fix(data): serialize portfolio publication validation

compose.yaml

@@ -72,6 +72,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+      bot:
+        condition: service_healthy
     environment:
       - "ConnectionStrings__gmrelaydb=Host=db;Port=5432;Database=gmrelay_db;Username=gmrelay;Password=${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}"
       - "Discord__Token=${DISCORD_BOT_TOKEN:?Set DISCORD_BOT_TOKEN in .env}"
@@ -89,6 +91,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+      bot:
+        condition: service_healthy
     environment:
       - "ConnectionStrings__gmrelaydb=Host=db;Port=5432;Database=gmrelay_db;Username=gmrelay;Password=${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}"
       - "Telegram__BotToken=${TELEGRAM_BOT_TOKEN:?Set TELEGRAM_BOT_TOKEN in .env}"

docs/superpowers/plans/2026-05-30-completed-game-portfolio.md

@@ -30,6 +30,7 @@
 - `src/GmRelay.Web/Components/Pages/PublicPortfolio.razor`
 - `tests/GmRelay.Bot.Tests/Web/PortfolioMigrationTests.cs`
 - `tests/GmRelay.Bot.Tests/Web/PortfolioSessionDeletionSourceTests.cs`
+- `tests/GmRelay.Bot.Tests/Web/PortfolioSchemaGateSourceTests.cs`
 - `tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresFixture.cs`
 - `tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresTests.cs`
 - `tests/GmRelay.Bot.Tests/Web/PortfolioContractsTests.cs`
@@ -69,6 +70,7 @@
 **Files:**
 - Create: `tests/GmRelay.Bot.Tests/Web/PortfolioMigrationTests.cs`
 - Create: `tests/GmRelay.Bot.Tests/Web/PortfolioSessionDeletionSourceTests.cs`
+- Create: `tests/GmRelay.Bot.Tests/Web/PortfolioSchemaGateSourceTests.cs`
 - Create: `tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresFixture.cs`
 - Create: `tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresTests.cs`
 - Create: `src/GmRelay.Bot/Migrations/V029__add_completed_game_portfolios_and_reviews.sql`
@@ -76,6 +78,7 @@
 - Modify: `src/GmRelay.DiscordBot/Features/Sessions/DiscordDeleteSessionHandler.cs`
 - Modify: `tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj`
 - Modify: `tests/GmRelay.Bot.Tests/packages.lock.json`
+- Modify: `compose.yaml`
 
 - [ ] **Step 1: Write the failing migration and session-deletion source-contract tests**
 
@@ -106,6 +109,7 @@ public async Task MigrationV029_ShouldCreatePortfolioTablesAndPublicationGuards(
     Assert.Contains("CREATE INDEX ix_portfolio_game_masters_player ON portfolio_game_masters (player_id, portfolio_game_id);", normalizedMigration, StringComparison.Ordinal);
     Assert.Contains("CREATE INDEX ix_portfolio_game_reviews_pending ON portfolio_game_reviews (portfolio_game_id, created_at DESC) WHERE moderation_status = 'Pending';", normalizedMigration, StringComparison.Ordinal);
     Assert.Contains("CREATE FUNCTION validate_public_portfolio_game_required_links() RETURNS TRIGGER LANGUAGE plpgsql", normalizedMigration, StringComparison.Ordinal);
+    Assert.Contains("PERFORM pg_advisory_xact_lock(20260530, 108);", normalizedMigration, StringComparison.Ordinal);
     Assert.Contains("USING ERRCODE = '23514';", normalizedMigration, StringComparison.Ordinal);
     Assert.Contains("CREATE CONSTRAINT TRIGGER trg_portfolio_games_validate_required_links AFTER INSERT OR UPDATE OF is_public ON portfolio_games DEFERRABLE INITIALLY DEFERRED", normalizedMigration, StringComparison.Ordinal);
     Assert.Contains("CREATE CONSTRAINT TRIGGER trg_portfolio_game_sessions_validate_required_links AFTER DELETE OR UPDATE OF portfolio_game_id ON portfolio_game_sessions DEFERRABLE INITIALLY DEFERRED", normalizedMigration, StringComparison.Ordinal);
@@ -157,12 +161,15 @@ public async Task DiscordDeleteSessionHandler_ShouldUnpublishOnlyCardsFromTheInt
         "UPDATE portfolio_games pg SET is_public = false, updated_at = now() FROM portfolio_game_sessions pgs JOIN sessions s ON s.id = pgs.session_id JOIN game_groups g ON g.id = s.group_id WHERE pgs.portfolio_game_id = pg.id AND s.id = @SessionId AND g.platform = 'Discord' AND g.external_group_id = @GuildId AND pg.is_public = true";
 
