fix(multiplayer): promote accepted matches atomically

server/store/match_sql.go

@@ -120,44 +120,92 @@ func CreateMatchFromAcceptedProposal(ctx context.Context, db *sql.DB, plan Accep
 		if proposalState != string(domain.Accepted) {
 			return fmt.Errorf("proposal is not accepted")
 		}
-		if !validAcceptedPlaylistCount(domain.Playlist(playlist), len(plan.Players)) {
-			return fmt.Errorf("accepted proposal playlist does not match player count")
-		}
-		if domain.Playlist(playlist) == domain.Ranked && !domain.IsRankedArenaPath(plan.ArenaPath) {
-			return fmt.Errorf("ranked accepted match plan has invalid arena")
-		}
-		participants, err := acceptedProposalParticipants(ctx, tx, plan)
-		if err != nil {
-			return err
-		}
-		inserted, err := tx.ExecContext(ctx, AcceptedMatchInsertSQL, plan.MatchID, playlist, plan.Region, plan.Protocol, plan.ArenaPath)
-		if err != nil {
-			return err
-		}
-		changed, err := inserted.RowsAffected()
-		if err != nil {
-			return err
-		}
-		if changed == 0 {
-			return verifyAcceptedMatchReplay(ctx, tx, plan, domain.Playlist(playlist), participants)
-		}
-		for _, player := range plan.Players {
-			ticketID := participants[player.PlayerID]
-			var protocol int
-			if err := tx.QueryRowContext(ctx, AcceptedTicketSQL, ticketID, player.PlayerID).Scan(&protocol); err != nil {
-				return fmt.Errorf("accepted ticket transition: %w", err)
-			}
-			if protocol != plan.Protocol {
-				return fmt.Errorf("accepted ticket protocol mismatch")
-			}
-			if _, err := tx.ExecContext(ctx, AcceptedMatchParticipantInsertSQL, plan.MatchID, player.PlayerID, ticketID, player.Slot, player.Team); err != nil {
-				return err
-			}
-		}
-		return nil
+		return createMatchFromAcceptedProposalTx(ctx, tx, plan, domain.Playlist(playlist))
 	})
 }
 
+func createMatchFromAcceptedProposalTx(ctx context.Context, tx *sql.Tx, plan AcceptedMatchPlan, playlist domain.Playlist) error {
+	if !validAcceptedPlaylistCount(domain.Playlist(playlist), len(plan.Players)) {
+		return fmt.Errorf("accepted proposal playlist does not match player count")
+	}
+	if domain.Playlist(playlist) == domain.Ranked && !domain.IsRankedArenaPath(plan.ArenaPath) {
+		return fmt.Errorf("ranked accepted match plan has invalid arena")
+	}
+	participants, err := acceptedProposalParticipants(ctx, tx, plan)
+	if err != nil {
+		return err
+	}
+	inserted, err := tx.ExecContext(ctx, AcceptedMatchInsertSQL, plan.MatchID, playlist, plan.Region, plan.Protocol, plan.ArenaPath)
+	if err != nil {
+		return err
+	}
+	changed, err := inserted.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if changed == 0 {
+		return verifyAcceptedMatchReplay(ctx, tx, plan, domain.Playlist(playlist), participants)
+	}
+	for _, player := range plan.Players {
+		ticketID := participants[player.PlayerID]
+		var protocol int
+		if err := tx.QueryRowContext(ctx, AcceptedTicketSQL, ticketID, player.PlayerID).Scan(&protocol); err != nil {
+			return fmt.Errorf("accepted ticket transition: %w", err)
+		}
+		if protocol != plan.Protocol {
+			return fmt.Errorf("accepted ticket protocol mismatch")
+		}
+		if _, err := tx.ExecContext(ctx, AcceptedMatchParticipantInsertSQL, plan.MatchID, player.PlayerID, ticketID, player.Slot, player.Team); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// promotePlannedAcceptedProposalTx closes the crash window between unanimous
+// acceptance and match creation. Legacy proposals without a persisted matcher
+// plan remain readable, but every planned production proposal is materialized
+// before the response transaction commits.
+func promotePlannedAcceptedProposalTx(ctx context.Context, tx *sql.Tx, proposalID string, playlist domain.Playlist) error {
+	var region, arenaPath sql.NullString
+	var protocol sql.NullInt64
+	if err := tx.QueryRowContext(ctx, StoredProposalMatchPlanSQL, proposalID).Scan(&region, &protocol, &arenaPath); err != nil {
+		return err
+	}
+	if !region.Valid && !protocol.Valid && !arenaPath.Valid {
+		return nil
+	}
+	if !region.Valid || !protocol.Valid || protocol.Int64 < 1 {
+		return fmt.Errorf("accepted proposal has incomplete match plan")
+	}
+	plan := AcceptedMatchPlan{
+		MatchID: "match-" + proposalID, ProposalID: proposalID,
+		Region: region.String, Protocol: int(protocol.Int64), ArenaPath: arenaPath.String,
+	}
+	rows, err := tx.QueryContext(ctx, StoredProposalMatchPlayersSQL, proposalID)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var player MatchPlayer
+		if err := rows.Scan(&player.PlayerID, &player.Team, &player.Slot); err != nil {
+			return err
+		}
+		plan.Players = append(plan.Players, player)
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+	if err := rows.Close(); err != nil {
+		return err
+	}
+	if !validAcceptedMatchPlan(plan) {
+		return fmt.Errorf("accepted proposal has invalid persisted match plan")
+	}
+	return createMatchFromAcceptedProposalTx(ctx, tx, plan, playlist)
+}
+
 func validAcceptedPlaylistCount(playlist domain.Playlist, count int) bool {
 	if playlist == domain.Ranked {
 		return count == 6

