecreate).toBe(true);
+	});
+
+	test('all three options are recorded on the run (details.options), matching what deployStack actually ran with -- not just passed through in memory', async () => {
+		await (await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: true, pull: true, build: true, forceRecreate: false }))).json();
+
+		const update = endUpdate();
+		const details = update?.details as { options?: { pull: boolean; build: boolean; forceRecreate: boolean } } | undefined;
+		expect(details?.options).toEqual({ pull: true, build: true, forceRecreate: false });
+	});
+});
+
+describe('PUT /api/stacks/[name]/compose -- restart:false (save only, no deploy)', () => {
+	test('creates NO schedule_executions row -- a save without a deploy must not become a run', async () => {
+		const res = await composeRoute.PUT(makeComposeEvent({ content: 'x', restart: false }));
+		expect(res.status).toBe(200);
+		expect((await res.json()).success).toBe(true);
+
+		expect(saveCalls).toHaveLength(1); // the save itself DID happen
+		expect(deployStackCalls).toHaveLength(0); // but no deploy
+		expect(created).toHaveLength(0); // and therefore no run record either
+		expect(updates).toHaveLength(0);
+	});
+
+	test('omitting restart entirely (defaults to false) behaves identically', async () => {
+		const res = await composeRoute.PUT(makeComposeEvent({ content: 'x' }));
+		expect(res.status).toBe(200);
+		expect(created).toHaveLength(0);
+		expect(deployStackCalls).toHaveLength(0);
+	});
+});
+
+describe('src/routes/api/stacks/[name]/deploy/+server.ts -- untouched by this task', () => {
+	test('still calls createRunRecorder exactly once (source-level regression guard against double-recording)', async () => {
+		const source = await readFile(
+			join(here, '..', 'src', 'routes', 'api', 'stacks', '[name]', 'deploy', '+server.ts'),
+			'utf8'
+		);
+		const matches = source.match(/createRunRecorder\(/g) ?? [];
+		expect(matches).toHaveLength(1);
+	});
+});
+
+/**
+ * F4 fix source-level guards. deploy/+server.ts and POST /api/stacks/+server.ts are
+ * not exercised as real integration tests in this file (see this file's top doc
+ * comment for why: the former pulls in $lib/server/audit -> ...license ->
+ * ...notifications, the latter pulls in $lib/server/docker -> hawser.ts ->
+ * ./db/drizzle.js -- neither faked here). A source-level guard cannot prove the wiring
+ * REDACTS correctly (that's what the real integration test above proves, for
+ * compose/+server.ts, which shares the exact same pattern) -- it only proves the call
+ * exists exactly once, so a future refactor can't silently drop it back out. It cannot
+ * distinguish a real call from the same text inside a comment or string; the call
+ * itself deliberately never appears verbatim in comments in either file, to keep this
+ * guard meaningful.
+ */
+describe('F4 fix -- recorder.addSecrets() wiring exists on the routes not covered by a real integration test here', () => {
+	test('deploy/+server.ts calls recorder.addSecrets(result.resolvedSecrets ?? []) exactly once, before recorder.end()', async () => {
+		const source = await readFile(
+			join(here, '..', 'src', 'routes', 'api', 'stacks', '[name]', 'deploy', '+server.ts'),
+			'utf8'
+		);
+		const matches = source.match(/recorder\.addSecrets\(/g) ?? [];
+		expect(matches).toHaveLength(1);
+		expect(source.indexOf('recorder.addSecrets(')).toBeLessThan(source.indexOf('}, event.request, recorder)'));
+	});
+
+	test('POST /api/stacks/+server.ts calls recorder.addSecrets(result.resolvedSecrets ?? []) exactly once, before recorder.end()', async () => {
+		const source = await readFile(join(here, '..', 'src', 'routes', 'api', 'stacks', '+server.ts'), 'utf8');
+		const matches = source.match(/recorder\.addSecrets\(/g) ?? [];
+		expect(matches).toHaveLength(1);
+		expect(source.indexOf('recorder.addSecrets(')).toBeLessThan(source.indexOf('}, request, recorder)'));
+	});
+});

