fix: durable payouts survive journal failure, cap bank withdrawals, hash passwords off the owner loop.

23 files changed, 917 insertions, 91 deletions

diff --git a/building_guide/concurrency.md b/building_guide/concurrency.md
index 984a61d..2fa4558 100644
--- a/building_guide/concurrency.md
+++ b/building_guide/concurrency.md
@@ -37,6 +37,17 @@ Rules:
   per-message write deadlines. A full queue disconnects only that client.
 - Saves run on the owner and serialize a value snapshot; concurrent
   read-modify-write cycles of the same files cannot happen.
+- Password work is the one deliberate exception: Argon2id verification and
+  hashing (~64 MiB, tens of milliseconds) run on the CALLER's connection
+  goroutine in `HandleSessionOnOwner` (`StatePassword` and
+  `StateNewAccount` are intercepted before any owner task is submitted).
+  A burst of logins therefore costs memory and CPU on connection
+  goroutines, never a stall of the owner's command/tick queue. The owner
+  task re-checks the stored hash against the one that was verified so a
+  password change mid-login cannot authorize a stale attempt, and
+  `player.hashLimiter` caps concurrent Argon2id computations at 4.
+  All resulting state transitions (echo, session state, account saves)
+  still happen on the owner.
 
 Unit tests construct Games without an owner; such Games run submitted tasks
 inline on the caller's goroutine (legacy behavior), which is fine for
@@ -126,6 +137,26 @@ an insufficient-funds message). A failed payout keeps its record open (the
 reported win is never announced as paid) and startup recovery re-pays the
 owed settlement.
 
+If the JOURNAL ITSELF cannot be appended (persistent write failure, e.g. a
+deleted or unwritable `data/economy`), appends are retried and then the
+wallet degrades safely:
+
+- A **wager** is never charged without a journal record — the bet is
+  rejected with the persistence message (unchanged).
+- A **payout** falls back to paying through the character file alone (the
+  save is the commit point), so the settlement is real, announced, and
+  durable even with no journal record. `ResolveStakes` then records the
+  unresolved stake IDs in the character file (`player.Player
+  .ResolvedStakes`) as durable resolution evidence, and recovery settles
+  those stakes without refunding them (no double pay, and a settlement's
+  chip stake is not returned in kind on top of credits that already
+  returned it). If the character save fails too, no evidence exists and
+  the open wager record drives the ordinary refund-on-lost-state recovery.
+- A journal that cannot be fully READ (oversized or unreadable line)
+  aborts recovery and compaction entirely: records are preserved verbatim
+  for operator inspection instead of compensating over a partial fold or
+  truncating the file.
+
 At startup (`game.New`), open records are compensated in two phases:
 
 1. Open **payout** records (append order, evolving balance): file at the
@@ -145,7 +176,10 @@ At startup (`game.New`), open records are compensated in two phases:
 Currency arithmetic is checked (`internal/casino/credits.go`): explicit
 `MaxCredits` cap, bounded `DefaultMaxBet` default (the explicit unlimited
 sentinel is still honored), floor conversion for payout multipliers, and
-overflow rejected instead of wrapping.
+overflow rejected instead of wrapping. The cap is shared by the wallet:
+bank withdrawals are rejected when they would push the on-hand balance
+past it, and gameplay credit grants (shop sales, pickups, activity
+payouts) clamp at the cap and log rather than wrap.
 
 ## Account lifecycle transactions
 
diff --git a/internal/game/act_effects.go b/internal/game/act_effects.go
index 4438eb6..cae54a5 100644
--- a/internal/game/act_effects.go
+++ b/internal/game/act_effects.go
@@ -169,7 +169,7 @@ func (g *Game) applyStep(sess *net.Session, p *player.Player, step *behavior.Ste
 				sess.WriteLine(fmt.Sprintf("You don't have enough credits. (Need %d, have %d)", -step.Credits, p.Credits))
 			}
 		} else {
-			p.Credits += step.Credits
+			g.grantCredits(p, step.Credits)
 			g.saveCharacter(p)
 		}
 	}
@@ -226,7 +226,7 @@ func (g *Game) giveTriggerDrop(sess *net.Session, p *player.Player, drop *behavi
 	}
 
 	if drop.ItemID == "credits" {
-		p.Credits += qty
+		g.grantCredits(p, qty)
 		if sess != nil {
 			sess.WriteLine(fmt.Sprintf("You receive %d credits.", qty))
 		}
diff --git a/internal/game/act_steal.go b/internal/game/act_steal.go
index f9ca095..32889ce 100644
--- a/internal/game/act_steal.go
+++ b/internal/game/act_steal.go
@@ -418,7 +418,7 @@ func (g *Game) giveStealLoot(sess *net.Session, p *player.Player, drop *behavior
 	}
 
 	if drop.ItemID == "credits" {
-		p.Credits += qty
+		g.grantCredits(p, qty)
 		sess.WriteLine(g.colorize(sess, "currency_pickup", fmt.Sprintf("You steal %d credits.", qty)))
 		return
 	}
diff --git a/internal/game/casino.go b/internal/game/casino.go
index 9af9156..f9eb771 100644
--- a/internal/game/casino.go
+++ b/internal/game/casino.go
@@ -99,7 +99,28 @@ func (w casinoWallet) payCreditsFlagged(amount int, refund bool) error {
 	rec, err := w.g.Economy.startKind("payout", refund, w.p, 0, amount,
 		creditsBefore, creditsAfter, chipsBefore, chipsBefore)
 	if err != nil {
-		return casino.ErrWalletPersistence
+		// The journal is unavailable (persistent append failure). Last
+		// resort: pay through the character file only. The save below is
+		// the commit point — the money is durable even without a journal
+		// record, so the settlement may be announced as paid. The stake
+		// resolution evidence (ResolveStakes) keeps recovery from treating
+		// the round as unresolved; without a payout record, an open wager
+		// can no longer be distinguished from a lost one, so the balance
+		// itself is the only record of what happened.
+		if capErr != nil {
+			return capErr
+		}
+		w.p.Credits = creditsAfter
+		if serr := w.g.AccountStore.SaveCharacter(w.p); serr != nil {
+			w.p.Credits = creditsBefore
+			return casino.ErrWalletPersistence
+		}
+		kind := "settlement"
+		if refund {
+			kind = "refund"
+		}
+		fmt.Fprintf(os.Stderr, "economy: %s payout of %d credits for %s could not be journaled; the character file is the only durable record\n", kind, amount, w.p.Name)
+		return nil
 	}
 	if capErr != nil {
 		return capErr
@@ -129,9 +150,28 @@ func (w casinoWallet) payCreditsFlagged(amount int, refund bool) error {
 
 // ResolveStakes marks every outstanding stake for the player settled: the
 // round resolved (won, lost, pushed, or forfeited), so startup recovery
-// must no longer refund it.
+// must no longer refund it. When the journal cannot persist the settled
+// markers, the record IDs are recorded in the character file as durable
+// resolution evidence (player.Player.ResolvedStakes) so recovery still
+// honors the resolution instead of refunding an already-resolved round.
 func (w casinoWallet) ResolveStakes() {
-	w.g.Economy.ResolveStakes(economyKey(w.p))
+	unresolved := w.g.Economy.ResolveStakes(economyKey(w.p))
+	if len(unresolved) == 0 {
+		return
+	}
+	changed := false
+	for _, rec := range unresolved {
+		if !resolvedStakeRecorded(w.p, rec.ID) {
+			w.p.ResolvedStakes = append(w.p.ResolvedStakes, rec.ID)
+			changed = true
+		}
+	}
+	if !changed {
+		return
+	}
+	if err := w.g.AccountStore.SaveCharacter(w.p); err != nil {
+		fmt.Fprintf(os.Stderr, "casino resolve stakes: evidence save for %s: %v\n", w.p.Name, err)
+	}
 }
 
