test(multiplayer): cover matcher load boundary

.github/workflows/multiplayer-load.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - server/api/**
       - server/domain/**
+      - server/matcher/**
       - Makefile
       - .github/workflows/multiplayer-load.yml
 

Makefile

@@ -4,7 +4,7 @@ verify-multiplayer-local:
 	bash scripts/verify_multiplayer_local.sh
 
 verify-multiplayer-load:
-	(cd server && go test -tags load ./api -run TestQueueCreateHTTPLoad -count=1)
+	(cd server && go test -tags load ./api ./matcher -run 'Test(QueueCreateHTTPLoad|ProposalFormationLoad)' -count=1)
 
 verify-release-gate:
 	@test -n "$(RELEASE_REPORT)" || (echo "RELEASE_REPORT=/path/to/report.json is required" >&2; exit 2)

multiplayer-next.md

@@ -1250,7 +1250,7 @@ the local/CI/community transport, not a silent production fallback.
 | 8.48 `[D:8.10,8.14,8.17,8.18,8.27,8.31,8.35,8.47]` | **IN PROGRESS.** Offline testkit exercises verified queue projection → ranked six-player proposal → ENet allocation → assignment-ready manifest → certified durable result receipt; `compose.allocated-smoke.yml` independently runs the real testkit API, matcher, allocator, Agones-shaped provider, PostgreSQL, and game-server supervisor with a generated signed roster, verifying queue/proposal/allocation binding, authenticated result, idempotent retry, shutdown acknowledgment, durable receipt/audit rows, and SIGTERM-driven game-process drain | `.github/workflows/allocated-compose.yml` runs `make verify-allocated-compose`. Live Docker evidence from this workspace and legacy fixture non-regression remain open |
 | 8.49 `[D:8.25,8.26,8.28,8.29,8.30,8.31,8.35,8.36]` | **IN PROGRESS.** `scripts/verify_kind_agones.sh` creates a disposable kind cluster, installs pinned Agones, loads the real `game-server` image, applies the Fleet in an explicitly separate Agones-only supervisor/UDP readiness mode, and verifies readiness plus allocation of a dynamic UDP endpoint; `.github/workflows/agones-integration.yml` runs it for infrastructure changes and on demand | The cloud-free runner is committed and fails clearly when Docker/kind/Helm are unavailable. CI/live evidence for production control-plane registration, roster/no-show, both readiness stages, races, multi-match node, result-pending reconciliation, drain, and rollback remains open |
 | 8.50 `[D:8.25,8.37,8.43,8.49]` | **IN PROGRESS.** `make verify-chaos-recovery` provides a disposable PostgreSQL + real testkit API + real maintenance flow: it restarts the API, injects a stale allocation, and verifies no-penalty requeue plus a durable participant-targeted lifecycle event | The API-restart/stalled-allocation slice is implemented and documented; 100 ms RTT/jitter/loss, matcher/client restart, game-pod death, node drain, Redis failover, control-plane loss, and live chaos evidence remain |
-| 8.51 `[D:8.17,8.18,8.30,8.31,8.45]` | **IN PROGRESS.** The opt-in `make verify-multiplayer-load` gate drives 10,000 real HTTP queue-create requests through the service with 256 in flight and records p95/p99; the handler and in-process ownership boundary are exercised without weakening normal tests | Local API load passes at p95 <250 ms in normal and race runs; PostgreSQL saturation, >=100 proposals/s, durable matcher fencing under load, forecast launch concurrency x2, and replica scaling remain live infrastructure gates |
+| 8.51 `[D:8.17,8.18,8.30,8.31,8.45]` | **IN PROGRESS.** The opt-in `make verify-multiplayer-load` gate drives 10,000 real HTTP queue-create requests through the service with 256 in flight and records p95/p99, plus 100 concurrent proposal formations through the real matcher/domain path; the handler and in-process ownership boundary are exercised without weakening normal tests | Local API load passes at p95 <250 ms in normal and race runs, and the matcher forms 100 unique proposals; PostgreSQL saturation, durable matcher fencing under load, forecast launch concurrency x2, and replica scaling remain live infrastructure gates |
 | 8.52 `[D:8.32,8.34,8.45,8.51]` | **IN PROGRESS.** Allocator now supports an opt-in, per-replica fixed-window allocation quota per EU/NA region (`--allocation-quota` / `--allocation-quota-window`), checked before any provider call and safe under concurrent attempts | Normal/race/vet tests cover quota exhaustion, window reset, region isolation, invalid input, and atomic concurrent consumption; measured regional cost model, shared/global quota, budget alerts, and denial-of-wallet production rehearsal remain |
 | 8.53 `[D:7.8,8.13,8.38,8.45,8.46,8.48,8.49,8.50,8.51,8.52]` | **IN PROGRESS.** `scripts/verify_release_gate.py` provides a fail-closed promotion check for the ordered development → internal → casual canary → casual → provisional ranked → ranked stages, requiring an evidence report for SLO, security, cost, rollback, EU+NA playtests, and both legacy gates | Validator and adversarial tests cover skipped stages, unknown stages, missing gates, non-boolean gate values, and blank release IDs; the actual reports, production rollback rehearsal, regional playtests, and live promotion remain open |
 

