feat: persist participant-scoped proposal recovery

multiplayer-todo.md

@@ -1195,7 +1195,7 @@ the local/CI/community transport, not a silent production fallback.
 | 8.15 `[D:7.8,8.3]` | **IN PROGRESS.** Pure Go probe validation treats Steam location as opaque, requires nonce/freshness/region and server-computed RTT, and implements discrepancy quarantine/release; authenticated HTTP now accepts only opaque location/nonce input through a server-owned probe provider | `server/domain/probes.go`, adversarial fixtures and `server/api/service.go` cover stale/wrong/forged evidence, the 25 ms/30% threshold, three-sample quarantine, five-clean release, authenticated provider arguments and rejection of client RTT fields; Steam coordinator and regional probe adapters remain |
 | 8.16 `[D:8.14,8.15]` | **IN PROGRESS.** Pure Go candidate/team selection implements the <=100 ms ceiling, pairwise widening tolerance, anchor inclusion, deterministic set/region scoring and balanced team partitioning; queue-backed formation now consumes the server-owned projection, fences duplicate player identities and rejects playlist/build/protocol mixing | `server/domain/matcher.go`, `teams.go` and adversarial fixtures cover no-common-region, tolerance boundaries, lexical ties, mean-rating balance, malformed candidates, duplicate identities, compatibility mismatches and queue-backed oldest-anchor formation; full population fixtures and durable matcher claim integration remain |
 | 8.17 `[D:8.14,8.16]` | **IN PROGRESS.** Pure Go proposal policy sends a 10-second response window to every selected human, requires unanimous acceptance, applies exact decline/timeout cooldowns and ranked escalation; authenticated API exposes revisioned accept/decline mutations; formed matches now pass through a playlist-aware proposal boundary | `server/domain/proposal.go`, `formation.go` and `server/api/service.go` plus adversarial fixtures cover partial/unanimous response, expiry, replay/conflict, stale API revision, casual lineup preparation and ranked metadata validation; queue precedence and allocation integration remain |
-| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now inserts proposal/participants and promotes every ticket in one rollback-safe transaction with player- and playlist-bound claim predicates, and queue creation has a durable idempotency/owner-read adapter | `server/store/serializable.go`, `queue_sql.go`, `proposal_sql.go` and tests cover retry classification, claim-boundary invariants, player/ticket/playlist mapping, durable queue replay/conflict, owner-scoped recovery, zero-row claim aborts and atomic statement ordering; live PostgreSQL adapter execution, Redis candidate index/repair, worker-failure and concurrent two-matcher integration tests remain |
+| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now inserts proposal/participants and promotes every ticket in one rollback-safe transaction with player- and playlist-bound claim predicates, queue creation has a durable idempotency/owner-read adapter, and participant-scoped proposal recovery now expires OPEN proposals and pending participants transactionally at read time | `server/store/serializable.go`, `queue_sql.go`, `proposal_sql.go`, `proposal_recovery_sql.go` and tests cover retry classification, claim-boundary invariants, player/ticket/playlist mapping, durable queue replay/conflict, owner-scoped queue/proposal recovery, expiry/read boundaries, zero-row claim aborts and atomic statement ordering; live PostgreSQL adapter execution, Redis candidate index/repair, worker-failure and concurrent two-matcher integration tests remain |
 | 8.19 `[D:8.18]` | **IN PROGRESS.** Pure Go casual lineup requires 2–6 humans with at least one per team, fills missing slots with explicit bots, permits kickoff-only bot-slot backfill and assigns no backfill penalty/rating update; proposal preparation now derives the lineup from formed teams | `server/domain/casual.go`, `formation.go` cover both-team minimum, bot shape, live-play rejection, zero-penalty backfill and casual proposal composition; queue candidate selection, opt-in 10 s backfill proposals, reconnect/leave penalties and live integration remain |
 | 8.20 `[D:8.18]` | **IN PROGRESS.** Pure Go ranked admission requires six unique verified solo humans, rejects bots/backfill/parties, and allows only random-enabled non-elevated arenas; proposal preparation requires matching metadata for every formed player | `server/domain/ranked.go`, `formation.go` cover count, identity, party, bot/backfill, arena eligibility and formed-player metadata rejection; `ArenaRegistry` integration, allocation wiring and innocent-ticket restoration remain |
 | 8.21 `[D:8.5,8.20]` | **IN PROGRESS.** Pure Go rating core implements canonical Glicko-2, daily inactivity, ranked 1/3 and casual 1/N human-opponent weights, deterministic opponent ordering, and authoritative draw/overtime/abandon scoring | `server/domain/rating.go` has canonical/inactivity/weight/invalid-input plus draw/OT/abandon fixtures; PostgreSQL snapshot locking, rating transaction integration, seasons and concurrent result transaction tests remain |
@@ -1226,7 +1226,7 @@ the local/CI/community transport, not a silent production fallback.
 
