fix: bind proposal claims to playlist

multiplayer-todo.md

@@ -1195,7 +1195,7 @@ the local/CI/community transport, not a silent production fallback.
 | 8.15 `[D:7.8,8.3]` | **IN PROGRESS.** Pure Go probe validation treats Steam location as opaque, requires nonce/freshness/region and server-computed RTT, and implements discrepancy quarantine/release; authenticated HTTP now accepts only opaque location/nonce input through a server-owned probe provider | `server/domain/probes.go`, adversarial fixtures and `server/api/service.go` cover stale/wrong/forged evidence, the 25 ms/30% threshold, three-sample quarantine, five-clean release, authenticated provider arguments and rejection of client RTT fields; Steam coordinator and regional probe adapters remain |
 | 8.16 `[D:8.14,8.15]` | **IN PROGRESS.** Pure Go candidate/team selection implements the <=100 ms ceiling, pairwise widening tolerance, anchor inclusion, deterministic set/region scoring and balanced team partitioning; queue-backed formation now consumes the server-owned projection, fences duplicate player identities and rejects playlist/build/protocol mixing | `server/domain/matcher.go`, `teams.go` and adversarial fixtures cover no-common-region, tolerance boundaries, lexical ties, mean-rating balance, malformed candidates, duplicate identities, compatibility mismatches and queue-backed oldest-anchor formation; full population fixtures and durable matcher claim integration remain |
 | 8.17 `[D:8.14,8.16]` | **IN PROGRESS.** Pure Go proposal policy sends a 10-second response window to every selected human, requires unanimous acceptance, applies exact decline/timeout cooldowns and ranked escalation; authenticated API exposes revisioned accept/decline mutations; formed matches now pass through a playlist-aware proposal boundary | `server/domain/proposal.go`, `formation.go` and `server/api/service.go` plus adversarial fixtures cover partial/unanimous response, expiry, replay/conflict, stale API revision, casual lineup preparation and ranked metadata validation; queue precedence and allocation integration remain |
-| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now inserts proposal/participants and promotes every ticket in one rollback-safe transaction with a player-bound claim predicate, and queue creation has a durable idempotency/owner-read adapter | `server/store/serializable.go`, `queue_sql.go`, `proposal_sql.go` and tests cover retry classification, claim-boundary invariants, player/ticket mapping, durable queue replay/conflict, owner-scoped recovery, zero-row claim aborts and atomic statement ordering; live PostgreSQL adapter execution, Redis candidate index/repair, worker-failure and concurrent two-matcher integration tests remain |
+| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now inserts proposal/participants and promotes every ticket in one rollback-safe transaction with player- and playlist-bound claim predicates, and queue creation has a durable idempotency/owner-read adapter | `server/store/serializable.go`, `queue_sql.go`, `proposal_sql.go` and tests cover retry classification, claim-boundary invariants, player/ticket/playlist mapping, durable queue replay/conflict, owner-scoped recovery, zero-row claim aborts and atomic statement ordering; live PostgreSQL adapter execution, Redis candidate index/repair, worker-failure and concurrent two-matcher integration tests remain |
 | 8.19 `[D:8.18]` | **IN PROGRESS.** Pure Go casual lineup requires 2–6 humans with at least one per team, fills missing slots with explicit bots, permits kickoff-only bot-slot backfill and assigns no backfill penalty/rating update; proposal preparation now derives the lineup from formed teams | `server/domain/casual.go`, `formation.go` cover both-team minimum, bot shape, live-play rejection, zero-penalty backfill and casual proposal composition; queue candidate selection, opt-in 10 s backfill proposals, reconnect/leave penalties and live integration remain |
 | 8.20 `[D:8.18]` | **IN PROGRESS.** Pure Go ranked admission requires six unique verified solo humans, rejects bots/backfill/parties, and allows only random-enabled non-elevated arenas; proposal preparation requires matching metadata for every formed player | `server/domain/ranked.go`, `formation.go` cover count, identity, party, bot/backfill, arena eligibility and formed-player metadata rejection; `ArenaRegistry` integration, allocation wiring and innocent-ticket restoration remain |
 | 8.21 `[D:8.5,8.20]` | **IN PROGRESS.** Pure Go rating core implements canonical Glicko-2, daily inactivity, ranked 1/3 and casual 1/N human-opponent weights, deterministic opponent ordering, and authoritative draw/overtime/abandon scoring | `server/domain/rating.go` has canonical/inactivity/weight/invalid-input plus draw/OT/abandon fixtures; PostgreSQL snapshot locking, rating transaction integration, seasons and concurrent result transaction tests remain |

server/store/proposal_sql.go

@@ -32,7 +32,7 @@ func CreateProposal(ctx context.Context, db *sql.DB, proposal domain.Proposal, t
 			if _, err := tx.ExecContext(ctx, ProposalParticipantInsertSQL, proposal.ProposalID, participant.PlayerID, ticketID); err != nil {
 				return err
 			}
-			result, err := tx.ExecContext(ctx, QueueTicketProposeSQL, ticketID, participant.PlayerID, now)
+			result, err := tx.ExecContext(ctx, QueueTicketProposeSQL, ticketID, participant.PlayerID, string(proposal.Playlist), now)
 			if err != nil {
 				return err
 			}

server/store/serializable.go

@@ -79,5 +79,5 @@ FOR UPDATE SKIP LOCKED`
 VALUES ($1, $2, $3, 'PENDING')`
 
 	QueueTicketProposeSQL = `UPDATE queue_tickets SET state = 'PROPOSED', revision = revision + 1
-WHERE ticket_id = $1 AND player_id = $2 AND state = 'QUEUED' AND expires_at > $3`
+WHERE ticket_id = $1 AND player_id = $2 AND playlist = $3 AND state = 'QUEUED' AND expires_at > $4`
 )

server/store/serializable_test.go

@@ -19,7 +19,7 @@ func TestRetryableRecognisesPostgresSerializationAndDeadlockErrors(t *testing.T)
 }
 
 func TestClaimSQLContainsDurableOwnershipFences(t *testing.T) {
-	for _, fragment := range []string{"FOR UPDATE SKIP LOCKED", "state = 'QUEUED'", "player_id = $2", "proposal_participants", "revision = revision + 1", "INSERT INTO proposals", "ranked_season_rollovers", "ON CONFLICT (player_id, season_id) DO NOTHING"} {
+	for _, fragment := range []string{"FOR UPDATE SKIP LOCKED", "state = 'QUEUED'", "player_id = $2", "playlist = $3", "proposal_participants", "revision = revision + 1", "INSERT INTO proposals", "ranked_season_rollovers", "ON CONFLICT (player_id, season_id) DO NOTHING"} {
 		if !containsAnySQL(fragment) {
 			t.Fatalf("claim boundary missing %q", fragment)
 		}