From 3dbecb0bd52de69f66d3191918be1eaec1a0b938 Mon Sep 17 00:00:00 2001
From: Josh Creek <8179928+jcreek@users.noreply.github.com>
Date: Tue, 1 Sep 2026 16:20:31 +0100
Subject: [PATCH] fix(multiplayer): fence roster topology at persistence

---
 multiplayer-next.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/multiplayer-next.md b/multiplayer-next.md
index 47379483..d40f4cf1 100644
--- a/multiplayer-next.md
+++ b/multiplayer-next.md
@@ -1408,3 +1408,5 @@ Allocated join admission now retains and applies the signed assignment’s autho
 Allocated boot now also validates the complete signed roster shape before opening the gameplay endpoint: malformed claims, duplicate player identities, duplicate slots, and team/global-slot mismatches fail closed rather than leaving a partially usable server. The Godot `--check-only` attempt still reaches the known macOS renderer/ZSTD crash before script parsing, so this startup guard remains statically reviewed and covered by the existing signed-claim tests pending a working Godot runtime.
 
 The control plane now mirrors that topology fence at roster publication: signed entries with duplicate players, duplicate slots, or a team inconsistent with the canonical global slot are rejected before durable assignment rows are written. Focused store tests cover forged topology and duplicate entries; normal/race Go suites and vet pass.
+
+The backend roster persistence boundary now enforces the same duplicate-player, duplicate-slot, and team/global-slot invariants as Godot startup. This closes the remaining local consistency gap in task 8.31; production signer/client-ticket publication and live Agones verification remain external gates.