Inbox answer validation isn't atomic with resolving the question

internal/store/inbox.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"strings"
 	"time"
 
@@ -114,6 +115,19 @@ func (s *Store) Respond(ctx context.Context, actor string, resolutions []Resolut
 	return s.write(ctx, func(tx *sql.Tx, emit emitFunc) error {
 		for _, r := range resolutions {
 			resp := r.Response
+			res, err := tx.ExecContext(ctx, `UPDATE inbox_items SET state = ?, resolved_by = ?, resolved_at = ? WHERE id = ? AND state = ?`,
+				string(r.State), actor, now(), resp.ItemId, string(api.Open))
+			if err != nil {
+				return err
+			}
+			n, err := res.RowsAffected()
+			if err != nil {
+				return err
+			}
+			if n == 0 {
+				return fmt.Errorf("%w: %s", ErrNotOpen, resp.ItemId)
+			}
+
 			attachments, err := json.Marshal(resp.Attachments)
 			if err != nil {
 				return err
@@ -137,12 +151,6 @@ func (s *Store) Respond(ctx context.Context, actor string, resolutions []Resolut
 				return err
 			}
 
-			_, err = tx.ExecContext(ctx, `UPDATE inbox_items SET state = ?, resolved_by = ?, resolved_at = ? WHERE id = ?`,
-				string(r.State), actor, now(), resp.ItemId)
-			if err != nil {
-				return err
-			}
-
 			err = emitItem(ctx, tx, emit, "inbox.updated", resp.ItemId, actor)
 			if err != nil {
 				return err