Block server destruction while linked to an active beta

Protect individual, bulk, and queued removals and rebuilds until beta closure. Recheck ownership before teardown and reject beta admission during pending or unresolved destruction.

Fixes #36

src/lib/server/fleet/beta.ts

@@ -357,6 +357,14 @@ export async function openBeta(input: OpenBetaInput): Promise<OpenBetaResult> {
     for (const name of input.servers) {
         const row = getServer(name);
         if (!row) throw new BetaError(`unknown server: ${name}`, 'unknown-server');
+        // Once teardown is queued or in flight, opening a beta cannot safely
+        // claim the instance. A failed remote request may still be running.
+        const removal = db().prepare(`SELECT id FROM server_deployments WHERE server = ? AND server_deleted_at IS NULL
+            AND action IN ('destroy', 'rebuild') AND (state IN ('waiting', 'queued', 'running', 'awaiting-health')
+                OR (state IN ('failed', 'interrupted') AND stage IN (
+                    'Stopping and removing container', 'Deleting Komodo deployment', 'Removing server files and registry')))
+            LIMIT 1`).get(name);
+        if (removal) throw new BetaError(`${name}: cancel or finish the pending destruction or rebuild before opening a beta.`, 'conflict');
         serverRows.push({ name, game: row.game, map: row.map });
     }
 

src/lib/server/fleet/collections.ts

@@ -9,7 +9,7 @@ import { deploymentStage, finishDeployment, recordDeploymentEvent } from './depl
 import { housePartyTargets } from './house-party.js';
 import { getServerKey } from './server-keys.js';
 import { serverObservation } from './status.js';
-import { getServer } from './servers.js';
+import { activeBetaRemovalBlocker, getServer } from './servers.js';
 import { parseServerName, zombieMapBySlug, zombieMaps } from './map-aliases.js';
 
 function coverage(entries: BlueprintEntry[]) {
@@ -93,6 +93,16 @@ function blockersFor(servers: CollectionPreview['servers']): string[] {
     return blockers;
 }
 
+function removalBlockersFor(removals: CollectionPreview['removals']): string[] {
+    const blockers: string[] = [];
+    if (removals.length && (!komodoConfigured() || !rconConfigured())) blockers.push('Configure Komodo and RCON before removing servers.');
+    for (const server of removals) {
+        const blocker = activeBetaRemovalBlocker(server.name);
+        if (blocker) blockers.push(blocker);
+    }
+    return blockers;
+}
+
 export function previewCollection(blueprintId: unknown, mode: unknown = 'fill'): CollectionPreview {
     if (typeof blueprintId !== 'string' || !blueprintId) throw new Error('Choose a collection to launch.');
     if (mode !== 'fill' && mode !== 'exact') throw new Error('Choose fill or exact collection mode.');
@@ -100,8 +110,7 @@ export function previewCollection(blueprintId: unknown, mode: unknown = 'fill'):
         const { entries, blueprintName } = blueprintEntries(blueprintId);
         const { counts, retainedServers, removals } = collectionPlan(entries, mode);
         const servers = allocate(entries, removals.map(server => server.name));
-        const blockers = blockersFor(servers);
-        if (removals.length && (!komodoConfigured() || !rconConfigured())) blockers.push('Configure Komodo and RCON before removing servers.');
+        const blockers = [...blockersFor(servers), ...removalBlockersFor(removals)];
         const id = randomUUID();
         const expiresAt = new Date(Date.now() + 30 * 60_000).toISOString();
         db().prepare('DELETE FROM server_collection_previews WHERE expires_at < ? AND collection_id IS NULL').run(new Date().toISOString());
@@ -132,8 +141,7 @@ export function queueCollection(input: { previewId?: unknown; keys?: unknown }):
         const { retainedServers, removals } = collectionPlan(entries, preview.mode);
         const releasingServers = removals.map(server => server.name);
         const servers = allocate(entries, releasingServers);
-        const blockers = blockersFor(servers);
-        if (removals.length && (!komodoConfigured() || !rconConfigured())) blockers.push('Configure Komodo and RCON before removing servers.');
+        const blockers = [...blockersFor(servers), ...removalBlockersFor(removals)];
         if (blockers.length) throw new Error(blockers.join(' '));
         if (servers.length !== reviewed.length || servers.some((server, i) => server.entryIndex !== reviewed[i]?.entryIndex || server.name !== reviewed[i]?.name || server.port !== reviewed[i]?.port)) {
             throw new Error('Fleet counts, lobby or port availability changed. Nothing was queued. Refresh the preview and review each server key.');
@@ -155,7 +163,8 @@ export function queueCollection(input: { previewId?: unknown; keys?: unknown }):
             if (queued && !getServer(server.name)) {
                 // No container or files exist yet: cancel the reservation instead of booting just to remove it.
                 const result = destroyServer(server.name, 'blueprint-exact');
-                if (!result.ok || !result.deploymentId) throw new Error('Could not queue removal for ' + server.name);
+                if (!result.ok) throw new Error(result.message);
+                if (!result.deploymentId) throw new Error('Could not queue removal for ' + server.name);
                 id = result.deploymentId;
                 db().prepare("UPDATE server_deployments SET state = 'cancelled', stage = 'Cancelled by exact collection', finished_at = ? WHERE id = ?").run(new Date().toISOString(), queued.id);
                 recordDeploymentEvent(queued.id, 'Queued creation cancelled by exact collection; saved key retained.');
@@ -163,7 +172,8 @@ export function queueCollection(input: { previewId?: unknown; keys?: unknown }):
                 finishDeployment(id, { ok: true });
             } else {
                 const result = destroyServer(server.name, 'blueprint-exact');
-                if (!result.ok || !result.deploymentId) throw new Error('Could not queue removal for ' + server.name);
+                if (!result.ok) throw new Error(result.message);
+                if (!result.deploymentId) throw new Error('Could not queue removal for ' + server.name);
                 id = result.deploymentId;
             }
             db().prepare('INSERT INTO server_collection_removals (collection_id, deployment_id, position) VALUES (?, ?, ?)').run(collectionId, id, position);

src/lib/server/fleet/servers.ts

@@ -153,6 +153,15 @@ export function listServers(): ServerRow[] {
     return db().prepare('SELECT * FROM servers WHERE destroyed_at IS NULL ORDER BY name').all() as ServerRow[];
 }
 
+/** Beta ownership lasts until explicit closure, regardless of test outcome or stage. */
+export function activeBetaRemovalBlocker(server: string): string | null {
+    const betas = db().prepare(`SELECT b.id FROM beta_servers bs JOIN betas b ON b.id = bs.beta_id
+        WHERE bs.server = ? AND bs.server_deleted_at IS NULL AND b.state IN ('running', 'ready-promote')
+        ORDER BY b.id`).all(server) as { id: number }[];
+    if (!betas.length) return null;
+    return `${server} is linked to active beta${betas.length === 1 ? '' : 's'} ${betas.map(beta => '#' + beta.id).join(', ')}. Promote or roll back the beta${betas.length === 1 ? '' : 's'} before destroying or rebuilding this server.`;
+}
+
 export function setServerField(
     name: string,
     field: keyof ServerRow,