TejasLamba2006 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · coderabbitai · Nov 9, 2026
@@ -9,6 +9,17 @@
     from features.models import FeatureState
 
 
+def has_live_experiment(feature_id: int) -> bool:
+    # Multivariate options belong to the feature, not an environment, so an
+    # experiment running in any environment locks them.
+    return bool(
+        Experiment.objects.filter(
+            feature_id=feature_id,
+            status=ExperimentStatus.RUNNING,
+        ).exists()
+    )
+
+
 def get_feature_state_metadata_builder(
     environment: "Environment",
 ) -> Callable[["FeatureState"], dict[str, Any] | None]:

@@ -79,7 +79,7 @@
 from features.feature_states.models import API_VALUE_TYPES
 from features.future.services import delete_segment_override, update_flag
 from features.future.types import SegmentOverrideRequest
-from features.models import FeatureState
+from features.models import Feature, FeatureState
 from features.value_types import BOOLEAN, STRING
 from features.versioning.versioning_service import get_environment_flags_list
 from integrations.flagsmith.client import get_openfeature_client
@@ -617,6 +617,9 @@ def transition_experiment_status(
 
         experiment.status = target_status
         if target_status == ExperimentStatus.RUNNING and not experiment.started_at:
+            Feature.objects.select_for_update().filter(
+                pk=experiment.feature_id
+            ).exists()
             experiment.started_at = timezone.now()
             _remove_superseded_experiment_rollouts(
                 experiment, AuthorData.from_user(user)

@@ -10,6 +10,9 @@
 # Multivariate variant reported when an identity falls through to the control value
 CONTROL_VARIANT_KEY = "control"
 RESERVED_VARIANT_KEY_MESSAGE = f'"{CONTROL_VARIANT_KEY}" is a reserved variant key.'
+LIVE_EXPERIMENT_MV_OPTIONS_MESSAGE = (
+    "Multivariate options cannot be changed while the feature is in a live experiment."
+)
 
 # Tag filtering strategy
 UNION = "UNION"

@@ -1,6 +1,9 @@
+from django.core.exceptions import ValidationError
 from django.db.models import Q
 
 from environments.models import Environment
+from experimentation.feature_state_metadata import has_live_experiment
+from features.constants import LIVE_EXPERIMENT_MV_OPTIONS_MESSAGE
 from features.import_export.types import FeatureExportData
 from features.models import Feature, FeatureSegment, FeatureState
 from features.multivariate.models import MultivariateFeatureOption
@@ -15,6 +18,8 @@ def overwrite_feature_for_environment(
     Apply a destructive feature import to a single environment without
     affecting other environments' feature states or the Feature definition.
     """
+    if has_live_experiment(existing_feature.id):
+        raise ValidationError(LIVE_EXPERIMENT_MV_OPTIONS_MESSAGE)
     FeatureSegment.objects.filter(
         feature=existing_feature, environment=environment
     ).delete()

@@ -3,6 +3,7 @@
 from typing import Optional
 
 from django.conf import settings
+from django.db import transaction
 from django.db.models import Q
 from django.utils import timezone
 from task_processor.decorators import (
@@ -143,27 +144,32 @@ def import_features_for_environment(feature_import_id: int) -> None:
 
