@quenty/datastore 13.51.0 → 13.52.0

package/src/Server/PlayerDataStoreManager.SessionLockTools.spec.lua

@@ -0,0 +1,228 @@
+--!strict
+--[[
+	The raw session-lock path: reading and writing the lock on a key without opening a session on it.
+	Usually the target is a player who is not in this server, but the write is deliberately permitted
+	against a live local session too -- see the last describe block.
+
+	@class PlayerDataStoreManager.SessionLockTools.spec.lua
+]]
+local require = require(script.Parent.loader).load(script)
+
+local DataStoreTestUtils = require("DataStoreTestUtils")
+local Jest = require("Jest")
+local PromiseTestUtils = require("PromiseTestUtils")
+
+local describe = Jest.Globals.describe
+local expect = Jest.Globals.expect
+local it = Jest.Globals.it
+
+local FOREIGN_SESSION = {
+	SessionId = "foreign-session",
+	PlaceId = 123,
+	JobId = "foreign-job",
+}
+
+local function seedForeignLock(mock, key: string, profile: { [string]: any }?)
+	local data: { [string]: any } = profile or {}
+	data.lock = {
+		LastUpdateTime = os.time(),
+		ActiveSession = FOREIGN_SESSION,
+	}
+	mock:SetRaw(key, data)
+end
+
+-- Returns the resolved value, or fails the spec and returns nil.
+local function awaitValue(promise, label: string): any
+	if not PromiseTestUtils.awaitSettled(promise, 10) then
+		expect(`{label} hung`).toEqual(`{label} settled`)
+		return nil
+	end
+
+	local ok, value = promise:Yield()
+	expect(ok).toEqual(true)
+	return value
+end
+
+describe("PlayerDataStoreManager.PromiseReadSessionLock", function()
+	it("resolves nil for a key that was never written", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		local lock = awaitValue(controller.manager:PromiseReadSessionLock(1), "read")
+		expect(lock).toBeNil()
+
+		controller:destroy()
+	end)
+
+	it("reports the session holding a foreign lock", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		seedForeignLock(controller.mock, "user_1", { coins = 5 })
+
+		local lock = awaitValue(controller.manager:PromiseReadSessionLock(1), "read")
+		expect(lock).never.toBeNil()
+		expect(lock.ActiveSession).toEqual(FOREIGN_SESSION)
+
+		controller:destroy()
+	end)
+
+	it("resolves nil for a stored profile with no lock", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		controller.mock:SetRaw("user_1", { coins = 5 })
+
+		local lock = awaitValue(controller.manager:PromiseReadSessionLock(1), "read")
+		expect(lock).toBeNil()
+
+		controller:destroy()
+	end)
+end)
+
+describe("PlayerDataStoreManager.PromiseUnlockSession", function()
+	it("clears a foreign lock and reports what it cleared", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		seedForeignLock(controller.mock, "user_1", { coins = 5 })
+
+		local previous = awaitValue(controller.manager:PromiseUnlockSession(1), "unlock")
+		expect(previous).never.toBeNil()
+		expect(previous.ActiveSession).toEqual(FOREIGN_SESSION)
+
+		expect(controller.mock:GetRaw("user_1").lock).toBeNil()
+
+		controller:destroy()
+	end)
+
+	it("leaves the rest of the profile untouched", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		seedForeignLock(controller.mock, "user_1", { coins = 5, level = 3 })
+
+		awaitValue(controller.manager:PromiseUnlockSession(1), "unlock")
+
+		local raw = controller.mock:GetRaw("user_1")
+		expect(raw.coins).toEqual(5)
+		expect(raw.level).toEqual(3)
+
+		controller:destroy()
+	end)
+
+	it("resolves nil on an already-unlocked key", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		controller.mock:SetRaw("user_1", { coins = 5 })
+
+		local previous = awaitValue(controller.manager:PromiseUnlockSession(1), "unlock")