     Assert.Contains(unpublish, source, StringComparison.Ordinal);
+    Assert.Contains("AND p.platform = 'Discord'", source, StringComparison.Ordinal);
     Assert.True(
         source.IndexOf(unpublish, StringComparison.Ordinal) <
         source.IndexOf("DELETE FROM sessions s", StringComparison.Ordinal));
 }
 ```
 
+Add `PortfolioSchemaGateSourceTests.cs` and assert that both the `discord` and `web` Compose services depend on a healthy `bot`. The Telegram bot runs `DbMigrator` synchronously before exposing a healthy endpoint, so this dependency is the migration-first schema gate.
+
 - [ ] **Step 2: Add the failing PostgreSQL Testcontainers integration fixture and tests**
 
 Add the package reference:
@@ -196,18 +203,33 @@ public async Task ExplicitUnpublishThenSessionDelete_ShouldCommitAndPreserveFirs
 [Fact]
 public async Task ConcurrentPublishAndLinkDelete_ShouldNotDeadlockOrCommitInvalidPublicCard()
 
+[Theory]
+[InlineData("portfolio_game_sessions", "session_id")]
+[InlineData("portfolio_game_masters", "player_id")]
+public async Task ConcurrentRequiredLinkDeletes_ShouldSerializeAndRejectInvalidPublicCard(string linkTable, string linkColumn)
+
+[Theory]
+[InlineData("portfolio_game_sessions")]
+[InlineData("portfolio_game_masters")]
+public async Task MovingLastRequiredLinkAway_ShouldFailCommitForPublishedCard(string linkTable)
+
+[Theory]
+[InlineData("sessions")]
+[InlineData("players")]
+public async Task RequiredParentCascadeDelete_ShouldFailCommitForPublishedCard(string parentTable)
+
 [Fact]
 public async Task ParentCardAndGroupCascadeDeletes_ShouldCommit()
 ```
 
-The direct-delete theory must expect PostgreSQL `23514` at commit for each required-link table. The explicit-unpublish scenario must delete the session successfully while preserving the first `published_at`. The concurrency scenario must bound both commits with timeouts, prove there is no deadlock, and prove that an invalid public card cannot commit. The parent-card and owning-group cascade scenarios must commit successfully.
+The direct-delete, moved-link, and direct parent-cascade theories must expect PostgreSQL `23514` at commit. The explicit-unpublish scenario must delete the session successfully while preserving the first `published_at`. The concurrency scenarios must bound commits with timeouts, prove there is no deadlock or write-skew, and prove that an invalid public card cannot commit. The parent-card and owning-group cascade scenarios must commit successfully.
 
 - [ ] **Step 3: Run the Task 1 tests to verify RED**
 
 Run:
 
 ```powershell
-dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj --filter "FullyQualifiedName~PortfolioMigrationTests|FullyQualifiedName~PortfolioMigrationPostgresTests|FullyQualifiedName~PortfolioSessionDeletionSourceTests"
+dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj --filter "FullyQualifiedName~PortfolioMigrationTests|FullyQualifiedName~PortfolioMigrationPostgresTests|FullyQualifiedName~PortfolioSessionDeletionSourceTests|FullyQualifiedName~PortfolioSchemaGateSourceTests"
 ```
 
