fix(multiplayer): promote accepted matches atomically

multiplayer-next.md

@@ -1206,7 +1206,7 @@ production fallback.
 | 8.15 `[D:7.8,8.3]` | **IN PROGRESS.** Pure Go probe validation treats Steam location as opaque, requires nonce/freshness/region and server-computed RTT, and implements discrepancy quarantine/release; authenticated HTTP now accepts only opaque location/nonce input through a server-owned probe provider and records validated RTT into the active player's durable queue ticket; durable queue projections have a server-derived RTT JSON field for matcher reads | `server/domain/probes.go`, `server/migrations/0003_queue_probe_metadata.sql`, adversarial fixtures and `server/api/service.go`/`store/queue_sql.go` cover stale/wrong/forged evidence, the 25 ms/30% threshold, three-sample quarantine, five-clean release, authenticated provider arguments, rejection of client RTT fields, player/ticket/expiry binding, persistence failure, playlist-scoped candidate reads and bounded metadata decoding; Steam coordinator, regional probe adapters and multi-region probe population remain |
 | 8.16 `[D:8.14,8.15]` | **IN PROGRESS.** Pure Go candidate/team selection implements the <=100 ms ceiling, pairwise widening tolerance, anchor inclusion, deterministic set/region scoring and balanced team partitioning; queue-backed formation now consumes the server-owned projection, fences duplicate player identities and rejects playlist/build/protocol mixing; the matcher worker performs bounded formation and delegates the final claim to the durable proposal transaction; the runnable matcher now supports explicitly enabled ranked six-player polling with durable verified-Steam identity lookup. **Fixed a real crash-loop**: `Worker.Run` treated every `RunOnce` error as fatal to the whole loop, including "no compatible candidates" (`FormFromQueue`'s completely routine answer when currently-queued players share no verified region) — found building a live two-player integration attempt (see below): two real players with no common region crashed the entire matcher process, taking matchmaking down for every other player in the playlist, and would crash-loop again on restart since the same incompatible candidates stay queued. Now only genuine static misconfiguration (`ErrWorkerNotConfigured`/`ErrUnsupportedPlaylist`/`ErrInvalidMatcherSize`) stops the loop; everything else retries next interval | `server/domain/matcher.go`, `teams.go`, `server/matcher/worker.go`, `server/store/queue_sql.go` and adversarial fixtures cover no-common-region, tolerance boundaries, lexical ties, mean-rating balance, malformed candidates, duplicate identities, compatibility mismatches, incomplete batches, source failure, durable claim failure, queue-backed oldest-anchor formation and incomplete ranked identity metadata; two new tests cover `Run` (not just `RunOnce`) surviving a per-pass error via a real concurrent goroutine, and still stopping immediately on a real configuration error, both clean across repeated `-race` runs. **A live two-player Godot proposal integration attempt is on disk but not committed**: `Game/tests/control_plane_proposal_smoke.gd`/`.tscn` and `scripts/verify_control_plane_proposal_integration.sh` exist and found the bug above, but the session paused running further concurrent headless Godot processes after discovering they'd been causing native engine crashes (macOS crash reporter, `EXC_BAD_ACCESS`/`SIGBUS`) intermittently all session, confirmed by the user; the two-player script was never itself verified to a clean pass. Arena selection and long-running worker integration remain |
 | 8.17 `[D:8.14,8.16]` | **IN PROGRESS.** Pure Go proposal policy sends a 10-second response window to every selected human, requires unanimous acceptance, applies exact casual/ranked decline and timeout cooldowns with ranked escalation, and exposes revisioned idempotent responses through the authenticated API. Proposal closure now atomically separates offenders from innocents: a decliner's ticket is `CANCELLED`; a timed-out player's ticket is `EXPIRED`; accepted or otherwise innocent participants return to `QUEUED` with their original `enqueued_at` and refreshed expiry. Direct queue cancellation closes the open proposal and requeues remaining participants immediately. Late API responses commit expiry, timeout penalties, and ticket release before returning `ErrProposalClosed`; recovery of an old declined proposal cannot misclassify its pending innocents as timeouts. Cooldown history rejects future, foreign-playlist, and invalid-kind events, and database rows are closed before penalty writes | Domain/store/API fixtures cover partial/unanimous response, expiry, replay/conflict, stale revision, exact cooldown windows/escalation, corrupt history filtering, offender ticket termination, innocent precedence preservation, direct-cancel cascade, and the former late-response rollback. PostgreSQL-tagged regressions compile and assert the durable split and penalty rows; the full local Go suite passes. Live PostgreSQL execution and allocation integration remain |
-| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation persists matcher-selected region/protocol/team/slot topology before acceptance, and final unanimous acceptance promotes the exact roster into one `ALLOCATING` match. Promotion replay validates immutable playlist/region/protocol/arena, participant, ticket, team, and slot identity but deliberately ignores mutable match state/server ownership, so a retry after a lost response still succeeds after allocation has advanced. Result sets are closed before crossing into promotion writes, avoiding one-connection pool stalls. Redis remains a rebuildable candidate projection over PostgreSQL authority | Store/API tests cover retries, claims, owner/revision fencing, expiry, exact promotion replay/conflict, progressed-match replay, rollback of partial claims, concurrent contested-ticket formation, and lost-cache repair. PostgreSQL-tagged regressions compile; prior live runs covered queue/proposal promotion and races, while this progressed-replay change awaits a live database rerun. Allocation runtime integration remains |
+| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation persists matcher-selected region/protocol/team/slot topology before acceptance, and the same serializable final-acceptance transaction now promotes the exact roster into one `ALLOCATING` match, closing the process-crash gap that could otherwise strand an accepted proposal before the former second promotion transaction. The API promoter remains a replay check. Promotion replay validates immutable playlist/region/protocol/arena, participant, ticket, team, and slot identity but deliberately ignores mutable match state/server ownership, so a retry after a lost response still succeeds after allocation has advanced. Result sets are closed before crossing into promotion writes, avoiding one-connection pool stalls. Redis remains a rebuildable candidate projection over PostgreSQL authority | Store/API tests cover retries, claims, owner/revision fencing, expiry, exact promotion replay/conflict, progressed-match replay, rollback of partial claims, concurrent contested-ticket formation, and lost-cache repair. PostgreSQL-tagged regressions compile and assert acceptance, ticket transitions, match creation, and roster insertion are one durable outcome; prior live runs covered queue/proposal promotion and races, while this atomic-promotion change awaits a live database rerun. Allocation runtime integration remains |
 | 8.19 `[D:8.18]` | **IN PROGRESS.** Pure Go casual lineup requires 2–6 humans with at least one per team, fills missing slots with explicit bots, permits kickoff-only bot-slot backfill and assigns no backfill penalty/rating update; proposal preparation now derives the lineup from formed teams | `server/domain/casual.go`, `formation.go` cover both-team minimum, bot shape, live-play rejection, zero-penalty backfill and casual proposal composition; queue candidate selection, opt-in 10 s backfill proposals, reconnect/leave penalties and live integration remain |
 | 8.20 `[D:8.18]` | **IN PROGRESS.** Pure Go ranked admission requires six unique verified solo humans, rejects bots/backfill/parties, and allows only random-enabled non-elevated arenas; proposal preparation requires matching metadata for every formed player | `server/domain/ranked.go`, `formation.go` cover count, identity, party, bot/backfill, arena eligibility and formed-player metadata rejection; `ArenaRegistry` integration, allocation wiring and innocent-ticket restoration remain |
 | 8.21 `[D:8.5,8.20]` | **IN PROGRESS.** Pure Go rating core implements canonical Glicko-2, daily inactivity, ranked 1/3 and casual 1/N human-opponent weights, deterministic opponent ordering, and authoritative draw/overtime/abandon scoring; certified result completion now applies per-player updates inside the durable transaction with lexical row locks and revision increments | `server/domain/rating.go`, `server/store/result_sql.go` and tests cover canonical/inactivity/weight/invalid-input, draw/OT/abandon, ordered participant snapshots, lock/value re-read and rating update SQL; live PostgreSQL rating and seasons execution now covered (§8.23), and concurrent result transaction cases are covered: `TestPostgreSQLConcurrentIdenticalResultSubmissionAppliesRatingsExactlyOnce` races 5 identical submissions and confirms one rating application, while `TestPostgreSQLConcurrentConflictingResultSubmissionsKeepOneReceipt` races different payloads and confirms exactly one winner, one conflict, one receipt and one completion event; live maintenance/DB execution remains |

