Cancel active provisioning jobs when rolling back betas

docs/provisioning.md

@@ -154,6 +154,20 @@ heartbeat or completion-time promises.
 - `/api/provisioning/:id`, `/:id/resume`, `/:id/cancel`, `/preview`, and
   `/house-party` preserve the existing operation, recovery, removal cancellation,
   launch preview, and fleet destruction APIs.
+- `POST /api/provisioning/:id/cancel` cancels any active create, start, restart,
+  rebuild, stop, or destroy job, including health verification. It releases that
+  job's recovery capacity and prevents further steps; completed effects are not
+  undone. Undelivered host commands are withdrawn. Commands already delivered
+  retain their receipts, and replacements wait for those mutations to settle.
+  Cancelling is idempotent. Lists and details expose `canCancel`.
+- `POST /api/provisioning/:id/cancel-creation` retains the explicit native creation
+  cleanup action: cancel the launch and remove its partial instance. Cancelling
+  a job alone retains its existing instance/files for inspection or later cleanup.
+- Beta rollback cancels conflicting provisioning jobs on its original servers
+  before queuing independent restoration restarts. It does not wait for the
+  superseded restart's health verification. Native activation receipts must still
+  provide durable before images; rollback reconciles completed receipts itself.
+  Manual rollback keeps the replacement jobs held until the campaign is resumed.
 - `GET /api/provisioning/:id?events=recent` returns the same detail with five recent
   events plus activity totals/latest ID and a failure excerpt. Omitting the option
   preserves the full legacy event response. Progress, capacity, named related work,

docs/ui-ux-implementation.md

@@ -14,7 +14,7 @@ The changes prioritize clear operational outcomes, reviewed action scope, recove
 | 4. Beta reading order | Outcome, blockers, deadline, actions, and server results precede evidence and activity. Shared activity history is collapsed, searchable, ordered, and progressively displayed. |
 | 5. Beta recovery | Deadlines and pause/retry consequences are explicit. A fresh attempt confirms evidence reset and restarts; expired tests explain rollback and plan reuse. Sign-off availability follows test/run readiness. |
 | 6. Launch input retention | Refreshing previews retains entered keys only for unchanged exact server IDs. Changed assignments are explained. Keys remain in memory; managing keys in another tab preserves the launch context. |
-| 7. Removal cancellation | Waiting removals can be withdrawn from operation lists/details. A database transition competes atomically with the worker claim before external deletion. Once removal or confirmed-deletion cleanup begins, cancellation is unavailable. |
+| 7. Provisioning cancellation | Active jobs can be cancelled from operation lists/details, including restarts and health verification. Remaining steps stop; effects already performed are retained. Rollback supersedes conflicting jobs with fresh restoration requests. |
 | 8. Partial outcomes | Reconciliation reports updated and skipped servers separately, with reasons and follow-up links. All-skipped work is an error outcome. Rollback feedback stays beside its initiating operation. |
 | 9. Scope clarity | Scope editing previews added/removed eligible servers. Script/plugin unscoping explains retained live copies and tracking detachment; configs explain composition impact. Completion links to reconciliation. Eligibility, promoted versions, and installed inventory have separate labels. |
 | 10. Accessible controls | Busy buttons retain their accessible names. Field labels focus the associated native control. Consequential errors use alert semantics; completion uses status semantics. Campaign server states have accessible descriptions. |
@@ -43,7 +43,7 @@ Activity and notifications have been removed. Copy results appear next to their
 
 - Promotion uses `GET /api/betas/:id/promote` to review impact and `POST` with the returned token as `previewToken` to apply it. A changed plan returns HTTP 409 and needs renewed review.
 - Reconciliation uses `POST /api/drift` with `dryRun: true` and optional `servers`, then executes with the returned `expectedFingerprint`. Omitted servers explicitly mean the entire fleet. A stale review returns HTTP 409; changes detected during application are reported as skipped files.
-- `POST /api/deployments/:id/cancel` only withdraws a waiting removal. It does not restore a server after deletion has started.
+- `POST /api/deployments/:id/cancel` cancels remaining provisioning work, including restarts and health checks. It does not undo changes already made.
 - System status exposes no credential values. Its optional connection check verifies Komodo network reachability, not credential validity. Remote game-file volumes remain explicitly unverified.
 - Drafts contain nonsecret beta setup. Launch keys are not stored in browser drafts.
 - Log search/export covers the loaded tail, not an entire remote file or a full diagnostic archive.