 | # | Task | Acceptance |
 |---|---|---|
-| 8.39 `[D:8.3,8.14,8.17]` | **IN PROGRESS.** `MatchmakingState` now projects queue → proposal → allocation/process-ready/assignment-ready/connect/live plus terminal failure states; autoload `ControlPlaneClient` provides authenticated queue create/recovery/heartbeat/cancel and proposal response requests with idempotency/revision headers; `matchmaking.tscn`/`matchmaking.gd` expose the state and authoritative actions from the main menu; authenticated proposal recovery now reconciles missed proposal events and expires them at read time; the Go API publishes targeted authenticated revisioned queue/proposal/assignment events and the Godot client consumes state/proposal/assignment events, fetching the authoritative assignment after assignment readiness | `test_matchmaking_state.gd`, `test_control_plane_client.gd`, `test_matchmaking_ui.gd`, `TestProposalRecoveryIsParticipantScopedAndExpiresAtReadBoundary`, `TestAuthenticatedWebSocketDeliversOnlyTargetedRevisionedEvents` and `TestStateChangingAPIActionsPublishTargetedEvents` reject stale/gapped/conflicting updates, validate endpoint/token/payload normalization, preserve idempotent duplicates, and guarantee visible phase/terminal copy; wiring durable allocation events into the outbox, wait/latency explanations and Godot runtime verification remain |
+| 8.39 `[D:8.3,8.14,8.17]` | **IN PROGRESS.** `MatchmakingState` now projects queue → proposal → allocation/process-ready/assignment-ready/connect/live plus terminal failure states; autoload `ControlPlaneClient` provides authenticated queue create/recovery/heartbeat/cancel and proposal response requests with idempotency/revision headers; `matchmaking.tscn`/`matchmaking.gd` expose the state and authoritative actions from the main menu; authenticated proposal recovery now reconciles missed proposal events and expires them at read time; the Go API publishes targeted authenticated revisioned queue/proposal/assignment events and the Godot client consumes state/proposal/assignment events, fetching the authoritative assignment after assignment readiness; the API can now use the durable participant-scoped proposal provider | `test_matchmaking_state.gd`, `test_control_plane_client.gd`, `test_matchmaking_ui.gd`, `TestProposalRecoveryIsParticipantScopedAndExpiresAtReadBoundary`, `TestAuthenticatedWebSocketDeliversOnlyTargetedRevisionedEvents`, `TestStateChangingAPIActionsPublishTargetedEvents` and `TestProposalRecoveryUsesDurableBackendAndRemainsParticipantScoped` reject stale/gapped/conflicting updates, validate endpoint/token/payload normalization, preserve idempotent duplicates, and guarantee visible phase/terminal copy; wiring durable allocation events into the outbox, wait/latency explanations and Godot runtime verification remain |
 | 8.40 `[D:8.3,8.14]` | **IN PROGRESS.** Pure Go revisioned replica reducer rejects gaps for REST resync, makes duplicate/out-of-order events idempotent, and resumes from the authoritative snapshot revision; authenticated queue-ticket recovery now has an owner-checked REST read; Godot client projection persists non-secret ticket/proposal state, forces authoritative recovery after restart, and can replay a lost queue-create response with the original ticket/idempotency key; the Go API now exposes an authenticated `/v1/events` WebSocket with bounded per-player queues, strict upgrade/vocabulary validation and REST-resync-safe slow-client failure; Godot `ControlPlaneClient` can connect to the stream, consume validated events, automatically reconnect with bounded backoff, and trigger REST recovery on projection gaps and stream return | `server/domain/sync.go`, `server/api/events.go`, `server/api/service.go`, `service_test.go`, `matchmaking_state.gd` and `control_plane_client.gd` cover gap, snapshot, replay, same-revision conflict, owner-only ticket recovery, expired-ticket terminal handling, malformed restart snapshots, API-level duplicate-create replay/conflict, authenticated handshake/key rejection, targeted event delivery, exactly-once slow-subscriber closure and invalid-event rejection; durable outbox fan-out and live Godot verification remain |
 | 8.41 `[D:7.8,8.9,8.31,8.40]` | **IN PROGRESS.** Authenticated `GET /v1/assignments/{matchId}` now exposes only a validated, player-scoped assignment view; Godot `AssignmentState`/`ControlPlaneClient.fetch_assignment()` bind the response to the authenticated player, recheck expiry, preserve explicit transport/slot/join authorisation and do not connect before assignment-ready; migration 0002 and the Go store adapter now persist/recover the complete player-scoped assignment projection with conflict-safe identical replay; `AssignmentProviderFromStore` wires that durable projection into the API injection point | `server/api/service.go`, `store_adapters.go`, `service_test.go`, `assignment_state.gd`, `test_assignment_state.gd`, `server/migrations/0002_assignments.sql` and `server/store/assignment_sql.go` cover participant/identity/expiry/shape/transport boundaries, player-scoped schema keys, expiry-filtered reads, assignment upsert conflict handling and nil-store fail-closed behavior; signed manifest-to-player persistence wiring, SDR relay-ticket installation, `hello` join-authorisation wiring, fencing integration and live Godot/PostgreSQL verification remain |
 | 8.42 `[D:8.22,8.23,8.24,8.40]` | **IN PROGRESS.** `RankedProfileState` and `ControlPlaneClient.fetch_ranked_profile()` expose the backend-authoritative rating/RD/volatility/games/tier/provisional/season view; matchmaking UI displays provisional/tier status without client-side rating math | `test_control_plane_client.gd` validates profile shape, numeric safety and provisional display; ranked profile fetch/display, committed revision after reconnect, abandon status and season countdown remain dependent on live auth/backend events and Godot runtime verification |