server/store/match_sql.go

@@ -120,44 +120,92 @@ func CreateMatchFromAcceptedProposal(ctx context.Context, db *sql.DB, plan Accep
 		if proposalState != string(domain.Accepted) {
 			return fmt.Errorf("proposal is not accepted")
 		}
-		if !validAcceptedPlaylistCount(domain.Playlist(playlist), len(plan.Players)) {
-			return fmt.Errorf("accepted proposal playlist does not match player count")
-		}
-		if domain.Playlist(playlist) == domain.Ranked && !domain.IsRankedArenaPath(plan.ArenaPath) {
-			return fmt.Errorf("ranked accepted match plan has invalid arena")
-		}
-		participants, err := acceptedProposalParticipants(ctx, tx, plan)
-		if err != nil {
-			return err
-		}
-		inserted, err := tx.ExecContext(ctx, AcceptedMatchInsertSQL, plan.MatchID, playlist, plan.Region, plan.Protocol, plan.ArenaPath)
-		if err != nil {
-			return err
-		}
-		changed, err := inserted.RowsAffected()
-		if err != nil {
-			return err
-		}
-		if changed == 0 {
-			return verifyAcceptedMatchReplay(ctx, tx, plan, domain.Playlist(playlist), participants)
-		}
-		for _, player := range plan.Players {
-			ticketID := participants[player.PlayerID]
-			var protocol int
-			if err := tx.QueryRowContext(ctx, AcceptedTicketSQL, ticketID, player.PlayerID).Scan(&protocol); err != nil {
-				return fmt.Errorf("accepted ticket transition: %w", err)
-			}
-			if protocol != plan.Protocol {
-				return fmt.Errorf("accepted ticket protocol mismatch")
-			}
-			if _, err := tx.ExecContext(ctx, AcceptedMatchParticipantInsertSQL, plan.MatchID, player.PlayerID, ticketID, player.Slot, player.Team); err != nil {
-				return err
-			}
-		}
-		return nil
+		return createMatchFromAcceptedProposalTx(ctx, tx, plan, domain.Playlist(playlist))
 	})
 }
 
+func createMatchFromAcceptedProposalTx(ctx context.Context, tx *sql.Tx, plan AcceptedMatchPlan, playlist domain.Playlist) error {
+	if !validAcceptedPlaylistCount(domain.Playlist(playlist), len(plan.Players)) {
+		return fmt.Errorf("accepted proposal playlist does not match player count")
+	}
+	if domain.Playlist(playlist) == domain.Ranked && !domain.IsRankedArenaPath(plan.ArenaPath) {
+		return fmt.Errorf("ranked accepted match plan has invalid arena")
+	}
+	participants, err := acceptedProposalParticipants(ctx, tx, plan)
+	if err != nil {
+		return err
+	}
+	inserted, err := tx.ExecContext(ctx, AcceptedMatchInsertSQL, plan.MatchID, playlist, plan.Region, plan.Protocol, plan.ArenaPath)
+	if err != nil {
+		return err
+	}
+	changed, err := inserted.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if changed == 0 {
+		return verifyAcceptedMatchReplay(ctx, tx, plan, domain.Playlist(playlist), participants)
+	}
+	for _, player := range plan.Players {
+		ticketID := participants[player.PlayerID]
+		var protocol int
+		if err := tx.QueryRowContext(ctx, AcceptedTicketSQL, ticketID, player.PlayerID).Scan(&protocol); err != nil {
+			return fmt.Errorf("accepted ticket transition: %w", err)
+		}
+		if protocol != plan.Protocol {
+			return fmt.Errorf("accepted ticket protocol mismatch")
+		}
+		if _, err := tx.ExecContext(ctx, AcceptedMatchParticipantInsertSQL, plan.MatchID, player.PlayerID, ticketID, player.Slot, player.Team); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// promotePlannedAcceptedProposalTx closes the crash window between unanimous
+// acceptance and match creation. Legacy proposals without a persisted matcher
+// plan remain readable, but every planned production proposal is materialized
+// before the response transaction commits.
+func promotePlannedAcceptedProposalTx(ctx context.Context, tx *sql.Tx, proposalID string, playlist domain.Playlist) error {
+	var region, arenaPath sql.NullString
+	var protocol sql.NullInt64
+	if err := tx.QueryRowContext(ctx, StoredProposalMatchPlanSQL, proposalID).Scan(&region, &protocol, &arenaPath); err != nil {
+		return err
+	}
+	if !region.Valid && !protocol.Valid && !arenaPath.Valid {
+		return nil
+	}
+	if !region.Valid || !protocol.Valid || protocol.Int64 < 1 {
+		return fmt.Errorf("accepted proposal has incomplete match plan")
+	}
+	plan := AcceptedMatchPlan{
+		MatchID: "match-" + proposalID, ProposalID: proposalID,
+		Region: region.String, Protocol: int(protocol.Int64), ArenaPath: arenaPath.String,
+	}
+	rows, err := tx.QueryContext(ctx, StoredProposalMatchPlayersSQL, proposalID)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var player MatchPlayer
+		if err := rows.Scan(&player.PlayerID, &player.Team, &player.Slot); err != nil {
+			return err
+		}
+		plan.Players = append(plan.Players, player)
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+	if err := rows.Close(); err != nil {
+		return err
+	}
+	if !validAcceptedMatchPlan(plan) {
+		return fmt.Errorf("accepted proposal has invalid persisted match plan")
+	}
+	return createMatchFromAcceptedProposalTx(ctx, tx, plan, playlist)
+}
+
 func validAcceptedPlaylistCount(playlist domain.Playlist, count int) bool {
 	if playlist == domain.Ranked {
 		return count == 6

