feat: single-owner game state, transactional lifecycle, durable money on server stop

26 files changed, 2379 insertions, 183 deletions

diff --git a/internal/game/account_txn.go b/internal/game/account_txn.go
new file mode 100644
index 0000000..488a5f6
--- /dev/null
+++ b/internal/game/account_txn.go
@@ -0,0 +1,380 @@
+package game
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"thehouseoficarus/internal/net"
+	"thehouseoficarus/internal/persistence"
+	"thehouseoficarus/internal/player"
+)
+
+// Account/character lifecycle operations. Each is one journal transaction
+// over the affected files (account list, character files), executed with the
+// game's single-owner guarantee: the online check, file mutation, registry
+// update, and cross-session refresh happen without any interleaved session
+// input, closing the check-then-rename gap. Save/remove errors are
+// propagated to the caller, never ignored.
+//
+// All handlers here are invoked from session input (already on the owner).
+
+// journalDir is the persistence journal directory under the game data dir.
+func (g *Game) journalDir() string {
+	return filepath.Join(g.DataDir, ".journal")
+}
+
+// newTxn starts a lifecycle transaction.
+func (g *Game) newTxn() *persistence.Transaction {
+	return persistence.NewTransaction(g.journalDir())
+}
+
+// adoptCharacterIdentity backfills stable identity fields on a loaded
+// character: a UUID (assigned once at first load and persisted) and the
+// owning account name. Legacy characters without these fields get them at
+// first connection and are re-saved so subsequent authorizations can use
+// them. Called from the owner goroutine only.
+func (g *Game) adoptCharacterIdentity(p *player.Player, accountName string) {
+	if p.ID == "" {
+		p.ID = newCharacterID()
+	}
+	if p.Account == "" {
+		p.Account = accountName
+	}
+	if err := g.AccountStore.SaveCharacter(p); err != nil {
+		// Identity backfill is best-effort: the character remains usable,
+		// but membership validation falls back to the account list.
+		log.Printf("identity backfill for %s: %v", p.Name, err)
+	}
+}
+
+// newCharacterID returns a random UUID (v4, formatted without dashes is
+// unnecessary; standard hyphenated form is used).
+func newCharacterID() string {
+	var b [16]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		panic(fmt.Sprintf("character id generation: %v", err))
+	}
+	b[6] = (b[6] & 0x0f) | 0x40 // version 4
+	b[8] = (b[8] & 0x3f) | 0x80 // RFC 4122 variant
+	s := hex.EncodeToString(b[:])
+	return s[0:8] + "-" + s[8:12] + "-" + s[12:16] + "-" + s[16:20] + "-" + s[20:32]
+}
+
+// backfillCharacterIDs migrates every character file at startup: assigns
+// missing IDs and owner fields (owner derived from account character lists
+// for legacy files) and persists them.
+func (g *Game) backfillCharacterIDs() {
+	names, err := g.AccountStore.ListCharacterNames()
+	if err != nil {
+		return
+	}
+	owners := map[string]string{} // character (lower) -> owning account
+	accounts, _ := g.AccountStore.ListAccountNames()
+	for _, accName := range accounts {
+		acc, err := g.AccountStore.LoadAccount(accName)
+		if err != nil {
+			continue
+		}
+		for _, c := range acc.Characters {
+			owners[strings.ToLower(c)] = acc.Name
+		}
+	}
+	for _, name := range names {
+		p, err := g.AccountStore.LoadCharacter(name)
+		if err != nil {
+			log.Printf("character migration load %s: %v", name, err)
+			continue
+		}
+		changed := false
+		if p.ID == "" {
+			p.ID = newCharacterID()
+			changed = true
+		}
+		if p.Account == "" {
+			if owner, ok := owners[strings.ToLower(p.Name)]; ok {
+				p.Account = owner
+				changed = true
+			}
+		}
+		if changed {
+			if err := g.AccountStore.SaveCharacter(p); err != nil {
+				log.Printf("character migration save %s: %v", p.Name, err)
+			}
+		}
+	}
+}
+
+// canonicAccount returns the account name in its canonical on-disk form.
+func (g *Game) canonicalAccount(name string) (string, error) {
+	return g.AccountStore.FindAccount(name)
+}
+
+// canonicChar returns the character name in its canonical on-disk form.
+func (g *Game) canonicalChar(name string) (string, error) {
+	return g.AccountStore.FindCharacter(name)
+}
+
+// createCharacterTxn creates the character file and appends it to the
+// owning account in a single transaction. Returns the created player.
+func (g *Game) createCharacterTxn(accountName, charName string, startingRoom int) (*player.Player, error) {
+	p := player.New(charName)
+	p.RoomID = startingRoom
+	p.Stats.RecordRoomVisit(startingRoom)
+	p.ID = newCharacterID()
+	p.Account = accountName
+	data, err := g.AccountStore.MarshalCharacter(p)
+	if err != nil {
+		return nil, err
+	}
+	txn := g.newTxn()
+	if err := txn.Replace(g.AccountStore.CharPath(charName), data, 0600); err != nil {
+		return nil, err
+	}
+	acc, err := g.AccountStore.LoadAccount(accountName)
+	if err != nil {
+		return nil, err
+	}
+	acc.Characters = append(acc.Characters, charName)
+	accData, err := g.AccountStore.MarshalAccount(acc)
+	if err != nil {
+		return nil, err
+	}
+	if err := txn.Replace(g.AccountStore.AccountPath(accountName), accData, 0600); err != nil {