 Expected: FAIL because `V029__add_completed_game_portfolios_and_reviews.sql` does not exist and the session-deletion handlers do not explicitly unpublish linked portfolio cards before deleting sessions.
@@ -273,6 +295,8 @@ AS $$
 DECLARE
     target_portfolio_game_id UUID;
 BEGIN
+    PERFORM pg_advisory_xact_lock(20260530, 108);
+
     IF TG_TABLE_NAME = 'portfolio_games' THEN
         target_portfolio_game_id := NEW.id;
     ELSE
@@ -357,7 +381,7 @@ CREATE INDEX ix_portfolio_game_reviews_pending
     WHERE moderation_status = 'Pending';
 ```
 
-The deferred constraint triggers retain the link-table `ON DELETE CASCADE` behavior. At transaction commit they reject a surviving published card when either required link set is empty. Child delete triggers do not lock or update the parent card, avoiding reverse lock order. Normal session-deletion handlers explicitly unpublish linked cards before deleting sessions. Card and club cascade deletion remain harmless because no published parent survives validation.
+The deferred constraint triggers retain the link-table `ON DELETE CASCADE` behavior. At transaction commit they acquire the same transaction-level advisory lock and reject a surviving published card when either required link set is empty. The intentionally global lock is appropriate for low-volume portfolio publication writes: it serializes validation, prevents write-skew across distinct child links, and gives multi-card transactions one lock order. Child delete triggers do not lock or update the parent card. Normal session-deletion handlers explicitly unpublish linked cards before deleting sessions. Card and club cascade deletion remain harmless because no published parent survives validation.
 
 - [ ] **Step 5: Explicitly unpublish linked cards in both session-deletion handlers**
 
@@ -391,20 +415,24 @@ WHERE pgs.portfolio_game_id = pg.id
 
 Both handlers deliberately unpublish before session deletion. This keeps normal deletes successful, preserves the first-publication `published_at`, and leaves the deferred trigger as the direct-SQL and concurrency backstop.
 
+Also add `AND p.platform = 'Discord'` to the Discord manager lookup before casting manager IDs, so cross-platform identities cannot affect authorization.
+
+In `compose.yaml`, make both `discord` and `web` depend on a healthy `bot` in addition to the healthy database. `DbMigrator` runs synchronously before the bot health endpoint starts, so this gates consumers on V029 without duplicating the migrator.
+
 - [ ] **Step 6: Run the Task 1 tests to verify GREEN**
 
 Run:
 
 ```powershell
-dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj --filter "FullyQualifiedName~PortfolioMigrationTests|FullyQualifiedName~PortfolioMigrationPostgresTests|FullyQualifiedName~PortfolioSessionDeletionSourceTests"
+dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj --filter "FullyQualifiedName~PortfolioMigrationTests|FullyQualifiedName~PortfolioMigrationPostgresTests|FullyQualifiedName~PortfolioSessionDeletionSourceTests|FullyQualifiedName~PortfolioSchemaGateSourceTests"
 ```
 
-Expected: PASS, including PostgreSQL 17 migration application, rejected direct required-link deletes, successful explicit unpublish plus session delete with preserved `published_at`, bounded concurrent publish/delete without deadlock or invalid public commit, and successful parent-card and owning-group cascades.
+Expected: PASS, including PostgreSQL 17 migration application, rejected direct required-link deletes, rejected moved links and session/player cascades, successful explicit unpublish plus session delete with preserved `published_at`, bounded concurrent publish/delete and distinct-link deletion without deadlock, write-skew, or invalid public commit, successful parent-card and owning-group cascades, Discord identity scoping, and Compose schema gating.
 
 - [ ] **Step 7: Commit**
 
