fix: economy recovery double-refund/erased-liability/cap-drops, entity editor path traversal

1 files changed, 9 insertions, 4 deletions

diff --git a/internal/game/casino.go b/internal/game/casino.go
index 3f06b41..bc1e690 100644
--- a/internal/game/casino.go
+++ b/internal/game/casino.go
@@ -82,15 +82,20 @@ func (w casinoWallet) PayCredits(amount int) error {
 	}
 	creditsBefore := w.p.Credits
 	chipsBefore := countChips(w.p)
-	creditsAfter, err := addCreditsChecked(creditsBefore, amount)
-	if err != nil {
-		return err
-	}
+	creditsAfter, capErr := addCreditsChecked(creditsBefore, amount)
+	// The journal record is written FIRST, even when the economy cap
+	// blocks the payout: a won settlement must never be silently dropped.
+	// With the cap blocking, the balance is unchanged and the open record
+	// keeps the owed amount durable; startup recovery re-applies it once
+	// the balance has room below the cap.
 	rec, err := w.g.Economy.start("payout", w.p, 0, amount,
 		creditsBefore, creditsAfter, chipsBefore, chipsBefore)
 	if err != nil {
 		return casino.ErrWalletPersistence
 	}
+	if capErr != nil {
+		return capErr
+	}
 	w.p.Credits = creditsAfter
 	if err := w.g.AccountStore.SaveCharacter(w.p); err != nil {
 		w.p.Credits = creditsBefore