 // RefundOutstanding returns every outstanding stake to the player: chips
diff --git a/internal/game/cmd_bank.go b/internal/game/cmd_bank.go
index 8da6e89..264bab2 100644
--- a/internal/game/cmd_bank.go
+++ b/internal/game/cmd_bank.go
@@ -390,6 +390,12 @@ func (g *Game) doBankWithdrawCredits(sess *net.Session, parts []string) {
 		sess.WriteLine("You don't have that many banked credits.")
 		return
 	}
+	// The withdrawal must respect the shared economy cap: banked credits
+	// are not part of the on-hand balance, so the sum can exceed it.
+	if _, capErr := addCreditsChecked(p.Credits, amount); capErr != nil {
+		sess.WriteLine("Your wallet cannot hold that many credits.")
+		return
+	}
 	p.BankedCredits -= amount
 	p.Credits += amount
 	g.saveCharacter(p)
diff --git a/internal/game/cmd_get.go b/internal/game/cmd_get.go
index f2776a3..bc48394 100644
--- a/internal/game/cmd_get.go
+++ b/internal/game/cmd_get.go
@@ -276,7 +276,7 @@ func (g *Game) doGetAll(sess *net.Session) {
 			if taken <= 0 {
 				continue
 			}
-			p.Credits += taken
+			g.grantCredits(p, taken)
 			if taken == 1 {
 				picked = append(picked, "1 credit")
 			} else {
@@ -378,7 +378,7 @@ func (g *Game) pickupCredits(sess *net.Session, p *player.Player, itemID string)
 	if qty <= 0 {
 		return
 	}
-	p.Credits += qty
+	g.grantCredits(p, qty)
 	g.saveCharacter(p)
 	if qty == 1 {
 		sess.WriteLine(g.colorize(sess, "currency_pickup", "You pick up 1 credit."))
diff --git a/internal/game/cmd_shop.go b/internal/game/cmd_shop.go
index ca1bf53..7299ad3 100644
--- a/internal/game/cmd_shop.go
+++ b/internal/game/cmd_shop.go
@@ -351,7 +351,7 @@ func (g *Game) doShopSell(sess *net.Session, mob *world.MobInstance, input strin
 	}
 
 	p.RemoveItem(match.ID, actualQty)
-	p.Credits += total
+	g.grantCredits(p, total)
 	g.MobStore.ShopAdd(mob.InstanceID, match.ID, actualQty)
 	g.saveCharacter(p)
 
diff --git a/internal/game/cmd_trigger_utility.go b/internal/game/cmd_trigger_utility.go
index b48742a..ca65445 100644
--- a/internal/game/cmd_trigger_utility.go
+++ b/internal/game/cmd_trigger_utility.go
@@ -65,7 +65,7 @@ func (g *Game) triggerProcessing(sess *net.Session, p *player.Player, mod *ModDe
 		p.SetInvSlot(slot, nil)
 	}
 
-	p.Credits += creditValue
+	g.grantCredits(p, creditValue)
 
 	g.triggerModReward(sess, p, mod, 1.0)
 
diff --git a/internal/game/core_login_account.go b/internal/game/core_login_account.go
index 47421e9..371c287 100644
--- a/internal/game/core_login_account.go
+++ b/internal/game/core_login_account.go
@@ -63,20 +63,127 @@ func (g *Game) handlePassword(sess *net.Session, input string) {
 		sess.Write("Account name: ")
 		return
 	}
+	auth := passwordAuth{ok: true, stored: acc.PasswordHash}
 	// Transparent upgrade: legacy single-pass SHA-256 hashes rehash to
 	// Argon2id after a successful verification. A failed save keeps the
 	// legacy hash and retries on the next login.
 	if player.NeedsRehash(acc.PasswordHash) {
 		if hash, hashErr := player.HashPassword(input); hashErr == nil {
-			acc.PasswordHash = hash
-			if err := g.AccountStore.SaveAccount(acc); err != nil {
-				log.Printf("login: password rehash save for %s: %v", acc.Name, err)
-			}
+			auth.rehash = hash
 		} else {
 			log.Printf("login: password rehash for %s: %v", acc.Name, hashErr)
 		}
 	}
+	g.applyPasswordAuth(sess, auth)
+}
+
+// passwordAuth carries the result of the EXPENSIVE password work (Argon2id
+// verification and any rehash), which runs on the caller's connection
+// goroutine — never on the owner, where a burst of logins would stall
+// every command and tick behind password hashing.
+type passwordAuth struct {
+	ok bool
+	// loadErr marks an account read failure off the owner: the owner task
+	// renders it distinctly from a wrong password.
+	loadErr bool
+	// stored is the hash that was verified; the owner task re-checks the
+	// file against it so a password change, rename, or delete made during
+	// verification cannot authorize a stale login.
+	stored string
+	// rehash is an upgraded hash to persist after a successful check.
+	rehash string
+}
+
+// handlePasswordOffOwner verifies the password on the caller's connection
+// goroutine and submits one owner task for the (cheap) state transition.
+// The production entry point; handlePassword stays for direct HandleSession
+// callers (tests) but hashes on the owner there.
+func (g *Game) handlePasswordOffOwner(sess *net.Session, input string) {
+	if sess.Account == nil {
+		// Defensive: password prompts only follow an account-name step.
+		g.RunOnOwner(func() {
+			if g.isShuttingDown() {
+				return
+			}
+			g.handlePassword(sess, input)
+		})
+		return
+	}
+	if input == "" || len(input) > 128 {
+		tooshort := input == ""
+		g.RunOnOwner(func() {
+			if g.isShuttingDown() {
+				return
+			}
+			if tooshort {
+				// Echo stays disabled: the next attempt is also a password.
+				sess.Write("Password: ")
+				return
+			}
+			sess.SetEcho(true)
+			sess.WriteLine("Wrong password.")
+			sess.State = net.StateAccountName
+			sess.Write("Account name: ")
+		})
+		return
+	}
+	auth := passwordAuth{}
+	acc, err := g.AccountStore.LoadAccount(sess.Account.Name)
+	switch {
+	case err != nil:
+		auth.loadErr = true
+	case player.CheckPassword(input, acc.PasswordHash):
+		auth.ok, auth.stored = true, acc.PasswordHash
+		// Transparent upgrade: legacy single-pass SHA-256 hashes rehash to
+		// Argon2id after a successful verification. A failed rehash keeps
+		// the legacy hash and retries on the next login.
+		if player.NeedsRehash(acc.PasswordHash) {
+			if hash, hashErr := player.HashPassword(input); hashErr == nil {
+				auth.rehash = hash
+			} else {
+				log.Printf("login: password rehash for %s: %v", acc.Name, hashErr)
+			}
+		}
+	}
+	g.RunOnOwner(func() {
+		if g.isShuttingDown() {
+			return
+		}
+		g.applyPasswordAuth(sess, auth)
+	})
+}
+
+// applyPasswordAuth completes (or rejects) a password login on the owner.
+func (g *Game) applyPasswordAuth(sess *net.Session, auth passwordAuth) {
 	sess.SetEcho(true)
+	reject := func(message string) {
+		sess.WriteLine(message)
+		sess.State = net.StateAccountName
+		sess.Write("Account name: ")
+	}
+	if auth.loadErr {
+		reject("Error loading account.")
+		return
+	}
+	if !auth.ok {
+		reject("Wrong password.")
+		return
+	}
+	acc, err := g.AccountStore.LoadAccount(sess.Account.Name)
+	if err != nil {
+		reject("Error loading account.")
+		return
+	}
+	if acc.PasswordHash != auth.stored {
+		// The account changed while the hash was being verified (password
+		// change, rename, or delete): the verified hash is stale.
+		reject("Account changed; sign in again.")
+		return
+	}
+	if auth.rehash != "" {
+		acc.PasswordHash = auth.rehash
+		g.saveAccount(acc)
+	}
 	sess.Account = &player.Account{
 		Name:         acc.Name,
 		PasswordHash: acc.PasswordHash,
@@ -136,9 +243,38 @@ func (g *Game) handleNewAccount(sess *net.Session, input string) {
 	}
 