+		return nil, err
+	}
+	return p, txn.Commit()
+}
+
+// renameCharacterTxn atomically renames the character file, persists the new
+// name inside it, and updates the owning account's character list.
+func (g *Game) renameCharacterTxn(accountName, oldName, newName string) error {
+	txn := g.newTxn()
+	if err := txn.Move(g.AccountStore.CharPath(oldName), g.AccountStore.CharPath(newName)); err != nil {
+		return err
+	}
+	p, err := g.AccountStore.LoadCharacter(oldName)
+	if err != nil {
+		return err
+	}
+	p.Name = newName
+	data, err := g.AccountStore.MarshalCharacter(p)
+	if err != nil {
+		return err
+	}
+	if err := txn.Replace(g.AccountStore.CharPath(newName), data, 0600); err != nil {
+		return err
+	}
+	acc, err := g.AccountStore.LoadAccount(accountName)
+	if err != nil {
+		return err
+	}
+	chars := make([]string, 0, len(acc.Characters))
+	for _, c := range acc.Characters {
+		if c == oldName {
+			chars = append(chars, newName)
+		} else {
+			chars = append(chars, c)
+		}
+	}
+	acc.Characters = chars
+	accData, err := g.AccountStore.MarshalAccount(acc)
+	if err != nil {
+		return err
+	}
+	if err := txn.Replace(g.AccountStore.AccountPath(accountName), accData, 0600); err != nil {
+		return err
+	}
+	return txn.Commit()
+}
+
+// deleteCharacterTxn removes the character file and updates the account list
+// atomically.
+func (g *Game) deleteCharacterTxn(accountName, charName string) error {
+	txn := g.newTxn()
+	if err := txn.Delete(g.AccountStore.CharPath(charName)); err != nil {
+		return err
+	}
+	acc, err := g.AccountStore.LoadAccount(accountName)
+	if err != nil {
+		return err
+	}
+	var chars []string
+	for _, c := range acc.Characters {
+		if c != charName {
+			chars = append(chars, c)
+		}
+	}
+	acc.Characters = chars
+	accData, err := g.AccountStore.MarshalAccount(acc)
+	if err != nil {
+		return err
+	}
+	if err := txn.Replace(g.AccountStore.AccountPath(accountName), accData, 0600); err != nil {
+		return err
+	}
+	return txn.Commit()
+}
+
+// purgeAccountTxn removes the account file and every character file in one
+// transaction.
+func (g *Game) purgeAccountTxn(accountName string, characters []string) error {
+	txn := g.newTxn()
+	for _, name := range characters {
+		if err := txn.Delete(g.AccountStore.CharPath(name)); err != nil {
+			return err
+		}
+	}
+	if err := txn.Delete(g.AccountStore.AccountPath(accountName)); err != nil {
+		return err
+	}
+	return txn.Commit()
+}
+
+// renameAccountTxn moves the account file and rewrites its embedded name in
+// one transaction.
+func (g *Game) renameAccountTxn(oldName, newName string) error {
+	txn := g.newTxn()
+	if err := txn.Move(g.AccountStore.AccountPath(oldName), g.AccountStore.AccountPath(newName)); err != nil {
+		return err
+	}
+	acc, err := g.AccountStore.LoadAccount(oldName)
+	if err != nil {
+		return err
+	}
+	acc.Name = newName
+	accData, err := g.AccountStore.MarshalAccount(acc)
+	if err != nil {
+		return err
+	}
+	if err := txn.Replace(g.AccountStore.AccountPath(newName), accData, 0600); err != nil {
+		return err
+	}
+	return txn.Commit()
+}
+
+// isMemberOf reports whether characterName belongs to accountName by
+// checking the character file's owner field (falling back to the account's
+// character list for legacy files), case-insensitively.
+func (g *Game) isMemberOf(accountName, characterName string) bool {
+	p, err := g.AccountStore.LoadCharacter(characterName)
+	if err != nil {
+		return false
+	}
+	if p.Account != "" {
+		return equalsFold(p.Account, accountName)
+	}
+	acc, err := g.AccountStore.LoadAccount(accountName)
+	if err != nil {
+		return false
+	}
+	for _, c := range acc.Characters {
+		if equalsFold(c, characterName) {
+			return true
+		}
+	}
+	return false
+}
+
+// publishAccountUpdate reloads the account from disk and republishes its
+// state to every session of that account, resetting stale pending menu
+// selections (pending character names, menu choices) after lifecycle
+// mutations. Called from the owner goroutine only.
+func (g *Game) publishAccountUpdate(accountName string) {
+	for _, sess := range g.allSessionsOfAccount(accountName) {
+		acc, err := g.AccountStore.LoadAccount(accountName)
+		if err != nil {
+			// The account file vanished (purge from another session); the
+			// session is stale and must leave the menu.
+			sess.Account = nil
+			sess.PendingChar = ""
+			sess.PendingMenu = nil
+			sess.WriteLine("\nYour account no longer exists.")
+			sess.Close()
+			continue
+		}
+		sess.Account = &player.Account{
+			Name:         acc.Name,
+			PasswordHash: acc.PasswordHash,
+			Characters:   acc.Characters,
+			Aliases:      acc.Aliases,
+			Colors:       acc.Colors,
+			Options:      acc.Options,
+			Admin:        acc.Admin,
+		}
+		if sess.Account.Aliases == nil {
+			sess.Account.Aliases = make(map[string]string)
+		}
+		if sess.Account.Colors == nil {
+			sess.Account.Colors = make(map[string]string)
+		}
+		if sess.Account.Options == nil {
+			sess.Account.Options = make(map[string]any)
+		}
+		// Any pending selection referencing a deleted/renamed character is