server/api/service.go

@@ -42,6 +42,9 @@ type SteamLoginProvider interface {
 type SessionIssuer interface {
 	Issue(context.Context, string, time.Duration, time.Time) (domain.Session, string, error)
 }
+type ProposalBackend interface {
+	Get(context.Context, string, string, time.Time) (domain.Proposal, error)
+}
 
 type AssignmentView struct {
 	MatchID           string    `json:"match_id"`
@@ -57,24 +60,25 @@ type AssignmentView struct {
 type AssignmentProvider func(context.Context, string, string, time.Time) (AssignmentView, error)
 
 type Service struct {
-	Sessions       *domain.SessionStore
-	SessionBackend SessionBackend
-	SessionIssuer  SessionIssuer
-	SteamLogin     SteamLoginProvider
-	Queue          *domain.Queue
-	Candidate      CandidateProvider
-	CandidateV2    CandidateProviderV2
-	QueueBackend   QueueBackend
-	Probe          ProbeProvider
-	Assignment     AssignmentProvider
-	Now            func() time.Time
-	Proposals      map[string]*domain.Proposal
-	RankedProfiles map[string]domain.RankedProfile
-	TierPolicy     domain.TierPolicy
-	RateLimiter    *RateLimiter
-	proposalMu     sync.Mutex
-	eventsMu       sync.Mutex
-	events         *eventHub
+	Sessions        *domain.SessionStore
+	SessionBackend  SessionBackend
+	SessionIssuer   SessionIssuer
+	SteamLogin      SteamLoginProvider
+	Queue           *domain.Queue
+	Candidate       CandidateProvider
+	CandidateV2     CandidateProviderV2
+	QueueBackend    QueueBackend
+	Probe           ProbeProvider
+	Assignment      AssignmentProvider
+	Now             func() time.Time
+	Proposals       map[string]*domain.Proposal
+	ProposalBackend ProposalBackend
+	RankedProfiles  map[string]domain.RankedProfile
+	TierPolicy      domain.TierPolicy
+	RateLimiter     *RateLimiter
+	proposalMu      sync.Mutex
+	eventsMu        sync.Mutex
+	events          *eventHub
 }
 
 func (s *Service) Handler() http.Handler {
@@ -413,6 +417,15 @@ func (s *Service) proposalMutation(w http.ResponseWriter, r *http.Request) {
 		s.proposalMu.Lock()
 		defer s.proposalMu.Unlock()
 		proposal, exists := s.Proposals[parts[0]]
+		if s.ProposalBackend != nil {
+			proposalValue, providerErr := s.ProposalBackend.Get(r.Context(), playerID, parts[0], s.now())
+			if providerErr != nil {
+				writeError(w, http.StatusNotFound, "not_found")
+				return
+			}
+			proposal = &proposalValue
+			exists = true
+		}
 		if !exists || proposal == nil || !proposal.HasParticipant(playerID) {
 			writeError(w, http.StatusNotFound, "not_found")
 			return