server/store/postgres_integration_test.go

@@ -584,6 +584,17 @@ func TestPostgreSQLProposalClaimAndResponseAreAtomic(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	proposal.Region = "EU"
+	proposal.Protocol = 1
+	for index := range proposal.Participants {
+		if proposal.Participants[index].PlayerID == "proposal-player-a" {
+			proposal.Participants[index].Team = 0
+			proposal.Participants[index].Slot = 0
+		} else {
+			proposal.Participants[index].Team = 1
+			proposal.Participants[index].Slot = 3
+		}
+	}
 	if err := CreateProposal(ctx, db, proposal, map[string]string{"proposal-player-a": "proposal-ticket-0", "proposal-player-b": "proposal-ticket-1"}, now); err != nil {
 		t.Fatalf("create proposal: %v", err)
 	}
@@ -616,6 +627,20 @@ func TestPostgreSQLProposalClaimAndResponseAreAtomic(t *testing.T) {
 	if accepted.State != domain.Accepted || accepted.Revision != 2 {
 		t.Fatalf("proposal did not close after unanimous acceptance: %+v", accepted)
 	}
+	var matchState string
+	if err := db.QueryRow(`SELECT state FROM matches WHERE match_id = 'match-proposal-integration'`).Scan(&matchState); err != nil {
+		t.Fatalf("atomic accepted match: %v", err)
+	}
+	var acceptedTickets, matchPlayers int
+	if err := db.QueryRow(`SELECT count(*) FROM queue_tickets WHERE ticket_id LIKE 'proposal-ticket-%' AND state = 'ACCEPTED'`).Scan(&acceptedTickets); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.QueryRow(`SELECT count(*) FROM match_participants WHERE match_id = 'match-proposal-integration'`).Scan(&matchPlayers); err != nil {
+		t.Fatal(err)
+	}
+	if matchState != "ALLOCATING" || acceptedTickets != 2 || matchPlayers != 2 {
+		t.Fatalf("acceptance did not atomically materialize match: state=%s tickets=%d players=%d", matchState, acceptedTickets, matchPlayers)
+	}
 }
 
 // TestPostgreSQLProposalDeclineCancelsOffenderAndRequeuesInnocent protects the

server/store/proposal_recovery_sql.go

@@ -398,6 +398,9 @@ func RespondToProposal(ctx context.Context, db *sql.DB, playerID, proposalID, id
 		if targetState != state {
 			if targetState == string(domain.Accepted) {
 				_, err = tx.ExecContext(ctx, ProposalAcceptSQL, proposalID)
+				if err == nil {
+					err = promotePlannedAcceptedProposalTx(ctx, tx, proposalID, domain.Playlist(playlist))
+				}
 			} else {
 				_, err = tx.ExecContext(ctx, ProposalDeclineSQL, proposalID)
 				if err != nil {