+		// stale now; revalidate before reuse.
+		sess.PendingMenu = nil
+		if sess.PendingChar != "" && sess.PendingChar != "connect" {
+			found := false
+			for _, c := range sess.Account.Characters {
+				if equalsFold(c, sess.PendingChar) {
+					found = true
+					break
+				}
+			}
+			if !found {
+				sess.PendingChar = ""
+				sess.State = net.StateMenu
+				g.showMenu(sess)
+			}
+		}
+	}
+}
+
+// allSessionsOfAccount returns every session authenticated to accountName,
+// including sessions sitting in menus (not just in-game characters).
+func (g *Game) allSessionsOfAccount(accountName string) []*net.Session {
+	if g.Hub == nil {
+		return nil
+	}
+	var out []*net.Session
+	for _, sess := range g.Hub.AllSessions() {
+		if sess.Account != nil && equalsFold(sess.Account.Name, accountName) {
+			out = append(out, sess)
+		}
+	}
+	return out
+}
+
+// equalsFold is a small case-insensitive string equality helper.
+func equalsFold(a, b string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := 0; i < len(a); i++ {
+		ca, cb := a[i], b[i]
+		if 'A' <= ca && ca <= 'Z' {
+			ca += 'a' - 'A'
+		}
+		if 'A' <= cb && cb <= 'Z' {
+			cb += 'a' - 'A'
+		}
+		if ca != cb {
+			return false
+		}
+	}
+	return true
+}
+
+// recoverJournals rolls back leftover lifecycle journals at startup and
+// surfaces unrecoverable ones.
+func (g *Game) recoverJournals() {
+	if err := persistence.Recover(g.journalDir()); err != nil {
+		fmt.Fprintf(os.Stderr, "lifecycle journal recovery failed: %v\n", err)
+		os.Exit(1)
+	}
+}
diff --git a/internal/game/baseline_race_test.go b/internal/game/baseline_race_test.go
new file mode 100644
index 0000000..de5b7b4
--- /dev/null
+++ b/internal/game/baseline_race_test.go
@@ -0,0 +1,132 @@
+package game
+
+// Owner-boundary concurrency regressions. These exercise the competing
+// runtime entry points the way production does (connection input, ticks,
+// disconnects, admin mutations, owner-routed wallet operations) and must
+// pass under -race with the single-owner design in place.
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+	"thehouseoficarus/internal/net"
+)
+
+// TestBaselineRaceSessionInputTickDisconnect exercises the three competing
+// runtime entry points against each other: connection-goroutine input, the
+// ticker goroutine, and hub disconnect callbacks.
+func TestBaselineRaceSessionInputTickDisconnect(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	h.seedAccount("bob", "pw", false)
+	h.seedCharacter("alice", "alice")
+	h.seedCharacter("bob", "bob")
+
+	aSess, _ := h.connect("alice")
+	bSess, _ := h.connect("bob")
+
+	aLines := h.goInput(aSess, 1)
+	bLines := h.goInput(bSess, 1)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 200; i++ {
+			aLines <- "look"
+		}
+		close(aLines)
+	}()
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 200; i++ {
+			bLines <- "say hi"
+		}
+		close(bLines)
+	}()
+
+	// Disconnect bob from a third goroutine while everything else runs.
+	go func() {
+		for i := 0; i < 50; i++ {
+			h.hub.PlayersInRoom(1)
+			if i == 25 {
+				h.hub.Remove(bSess)
+			}
+		}
+	}()
+
+	wg.Wait()
+}
+
+// TestBaselineRaceAdminRewriteWhilePlaying hammers Game.RewriteRoomIDs (the
+// admin entry point) while players keep moving and ticking.
+func TestBaselineRaceAdminRewriteWhilePlaying(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("carol", "pw", false)
+	h.seedCharacter("carol", "carol")
+	sess, _ := h.connect("carol")
+	lines := h.goInput(sess, 1)
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 200; i++ {
+			lines <- fmt.Sprintf("go north")
+		}
+		close(lines)
+	}()
+
+	// Concurrent admin room-ID rewrites targeting the player's live state.
+	for i := 0; i < 20; i++ {
+		h.g.RewriteRoomIDs(map[int]int{2: 2 + i + 1, 2 + i: 2 + i + 1})
+	}
+
+	wg.Wait()
+}
+
+// TestBaselineRaceCasinoWallet drives concurrent casino activity through
+// the owner boundary (as production does): wallet debits/credits from
+// multiple players' session tasks plus session input, all on one owner.
+func TestBaselineRaceCasinoWallet(t *testing.T) {
+	h := newHarness(t)
+	for _, n := range []string{"dave", "erin", "frank"} {
+		h.seedAccount(n, "pw", false)
+		p := h.seedCharacter(n, n)
+		p.Credits = 100000
+	}
+	sessions := make([]*net.Session, 0, 3)
+	for _, n := range []string{"dave", "erin", "frank"} {
+		s, _ := h.connect(n)
+		sessions = append(sessions, s)
+	}
+
+	var wg sync.WaitGroup
+	for _, s := range sessions {
+		wallet := casinoWallet{g: h.g, p: s.Player}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := 0; i < 100; i++ {
+				h.g.RunOnOwner(func() {
+					wallet.Wager(1)
+					wallet.PayCredits(1)
+				})
+			}
+		}()
+
+		// Session input competes with the wallet operations.
+		lines := h.goInput(s, 1)
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := 0; i < 100; i++ {
+				lines <- "look"
+			}
+			close(lines)
+		}()
+	}
+
+	wg.Wait()
+	h.barrier()
+}
diff --git a/internal/game/casino.go b/internal/game/casino.go
index eb6fa4a..7442178 100644
--- a/internal/game/casino.go
+++ b/internal/game/casino.go
@@ -18,29 +18,76 @@ type casinoWallet struct {
 	p *player.Player
 }
 