 ```powershell
-git add src/GmRelay.Bot/Migrations/V029__add_completed_game_portfolios_and_reviews.sql src/GmRelay.Shared/Features/Sessions/ListSessions/DeleteSessionHandler.cs src/GmRelay.DiscordBot/Features/Sessions/DiscordDeleteSessionHandler.cs tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj tests/GmRelay.Bot.Tests/packages.lock.json tests/GmRelay.Bot.Tests/Web/PortfolioMigrationTests.cs tests/GmRelay.Bot.Tests/Web/PortfolioSessionDeletionSourceTests.cs tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresFixture.cs tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresTests.cs
+git add src/GmRelay.Bot/Migrations/V029__add_completed_game_portfolios_and_reviews.sql src/GmRelay.Shared/Features/Sessions/ListSessions/DeleteSessionHandler.cs src/GmRelay.DiscordBot/Features/Sessions/DiscordDeleteSessionHandler.cs compose.yaml tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj tests/GmRelay.Bot.Tests/packages.lock.json tests/GmRelay.Bot.Tests/Web/PortfolioMigrationTests.cs tests/GmRelay.Bot.Tests/Web/PortfolioSessionDeletionSourceTests.cs tests/GmRelay.Bot.Tests/Web/PortfolioSchemaGateSourceTests.cs tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresFixture.cs tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresTests.cs
 git commit -m "fix(data): harden portfolio publication concurrency"
 ```
 

docs/superpowers/specs/2026-05-30-completed-game-portfolio-design.md

@@ -79,7 +79,7 @@ CHECK (NOT is_public OR (
 
 Application validation additionally requires at least one linked completed session and at least one linked GM before publishing because those requirements span child tables. Publishing locks the parent card, validates both required link sets, then sets `is_public = true` and `published_at = COALESCE(published_at, now())` so `published_at` remains the first-publication timestamp. Link replacement locks the parent card and unpublishes it before replacing required links.
 
-Deferred database constraint triggers validate the same invariant at transaction commit after a card transitions to public or a required session/master link is deleted or moved. They raise a check-violation error if a published card would commit without both required link sets. The deferred guard is a database backstop and deliberately does not lock or update a parent card from a child delete trigger, avoiding reverse lock order. Normal session-deletion handlers explicitly unpublish linked cards in the same transaction before deleting the session. The link foreign keys retain `ON DELETE CASCADE`; when the card itself or its owning club is deleted, deferred validation sees no surviving published card and remains harmless.
+Deferred database constraint triggers validate the same invariant at transaction commit after a card transitions to public or a required session/master link is deleted or moved. They raise a check-violation error if a published card would commit without both required link sets. Before checking state, each trigger acquires the same transaction-level PostgreSQL advisory lock, `pg_advisory_xact_lock(20260530, 108)`. Portfolio publication writes are low volume, so this intentionally global lock serializes invariant validation with one lock order, prevents write-skew when concurrent transactions remove different links, and avoids multi-card deadlocks. The deferred guard is a database backstop and deliberately does not lock or update a parent row from a child delete trigger. Normal session-deletion handlers explicitly unpublish linked cards in the same transaction before deleting the session. The link foreign keys retain `ON DELETE CASCADE`; when the card itself or its owning club is deleted, deferred validation sees no surviving published card and remains harmless.
 
 ### `portfolio_game_sessions`
 
@@ -311,7 +311,15 @@ Add:
 
 ```yaml
 services:
+  discord:
+    depends_on:
+      bot:
+        condition: service_healthy
+
   web:
+    depends_on:
+      bot:
+        condition: service_healthy
     environment:
       - "PortfolioCovers__StoragePath=/app/portfolio-covers"
     volumes:
@@ -326,6 +334,8 @@ Development configuration uses a local directory under the application content r
 
 The Web Docker image creates `/app/portfolio-covers` and assigns it to `$APP_UID` before switching to the non-root runtime user.
 
+The Telegram bot runs `DbMigrator` synchronously before its health endpoint becomes healthy. Docker Compose therefore starts Discord and Web only after the bot is healthy, using it as the schema-migration gate without duplicating migration ownership.
+
 ---
 
 ## Documentation
@@ -344,7 +354,7 @@ Follow TDD for production changes.
 ### Schema And Contracts
 
 - Migration source-contract tests assert the four new tables, format constraint, publication guard, case-insensitive slug uniqueness, group and GM-profile indexes, card-oriented pending-review index, and deferred constraint-trigger backstop.
-- PostgreSQL integration tests apply migrations V001 through V029 to `postgres:17-alpine` and cover direct invalid link removal, explicit unpublish before session deletion, concurrent publish/delete ordering without deadlock, and parent/card cascade deletion.
+- PostgreSQL integration tests apply migrations V001 through V029 to `postgres:17-alpine` and cover direct invalid link removal, moved links, direct session/player cascades, explicit unpublish before session deletion, concurrent publish/delete ordering, concurrent removal of distinct required links without write-skew or deadlock, and parent/card cascade deletion.
 - Public DTO reflection/source tests assert that private identifiers and physical storage paths are absent.
 - Existing showcase tests continue to assert the future-session catalog boundary.
 

src/GmRelay.Bot/Migrations/V029__add_completed_game_portfolios_and_reviews.sql

@@ -59,6 +59,8 @@ AS $$
 DECLARE
     target_portfolio_game_id UUID;
 BEGIN
+    PERFORM pg_advisory_xact_lock(20260530, 108);
+
     IF TG_TABLE_NAME = 'portfolio_games' THEN
         target_portfolio_game_id := NEW.id;
     ELSE

src/GmRelay.DiscordBot/Features/Sessions/DiscordDeleteSessionHandler.cs

@@ -32,7 +32,9 @@ public sealed class DiscordDeleteSessionHandler(
               FROM group_managers gm
               JOIN players p ON p.id = gm.player_id
               JOIN game_groups g ON g.id = gm.group_id
-              WHERE g.platform = 'Discord' AND g.external_group_id = @GuildId",
+              WHERE g.platform = 'Discord'
+                AND p.platform = 'Discord'
+                AND g.external_group_id = @GuildId",
             new { GuildId = guildId });
 
