feat: persist authenticated queue probe RTT

server/api/service.go

@@ -26,6 +26,9 @@ const maxBodyBytes = 8 << 10
 type CandidateProvider func(playerID, ticketID string) (domain.Candidate, error)
 type CandidateProviderV2 func(playerID, ticketID string, spec domain.QueueSpec) (domain.Candidate, error)
 type ProbeProvider func(playerID, region string, opaqueLocation, nonce []byte, receivedAt time.Time) (domain.ProbeEvidence, []byte, error)
+type ProbeRecorder interface {
+	RecordProbe(context.Context, string, string, time.Duration, time.Time) error
+}
 
 type QueueBackend interface {
 	Create(context.Context, string, string, string, domain.QueueSpec, time.Time) (domain.QueueTicket, error)
@@ -86,6 +89,7 @@ type Service struct {
 	QueueBackend    QueueBackend
 	CandidateIndex  CandidateIndex
 	Probe           ProbeProvider
+	ProbeRecorder   ProbeRecorder
 	Assignment      AssignmentProvider
 	Now             func() time.Time
 	Proposals       map[string]*domain.Proposal
@@ -653,6 +657,12 @@ func (s *Service) probe(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusUnprocessableEntity, "invalid_probe")
 		return
 	}
+	if s.ProbeRecorder != nil {
+		if err := s.ProbeRecorder.RecordProbe(r.Context(), playerID, region, evidence.ServerRTT, receivedAt); err != nil {
+			writeError(w, http.StatusServiceUnavailable, "probe_persistence_failed")
+			return
+		}
+	}
 	writeJSON(w, http.StatusAccepted, map[string]any{"region": region, "server_rtt_ms": evidence.ServerRTT.Milliseconds(), "status": "accepted"})
 }
 

server/api/service_test.go

@@ -25,6 +25,21 @@ type candidateIndexSpy struct {
 	last                     domain.Candidate
 }
 
+type probeRecorderSpy struct {
+	calls int
+	err   error
+	last  struct {
+		player, region string
+		rtt            time.Duration
+	}
+}
+
+func (p *probeRecorderSpy) RecordProbe(_ context.Context, player, region string, rtt time.Duration, _ time.Time) error {
+	p.calls++
+	p.last.player, p.last.region, p.last.rtt = player, region, rtt
+	return p.err
+}
+
 func (i *candidateIndexSpy) Upsert(_ context.Context, candidate domain.Candidate) error {
 	i.upsertCalls++
 	i.last = candidate
@@ -936,6 +951,36 @@ func TestProbeAPIUsesServerEvidenceAndRejectsClientRTTField(t *testing.T) {
 	_ = response.Body.Close()
 }
 
+func TestProbeAPIRecordsOnlyValidatedServerEvidence(t *testing.T) {
+	now := time.Unix(1000, 0).UTC()
+	sessions := domain.NewSessionStore()
+	session, token, _ := sessions.Issue("player-a", time.Hour, now)
+	recorder := &probeRecorderSpy{}
+	service := &Service{Sessions: sessions, Now: func() time.Time { return now }, ProbeRecorder: recorder, Probe: func(_ string, region string, location, nonce []byte, _ time.Time) (domain.ProbeEvidence, []byte, error) {
+		return domain.ProbeEvidence{OpaqueLocation: location, Nonce: nonce, IssuedAt: now, Region: region, ServerRTT: 37 * time.Millisecond}, nonce, nil
+	}}
+	server := httptest.NewServer(service.Handler())
+	defer server.Close()
+	req, _ := http.NewRequest(http.MethodPost, server.URL+"/v1/probes/NA", strings.NewReader(`{"opaque_location":"b3BhcXVl","nonce":"bm9uY2U="}`))
+	req.Header.Set("Authorization", "Bearer "+session.SessionID+":"+token)
+	response, err := http.DefaultClient.Do(req)
+	if err != nil || response.StatusCode != http.StatusAccepted {
+		t.Fatalf("status=%v err=%v", response.StatusCode, err)
+	}
+	response.Body.Close()
+	if recorder.calls != 1 || recorder.last.player != "player-a" || recorder.last.region != "NA" || recorder.last.rtt != 37*time.Millisecond {
+		t.Fatalf("recorded probe=%+v calls=%d", recorder.last, recorder.calls)
+	}
+	recorder.err = errors.New("database unavailable")
+	req, _ = http.NewRequest(http.MethodPost, server.URL+"/v1/probes/NA", strings.NewReader(`{"opaque_location":"b3BhcXVl","nonce":"bm9uY2U="}`))
+	req.Header.Set("Authorization", "Bearer "+session.SessionID+":"+token)
+	response, err = http.DefaultClient.Do(req)
+	if err != nil || response.StatusCode != http.StatusServiceUnavailable {
+		t.Fatalf("persistence status=%v err=%v", response.StatusCode, err)
+	}
+	response.Body.Close()
+}
+
 func TestProposalRecoveryIsParticipantScopedAndExpiresAtReadBoundary(t *testing.T) {
 	now := time.Unix(1000, 0).UTC()
 	sessions := domain.NewSessionStore()

server/domain/queue.go

@@ -163,6 +163,34 @@ func (q *Queue) Expire(now time.Time) []QueueTicket {
 	return q.expireLocked(now)
 }
 