+		expect(previous).toBeNil()
+
+		controller:destroy()
+	end)
+
+	it("does not create an entry for a key that was never written", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		awaitValue(controller.manager:PromiseUnlockSession(1), "unlock")
+
+		expect(controller.mock:GetRaw("user_1")).toBeNil()
+
+		controller:destroy()
+	end)
+end)
+
+describe("PlayerDataStoreManager.PromiseLockSession", function()
+	it("claims an unlocked key", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		controller.mock:SetRaw("user_1", { coins = 5 })
+
+		local previous = awaitValue(controller.manager:PromiseLockSession(1), "lock")
+		expect(previous).toBeNil()
+
+		local lock = awaitValue(controller.manager:PromiseReadSessionLock(1), "read")
+		expect(lock).never.toBeNil()
+		expect(lock.ActiveSession.PlaceId).toEqual(game.PlaceId)
+		expect(controller.mock:GetRaw("user_1").coins).toEqual(5)
+
+		controller:destroy()
+	end)
+
+	it("reports the lock it replaced", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		seedForeignLock(controller.mock, "user_1", { coins = 5 })
+
+		local previous = awaitValue(controller.manager:PromiseLockSession(1), "lock")
+		expect(previous).never.toBeNil()
+		expect(previous.ActiveSession).toEqual(FOREIGN_SESSION)
+
+		controller:destroy()
+	end)
+
+	it("claims a key that was never written", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		awaitValue(controller.manager:PromiseLockSession(1), "lock")
+
+		local lock = awaitValue(controller.manager:PromiseReadSessionLock(1), "read")
+		expect(lock).never.toBeNil()
+
+		controller:destroy()
+	end)
+end)
+
+describe("PlayerDataStoreManager raw lock writes against a live session", function()
+	-- Allowed on purpose: pulling the key out from under a live local session is the failure the
+	-- lock/unlock debug tools exist to provoke. See PlayerDataStoreManager._promiseWriteRawSessionLock.
+	it("writes the lock while this server holds a session for that user", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		if not controller.storeAndAwaitLock() then
+			expect("lock was never acquired").toEqual("lock was acquired")
+			controller:destroy()
+			return
+		end
+
+		local previous = awaitValue(controller.manager:PromiseUnlockSession(1), "unlock")
+		expect(previous).never.toBeNil()
+		expect(previous.ActiveSession.JobId).toEqual(game.JobId)
+		expect(controller.mock:GetRaw("user_1").lock).toBeNil()
+
+		controller:destroy()
+	end)
+
+	it("still serves a read while this server holds a session", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		if not controller.storeAndAwaitLock() then
+			expect("lock was never acquired").toEqual("lock was acquired")
+			controller:destroy()
+			return
+		end
+
+		local lock = awaitValue(controller.manager:PromiseReadSessionLock(1), "read")
+		expect(lock).never.toBeNil()
+		expect(lock.ActiveSession.JobId).toEqual(game.JobId)
+
+		controller:destroy()
+	end)
+
+	it("writes once the session has been removed", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		if not controller.storeAndAwaitLock() then
+			expect("lock was never acquired").toEqual("lock was acquired")
+			controller:destroy()
+			return
+		end
+
+		if not PromiseTestUtils.awaitSettled(controller.promiseShutdown({ 1 }), 10) then
+			expect("shutdown hung").toEqual("shutdown settled")
+			controller:destroy()
+			return
+		end
+
+		awaitValue(controller.manager:PromiseLockSession(1), "lock")
+		expect(controller.mock:GetRaw("user_1").lock).never.toBeNil()
+
+		controller:destroy()
+	end)
+end)

