fix(deploy): no dangling symlink on first-deploy failure, deadline-capped health poll, release pruning, honest commit rc

scripts/deploy.sh

@@ -228,7 +228,11 @@ ln -sfn \"\$RELDIR\" \"\$CURRENT\"
 rollback_install() {
     rm -rf \"\$LIVE\"
     [ ! -d \"\$BACKUP\" ] || mv \"\$BACKUP\" \"\$LIVE\"
-    [ -z \"\$PREV\" ] || ln -sfn \"\$PREV\" \"\$CURRENT\"
+    if [ -n \"\$PREV\" ]; then
+        ln -sfn \"\$PREV\" \"\$CURRENT\"
+    else
+        rm -f \"\$CURRENT\"
+    fi
 }
 if [ -d \"\$LIVE\" ]; then mv \"\$LIVE\" \"\$BACKUP\"; fi
 if ! mkdir -p \"\$LIVE\" || ! cp -a \"\$NEW/.\" \"\$LIVE/\"; then
@@ -243,16 +247,16 @@ chmod 755 /etc/init.d/mk8-guard
 /etc/init.d/mk8-guard enable
 /etc/init.d/pagerwebui start
 
-# Post-deploy verification: API must answer within 60s or we roll back.
-i=0
+# Post-deploy verification: API must answer within ~60s (deadline-capped so
+# hung connections cannot stretch the window) or we roll back.
+DEADLINE=\$((SECONDS + 60))
 HEALTH_OK=''
-while [ \$i -lt 60 ]; do
+while [ \$SECONDS -lt \$DEADLINE ]; do
     if curl -fsS -m 3 http://127.0.0.1:8080/ >/dev/null 2>&1; then
         HEALTH_OK=1
         break
     fi
     sleep 1
-    i=\$((i+1))
 done
 if [ -z \"\$HEALTH_OK\" ]; then
     echo 'post-deploy health check failed; rolling back' >&2
@@ -263,6 +267,16 @@ if [ -z \"\$HEALTH_OK\" ]; then
     exit 1
 fi
 rm -rf \"\$BACKUP\"
+# Prune old releases; keep the newest 3 including current.
+ALL=\$(ls -1d /mmc/mk8/releases/2* 2>/dev/null | sort)
+TOTAL=\$(printf '%s\\n' \"\$ALL\" | grep -c .)
+KEEP_FROM=\$((TOTAL - 2))
+if [ \"\$KEEP_FROM\" -gt 1 ]; then
+    printf '%s\\n' \"\$ALL\" | awk -v kf=\"\$KEEP_FROM\" 'NR < kf' | while read r; do
+        CUR=\$(readlink \$CURRENT 2>/dev/null || true)
+        [ \"\$r\" = \"\$CUR\" ] || rm -rf \"\$r\"
+    done
+fi
 echo RELEASE_OK@\"\$RELDIR\""
 if run_ssh "$TARGET" "$REMOTE_COMMAND"; then
     printf 'Release active: /mmc/mk8/releases/%s\n' "$RELEASE_TS"