fix: two-player lobby deadlock

2026-08-30 23:42:26 +03:00
parent d5eb26d330
commit 93af738e36
9 changed files with 77 additions and 10 deletions
@@ -66,6 +66,11 @@ The session token is in each POST body. For `GET /api/state`, it is supplied
 in `X-Session-Token`; absence creates a spectator-safe view. It is never a URL
 parameter.

+For the primary “Play” action, `requestedRole: "player"` atomically assigns
+the first available player slot (`player1`, then `player2`). This avoids a
+client-side availability race; the response and every authorized state snapshot
+contain the assigned concrete role.
+
 `leave` and `profile-reset` release only the requesting session; profile data is
 cleared by the browser in Milestone 022. A player leaving an active match aborts
 that match and returns remaining valid players to the lobby. `game/reset` is