package/src/Server/PlayerDataStoreManager.lua

@@ -51,16 +51,21 @@
 
 local require = require(script.Parent.loader).load(script)
 
+local HttpService = game:GetService("HttpService")
 local Players = game:GetService("Players")
 local RunService = game:GetService("RunService")
 
 local BaseObject = require("BaseObject")
 local BindToCloseService = require("BindToCloseService")
 local DataStore = require("DataStore")
+local DataStoreLockUtils = require("DataStoreLockUtils")
+local DataStorePromises = require("DataStorePromises")
 local Maid = require("Maid")
 local PendingPromiseTracker = require("PendingPromiseTracker")
+local PlayerDataStoreHandle = require("PlayerDataStoreHandle")
 local PlayerMock = require("PlayerMock")
 local Promise = require("Promise")
+local PromiseRetryUtils = require("PromiseRetryUtils")
 local PromiseUtils = require("PromiseUtils")
 local ServiceBag = require("ServiceBag")
 
@@ -81,9 +86,15 @@ export type PlayerDataStoreManager =
 			_datastores: { [PlayerUserId]: DataStore.DataStore },
 			_removing: { [PlayerUserId]: boolean },
 			_removingPromises: { [PlayerUserId]: Promise.Promise<any> },
+			_handleCounts: { [PlayerUserId]: number },
 			_pendingSaves: PendingPromiseTracker.PendingPromiseTracker<any>,
 			_removingCallbacks: { RemovingCallback },
 			_disableSavingInStudio: boolean?,
+			_hasCreatedDataStore: boolean,
+			_loadRetryOptions: PromiseRetryUtils.RetryOptions?,
+			_autoSaveTimeSeconds: number?,
+			_autoSaveTimeSecondsSet: boolean,
+			_sessionMessagingCloseDelaySeconds: number?,
 		},
 		{} :: typeof({ __index = PlayerDataStoreManager })
 	))
@@ -119,8 +130,11 @@ function PlayerDataStoreManager.new(
 	self._datastores = {} -- [userId] = datastore
 	self._removing = {} -- [player] = true
 	self._removingPromises = {} -- [player] = removal promise
+	self._handleCounts = {} -- [userId] = outstanding PlayerDataStoreHandle count
 	self._pendingSaves = PendingPromiseTracker.new()
 	self._removingCallbacks = {} -- [func, ...]
+	self._hasCreatedDataStore = false
+	self._autoSaveTimeSecondsSet = false
 
 	self._maid:GiveTask(Players.PlayerRemoving:Connect(function(player)
 		if self._disableSavingInStudio then
@@ -130,12 +144,6 @@ function PlayerDataStoreManager.new(
 		self:_removePlayerDataStore(player.UserId)
 	end))
 
-	-- On teardown (e.g. a hot-reloaded ServiceBag, or unit tests) flush and destroy any datastores we
-	-- still own. See _flushAndDestroyAll.
-	self._maid:GiveTask(function()
-		self:_flushAndDestroyAll()
-	end)
-
 	if skipBindingToClose ~= true then
 		-- Route through BindToCloseService so the callback is unregistered on :Destroy()
 		-- (unlike a raw game:BindToClose, which can never be unbound and would leak on hot reload).
@@ -152,33 +160,6 @@ function PlayerDataStoreManager.new(
 	return self
 end
 
---[=[
-	Flushes and tears down every datastore we still own. Runs on manager teardown (a hot-reloaded
-	ServiceBag, or a unit test). SaveAndCloseSession() is a best-effort synchronous write: the
-	underlying UpdateAsync request is dispatched before Destroy() cancels the promise, so a live
-	server usually honors it, but it is not guaranteed. A store whose load failed rejects, so the
-	rejection is swallowed. Stores handed off gracefully via _removePlayerDataStore have already been
-	pulled out of _datastores, so this only covers the ones nothing else cleaned up.
-]=]
-function PlayerDataStoreManager._flushAndDestroyAll(self: PlayerDataStoreManager): ()
-	for userId, datastore in self._datastores do
-		-- Cast past the DataStore intersection type: the solver otherwise blows up ("code too complex")
-		-- resolving :SaveAndCloseSession()/:Destroy() through it.
-		local store = datastore :: any
-		-- A failed load makes the save reject unconditionally; skip it so teardown does not
-		-- manufacture a guaranteed rejection.
-		if not store:DidLoadFail() then
-			-- Close the session, don't just save: this teardown ends the session, so it must also
-			-- release the session lock. A lock left held here reads as a live foreign session to the
-			-- next server that loads the key, which then grinds through the whole graceful-close/steal
-			-- retry ladder against a holder that no longer exists before it can load.
-			store:SaveAndCloseSession()
-		end
-		store:Destroy()
-		self._datastores[userId] = nil
-	end
-end
-
 --[=[
 	For if you want to disable saving in studio for faster close time!
 ]=]
@@ -188,6 +169,64 @@ function PlayerDataStoreManager.DisableSaveOnCloseStudio(self: PlayerDataStoreMa
 	self._disableSavingInStudio = true
 end
 
