feat: sym-link containment, batch count prompt for crafting

1 files changed, 10 insertions, 5 deletions

diff --git a/FIXES.md b/FIXES.md
index b4c9198..45e0fab 100644
--- a/FIXES.md
+++ b/FIXES.md
@@ -100,16 +100,21 @@ Nothing was staged or committed. The audit artifacts (`AUDIT.md`, `reports/`) ar
 - **Validation**: craft `type`/`subtype` is checked against `item.KnownCraftKeys` — an unknown key left the action set but never advancing (player stuck). Test: `TestValidateCraftBlocksRejectsUnknownType`.
 - **Validation**: the mob/safespot size vocabulary moved to `object.MobSizeRank`; `validateObjects` rejects an unknown `safespot.max_block_size` (silently disables cover) and out-of-range chances, and `validateMobCombatStats` rejects an unknown mob `size`. Test: `TestValidateObjectsRejectsUnknownSafespotSize`.
 
+## Tranche 7 (this pass)
+
+- **Security**: `resolveDataPath` now resolves symlinks on the longest existing prefix and re-checks containment, so a symlink inside `data/` cannot redirect a raw-editor read or write outside the data directory. Test: `TestResolveDataPathRejectsSymlinkEscape`.
+- **UX**: the production "how many" prompt now says "How many batches (each makes N, return for all)?" so a batch count cannot silently mean N× the materials/units.
+- **Test coverage**: added `TestGatherYieldsDrop`, an end-to-end gather test (seed object + pickaxe, start the action, tick to a drop) — the first coverage for the gather system the audit flagged.
+- **Investigated (no change)**: the craps Fire bet. Settling it at the 4th/5th point as the audit suggested would cap the payout at the lower tier and under-pay; the bet must ride to the seven-out to pay the highest tier reached. Left as-is and noted here.
+
 ## Still open
 
 - **Explicit undo snapshot-existence flag** (the current fix safely refuses an intentionally empty before-image).
-- **Production "how many" batches vs units**.
 - **Persistence** `Recover` mid-game misuse.
-- **Casino**: craps Fire/ATS settlement deferral.
-- **Admin**: symlink handling in the raw file API.
+- **Casino**: craps Fire bet forfeiture on disconnect (design decision; shutdown refunds).
 - **Structural refactors** remaining from `AUDIT.md` §3–4 (`ui.Table` shrink consolidation, `tableCore` for pai gow, `refs` struct in validate, `remapInt`/`remapScalar`).
-- **Test infrastructure**: CI wiring for `test-race`, a master-tick harness option, and coverage for steal/gather/burn/talk.
+- **Test infrastructure**: CI wiring for `test-race`, a master-tick harness option, and coverage for steal/burn/talk.
 
 ## Suggested next step
 
-Tranche 7: the remaining structural refactors (`ui.Table`, `tableCore` for pai gow, `refs` struct, `remapInt`/`remapScalar`) and the test-infrastructure work. Keep `make lint`, `go test ./...`, and `go test -race` green.
+Tranche 8: the remaining structural refactors and the steal/burn/talk test coverage. Keep `make lint`, `go test ./...`, and `go test -race` green.