+// RecordProbe stores server-computed RTT metadata on the player's active
+// ticket. It never accepts client-provided latency and refuses expired or
+// non-queueable tickets.
+func (q *Queue) RecordProbe(playerID, region string, rtt time.Duration, now time.Time) error {
+	if playerID == "" || (region != "EU" && region != "NA") || rtt < 0 || now.IsZero() {
+		return fmt.Errorf("invalid probe recording")
+	}
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	ticketID, ok := q.byPlayer[playerID]
+	if !ok {
+		return ErrTicketNotFound
+	}
+	ticket, ok := q.tickets[ticketID]
+	if !ok || (ticket.State != Queued && ticket.State != Proposed) {
+		return ErrTicketNotFound
+	}
+	if !now.Before(ticket.ExpiresAt) {
+		return ErrTicketExpired
+	}
+	if ticket.Candidate.PredictedRTT == nil {
+		ticket.Candidate.PredictedRTT = make(map[string]float64)
+	}
+	ticket.Candidate.PredictedRTT[region] = float64(rtt) / float64(time.Millisecond)
+	q.tickets[ticketID] = ticket
+	return nil
+}
+
 func (q *Queue) expireLocked(now time.Time) []QueueTicket {
 	var expired []QueueTicket
 	for id, ticket := range q.tickets {

server/domain/queue_test.go

@@ -136,3 +136,24 @@ func TestQueueConcurrentCreateKeepsOneActiveTicketPerPlayer(t *testing.T) {
 		t.Fatalf("concurrent creates succeeded %d times", succeeded)
 	}
 }
+
+func TestQueueRecordProbeBindsServerRTTToActivePlayerTicket(t *testing.T) {
+	now := time.Unix(1000, 0).UTC()
+	queue := NewQueue()
+	if _, err := queue.Create("player-a", "ticket-a", "create-key-123456", Candidate{PlayerID: "player-a", TicketID: "ticket-a", Playlist: Casual, EnqueuedAt: now}, now); err != nil {
+		t.Fatal(err)
+	}
+	if err := queue.RecordProbe("player-a", "EU", 42*time.Millisecond, now); err != nil {
+		t.Fatal(err)
+	}
+	ticket, err := queue.Get("player-a", "ticket-a", now)
+	if err != nil || ticket.Candidate.PredictedRTT["EU"] != 42 {
+		t.Fatalf("ticket=%+v err=%v", ticket, err)
+	}
+	if err := queue.RecordProbe("player-a", "NA", time.Millisecond, now.Add(QueueExpiryWindow)); err != ErrTicketExpired {
+		t.Fatalf("expired record err=%v", err)
+	}
+	if err := queue.RecordProbe("player-other", "EU", time.Millisecond, now); err != ErrTicketNotFound {
+		t.Fatalf("unknown player err=%v", err)
+	}
+}

server/store/queue_sql.go

@@ -137,6 +137,28 @@ type queueTicketRecord struct {
 
 type PostgresQueue struct{ DB *sql.DB }
 
+const QueueProbeRecordSQL = `UPDATE queue_tickets
+SET predicted_rtt = jsonb_set(COALESCE(predicted_rtt, '{}'::jsonb), ARRAY[$2], to_jsonb($3::double precision), true)
+WHERE player_id = $1 AND state IN ('QUEUED', 'PROPOSED') AND expires_at > $4`
+
+func (q PostgresQueue) RecordProbe(ctx context.Context, playerID, region string, rtt time.Duration, now time.Time) error {
+	if q.DB == nil || playerID == "" || (region != "EU" && region != "NA") || rtt < 0 || now.IsZero() {
+		return fmt.Errorf("invalid probe recording")
+	}
+	result, err := q.DB.ExecContext(ctx, QueueProbeRecordSQL, playerID, region, float64(rtt)/float64(time.Millisecond), now)
+	if err != nil {
+		return err
+	}
+	changed, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if changed == 0 {
+		return domain.ErrTicketNotFound
+	}
+	return nil
+}
+
 func (q PostgresQueue) Create(ctx context.Context, playerID, ticketID, idempotencyKey string, spec domain.QueueSpec, now time.Time) (domain.QueueTicket, error) {
 	return CreateQueueTicket(ctx, q.DB, ticketID, playerID, idempotencyKey, spec, now)
 }