fix: reconcile command-less serve shapes in applyManifest

[m4ttheweric]

Follow-up to #7, closing the deferred CodeRabbit finding on applyManifest.

Problem

applyManifest only reconciled an existing record's serve shape when the resolved shape carried a start command (else if (shape.command)). Two consequences:

• A port-only app activating a port-only alt returned success but kept its base port and route ... deck alt was a silent no-op for routing.
• A supervised app whose manifest dropped commands.start silently kept its old launchd service.

Fix

The existing-record branch now handles every resolved shape:

• port-only (external) app, port changed → editApp({ port }) propagates the new port + route alias. editApp's external path updates the portless alias without touching launchd, so deck alt actually re-routes.
• external → service (start added) → 400 refusal. editApp keeps a record's kind, so it would set a command but never install launchd, leaving a route-only app with a command and no service. Refuse rather than half-apply; deck remove + re-register is the explicit path.
• service → route-only (start dropped) → 400 refusal. Tearing a live service down to route-only is a structural change editApp doesn't perform; refusing beats silently keeping the stale service.

A full kind-transition capability in editApp (both directions, in place) is deliberately out of scope ... the refusals turn a silent wrong-state into a clear, actionable error, which is the actual defect.

Behavior note

External-app port changes now flow through editApp on every alt toggle / manifest edit, where they previously no-opped. External / staticPort ports are exempt from deck's port-collision check by design (they're the user's own process, not deck's to arbitrate), so two external apps can be aliased to the same port with no 409. This is consistent with the existing stance for that field, not a new arbitration; calling it out since the pathway is now reachable more often.

Testing

• Full unit suite bun test core src = 515 pass / 0 fail (512 baseline + 3 new).
• New tests assert real state (record kind/port/command and the edge.aliases route map), not just status codes: port-only alt re-points the route; external→service refused with kind unchanged; service→route-only refused with the service kept.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 49 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 423c37ce-7b82-4560-910b-d8ffc0ab2966

📥 Commits

Reviewing files that changed from the base of the PR and between 195d9a2 and 9f5e2ac.

📒 Files selected for processing (2)

• src/api/register-manifest.test.ts
• src/api/register-manifest.ts

---

_{Comment @coderabbitai help to get the list of available commands.}