tests/stack-create-start-build-options.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Before this fix, POST /api/stacks (Create & Start) ALWAYS deployed with
+ * build:false and no pullPolicy, regardless of what the caller sent -- a stack whose
+ * compose declares a `build:` section silently never built on its first start.
+ *
+ * This is a SOURCE-LEVEL check, not a route-level one, for the same reason
+ * tests/stack-compose-redeploy-run-record.test.ts's own doc comment gives for NOT
+ * importing the dedicated deploy endpoint: importing this route for real pulls in
+ * $lib/server/audit -> $lib/server/license -> $lib/server/notifications/index.ts for
+ * the auditStack() call this route makes -- and, worse, $lib/server/docker ->
+ * hawser.ts -> `./db/drizzle.js`, a SEPARATE module specifier from $lib/server/db
+ * that instantiates a real better-sqlite3 connection at import time (confirmed
+ * empirically: faking $lib/server/db alone is not enough, the drizzle specifier
+ * throws ERR_DLOPEN_FAILED under Bun regardless). Faking that whole chain just to
+ * prove three destructured request fields reach one function call would be a much
+ * bigger maintenance burden than the guard itself is worth.
+ *
+ * What IS covered by a real route-level test: the identical pull/build/forceRecreate
+ * plumbing in PUT /api/stacks/[name]/compose (Save & redeploy), which has no such
+ * import chain -- see the "restart:true build/pull/forceRecreate options" describe
+ * block in stack-compose-redeploy-run-record.test.ts. Both routes were changed
+ * together, from the same requestBody shape RedeployPopover.svelte now sends; this
+ * file's job is only to catch this route's copy of that change regressing
+ * independently of the other.
+ */
+import { describe, test, expect } from 'bun:test';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const routePath = join(here, '..', 'src', 'routes', 'api', 'stacks', '+server.ts');
+
+async function readRoute(): Promise<string> {
+	return readFile(routePath, 'utf8');
+}
+
+describe('POST /api/stacks -- build/pull/forceRecreate options (source-level)', () => {
+	test('the request body destructuring includes pull, build, and forceRecreate', async () => {
+		const source = await readRoute();
+		// Single destructuring statement for the whole POST body -- match it as one
+		// block so a future refactor that drops one of the three fields (while keeping
+		// the others) still fails this test, instead of three independent substring
+		// checks that could each pass against three DIFFERENT destructuring statements.
+		const match = source.match(/const\s*\{([^}]*)\}\s*=\s*body;/);
+		expect(match).not.toBeNull();
+		const fields = match![1];
+		expect(fields).toContain('pull');
+		expect(fields).toContain('build');
+		expect(fields).toContain('forceRecreate');
+	});
+
+	test('deployStack() is called with build and pullPolicy derived from the request, not hardcoded', async () => {
+		const source = await readRoute();
+		const deployCall = source.match(/const result = await deployStack\(\{[\s\S]*?\}\);/);
+		expect(deployCall).not.toBeNull();
+		const body = deployCall![0];
+
+		// build: must reference the coerced request value, not a literal false --
+		// `build: false` would match `build:` alone, so anchor on the variable name.
+		expect(body).toMatch(/build:\s*buildOpt/);
+		// pullPolicy must be conditional on the request's pull flag, not omitted or a
+		// hardcoded 'always'/undefined -- the ternary is the actual translation from
+		// deployOptions.pull (boolean) to deployStack's pullPolicy (string | undefined).
+		expect(body).toMatch(/pullPolicy:\s*pullOpt\s*\?\s*'always'\s*:\s*undefined/);
+		expect(body).toMatch(/forceRecreate:\s*forceRecreateOpt/);
+	});
+
+	test('buildOpt/pullOpt/forceRecreateOpt are coerced booleans of the destructured request fields, not the raw (possibly undefined/truthy-string) body values', async () => {
+		const source = await readRoute();
+		expect(source).toMatch(/const\s+pullOpt\s*=\s*!!pull;/);
+		expect(source).toMatch(/const\s+buildOpt\s*=\s*!!build;/);
+		expect(source).toMatch(/const\s+forceRecreateOpt\s*=\s*!!forceRecreate;/);
+	});
+
+	test('the run recorder options match what deployStack is actually called with -- the same three variables, not separately hardcoded values that could drift from the deploy call', async () => {
+		const source = await readRoute();
+		const recorderCall = source.match(/options:\s*\{\s*pull:\s*pullOpt,\s*build:\s*buildOpt,\s*forceRecreate:\s*forceRecreateOpt\s*\}/);
+		expect(recorderCall).not.toBeNull();
+	});
+});

