From eef7cf28da3c6312eac7d3fddcdff5ec79ee7382 Mon Sep 17 00:00:00 2001 From: Josh Creek <8179928+jcreek@users.noreply.github.com> Date: Tue, 1 Sep 2026 07:52:52 +0100 Subject: [PATCH] feat: make proposal responses durable --- multiplayer-todo.md | 4 +- server/api/service.go | 29 +++- server/api/service_test.go | 29 +++- server/api/store_adapters.go | 4 + server/store/proposal_recovery_sql.go | 165 +++++++++++++++++++++ server/store/proposal_recovery_sql_test.go | 13 +- 6 files changed, 228 insertions(+), 16 deletions(-) diff --git a/multiplayer-todo.md b/multiplayer-todo.md index 204cd1be..88a3dfce 100644 --- a/multiplayer-todo.md +++ b/multiplayer-todo.md @@ -1195,7 +1195,7 @@ the local/CI/community transport, not a silent production fallback. | 8.15 `[D:7.8,8.3]` | **IN PROGRESS.** Pure Go probe validation treats Steam location as opaque, requires nonce/freshness/region and server-computed RTT, and implements discrepancy quarantine/release; authenticated HTTP now accepts only opaque location/nonce input through a server-owned probe provider | `server/domain/probes.go`, adversarial fixtures and `server/api/service.go` cover stale/wrong/forged evidence, the 25 ms/30% threshold, three-sample quarantine, five-clean release, authenticated provider arguments and rejection of client RTT fields; Steam coordinator and regional probe adapters remain | | 8.16 `[D:8.14,8.15]` | **IN PROGRESS.** Pure Go candidate/team selection implements the <=100 ms ceiling, pairwise widening tolerance, anchor inclusion, deterministic set/region scoring and balanced team partitioning; queue-backed formation now consumes the server-owned projection, fences duplicate player identities and rejects playlist/build/protocol mixing | `server/domain/matcher.go`, `teams.go` and adversarial fixtures cover no-common-region, tolerance boundaries, lexical ties, mean-rating balance, malformed candidates, duplicate identities, compatibility mismatches and queue-backed oldest-anchor formation; full population fixtures and durable matcher claim integration remain | | 8.17 `[D:8.14,8.16]` | **IN PROGRESS.** Pure Go proposal policy sends a 10-second response window to every selected human, requires unanimous acceptance, applies exact decline/timeout cooldowns and ranked escalation; authenticated API exposes revisioned accept/decline mutations; formed matches now pass through a playlist-aware proposal boundary | `server/domain/proposal.go`, `formation.go` and `server/api/service.go` plus adversarial fixtures cover partial/unanimous response, expiry, replay/conflict, stale API revision, casual lineup preparation and ranked metadata validation; queue precedence and allocation integration remain | -| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now inserts proposal/participants and promotes every ticket in one rollback-safe transaction with player- and playlist-bound claim predicates, queue creation has a durable idempotency/owner-read adapter, and participant-scoped proposal recovery now expires OPEN proposals and pending participants transactionally at read time | `server/store/serializable.go`, `queue_sql.go`, `proposal_sql.go`, `proposal_recovery_sql.go` and tests cover retry classification, claim-boundary invariants, player/ticket/playlist mapping, durable queue replay/conflict, owner-scoped queue/proposal recovery, expiry/read boundaries, zero-row claim aborts and atomic statement ordering; live PostgreSQL adapter execution, Redis candidate index/repair, worker-failure and concurrent two-matcher integration tests remain | +| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now inserts proposal/participants and promotes every ticket in one rollback-safe transaction with player- and playlist-bound claim predicates, queue creation has a durable idempotency/owner-read adapter, participant-scoped proposal recovery now expires OPEN proposals and pending participants transactionally at read time, and proposal accept/decline now uses participant/proposal locks, revision fencing and durable idempotency | `server/store/serializable.go`, `queue_sql.go`, `proposal_sql.go`, `proposal_recovery_sql.go` and tests cover retry classification, claim-boundary invariants, player/ticket/playlist mapping, durable queue replay/conflict, owner-scoped queue/proposal recovery, expiry/read boundaries, response replay/conflict, stale revisions, zero-row claim aborts and atomic statement ordering; live PostgreSQL adapter execution, Redis candidate index/repair, worker-failure and concurrent two-matcher integration tests remain | | 8.19 `[D:8.18]` | **IN PROGRESS.