fix: enforce matchmaking compatibility boundaries

server/domain/matcher.go

@@ -92,7 +92,7 @@ func SelectCandidates(anchor Candidate, candidates []Candidate, size int, now ti
 	seen := map[string]bool{}
 	seenPlayers := map[string]bool{}
 	add := func(candidate Candidate) {
-		if validCandidate(candidate) && !seen[candidate.TicketID] && !seenPlayers[candidate.PlayerID] {
+		if validCandidate(candidate) && compatibleMetadata(anchor, candidate) && !seen[candidate.TicketID] && !seenPlayers[candidate.PlayerID] {
 			seen[candidate.TicketID] = true
 			seenPlayers[candidate.PlayerID] = true
 			pool = append(pool, candidate)
@@ -139,6 +139,23 @@ func SelectCandidates(anchor Candidate, candidates []Candidate, size int, now ti
 	return best, nil
 }
 
+// compatibleMetadata prevents a queue projection from crossing playlist or
+// protocol/build boundaries. Empty anchor metadata is retained for older
+// direct/community callers; once the queue has selected a compatibility
+// contract, every participant must carry the exact same values.
+func compatibleMetadata(anchor, candidate Candidate) bool {
+	if anchor.Playlist != "" && candidate.Playlist != anchor.Playlist {
+		return false
+	}
+	if anchor.ClientBuild != "" && candidate.ClientBuild != anchor.ClientBuild {
+		return false
+	}
+	if anchor.ProtocolVersion > 0 && candidate.ProtocolVersion != anchor.ProtocolVersion {
+		return false
+	}
+	return true
+}
+
 func validCandidate(candidate Candidate) bool {
 	if candidate.TicketID == "" || candidate.PlayerID == "" || candidate.EnqueuedAt.IsZero() || math.IsNaN(candidate.Rating) || math.IsInf(candidate.Rating, 0) {
 		return false

server/domain/matcher_test.go

@@ -101,3 +101,33 @@ func TestSelectCandidatesRejectsMalformedCandidateInsteadOfTrustingIt(t *testing
 		t.Fatal("duplicate player candidate accepted")
 	}
 }
+
+func TestSelectCandidatesDoesNotMixQueueCompatibilityContracts(t *testing.T) {
+	now := time.Unix(100000, 0)
+	anchor := candidate("a", 1500, 0, 40, 40, now)
+	anchor.Playlist = Ranked
+	anchor.ClientBuild = "build-1"
+	anchor.ProtocolVersion = 2
+	compatible := anchor
+	compatible.TicketID = "b"
+	compatible.PlayerID = "player-b"
+	mismatchPlaylist := compatible
+	mismatchPlaylist.TicketID = "c"
+	mismatchPlaylist.PlayerID = "player-c"
+	mismatchPlaylist.Playlist = Casual
+	mismatchBuild := compatible
+	mismatchBuild.TicketID = "d"
+	mismatchBuild.PlayerID = "player-d"
+	mismatchBuild.ClientBuild = "build-2"
+	mismatchProtocol := compatible
+	mismatchProtocol.TicketID = "e"
+	mismatchProtocol.PlayerID = "player-e"
+	mismatchProtocol.ProtocolVersion = 3
+	selection, err := SelectCandidates(anchor, []Candidate{mismatchPlaylist, mismatchBuild, mismatchProtocol, compatible}, 2, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ticketIDs(selection.Players) != "a\x00b\x00" {
+		t.Fatalf("selected incompatible metadata: %q", ticketIDs(selection.Players))
+	}
+}