Beta: clean up servers that opted out while the bot was offline

The bot remembers where it registered beta commands (beta_registered) and
removes them from servers that are no longer in the beta at the next start.
Failed cleanups are retried; a server the bot has left is forgotten.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

docs/architecture.md

@@ -84,7 +84,7 @@ Some commands have a response that takes longer than three seconds (anything tha
 | Schedule reminders | `events/schedule_reminders.go` | 1 min | DMs participants 10 minutes before a session |
 | Raid watch | `security` | 30 s | Ends raid mode after a quiet period |
 | Snapshots | `security` | 6 h | Saves roles and channels while anti-nuke is on (keeps three) |
-| Beta settings | `bot/bot.go` (`WatchBeta`) | 30 s | Re-reads who the beta testers are |
+| Beta settings | `bot/bot.go` (`WatchBeta`) | 30 s | Re-reads who the beta testers are and which servers opted in, and adds or removes beta commands to match |
 | Command listeners | music, tickets, security | on `NOTIFY` | Carry out dashboard requests |
 
 ## The link to the dashboard

docs/beta-features.md

@@ -37,7 +37,7 @@ Code: `internal/beta` (the rules), `internal/commands/commands.go` (`RegisterBet
 - For a person using a command in another server, the bot looks up their roles in the beta server: first in its gateway cache, otherwise it asks Discord (remembered for 30 seconds). If anything fails, the answer is no.
 - If the owner changes the beta server on the dashboard, the beta commands move within 30 seconds. In the beta server, commands this bot left there that no longer exist are removed too. If the beta server is also `GUILD_ID`, the regular commands are kept.
 - `/beta` shows the bot's owner how access is set up. Only the owner of the Discord application can run it, and it is hidden from everyone but administrators.
-- A server that opted out while the bot was **offline** keeps its beta commands in the menu until someone removes them. Using one still fails, because the gate checks every time.
+- The bot remembers the servers where it registered beta commands (`beta_registered` table). A server that opted out while the bot was **offline** is cleaned up on the next start, and a cleanup that fails is retried every 30 seconds. A server the bot has left is forgotten.
 
 ### Add a beta command
 

docs/database.md

@@ -33,7 +33,7 @@ Two things only exist in the API's migrations, because the bot never inserts int
 | Music | `music_settings`, `music_now_playing`, `music_queue`, `music_commands` | State for the dashboard's player, plus requests from the dashboard |
 | Tickets | `ticket_settings`, `ticket_categories`, `tickets`, `ticket_commands` | |
 | Security | `security_settings`, `security_trusted`, `security_quarantines`, `security_lockdowns`, `security_raids`, `security_raid_caught`, `security_snapshots`, `security_events`, `security_commands` | Settings, who is trusted, quarantines (with the roles to give back), locked channels (with the permission to restore), raids in progress, snapshots, an event history, and dashboard requests |
-| Beta | `beta_settings`, `beta_guilds` | `beta_settings` is one row: the beta server and the Beta Tester role. `beta_guilds` lists servers whose owner opted in to beta features. Written by the dashboard, read by the bot |
+| Beta | `beta_settings`, `beta_guilds` | `beta_settings` is one row: the beta server and the Beta Tester role. `beta_guilds` lists servers whose owner opted in to beta features. Both are written by the dashboard and read by the bot. `beta_registered` is the bot's own note of where it registered beta commands |
 
 Discord IDs are `BIGINT` (snowflakes fit in 64 bits). In Go they are `int64`; Discord's own API gives them to you as strings, so convert at the edge.