** Pure Go casual lineup requires 2–6 humans with at least one per team, fills missing slots with explicit bots, permits kickoff-only bot-slot backfill and assigns no backfill penalty/rating update; proposal preparation now derives the lineup from formed teams | `server/domain/casual.go`, `formation.go` cover both-team minimum, bot shape, live-play rejection, zero-penalty backfill and casual proposal composition; queue candidate selection, opt-in 10 s backfill proposals, reconnect/leave penalties and live integration remain | | 8.20 `[D:8.18]` | **IN PROGRESS.** Pure Go ranked admission requires six unique verified solo humans, rejects bots/backfill/parties, and allows only random-enabled non-elevated arenas; proposal preparation requires matching metadata for every formed player | `server/domain/ranked.go`, `formation.go` cover count, identity, party, bot/backfill, arena eligibility and formed-player metadata rejection; `ArenaRegistry` integration, allocation wiring and innocent-ticket restoration remain | | 8.21 `[D:8.5,8.20]` | **IN PROGRESS.** Pure Go rating core implements canonical Glicko-2, daily inactivity, ranked 1/3 and casual 1/N human-opponent weights, deterministic opponent ordering, and authoritative draw/overtime/abandon scoring | `server/domain/rating.go` has canonical/inactivity/weight/invalid-input plus draw/OT/abandon fixtures; PostgreSQL snapshot locking, rating transaction integration, seasons and concurrent result transaction tests remain | @@ -1226,7 +1226,7 @@ the local/CI/community transport, not a silent production fallback. | # | Task | Acceptance | |---|---|---| -| 8.39 `[D:8.3,8.14,8.17]` | **IN PROGRESS.** `MatchmakingState` now projects queue → proposal → allocation/process-ready/assignment-ready/connect/live plus terminal failure states; autoload `ControlPlaneClient` provides authenticated queue create/recovery/heartbeat/cancel and proposal response requests with idempotency/revision headers; `matchmaking.tscn`/`matchmaking.gd` expose the state and authoritative actions from the main menu; authenticated proposal recovery now reconciles missed proposal events and expires them at read time; the Go API publishes targeted authenticated revisioned queue/proposal/assignment events and the Godot client consumes state/proposal/assignment events, fetching the authoritative assignment after assignment readiness; the API can now use the durable participant-scoped proposal provider | `test_matchmaking_state.gd`, `test_control_plane_client.gd`, `test_matchmaking_ui.gd`, `TestProposalRecoveryIsParticipantScopedAndExpiresAtReadBoundary`, `TestAuthenticatedWebSocketDeliversOnlyTargetedRevisionedEvents`, `TestStateChangingAPIActionsPublishTargetedEvents` and `TestProposalRecoveryUsesDurableBackendAndRemainsParticipantScoped` reject stale/gapped/conflicting updates, validate endpoint/token/payload normalization, preserve idempotent duplicates, and guarantee visible phase/terminal copy; wiring durable allocation events into the outbox, wait/latency explanations and Godot runtime verification remain | +| 8.39 `[D:8.3,8.14,8.17]` | **IN PROGRESS.