fix(multiplayer): correct allocated fleet entrypoint

deploy/k8s/base/fleet.yaml

@@ -64,7 +64,9 @@ spec:
                 - --image-digest-env=COSMIC_CLASH_IMAGE_DIGEST
                 - --roster-path=/run/cosmic-clash/join-roster.json
                 - --transport=enet
+                - --protocol-version=1
                 - --
+                - /opt/cosmic-clash/CosmicClashServer.x86_64
                 - --allocated-mode
                 - --match-id=allocation-placeholder
                 - --server-id=allocation-placeholder

deploy/k8s/overlays/na/kustomization.yaml

@@ -11,5 +11,5 @@ patches:
       name: cosmic-clash-game
     patch: |-
       - op: replace
-        path: /spec/template/spec/template/spec/containers/0/args/18
+        path: /spec/template/spec/template/spec/containers/0/args/21
         value: --region=NA

multiplayer-next.md

@@ -1393,6 +1393,13 @@ godot --path Game -- --connect 127.0.0.1:27015 --name Alice
 
 The current working implementation now wires `deploy/k8s/base/fleet.yaml` to the digest-pinned `game-server` supervisor target, the in-cluster control-plane Service, workload roster materialization, signing/drain secret references, downward-API server/image identity, and the required game-server egress policy. `kubectl kustomize deploy/k8s/base` and `server/security/test_fleet_manifests.py` pass. The older 8.28 narrative above still records the pre-wiring state; live Agones, operator secret/image replacement, and real cluster readiness remain explicit gates.
 
+An adversarial Fleet-entrypoint review found that the supervisor invocation had
+no executable after `--`, and that its required supervisor-level protocol flag
+was missing. The Fleet now passes the exported Godot server explicitly and
+sets `--protocol-version=1`; the NA overlay's positional patch and manifest
+regression test were updated together. This is a local launch-contract fix,
+not evidence of live Agones readiness.
+
 The NA overlay now also patches the allocated child’s `--region=NA` argument, keeping it aligned with the NA Fleet label; rendered EU and NA overlays and the adversarial manifest test verify that regional assignment validation cannot silently remain EU in the NA deployment.
 
 Allocated Godot startup now derives its `min-players` floor from the verified signed roster size, preventing the direct-server default of one player from starting a partially admitted allocated match. A focused regression test covers six-player, casual two-player, and direct-server behavior; the full Godot harness is currently unavailable because Godot cannot open its shared `user://` log and crashes in the macOS renderer before test execution.

server/security/test_fleet_manifests.py

@@ -23,6 +23,8 @@ class FleetManifestTest(unittest.TestCase):
             "ghcr.io/cosmic-clash/game-server@sha256:",
             "--sdk-base-url=http://127.0.0.1:9357",
             "--control-plane-url=http://control-plane.cosmic-clash.svc.cluster.local:8080",
+            "--protocol-version=1",
+            "/opt/cosmic-clash/CosmicClashServer.x86_64",
             "--roster-path=/run/cosmic-clash/join-roster.json",
             "--allocated-mode",
             "--join-authorisations-key-file=/run/secrets/cosmic-clash/join-signing-key",
@@ -63,9 +65,11 @@ class FleetManifestTest(unittest.TestCase):
         na_kustomization = self.read("overlays/na/kustomization.yaml")
         self.assertIn("cosmic-clash.io/region: EU", eu)
         self.assertIn("cosmic-clash.io/region: NA", na)
-        self.assertIn("path: /spec/template/spec/template/spec/containers/0/args/18", na_kustomization)
+        self.assertIn("path: /spec/template/spec/template/spec/containers/0/args/21", na_kustomization)
         self.assertIn("value: --region=NA", na_kustomization)
         self.assertNotEqual(eu, na)
+        self.assertEqual(na_kustomization.count("value: --region=NA"), 1)
+        self.assertEqual(na_kustomization.count("value: --region=EU"), 0)
         for document in (eu, na):
             self.assertIn("namespace: cosmic-clash", document)