fix: exact casino settlement/refund coverage, journal damage handling, craft output ordering, aggregate ingredient planning

1 files changed, 21 insertions, 8 deletions

diff --git a/building_guide/concurrency.md b/building_guide/concurrency.md
index 2fa4558..a30e1a6 100644
--- a/building_guide/concurrency.md
+++ b/building_guide/concurrency.md
@@ -124,9 +124,15 @@ Two record kinds exist:
 - **wager** — a committed stake. The record stays OPEN while the stake is
   outstanding (round in flight) and is resolved when the round settles:
   won, lost, pushed, forfeited (disconnect), or refunded (shutdown). Games
-  resolve stakes through `casino.Wallet.ResolveStakes` after settlement;
-  `casino.Wallet.RefundOutstanding` returns every outstanding stake
-  (chips as chips, credits durably) at shutdown/eviction, exactly once.
+  resolve stakes through `casino.Wallet.ResolveStakes` after settlement
+  (or per hand via `ResolveStake`); `casino.Wallet.RefundOutstanding`
+  returns every outstanding stake (chips as chips, credits durably) at
+  shutdown/eviction, exactly once. A stake already covered by an open
+  settlement payout is resolved WITHOUT a refund: a table settlement
+  includes its hand's stake return and a slots payout proves the round
+  resolved, so refunding would double-pay the round — recovery re-applies
+  the owed payout instead, and the covered stakes receive their money
+  through it.
 - **payout** — money movement (winnings, pushes, refunds). The record
   closes when the balance mutation is durable.
 
@@ -152,10 +158,12 @@ wallet degrades safely:
   chip stake is not returned in kind on top of credits that already
   returned it). If the character save fails too, no evidence exists and
   the open wager record drives the ordinary refund-on-lost-state recovery.
-- A journal that cannot be fully READ (oversized or unreadable line)
-  aborts recovery and compaction entirely: records are preserved verbatim
-  for operator inspection instead of compensating over a partial fold or
-  truncating the file.
+- A journal that cannot be fully READ (oversized or unreadable line) or
+  that contains a malformed record with later records present aborts
+  recovery and compaction entirely: records are preserved verbatim for
+  operator inspection instead of compensating over a partial fold or
+  truncating the file. A torn FINAL line (crash mid-append) is still
+  tolerated and skipped.
 
 At startup (`game.New`), open records are compensated in two phases:
 
@@ -171,7 +179,12 @@ At startup (`game.New`), open records are compensated in two phases:
    lost in the crash) — unless a later payout record proves the round
    resolved (the win/push/refund already returned the stake inside that
    payout), in which case only the lost resolution marker is re-applied.
-   Ambiguous records stay open for operator inspection.
+   Settlement payouts may carry an explicit `covers` list naming the stake
+   IDs they return (a table hand's payout): recovery then resolves
+   exactly those stakes. A payout without a list (legacy records, slots
+   winnings) resolves every open stake of its player — a journaled
+   settlement means the round resolved, and its re-application delivers
+   the money. Ambiguous records stay open for operator inspection.
 
 Currency arithmetic is checked (`internal/casino/credits.go`): explicit
 `MaxCredits` cap, bounded `DefaultMaxBet` default (the explicit unlimited