-func (w casinoWallet) Wager(amount int) (casino.Wager, bool) {
+// Wager debits the stake durably. Order of operations: durable journal
+// record FIRST (with balance checkpoints), then the in-memory mutation,
+// then the character save, then the settlement marker. A failed save
+// reverts the in-memory mutation and voids the record: no charge is kept
+// in memory, and the error distinguishes persistence failure from
+// insufficient funds.
+func (w casinoWallet) Wager(amount int) (casino.Wager, error) {
 	if amount <= 0 {
-		return casino.Wager{}, false
+		return casino.Wager{}, casino.ErrInsufficientFunds
 	}
-	chips := countChips(w.p)
+	creditsBefore := w.p.Credits
+	chipsBefore := countChips(w.p)
+	chips := chipsBefore
 	if chips > amount {
 		chips = amount
 	}
 	credits := amount - chips
-	if w.p.Credits < credits {
-		return casino.Wager{}, false
+	if creditsBefore < credits {
+		return casino.Wager{}, casino.ErrInsufficientFunds
+	}
+	rec, err := w.g.Economy.start("wager", w.p, chips, credits,
+		creditsBefore, creditsBefore-credits, chipsBefore, chipsBefore-chips)
+	if err != nil {
+		return casino.Wager{}, casino.ErrWalletPersistence
 	}
 	if chips > 0 {
 		w.p.RemoveItem("chips", chips)
 	}
 	w.p.Credits -= credits
-	w.g.AccountStore.SaveCharacter(w.p)
-	return casino.Wager{Total: amount, Chips: chips, Credits: credits}, true
+	if err := w.g.AccountStore.SaveCharacter(w.p); err != nil {
+		// Revert the in-memory mutation: the play must not proceed on a
+		// stake that could not be made durable.
+		if chips > 0 {
+			w.g.giveChips(w.p, chips)
+		}
+		w.p.Credits += credits
+		w.g.Economy.void(rec)
+		return casino.Wager{}, casino.ErrWalletPersistence
+	}
+	w.g.Economy.settle(rec)
+	return casino.Wager{Total: amount, Chips: chips, Credits: credits}, nil
 }
 