 	hash, err := player.HashPassword(input)
-	if err != nil {
+	g.applyNewAccount(sess, hash, err)
+}
+
+// handleNewAccountOffOwner hashes the confirmed password on the caller's
+// connection goroutine (Argon2id is expensive) and submits one owner task
+// for the existence re-check and save.
+func (g *Game) handleNewAccountOffOwner(sess *net.Session, input string) {
+	input = strings.TrimSpace(input)
+	if input == "" || input != sess.PendingPass {
+		g.RunOnOwner(func() {
+			if g.isShuttingDown() {
+				return
+			}
+			g.handleNewAccount(sess, input)
+		})
+		return
+	}
+	hash, hashErr := player.HashPassword(input)
+	g.RunOnOwner(func() {
+		if g.isShuttingDown() {
+			return
+		}
+		g.applyNewAccount(sess, hash, hashErr)
+	})
+}
+
+// applyNewAccount creates the account on the owner. The password was
+// already hashed by the caller (off the owner where possible).
+func (g *Game) applyNewAccount(sess *net.Session, hash string, hashErr error) {
+	if hashErr != nil {
 		sess.SetEcho(true)
-		sess.WriteLine(fmt.Sprintf("Error creating account: %v", err))
+		sess.WriteLine(fmt.Sprintf("Error creating account: %v", hashErr))
 		sess.Account = nil
 		sess.State = net.StateAccountName
 		sess.Write("Account name: ")
diff --git a/internal/game/economy.go b/internal/game/economy.go
index 0d5f08f..fc1b289 100644
--- a/internal/game/economy.go
+++ b/internal/game/economy.go
@@ -181,7 +181,9 @@ func (j *economyJournal) startKind(kind string, refund bool, p *player.Player, c
 		ChipsBefore:   chipsBefore,
 		ChipsAfter:    chipsAfter,
 	}
-	if err := j.append(*rec); err != nil {
+	// Retry a bounded number of times: a transient append failure must not
+	// drop the record that makes the wager or owed payout durable.
+	if err := j.appendRetry(*rec, 5); err != nil {
 		return nil, err
 	}
 	if rec.Tracked {
@@ -240,7 +242,13 @@ func (j *economyJournal) openStakes(player string) []*economyRecord {
 // payout evidence, or — if the round was a loss with no settlement
 // payout — refunds it under the documented refund-on-crash policy. A
 // stake is only forgotten once its marker is durable.
-func (j *economyJournal) ResolveStakes(player string) {
+//
+// It returns the records whose settled marker could NOT be made durable.
+// Callers holding the player should record those IDs as resolved-stake
+// evidence (player.Player.ResolvedStakes) so recovery still honors the
+// resolution even though the journal could not persist its marker.
+func (j *economyJournal) ResolveStakes(player string) []*economyRecord {
+	var unresolved []*economyRecord
 	remaining := j.stakes[player][:0]
 	for _, rec := range j.stakes[player] {
 		rec.Status = "settled"
@@ -249,6 +257,7 @@ func (j *economyJournal) ResolveStakes(player string) {
 			// (or a later attempt) still resolves it.
 			rec.Status = "open"
 			remaining = append(remaining, rec)
+			unresolved = append(unresolved, rec)
 		}
 	}
 	if len(remaining) == 0 {
@@ -256,6 +265,7 @@ func (j *economyJournal) ResolveStakes(player string) {
 	} else {
 		j.stakes[player] = remaining
 	}
+	return unresolved
 }
 
 // economyKey is the identity a player's journal records are indexed by:
@@ -275,6 +285,41 @@ func (rec *economyRecord) key() string {
 	return rec.Player
 }
 
+// resolvedStakeRecorded reports whether the character's durable evidence
+// list claims rec's stake was resolved by the session (its settled marker
+// could not be journaled; see player.Player.ResolvedStakes).
+func resolvedStakeRecorded(p *player.Player, id string) bool {
+	for _, existing := range p.ResolvedStakes {
+		if existing == id {
+			return true
+		}
+	}
+	return false
+}
+
+// pruneResolvedStakes drops resolved-stake evidence IDs that no longer
+// correspond to an open wager record (settled or void). It reports whether
+// anything changed, so callers only pay for a save when the file would
+// actually differ.
+func pruneResolvedStakes(openStakeIDs map[string]bool, p *player.Player) bool {
+	if len(p.ResolvedStakes) == 0 {
+		return false
+	}
+	kept := p.ResolvedStakes[:0]
+	changed := false
+	for _, id := range p.ResolvedStakes {
+		if openStakeIDs[id] {
+			kept = append(kept, id)
+		} else {
+			changed = true
+		}
+	}
+	if changed {
+		p.ResolvedStakes = kept
+	}
+	return changed
+}
+
 // payoutIdentifies reports whether two journal records belong to the same
 // character identity. ID-carrying records match only on the stable ID: a
 // different character that reused the display name must never supply (or
@@ -295,11 +340,16 @@ func payoutIdentifies(a, b economyRecord) bool {
 
 // reloadStakes rebuilds the outstanding-stake index from the journal file:
 // open wager records remain tracked (and refundable/resolvable) after
-// recovery compaction.
-func (j *economyJournal) reloadStakes() {
+// recovery compaction. A read failure leaves the previous indexes intact
+// (never a wiped index over a live journal); the caller logs loudly.
+func (j *economyJournal) reloadStakes() error {
+	folded, err := j.loadFolded()
+	if err != nil {
+		return err
+	}
 	j.stakes = make(map[string][]*economyRecord)
 	j.openPayouts = make(map[string]bool)
-	for _, fr := range j.loadFolded() {
+	for _, fr := range folded {
 		if fr.rec.Kind == "wager" && fr.rec.Status == "open" {
 			rec := fr.rec
 			j.registerStake(&rec)
@@ -308,18 +358,23 @@ func (j *economyJournal) reloadStakes() {
 			j.openPayouts[fr.rec.ID] = true
 		}
 	}
+	return nil
 }
 
 // loadOpen folds the journal and returns the still-open records.
-func (j *economyJournal) loadOpen() []*economyRecord {
+func (j *economyJournal) loadOpen() ([]*economyRecord, error) {
 	var open []*economyRecord
-	for _, fr := range j.loadFolded() {
+	folded, err := j.loadFolded()
+	if err != nil {
+		return nil, err
+	}
+	for _, fr := range folded {
 		if fr.rec.Status == "open" {
 			rec := fr.rec
 			open = append(open, &rec)
 		}
 	}
-	return open
+	return open, nil
 }
 
 // foldedRecord is the latest state of one record ID together with the
@@ -330,11 +385,15 @@ type foldedRecord struct {
 }
 
 // loadFolded folds the journal (latest line per record ID wins) and
-// returns the surviving records in journal append order.
-func (j *economyJournal) loadFolded() []foldedRecord {
+// returns the surviving records in journal append order. A read failure
+// (oversized or unreadable region) is an ERROR, never a silent truncation:
+// callers must not compact or compensate over a partially-read journal,
+// because compaction would permanently erase every record beyond the
+// unreadable point — including owed payouts and outstanding stakes.
+func (j *economyJournal) loadFolded() ([]foldedRecord, error) {
 	f, err := os.Open(j.path)
 	if err != nil {
-		return nil
+		return nil, nil // no journal yet: nothing to fold
 	}
 	defer f.Close()
 	latest := map[string]*foldedRecord{}
@@ -362,16 +421,29 @@ func (j *economyJournal) loadFolded() []foldedRecord {
 			order = append(order, fr)
 		}
 	}
+	if err := scanner.Err(); err != nil {
+		// A scanner error means the fold is INCOMPLETE (a line exceeded the
+		// buffer or the file became unreadable mid-scan). Returning a
+		// partial fold would let compaction erase valid records; surface
+		// the failure instead.
+		return nil, fmt.Errorf("scan economy journal: %w", err)
+	}
 	folded := make([]foldedRecord, 0, len(order))
 	for _, fr := range order {
 		folded = append(folded, *fr)
 	}
-	return folded
+	return folded, nil
 }
 
-// compact rewrites the journal keeping only still-open records.
+// compact rewrites the journal keeping only still-open records. A fold
+// failure aborts the rewrite: compacting over a journal that could not be
+// fully read would silently erase every record beyond the unreadable point.
 func (j *economyJournal) compact() {
-	open := j.loadOpen()
+	open, err := j.loadOpen()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "economy compaction aborted: %v (journal preserved for inspection)\n", err)
+		return
+	}
 	tmp := j.path + ".compact"
 	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
 	if err != nil {
@@ -468,6 +540,27 @@ func (g *Game) applyOpenPayout(p *player.Player, rec *economyRecord) error {
 	return nil
 }
 