         if (!permissionChecker.CanManageSchedule(guildOwnerId, userId, dbManagerUserIds, resolvedPermissions))

tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresTests.cs

@@ -74,7 +74,7 @@ public sealed class PortfolioMigrationPostgresTests(PortfolioMigrationPostgresFi
             connection,
             "DELETE FROM sessions WHERE id = @sessionId",
             transaction,
-            new NpgsqlParameter("sessionId", seed.SessionId));
+            new NpgsqlParameter("sessionId", seed.SessionIds[0]));
 
         await transaction.CommitAsync().WaitAsync(CommandTimeout);
 
@@ -133,6 +133,105 @@ public sealed class PortfolioMigrationPostgresTests(PortfolioMigrationPostgresFi
             parameters: new NpgsqlParameter("portfolioGameId", seed.PortfolioGameId)));
     }
 
+    [Theory]
+    [InlineData("portfolio_game_sessions", "session_id")]
+    [InlineData("portfolio_game_masters", "player_id")]
+    public async Task ConcurrentRequiredLinkDeletes_ShouldSerializeAndRejectInvalidPublicCard(
+        string linkTable,
+        string linkColumn)
+    {
+        var database = await fixture.CreateMigratedDatabaseAsync();
+        await using var seedConnection = await database.OpenConnectionAsync();
+        var seed = await SeedCardAsync(
+            seedConnection,
+            isPublic: true,
+            sessionCount: linkTable == "portfolio_game_sessions" ? 2 : 1,
+            masterCount: linkTable == "portfolio_game_masters" ? 2 : 1);
+        await using var firstConnection = await database.OpenConnectionAsync();
+        await using var secondConnection = await database.OpenConnectionAsync();
+        await using var firstTransaction = await firstConnection.BeginTransactionAsync();
+        await using var secondTransaction = await secondConnection.BeginTransactionAsync();
+        var linkIds = linkTable == "portfolio_game_sessions" ? seed.SessionIds : seed.MasterIds;
+
+        await ExecuteNonQueryAsync(
+            firstConnection,
+            $"DELETE FROM {linkTable} WHERE portfolio_game_id = @portfolioGameId AND {linkColumn} = @linkId",
+            firstTransaction,
+            new NpgsqlParameter("portfolioGameId", seed.PortfolioGameId),
+            new NpgsqlParameter("linkId", linkIds[0]));
+        await ExecuteNonQueryAsync(
+            secondConnection,
+            $"DELETE FROM {linkTable} WHERE portfolio_game_id = @portfolioGameId AND {linkColumn} = @linkId",
+            secondTransaction,
+            new NpgsqlParameter("portfolioGameId", seed.PortfolioGameId),
+            new NpgsqlParameter("linkId", linkIds[1]));
+
+        var commitStates = await Task.WhenAll(
+            CommitAndCaptureSqlStateAsync(firstTransaction),
+            CommitAndCaptureSqlStateAsync(secondTransaction));
+
+        Assert.Single(commitStates, state => state is null);
+        Assert.Single(commitStates, state => state == PostgresErrorCodes.CheckViolation);
+
+        await using var verificationConnection = await database.OpenConnectionAsync();
+        Assert.True(await ExecuteScalarAsync<bool>(
+            verificationConnection,
+            "SELECT is_public FROM portfolio_games WHERE id = @portfolioGameId",
+            parameters: new NpgsqlParameter("portfolioGameId", seed.PortfolioGameId)));
+        Assert.Equal(1, await ExecuteScalarAsync<long>(
+            verificationConnection,
+            $"SELECT COUNT(*) FROM {linkTable} WHERE portfolio_game_id = @portfolioGameId",
+            parameters: new NpgsqlParameter("portfolioGameId", seed.PortfolioGameId)));
+    }
+
+    [Theory]
+    [InlineData("portfolio_game_sessions")]
+    [InlineData("portfolio_game_masters")]
+    public async Task MovingLastRequiredLinkAway_ShouldFailCommitForPublishedCard(string linkTable)
+    {
+        var database = await fixture.CreateMigratedDatabaseAsync();
+        await using var connection = await database.OpenConnectionAsync();
+        var source = await SeedCardAsync(connection, isPublic: true);
+        var destination = await SeedCardAsync(connection, isPublic: false);
+        await using var transaction = await connection.BeginTransactionAsync();
+
+        await ExecuteNonQueryAsync(
+            connection,
+            $"UPDATE {linkTable} SET portfolio_game_id = @destinationId WHERE portfolio_game_id = @sourceId",
+            transaction,
+            new NpgsqlParameter("destinationId", destination.PortfolioGameId),
+            new NpgsqlParameter("sourceId", source.PortfolioGameId));
+
+        var exception = await Assert.ThrowsAsync<PostgresException>(
+            () => transaction.CommitAsync().WaitAsync(CommandTimeout));
+
+        Assert.Equal(PostgresErrorCodes.CheckViolation, exception.SqlState);
+    }
+
+    [Theory]
+    [InlineData("sessions")]
+    [InlineData("players")]
+    public async Task RequiredParentCascadeDelete_ShouldFailCommitForPublishedCard(string parentTable)
+    {
+        var database = await fixture.CreateMigratedDatabaseAsync();
+        await using var connection = await database.OpenConnectionAsync();
+        var seed = await SeedCardAsync(connection, isPublic: true);
+        await using var transaction = await connection.BeginTransactionAsync();
+
+        await ExecuteNonQueryAsync(
+            connection,
+            $"DELETE FROM {parentTable} WHERE id = @parentId",
+            transaction,
+            new NpgsqlParameter(
+                "parentId",
+                parentTable == "sessions" ? seed.SessionIds[0] : seed.MasterIds[0]));
+
+        var exception = await Assert.ThrowsAsync<PostgresException>(
+            () => transaction.CommitAsync().WaitAsync(CommandTimeout));
+
+        Assert.Equal(PostgresErrorCodes.CheckViolation, exception.SqlState);
+    }
+
     [Fact]
     public async Task ParentCardAndGroupCascadeDeletes_ShouldCommit()
     {
@@ -161,29 +260,42 @@ public sealed class PortfolioMigrationPostgresTests(PortfolioMigrationPostgresFi
             ]));
     }
 
