fix(multiplayer): fence recovered allocation tuples

server/allocator/worker.go

@@ -6,6 +6,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/cosmic-clash/cosmic-clash/server/agones"
 	"github.com/cosmic-clash/cosmic-clash/server/domain"
 )
 
@@ -49,6 +50,9 @@ func (w Worker) RunOnce(ctx context.Context) (bool, error) {
 				return true, fmt.Errorf("recover provider allocation for match %s: %w", request.MatchID, err)
 			}
 			if found {
+				if err := validateRecoveredAllocation(request, recovered); err != nil {
+					return true, fmt.Errorf("recovered provider allocation for match %s: %w", request.MatchID, err)
+				}
 				if _, err := w.Service.RecordProviderAllocation(ctx, recovered, w.Now()); err != nil {
 					return true, fmt.Errorf("record recovered allocation for match %s: %w", request.MatchID, err)
 				}
@@ -74,6 +78,14 @@ func (w Worker) RunOnce(ctx context.Context) (bool, error) {
 	return true, nil
 }
 
+func validateRecoveredAllocation(request domain.AllocationRequest, result agones.AllocatedServer) error {
+	allocation := result.Allocation
+	if result.Endpoint == "" || allocation.State != domain.ServerAllocated || allocation.AllocationID != request.AllocationID || allocation.MatchID != request.MatchID || allocation.ServerID == "" || allocation.Region != request.Region || allocation.Build != request.Build || allocation.Protocol != request.Protocol || allocation.Transport != request.Transport {
+		return fmt.Errorf("recovered allocation does not match request")
+	}
+	return nil
+}
+
 // AllocationLabels are the compatibility selectors shared with the Fleet
 // template. They are derived only from the durable match plan, never client
 // input or mutable worker configuration.

server/allocator/worker_test.go

@@ -93,6 +93,18 @@ func TestWorkerRecoversProviderAllocationBeforeIssuingSecondAllocation(t *testin
 	}
 }
 
+func TestWorkerRejectsRecoveredAllocationForDifferentCompatibility(t *testing.T) {
+	request := domain.AllocationRequest{AllocationID: "allocation-1", MatchID: "match-1", Region: "EU", Build: "build-1", Protocol: 1, Transport: "enet"}
+	claims := &matchClaimSpy{request: request, found: true}
+	provider := &recoverableProviderSpy{recovered: agones.AllocatedServer{Allocation: domain.Allocation{AllocationID: request.AllocationID, MatchID: request.MatchID, ServerID: "server-1", Region: "NA", Build: request.Build, Protocol: request.Protocol, Transport: request.Transport, State: domain.ServerAllocated}, Endpoint: "127.0.0.1:31001"}, found: true}
+	durable := &durableSpy{}
+	worker := Worker{Claims: claims, Service: Service{Provider: provider, Durable: durable, Now: func() time.Time { return time.Unix(1_000, 0) }}, Now: func() time.Time { return time.Unix(1_000, 0) }}
+	processed, err := worker.RunOnce(context.Background())
+	if err == nil || !processed || durable.calls != 0 || claims.bound != (domain.Allocation{}) {
+		t.Fatalf("processed=%t err=%v durable_calls=%d bound=%+v", processed, err, durable.calls, claims.bound)
+	}
+}
+
 func TestWorkerDoesNothingWhenNoDurableMatchIsAvailable(t *testing.T) {
 	claims := &matchClaimSpy{}
 	worker := Worker{Claims: claims, Now: func() time.Time { return time.Unix(1_000, 0) }}