docs/superpowers/plans/2026-05-30-completed-game-portfolio.md

@@ -140,42 +140,54 @@ public async Task MigrationV029_ShouldStoreProviderNeutralCoverKeys()
 }
 ```
 
-Add `PortfolioSessionDeletionSourceTests.cs`. Normalize whitespace before comparing source text and assert that both session-deletion paths explicitly unpublish linked cards before deleting the required session link:
+Add `PortfolioSessionDeletionSourceTests.cs`. Normalize whitespace before comparing source text and assert that both session-deletion paths explicitly lock the target session row, unpublish linked cards, and then delete the required session link:
 
 ```csharp
 [Fact]
-public async Task SharedDeleteSessionHandler_ShouldUnpublishLinkedPortfolioCardBeforeDeletingSession()
+public async Task SharedDeleteSessionHandler_ShouldLockSessionBeforeUnpublishingLinkedPortfolioCardAndDeletingSession()
 {
     var source = NormalizeSql(await ReadRepositoryFileAsync(
         "src/GmRelay.Shared/Features/Sessions/ListSessions/DeleteSessionHandler.cs"));
 
+    const string sessionLock =
+        "FROM sessions s WHERE s.id = @SessionId FOR UPDATE OF s";
     const string unpublish =
         "UPDATE portfolio_games pg SET is_public = false, updated_at = now() FROM portfolio_game_sessions pgs WHERE pgs.portfolio_game_id = pg.id AND pgs.session_id = @SessionId AND pg.is_public = true";
 
+    Assert.Contains(sessionLock, source, StringComparison.Ordinal);
     Assert.Contains(unpublish, source, StringComparison.Ordinal);
+    Assert.True(
+        source.IndexOf(sessionLock, StringComparison.Ordinal) <
+        source.IndexOf(unpublish, StringComparison.Ordinal));
     Assert.True(
         source.IndexOf(unpublish, StringComparison.Ordinal) <
         source.IndexOf("DELETE FROM sessions WHERE id = @Id", StringComparison.Ordinal));
 }
 
 [Fact]
-public async Task DiscordDeleteSessionHandler_ShouldUnpublishOnlyCardsFromTheInteractionGuildBeforeDeletingSession()
+public async Task DiscordDeleteSessionHandler_ShouldLockGuildSessionBeforeUnpublishingLinkedPortfolioCardAndDeletingSession()
 {
     var source = NormalizeSql(await ReadRepositoryFileAsync(
         "src/GmRelay.DiscordBot/Features/Sessions/DiscordDeleteSessionHandler.cs"));
 
+    const string sessionLock =
+        "SELECT s.id FROM sessions s JOIN game_groups g ON g.id = s.group_id WHERE s.id = @SessionId AND g.platform = 'Discord' AND g.external_group_id = @GuildId FOR UPDATE OF s";
     const string unpublish =
         "UPDATE portfolio_games pg SET is_public = false, updated_at = now() FROM portfolio_game_sessions pgs JOIN sessions s ON s.id = pgs.session_id JOIN game_groups g ON g.id = s.group_id WHERE pgs.portfolio_game_id = pg.id AND s.id = @SessionId AND g.platform = 'Discord' AND g.external_group_id = @GuildId AND pg.is_public = true";
 
+    Assert.Contains(sessionLock, source, StringComparison.Ordinal);
     Assert.Contains(unpublish, source, StringComparison.Ordinal);
     Assert.Contains("AND p.platform = 'Discord'", source, StringComparison.Ordinal);
+    Assert.True(
+        source.IndexOf(sessionLock, StringComparison.Ordinal) <
+        source.IndexOf(unpublish, StringComparison.Ordinal));
     Assert.True(
         source.IndexOf(unpublish, StringComparison.Ordinal) <
         source.IndexOf("DELETE FROM sessions s", StringComparison.Ordinal));
 }
 ```
 
-Add `PortfolioSchemaGateSourceTests.cs` and assert that both the `discord` and `web` Compose services depend on a healthy `bot`. Assert the same schema gate in Aspire: save the `bot` project resource to a variable and make the `discord` and `web` project resources call `.WaitFor(bot)` in addition to `.WaitFor(postgres)`. The Telegram bot runs `DbMigrator` synchronously before exposing a healthy endpoint, so this dependency is the migration-first schema gate.
+Add `PortfolioSchemaGateSourceTests.cs` and assert that both the `discord` and `web` Compose services depend on a healthy `bot`. Assert the same schema gate in Aspire: save the `bot` project resource to a variable, expose its named port `8081` HTTP endpoint, attach `.WithHttpHealthCheck("/health", endpointName: "health")`, and make the `discord` and `web` project resources call `.WaitFor(bot)` in addition to `.WaitFor(postgres)`. The Telegram bot runs `DbMigrator` synchronously before exposing a healthy endpoint, so this dependency is the migration-first schema gate.
 
 - [ ] **Step 2: Add the failing PostgreSQL Testcontainers integration fixture and tests**
 
@@ -250,7 +262,7 @@ public async Task RequiredParentCascadeDelete_ShouldFailCommitForPublishedCard(s
 public async Task ParentCardAndGroupCascadeDeletes_ShouldCommit()
 ```
 