-func (w casinoWallet) PayCredits(amount int) {
-	w.p.Credits += amount
-	w.g.AccountStore.SaveCharacter(w.p)
+// PayCredits applies a payout durably. The journal record is written first;
+// if the save fails, the record stays open and startup recovery re-pays it
+// (the player is owed the settlement).
+func (w casinoWallet) PayCredits(amount int) error {
+	if amount <= 0 {
+		return nil
+	}
+	creditsBefore := w.p.Credits
+	chipsBefore := countChips(w.p)
+	creditsAfter, err := addCreditsChecked(creditsBefore, amount)
+	if err != nil {
+		return err
+	}
+	rec, err := w.g.Economy.start("payout", w.p, 0, amount,
+		creditsBefore, creditsAfter, chipsBefore, chipsBefore)
+	if err != nil {
+		return casino.ErrWalletPersistence
+	}
+	w.p.Credits = creditsAfter
+	if err := w.g.AccountStore.SaveCharacter(w.p); err != nil {
+		w.p.Credits = creditsBefore
+		// Keep the record open: recovery re-pays on next startup, since a
+		// reported win must be durable.
+		return casino.ErrWalletPersistence
+	}
+	w.g.Economy.settle(rec)
+	return nil
 }
 
 // casinoAffordable is the most a player can wager: chips are spent first,
diff --git a/internal/game/casino_test.go b/internal/game/casino_test.go
index e43eb05..026415f 100644
--- a/internal/game/casino_test.go
+++ b/internal/game/casino_test.go
@@ -3,6 +3,7 @@ package game
 import (
 	"strings"
 	"testing"
+	"time"
 
 	"thehouseoficarus/internal/casino"
 	"thehouseoficarus/internal/color"
@@ -19,6 +20,8 @@ func (c *casinoTestConn) Write(b []byte) (int, error) {
 	c.data = append(c.data, b...)
 	return len(b), nil
 }
+func (c *casinoTestConn) SetWriteDeadline(time.Time) error { return nil }
+
 func (c *casinoTestConn) Close() error       { return nil }
 func (c *casinoTestConn) SetEcho(bool) error { return nil }
 
diff --git a/internal/game/cmd_quit.go b/internal/game/cmd_quit.go
index 0eb8fb9..80ad351 100644
--- a/internal/game/cmd_quit.go
+++ b/internal/game/cmd_quit.go
@@ -30,7 +30,7 @@ func (g *Game) doQuit(sess *net.Session) {
 	g.broadcastAction(sess, "%s sits down to rest.", p.Name)
 
 	ticksLeft := 10
-	id := g.Ticks.Subscribe(engine.ToTicks(1), func() bool {
+	id := g.SubscribeTicks(engine.ToTicks(1), func() bool {
 		switch ticksLeft {
 		case 10:
 			sess.WriteLine("You sit down to rest...")
diff --git a/internal/game/cmd_registry.go b/internal/game/cmd_registry.go
index 0fee89e..9a42d1e 100644
--- a/internal/game/cmd_registry.go
+++ b/internal/game/cmd_registry.go
@@ -181,7 +181,10 @@ func classifyCommand(cmd string) CommandClass {
 	if _, ok := verbAliases[cmd]; ok {
 		return ClassActive
 	}
-	if obstacleVerbs[cmd] {
+	obstacleVerbsMu.RLock()
+	isObstacle := obstacleVerbs[cmd]
+	obstacleVerbsMu.RUnlock()
+	if isObstacle {
 		return ClassActive
 	}
 	return ClassUnknown
@@ -211,7 +214,10 @@ func (g *Game) executeCommand(sess *net.Session, cmd string, args []string, rawI
 		return
 	}
 
