fix: durable payouts survive journal failure, cap bank withdrawals, hash passwords off the owner loop.

1 files changed, 14 insertions, 0 deletions

diff --git a/internal/game/game.go b/internal/game/game.go
index 096e070..7255042 100644
--- a/internal/game/game.go
+++ b/internal/game/game.go
@@ -291,6 +291,20 @@ func (g *Game) HandleSessionOnOwner(sess *net.Session, input string) {
 	if g.isShuttingDown() {
 		return
 	}
+	// Password work is expensive (Argon2id, ~64 MiB and tens of
+	// milliseconds per call) and must never run on the owner goroutine:
+	// the owner serializes every command and tick, so a burst of logins
+	// would stall the whole world. Verify/hash on the caller's connection
+	// goroutine, then submit one owner task for the (cheap) state
+	// transition.
+	switch sess.State {
+	case net.StatePassword:
+		g.handlePasswordOffOwner(sess, input)
+		return
+	case net.StateNewAccount:
+		g.handleNewAccountOffOwner(sess, input)
+		return
+	}
 	g.RunOnOwner(func() {
 		// Re-checked at task execution: the flag may flip between
 		// submission and execution, and RunOnOwner must never fall back