fix(gameplay): gate next-round replay on prior transition

lobby/tests.py

@@ -1326,6 +1326,27 @@ class RevealRoundFlowTests(TestCase):
         mock_sync_broadcast_phase_event.assert_called_once()
         self.assertEqual(mock_sync_broadcast_phase_event.call_args.args[1], "phase.lie_started")
 
+    def test_start_next_round_rejects_plain_first_round_lie_phase(self):
+        self.client.login(username="host_reveal", password="secret123")
+        self.session.status = GameSession.Status.LIE
+        self.session.save(update_fields=["status"])
+
+        response = self.client.post(
+            reverse(
+                "lobby:start_next_round",
+                kwargs={"code": self.session.code},
+            ),
+            HTTP_ACCEPT_LANGUAGE="en",
+        )
+
+        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.json()["error_code"], "next_round_invalid_phase")
+        self.session.refresh_from_db()
+        self.assertEqual(self.session.status, GameSession.Status.LIE)
+        self.assertEqual(self.session.current_round, 1)
+        self.assertEqual(RoundConfig.objects.filter(session=self.session, number=1).count(), 1)
+        self.assertEqual(RoundQuestion.objects.filter(session=self.session, round_number=1).count(), 1)
+
     def test_start_next_round_requires_host(self):
         self.session.status = GameSession.Status.SCOREBOARD
         self.session.save(update_fields=["status"])

lobby/views.py

@@ -1004,6 +1004,9 @@ def start_next_round(request: HttpRequest, code: str) -> JsonResponse:
             locked_session.save(update_fields=["current_round", "status"])
             should_broadcast = True
         elif locked_session.status == GameSession.Status.LIE:
+            if locked_session.current_round <= 1:
+                return api_error(request, code="next_round_invalid_phase", status=400)
+
             next_round_config = RoundConfig.objects.filter(
                 session=locked_session,
                 number=locked_session.current_round,