** `MatchmakingState` now projects queue → proposal → allocation/process-ready/assignment-ready/connect/live plus terminal failure states; autoload `ControlPlaneClient` provides authenticated queue create/recovery/heartbeat/cancel and proposal response requests with idempotency/revision headers; `matchmaking.tscn`/`matchmaking.gd` expose the state and authoritative actions from the main menu; authenticated proposal recovery now reconciles missed proposal events and expires them at read time; the Go API publishes targeted authenticated revisioned queue/proposal/assignment events and the Godot client consumes state/proposal/assignment events, fetching the authoritative assignment after assignment readiness; the API can now use the durable participant-scoped proposal provider for both recovery and accept/decline mutations | `test_matchmaking_state.gd`, `test_control_plane_client.gd`, `test_matchmaking_ui.gd`, `TestProposalRecoveryIsParticipantScopedAndExpiresAtReadBoundary`, `TestAuthenticatedWebSocketDeliversOnlyTargetedRevisionedEvents`, `TestStateChangingAPIActionsPublishTargetedEvents`, `TestProposalRecoveryUsesDurableBackendAndRemainsParticipantScoped` and store proposal SQL tests reject stale/gapped/conflicting updates, validate endpoint/token/payload normalization, preserve idempotent duplicates, and guarantee visible phase/terminal copy; wiring durable allocation events into the outbox, wait/latency explanations and Godot runtime verification remain | | 8.40 `[D:8.3,8.14]` | **IN PROGRESS.** Pure Go revisioned replica reducer rejects gaps for REST resync, makes duplicate/out-of-order events idempotent, and resumes from the authoritative snapshot revision; authenticated queue-ticket recovery now has an owner-checked REST read; Godot client projection persists non-secret ticket/proposal state, forces authoritative recovery after restart, and can replay a lost queue-create response with the original ticket/idempotency key; the Go API now exposes an authenticated `/v1/events` WebSocket with bounded per-player queues, strict upgrade/vocabulary validation and REST-resync-safe slow-client failure; Godot `ControlPlaneClient` can connect to the stream, consume validated events, automatically reconnect with bounded backoff, and trigger REST recovery on projection gaps and stream return | `server/domain/sync.go`, `server/api/events.go`, `server/api/service.go`, `service_test.go`, `matchmaking_state.gd` and `control_plane_client.gd` cover gap, snapshot, replay, same-revision conflict, owner-only ticket recovery, expired-ticket terminal handling, malformed restart snapshots, API-level duplicate-create replay/conflict, authenticated handshake/key rejection, targeted event delivery, exactly-once slow-subscriber closure and invalid-event rejection; durable outbox fan-out and live Godot verification remain | | 8.41 `[D:7.8,8.9,8.31,8.40]` | **IN PROGRESS.** Authenticated `GET /v1/assignments/{matchId}` now exposes only a validated, player-scoped assignment view; Godot `AssignmentState`/`ControlPlaneClient.fetch_assignment()` bind the response to the authenticated player, recheck expiry, preserve explicit transport/slot/join authorisation and do not connect before assignment-ready; migration 0002 and the Go store adapter now persist/recover the complete player-scoped assignment projection with conflict-safe identical replay; `AssignmentProviderFromStore` wires that durable projection into the API injection point | `server/api/service.go`, `store_adapters.go`, `service_test.go`, `assignment_state.gd`, `test_assignment_state.gd`, `server/migrations/0002_assignments.sql` and `server/store/assignment_sql.go` cover participant/identity/expiry/shape/transport boundaries, player-scoped schema keys, expiry-filtered reads, assignment upsert conflict handling and nil-store fail-closed behavior; signed manifest-to-player persistence wiring, SDR relay-ticket installation, `hello` join-authorisation wiring, fencing integration and live Godot/PostgreSQL verification remain | | 8.42 `[D:8.22,8.23,8.24,8.40]` | **IN PROGRESS.