-The direct-delete, moved-link, invalid publication, and direct parent-cascade scenarios must expect PostgreSQL `23514` at commit. Every selected linked session must be completed with `scheduled_at < now()`: one future link among multiple selected sessions rejects publication. A future reschedule must atomically unpublish a linked public card while preserving its first `published_at`. The `READ COMMITTED` concurrency scenarios must launch bounded commit tasks together, cover both publish/delete lock orders, and prove there is no deadlock, write-skew, or invalid public commit. The publish/reschedule race must finish with the future session committed and the card private. The `REPEATABLE READ` scenarios must reject triggered portfolio writes with `0A000`, including both draft-link deletion versus publication commit orders, because a stale snapshot after lock acquisition cannot safely validate the invariant. The parent-card and owning-group cascade scenarios must commit successfully.
+The direct-delete, moved-link, invalid publication, and direct parent-cascade scenarios must expect PostgreSQL `23514` at commit. Every selected linked session must be completed with `scheduled_at < now()`: one future link among multiple selected sessions rejects publication. A future reschedule must atomically unpublish a linked public card while preserving its first `published_at`. The `READ COMMITTED` concurrency scenarios must launch bounded tasks together, cover both publish/delete lock orders, and prove there is no deadlock, write-skew, or invalid public commit. A session-delete versus future-reschedule race must use the common `sessions` then `portfolio_games` lock order, cover both first-session-lock orders through real blocking transactions, and finish with the card private and session deleted. The publish/reschedule race must finish with the future session committed and the card private. The `REPEATABLE READ` scenarios must reject triggered portfolio writes with `0A000`, including both draft-link deletion versus publication commit orders, because a stale snapshot after lock acquisition cannot safely validate the invariant. The parent-card and owning-group cascade scenarios must commit successfully.
 
 - [ ] **Step 3: Run the Task 1 tests to verify RED**
 
@@ -260,7 +272,7 @@ Run:
 dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj --filter "FullyQualifiedName~PortfolioMigrationTests|FullyQualifiedName~PortfolioMigrationPostgresTests|FullyQualifiedName~PortfolioSessionDeletionSourceTests|FullyQualifiedName~PortfolioSchemaGateSourceTests"
 ```
 
-Expected during the Task 1 quality-review fix: FAIL because V029 does not yet validate completed linked sessions or automatically unpublish on future reschedule, and the Aspire AppHost does not yet gate `discord` and `web` on `bot`.
+Expected during this Task 1 quality-review fix: FAIL because session-deletion handlers do not yet lock `sessions` before linked cards and the Aspire AppHost does not yet attach the bot HTTP health check used by `.WaitFor(bot)`.
 
 - [ ] **Step 4: Add migration V029**
 
@@ -455,11 +467,11 @@ CREATE INDEX ix_portfolio_game_reviews_pending
     WHERE moderation_status = 'Pending';
 ```
 