server/matcher/load_test.go

@@ -0,0 +1,81 @@
+//go:build load
+
+package matcher
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/cosmic-clash/cosmic-clash/server/domain"
+)
+
+// TestProposalFormationLoad is the local matcher-throughput portion of §8.51.
+// It drives the real Worker and domain formation code; durable PostgreSQL
+// proposal throughput and cross-replica fencing remain integration gates.
+func TestProposalFormationLoad(t *testing.T) {
+	const proposals = 100
+	now := time.Unix(1_000_000, 0).UTC()
+	var created atomic.Int64
+	ids := make(chan string, proposals)
+	var wg sync.WaitGroup
+	started := make(chan struct{})
+	for i := 0; i < proposals; i++ {
+		workerIndex := i
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			worker := Worker{
+				Playlist: domain.Casual, Size: 6, Now: func() time.Time { return now },
+				NextID: func() string { return fmt.Sprintf("load-proposal-%04d-123456", workerIndex) },
+				Source: func(context.Context, time.Time, domain.Playlist, int) ([]domain.Candidate, error) {
+					candidates := make([]domain.Candidate, 6)
+					for slot := range candidates {
+						candidates[slot] = domain.Candidate{
+							PlayerID: fmt.Sprintf("load-player-%04d-%d", workerIndex, slot),
+							TicketID: fmt.Sprintf("load-ticket-%04d-%d", workerIndex, slot),
+							Playlist: domain.Casual, ClientBuild: "build-1", ProtocolVersion: 1,
+							EnqueuedAt: now, PredictedRTT: map[string]float64{"EU": 20},
+						}
+					}
+					return candidates, nil
+				},
+				Prepare: func(id string, playlist domain.Playlist, formation domain.MatchFormation, at time.Time) (domain.PreparedProposal, error) {
+					return domain.PrepareProposal(id, playlist, formation, nil, domain.RankedArena{}, at)
+				},
+				Creator: ProposalCreatorFunc(func(_ context.Context, proposal domain.Proposal, _ map[string]string, _ time.Time) error {
+					created.Add(1)
+					ids <- proposal.ProposalID
+					return nil
+				}),
+			}
+			<-started
+			if formed, err := worker.RunOnce(context.Background()); err != nil || !formed {
+				t.Errorf("worker %d formed=%v err=%v", workerIndex, formed, err)
+			}
+		}()
+	}
+	startedAt := time.Now()
+	close(started)
+	wg.Wait()
+	close(ids)
+	if created.Load() != proposals {
+		t.Fatalf("created=%d, want %d", created.Load(), proposals)
+	}
+	ordered := make([]string, 0, proposals)
+	for id := range ids {
+		ordered = append(ordered, id)
+	}
+	sort.Strings(ordered)
+	for i, id := range ordered {
+		want := fmt.Sprintf("load-proposal-%04d-123456", i)
+		if id != want {
+			t.Fatalf("proposal %d = %q, want unique %q", i, id, want)
+		}
+	}
+	t.Logf("proposal formation load: proposals=%d elapsed=%s rate=%.1f/s", proposals, time.Since(startedAt), float64(proposals)/time.Since(startedAt).Seconds())
+}