fix: more casino, economy, gameplay, security, and world data hardening gaps

1 files changed, 8 insertions, 2 deletions

diff --git a/internal/game/act_effects.go b/internal/game/act_effects.go
index a107320..e51deab 100644
--- a/internal/game/act_effects.go
+++ b/internal/game/act_effects.go
@@ -173,10 +173,16 @@ func (g *Game) applyStep(sess *net.Session, p *player.Player, step *behavior.Ste
 	}
 
 	// 10. credits (signed). A negative cost was preflighted for affordability,
-	// so the debit is unconditional here.
+	// so the debit is unconditional here. Clamp defensively anyway: a
+	// multi-step batch that shares one tick must never drive the balance
+	// negative, an invariant every wallet/economy path relies on.
 	if step.Credits != 0 {
 		if step.Credits < 0 {
-			p.Credits += step.Credits
+			debit := step.Credits
+			if p.Credits+debit < 0 {
+				debit = -p.Credits
+			}
+			p.Credits += debit
 			g.saveCharacter(p)
 		} else {
 			g.grantCredits(p, step.Credits)