 
 def _import_features_for_environment(feature_import: FeatureImport) -> None:
-    environment = feature_import.environment
-    input_data: list[FeatureExportData] = json.loads(feature_import.data)
-    project = environment.project
-
-    for feature_data in input_data:
-        existing_feature = Feature.objects.filter(
-            name=feature_data["name"],
-            project=project,
-        ).first()
-
-        if existing_feature and feature_import.strategy == SKIP:
-            continue
-
-        if existing_feature is None:
-            existing_feature = map_feature_export_data_to_feature(feature_data, project)
-            existing_feature.save()
-
-        overwrite_feature_for_environment(feature_data, existing_feature, environment)
-
-    feature_import.status = SUCCESS
-    feature_import.save()
+    with transaction.atomic():
+        environment = feature_import.environment
+        input_data: list[FeatureExportData] = json.loads(feature_import.data)
+        project = environment.project
+
+        for feature_data in input_data:
+            existing_feature = Feature.objects.filter(
+                name=feature_data["name"],
+                project=project,
+            ).first()
+
+            if existing_feature and feature_import.strategy == SKIP:
+                continue
+
+            if existing_feature is None:
+                existing_feature = map_feature_export_data_to_feature(
+                    feature_data, project
+                )
+                existing_feature.save()
+
+            overwrite_feature_for_environment(
+                feature_data, existing_feature, environment
+            )
+
+        feature_import.status = SUCCESS
+        feature_import.save()
 
 
 # Should only run on official flagsmith instance.

@@ -2,13 +2,17 @@
     CREATE_FEATURE,
     VIEW_PROJECT,
 )
+from django.db import transaction
 from django.utils.decorators import method_decorator
 from drf_spectacular.utils import extend_schema
 from rest_framework import viewsets
 from rest_framework.decorators import api_view
+from rest_framework.exceptions import ValidationError
 from rest_framework.generics import get_object_or_404
 from rest_framework.response import Response
 
+from experimentation.feature_state_metadata import has_live_experiment
+from features.constants import LIVE_EXPERIMENT_MV_OPTIONS_MESSAGE
 from features.models import Feature
 from projects.permissions import NestedProjectPermissions
 
@@ -69,9 +73,53 @@ def get_permissions(self):  # type: ignore[no-untyped-def]
     def create(self, request, *args, **kwargs):  # type: ignore[no-untyped-def]
         feature_pk = self.kwargs.get("feature_pk")
         project_pk = self.kwargs.get("project_pk")
-        get_object_or_404(Feature.objects.filter(project__id=project_pk), pk=feature_pk)
+        url_feature = get_object_or_404(
+            Feature.objects.filter(project__id=project_pk), pk=feature_pk
+        )
+        if "feature" in request.data and str(request.data.get("feature")) != str(
+            url_feature.id
+        ):
+            raise ValidationError({"feature": "Feature must match the URL."})
         return super().create(request, *args, **kwargs)
 
+    def perform_create(self, serializer):  # type: ignore[no-untyped-def]
+        url_feature = get_object_or_404(
+            Feature.objects.filter(project__id=self.kwargs["project_pk"]),
+            pk=self.kwargs["feature_pk"],
+        )
+        if serializer.validated_data["feature"] != url_feature:
+            raise ValidationError({"feature": "Feature must match the URL."})
+        with transaction.atomic():
+            Feature.objects.select_for_update().filter(pk=url_feature.pk).exists()
+            self._check_no_live_experiment(url_feature)
+            super().perform_create(serializer)
+
+    def perform_update(self, serializer):  # type: ignore[no-untyped-def]
+        features = [serializer.instance.feature]
+        if "feature" in serializer.validated_data:
+            features.append(serializer.validated_data["feature"])
+        feature_ids = sorted({feature.id for feature in features})
+        with transaction.atomic():
+            list(
+                Feature.objects.select_for_update()
+                .filter(pk__in=feature_ids)
+                .order_by("pk")
+                .values_list("pk", flat=True)
+            )
+            for feature in features:
+                self._check_no_live_experiment(feature)
+            super().perform_update(serializer)
+
+    def perform_destroy(self, instance):  # type: ignore[no-untyped-def]
+        with transaction.atomic():
+            Feature.objects.select_for_update().filter(pk=instance.feature_id).exists()
+            self._check_no_live_experiment(instance.feature)
+            super().perform_destroy(instance)
+
+    def _check_no_live_experiment(self, feature: Feature) -> None:
+        if has_live_experiment(feature.id):
+            raise ValidationError(LIVE_EXPERIMENT_MV_OPTIONS_MESSAGE)
+
     def get_queryset(self):  # type: ignore[no-untyped-def]
         if getattr(self, "swagger_fake_view", False):
             return MultivariateFeatureOption.objects.none()