+// grantCredits adds credits from ordinary gameplay (shop sales, credit
+// pickups, activity payouts). The economy cap is enforced by clamping: the
+// cap is far above any reachable balance, so hitting it means a data bug —
+// clamp (never wrap) and log loudly for the operator.
+func (g *Game) grantCredits(p *player.Player, amount int) {
+	if amount <= 0 {
+		return
+	}
+	sum, err := addCreditsChecked(p.Credits, amount)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "credit grant for %s clamped at the economy cap: %v\n", p.Name, err)
+		p.Credits = maxCreditsValue
+		return
+	}
+	p.Credits = sum
+}
+
+// maxCreditsValue mirrors casino.MaxCredits; kept local to avoid a
+// dependency cycle (see addCreditsChecked).
+const maxCreditsValue = 1_000_000_000_000
+
 // addCreditsChecked is the game-side checked addition against the economy
 // cap (mirrors casino.MaxCredits; kept local to avoid a dependency cycle).
 func addCreditsChecked(a, b int) (int, error) {
@@ -555,7 +648,14 @@ func (g *Game) recoverEconomy() {
 	if g.Economy == nil {
 		return
 	}
-	folded := g.Economy.loadFolded()
+	folded, err := g.Economy.loadFolded()
+	if err != nil {
+		// The journal could not be fully read. Compensation over a partial
+		// fold could double-pay or erase liabilities, and compaction would
+		// truncate the file. Preserve everything for operator inspection.
+		fmt.Fprintf(os.Stderr, "economy recovery aborted: %v (journal and character files preserved for inspection)\n", err)
+		return
+	}
 	if g.Economy.openPayouts == nil {
 		g.Economy.openPayouts = make(map[string]bool)
 	} else {
@@ -585,12 +685,21 @@ func (g *Game) recoverEconomy() {
 			}
 		}
 	}
-	// finalizeLoaded prunes stale open-payout evidence the first time a
-	// character file is touched: IDs the journal shows as settled or void
-	// cannot prove anything and are dropped (with a durable save) so the
-	// list stays small and meaningful.
+	// finalizeLoaded prunes stale open-payout evidence and resolved-stake
+	// evidence the first time a character file is touched: IDs the journal
+	// shows as settled or void cannot prove anything and are dropped (with
+	// a durable save) so the lists stay small and meaningful.
+	openStakeIDs := make(map[string]bool)
+	for i := range folded {
+		rec := &folded[i].rec
+		if rec.Kind == "wager" && rec.Status == "open" {
+			openStakeIDs[rec.ID] = true
+		}
+	}
 	finalizeLoaded := func(p *player.Player) *player.Player {
-		if pruneOpenPayouts(g.Economy, p) {
+		prunedPayouts := pruneOpenPayouts(g.Economy, p)
+		prunedStakes := pruneResolvedStakes(openStakeIDs, p)
+		if prunedPayouts || prunedStakes {
 			if err := g.AccountStore.SaveCharacter(p); err != nil {
 				fmt.Fprintf(os.Stderr, "economy recovery: evidence prune save %s: %v\n", p.Name, err)
 			}
@@ -830,11 +939,23 @@ func (g *Game) recoverEconomy() {
 	}
 	for k := len(openWagers) - 1; k >= 0; k-- {
 		rec := &folded[openWagers[k]].rec
-		resolvedByPayout, resolvedBySettlement := laterPayoutEvidence(rec, folded[openWagers[k]].seq)
 		p := loadPlayer(rec)
 		if p == nil {
 			continue
 		}
+		// File-side resolution evidence: the session resolved this stake
+		// but its settled marker could not be journaled (e.g. a broken
+		// economy path), so the character file carries the resolution ID.
+		// The round resolved — the stake must not be refunded, and its chip
+		// part must not return in kind on top of a settlement that already
+		// returned it as credits (a refund, by contrast, already gave the
+		// chips back in the file).
+		if resolvedStakeRecorded(p, rec.ID) {
+			g.Economy.settle(rec)
+			compensated++
+			continue
+		}
+		resolvedByPayout, resolvedBySettlement := laterPayoutEvidence(rec, folded[openWagers[k]].seq)
 		// Checkpoint comparisons use the DURABLE state, captured before any
 		// in-memory chip restoration below.
 		creditsNow, chipsNow := p.Credits, countChips(p)
@@ -887,8 +1008,19 @@ func (g *Game) recoverEconomy() {
 			// The debit is durable but the round was lost in the crash:
 			// refund the stake (approved refund-on-recovery policy). The
 			// chips (if owed) are already restored in memory; one durable
-			// save covers both the chip return and the credit refund.
-			p.Credits += rec.Credit
+			// save covers both the chip return and the credit refund. The
+			// credit refund is checked: a record can never push the
+			// balance past the economy cap.
+			sum, capErr := addCreditsChecked(creditsNow, rec.Credit)
+			if capErr != nil {
+				if chipsOwed {
+					p.RemoveItem("chips", rec.Chips)
+				}
+				fmt.Fprintf(os.Stderr, "economy recovery: refund %s for %s blocked (%v) — kept open for operator inspection\n",
+					rec.ID, rec.Player, capErr)
+				continue
+			}
+			p.Credits = sum
 			if err := g.AccountStore.SaveCharacter(p); err != nil {
 				// Revert the in-memory refund so later records for this
 				// player still compare against the durable balance; the
@@ -918,7 +1050,40 @@ func (g *Game) recoverEconomy() {
 		}
 	}
 	g.Economy.compact()
+	// Final evidence prune: the phases above settled or voided records, so
+	// evidence IDs that no longer correspond to an open record are stale
+	// (a settled stake's resolution evidence, an applied payout's entry).
+	// Drop them now so the character files stay small and meaningful; a
+	// failed save only defers the prune to the next startup (finalizeLoaded).
+	stillOpen := make(map[string]bool)
+	for i := range folded {
+		rec := &folded[i].rec
+		if rec.Kind == "wager" && rec.Status == "open" {
+			stillOpen[rec.ID] = true
+		}
+	}
+	pruneSeen := make(map[*player.Player]bool)
+	prunePlayer := func(p *player.Player) {
+		if p == nil || pruneSeen[p] {
+			return
+		}
+		pruneSeen[p] = true
+		if pruneOpenPayouts(g.Economy, p) || pruneResolvedStakes(stillOpen, p) {
+			if err := g.AccountStore.SaveCharacter(p); err != nil {
+				fmt.Fprintf(os.Stderr, "economy recovery: final evidence prune save %s: %v\n", p.Name, err)
+			}
+		}
+	}
+	for _, p := range playersByID {
+		prunePlayer(p)
+	}
+	for _, p := range playersByName {
+		prunePlayer(p)
+	}
 	// Rebuild the outstanding-stake index from whatever open wager records
-	// remain (normally none; ambiguous ones stay refundable/resolvable).
-	g.Economy.reloadStakes()
+	// remain (normally none; ambiguous ones stay refundable/resolvable). A
+	// fold failure leaves the previous index intact and was already logged.
+	if err := g.Economy.reloadStakes(); err != nil {
+		fmt.Fprintf(os.Stderr, "economy recovery: stake index rebuild failed: %v\n", err)
+	}
 }
diff --git a/internal/game/economy_journal_test_helpers_test.go b/internal/game/economy_journal_test_helpers_test.go
new file mode 100644
index 0000000..e65c622
--- /dev/null
+++ b/internal/game/economy_journal_test_helpers_test.go
@@ -0,0 +1,14 @@
+package game
+
+import "testing"
+
+// mustLoadOpen is the test-side loadOpen: a journal fold failure is a test
+// failure, not a nil slice to accidentally treat as "nothing open".
+func (j *economyJournal) mustLoadOpen(t *testing.T) []*economyRecord {
+	t.Helper()
+	open, err := j.loadOpen()
+	if err != nil {
+		t.Fatalf("loadOpen: %v", err)
+	}
+	return open
+}
diff --git a/internal/game/economy_open_payout_list_test.go b/internal/game/economy_open_payout_list_test.go
index 893022f..a16f73b 100644
--- a/internal/game/economy_open_payout_list_test.go
+++ b/internal/game/economy_open_payout_list_test.go
@@ -82,7 +82,7 @@ func TestRecoveryReappliesPayoutWhenUnrelatedCreditsMaskTheBalance(t *testing.T)
 	if loaded.Credits != 130 {
 		t.Fatalf("balance after recovery = %d, want 130 (owed payout re-applied once)", loaded.Credits)
 	}
-	if open := g.Economy.loadOpen(); len(open) != 0 {
+	if open := g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("records left open after recovery: %+v", open)
 	}
 }
@@ -114,7 +114,7 @@ func TestRecoverySettlesDurablePayoutWithoutReapplying(t *testing.T) {
 	if loaded.Credits != 110 {
 		t.Fatalf("balance after recovery = %d, want 110 (durable payout not re-applied)", loaded.Credits)
 	}
-	if open := g.Economy.loadOpen(); len(open) != 0 {
+	if open := g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("records left open after recovery: %+v", open)
 	}
 }
diff --git a/internal/game/economy_recovery_identity_test.go b/internal/game/economy_recovery_identity_test.go
index c2d3d0a..04d6fed 100644
--- a/internal/game/economy_recovery_identity_test.go
+++ b/internal/game/economy_recovery_identity_test.go
@@ -51,7 +51,7 @@ func TestRecoveryDoesNotPayReusedCharacterName(t *testing.T) {
 	if loaded.Credits != 90 {
 		t.Errorf("replacement identity received someone else's payout: credits=%d, want 90", loaded.Credits)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 1 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 1 {
 		t.Errorf("original identity's unresolved liability was discarded: open records=%d", len(open))
 	}
 }
@@ -123,6 +123,6 @@ func TestEconomyRecoveryRunsAfterLifecycleRollback(t *testing.T) {
 	}
 	if loaded.Credits != 110 {
 		t.Errorf("lifecycle rollback erased recovered payout: credits=%d, want 110; open liabilities=%d",
-			loaded.Credits, len(restarted.g.Economy.loadOpen()))
+			loaded.Credits, len(restarted.g.Economy.mustLoadOpen(t)))
 	}
 }
diff --git a/internal/game/economy_recovery_regression_test.go b/internal/game/economy_recovery_regression_test.go
index f9d3b37..207e01d 100644
--- a/internal/game/economy_recovery_regression_test.go
+++ b/internal/game/economy_recovery_regression_test.go
@@ -104,7 +104,7 @@ func TestRecoveryReappliesLostPayoutWithEvidence(t *testing.T) {
 	if loaded.Credits != 110 {
 		t.Fatalf("balance after recovery = %d, want 110 (payout re-applied once, no double stake refund)", loaded.Credits)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("records left open after recovery: %+v", open)
 	}
 }
@@ -166,7 +166,7 @@ func TestRecoveryReappliesIdenticalFailedPayouts(t *testing.T) {
 	if loaded.Credits != 130 {
 		t.Fatalf("balance after recovery = %d, want 130 (both identical failed payouts re-applied)", loaded.Credits)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("records left open after recovery: %+v", open)
 	}
 }
@@ -247,7 +247,7 @@ func TestRecoveryKeepsWagerOpenWhenChipsDoNotFit(t *testing.T) {
 	if got := countChips(loaded); got != 0 {
 		t.Fatalf("chips after recovery = %d, want 0 (no inventory room; nothing delivered)", got)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 1 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 1 {
 		t.Fatalf("chip wager must stay open for operator inspection, open records: %+v", open)
 	}
 }
@@ -287,7 +287,7 @@ func TestRecoveryPreservesAmbiguousPayout(t *testing.T) {
 	if loaded.Credits != 95 {
 		t.Fatalf("ambiguous recovery mutated the balance: %d, want 95", loaded.Credits)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 1 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 1 {
 		t.Fatalf("ambiguous payout must stay open for operator inspection: %+v", open)
 	}
 }
@@ -321,7 +321,7 @@ func TestRecoveryKeepsUnpaidSiblingsOpenAtCreditCap(t *testing.T) {
 	if loaded.Credits != casino.MaxCredits-10 {
 		t.Fatalf("balance after capped recovery = %d, want %d (one payout applied)", loaded.Credits, casino.MaxCredits-10)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 1 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 1 {
 		t.Fatalf("unpaid liability must stay open for operator inspection, open records: %+v", open)
 	}
 }
@@ -364,9 +364,9 @@ func TestRecoveryRestoresChipsFromMixedRefundCrash(t *testing.T) {
 	}
 	if loaded.Credits != 100 || countChips(loaded) != 10 {
 		t.Fatalf("mixed refund after recovery = (%d credits, %d chips), want (100, 10); open records: %+v",
-			loaded.Credits, countChips(loaded), h.g.Economy.loadOpen())
+			loaded.Credits, countChips(loaded), h.g.Economy.mustLoadOpen(t))
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("nothing may stay owed after recovery: %+v", open)
 	}
 }
@@ -429,13 +429,13 @@ func TestRecoveryUnpaidLiabilitySurvivesLaterRecoveries(t *testing.T) {
 			}
 		}
 		h.g.recoverEconomy()
-		if len(h.g.Economy.loadOpen()) != 1 {
-			t.Errorf("setup: expected one unpaid record after capped recovery, got %d", len(h.g.Economy.loadOpen()))
+		if len(h.g.Economy.mustLoadOpen(t)) != 1 {
+			t.Errorf("setup: expected one unpaid record after capped recovery, got %d", len(h.g.Economy.mustLoadOpen(t)))
 			return
 		}
 		// A later startup over the same files: the liability stays owed.
 		h.g.recoverEconomy()
-		if got := len(h.g.Economy.loadOpen()); got != 1 {
+		if got := len(h.g.Economy.mustLoadOpen(t)); got != 1 {
 			t.Errorf("second recovery erased the unpaid 20-credit liability: open=%d, want 1", got)
 		}
 	})
@@ -481,8 +481,8 @@ func TestCapBlockedPayoutIsJournaled(t *testing.T) {
 	// Recovery: the owed win cannot be applied (cap), so the liability
 	// stays open for operator inspection, never erased; the consumed
 	// stake is settled against the payout evidence.
-	if got := len(restarted.g.Economy.loadOpen()); got != 1 {
-		t.Fatalf("owed cap-blocked payout must stay open after recovery, open records: %+v", restarted.g.Economy.loadOpen())
+	if got := len(restarted.g.Economy.mustLoadOpen(t)); got != 1 {
+		t.Fatalf("owed cap-blocked payout must stay open after recovery, open records: %+v", restarted.g.Economy.mustLoadOpen(t))
 	}
 	if loaded.Credits != casino.MaxCredits-10 {
 		t.Fatalf("recovery mutated a capped balance: %d", loaded.Credits)
@@ -523,7 +523,7 @@ func TestRecoveryReappliesPartiallyPaidIdenticalPayouts(t *testing.T) {
 			t.Error(err)
 			return
 		}
-		first := h.g.Economy.loadOpen()[0]
+		first := h.g.Economy.mustLoadOpen(t)[0]
 		if first.ID == second.ID {
 			t.Fatal("setup: expected two distinct records")
 		}
@@ -539,7 +539,7 @@ func TestRecoveryReappliesPartiallyPaidIdenticalPayouts(t *testing.T) {
 		if loaded.Credits != 130 {
 			t.Errorf("recovered balance = %d, want 130 (remaining owed payout re-applied)", loaded.Credits)
 		}
-		if open := h.g.Economy.loadOpen(); len(open) != 0 {
+		if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 			t.Errorf("records left open after recovery: %+v", open)
 		}
 	})
diff --git a/internal/game/economy_shutdown_test.go b/internal/game/economy_shutdown_test.go
index efdd5fd..27190fb 100644
--- a/internal/game/economy_shutdown_test.go
+++ b/internal/game/economy_shutdown_test.go
@@ -146,7 +146,7 @@ func TestEconomyFailedSaveRevertsAndVoids(t *testing.T) {
 	}
 	// The record is void, not open: recovery must not compensate.
 	os.Chmod(charDir, 0700)
-	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("void record remained open: %v", open)
 	}
 }
@@ -182,7 +182,7 @@ func TestEconomyRecoveryRefundsDurableLostWager(t *testing.T) {
 	if loaded.Credits != 100 {
 		t.Fatalf("credits after recovery = %d, want 100 (refund)", loaded.Credits)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("recovered record left open: %v", open)
 	}
 }
@@ -217,7 +217,7 @@ func TestEconomyRecoveryAppliesLostPayout(t *testing.T) {
 	if loaded.Credits != 75 {
 		t.Fatalf("credits after recovery = %d, want 75 (payout re-applied)", loaded.Credits)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("recovered record left open: %v", open)
 	}
 }
diff --git a/internal/game/game.go b/internal/game/game.go
index 096e070..7255042 100644
--- a/internal/game/game.go
+++ b/internal/game/game.go
@@ -291,6 +291,20 @@ func (g *Game) HandleSessionOnOwner(sess *net.Session, input string) {
 	if g.isShuttingDown() {
 		return
 	}