server/api/service_test.go

@@ -21,6 +21,19 @@ type queueBackendSpy struct{ createCalls, heartbeatCalls, cancelCalls, getCalls
 
 type sessionBackendSpy struct{ calls int }
 
+type proposalBackendSpy struct {
+	proposal domain.Proposal
+	calls    int
+}
+
+func (b *proposalBackendSpy) Get(_ context.Context, playerID, _ string, _ time.Time) (domain.Proposal, error) {
+	b.calls++
+	if !b.proposal.HasParticipant(playerID) {
+		return domain.Proposal{}, domain.ErrNotParticipant
+	}
+	return b.proposal, nil
+}
+
 func (s *sessionBackendSpy) Authenticate(_ context.Context, sessionID, _ string, _ time.Time) (domain.Session, error) {
 	s.calls++
 	return domain.Session{SessionID: sessionID, PlayerID: "player-1"}, nil
@@ -341,6 +354,49 @@ func TestStateChangingAPIActionsPublishTargetedEvents(t *testing.T) {
 	}
 }
 
+func TestProposalRecoveryUsesDurableBackendAndRemainsParticipantScoped(t *testing.T) {
+	now := time.Unix(1000, 0).UTC()
+	proposal, err := domain.NewProposal("proposal-1234567890123456", domain.Casual, []string{"player-1", "player-2"}, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	backend := &proposalBackendSpy{proposal: proposal}
+	sessions := domain.NewSessionStore()
+	participantSession, participantToken, err := sessions.Issue("player-1", time.Hour, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	outsiderSession, outsiderToken, err := sessions.Issue("outsider", time.Hour, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	service := &Service{Sessions: sessions, Proposals: map[string]*domain.Proposal{}, ProposalBackend: backend, Now: func() time.Time { return now }}
+	server := httptest.NewServer(service.Handler())
+	defer server.Close()
+	get := func(session domain.Session, token string) int {
+		request, err := http.NewRequest(http.MethodGet, server.URL+"/v1/proposals/"+proposal.ProposalID, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		request.Header.Set("Authorization", "Bearer "+session.SessionID+":"+token)
+		response, err := server.Client().Do(request)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_ = response.Body.Close()
+		return response.StatusCode
+	}
+	if status := get(participantSession, participantToken); status != http.StatusOK {
+		t.Fatalf("participant recovery status = %d", status)
+	}
+	if status := get(outsiderSession, outsiderToken); status != http.StatusNotFound {
+		t.Fatalf("outsider recovery status = %d", status)
+	}
+	if backend.calls != 2 {
+		t.Fatalf("durable backend calls = %d", backend.calls)
+	}
+}
+
 func TestQueueAPIRejectsUnauthenticatedUnknownAndOversizedInput(t *testing.T) {
 	service := &Service{Sessions: domain.NewSessionStore(), Queue: domain.NewQueue(), Candidate: func(string, string) (domain.Candidate, error) { return domain.Candidate{}, nil }}
 	server := httptest.NewServer(service.Handler())

server/api/store_adapters.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"time"
 
+	"github.com/cosmic-clash/cosmic-clash/server/domain"
 	"github.com/cosmic-clash/cosmic-clash/server/store"
 )
 
@@ -29,3 +30,13 @@ func AssignmentProviderFromStore(db *sql.DB) AssignmentProvider {
 		}, nil
 	}
 }
+
+type postgresProposalBackend struct{ db *sql.DB }
+
+func (p postgresProposalBackend) Get(ctx context.Context, playerID, proposalID string, now time.Time) (domain.Proposal, error) {
+	return store.GetProposal(ctx, p.db, playerID, proposalID, now)
+}
+
+func ProposalProviderFromStore(db *sql.DB) ProposalBackend {
+	return postgresProposalBackend{db: db}
+}

server/api/store_adapters_test.go

@@ -15,3 +15,13 @@ func TestAssignmentProviderFromStorePreservesPlayerScopedRecoveryBoundary(t *tes
 		t.Fatal("nil store was treated as an available assignment source")
 	}
 }
+
+func TestProposalProviderFromStoreFailsClosedWithoutDatabase(t *testing.T) {
+	provider := ProposalProviderFromStore(nil)
+	if provider == nil {
+		t.Fatal("proposal store provider was not created")
+	}
+	if _, err := provider.Get(context.Background(), "player-1", "proposal-1", time.Unix(1000, 0)); err == nil {
+		t.Fatal("nil store was treated as an available proposal source")
+	}
+}

