fix: more casino, economy, gameplay, security, and world data hardening gaps

1 files changed, 32 insertions, 0 deletions

diff --git a/internal/casino/correct_casino_refund_bank_test.go b/internal/casino/correct_casino_refund_bank_test.go
index fd90ae1..4262997 100644
--- a/internal/casino/correct_casino_refund_bank_test.go
+++ b/internal/casino/correct_casino_refund_bank_test.go
@@ -99,3 +99,35 @@ func TestMachineRefundAllFailedRefundKeepsStakeOpenForRecovery(t *testing.T) {
 		t.Fatalf("the failed refund was not reported: %+v", events)
 	}
 }
+
+// TestMachineDisconnectSettlesBankedFeatureWinnings: already-landed free-spin
+// winnings are not part of the forfeited in-flight wager, so a disconnect must
+// settle them through the wallet rather than silently zeroing featureBank.
+func TestMachineDisconnectSettlesBankedFeatureWinnings(t *testing.T) {
+	m := newMachine(1, MachineConfig{ID: "slots", Game: GameSlots}, newTestRand())
+	wallet := &testWallet{credits: 100}
+	m.join("alice")
+	m.beginSpinLocked(10, wallet, "", "")
+	m.spin = &SlotSpin{Payout: 25, ScatterCount: 3}
+	m.finishSpin() // triggers the feature: 25 banked, the stake stays open
+	if m.featureBank != 25 || !m.inFreeSpins {
+		t.Fatalf("setup: featureBank=%v inFreeSpins=%v, want 25/true", m.featureBank, m.inFreeSpins)
+	}
+
+	events := m.markDisconnected("alice")
+	if wallet.paid != 25 {
+		t.Fatalf("disconnect paid %d, want 25 banked free-spin credits", wallet.paid)
+	}
+	if got := wallet.credits + wallet.paid; got != 115 {
+		t.Fatalf("banked winnings were destroyed on disconnect: balance %d, want 115 (100 - 10 forfeited stake + 25 banked)", got)
+	}
+	if !hasMessage(events, "25") {
+		t.Fatalf("missing banked-winnings settlement message: %+v", events)
+	}
+	if len(wallet.open) != 0 {
+		t.Fatalf("stake still outstanding after disconnect: %+v", wallet.open)
+	}
+	if m.owns("alice") {
+		t.Fatal("machine still owns the disconnected player")
+	}
+}