-    private static async Task<PortfolioSeed> SeedCardAsync(NpgsqlConnection connection, bool isPublic)
+    private static async Task<PortfolioSeed> SeedCardAsync(
+        NpgsqlConnection connection,
+        bool isPublic,
+        int sessionCount = 1,
+        int masterCount = 1)
     {
-        var playerId = Guid.NewGuid();
         var groupId = Guid.NewGuid();
-        var sessionId = Guid.NewGuid();
         var portfolioGameId = Guid.NewGuid();
-        var legacyId = Interlocked.Increment(ref nextLegacyId);
+        var sessionIds = Enumerable.Range(0, sessionCount).Select(_ => Guid.NewGuid()).ToArray();
+        var masterIds = Enumerable.Range(0, masterCount).Select(_ => Guid.NewGuid()).ToArray();
         var publishedAtValue = DateTime.UtcNow.AddDays(-1);
         var publishedAt = new DateTime(publishedAtValue.Ticks / 10 * 10, DateTimeKind.Utc);
         await using var transaction = await connection.BeginTransactionAsync();
 
+        foreach (var masterId in masterIds)
+        {
+            var legacyId = Interlocked.Increment(ref nextLegacyId);
+            await ExecuteNonQueryAsync(
+                connection,
+                """
+                INSERT INTO players (id, telegram_id, display_name, platform, external_user_id)
+                VALUES (@playerId, @legacyId, 'Portfolio GM', 'Telegram', @legacyIdText);
+                """,
+                transaction,
+                new NpgsqlParameter("playerId", masterId),
+                new NpgsqlParameter("legacyId", legacyId),
+                new NpgsqlParameter("legacyIdText", legacyId.ToString()));
+        }
+
+        var groupLegacyId = Interlocked.Increment(ref nextLegacyId);
         await ExecuteNonQueryAsync(
             connection,
             """
-            INSERT INTO players (id, telegram_id, display_name, platform, external_user_id)
-            VALUES (@playerId, @legacyId, 'Portfolio GM', 'Telegram', @legacyIdText);
-
             INSERT INTO game_groups (id, telegram_chat_id, name, gm_telegram_id, platform, external_group_id)
             VALUES (@groupId, @legacyId, 'Portfolio Club', @legacyId, 'Telegram', @legacyIdText);
 
