deploy: never --delete into the phone's tree

It is not a git repo, it gets edited on the device, and this path had no
snapshot while the local compose path has had one all along. Now it snapshots
to ~/souveraine-surfaces/.quickshell-previous, copies by checksum, and only
reports phone-only files instead of destroying them.

surfaces/quickshell/deploy.sh

@@ -18,7 +18,10 @@
 #   deploy.sh -u           remove the souveraine config dir (ii untouched)
 #   deploy.sh --legacy-clean  remove the OLD overlay symlinks from ii and
 #                          restore its .upstream backups (one-time migration)
-#   deploy.sh --phone      rsync this surface to the phone and deploy there
+#   deploy.sh --phone      copy this surface to the phone and deploy there.
+#                          NEVER deletes on the device: it snapshots the phone's
+#                          tree first, copies by checksum, and only *reports*
+#                          files that exist solely on the phone.
 set -euo pipefail
 
 SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -246,7 +249,44 @@ if [[ "${1:-}" == "--phone" ]]; then
         fi
     fi
     "${ssh_i[@]}" "$PHONE_USB" "mkdir -p ~/$PHONE_DEST"
-    rsync -a --delete -e "ssh -F /dev/null -i $HOME/.ssh/ani" "$SRC/" "$PHONE_USB:$PHONE_DEST/"
+
+    # NEVER --delete into the phone's tree.
+    #
+    # `~/souveraine-surfaces` on the device is not a git repo — nothing there has
+    # history — and files get edited directly on the phone. This path used to be
+    # `rsync -a --delete` with no snapshot, so an on-device edit was destroyed
+    # with no record that it had existed. It cost real work more than once, and
+    # it is the root of both the ~900-file ii drift and the stevia pkgrels that
+    # only ever existed on the phone.
+    #
+    # Note the asymmetry that made it survive: the LOCAL compose path below
+    # snapshots to .ii-previous/.souveraine-previous before it switches
+    # anything. Only the phone — the one machine that is a daily driver and has
+    # no history — was handled without one.
+    #
+    # So: snapshot first, copy without deleting, and REPORT what a --delete
+    # would have taken. Divergence becomes visible instead of being silently
+    # resolved in the laptop's favour.
+    PHONE_SNAPSHOT="souveraine-surfaces/.quickshell-previous"
+    if ! "${ssh_i[@]}" "$PHONE_USB" \
+        "mkdir -p ~/$PHONE_SNAPSHOT && rsync -a --delete ~/$PHONE_DEST/ ~/$PHONE_SNAPSHOT/"; then
+        echo "ERROR: could not snapshot the phone's surface tree — refusing to write to it" >&2
+        exit 1
+    fi
+    echo "phone tree snapshotted to ~/$PHONE_SNAPSHOT"
+
+    # What a --delete would have destroyed. Listed, never removed.
+    phone_only="$(rsync -ain --delete -e "ssh -F /dev/null -i $HOME/.ssh/ani" \
+        "$SRC/" "$PHONE_USB:$PHONE_DEST/" 2>/dev/null | sed -n 's/^deleting //p')"
+    if [[ -n "$phone_only" ]]; then
+        echo "phone-only files LEFT IN PLACE (a --delete would have destroyed these):" >&2
+        printf '%s\n' "$phone_only" | sed 's/^/  /' >&2
+        echo "  → if any of that is work you want, copy it back into the repo now." >&2
+    fi
+
+    # Checksum, not timestamp. Plain -a reports files that differ only in mtime
+    # from earlier hand copies, which lies about what is actually changing.
+    rsync -ac -e "ssh -F /dev/null -i $HOME/.ssh/ani" "$SRC/" "$PHONE_USB:$PHONE_DEST/"
     printf '%s\n' "$deployed_revision" \
         | "${ssh_i[@]}" "$PHONE_USB" "cat > ~/$PHONE_DEST/DEPLOYED-REVISION"
     "${ssh_i[@]}" "$PHONE_USB" "bash ~/$PHONE_DEST/deploy.sh"