fix: harden engine across casino, economy, concurrency, security, and content

1 files changed, 7 insertions, 1 deletions

diff --git a/internal/game/session_registry.go b/internal/game/session_registry.go
index 0e47f82..c4f5d67 100644
--- a/internal/game/session_registry.go
+++ b/internal/game/session_registry.go
@@ -11,9 +11,15 @@ func (g *Game) attachSession(sess *net.Session) {
 	g.charsMu.Unlock()
 }
 
-// detachSession removes a character's registry entry.
+// detachSession removes a character's registry entry and drops every command
+// queued under its name. Leftover queue entries retain the departed session
+// (and its transport) and would otherwise replay against the next session
+// that logs in as the same character.
 func (g *Game) detachSession(name string) {
 	g.charsMu.Lock()
 	delete(g.loggedInChars, name)
 	g.charsMu.Unlock()
+	if g.queue != nil {
+		g.queue.ClearPlayer(name)
+	}
 }