-	if obstacleVerbs[cmd] {
+	obstacleVerbsMu.RLock()
+	isObstacle := obstacleVerbs[cmd]
+	obstacleVerbsMu.RUnlock()
+	if isObstacle {
 		g.doObstacle(sess, cmd)
 		return
 	}
diff --git a/internal/game/cmd_room_remove_test.go b/internal/game/cmd_room_remove_test.go
index 8bd8470..cd9569d 100644
--- a/internal/game/cmd_room_remove_test.go
+++ b/internal/game/cmd_room_remove_test.go
@@ -6,6 +6,7 @@ import (
 	"strconv"
 	"strings"
 	"testing"
+	"time"
 
 	"thehouseoficarus/internal/combat"
 	"thehouseoficarus/internal/net"
@@ -21,6 +22,8 @@ func (c *removeTestConn) Write(b []byte) (int, error) {
 	c.buf = append(c.buf, b...)
 	return len(b), nil
 }
+func (c *removeTestConn) SetWriteDeadline(time.Time) error { return nil }
+
 func (c *removeTestConn) Close() error       { return nil }
 func (c *removeTestConn) SetEcho(bool) error { return nil }
 
diff --git a/internal/game/cmd_shutdown.go b/internal/game/cmd_shutdown.go
index 0bb0f8f..0030649 100644
--- a/internal/game/cmd_shutdown.go
+++ b/internal/game/cmd_shutdown.go
@@ -1,14 +1,24 @@
 package game
 
+// The shutdown command schedules a graceful server shutdown. Signals and
+// this command converge on Game.RequestShutdown, so both paths drain work,
+// resolve outstanding wagers, and save owned state before transports close.
+
 import (
 	"fmt"
-	"os"
 	"strconv"
 	"time"
 
 	"thehouseoficarus/internal/net"
 )
 
+// scheduledShutdown carries one countdown run's captured cancel channel, so
+// a later run (or cancel) can never close or read a replacement run's
+// channel.
+type scheduledShutdown struct {
+	cancel chan struct{}
+}
+
 func (g *Game) executeShutdown(sess *net.Session, args []string, rawInput string) {
 	if !g.checkAdmin(sess) {
 		sess.WriteLine("Unknown command.")
@@ -21,20 +31,17 @@ func (g *Game) executeShutdown(sess *net.Session, args []string, rawInput string
 
 	if args[0] == "cancel" {
 		g.shutdownMu.Lock()
-		if !g.shutdownActive {
-			g.shutdownMu.Unlock()
+		run := g.shutdownRun
+		g.shutdownMu.Unlock()
+		if run == nil {
 			sess.WriteLine("No shutdown in progress.")
 			return
 		}
-		close(g.shutdownCancel)
-		g.shutdownActive = false
+		close(run.cancel)
+		g.shutdownMu.Lock()
+		g.shutdownRun = nil
 		g.shutdownMu.Unlock()
-
-		for _, other := range g.Hub.AllSessions() {
-			if other.Player != nil {
-				other.WriteLine("[Server] Shutdown cancelled.")
-			}
-		}
+		g.broadcastLoggedIn("[Server] Shutdown cancelled.")
 		return
 	}
 
@@ -45,58 +52,62 @@ func (g *Game) executeShutdown(sess *net.Session, args []string, rawInput string
 	}
 
 	g.shutdownMu.Lock()
-	if g.shutdownActive {
+	if g.shutdownRun != nil {
 		g.shutdownMu.Unlock()
 		sess.WriteLine("A shutdown is already in progress.")
 		return
 	}
-	g.shutdownActive = true
-	g.shutdownCancel = make(chan struct{})
+	run := &scheduledShutdown{cancel: make(chan struct{})}
+	g.shutdownRun = run
 	g.shutdownMu.Unlock()
 
-	go func() {
-		remaining := minutes * 60
-		ticker := time.NewTicker(30 * time.Second)
-		defer ticker.Stop()
+	go g.runShutdownCountdown(run, minutes)
+	sess.WriteLine(fmt.Sprintf("Shutdown scheduled in %d minute(s).", minutes))
+}
 