-The deferred constraint triggers retain the link-table `ON DELETE CASCADE` behavior. At transaction commit validators acquire the same transaction-level advisory lock and reject a surviving published card when either required link set is empty or any linked session has `scheduled_at >= now()`. The intentionally global lock is appropriate for low-volume portfolio publication writes: under the application default `READ COMMITTED` isolation level it serializes validation, prevents write-skew across distinct child links, and gives multi-card transactions one lock order. PostgreSQL retains stale snapshots under `REPEATABLE READ` and `SERIALIZABLE`, so the guard rejects every triggered portfolio write at those isolation levels with `0A000`. The deferred future-reschedule trigger atomically unpublishes linked public cards while preserving `published_at`; it updates the card before validator lock acquisition so a racing publication cannot create an inverted lock order. At `READ COMMITTED`, draft edits, explicit unpublishing, future reschedules, and card or club cascade deletion remain valid. Normal session-deletion handlers explicitly unpublish linked cards before deleting sessions.
+The deferred constraint triggers retain the link-table `ON DELETE CASCADE` behavior. At transaction commit validators acquire the same transaction-level advisory lock and reject a surviving published card when either required link set is empty or any linked session has `scheduled_at >= now()`. The intentionally global lock is appropriate for low-volume portfolio publication writes: under the application default `READ COMMITTED` isolation level it serializes validation, prevents write-skew across distinct child links, and gives multi-card transactions one lock order. PostgreSQL retains stale snapshots under `REPEATABLE READ` and `SERIALIZABLE`, so the guard rejects every triggered portfolio write at those isolation levels with `0A000`. The deferred future-reschedule trigger atomically unpublishes linked public cards while preserving `published_at`; it updates the session before the card. At `READ COMMITTED`, draft edits, explicit unpublishing, future reschedules, and card or club cascade deletion remain valid. Normal session-deletion handlers use the same `sessions` then `portfolio_games` lock order: explicitly lock the target session row, unpublish linked cards, then delete the session.
 
-- [ ] **Step 5: Explicitly unpublish linked cards in both session-deletion handlers**
+- [ ] **Step 5: Lock sessions before explicitly unpublishing linked cards in both session-deletion handlers**
 
-In `src/GmRelay.Shared/Features/Sessions/ListSessions/DeleteSessionHandler.cs`, run this statement inside the existing transaction after authorization and before `DELETE FROM sessions`:
+In `src/GmRelay.Shared/Features/Sessions/ListSessions/DeleteSessionHandler.cs`, strengthen the initial session fetch with `FOR UPDATE OF s`. After authorization, run this statement inside the existing transaction before `DELETE FROM sessions`:
 
 ```sql
 UPDATE portfolio_games pg
@@ -471,7 +483,7 @@ WHERE pgs.portfolio_game_id = pg.id
   AND pg.is_public = true
 ```
 
-In `src/GmRelay.DiscordBot/Features/Sessions/DiscordDeleteSessionHandler.cs`, start a transaction before deleting. Run this guild-scoped unpublish statement before the existing guild-scoped `DELETE FROM sessions`, then commit:
+In `src/GmRelay.DiscordBot/Features/Sessions/DiscordDeleteSessionHandler.cs`, start a transaction before deleting. Lock the guild-scoped target session row with `SELECT s.id ... FOR UPDATE OF s`, preserving the existing not-found result. Run this guild-scoped unpublish statement before the existing guild-scoped `DELETE FROM sessions`, then commit:
 
 ```sql
 UPDATE portfolio_games pg
@@ -487,11 +499,11 @@ WHERE pgs.portfolio_game_id = pg.id
   AND pg.is_public = true
 ```
 
-Both handlers deliberately unpublish before session deletion. This keeps normal deletes successful, preserves the first-publication `published_at`, and leaves the deferred trigger as the direct-SQL and concurrency backstop.
+Both handlers deliberately use `sessions` then `portfolio_games` locking before session deletion. This matches future rescheduling, keeps normal deletes successful, preserves the first-publication `published_at`, and leaves the deferred trigger as the direct-SQL and concurrency backstop.
 
 Also add `AND p.platform = 'Discord'` to the Discord manager lookup before casting manager IDs, so cross-platform identities cannot affect authorization.
 
-In `compose.yaml`, make both `discord` and `web` depend on a healthy `bot` in addition to the healthy database. Mirror the same schema gate in `src/GmRelay.AppHost/Program.cs`: save the `bot` project resource and add `.WaitFor(bot)` to both `discord` and `web` after `.WaitFor(postgres)`. `DbMigrator` runs synchronously before the bot health endpoint starts, so this gates consumers on V029 without duplicating the migrator.
+In `compose.yaml`, make both `discord` and `web` depend on a healthy `bot` in addition to the healthy database. Mirror the same schema gate in `src/GmRelay.AppHost/Program.cs`: save the `bot` project resource, add `.WithHttpEndpoint(port: 8081, targetPort: 8081, name: "health")`, attach `.WithHttpHealthCheck("/health", endpointName: "health")`, and add `.WaitFor(bot)` to both `discord` and `web` after `.WaitFor(postgres)`. `DbMigrator` runs synchronously before the bot health endpoint starts, so this gates consumers on V029 without duplicating the migrator.
 