+	// Password work is expensive (Argon2id, ~64 MiB and tens of
+	// milliseconds per call) and must never run on the owner goroutine:
+	// the owner serializes every command and tick, so a burst of logins
+	// would stall the whole world. Verify/hash on the caller's connection
+	// goroutine, then submit one owner task for the (cheap) state
+	// transition.
+	switch sess.State {
+	case net.StatePassword:
+		g.handlePasswordOffOwner(sess, input)
+		return
+	case net.StateNewAccount:
+		g.handleNewAccountOffOwner(sess, input)
+		return
+	}
 	g.RunOnOwner(func() {
 		// Re-checked at task execution: the flag may flip between
 		// submission and execution, and RunOnOwner must never fall back
diff --git a/internal/game/hacking/wumpus.go b/internal/game/hacking/wumpus.go
index 1f0a434..1d4b371 100644
--- a/internal/game/hacking/wumpus.go
+++ b/internal/game/hacking/wumpus.go
@@ -200,9 +200,12 @@ func (w *WumpusGame) checkRoom() (string, bool, bool) {
 		if cur == i {
 			sb.WriteString("ICE detected! You're relocated to a random node...\n")
 			w.player = rand.Intn(20)
-			chained, _, _ := w.checkRoom()
+			// The chained check can terminate the game (landing on the
+			// rogue AI or a data trap): propagate its result instead of
+			// discarding the terminal state.
+			chained, done, won := w.checkRoom()
 			sb.WriteString(chained)
-			return sb.String(), false, false
+			return sb.String(), done, won
 		}
 	}
 	sb.WriteString(w.roomDesc())
diff --git a/internal/game/hacking/wumpus_regression_test.go b/internal/game/hacking/wumpus_regression_test.go
new file mode 100644
index 0000000..b27a7f9
--- /dev/null
+++ b/internal/game/hacking/wumpus_regression_test.go
@@ -0,0 +1,20 @@
+package hacking
+
+import "testing"
+
+// A teleport into a terminal hazard (rogue AI or data trap) must end the
+// hacking session: the chained room check's terminal result is propagated
+// instead of discarded.
+func TestICETeleportTerminalResultIsPropagated(t *testing.T) {
+	for i := 0; i < 2000; i++ {
+		w := &WumpusGame{player: 0, wumpus: 19, pits: [2]int{2, 3}, ice: [2]int{1, 4}, probes: 5}
+		text, done, won := w.HandleInput("move 2")
+		if w.gameOver {
+			if !done || won != w.won {
+				t.Fatalf("terminal state not propagated: done=%v won=%v internal gameOver=%v; output=%s", done, won, w.gameOver, text)
+			}
+			return
+		}
+	}
+	t.Fatal("probe never encountered a terminal teleport")
+}
diff --git a/internal/game/journal_failure_regression_test.go b/internal/game/journal_failure_regression_test.go
new file mode 100644
index 0000000..683b996
--- /dev/null
+++ b/internal/game/journal_failure_regression_test.go
@@ -0,0 +1,228 @@
+package game
+
+// Journal-failure regressions: a broken economy journal (persistent append
+// failure) must never lose money silently. Settlements pay through the
+// character file, stake resolutions are recorded as file evidence, and an
+// unreadable journal aborts recovery/compaction instead of erasing records.
+
+import (
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"thehouseoficarus/internal/casino"
+	"thehouseoficarus/internal/player"
+)
+
+// failJournalDuring redirects the economy journal path for the duration of
+// fn, simulating a persistent append failure, and restores it afterwards.
+func failJournalDuring(h *harness, fn func()) {
+	path := h.g.Economy.path
+	h.g.Economy.path = h.dir
+	defer func() { h.g.Economy.path = path }()
+	fn()
+}
+
+// TestSettlementFallbackKeepsWholeBalance: a full table round whose payout
+// journal append fails still ends with the player whole — the settlement is
+// paid through the character file, the stake resolution is recorded as
+// evidence, and recovery leaves the balance exact.
+func TestSettlementFallbackKeepsWholeBalance(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice")
+	p := h.seedCharacter("alice", "alice")
+	h.g.RunOnOwner(func() {
+		p.Credits = 1000
+		h.g.Casino.Join(1, casino.TableConfig{ID: "b", Game: casino.GameBaccarat}, "alice")
+		var totalPaid int
+		failed := false
+		w := casinoWallet{g: h.g, p: p}
+		// Wrap the wallet so exactly one settlement hits a broken journal.
+		wallet := &fallbackProbeWallet{harness: h, inner: w, onPay: func(credits int, failedCall bool) {
+			totalPaid += credits
+			if failedCall {
+				failed = true
+			}
+		}}
+		rounds := 0
+		for rounds < 100 && !failed {
+			rounds++
+			h.g.Casino.Bet(1, "b", "alice", "player", 10, wallet)
+		}
+		if !failed {
+			t.Fatal("probe never observed a settlement payout")
+			return
+		}
+		// One more full round after the failure: the table keeps working.
+		rounds++
+		h.g.Casino.Bet(1, "b", "alice", "player", 10, wallet)
+		h.g.recoverEconomy()
+		loaded, err := h.g.AccountStore.LoadCharacter("alice")
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		want := 1000 - 10*rounds + totalPaid
+		if loaded.Credits != want {
+			t.Errorf("balance after journal-failure round: credits=%d, want %d (wagers %d, paid %d)",
+				loaded.Credits, want, 10*rounds, totalPaid)
+		}
+		if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
+			t.Errorf("records left open: %+v", open)
+		}
+	})
+}
+
+// fallbackProbeWallet routes PayCredits through the real wallet once with a
+// broken journal (the first settlement), then normally.
+type fallbackProbeWallet struct {
+	harness *harness
+	inner   casinoWallet
+	onPay   func(credits int, failedCall bool)
+	broke   bool
+}
+
+func (w *fallbackProbeWallet) Wager(amount int) (casino.Wager, error) { return w.inner.Wager(amount) }
+
+func (w *fallbackProbeWallet) PayCredits(amount int) error {
+	if w.broke {
+		w.onPay(amount, false)
+		return w.inner.PayCredits(amount)
+	}
+	w.broke = true
+	w.onPay(amount, true)
+	failJournalDuring(w.harness, func() {
+		_ = w.inner.PayCredits(amount)
+	})
+	return nil
+}
+
+func (w *fallbackProbeWallet) ResolveStakes() { w.inner.ResolveStakes() }
+func (w *fallbackProbeWallet) RefundOutstanding() (int, int, error) {
+	return w.inner.RefundOutstanding()
+}
+
+// TestChipStakeSettlementFallbackNoDoublePay: a chip-funded stake whose win
+// is paid through the character-file fallback must not ALSO get its chips
+// returned in kind by recovery — the settlement returned the stake as
+// credits inside the payout.
+func TestChipStakeSettlementFallbackNoDoublePay(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice")
+	p := h.seedCharacter("alice", "alice")
+	h.g.RunOnOwner(func() {
+		p.Credits = 100
+		p.SetInvSlot(0, &player.InventorySlot{ItemID: "chips", Quantity: 10})
+		w := casinoWallet{g: h.g, p: p}
+		if _, err := w.Wager(10); err != nil {
+			t.Error(err)
+			return
+		}
+		// The journal is broken for BOTH the settlement and the resolution:
+		// the win lands in the character file, the resolution in evidence.
+		failJournalDuring(h, func() {
+			if err := w.PayCredits(20); err != nil {
+				t.Errorf("fallback settlement failed: %v", err)
+				return
+			}
+			w.ResolveStakes()
+		})
+		h.g.recoverEconomy()
+		loaded, err := h.g.AccountStore.LoadCharacter("alice")
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		if loaded.Credits != 120 || countChips(loaded) != 0 {
+			t.Errorf("after recovery: %d credits / %d chips, want 120 / 0 (chip stake debited, win of 20 paid once in credits; no in-kind chip return on top)",
+				loaded.Credits, countChips(loaded))
+		}
+		if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
+			t.Errorf("open records: %+v", open)
+		}
+	})
+}
+
+// TestCorruptJournalAbortsRecoveryWithoutErasure: an unreadable journal
+// region must abort compensation and compaction — the owed payout record
+// beyond the corruption stays in the file for operator inspection instead
+// of being compacted away.
+func TestCorruptJournalAbortsRecoveryWithoutErasure(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice")
+	p := h.seedCharacter("alice", "alice")
+	h.g.RunOnOwner(func() {
+		p.Credits = 100
+		if err := h.g.AccountStore.SaveCharacter(p); err != nil {
+			t.Error(err)
+			return
+		}
+		// Corrupt the journal with an oversized line, then journal an owed
+		// payout BEYOND it (as appends would after the corruption).
+		f, err := os.OpenFile(h.g.Economy.path, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		_, werr := f.WriteString(strings.Repeat("x", 1024*1024+1) + "\n")
+		f.Close()
+		if werr != nil {
+			t.Error(werr)
+			return
+		}
+		if _, err := h.g.Economy.start("payout", p, 0, 20, 100, 120, 0, 0); err != nil {
+			t.Errorf("payout could not be journaled: %v", err)
+			return
+		}
+		h.g.recoverEconomy()
+		// The owed payout record is preserved verbatim: no compensation ran
+		// (credits unchanged) and no compaction erased the record.
+		loaded, err := h.g.AccountStore.LoadCharacter("alice")
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		data, err := os.ReadFile(h.g.Economy.path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if loaded.Credits != 100 {
+			t.Errorf("aborted recovery paid the payout: credits=%d, want 100 (preserved for inspection)", loaded.Credits)
+		}
+		if !strings.Contains(string(data), `"kind":"payout"`) {
+			t.Error("corrupt journal recovery erased the owed payout record instead of preserving it")
+		}
+	})
+}
+
+// TestBankWithdrawalHonorsCreditCap: a withdrawal that would push the
+// on-hand balance past the shared economy cap is rejected; neither balance
+// changes.
+func TestBankWithdrawalHonorsCreditCap(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice")
+	p := h.seedCharacter("alice", "alice")
+	p.Credits = casino.MaxCredits
+	p.BankedCredits = 10
+	if err := h.g.AccountStore.SaveCharacter(p); err != nil {
+		t.Fatal(err)
+	}
+	sess, conn := h.connect("alice")
+	h.g.RunOnOwner(func() {
+		h.g.doBankWithdrawCredits(sess, []string{"withdraw", "credits", "10"})
+	})
+	if sess.Player.Credits != casino.MaxCredits || sess.Player.BankedCredits != 10 {
+		t.Errorf("rejected withdrawal changed balances: credits=%d banked=%d",
+			sess.Player.Credits, sess.Player.BankedCredits)
+	}
+	// The session writer goroutine flushes asynchronously; wait for the
+	// rejection to arrive instead of racing it.
+	deadline := time.Now().Add(2 * time.Second)
+	for !conn.Contains("cannot hold") && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if !conn.Contains("cannot hold") {
+		t.Errorf("withdrawal rejection not reported; output=%s", conn.Bytes())
+	}
+}
diff --git a/internal/game/login_offowner_regression_test.go b/internal/game/login_offowner_regression_test.go
new file mode 100644
index 0000000..327de7e
--- /dev/null
+++ b/internal/game/login_offowner_regression_test.go
@@ -0,0 +1,122 @@
+package game
+
+// Login regressions for the off-owner password path: the production entry
+// point verifies passwords and hashes new-account passwords on the
+// connection goroutine (never the owner), then completes the state
+// transition on the owner. The observable login behavior is unchanged.
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"strings"
+	"testing"
+	"time"
+
+	"thehouseoficarus/internal/net"
+	"thehouseoficarus/internal/player"
+)
+
+// waitForOutput polls the queued session writer until substr appears or the
+// deadline passes.
+func waitForOutput(t *testing.T, conn *chanConn, substr string) {
+	t.Helper()
+	deadline := time.Now().Add(3 * time.Second)
+	for !conn.Contains(substr) && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if !conn.Contains(substr) {
+		t.Fatalf("output %q never arrived; got:\n%s", substr, conn.Bytes())
+	}
+}
+
+// TestLoginThroughServerEntryUsesOffOwnerPathAndUpgradesLegacyHash drives
+// the real server entry point (HandleSessionOnOwner) through: legacy-hash
+// account creation, a WRONG password attempt, and a correct login that
+// rehashes the legacy SHA-256 hash to Argon2id durably.
+func TestLoginThroughServerEntryUsesOffOwnerPathAndUpgradesLegacyHash(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice")
+	h.seedCharacter("alice", "alice")
+	acc, err := h.g.AccountStore.LoadAccount("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Downgrade to a legacy salted SHA-256 hash so the login exercises the
+	// transparent rehash.
+	salt := []byte("0123456789abcdef")
+	sum := sha256.Sum256(append(append([]byte{}, salt...), []byte("pw")...))
+	acc.PasswordHash = "sha256:" + base64.RawStdEncoding.EncodeToString(salt) + ":" + strings.ToLower(sha256HashHex(sum))
+	if err := h.g.AccountStore.SaveAccount(acc); err != nil {
+		t.Fatal(err)
+	}
+
+	conn := newChanConn()
+	sess := &net.Session{Conn: conn, State: net.StateAccountName}
+	sess.StartWriter()
+	lines := make(chan string, 8)
+	go h.input(sess, lines)
+
+	lines <- "alice"   // existing account → password prompt (echo off)
+	lines <- "wrongpw" // rejected, echo restored, back to account name
+	waitForOutput(t, conn, "Wrong password.")
+	lines <- "alice" // account name again
+	lines <- "pw"    // correct password through the off-owner path
+	waitForOutput(t, conn, "Welcome back to Vesta, alice.")
+
+	if sess.Account == nil || sess.Account.Name != "alice" || len(sess.Account.Characters) != 1 {
+		t.Fatalf("login did not complete: %+v", sess.Account)
+	}
+	upgraded, err := h.g.AccountStore.LoadAccount("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasPrefix(upgraded.PasswordHash, "argon2id:") {
+		t.Errorf("legacy hash not upgraded on login: %s", upgraded.PasswordHash[:12])
+	}
+	if !player.CheckPassword("pw", upgraded.PasswordHash) {
+		t.Error("upgraded hash no longer verifies the password")
+	}
+}
+
+// TestNewAccountThroughServerEntryHashesOffOwner drives account creation
+// through the real server entry point.
+func TestNewAccountThroughServerEntryHashesOffOwner(t *testing.T) {
+	h := newHarness(t)
+	conn := newChanConn()
+	sess := &net.Session{Conn: conn, State: net.StateAccountName}
+	sess.StartWriter()
+	lines := make(chan string, 8)
+	go h.input(sess, lines)
+
+	lines <- "newbie" // unknown name → new-account password prompt
+	lines <- "hunter2pass"
+	lines <- "hunter2pw" // mismatch → restart account entry (Account reset)
+	waitForOutput(t, conn, "Passwords do not match.")
+	lines <- "newbie" // account name again
+	lines <- "hunter2pw"
+	lines <- "hunter2pw"
+	lines <- "n" // color prompt
+	waitForOutput(t, conn, "Welcome back to Vesta, newbie.")
+
+	created, err := h.g.AccountStore.LoadAccount("newbie")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasPrefix(created.PasswordHash, "argon2id:") {
+		t.Errorf("created account did not hash with Argon2id: %s", created.PasswordHash[:12])
+	}
+	if !player.CheckPassword("hunter2pw", created.PasswordHash) {
+		t.Error("created hash does not verify the password")
+	}
+}
+
+// sha256HashHex formats like hex.EncodeToString for the legacy hash check.
+func sha256HashHex(sum [32]byte) string {
+	const hexdigits = "0123456789abcdef"
+	out := make([]byte, 64)
+	for i, b := range sum {
+		out[i*2] = hexdigits[b>>4]
+		out[i*2+1] = hexdigits[b&0x0f]
+	}
+	return string(out)
+}
diff --git a/internal/game/readiness_regression_test.go b/internal/game/readiness_regression_test.go
index 7fa2b2e..3d21390 100644
--- a/internal/game/readiness_regression_test.go
+++ b/internal/game/readiness_regression_test.go
@@ -196,17 +196,19 @@ func TestRecoverySaveFailureRetriesOnNextStartup(t *testing.T) {
 			return
 		}
 		if loaded.Credits != 110 {
-			t.Errorf("after fixing the disk and retrying: %d credits, want 110; open=%+v", loaded.Credits, h.g.Economy.loadOpen())
+			t.Errorf("after fixing the disk and retrying: %d credits, want 110; open=%+v", loaded.Credits, h.g.Economy.mustLoadOpen(t))
 		}
 	})
 }
 