-		for _, other := range g.Hub.AllSessions() {
-			if other.Player != nil {
-				other.WriteLine(fmt.Sprintf("[Server] Shutting down in %d minute(s).", minutes))
-			}
-		}
+// runShutdownCountdown announces the countdown and requests the shutdown
+// at expiry. Cancellation is handled through the run's captured channel;
+// nothing reads a replaceable shared field here.
+func (g *Game) runShutdownCountdown(run *scheduledShutdown, minutes int) {
+	remaining := minutes * 60
+	ticker := time.NewTicker(30 * time.Second)
+	defer ticker.Stop()
 
-		for {
-			select {
-			case <-ticker.C:
-				remaining -= 30
-				if remaining <= 0 {
-					for _, other := range g.Hub.AllSessions() {
-						if other.Player != nil {
-							other.WriteLine("[Server] Shutting down NOW.")
-						}
-					}
-					os.Exit(0)
-				}
-				mins := remaining / 60
-				secs := remaining % 60
-				if secs == 0 {
-					for _, other := range g.Hub.AllSessions() {
-						if other.Player != nil {
-							other.WriteLine(fmt.Sprintf("[Server] Shutting down in %d minute(s).", mins))
-						}
-					}
-				} else {
-					for _, other := range g.Hub.AllSessions() {
-						if other.Player != nil {
-							other.WriteLine(fmt.Sprintf("[Server] Shutting down in %d minute(s) %d seconds.", mins, secs))
-						}
-					}
+	g.broadcastLoggedIn(fmt.Sprintf("[Server] Shutting down in %d minute(s).", minutes))
+
+	for {
+		select {
+		case <-ticker.C:
+			remaining -= 30
+			if remaining <= 0 {
+				g.broadcastLoggedIn("[Server] Shutting down NOW.")
+				if g.shutdownHook != nil {
+					g.shutdownHook("scheduled shutdown")
 				}
-			case <-g.shutdownCancel:
 				return
 			}
+			mins := remaining / 60
+			secs := remaining % 60
+			if secs == 0 {
+				g.broadcastLoggedIn(fmt.Sprintf("[Server] Shutting down in %d minute(s).", mins))
+			} else {
+				g.broadcastLoggedIn(fmt.Sprintf("[Server] Shutting down in %d minute(s) %d seconds.", mins, secs))
+			}
+		case <-run.cancel:
+			return
 		}
-	}()
+	}
+}
 
-	sess.WriteLine(fmt.Sprintf("Shutdown scheduled in %d minute(s).", minutes))
+// broadcastLoggedIn writes one line to every logged-in player. Read-only
+// over Hub membership (mutex-protected); writes go through outbound queues.
+func (g *Game) broadcastLoggedIn(msg string) {
+	if g.Hub == nil {
+		return
+	}
+	for _, other := range g.Hub.AllSessions() {
+		if other.Player != nil {
+			other.WriteLine(msg)
+		}
+	}
 }
diff --git a/internal/game/combat_attack.go b/internal/game/combat_attack.go
index 3544fcc..bd16999 100644
--- a/internal/game/combat_attack.go
+++ b/internal/game/combat_attack.go
@@ -193,7 +193,7 @@ func (g *Game) startCombat(sess *net.Session, p *player.Player, mob *world.MobIn
 		g.broadcastAction(sess, "%s attacks %s!", p.Name, mobDisplayName(mob, true))
 	}
 
-	g.Ticks.Subscribe(1, func() bool {
+	g.SubscribeTicks(1, func() bool {
 		cs := g.Combat.Get(p.Name)
 		if cs == nil || !cs.Active {
 			return false
@@ -255,7 +255,7 @@ func (g *Game) startCombat(sess *net.Session, p *player.Player, mob *world.MobIn
 	})
 