 - [ ] **Step 6: Run the Task 1 tests to verify GREEN**
 
@@ -501,7 +513,7 @@ Run:
 dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj --filter "FullyQualifiedName~PortfolioMigrationTests|FullyQualifiedName~PortfolioMigrationPostgresTests|FullyQualifiedName~PortfolioSessionDeletionSourceTests|FullyQualifiedName~PortfolioSchemaGateSourceTests"
 ```
 
-Expected: PASS, including PostgreSQL 17 migration application, rejected direct required-link deletes, rejected moved links and session/player cascades, rejected publication with any future linked session, automatic unpublish with preserved `published_at` after future reschedule, bounded `READ COMMITTED` publish/delete in both commit orders, publish/reschedule races, and distinct-link deletion without deadlock, write-skew, or invalid public commit, rejected `REPEATABLE READ` triggered writes including both draft-delete versus publish commit orders, successful parent-card and owning-group cascades, Discord identity scoping, and Compose/Aspire schema gating.
+Expected: PASS, including PostgreSQL 17 migration application, rejected direct required-link deletes, rejected moved links and session/player cascades, rejected publication with any future linked session, automatic unpublish with preserved `published_at` after future reschedule, bounded `READ COMMITTED` publish/delete in both commit orders, publish/reschedule races, session-delete/reschedule serialization in both first-lock orders, and distinct-link deletion without deadlock, write-skew, or invalid public commit, rejected `REPEATABLE READ` triggered writes including both draft-delete versus publish commit orders, successful parent-card and owning-group cascades, Discord identity scoping, and Compose/Aspire HTTP health gating.
 
 - [ ] **Step 7: Commit**
 

docs/superpowers/specs/2026-05-30-completed-game-portfolio-design.md

@@ -81,7 +81,7 @@ Application validation additionally requires at least one linked session, every
 
 Deferred database constraint triggers validate the same invariant at transaction commit after a card transitions to public, a session link is inserted, deleted, moved, or repointed, or a required master link is deleted or moved. They raise a check-violation error if a published card would commit without both required link sets or with any linked session where `scheduled_at >= now()`. Before checking state, each validator acquires the same transaction-level PostgreSQL advisory lock, `pg_advisory_xact_lock(20260530, 108)`. Portfolio publication writes are low volume, so this intentionally global lock serializes invariant validation with one lock order, prevents write-skew under the application default `READ COMMITTED` isolation level, and avoids multi-card deadlocks. PostgreSQL keeps a stale snapshot after waiting under `REPEATABLE READ` or `SERIALIZABLE`, so the guard rejects every triggered portfolio write at those levels; callers must use `READ COMMITTED` for portfolio mutations.
 
-A deferred `sessions.scheduled_at` trigger atomically unpublishes linked public cards when a completed session is rescheduled into the future, preserving the first `published_at`. Running that update at commit lets it re-check the current card row after a racing publication without taking the advisory lock before the row update, avoiding an inverted lock order. Normal session-deletion handlers still explicitly unpublish linked cards in the same transaction before deleting the session. The link foreign keys retain `ON DELETE CASCADE`; when the card itself or its owning club is deleted at `READ COMMITTED`, deferred validation sees no surviving published card and remains harmless.
+A deferred `sessions.scheduled_at` trigger atomically unpublishes linked public cards when a completed session is rescheduled into the future, preserving the first `published_at`. Running that update at commit lets it re-check the current card row after a racing publication without taking the advisory lock before the row update. Session mutation paths use one row-lock order: `sessions` first, then linked `portfolio_games`. Normal session-deletion handlers explicitly lock the target session row, unpublish linked cards in the same transaction, and only then delete the session. The link foreign keys retain `ON DELETE CASCADE`; when the card itself or its owning club is deleted at `READ COMMITTED`, deferred validation sees no surviving published card and remains harmless.
 
