fix: harden economy recovery, shutdown concurrency, world validation, and inventory-loss paths

1 files changed, 9 insertions, 3 deletions

diff --git a/internal/admin/api_rooms_bulk_delete.go b/internal/admin/api_rooms_bulk_delete.go
index 5b525f6..6017eed 100644
--- a/internal/admin/api_rooms_bulk_delete.go
+++ b/internal/admin/api_rooms_bulk_delete.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"os"
 
+	"thehouseoficarus/internal/persistence"
 	"thehouseoficarus/internal/world"
 )
 
@@ -74,13 +75,14 @@ func (s *AdminServer) handleBulkDelete(w http.ResponseWriter, r *http.Request) {
 
 	deletedSet := make(map[int]bool, len(req.IDs))
 	for _, snap := range snapshots {
-		s.detachRoomFromCourse(snap.id)
 		if err := os.Remove(snap.path); err != nil {
 			// All-or-nothing: restore every room deleted so far so a failed
-			// bulk delete never strands rooms without an undo record.
+			// bulk delete never strands rooms without an undo record. Course
+			// detaches are deferred until every file is gone, so a failed
+			// delete cannot leave course references already rewritten.
 			for _, done := range snapshots {
 				if deletedSet[done.id] {
-					if werr := os.WriteFile(done.path, done.oldContent, 0644); werr != nil {
+					if werr := persistence.WriteFile(done.path, done.oldContent, 0644); werr != nil {
 						log.Printf("bulk-delete rollback of room %d: %v", done.id, werr)
 					}
 				}
@@ -90,6 +92,10 @@ func (s *AdminServer) handleBulkDelete(w http.ResponseWriter, r *http.Request) {
 		}
 		deletedSet[snap.id] = true
 	}
+	// Room files are gone; now detach the deleted rooms from any courses.
+	for _, snap := range snapshots {
+		s.detachRoomFromCourse(snap.id)
+	}
 
 	s.world.RebuildRoomIndex(s.dataDir)
 	for _, snap := range snapshots {