@@ -1,6 +1,6 @@
 from datetime import datetime
 from functools import cached_property
-from typing import Any, Callable
+from typing import Any, Callable, cast
 from uuid import UUID
 
 import django.core.exceptions
@@ -12,7 +12,7 @@
     FeatureStateValueSerializer,
 )
 from common.projects.permissions import VIEW_PROJECT
-from django.db import models
+from django.db import models, transaction
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import extend_schema_field
 from drf_writable_nested import (  # type: ignore[attr-defined]
@@ -31,7 +31,9 @@
 from evaluation.types import EvaluatedFeatureState
 from experimentation.feature_state_metadata import (
     get_feature_state_metadata_builder,
+    has_live_experiment,
 )
+from features.constants import LIVE_EXPERIMENT_MV_OPTIONS_MESSAGE
 from integrations.vcs.services import dispatch_vcs_on_feature_state_changed
 from metadata.serializers import MetadataSerializer, MetadataSerializerMixin
 from projects.code_references.serializers import (
@@ -307,6 +309,22 @@ def validate_project_features_limit(self, project: Project) -> None:
                 }
             )
 
+    def update(self, instance: Feature, validated_data: dict[str, Any]) -> Feature:
+        with transaction.atomic():
+            Feature.objects.select_for_update().filter(pk=instance.pk).exists()
+            if (
+                has_live_experiment(instance.id)
+                and "multivariate_options" in validated_data
+            ):
+                if self._changes_multivariate_options(
+                    validated_data["multivariate_options"], instance
+                ):
+                    raise serializers.ValidationError(
+                        {"multivariate_options": LIVE_EXPERIMENT_MV_OPTIONS_MESSAGE}
+                    )
+                validated_data.pop("multivariate_options")
+            return super().update(instance, validated_data)  # type: ignore[no-any-return]
+
     def validate_multivariate_options(self, multivariate_options):  # type: ignore[no-untyped-def]
         if multivariate_options:
             user = self.context["request"].user
@@ -324,8 +342,44 @@ def validate_multivariate_options(self, multivariate_options):  # type: ignore[n
             )
             if total_percentage_allocation > 100:
                 raise serializers.ValidationError("Invalid percentage allocation")
+        instance = cast(Feature | None, self.instance)
+        if (
+            instance
+            and self._changes_multivariate_options(multivariate_options, instance)
+            and has_live_experiment(instance.id)
+        ):
+            raise serializers.ValidationError(LIVE_EXPERIMENT_MV_OPTIONS_MESSAGE)
         return multivariate_options
 
+    def _changes_multivariate_options(
+        self,
+        multivariate_options: list[dict[str, Any]] | None,
+        instance: Feature | None = None,
+    ) -> bool:
+        instance = instance or cast(Feature | None, self.instance)
+        if instance is None:
+            return False
+        # The frontend resubmits the whole feature, so only a real change to
+        # writable option fields counts. Compare on content, not ids.
+        fields = (
+            "type",
+            "integer_value",
+            "string_value",
+            "boolean_value",
+            "default_percentage_allocation",
+        )
+        current = NestedMultivariateFeatureOptionSerializer(
+            instance.multivariate_options.all(), many=True
+        ).data
+
+        def signature(options) -> list[tuple[Any, ...]]:  # type: ignore[no-untyped-def]
+            return sorted(
+                (tuple(option.get(field) for field in fields) for option in options),
+                key=repr,
+            )
+
+        return signature(current) != signature(multivariate_options or [])
+
     def validate_owners(self, owners: list[FFAdminUser]) -> list[FFAdminUser]:
         project: Project = self.context["project"]
         invalid_users = [