** `RankedProfileState` and `ControlPlaneClient.fetch_ranked_profile()` expose the backend-authoritative rating/RD/volatility/games/tier/provisional/season view; matchmaking UI displays provisional/tier status without client-side rating math | `test_control_plane_client.gd` validates profile shape, numeric safety and provisional display; ranked profile fetch/display, committed revision after reconnect, abandon status and season countdown remain dependent on live auth/backend events and Godot runtime verification | diff --git a/server/api/service.go b/server/api/service.go index f08d409f..63bba26b 100644 --- a/server/api/service.go +++ b/server/api/service.go @@ -45,6 +45,9 @@ type SessionIssuer interface { type ProposalBackend interface { Get(context.Context, string, string, time.Time) (domain.Proposal, error) } +type ProposalMutationBackend interface { + Respond(context.Context, string, string, string, bool, uint64, time.Time) (domain.Proposal, error) +} type AssignmentView struct { MatchID string `json:"match_id"` @@ -451,15 +454,25 @@ func (s *Service) proposalMutation(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_revision") return } - s.proposalMu.Lock() - defer s.proposalMu.Unlock() - proposal, exists := s.Proposals[parts[0]] - if !exists || proposal == nil { - writeError(w, http.StatusNotFound, "not_found") - return - } now := s.now() - updated, err := proposal.Respond(playerID, key, parts[1] == "accept", revision, now) + var updated domain.Proposal + if s.ProposalBackend != nil { + mutator, supportsMutation := s.ProposalBackend.(ProposalMutationBackend) + if !supportsMutation { + writeError(w, http.StatusServiceUnavailable, "proposal_unavailable") + return + } + updated, err = mutator.Respond(r.Context(), playerID, parts[0], key, parts[1] == "accept", revision, now) + } else { + s.proposalMu.Lock() + defer s.proposalMu.Unlock() + proposal, exists := s.Proposals[parts[0]] + if !exists || proposal == nil { + writeError(w, http.StatusNotFound, "not_found") + return + } + updated, err = proposal.Respond(playerID, key, parts[1] == "accept", revision, now) + } if err != nil { writeDomainError(w, err) return diff --git a/server/api/service_test.go b/server/api/service_test.go index dd712757..c578d562 100644 --- a/server/api/service_test.go +++ b/server/api/service_test.go @@ -22,8 +22,18 @@ type queueBackendSpy struct{ createCalls, heartbeatCalls, cancelCalls, getCalls type sessionBackendSpy struct{ calls int } type proposalBackendSpy struct { - proposal domain.Proposal - calls int + proposal domain.Proposal + calls int + mutations int +} + +func (b *proposalBackendSpy) Respond(_ context.Context, playerID, _ string, key string, accept bool, revision uint64, now time.Time) (domain.Proposal, error) { + b.mutations++ + updated, err := b.proposal.Respond(playerID, key, accept, revision, now) + if err == nil { + b.proposal = updated + } + return updated, err } func (b *proposalBackendSpy) Get(_ context.Context, playerID, _ string, _ time.Time) (domain.Proposal, error) { @@ -389,6 +399,21 @@ func TestProposalRecoveryUsesDurableBackendAndRemainsParticipantScoped(t *testin if status := get(participantSession, participantToken); status != http.StatusOK { t.Fatalf("participant recovery status = %d", status) } + respond, err := http.NewRequest(http.MethodPost, server.URL+"/v1/proposals/"+proposal.ProposalID+"/accept", nil) + if err != nil { + t.Fatal(err) + } + respond.Header.Set("Authorization", "Bearer "+participantSession.SessionID+":"+participantToken) + respond.Header.Set("Idempotency-Key", "proposal-durable-response-123456") + respond.Header.Set("If-Match-Revision", "0") + response, err := server.Client().Do(respond) + if err != nil { + t.Fatal(err) + } + _ = response.Body.Close() + if response.StatusCode != http.StatusOK || backend.mutations != 1 { + t.Fatalf("durable response status = %d, mutations = %d", response.StatusCode, backend.mutations) + } if status := get(outsiderSession, outsiderToken); status != http.StatusNotFound { t.Fatalf("outsider recovery status = %d", status) } diff --git a/server/api/store_adapters.go b/server/api/store_adapters.go index d54d4abb..966c1032 100644 --- a/server/api/store_adapters.go +++ b/server/api/store_adapters.go @@ -37,6 +37,10 @@ func (p postgresProposalBackend) Get(ctx context.Context, playerID, proposalID s return store.GetProposal(ctx, p.db, playerID, proposalID, now) } +func (p postgresProposalBackend) Respond(ctx context.Context, playerID, proposalID, idempotencyKey string, accept bool, expectedRevision uint64, now time.Time) (domain.Proposal, error) { + return