 ### `portfolio_game_sessions`
 
@@ -336,7 +336,7 @@ Development configuration uses a local directory under the application content r
 
 The Web Docker image creates `/app/portfolio-covers` and assigns it to `$APP_UID` before switching to the non-root runtime user.
 
-The Telegram bot runs `DbMigrator` synchronously before its health endpoint becomes healthy. Docker Compose therefore starts Discord and Web only after the bot is healthy, using it as the schema-migration gate without duplicating migration ownership. The Aspire AppHost mirrors this ordering: its `discord` and `web` project resources wait for both PostgreSQL and the `bot` resource.
+The Telegram bot runs `DbMigrator` synchronously before its health endpoint becomes healthy. Docker Compose therefore starts Discord and Web only after the bot is healthy, using it as the schema-migration gate without duplicating migration ownership. The Aspire AppHost mirrors this readiness gate by explicitly exposing the bot project resource's port `8081` endpoint, attaching `.WithHttpHealthCheck("/health", endpointName: "health")`, and making its `discord` and `web` project resources wait for both PostgreSQL and the healthy `bot` resource.
 
 ---
 
@@ -355,8 +355,8 @@ Follow TDD for production changes.
 
 ### Schema And Contracts
 
-- Migration source-contract tests assert the four new tables, format constraint, publication guard, case-insensitive slug uniqueness, group and GM-profile indexes, card-oriented pending-review index, completed-session validator, deferred future-reschedule unpublish trigger, and AppHost schema gate.
-- PostgreSQL integration tests apply migrations V001 through V029 to `postgres:17-alpine` and cover direct invalid link removal, moved links, direct session/player cascades, explicit unpublish before session deletion, rejection of publication when any linked session is future, automatic unpublish with preserved `published_at` after future reschedule, publish/reschedule races, both bounded publish/delete commit orders, concurrent removal of distinct required links without write-skew or deadlock under `READ COMMITTED`, rejection of equivalent `REPEATABLE READ` writes including both draft-delete versus publish commit orders, and parent/card cascade deletion.
+- Migration source-contract tests assert the four new tables, format constraint, publication guard, case-insensitive slug uniqueness, group and GM-profile indexes, card-oriented pending-review index, completed-session validator, deferred future-reschedule unpublish trigger, session-first deletion locks, and the AppHost HTTP health gate.
+- PostgreSQL integration tests apply migrations V001 through V029 to `postgres:17-alpine` and cover direct invalid link removal, moved links, direct session/player cascades, explicit session-lock then unpublish then session deletion, delete/reschedule lock ordering in both first-lock orders, rejection of publication when any linked session is future, automatic unpublish with preserved `published_at` after future reschedule, publish/reschedule races, both bounded publish/delete commit orders, concurrent removal of distinct required links without write-skew or deadlock under `READ COMMITTED`, rejection of equivalent `REPEATABLE READ` writes including both draft-delete versus publish commit orders, and parent/card cascade deletion.
 - Public DTO reflection/source tests assert that private identifiers and physical storage paths are absent.
 - Existing showcase tests continue to assert the future-session catalog boundary.
 

src/GmRelay.AppHost/Program.cs

@@ -6,7 +6,9 @@ var postgres = builder.AddPostgres("postgres")
 
 var bot = builder.AddProject<Projects.GmRelay_Bot>("bot")
     .WithReference(postgres)
-    .WaitFor(postgres);
+    .WaitFor(postgres)
+    .WithHttpEndpoint(port: 8081, targetPort: 8081, name: "health")
+    .WithHttpHealthCheck("/health", endpointName: "health");
 
 builder.AddProject<Projects.GmRelay_DiscordBot>("discord")
     .WithReference(postgres)

src/GmRelay.DiscordBot/Features/Sessions/DiscordDeleteSessionHandler.cs