-            INSERT INTO sessions (id, group_id, title, join_link, scheduled_at)
-            VALUES (@sessionId, @groupId, 'Completed Session', 'https://example.test/session', now() - interval '1 day');
-
             INSERT INTO portfolio_games (
                 id,
                 group_id,
@@ -202,26 +314,61 @@ public sealed class PortfolioMigrationPostgresTests(PortfolioMigrationPostgresFi
                 'covers/example.webp',
                 @isPublic,
                 CASE WHEN @isPublic THEN @publishedAt ELSE NULL END);
-
-            INSERT INTO portfolio_game_sessions (portfolio_game_id, session_id)
-            VALUES (@portfolioGameId, @sessionId);
-
-            INSERT INTO portfolio_game_masters (portfolio_game_id, player_id)
-            VALUES (@portfolioGameId, @playerId);
             """,
             transaction,
-            new NpgsqlParameter("playerId", playerId),
-            new NpgsqlParameter("legacyId", legacyId),
-            new NpgsqlParameter("legacyIdText", legacyId.ToString()),
+            new NpgsqlParameter("legacyId", groupLegacyId),
+            new NpgsqlParameter("legacyIdText", groupLegacyId.ToString()),
             new NpgsqlParameter("groupId", groupId),
-            new NpgsqlParameter("sessionId", sessionId),
             new NpgsqlParameter("portfolioGameId", portfolioGameId),
             new NpgsqlParameter("publicSlug", $"portfolio-{portfolioGameId:N}"),
             new NpgsqlParameter("isPublic", isPublic),
             new NpgsqlParameter("publishedAt", publishedAt));
 
+        foreach (var sessionId in sessionIds)
+        {
+            await ExecuteNonQueryAsync(
+                connection,
+                """
+                INSERT INTO sessions (id, group_id, title, join_link, scheduled_at)
+                VALUES (@sessionId, @groupId, 'Completed Session', 'https://example.test/session', now() - interval '1 day');
+
+                INSERT INTO portfolio_game_sessions (portfolio_game_id, session_id)
+                VALUES (@portfolioGameId, @sessionId);
+                """,
+                transaction,
+                new NpgsqlParameter("sessionId", sessionId),
+                new NpgsqlParameter("groupId", groupId),
+                new NpgsqlParameter("portfolioGameId", portfolioGameId));
+        }
+
+        foreach (var masterId in masterIds)
+        {
+            await ExecuteNonQueryAsync(
+                connection,
+                """
+                INSERT INTO portfolio_game_masters (portfolio_game_id, player_id)
+                VALUES (@portfolioGameId, @playerId);
+                """,
+                transaction,
+                new NpgsqlParameter("portfolioGameId", portfolioGameId),
+                new NpgsqlParameter("playerId", masterId));
+        }
+
         await transaction.CommitAsync().WaitAsync(CommandTimeout);
-        return new PortfolioSeed(portfolioGameId, groupId, sessionId, publishedAt);
+        return new PortfolioSeed(portfolioGameId, groupId, sessionIds, masterIds, publishedAt);
+    }
+
+    private static async Task<string?> CommitAndCaptureSqlStateAsync(NpgsqlTransaction transaction)
+    {
+        try
+        {
+            await transaction.CommitAsync().WaitAsync(CommandTimeout);
+            return null;
+        }
+        catch (PostgresException exception)
+        {
+            return exception.SqlState;
+        }
     }
 
     private static async Task<int> ExecuteNonQueryAsync(
@@ -249,6 +396,7 @@ public sealed class PortfolioMigrationPostgresTests(PortfolioMigrationPostgresFi
     private sealed record PortfolioSeed(
         Guid PortfolioGameId,
         Guid GroupId,
-        Guid SessionId,
+        Guid[] SessionIds,
+        Guid[] MasterIds,
         DateTime PublishedAt);
 }

