Deploy: stop rsync --delete from wiping builder builds/ artifacts.

Exclude builds/ and .docker from broadcast sync; re-run prepare-be-builder-dirs
after deploy so nobody retains write access to artifact trees.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh

@@ -12,12 +12,21 @@ DOWNLOADS="${2:-/var/www/localhost/htdocs/apps/app/androidcast_project/downloads
 OTA_ROOT="${3:-/var/www/localhost/htdocs/apps/app/androidcast_project/ota-artifacts}"
 
 mkdir -p "${BUILDS}" "${DOCKER_HOME}/.docker" "${DOWNLOADS}" "${OTA_ROOT}/v0/ota/channel"
-chown -R nginx:nginx "${BROADCAST_ROOT}" "${DOWNLOADS}" "${OTA_ROOT}" 2>/dev/null || true
+
+# Do not chown -R broadcast root: that resets builds/* to nginx and breaks PHP-FPM (nobody).
+for _d in config bin deploy sql src public; do
+  if [ -d "${BROADCAST_ROOT}/${_d}" ]; then
+    chown -R nginx:nginx "${BROADCAST_ROOT}/${_d}" 2>/dev/null || true
+  fi
+done
+chown -R nginx:nginx "${DOWNLOADS}" "${OTA_ROOT}" 2>/dev/null || true
 chmod -R 775 "${DOWNLOADS}" "${OTA_ROOT}" 2>/dev/null || true
 
 # PHP-FPM www pool is often nobody; artifact dirs must be writable by that user.
 chown nobody:nginx "${BUILDS}" 2>/dev/null || true
 chmod 2775 "${BUILDS}" 2>/dev/null || true
+find "${BUILDS}" -mindepth 1 -maxdepth 1 -type d -exec chown nobody:nginx {} \; 2>/dev/null || true
+find "${BUILDS}" -mindepth 1 -maxdepth 1 -type d -exec chmod 2775 {} \; 2>/dev/null || true
 chown nobody:nobody "${DOCKER_HOME}/.docker" 2>/dev/null || true
 chmod 775 "${DOCKER_HOME}/.docker" 2>/dev/null || true
 

sim/cluster0/scripts/deploy-ac-broadcast.sh

@@ -21,10 +21,12 @@ else
 fi
 
 log "deploy ac-ms-broadcast → ${BROADCAST_DEST}"
-mkdir -p "$BROADCAST_DEST"
+mkdir -p "$BROADCAST_DEST/builds" "$BROADCAST_DEST/.docker"
 rsync -a --delete \
   --exclude='.git' \
   --exclude='config/config.php' \
+  --exclude='builds/' \
+  --exclude='.docker/' \
   "${BROADCAST_SRC}/" "${BROADCAST_DEST}/" 2>/dev/null || \
   { mkdir -p "$BROADCAST_DEST"; cp -r "${BROADCAST_SRC}/." "${BROADCAST_DEST}/"; }
 
@@ -66,6 +68,16 @@ return [
 PHPEOF
 
 chown -R nginx:nginx "$BROADCAST_DEST" 2>/dev/null || true
+# Preserve builder artifact ownership (PHP-FPM user nobody).
+PREP="${ROOT}/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh"
+if [ -f "$PREP" ]; then
+  sh "$PREP" "$BROADCAST_DEST"
+else
+  chown nobody:nginx "$BROADCAST_DEST/builds" 2>/dev/null || true
+  chmod 2775 "$BROADCAST_DEST/builds" 2>/dev/null || true
+  chown nobody:nobody "$BROADCAST_DEST/.docker" 2>/dev/null || true
+  chmod 775 "$BROADCAST_DEST/.docker" 2>/dev/null || true
+fi
 
 # DB schema + user — primary node only
 if is_primary_node; then