fix: enforce matchmaking compatibility boundaries

server/domain/matcher_test.go

@@ -101,3 +101,33 @@ func TestSelectCandidatesRejectsMalformedCandidateInsteadOfTrustingIt(t *testing
 		t.Fatal("duplicate player candidate accepted")
 	}
 }
+
+func TestSelectCandidatesDoesNotMixQueueCompatibilityContracts(t *testing.T) {
+	now := time.Unix(100000, 0)
+	anchor := candidate("a", 1500, 0, 40, 40, now)
+	anchor.Playlist = Ranked
+	anchor.ClientBuild = "build-1"
+	anchor.ProtocolVersion = 2
+	compatible := anchor
+	compatible.TicketID = "b"
+	compatible.PlayerID = "player-b"
+	mismatchPlaylist := compatible
+	mismatchPlaylist.TicketID = "c"
+	mismatchPlaylist.PlayerID = "player-c"
+	mismatchPlaylist.Playlist = Casual
+	mismatchBuild := compatible
+	mismatchBuild.TicketID = "d"
+	mismatchBuild.PlayerID = "player-d"
+	mismatchBuild.ClientBuild = "build-2"
+	mismatchProtocol := compatible
+	mismatchProtocol.TicketID = "e"
+	mismatchProtocol.PlayerID = "player-e"
+	mismatchProtocol.ProtocolVersion = 3
+	selection, err := SelectCandidates(anchor, []Candidate{mismatchPlaylist, mismatchBuild, mismatchProtocol, compatible}, 2, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ticketIDs(selection.Players) != "a\x00b\x00" {
+		t.Fatalf("selected incompatible metadata: %q", ticketIDs(selection.Players))
+	}
+}