tests/GmRelay.Bot.Tests/Web/PortfolioMigrationTests.cs

@@ -31,6 +31,7 @@ public sealed class PortfolioMigrationTests
         Assert.Contains("CREATE INDEX ix_portfolio_game_reviews_public ON portfolio_game_reviews (portfolio_game_id, created_at DESC) WHERE moderation_status = 'Approved' AND publication_consent_at IS NOT NULL;", normalizedMigration, StringComparison.Ordinal);
         Assert.Contains("CREATE INDEX ix_portfolio_game_reviews_pending ON portfolio_game_reviews (portfolio_game_id, created_at DESC) WHERE moderation_status = 'Pending';", normalizedMigration, StringComparison.Ordinal);
         Assert.Contains("CREATE FUNCTION validate_public_portfolio_game_required_links() RETURNS TRIGGER LANGUAGE plpgsql", normalizedMigration, StringComparison.Ordinal);
+        Assert.Contains("PERFORM pg_advisory_xact_lock(20260530, 108);", normalizedMigration, StringComparison.Ordinal);
         Assert.Contains("RAISE EXCEPTION 'published portfolio game % must have at least one linked session and at least one linked master', target_portfolio_game_id USING ERRCODE = '23514';", normalizedMigration, StringComparison.Ordinal);
         Assert.Contains("CREATE CONSTRAINT TRIGGER trg_portfolio_games_validate_required_links AFTER INSERT OR UPDATE OF is_public ON portfolio_games DEFERRABLE INITIALLY DEFERRED FOR EACH ROW EXECUTE FUNCTION validate_public_portfolio_game_required_links();", normalizedMigration, StringComparison.Ordinal);
         Assert.Contains("CREATE CONSTRAINT TRIGGER trg_portfolio_game_sessions_validate_required_links AFTER DELETE OR UPDATE OF portfolio_game_id ON portfolio_game_sessions DEFERRABLE INITIALLY DEFERRED FOR EACH ROW EXECUTE FUNCTION validate_public_portfolio_game_required_links();", normalizedMigration, StringComparison.Ordinal);

tests/GmRelay.Bot.Tests/Web/PortfolioSchemaGateSourceTests.cs

@@ -0,0 +1,59 @@
+namespace GmRelay.Bot.Tests.Web;
+
+public sealed class PortfolioSchemaGateSourceTests
+{
+    [Fact]
+    public async Task Compose_ShouldStartDiscordAndWebOnlyAfterBotMigrationsAreHealthy()
+    {
+        var compose = await ReadRepositoryFileAsync("compose.yaml");
+
+        AssertServiceDependsOnHealthyBot(compose, "discord");
+        AssertServiceDependsOnHealthyBot(compose, "web");
+    }
+
+    private static void AssertServiceDependsOnHealthyBot(string compose, string serviceName)
+    {
+        var serviceBlock = GetServiceBlock(compose, serviceName);
+
+        Assert.Contains(
+            """
+                  bot:
+                    condition: service_healthy
+            """,
+            serviceBlock,
+            StringComparison.Ordinal);
+    }
+
+    private static string GetServiceBlock(string compose, string serviceName)
+    {
+        var lines = compose.Split('\n');
+        var start = Array.FindIndex(lines, line => line.TrimEnd('\r') == $"  {serviceName}:");
+        Assert.True(start >= 0, $"compose.yaml should contain service '{serviceName}'.");
+
+        var end = Array.FindIndex(
+            lines,
+            start + 1,
+            line => line.StartsWith("  ", StringComparison.Ordinal)
+                && !line.StartsWith("    ", StringComparison.Ordinal)
+                && line.TrimEnd('\r').EndsWith(':'));
+
+        return string.Join('\n', lines[start..(end < 0 ? lines.Length : end)]);
+    }
+
+    private static async Task<string> ReadRepositoryFileAsync(string relativePath)
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            var candidate = Path.Combine(directory.FullName, relativePath);
+            if (File.Exists(candidate))
+            {
+                return await File.ReadAllTextAsync(candidate);
+            }
+
+            directory = directory.Parent;
+        }
+
+        throw new FileNotFoundException($"Could not locate repository file '{relativePath}'.");
+    }
+}

tests/GmRelay.Bot.Tests/Web/PortfolioSessionDeletionSourceTests.cs

@@ -28,6 +28,7 @@ public sealed class PortfolioSessionDeletionSourceTests
             "UPDATE portfolio_games pg SET is_public = false, updated_at = now() FROM portfolio_game_sessions pgs JOIN sessions s ON s.id = pgs.session_id JOIN game_groups g ON g.id = s.group_id WHERE pgs.portfolio_game_id = pg.id AND s.id = @SessionId AND g.platform = 'Discord' AND g.external_group_id = @GuildId AND pg.is_public = true";
 
         Assert.Contains(unpublish, source, StringComparison.Ordinal);
+        Assert.Contains("AND p.platform = 'Discord'", source, StringComparison.Ordinal);
         Assert.True(
             source.IndexOf(unpublish, StringComparison.Ordinal) <
             source.IndexOf("DELETE FROM sessions s", StringComparison.Ordinal),