tests/stacks-collect-process.test.ts

@@ -0,0 +1,25 @@
+import { describe, test, expect } from 'bun:test';
+import { spawn } from 'child_process';
+import { collectProcess } from '../src/lib/server/process-output-core';
+
+describe('collectProcess with a line callback', () => {
+	test('emits each line separately and in order', async () => {
+		const lines: string[] = [];
+		const child = spawn('sh', ['-c', 'printf "eins\\nzwei\\ndrei\\n" >&2']);
+		await collectProcess(child, (line) => lines.push(line));
+		expect(lines).toEqual(['eins', 'zwei', 'drei']);
+	});
+
+	test('emits a trailing line that has no newline', async () => {
+		const lines: string[] = [];
+		const child = spawn('sh', ['-c', 'printf "ohne-umbruch" >&2']);
+		await collectProcess(child, (line) => lines.push(line));
+		expect(lines).toEqual(['ohne-umbruch']);
+	});
+
+	test('behaves exactly as before when no callback is given', async () => {
+		const child = spawn('sh', ['-c', 'printf "unveraendert\\n" >&2']);
+		const result = await collectProcess(child);
+		expect(result.stderr).toContain('unveraendert');
+	});
+});

tests/stacks-compat.test.ts

@@ -0,0 +1,34 @@
+import { describe, test, expect } from 'bun:test';
+import { surfaceBlockIfNoLines } from '../src/lib/server/secret-redaction';
+
+describe('surfaceBlockIfNoLines (old-agent compatibility)', () => {
+	test('reports the response block as one line when no lines arrived', () => {
+		const seen: string[] = [];
+		surfaceBlockIfNoLines((line) => seen.push(line), 0, 'Container probe-app-1  Started', []);
+		expect(seen).toEqual(['Container probe-app-1  Started']);
+	});
+
+	test('does not report the block again once lines already arrived', () => {
+		const seen: string[] = ['first', 'second'];
+		surfaceBlockIfNoLines((line) => seen.push(line), seen.length, 'first\nsecond', []);
+		expect(seen).toEqual(['first', 'second']);
+	});
+
+	test('does nothing without an onLine callback', () => {
+		expect(() => surfaceBlockIfNoLines(undefined, 0, 'some output', [])).not.toThrow();
+	});
+
+	test('does nothing when the block is empty or undefined', () => {
+		const seen: string[] = [];
+		surfaceBlockIfNoLines((line) => seen.push(line), 0, '', []);
+		surfaceBlockIfNoLines((line) => seen.push(line), 0, undefined, []);
+		expect(seen).toEqual([]);
+	});
+
+	test('redacts secrets in the surfaced block, same as a streamed line', () => {
+		const seen: string[] = [];
+		const secret = 'sup3rsecret-password-42';
+		surfaceBlockIfNoLines((line) => seen.push(line), 0, `Error: password=${secret} rejected`, [secret]);
+		expect(seen).toEqual(['Error: password=*** rejected']);
+	});
+});

