Add verifiable atomic server updates

README.md

@@ -7,14 +7,20 @@ repository so clients and servers use the same protocol implementation.
 ## Stage a build
 
 Export the `Linux Dedicated Server` preset from the game project, then stage
-its executable and PCK:
+its executable and PCK with the exact game version and source commit:
 
 ```sh
-./scripts/stage-build.sh ../netfishing/builds/vX.Y.Z-alpha/server-linux-x86_64
+game_commit="$(git -C ../netfishing rev-parse HEAD)"
+./scripts/stage-build.sh \
+  ../netfishing/builds/vX.Y.Z-alpha/server-linux-x86_64 \
+  X.Y.Z-alpha \
+  "${game_commit}"
 ```
 
 The staged binaries under `dist/` are release inputs and are intentionally not
-tracked by Git.
+tracked by Git. `dist/BUILD_INFO` records the version, full game commit, export
+preset, platform, and binary hashes. Packaging refuses a version mismatch or
+failed internal checksum.
 
 Create a deterministic native archive after staging:
 
@@ -22,17 +28,25 @@ Create a deterministic native archive after staging:
 ./scripts/package-native.sh X.Y.Z-alpha
 ```
 
-## Run natively
+## Install or update natively
 
-Copy `dist/NETfishingServer.x86_64` and `dist/NETfishingServer.pck` into the
-same directory, make the executable runnable, and start it with a persistent
-data directory:
+The native archive contains its `BUILD_INFO` and internal checksums. Transfer
+both the archive and its adjacent `.sha256` file, then install it:
 
 ```sh
-./NETfishingServer.x86_64 \
-	-- \
-  --config=/etc/netfishing-server.cfg \
-  --data-dir=/var/lib/netfishing-server
+sudo ./scripts/install-native-release.sh \
+  packages/netfishing-dedicated-server-X.Y.Z-alpha-linux-x86_64.tar.gz \
+  packages/netfishing-dedicated-server-X.Y.Z-alpha-linux-x86_64.tar.gz.sha256
+```
+
+Releases are immutable directories under `/opt/netfishing-server/releases`.
+The installer verifies the outer archive hash, internal hashes, manifest, and
+platform before atomically changing `/opt/netfishing-server/current`. When the
+sample systemd unit is already active, a failed start automatically restores
+the prior release. Manually return to the recorded previous release with:
+
+```sh
+sudo ./scripts/rollback-native.sh
 ```
 
 Copy `config/server.cfg.example` to `/etc/netfishing-server.cfg` and adjust the
@@ -53,16 +67,31 @@ standalone `--` shown above; it separates Godot engine flags from server flags.
 Public listing requires the discovery URL and a publicly reachable ENet UDP
 port. Discovery makes a server findable but does not relay gameplay traffic.
 
-For a systemd installation, create a dedicated `netfishing` system user, place
-the two staged build files in `/opt/netfishing-server`, install the sample
-configuration and environment files under `/etc`, and copy
-`systemd/netfishing-server.service` to the system unit directory. The service
-expects `/var/lib/netfishing-server` to be writable by that user.
+For a systemd installation, create a dedicated `netfishing` system user,
+install the sample configuration and environment files under `/etc`, and copy
+`systemd/netfishing-server.service` to the system unit directory. The unit runs
+the atomic `current` release link and expects `/var/lib/netfishing-server` to be
+writable by that user. When migrating an older direct-path installation, stop
+the service, run the installer once, replace/reload the unit, and then start it.
+After that one-time migration, future upgrades can be applied while the unit
+is running.
+
+For a direct foreground run from staged build inputs:
+
+```sh
+./dist/NETfishingServer.x86_64 \
+  -- \
+  --config=/etc/netfishing-server.cfg \
+  --data-dir=/var/lib/netfishing-server
+```
 
 ## Run with Docker Compose
 
 ```sh
-./scripts/stage-build.sh ../netfishing/builds/vX.Y.Z-alpha/server-linux-x86_64
+./scripts/stage-build.sh \
+  ../netfishing/builds/vX.Y.Z-alpha/server-linux-x86_64 \
+  X.Y.Z-alpha \
+  "$(git -C ../netfishing rev-parse HEAD)"
 docker compose build
 docker compose up -d
 ```