-// TestLostResolutionMarkerSurfacesAndRefunds: a resolution marker that
-// cannot be journaled (persistent append failure) leaves the stake OPEN —
-// never silently forgotten — and recovery then applies the documented
-// refund-on-lost-state policy (the player is never the loser of a lost
-// marker).
-func TestLostResolutionMarkerSurfacesAndRefunds(t *testing.T) {
+// TestResolvedStakeEvidenceSurvivesJournalFailure: a resolution marker
+// that cannot be journaled (persistent append failure) leaves the stake
+// OPEN — never silently forgotten — and records the resolution in the
+// character file as durable evidence. Recovery then settles the stake
+// WITHOUT refunding it: the round genuinely resolved, and the file is the
+// proof. When the file save also fails, no evidence exists and recovery
+// applies the documented refund-on-lost-state policy instead.
+func TestResolvedStakeEvidenceSurvivesJournalFailure(t *testing.T) {
 	h := newHarness(t)
 	h.seedAccount("alice")
 	p := h.seedCharacter("alice", "alice")
@@ -224,28 +226,40 @@ func TestLostResolutionMarkerSurfacesAndRefunds(t *testing.T) {
 		if open := h.g.Economy.openStakes(economyKey(p)); len(open) != 1 {
 			t.Errorf("unresolvable stake was silently dropped: open=%d", len(open))
 		}
-		h.g.recoverEconomy()
+		// The resolution is recorded durably in the character file.
 		loaded, err := h.g.AccountStore.LoadCharacter("alice")
 		if err != nil {
 			t.Error(err)
 			return
 		}
-		if loaded.Credits != 100 {
-			t.Errorf("after recovery: credits=%d, want 100 (stake refunded; marker lost)", loaded.Credits)
+		if len(loaded.ResolvedStakes) != 1 {
+			t.Errorf("resolved-stake evidence not recorded: %+v", loaded.ResolvedStakes)
+			return
+		}
+		h.g.recoverEconomy()
+		loaded, err = h.g.AccountStore.LoadCharacter("alice")
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		if loaded.Credits != 90 {
+			t.Errorf("after recovery: credits=%d, want 90 (round resolved; evidence prevents a refund)", loaded.Credits)
 		}
-		if open := h.g.Economy.loadOpen(); len(open) != 0 {
+		if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 			t.Errorf("records left open after recovery: %+v", open)
 		}
+		if len(loaded.ResolvedStakes) != 0 {
+			t.Errorf("stale resolved-stake evidence not pruned: %+v", loaded.ResolvedStakes)
+		}
 	})
 }
 