@@ -45,6 +45,19 @@ public sealed class DiscordDeleteSessionHandler(
         }
 
         await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+        _ = await connection.QuerySingleOrDefaultAsync<Guid?>(
+            """
+            SELECT s.id
+            FROM sessions s
+            JOIN game_groups g ON g.id = s.group_id
+            WHERE s.id = @SessionId
+              AND g.platform = 'Discord'
+              AND g.external_group_id = @GuildId
+            FOR UPDATE OF s
+            """,
+            new { SessionId = sessionId, GuildId = guildId },
+            transaction);
+
         await connection.ExecuteAsync(
             """
             UPDATE portfolio_games pg

src/GmRelay.Shared/Features/Sessions/ListSessions/DeleteSessionHandler.cs

@@ -31,7 +31,7 @@ public sealed class DeleteSessionHandler(
         await using var connection = await dataSource.OpenConnectionAsync(ct);
         await using var transaction = await connection.BeginTransactionAsync(ct);
 
-        // 1. Fetch session and verify group manager.
+        // 1. Lock the session before any linked portfolio card and verify group manager.
         var session = await connection.QuerySingleOrDefaultAsync<DeleteSessionInfoDto>(
             """
             SELECT s.title AS Title,
@@ -49,6 +49,7 @@ public sealed class DeleteSessionHandler(
                    ) AS CanManage
             FROM sessions s
             WHERE s.id = @SessionId
+            FOR UPDATE OF s
             """,
             new { command.SessionId, Platform = command.User.Platform.ToString(), ExternalUserId = command.User.ExternalUserId }, transaction);
 

tests/GmRelay.Bot.Tests/Web/PortfolioMigrationPostgresTests.cs

@@ -421,6 +421,70 @@ public sealed class PortfolioMigrationPostgresTests(PortfolioMigrationPostgresFi
             parameters: new NpgsqlParameter("sessionId", seed.SessionIds[0])));
     }
 
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task ConcurrentSessionDeleteAndFutureReschedule_ShouldSerializeSessionBeforeCardWithoutDeadlock(
+        bool deleteLocksSessionFirst)
+    {
+        var database = await fixture.CreateMigratedDatabaseAsync();
+        await using var seedConnection = await database.OpenConnectionAsync();
+        var seed = await SeedCardAsync(seedConnection, isPublic: true);
+        await using var deleteConnection = await database.OpenConnectionAsync();
+        await using var rescheduleConnection = await database.OpenConnectionAsync();
+        await using var observerConnection = await database.OpenConnectionAsync();
+        await using var deleteTransaction = await deleteConnection.BeginTransactionAsync();
+        await using var rescheduleTransaction = await rescheduleConnection.BeginTransactionAsync();
+        var deletePid = await GetBackendPidAsync(deleteConnection, deleteTransaction);
+        var reschedulePid = await GetBackendPidAsync(rescheduleConnection, rescheduleTransaction);
+
+        if (deleteLocksSessionFirst)
+        {
+            await LockSessionAsync(deleteConnection, deleteTransaction, seed.SessionIds[0]);
+            var rescheduleTask = RescheduleSessionAsync(
+                rescheduleConnection,
+                rescheduleTransaction,
+                seed.SessionIds[0]);
+
+            await WaitUntilBlockedByAsync(observerConnection, reschedulePid, deletePid);
+            await UnpublishAndDeleteSessionAsync(
+                deleteConnection,
+                deleteTransaction,
+                seed.PortfolioGameId,
+                seed.SessionIds[0]);
+            await deleteTransaction.CommitAsync().WaitAsync(CommandTimeout);
+
+            Assert.Equal(0, await rescheduleTask.WaitAsync(CommandTimeout));
+            await rescheduleTransaction.CommitAsync().WaitAsync(CommandTimeout);
+        }
+        else
+        {
+            Assert.Equal(1, await RescheduleSessionAsync(
+                rescheduleConnection,
+                rescheduleTransaction,
+                seed.SessionIds[0]));
+            var deleteTask = LockUnpublishDeleteAndCommitSessionAsync(
+                deleteConnection,
+                deleteTransaction,
+                seed.PortfolioGameId,
+                seed.SessionIds[0]);
