fix(multiplayer): validate contract ticket input

server/api/service.go

@@ -453,6 +453,13 @@ func (s *Service) contractQueueCreate(w http.ResponseWriter, r *http.Request) {
 	}
 	var fields map[string]json.RawMessage
 	if json.Unmarshal(body, &fields) == nil {
+		if rawTicketID, exists := fields["ticket_id"]; exists {
+			var ticketID string
+			if json.Unmarshal(rawTicketID, &ticketID) != nil || !controlPlaneResourceIDRE.MatchString(ticketID) {
+				writeError(w, http.StatusBadRequest, "invalid_request")
+				return
+			}
+		}
 		// Ticket IDs are server-assigned for the public contract. Deriving one
 		// from the authenticated request's idempotency material makes retries
 		// converge on the same domain command without persisting adapter state.

server/api/service_test.go

@@ -281,6 +281,18 @@ func TestDocumentedContractRoutesRejectNonOpaqueResourceIDs(t *testing.T) {
 	service := &Service{}
 	server := httptest.NewServer(service.Handler())
 	defer server.Close()
+	request, err := http.NewRequest(http.MethodPost, server.URL+"/api/v1/queue/tickets", strings.NewReader(`{"ticket_id":"short","playlist":"casual","client_build":"build-1","protocol_version":1}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if response, requestErr := http.DefaultClient.Do(request); requestErr != nil {
+		t.Fatal(requestErr)
+	} else {
+		if response.StatusCode != http.StatusBadRequest {
+			t.Fatalf("short supplied ticket id status = %d, want 400", response.StatusCode)
+		}
+		response.Body.Close()
+	}
 	paths := []string{
 		"/api/v1/queue/tickets/short/heartbeat",
 		"/api/v1/proposals/proposal/unsafe/accept",