+--[=[
+	Overrides the load retry backoff on every datastore this manager creates. See
+	[DataStore.SetLoadRetryOptions].
+
+	This is the knob that decides how long a player waits on a lock held by a dead server: the ladder
+	runs, and only once it is exhausted is the lock stolen unconditionally. Defaults to ~49s.
+
+	:::info
+	Must be set before the first datastore is created.
+	:::
+
+	@param options RetryOptions
+]=]
+function PlayerDataStoreManager.SetLoadRetryOptions(
+	self: PlayerDataStoreManager,
+	options: PromiseRetryUtils.RetryOptions
+): ()
+	assert(not self._hasCreatedDataStore, "Must configure before the first datastore is created")
+	assert(type(options) == "table", "Bad options")
+
+	self._loadRetryOptions = options
+end
+
+--[=[
+	Sets the autosave interval on every datastore this manager creates. See
+	[DataStore.SetAutoSaveTimeSeconds]. Passing nil disables syncing entirely.
+
+	:::info
+	Must be set before the first datastore is created.
+	:::
+
+	@param autoSaveTimeSeconds number?
+]=]
+function PlayerDataStoreManager.SetAutoSaveTimeSeconds(self: PlayerDataStoreManager, autoSaveTimeSeconds: number?): ()
+	assert(not self._hasCreatedDataStore, "Must configure before the first datastore is created")
+	assert(type(autoSaveTimeSeconds) == "number" or autoSaveTimeSeconds == nil, "Bad autoSaveTimeSeconds")
+
+	self._autoSaveTimeSeconds = autoSaveTimeSeconds
+	self._autoSaveTimeSecondsSet = true
+end
+
+--[=[
+	Sets the post-graceful-close replication delay on every datastore this manager creates. See
+	[DataStore.SetSessionMessagingCloseDelaySeconds].
+
+	:::info
+	Must be set before the first datastore is created.
+	:::
+
+	@param seconds number
+]=]
+function PlayerDataStoreManager.SetSessionMessagingCloseDelaySeconds(self: PlayerDataStoreManager, seconds: number): ()
+	assert(not self._hasCreatedDataStore, "Must configure before the first datastore is created")
+	assert(type(seconds) == "number" and seconds >= 0, "Bad seconds")
+
+	self._sessionMessagingCloseDelaySeconds = seconds
+end
+
 --[=[
 	Adds a callback to be called before save on removal
 	@param callback function -- May return a promise
@@ -210,6 +249,93 @@ function PlayerDataStoreManager.RemovePlayerDataStore(
 	self:_removePlayerDataStore(userId)
 end
 
+--[=[
+	Gets the datastore for a player as a counted handle, opening a session if none is live.
+
+	Prefer this over [PlayerDataStoreManager.PromiseDataStore] for anything acting on a player who may
+	not be in this server. Opening their store takes the session lock, which kicks them from wherever
+	they were and keeps them from rejoining until it is dropped -- and destroying the handle is what
+	drops it.
+
+	Handles are counted, so several systems can hold the same player's store at once and the session
+	survives until the last handle is destroyed.
+
+	:::note
+	The join/leave path deliberately does *not* run through handles. Making a player's presence just
+	another reference would be tidier, but removal is reached from several directions already -- a
+	stolen session, a close request, a failed lock, PlayerRemoving, server shutdown -- and a handle
+	leaked on any of them would hold a player's save open instead of closing it, which is worse than
+	the asymmetry. So a handle never removes a store belonging to a player who is in this server;
+	their own path owns that.
+	:::
+
+	@param playerOrUserId Player | number
+	@return Promise<PlayerDataStoreHandle>
+]=]
+function PlayerDataStoreManager.PromiseDataStoreHandle(
+	self: PlayerDataStoreManager,
+	playerOrUserId: Player | PlayerUserId
+): Promise.Promise<PlayerDataStoreHandle.PlayerDataStoreHandle>
+	local userId = self:_toPlayerUserIdOrError(playerOrUserId)
+
+	-- Counted before the open rather than after, so a second caller arriving while this one is still
+	-- loading cannot see a count of zero and release the store out from under it.
+	self._handleCounts[userId] = (self._handleCounts[userId] or 0) + 1
+
+	return self:_promiseDataStoreByUserId(userId):Then(function(dataStore)
+		return PlayerDataStoreHandle.new(dataStore, function()
+			self:_releaseDataStoreHandle(userId)
+		end)
+	end, function(err)
+		-- The open failed, so there is no handle to be destroyed later. Give the count back.
+		self:_releaseDataStoreHandle(userId)
+		return Promise.rejected(err)
+	end)
+end
+
+function PlayerDataStoreManager._releaseDataStoreHandle(self: PlayerDataStoreManager, userId: PlayerUserId): ()
+	local count = self._handleCounts[userId]
+	if not count then
+		return
+	end
+
+	count -= 1
+	if count > 0 then
+		self._handleCounts[userId] = count
+		return
+	end
+
+	self._handleCounts[userId] = nil
+
+	-- A player in this server owns their own session through the join/leave path. Only a store opened
+	-- on behalf of someone absent is ours to close.
+	if Players:GetPlayerByUserId(userId) then
+		return
+	end
+
+	self:_removePlayerDataStore(userId)
+end
+
+--[=[
+	Resolves once any removal in flight for this player has saved and closed their session, and
+	immediately when there is nothing being removed.
+
+	Destroying the last handle for an absent player *starts* the save-and-close; it does not wait for
+	it. Tooling that reports back to an operator waits here first, so it says the lock is released
+	only once the write that releases it has actually landed.
+
+	@param playerOrUserId Player | number
+	@return Promise<()>
+]=]
+function PlayerDataStoreManager.PromiseSessionClosed(
+	self: PlayerDataStoreManager,
+	playerOrUserId: Player | PlayerUserId
+): Promise.Promise<()>
+	local userId = self:_toPlayerUserIdOrError(playerOrUserId)
+
+	return self:_promiseWaitForRemoving(userId)
+end
+
 --[=[
 	Gets the datastore for a player. If it does not exist, it will create one.
 