server/store/postgres_integration_test.go

@@ -584,6 +584,17 @@ func TestPostgreSQLProposalClaimAndResponseAreAtomic(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	proposal.Region = "EU"
+	proposal.Protocol = 1
+	for index := range proposal.Participants {
+		if proposal.Participants[index].PlayerID == "proposal-player-a" {
+			proposal.Participants[index].Team = 0
+			proposal.Participants[index].Slot = 0
+		} else {
+			proposal.Participants[index].Team = 1
+			proposal.Participants[index].Slot = 3
+		}
+	}
 	if err := CreateProposal(ctx, db, proposal, map[string]string{"proposal-player-a": "proposal-ticket-0", "proposal-player-b": "proposal-ticket-1"}, now); err != nil {
 		t.Fatalf("create proposal: %v", err)
 	}
@@ -616,6 +627,20 @@ func TestPostgreSQLProposalClaimAndResponseAreAtomic(t *testing.T) {
 	if accepted.State != domain.Accepted || accepted.Revision != 2 {
 		t.Fatalf("proposal did not close after unanimous acceptance: %+v", accepted)
 	}
+	var matchState string
+	if err := db.QueryRow(`SELECT state FROM matches WHERE match_id = 'match-proposal-integration'`).Scan(&matchState); err != nil {
+		t.Fatalf("atomic accepted match: %v", err)
+	}
+	var acceptedTickets, matchPlayers int
+	if err := db.QueryRow(`SELECT count(*) FROM queue_tickets WHERE ticket_id LIKE 'proposal-ticket-%' AND state = 'ACCEPTED'`).Scan(&acceptedTickets); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.QueryRow(`SELECT count(*) FROM match_participants WHERE match_id = 'match-proposal-integration'`).Scan(&matchPlayers); err != nil {
+		t.Fatal(err)
+	}
+	if matchState != "ALLOCATING" || acceptedTickets != 2 || matchPlayers != 2 {
+		t.Fatalf("acceptance did not atomically materialize match: state=%s tickets=%d players=%d", matchState, acceptedTickets, matchPlayers)
+	}
 }
 
 // TestPostgreSQLProposalDeclineCancelsOffenderAndRequeuesInnocent protects the

server/store/proposal_recovery_sql.go

@@ -398,6 +398,9 @@ func RespondToProposal(ctx context.Context, db *sql.DB, playerID, proposalID, id
 		if targetState != state {
 			if targetState == string(domain.Accepted) {
 				_, err = tx.ExecContext(ctx, ProposalAcceptSQL, proposalID)
+				if err == nil {
+					err = promotePlannedAcceptedProposalTx(ctx, tx, proposalID, domain.Playlist(playlist))
+				}
 			} else {
 				_, err = tx.ExecContext(ctx, ProposalDeclineSQL, proposalID)
 				if err != nil {