tests/stacks-hawser-lines.test.ts

@@ -0,0 +1,91 @@
+/**
+ * Tests for line consumption on the Hawser compose path. A new agent sends its output as
+ * 'stream' messages while the command runs AND still returns the whole block in its final
+ * response. Only one of the two may reach the operator: the lines win, the block is the
+ * fallback for an agent that sends none. Without that rule the operator sees everything twice.
+ *
+ * executeComposeViaHawser cannot be imported here -- stacks.ts pulls in db/drizzle ->
+ * better-sqlite3, which bun's test runner cannot load, and a failed import poisons unrelated
+ * tests in the same process (see stacks-collect-process.test.ts for the same constraint).
+ * What it composes is testable, so this wires those pieces the way stacks.ts wires them: the
+ * real message dispatcher, base64 decode included, feeding the real sink.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { makeRedactedLineSink } from '../src/lib/server/secret-redaction.js';
+import { dispatchStreamMessage, type StreamDispatchTarget } from '../src/lib/server/hawser-core.js';
+
+const REQUEST_ID = 'compose-1';
+
+/**
+ * Stands in for a Hawser agent: each line arrives as a 'stream' message carrying base64 data
+ * (Go marshals []byte that way), then the response arrives with the final output block.
+ */
+function runFakeAgent(
+	sink: ReturnType<typeof makeRedactedLineSink>,
+	agent: { lines: string[]; output?: string }
+): void {
+	const connection: StreamDispatchTarget = {
+		pendingStreamRequests: new Map(),
+		lineHandlers: new Map()
+	};
+	if (sink.forward) connection.lineHandlers!.set(REQUEST_ID, sink.forward);
+
+	for (const line of agent.lines) {
+		dispatchStreamMessage(connection, {
+			requestId: REQUEST_ID,
+			data: Buffer.from(line).toString('base64')
+		});
+	}
+
+	// The 'response' case in hawser.ts drops the handler once the request is done.
+	connection.lineHandlers!.delete(REQUEST_ID);
+	sink.surfaceBlock(agent.output);
+}
+
+describe('compose lines from a Hawser agent', () => {
+	test('forwards lines from a new agent redacted', () => {
+		const seen: string[] = [];
+		const secret = 'sup3rsecret-password-42';
+		const sink = makeRedactedLineSink((l) => seen.push(l), [secret]);
+
+		runFakeAgent(sink, { lines: [`password=${secret}`, 'Container app-1  Started'] });
+
+		expect(seen.join('\n')).not.toContain(secret);
+		expect(seen).toEqual(['password=***', 'Container app-1  Started']);
+	});
+
+	test('does not append the output block on top of the streamed lines', () => {
+		const seen: string[] = [];
+		const sink = makeRedactedLineSink((l) => seen.push(l), []);
+
+		// A new agent sends both: the lines as they happen, plus the whole block at the end.
+		runFakeAgent(sink, {
+			lines: ['Container app-1  Recreate', 'Container app-1  Started'],
+			output: 'Container app-1  Recreate\nContainer app-1  Started'
+		});
+
+		expect(seen).toEqual(['Container app-1  Recreate', 'Container app-1  Started']);
+	});
+
+	test('surfaces the block when an old agent sends no lines at all', () => {
+		const seen: string[] = [];
+		const sink = makeRedactedLineSink((l) => seen.push(l), []);
+
+		runFakeAgent(sink, { lines: [], output: 'Container app-1  Started' });
+
+		expect(seen).toEqual(['Container app-1  Started']);
+	});
+
+	test('surfaces the block when every line was withheld by redaction', () => {
+		const seen: string[] = [];
+		// Shorter than MIN_REPLACEABLE_LENGTH, so the whole line is withheld rather than patched.
+		const sink = makeRedactedLineSink((l) => seen.push(l), ['pw123']);
+
+		runFakeAgent(sink, { lines: ['token=pw123'], output: 'Container app-1  Started' });
+
+		// A withheld line never reached the operator, so it must not count as one seen --
+		// otherwise this run would show nothing at all.
+		expect(seen).toEqual(['Container app-1  Started']);
+	});
+});

tests/stacks-line-forwarding.test.ts

@@ -0,0 +1,27 @@
+import { describe, test, expect } from 'bun:test';
+import { makeLineForwarder } from '../src/lib/server/secret-redaction';
+
+describe('line forwarding with redaction', () => {
+	test('forwards lines redacted, not raw', async () => {
+		const seen: string[] = [];
+		const secret = 'sup3rsecret-password-42';
+
+		// makeLineForwarder is the small bridge between collectProcess and send()
+		const forward = makeLineForwarder(seen.push.bind(seen), [secret]);
+		forward(`Error: password=${secret} rejected`);
+		forward('Container app-1  Started');
+
+		expect(seen).toEqual([
+			'Error: password=*** rejected',
+			'Container app-1  Started'
+		]);
+		expect(seen.join('\n')).not.toContain(secret);
+	});
+
+	test('drops a withheld line entirely', () => {
+		const seen: string[] = [];
+		const forward = makeLineForwarder(seen.push.bind(seen), ['test']);
+		forward('Pulling alpine:latest');
+		expect(seen).toEqual([]);
+	});
+});