+
+            await WaitUntilBlockedByAsync(observerConnection, deletePid, reschedulePid);
+            await rescheduleTransaction.CommitAsync().WaitAsync(CommandTimeout);
+            await deleteTask.WaitAsync(CommandTimeout);
+        }
+
+        await using var verificationConnection = await database.OpenConnectionAsync();
+        Assert.False(await ExecuteScalarAsync<bool>(
+            verificationConnection,
+            "SELECT is_public FROM portfolio_games WHERE id = @portfolioGameId",
+            parameters: new NpgsqlParameter("portfolioGameId", seed.PortfolioGameId)));
+        Assert.Equal(0, await ExecuteScalarAsync<long>(
+            verificationConnection,
+            "SELECT COUNT(*) FROM sessions WHERE id = @sessionId",
+            parameters: new NpgsqlParameter("sessionId", seed.SessionIds[0])));
+    }
+
     [Theory]
     [InlineData("portfolio_game_sessions")]
     [InlineData("portfolio_game_masters")]
@@ -618,6 +682,98 @@ public sealed class PortfolioMigrationPostgresTests(PortfolioMigrationPostgresFi
             transaction);
     }
 
+    private static Task<int> GetBackendPidAsync(
+        NpgsqlConnection connection,
+        NpgsqlTransaction transaction)
+    {
+        return ExecuteScalarAsync<int>(connection, "SELECT pg_backend_pid()", transaction);
+    }
+
+    private static Task<int> LockSessionAsync(
+        NpgsqlConnection connection,
+        NpgsqlTransaction transaction,
+        Guid sessionId)
+    {
+        return ExecuteNonQueryAsync(
+            connection,
+            "SELECT 1 FROM sessions s WHERE s.id = @sessionId FOR UPDATE OF s",
+            transaction,
+            new NpgsqlParameter("sessionId", sessionId));
+    }
+
+    private static Task<int> RescheduleSessionAsync(
+        NpgsqlConnection connection,
+        NpgsqlTransaction transaction,
+        Guid sessionId)
+    {
+        return ExecuteNonQueryAsync(
+            connection,
+            "UPDATE sessions SET scheduled_at = now() + interval '1 day' WHERE id = @sessionId",
+            transaction,
+            new NpgsqlParameter("sessionId", sessionId));
+    }
+
+    private static async Task LockUnpublishDeleteAndCommitSessionAsync(
+        NpgsqlConnection connection,
+        NpgsqlTransaction transaction,
+        Guid portfolioGameId,
+        Guid sessionId)
+    {
+        await LockSessionAsync(connection, transaction, sessionId);
+        await UnpublishAndDeleteSessionAsync(connection, transaction, portfolioGameId, sessionId);
+        await transaction.CommitAsync().WaitAsync(CommandTimeout);
+    }
+
+    private static async Task UnpublishAndDeleteSessionAsync(
+        NpgsqlConnection connection,
+        NpgsqlTransaction transaction,
+        Guid portfolioGameId,
+        Guid sessionId)
+    {
+        await ExecuteNonQueryAsync(
+            connection,
+            """
+            UPDATE portfolio_games
+            SET is_public = false,
+                updated_at = now()
+            WHERE id = @portfolioGameId
+            """,
+            transaction,
+            new NpgsqlParameter("portfolioGameId", portfolioGameId));
+        await ExecuteNonQueryAsync(
+            connection,
+            "DELETE FROM sessions WHERE id = @sessionId",
+            transaction,
+            new NpgsqlParameter("sessionId", sessionId));
+    }
+
+    private static async Task WaitUntilBlockedByAsync(
+        NpgsqlConnection observerConnection,
+        int blockedPid,
+        int blockingPid)
+    {
+        using var timeout = new CancellationTokenSource(CommandTimeout);
+        while (!timeout.IsCancellationRequested)
+        {
+            if (await ExecuteScalarAsync<bool>(
+                    observerConnection,
+                    "SELECT @blockingPid = ANY (pg_blocking_pids(@blockedPid))",
+                    parameters:
+                    [
+                        new NpgsqlParameter("blockedPid", blockedPid),
+                        new NpgsqlParameter("blockingPid", blockingPid)
+                    ]))
+            {
+                return;
+            }
+
+            await Task.Yield();
+        }
+
+        throw new TimeoutException(