@@ -312,16 +438,149 @@ function PlayerDataStoreManager:_toPlayerUserIdOrError(playerOrUserId: Player |
 	) :: PlayerUserId
 end
 
+--[=[
+	Reads the session lock on a player's key without opening a session on it.
+
+	This is the read side of the tooling path: it answers "who holds this key, and how stale is that
+	claim", whether or not the player is in this server. Resolves nil when the key is unlocked or
+	absent. Reads the stored key, so for a player in this server it reflects their last save rather
+	than unsaved in-memory state.
+
+	@param playerOrUserId Player | number
+	@return Promise<LockData?>
+]=]
+function PlayerDataStoreManager.PromiseReadSessionLock(
+	self: PlayerDataStoreManager,
+	playerOrUserId: Player | PlayerUserId
+): Promise.Promise<DataStoreLockUtils.LockData?>
+	local userId = self:_toPlayerUserIdOrError(playerOrUserId)
+
+	return DataStorePromises.getAsync(self._robloxDataStore, self:_getKey(userId)):Then(function(data)
+		return DataStoreLockUtils.readLock(data)
+	end)
+end
+
+--[=[
+	Clears the session lock on a player's key with a raw write, releasing a claim left behind by a
+	server that died without closing its session.
+
+	:::warning
+	This is a soft lock. A loading session steals it anyway once its retry ladder is exhausted (see
+	[PlayerDataStoreManager.SetLoadRetryOptions]) -- clearing it early only saves the player that wait.
+	:::
+
+	:::danger
+	Permitted against a session this server holds, which desynchronizes that session from the key --
+	its next save either re-writes the lock or reads this as a theft and kicks the player. That is a
+	debug/stress-test capability, not a normal one.
+	:::
+
+	@param playerOrUserId Player | number
+	@return Promise<LockData?> -- the lock that was cleared, or nil if it was already unlocked
+]=]
+function PlayerDataStoreManager.PromiseUnlockSession(
+	self: PlayerDataStoreManager,
+	playerOrUserId: Player | PlayerUserId
+): Promise.Promise<DataStoreLockUtils.LockData?>
+	return self:_promiseWriteRawSessionLock(self:_toPlayerUserIdOrError(playerOrUserId), nil)
+end
+
+--[=[
+	Claims a player's key with a raw write, under a session this server will never answer for. Parks
+	the key so an inspection is not racing a live server.
+
+	:::warning
+	This is a soft lock, and holds only for as long as a loading session's retry ladder. It is not a
+	way to keep a player out of their data.
+	:::
+
+	:::danger
+	Permitted against a session this server holds, with the same desynchronizing effect described on
+	[PlayerDataStoreManager.PromiseUnlockSession].
+	:::
+
+	@param playerOrUserId Player | number
+	@return Promise<LockData?> -- the lock that was replaced, or nil if it was unlocked
+]=]
+function PlayerDataStoreManager.PromiseLockSession(
+	self: PlayerDataStoreManager,
+	playerOrUserId: Player | PlayerUserId
+): Promise.Promise<DataStoreLockUtils.LockData?>
+	local userId = self:_toPlayerUserIdOrError(playerOrUserId)
+
+	return self:_promiseWriteRawSessionLock(
+		userId,
+		DataStoreLockUtils.createLockData({
+			SessionId = HttpService:GenerateGUID(false),
+			PlaceId = game.PlaceId,
+			JobId = game.JobId,
+		})
+	)
+end
+
+function PlayerDataStoreManager._promiseWriteRawSessionLock(
+	self: PlayerDataStoreManager,
+	userId: PlayerUserId,
+	lockData: DataStoreLockUtils.LockData?
+): Promise.Promise<DataStoreLockUtils.LockData?>
+	-- Deliberately unguarded against a session this server owns. A raw write underneath one
+	-- desynchronizes that session from the key: on its next save it either re-writes this lock, or
