fix(multiplayer): centralize arena path validation

multiplayer-next.md

@@ -1451,7 +1451,7 @@ The same allocation path now carries the matcher-selected playlist, preventing a
 
 Ranked proposal admission no longer trusts the matcher’s `--ranked-random-arena` boolean. The Go domain now owns a named allowlist for the three floor-goal `ArenaRegistry` entries, and rejects unknown and elevated IDs before any proposal is created.
 
-The arena hand-off is now durable: the matcher deterministically selects an eligible floor-goal arena from the proposal ID, migration 0008 stores that path on proposals and matches and enforces it for new direct SQL writes, migration 0009 retains it on provider allocations, each durable transition and recovery lookup rechecks the same allowlist, allocation claims and idempotency digests retain it, Agones applies it as a match-scoped annotation, and the supervisor overlays the allocated child’s `--arena-path`. Godot accepts only the same floor-goal `ArenaRegistry` paths and requires one for allocated ranked matches, so a stale Fleet default, an elevated variant, or an altered retry cannot substitute a ranked arena.
+The arena hand-off is now durable: the matcher deterministically selects an eligible floor-goal arena from the proposal ID, migration 0008 stores that path on proposals and matches and enforces it for new direct SQL writes, migration 0009 retains it on provider allocations, domain/store/provider boundaries and recovery lookups recheck the same allowlist, allocation claims and idempotency digests retain it, Agones applies it as a match-scoped annotation, and the supervisor overlays the allocated child’s `--arena-path`. Godot accepts only the same floor-goal `ArenaRegistry` paths and requires one for allocated ranked matches, so a stale Fleet default, an elevated variant, or an altered retry cannot substitute a ranked arena.
 
 The Godot control-plane client now retains the exact last idempotent mutation and exposes `retry_last_mutation()` for transport, timeout, rate-limit, and 5xx failures. Retries reuse the original idempotency key and expected revision, while 401 and 409 responses remain non-retryable; the harness covers the policy boundary. This closes the local duplicate-action recovery mechanism for heartbeat/cancel/proposal calls, with broader live UI retry verification still remaining.
 

server/domain/allocator.go

@@ -137,7 +137,7 @@ func (a *Allocator) PublishAssignment(allocationID string, manifest AllocationMa
 }
 
 func validateAllocationRequest(request AllocationRequest) error {
-	if request.AllocationID == "" || request.MatchID == "" || request.Region == "" || request.Build == "" || request.Protocol <= 0 || (request.Transport != "enet" && request.Transport != "steam_sdr") {
+	if request.AllocationID == "" || request.MatchID == "" || request.Region == "" || request.Build == "" || request.Protocol <= 0 || (request.Transport != "enet" && request.Transport != "steam_sdr") || (request.ArenaPath != "" && !IsRankedArenaPath(request.ArenaPath)) {
 		return ErrAllocationInput
 	}
 	return nil

server/domain/allocator_test.go

@@ -53,6 +53,19 @@ func TestAllocatorRejectsInvalidServerAndNoCompatibleCapacity(t *testing.T) {
 	}
 }
 
+func TestAllocatorRejectsUnregisteredArenaPath(t *testing.T) {
+	a, err := NewAllocator([]ReadyServer{{ServerID: "server-1", Region: "EU", Build: "build-1", Protocol: 1, Transport: "enet", State: ServerReady}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{"res://scenes/arena_01_elevated.tscn", "res://forged.tscn"} {
+		request := AllocationRequest{AllocationID: "allocation-" + path, MatchID: "match-1", Region: "EU", Build: "build-1", Protocol: 1, ArenaPath: path, Transport: "enet"}
+		if _, err := a.Allocate(request, time.Unix(1000, 0)); !errors.Is(err, ErrAllocationInput) {
+			t.Fatalf("arena path %q returned %v, want ErrAllocationInput", path, err)
+		}
+	}
+}
+
 func TestAllocatorConcurrentClaimsCannotDoubleAllocateOneServer(t *testing.T) {
 	a, _ := NewAllocator([]ReadyServer{{ServerID: "server-1", Region: "EU", Build: "build-1", Protocol: 1, Transport: "enet", State: ServerReady}})
 	requests := []AllocationRequest{

server/store/allocator_sql.go

@@ -140,7 +140,7 @@ func RecordProviderAllocation(ctx context.Context, db *sql.DB, allocation domain
 }
 
 func validAllocationInput(db *sql.DB, request domain.AllocationRequest, now time.Time) bool {
-	return db != nil && request.AllocationID != "" && request.MatchID != "" && (request.Region == "EU" || request.Region == "NA") && request.Build != "" && request.Protocol > 0 && (request.Transport == "enet" || request.Transport == "steam_sdr") && !now.IsZero()
+	return db != nil && request.AllocationID != "" && request.MatchID != "" && (request.Region == "EU" || request.Region == "NA") && request.Build != "" && request.Protocol > 0 && (request.Transport == "enet" || request.Transport == "steam_sdr") && (request.ArenaPath == "" || domain.IsRankedArenaPath(request.ArenaPath)) && !now.IsZero()
 }
 
 func allocationRequestDigest(request domain.AllocationRequest) [32]byte {