+            $"PostgreSQL backend {blockedPid} was not blocked by backend {blockingPid} within {CommandTimeout}.");
+    }
+
     private static async Task<int> ExecuteNonQueryAsync(
         NpgsqlConnection connection,
         string sql,

tests/GmRelay.Bot.Tests/Web/PortfolioSchemaGateSourceTests.cs

@@ -17,7 +17,7 @@ public sealed class PortfolioSchemaGateSourceTests
         var appHost = NormalizeSource(await ReadRepositoryFileAsync("src/GmRelay.AppHost/Program.cs"));
 
         Assert.Contains(
-            "var bot = builder.AddProject<Projects.GmRelay_Bot>(\"bot\") .WithReference(postgres) .WaitFor(postgres);",
+            "var bot = builder.AddProject<Projects.GmRelay_Bot>(\"bot\") .WithReference(postgres) .WaitFor(postgres) .WithHttpEndpoint(port: 8081, targetPort: 8081, name: \"health\") .WithHttpHealthCheck(\"/health\", endpointName: \"health\");",
             appHost,
             StringComparison.Ordinal);
         Assert.Contains(

tests/GmRelay.Bot.Tests/Web/PortfolioSessionDeletionSourceTests.cs

@@ -3,15 +3,22 @@ namespace GmRelay.Bot.Tests.Web;
 public sealed class PortfolioSessionDeletionSourceTests
 {
     [Fact]
-    public async Task SharedDeleteSessionHandler_ShouldUnpublishLinkedPortfolioCardBeforeDeletingSession()
+    public async Task SharedDeleteSessionHandler_ShouldLockSessionBeforeUnpublishingLinkedPortfolioCardAndDeletingSession()
     {
         var source = NormalizeSql(await ReadRepositoryFileAsync(
             "src/GmRelay.Shared/Features/Sessions/ListSessions/DeleteSessionHandler.cs"));
 
+        const string sessionLock =
+            "FROM sessions s WHERE s.id = @SessionId FOR UPDATE OF s";
         const string unpublish =
             "UPDATE portfolio_games pg SET is_public = false, updated_at = now() FROM portfolio_game_sessions pgs WHERE pgs.portfolio_game_id = pg.id AND pgs.session_id = @SessionId AND pg.is_public = true";
 
+        Assert.Contains(sessionLock, source, StringComparison.Ordinal);
         Assert.Contains(unpublish, source, StringComparison.Ordinal);
+        Assert.True(
+            source.IndexOf(sessionLock, StringComparison.Ordinal) <
+            source.IndexOf(unpublish, StringComparison.Ordinal),
+            "The shared delete path must lock the session before locking a linked portfolio card.");
         Assert.True(
             source.IndexOf(unpublish, StringComparison.Ordinal) <
             source.IndexOf("DELETE FROM sessions WHERE id = @Id", StringComparison.Ordinal),
@@ -19,16 +26,23 @@ public sealed class PortfolioSessionDeletionSourceTests
     }
 
     [Fact]
-    public async Task DiscordDeleteSessionHandler_ShouldUnpublishOnlyCardsFromTheInteractionGuildBeforeDeletingSession()
+    public async Task DiscordDeleteSessionHandler_ShouldLockGuildSessionBeforeUnpublishingLinkedPortfolioCardAndDeletingSession()
     {
         var source = NormalizeSql(await ReadRepositoryFileAsync(
             "src/GmRelay.DiscordBot/Features/Sessions/DiscordDeleteSessionHandler.cs"));
 
+        const string sessionLock =
+            "SELECT s.id FROM sessions s JOIN game_groups g ON g.id = s.group_id WHERE s.id = @SessionId AND g.platform = 'Discord' AND g.external_group_id = @GuildId FOR UPDATE OF s";
         const string unpublish =
             "UPDATE portfolio_games pg SET is_public = false, updated_at = now() FROM portfolio_game_sessions pgs JOIN sessions s ON s.id = pgs.session_id JOIN game_groups g ON g.id = s.group_id WHERE pgs.portfolio_game_id = pg.id AND s.id = @SessionId AND g.platform = 'Discord' AND g.external_group_id = @GuildId AND pg.is_public = true";
 
+        Assert.Contains(sessionLock, source, StringComparison.Ordinal);
         Assert.Contains(unpublish, source, StringComparison.Ordinal);
         Assert.Contains("AND p.platform = 'Discord'", source, StringComparison.Ordinal);
+        Assert.True(
+            source.IndexOf(sessionLock, StringComparison.Ordinal) <
+            source.IndexOf(unpublish, StringComparison.Ordinal),
+            "The Discord delete path must lock the guild-scoped session before locking a linked portfolio card.");
         Assert.True(
             source.IndexOf(unpublish, StringComparison.Ordinal) <
             source.IndexOf("DELETE FROM sessions s", StringComparison.Ordinal),