A failed fix deploy now keeps the fix open on its path

Satsuma builds and runs products: sets of smart contracts on its own chain, some of which hold funds. When a problem is found in one, the fix travels a governed path: a rebuild, a deploy, and a vote that marks the problem resolved. For a product that holds money, the fix is a migration: a successor contract is deployed and the position moves to it. Two changes to that path landed in the system.

The first: only a successful deploy closes a fix. A failed deploy is now recorded as failed, and the issue stays open. In a governed run, a successor deploy failed on a check in the builder's own script, and the process wrongly cleared the migration anyway. The migration record was restored by hand.

The second: the rebuild that returns the deploy log to the builder keeps the instructions for the migration and the contract sources already deployed.

Both changes were merged. Still open: fixes do not yet arrive as pull requests against the products' own code, a swap count resets to zero after a migration, and a change of address in one product is not passed on to the products that depend on it.