store.RespondToProposal(ctx, p.db, playerID, proposalID, idempotencyKey, accept, expectedRevision, now) +} + func ProposalProviderFromStore(db *sql.DB) ProposalBackend { return postgresProposalBackend{db: db} } diff --git a/server/store/proposal_recovery_sql.go b/server/store/proposal_recovery_sql.go index e798a341..bdc25249 100644 --- a/server/store/proposal_recovery_sql.go +++ b/server/store/proposal_recovery_sql.go @@ -1,8 +1,11 @@ package store import ( + "bytes" "context" + "crypto/sha256" "database/sql" + "encoding/json" "fmt" "time" @@ -27,6 +30,50 @@ FROM proposal_participants WHERE proposal_id = $1 ORDER BY player_id` +const ProposalResponseIdempotencyScope = "proposal.respond" + +const ProposalResponseIdempotencyInsertSQL = `INSERT INTO idempotency_keys + (scope, idempotency_key, payload_digest, result) +VALUES ($1, $2, $3, $4) +ON CONFLICT (scope, idempotency_key) DO NOTHING` + +const ProposalResponseIdempotencySelectSQL = `SELECT payload_digest, result +FROM idempotency_keys +WHERE scope = $1 AND idempotency_key = $2 +FOR UPDATE` + +const ProposalLockSQL = `SELECT playlist, state, revision, expires_at +FROM proposals +WHERE proposal_id = $1 +FOR UPDATE` + +const ProposalParticipantLockSQL = `SELECT response +FROM proposal_participants +WHERE proposal_id = $1 AND player_id = $2 +FOR UPDATE` + +const ProposalParticipantRespondSQL = `UPDATE proposal_participants +SET response = $3, responded_at = $4 +WHERE proposal_id = $1 AND player_id = $2 AND response = 'PENDING'` + +const ProposalCountPendingSQL = `SELECT COUNT(*) +FROM proposal_participants +WHERE proposal_id = $1 AND response = 'PENDING'` + +const ProposalAcceptSQL = `UPDATE proposals +SET state = 'ACCEPTED', revision = revision + 1 +WHERE proposal_id = $1 AND state = 'OPEN'` + +const ProposalDeclineSQL = `UPDATE proposals +SET state = 'DECLINED', revision = revision + 1 +WHERE proposal_id = $1 AND state = 'OPEN'` + +const ProposalRevisionBumpSQL = `UPDATE proposals +SET revision = revision + 1 +WHERE proposal_id = $1 AND state = 'OPEN'` + +var ErrProposalResponseConflict = fmt.Errorf("proposal response conflict") + // GetProposal recovers the full proposal only after proving the caller is a // participant. Expiry is advanced in the same transaction as the read so a // missed event cannot leave a durable proposal indefinitely OPEN. @@ -75,3 +122,121 @@ func GetProposal(ctx context.Context, db *sql.DB, playerID, proposalID string, n } return proposal, nil } + +// RespondToProposal is the durable mutation counterpart to GetProposal. The +// proposal row and participant row are locked in one transaction; the result +// is stored under the idempotency key before the transaction commits. +func RespondToProposal(ctx context.Context, db *sql.DB, playerID, proposalID, idempotencyKey string, accept bool, expectedRevision uint64, now time.Time) (domain.Proposal, error) { + if db == nil || playerID == "" || proposalID == "" || len(idempotencyKey) < 16 || len(idempotencyKey) > 128 || now.IsZero() { + return domain.Proposal{}, fmt.Errorf("invalid proposal response arguments") + } + digest := sha256.Sum256([]byte(fmt.Sprintf("%s|%s|%t|%d", playerID, proposalID, accept, expectedRevision))) + var proposal domain.Proposal + err := RunSerializable(ctx, db, DefaultSerializableAttempts, func(ctx context.Context, tx *sql.Tx) error { + result, err := tx.ExecContext(ctx, ProposalResponseIdempotencyInsertSQL, ProposalResponseIdempotencyScope, idempotencyKey, digest[:], []byte("{}")) + if err != nil { + return err + } + inserted, err := result.RowsAffected() + if err != nil { + return err + } + if inserted == 0 { + var priorDigest, priorResult []byte + if err := tx.QueryRowContext(ctx, ProposalResponseIdempotencySelectSQL, ProposalResponseIdempotencyScope, idempotencyKey).Scan(&priorDigest, &priorResult); err != nil { + return err + } + if !bytes.Equal(priorDigest, digest[:]) { + return ErrProposalResponseConflict + } + if err := json.Unmarshal(priorResult, &proposal); err != nil { + return fmt.Errorf("invalid stored proposal response: %w", err) + } + return nil + } + + var playlist, state