-// TestUnjournalablePayoutRefundsStake: a payout that cannot even be
-// journaled (persistent append failure) is not announced as paid, the
-// balance is unchanged, and recovery applies the documented fallback: the
-// stake is refunded. The unrecorded win beyond the stake cannot be
-// protected, but the player never loses money and no win is announced that
-// is not durable.
-func TestUnjournalablePayoutRefundsStake(t *testing.T) {
+// TestUnjournalablePayoutPaidThroughCharacterFile: a payout that cannot be
+// journaled (persistent append failure) is still made durable through the
+// character file — the save is the commit point, so the win is real and
+// announced. The resolved stake is recorded as file evidence so recovery
+// neither refunds the stake (double pay) nor drops the round.
+func TestUnjournalablePayoutPaidThroughCharacterFile(t *testing.T) {
 	h := newHarness(t)
 	h.seedAccount("alice")
 	p := h.seedCharacter("alice", "alice")
@@ -260,23 +274,25 @@ func TestUnjournalablePayoutRefundsStake(t *testing.T) {
 		h.g.Economy.path = h.dir
 		err := w.PayCredits(20)
 		h.g.Economy.path = path
-		if err == nil {
-			t.Error("injected write failure did not fail")
+		if err != nil {
+			t.Errorf("character-file fallback failed: %v", err)
 			return
 		}
-		if p.Credits != 90 {
-			t.Errorf("failed payout mutated the balance: %d", p.Credits)
+		if p.Credits != 110 {
+			t.Errorf("fallback payout did not land: credits=%d, want 110", p.Credits)
 		}
+		// As the games do after a successful settlement: resolve the stake.
+		w.ResolveStakes()
 		h.g.recoverEconomy()
 		loaded, err := h.g.AccountStore.LoadCharacter("alice")
 		if err != nil {
 			t.Error(err)
 			return
 		}
-		if loaded.Credits != 100 {
-			t.Errorf("stake refund after unjournalable payout: credits=%d, want 100", loaded.Credits)
+		if loaded.Credits != 110 {
+			t.Errorf("after recovery: credits=%d, want 110 (win durable once; no stake refund on top)", loaded.Credits)
 		}
-		if open := h.g.Economy.loadOpen(); len(open) != 0 {
+		if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 			t.Errorf("open records: %+v", open)
 		}
 	})
diff --git a/internal/player/password.go b/internal/player/password.go
index f8ce3cc..9be39fb 100644
--- a/internal/player/password.go
+++ b/internal/player/password.go
@@ -31,13 +31,31 @@ const (
 	argonSaltLen = 16
 )
 
