fix: durable payouts survive journal failure, cap bank withdrawals, hash passwords off the owner loop.

1 files changed, 14 insertions, 14 deletions

diff --git a/internal/game/economy_recovery_regression_test.go b/internal/game/economy_recovery_regression_test.go
index f9d3b37..207e01d 100644
--- a/internal/game/economy_recovery_regression_test.go
+++ b/internal/game/economy_recovery_regression_test.go
@@ -104,7 +104,7 @@ func TestRecoveryReappliesLostPayoutWithEvidence(t *testing.T) {
 	if loaded.Credits != 110 {
 		t.Fatalf("balance after recovery = %d, want 110 (payout re-applied once, no double stake refund)", loaded.Credits)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("records left open after recovery: %+v", open)
 	}
 }
@@ -166,7 +166,7 @@ func TestRecoveryReappliesIdenticalFailedPayouts(t *testing.T) {
 	if loaded.Credits != 130 {
 		t.Fatalf("balance after recovery = %d, want 130 (both identical failed payouts re-applied)", loaded.Credits)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("records left open after recovery: %+v", open)
 	}
 }
@@ -247,7 +247,7 @@ func TestRecoveryKeepsWagerOpenWhenChipsDoNotFit(t *testing.T) {
 	if got := countChips(loaded); got != 0 {
 		t.Fatalf("chips after recovery = %d, want 0 (no inventory room; nothing delivered)", got)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 1 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 1 {
 		t.Fatalf("chip wager must stay open for operator inspection, open records: %+v", open)
 	}
 }
@@ -287,7 +287,7 @@ func TestRecoveryPreservesAmbiguousPayout(t *testing.T) {
 	if loaded.Credits != 95 {
 		t.Fatalf("ambiguous recovery mutated the balance: %d, want 95", loaded.Credits)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 1 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 1 {
 		t.Fatalf("ambiguous payout must stay open for operator inspection: %+v", open)
 	}
 }
@@ -321,7 +321,7 @@ func TestRecoveryKeepsUnpaidSiblingsOpenAtCreditCap(t *testing.T) {
 	if loaded.Credits != casino.MaxCredits-10 {
 		t.Fatalf("balance after capped recovery = %d, want %d (one payout applied)", loaded.Credits, casino.MaxCredits-10)
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 1 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 1 {
 		t.Fatalf("unpaid liability must stay open for operator inspection, open records: %+v", open)
 	}
 }
@@ -364,9 +364,9 @@ func TestRecoveryRestoresChipsFromMixedRefundCrash(t *testing.T) {
 	}
 	if loaded.Credits != 100 || countChips(loaded) != 10 {
 		t.Fatalf("mixed refund after recovery = (%d credits, %d chips), want (100, 10); open records: %+v",
-			loaded.Credits, countChips(loaded), h.g.Economy.loadOpen())
+			loaded.Credits, countChips(loaded), h.g.Economy.mustLoadOpen(t))
 	}
-	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+	if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 		t.Fatalf("nothing may stay owed after recovery: %+v", open)
 	}
 }
@@ -429,13 +429,13 @@ func TestRecoveryUnpaidLiabilitySurvivesLaterRecoveries(t *testing.T) {
 			}
 		}
 		h.g.recoverEconomy()
-		if len(h.g.Economy.loadOpen()) != 1 {
-			t.Errorf("setup: expected one unpaid record after capped recovery, got %d", len(h.g.Economy.loadOpen()))
+		if len(h.g.Economy.mustLoadOpen(t)) != 1 {
+			t.Errorf("setup: expected one unpaid record after capped recovery, got %d", len(h.g.Economy.mustLoadOpen(t)))
 			return
 		}
 		// A later startup over the same files: the liability stays owed.
 		h.g.recoverEconomy()
-		if got := len(h.g.Economy.loadOpen()); got != 1 {
+		if got := len(h.g.Economy.mustLoadOpen(t)); got != 1 {
 			t.Errorf("second recovery erased the unpaid 20-credit liability: open=%d, want 1", got)
 		}
 	})
@@ -481,8 +481,8 @@ func TestCapBlockedPayoutIsJournaled(t *testing.T) {
 	// Recovery: the owed win cannot be applied (cap), so the liability
 	// stays open for operator inspection, never erased; the consumed
 	// stake is settled against the payout evidence.
-	if got := len(restarted.g.Economy.loadOpen()); got != 1 {
-		t.Fatalf("owed cap-blocked payout must stay open after recovery, open records: %+v", restarted.g.Economy.loadOpen())
+	if got := len(restarted.g.Economy.mustLoadOpen(t)); got != 1 {
+		t.Fatalf("owed cap-blocked payout must stay open after recovery, open records: %+v", restarted.g.Economy.mustLoadOpen(t))
 	}
 	if loaded.Credits != casino.MaxCredits-10 {
 		t.Fatalf("recovery mutated a capped balance: %d", loaded.Credits)
@@ -523,7 +523,7 @@ func TestRecoveryReappliesPartiallyPaidIdenticalPayouts(t *testing.T) {
 			t.Error(err)
 			return
 		}
-		first := h.g.Economy.loadOpen()[0]
+		first := h.g.Economy.mustLoadOpen(t)[0]
 		if first.ID == second.ID {
 			t.Fatal("setup: expected two distinct records")
 		}
@@ -539,7 +539,7 @@ func TestRecoveryReappliesPartiallyPaidIdenticalPayouts(t *testing.T) {
 		if loaded.Credits != 130 {
 			t.Errorf("recovered balance = %d, want 130 (remaining owed payout re-applied)", loaded.Credits)
 		}
-		if open := h.g.Economy.loadOpen(); len(open) != 0 {
+		if open := h.g.Economy.mustLoadOpen(t); len(open) != 0 {
 			t.Errorf("records left open after recovery: %+v", open)
 		}
 	})