string + var revision uint64 + var expiresAt time.Time + if err := tx.QueryRowContext(ctx, ProposalLockSQL, proposalID).Scan(&playlist, &state, &revision, &expiresAt); err != nil { + return err + } + if state != string(domain.Open) || !now.Before(expiresAt) { + return domain.ErrProposalClosed + } + if revision != expectedRevision { + return domain.ErrStaleRevision + } + var response string + if err := tx.QueryRowContext(ctx, ProposalParticipantLockSQL, proposalID, playerID).Scan(&response); err != nil { + return domain.ErrNotParticipant + } + if response != string(domain.Pending) { + return domain.ErrConflict + } + response = string(domain.DeclinedResponse) + if accept { + response = string(domain.AcceptedResponse) + } + changed, err := tx.ExecContext(ctx, ProposalParticipantRespondSQL, proposalID, playerID, response, now) + if err != nil { + return err + } + if count, err := changed.RowsAffected(); err != nil || count != 1 { + return ErrProposalResponseConflict + } + targetState := string(domain.Declined) + if accept { + var pending int + if err := tx.QueryRowContext(ctx, ProposalCountPendingSQL, proposalID).Scan(&pending); err != nil { + return err + } + if pending == 0 { + targetState = string(domain.Accepted) + } else { + targetState = state + } + } + if targetState != state { + if targetState == string(domain.Accepted) { + _, err = tx.ExecContext(ctx, ProposalAcceptSQL, proposalID) + } else { + _, err = tx.ExecContext(ctx, ProposalDeclineSQL, proposalID) + } + if err != nil { + return err + } + revision++ + } else { + if _, err := tx.ExecContext(ctx, ProposalRevisionBumpSQL, proposalID); err != nil { + return err + } + revision++ + } + proposal = domain.Proposal{ProposalID: proposalID, Playlist: domain.Playlist(playlist), State: domain.State(targetState), Revision: revision, ExpiresAt: expiresAt} + rows, err := tx.QueryContext(ctx, ProposalParticipantsSelectSQL, proposalID) + if err != nil { + return err + } + for rows.Next() { + var participant domain.ProposalParticipant + if err := rows.Scan(&participant.PlayerID, &participant.Response); err != nil { + rows.Close() + return err + } + proposal.Participants = append(proposal.Participants, participant) + } + if err := rows.Err(); err != nil { + rows.Close() + return err + } + rows.Close() + stored, err := json.Marshal(proposal) + if err != nil { + return err + } + _, err = tx.ExecContext(ctx, `UPDATE idempotency_keys SET result = $3 WHERE scope = $1 AND idempotency_key = $2`, ProposalResponseIdempotencyScope, idempotencyKey, stored) + return err + }) + return proposal, err +} diff --git a/server/store/proposal_recovery_sql_test.go b/server/store/proposal_recovery_sql_test.go index a38d264e..90286dc6 100644 --- a/server/store/proposal_recovery_sql_test.go +++ b/server/store/proposal_recovery_sql_test.go @@ -7,10 +7,15 @@ import ( func TestProposalRecoverySQLBindsParticipantAndExpiresAtReadBoundary(t *testing.T) { for query, fragments := range map[string][]string{ - ProposalExpireSQL: {"state = 'OPEN'", "expires_at <= $2", "revision = revision + 1"}, - ProposalParticipantExpireSQL: {"response = 'PENDING'", "response = 'TIMED_OUT'"}, - ProposalRecoverySelectSQL: {"proposal_id = $1", "player_id = $2", "EXISTS"}, - ProposalParticipantsSelectSQL: {"proposal_id = $1", "ORDER BY player_id"}, + ProposalExpireSQL: {"state = 'OPEN'", "expires_at <= $2", "revision = revision + 1"}, + ProposalParticipantExpireSQL: {"response = 'PENDING'", "response = 'TIMED_OUT'"}, + ProposalRecoverySelectSQL: {"proposal_id = $1", "player_id = $2", "EXISTS"}, + ProposalParticipantsSelectSQL: {"proposal_id = $1", "ORDER BY player_id"}, + ProposalResponseIdempotencyInsertSQL: {"ON CONFLICT (scope, idempotency_key) DO NOTHING", "payload_digest"}, + ProposalLockSQL: {"proposal_id = $1", "FOR UPDATE"}, + ProposalParticipantLockSQL: {"proposal_id = $1", "player_id = $2", "FOR UPDATE"}, + ProposalParticipantRespondSQL: {"response = 'PENDING'", "responded_at"}, + ProposalRevisionBumpSQL: {"revision = revision + 1", "state = 'OPEN'"}, } { for _, fragment := range fragments { if !contains(query, fragment) {