fix: admin undo/redo failure, video poker cabinet ids, room ref behavior

1 files changed, 17 insertions, 8 deletions

diff --git a/FIXES.md b/FIXES.md
index 80dc7ae..d40ed3d 100644
--- a/FIXES.md
+++ b/FIXES.md
@@ -57,7 +57,7 @@ Nothing was staged or committed. The audit artifacts (`AUDIT.md`, `reports/`) ar
 ### Tooling
 31. **`make lint` gate restored** — fixed the 15 reported issues (error-string casing, doc-comment form, unused params, ineffassign) without weakening `.golangci.yml`.
 
-## Tranche 2 (this pass)
+## Tranche 2
 
 - **Security**: `restoreAccountSecret` no longer fails open on a non-mapping body (the admin raw editor can no longer blank `password_hash`); `validEntityID` rejects control characters and leading dots.
 - **Info disclosure**: video-poker bank/wager errors are mapped instead of printing raw `os`/YAML errors and server paths.
@@ -69,18 +69,27 @@ Nothing was staged or committed. The audit artifacts (`AUDIT.md`, `reports/`) ar
 - **Net**: `Conn` now requires `SetReadDeadline`, so every transport gets an idle read deadline (removed the concrete-type switch); hub room buckets are pruned and `RekeyRooms` merges instead of clobbering.
 - Tests added: `TestRestoreAccountSecretRefusesNonMappingBody`, `TestWalkYAMLDirIncludesYml`, `TestValidateTalkConfigRequiresStartNode`, `TestPickupCreditsHonorsRequestedQuantity`, `TestMachineLeavePaysBankedFeature`, `TestCrapsShooterChangeResetsHand`.
 
+## Tranche 3 (this pass)
+
+- **Undo**: a failed undo/redo is now reported distinctly from an empty history (`UndoStack.LastError()`), so the admin UI no longer shows "Nothing to undo" for a real failure. Test: `TestUndoFailureIsReportedDistinctly`.
+- **Quit**: `quit`/`logout` are `ClassInstant`, so a queued active command can no longer silently replace or delay a quit.
+- **World**: a reference-style room object entry (`id:` only) that carries behavior fields is rejected at load instead of silently dropping the behavior. Test: `TestRoomObjectReferenceRejectsBehaviorFields`.
+- **Validation**: gather drops with `weight <= 0` (never selectable) are warned about. Test: `TestValidateGatherWarnsOnWeightlessDrop`.
+- **Admin**: trigger POST now serializes through `triggerMapToYAML` like PUT (no unknown-key divergence); `resolve-duplicate` verifies the path is genuinely a duplicate-ID room file before deleting/renaming it.
+- **Net**: the shutdown flush gives each session a bounded slice instead of letting the first stalled writer starve the rest; the telnet echo CRLF refreshes its write deadline so it is not dropped on an idle connection.
+- **Casino**: video-poker cabinet IDs are claimed in the addressable namespace, so an ID colliding with a machine variant/game name is rejected instead of producing an unreachable cabinet. Test: `TestVideoPokerCabinetIDCollisionIsRejected`.
+
 ## Still open
 
-- **Undo failure reporting** (`Undo()`/`Redo()` still return nil on failure → "Nothing to undo") and an explicit snapshot-existence flag.
-- **`quit` queue/busy interaction**; **"how many" batches vs units**; **production `FirstCraft()` vs multi-recipe availability**.
-- **Room object reference entries silently drop behavior fields**; **craft `type`/`subtype` validator rule**; **safespot validation**; **drop weight validation**.
+- **Explicit undo snapshot-existence flag** (the current fix safely refuses an intentionally empty before-image).
+- **Production `FirstCraft()` vs multi-recipe availability** (5 of 6 `arrow_shaft` recipes unreachable); **"how many" batches vs units**.
+- **Craft `type`/`subtype` validator rule**; **safespot validation** (needs the size vocabulary moved to a shared package); **drop weight in mob loot/steal readers**.
 - **Persistence** `Recover` mid-game misuse; journal versioning.
-- **Casino**: craps Fire/ATS deferral, plinko RTP wording, video-poker cabinet ID collisions.
-- **Admin**: trigger POST/PUT divergence, `resolve-duplicate` precondition, symlink handling.
-- **Net**: telnet echo CRLF deadline, shutdown flush starvation.
+- **Casino**: craps Fire/ATS settlement deferral; plinko RTP wording.
+- **Admin**: symlink handling in the raw file API.
 - **Structural refactors** from `AUDIT.md` §3–4.
 - **Test infrastructure**: `make test-race`/CI, harness owner-goroutine leak, master-tick harness option, and coverage for steal/gather/burn/talk and the WebSocket transport.
 
 ## Suggested next step
 
-Tranche 3: the remaining admin/persistence/casino P2s above, then the structural refactors. Keep `make lint`, `go test ./...`, and `go test -race` green.
+Tranche 4: the production multi-recipe fix, the remaining validation gaps, the persistence hardening, and then the structural refactors. Keep `make lint`, `go test ./...`, and `go test -race` green.