+	-- reads it as a theft and kicks the player. That is precisely the failure the lock/unlock tools
+	-- exist to provoke, so stress-testing against a live local session is allowed rather than refused.
+	-- Callers reaching for this outside of debug tooling want the live [DataStore] instead.
+	local previousLock: DataStoreLockUtils.LockData? = nil
+
+	return DataStorePromises.updateAsync(self._robloxDataStore, self:_getKey(userId), function(data, datastoreKeyInfo)
+		previousLock = DataStoreLockUtils.readLock(data)
+
+		-- Nothing stored and nothing to clear, so cancel rather than create an empty entry.
+		if data == nil and lockData == nil then
+			return nil
+		end
+
+		-- UpdateAsync drops both when the transform omits them, so carry them through untouched.
+		local userIdList = if datastoreKeyInfo then datastoreKeyInfo:GetUserIds() else { userId }
+		local metadata = if datastoreKeyInfo then datastoreKeyInfo:GetMetadata() else nil
+
+		return DataStoreLockUtils.withLock(data, lockData), userIdList, metadata
+	end):Then(function()
+		return previousLock
+	end)
+end
+
 --[=[
 	Removes all player data stores, and returns a promise that
 	resolves when all pending saves are saved.
+
+	On a closing server Roblox fires PlayerRemoving for every player, so a removal is usually already
+	in flight by the time this runs. Those removals do the real save-and-close themselves; this waits
+	for them rather than starting anything of its own.
+
 	@return Promise
 ]=]
 function PlayerDataStoreManager.PromiseAllSaves(self: PlayerDataStoreManager): Promise.Promise<()>
 	for userId, _ in self._datastores do
 		self:_removePlayerDataStore(userId)
 	end
-	return self._maid:GivePromise(PromiseUtils.all(self._pendingSaves:GetAll()))
+
+	local promises: { Promise.Promise<any> } = {}
+
+	-- Wait on the removals still in flight, not just on _pendingSaves. A removal only reaches its write
+	-- after the removing callbacks and then DataStore's own saving callbacks resolve, and Saving fires at
+	-- the very end of that sync -- so _pendingSaves can be empty while a PlayerRemoving triggered moments
+	-- earlier is still working toward its UpdateAsync. Resolving on that empty set lets BindToClose
+	-- return and the server die mid-write, leaving the session locked with nobody able to release it: a
+	-- lock belongs to the server that holds it, so the next server can only recover by grinding the
+	-- graceful-close handshake against a dead JobId and then stealing it.
+	for _, removalPromise in self._removingPromises do
+		table.insert(promises, removalPromise :: any)
+	end
+
+	for _, savePromise in self._pendingSaves:GetAll() do
+		table.insert(promises, savePromise :: any)
+	end
+
+	return self._maid:GivePromise(PromiseUtils.all(promises))
 end
 
 function PlayerDataStoreManager._createDataStore(
@@ -332,8 +591,21 @@ function PlayerDataStoreManager._createDataStore(
 
 	local maid = Maid.new()
 
+	self._hasCreatedDataStore = true
+
 	-- DataStore is cleaned up very carefully in _removePlayerDataStore
 	local datastore = DataStore.new(self._robloxDataStore, self:_getKey(userId))
+
+	if self._loadRetryOptions then
+		datastore:SetLoadRetryOptions(self._loadRetryOptions)
+	end
+	if self._autoSaveTimeSecondsSet then
+		datastore:SetAutoSaveTimeSeconds(self._autoSaveTimeSeconds)
+	end
+	if self._sessionMessagingCloseDelaySeconds then
+		datastore:SetSessionMessagingCloseDelaySeconds(self._sessionMessagingCloseDelaySeconds)
+	end
+
 	datastore:SetSessionLockingEnabled(true)
 	datastore:SetSessionMessagingEnabled(true, self._serviceBag)
 	datastore:SetUserIdList({ userId })