server/store/proposal_recovery_sql.go

@@ -0,0 +1,77 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"time"
+
+	"github.com/cosmic-clash/cosmic-clash/server/domain"
+)
+
+const ProposalExpireSQL = `UPDATE proposals
+SET state = 'EXPIRED', revision = revision + 1
+WHERE proposal_id = $1 AND state = 'OPEN' AND expires_at <= $2`
+
+const ProposalParticipantExpireSQL = `UPDATE proposal_participants
+SET response = 'TIMED_OUT', responded_at = $2
+WHERE proposal_id = $1 AND response = 'PENDING'`
+
+const ProposalRecoverySelectSQL = `SELECT proposal_id, playlist, state, revision, expires_at
+FROM proposals
+WHERE proposal_id = $1
+  AND EXISTS (SELECT 1 FROM proposal_participants WHERE proposal_id = proposals.proposal_id AND player_id = $2)`
+
+const ProposalParticipantsSelectSQL = `SELECT player_id, response
+FROM proposal_participants
+WHERE proposal_id = $1
+ORDER BY player_id`
+
+// GetProposal recovers the full proposal only after proving the caller is a
+// participant. Expiry is advanced in the same transaction as the read so a
+// missed event cannot leave a durable proposal indefinitely OPEN.
+func GetProposal(ctx context.Context, db *sql.DB, playerID, proposalID string, now time.Time) (domain.Proposal, error) {
+	if db == nil || playerID == "" || proposalID == "" || now.IsZero() {
+		return domain.Proposal{}, fmt.Errorf("invalid proposal recovery arguments")
+	}
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return domain.Proposal{}, err
+	}
+	defer tx.Rollback()
+	if _, err := tx.ExecContext(ctx, ProposalExpireSQL, proposalID, now); err != nil {
+		return domain.Proposal{}, err
+	}
+	if _, err := tx.ExecContext(ctx, ProposalParticipantExpireSQL, proposalID, now); err != nil {
+		return domain.Proposal{}, err
+	}
+	var proposal domain.Proposal
+	var playlist, state string
+	if err := tx.QueryRowContext(ctx, ProposalRecoverySelectSQL, proposalID, playerID).Scan(&proposal.ProposalID, &playlist, &state, &proposal.Revision, &proposal.ExpiresAt); err != nil {
+		return domain.Proposal{}, err
+	}
+	proposal.Playlist = domain.Playlist(playlist)
+	proposal.State = domain.State(state)
+	rows, err := tx.QueryContext(ctx, ProposalParticipantsSelectSQL, proposalID)
+	if err != nil {
+		return domain.Proposal{}, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var participant domain.ProposalParticipant
+		if err := rows.Scan(&participant.PlayerID, &participant.Response); err != nil {
+			return domain.Proposal{}, err
+		}
+		proposal.Participants = append(proposal.Participants, participant)
+	}
+	if err := rows.Err(); err != nil {
+		return domain.Proposal{}, err
+	}
+	if len(proposal.Participants) == 0 {
+		return domain.Proposal{}, fmt.Errorf("proposal has no participants")
+	}
+	if err := tx.Commit(); err != nil {
+		return domain.Proposal{}, err
+	}
+	return proposal, nil
+}

server/store/proposal_recovery_sql_test.go

@@ -0,0 +1,30 @@
+package store
+
+import (
+	"testing"
+	"time"
+)
+
+func TestProposalRecoverySQLBindsParticipantAndExpiresAtReadBoundary(t *testing.T) {
+	for query, fragments := range map[string][]string{
+		ProposalExpireSQL:             {"state = 'OPEN'", "expires_at <= $2", "revision = revision + 1"},
+		ProposalParticipantExpireSQL:  {"response = 'PENDING'", "response = 'TIMED_OUT'"},
+		ProposalRecoverySelectSQL:     {"proposal_id = $1", "player_id = $2", "EXISTS"},
+		ProposalParticipantsSelectSQL: {"proposal_id = $1", "ORDER BY player_id"},
+	} {
+		for _, fragment := range fragments {
+			if !contains(query, fragment) {
+				t.Fatalf("query %q missing %q", query, fragment)
+			}
+		}
+	}
+}
+
+func TestProposalRecoveryRejectsMissingAuthorityInputs(t *testing.T) {
+	if _, err := GetProposal(nil, nil, "player-1", "proposal-1", time.Unix(1000, 0)); err == nil {
+		t.Fatal("nil database accepted")
+	}
+	if _, err := GetProposal(nil, nil, "", "proposal-1", time.Unix(1000, 0)); err == nil {
+		t.Fatal("empty player accepted")
+	}
+}