+// hashLimiter bounds concurrent Argon2id computations. Each hash costs
+// ~64 MiB and tens of milliseconds, so an unbounded burst of logins (or
+// login attempts) would spike memory and CPU in parallel. Password work
+// runs on connection/HTTP goroutines (never the game owner); this only
+// caps how many run at once. Callers acquire per computation, never
+// nested, so the limited channel cannot deadlock.
+var hashLimiter = make(chan struct{}, 4)
+
+func acquireHashSlot() {
+	hashLimiter <- struct{}{}
+}
+
+func releaseHashSlot() {
+	<-hashLimiter
+}
+
 // HashPassword derives an Argon2id password hash.
 func HashPassword(password string) (string, error) {
 	salt := make([]byte, argonSaltLen)
 	if _, err := rand.Read(salt); err != nil {
 		return "", err
 	}
+	acquireHashSlot()
 	key := argon2.IDKey([]byte(password), salt, argonTime, argonMemory, argonThreads, argonKeyLen)
+	releaseHashSlot()
 	return fmt.Sprintf("argon2id:%d:%d:%d:%s:%s",
 		argonTime, argonMemory, argonThreads,
 		base64.RawStdEncoding.EncodeToString(salt), hex.EncodeToString(key)), nil
@@ -63,7 +81,9 @@ func CheckPassword(password, stored string) bool {
 		if errT != nil || errM != nil || errP != nil || errSalt != nil || errKey != nil {
 			return false
 		}
+		acquireHashSlot()
 		key := argon2.IDKey([]byte(password), salt, uint32(t), uint32(m), uint8(p), uint32(len(expected)))
+		releaseHashSlot()
 		return subtle.ConstantTimeCompare(key, expected) == 1
 	case "sha256":
 		legacy := strings.SplitN(stored, ":", 3)
diff --git a/internal/player/player.go b/internal/player/player.go
index 708588c..0a48b04 100644
--- a/internal/player/player.go
+++ b/internal/player/player.go
@@ -176,7 +176,15 @@ type Player struct {
 	// amounts are ALREADY INCLUDED in this file's credit balance. Recovery
 	// uses membership to prove a payout became durable instead of guessing
 	// from balance checkpoints, which unrelated credit changes can fake.
-	OpenPayouts            []string         `yaml:"open_payouts,omitempty"`
+	OpenPayouts []string `yaml:"open_payouts,omitempty"`
+	// ResolvedStakes is durable evidence for the economy journal (see
+	// internal/game/economy.go): the IDs of outstanding wager records the
+	// session RESOLVED (won, lost, pushed, refunded) but whose settled
+	// markers could not be appended to the journal (e.g. a broken economy
+	// path). Recovery treats membership as proof the round resolved — the
+	// stake must not be refunded and its chip part must not return in kind
+	// on top of a settlement that already returned it as credits.
+	ResolvedStakes         []string         `yaml:"resolved_stakes,omitempty"`
 	Description            string           `yaml:"description"`
 	AttackStyle            AttackStyle      `yaml:"attack_style"`
 	Prompt                 string           `yaml:"prompt"`