Abort the install when an upgrade migration fails (#1497)

Dashboard/AddServerDialog.xaml

@@ -34,6 +34,7 @@
                 <TextBlock Text="Server Name/Address:" FontWeight="Bold" Margin="0,0,0,4"
                            Foreground="{DynamicResource ForegroundBrush}"/>
                 <TextBox x:Name="ServerNameTextBox" Margin="0,0,0,12"
+                         TextChanged="ServerNameTextBox_TextChanged"
                          ToolTip="e.g., localhost, server.domain.com, 192.168.1.100, server\instance"/>
 
                 <!-- Display Name -->
@@ -218,6 +219,12 @@
                     <StackPanel Margin="16,8,0,0">
                         <CheckBox x:Name="CleanInstallCheckBox"
                                   Content="Perform clean install (drops existing database)"
+                                  Checked="CleanInstallCheckBox_Checked"
+                                  Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,0,4"/>
+                        <CheckBox x:Name="RepairCheckBox"
+                                  Content="Repair: reinstall objects, skip upgrade scripts"
+                                  Checked="RepairCheckBox_Checked"
+                                  ToolTip="Use when an upgrade fails because a table or object is missing or damaged. Reinstalls the schema objects without running migrations and without dropping the database. The pending upgrade still needs to run afterwards."
                                   Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,0,4"/>
                         <CheckBox x:Name="ResetScheduleCheckBox"
                                   Content="Reset collection schedule to defaults"

Dashboard/Services/ServerManager.cs

@@ -272,15 +272,35 @@ IF EXISTS (SELECT 1 FROM msdb.dbo.sysjobs WHERE name = N'PerformanceMonitor - Hu
             jobCmd.CommandTimeout = 30;
             await jobCmd.ExecuteNonQueryAsync();
 
-            // Close active connections before dropping
+            // Close active connections before dropping.
+            // EngineEdition 8 = Azure SQL Managed Instance, where SINGLE_USER is non-modifiable (the batch
+            // would die on that line); gate it to box SQL Server and let MI DROP directly. Mirrors
+            // InstallationService.CleanInstallAsync.
             using var killCmd = new SqlCommand(@"
                 IF DB_ID('PerformanceMonitor') IS NOT NULL
                 BEGIN
-                    ALTER DATABASE [PerformanceMonitor] SET SINGLE_USER WITH ROLLBACK IMMEDIATE;
+                    IF SERVERPROPERTY('EngineEdition') <> 8
+                        ALTER DATABASE [PerformanceMonitor] SET SINGLE_USER WITH ROLLBACK IMMEDIATE;
                     DROP DATABASE [PerformanceMonitor];
                 END", connection);
             killCmd.CommandTimeout = 30;
-            await killCmd.ExecuteNonQueryAsync();
+            try
+            {
+                await killCmd.ExecuteNonQueryAsync();
+            }
+            catch
+            {
+                // A DROP that fails or times out after SINGLE_USER committed strands the database
+                // semi-bricked. Un-brick best-effort on a fresh connection, then re-raise the original error.
+                connection.Close();
+                bool restored = await InstallationService.TryRestoreDatabaseAccessAsync(builder.ConnectionString);
+                if (!restored)
+                {
+                    Logger.Warning($"Drop failed on '{server.DisplayName}' and the database may be left in " +
+                        "SINGLE_USER mode; re-run the clean install to recover, or ALTER DATABASE ... SET MULTI_USER manually.");
+                }
+                throw;
+            }
 
             Logger.Info($"Dropped PerformanceMonitor database and Agent jobs on '{server.DisplayName}'");
         }

Installer.Core/InstallGuard.cs

@@ -0,0 +1,74 @@
+namespace Installer.Core;
+
+/// <summary>Why installing against a server would be unsafe.</summary>
+public enum InstallBlock
+{
+    /// <summary>Safe to install.</summary>
+    None,
+
+    /// <summary>
+    /// This binary's own version will not parse. It is what a FRESH install writes to
+    /// <c>installation_history.installer_version</c>, so letting it through poisons a brand-new server's
+    /// ledger at birth — after which every surface refuses to touch that server again.
+    /// </summary>
+    UnreadableBuildVersion,
+
+    /// <summary>
+    /// The version recorded on the server will not parse, so we cannot tell which migrations still apply.
+    /// </summary>
+    UnreadableInstalledVersion,
+
+    /// <summary>
+    /// The server is on a NEWER build than this binary. Installing would run our older scripts over it —
+    /// reverting every <c>CREATE OR ALTER</c> procedure and view to their older definitions — and then
+    /// record the LOWER version as SUCCESS. A silent downgrade.
+    /// </summary>
+    InstalledIsNewerThanBuild,
+}
+
+/// <summary>
+/// The decision behind both installers' pre-install blocks.
+///
+/// Two of these cases are invisible to every other guard: they produce ZERO upgrade hops AND ZERO
+/// failures, so the migration-failure abort never fires and nothing downstream notices. That is what
+/// makes them dangerous, and why the decision lives here — shared and pinned — rather than hand-copied
+/// into a WPF code-behind and a CLI Main.
+/// </summary>
+public static class InstallGuard
+{
+    /// <param name="installedVersion">The version recorded on the server; null when nothing is installed.</param>
+    /// <param name="buildVersion">The version of the binary about to run.</param>
+    public static InstallBlock Check(string? installedVersion, string? buildVersion)
+    {
+        var build = ScriptProvider.TryParseVersionCore(buildVersion);
+
+        /*
+        Checked first, and independently of whether anything is installed: a fresh install WRITES this
+        value, so an unreadable one is fatal even on an empty server.
+        */
+        if (build == null)
+        {
+            return InstallBlock.UnreadableBuildVersion;
+        }
+
+        if (installedVersion == null)
+        {
+            /* Nothing installed: a fresh install is safe. */
+            return InstallBlock.None;
+        }
+
+        var installed = ScriptProvider.TryParseVersionCore(installedVersion);
+
+        if (installed == null)
+        {
+            return InstallBlock.UnreadableInstalledVersion;
+        }
+
+        if (installed > build)
+        {
+            return InstallBlock.InstalledIsNewerThanBuild;
+        }
+
+        return InstallBlock.None;
+    }
+}