 	if !isTask {
-		g.Ticks.Subscribe(engine.ToTicks(mob.Speed), func() bool {
+		g.SubscribeTicks(engine.ToTicks(mob.Speed), func() bool {
 			cs := g.Combat.Get(p.Name)
 			if cs == nil || !cs.Active {
 				return false
diff --git a/internal/game/combat_mob.go b/internal/game/combat_mob.go
index dabb7d7..7d60a11 100644
--- a/internal/game/combat_mob.go
+++ b/internal/game/combat_mob.go
@@ -318,7 +318,7 @@ func (g *Game) awardKillDrops(sess *net.Session, p *player.Player, mob *world.Mo
 func (g *Game) scheduleMobRespawn(mob *world.MobInstance) {
 	instanceID := mob.InstanceID
 	if mob.SpawnedByTrigger {
-		g.Ticks.Subscribe(10, func() bool {
+		g.SubscribeTicks(10, func() bool {
 			g.MobStore.RemoveInstance(instanceID)
 			return false
 		})
@@ -328,7 +328,7 @@ func (g *Game) scheduleMobRespawn(mob *world.MobInstance) {
 	if respawnTicks <= 0 {
 		respawnTicks = engine.ToTicks(30)
 	}
-	g.Ticks.Subscribe(respawnTicks, func() bool {
+	g.SubscribeTicks(respawnTicks, func() bool {
 		g.respawnMob(instanceID)
 		return false
 	})
diff --git a/internal/game/core_course.go b/internal/game/core_course.go
index 232e6dc..15bd47e 100644
--- a/internal/game/core_course.go
+++ b/internal/game/core_course.go
@@ -70,6 +70,10 @@ type ObstacleInfo struct {
 
 var obstacleVerbs = map[string]bool{}
 
+// obstacleVerbsMu guards the global obstacle-verb set: course loading
+// rebuilds it, and command classification reads it from session tasks.
+var obstacleVerbsMu sync.RWMutex
+
 var verbGerund = map[string]string{
 	"scramble": "scrambling",
 	"jump":     "jumping",
@@ -251,5 +255,7 @@ func (cs *CourseStore) loadAllLocked() {
 		return nil
 	})
 
+	obstacleVerbsMu.Lock()
 	obstacleVerbs = localVerbs
+	obstacleVerbsMu.Unlock()
 }
diff --git a/internal/game/core_login_account.go b/internal/game/core_login_account.go
index 77b72d3..a846f4d 100644
--- a/internal/game/core_login_account.go
+++ b/internal/game/core_login_account.go
@@ -2,7 +2,6 @@ package game
 
 import (
 	"fmt"
-	"os"
 	"strings"
 
 	"thehouseoficarus/internal/color"
@@ -332,34 +331,19 @@ func (g *Game) handleRenameAccount(sess *net.Session, input string) {
 		return
 	}
 
-	oldPath := g.AccountStore.AccountPath(oldName)
-	newPath := g.AccountStore.AccountPath(newName)
-	if err := os.Rename(oldPath, newPath); err != nil {
+	// One journal transaction: file move + embedded name rewrite. Any
+	// failure rolls back, so the account is never half-renamed.
+	if err := g.renameAccountTxn(oldName, newName); err != nil {
 		sess.WriteLine(fmt.Sprintf("Error renaming account: %v", err))
 		g.showMenu(sess)
 		return
 	}
 
-	// Persist the new name inside the account file itself; otherwise the next
-	// login adopts the old name again and account lookup drifts apart from
-	// the filename. Roll the rename back if the file cannot be updated so the
-	// account never ends up in a half-renamed state.
-	acc, err := g.AccountStore.LoadAccount(newName)
-	if err != nil {
-		sess.WriteLine(fmt.Sprintf("Error renaming account: %v", err))
-		os.Rename(newPath, oldPath)
-		g.showMenu(sess)
-		return
-	}
-	acc.Name = newName
-	if err := g.AccountStore.SaveAccount(acc); err != nil {
-		sess.WriteLine(fmt.Sprintf("Error renaming account: %v", err))
-		os.Rename(newPath, oldPath)
-		g.showMenu(sess)
-		return
-	}
+	// Republish account state to EVERY session of this account: other
+	// authenticated sessions must not retain stale account objects or
+	// pending menu selections bound to the old name.
+	g.publishAccountUpdate(newName)
 
-	sess.Account.Name = newName
 	sess.WriteLine(fmt.Sprintf("Account renamed to %s.", newName))
 	g.showMenu(sess)
 }
@@ -373,8 +357,10 @@ func (g *Game) handlePurgeAccount(sess *net.Session, input string) {
 		return
 	}
 
-	// Refuse to purge while any character is connected: a live session would
-	// keep playing (and saving) a character whose file is about to vanish.
+	// Refuse to purge while any character is connected: a live session
+	// would keep playing (and saving) a character whose file is about to
+	// vanish. The online check and the purge run as one owner step, so no
+	// connection can start a character between check and deletion.
 	for _, name := range sess.Account.Characters {
 		if g.characterOnline(name) {
 			sess.WriteLine(fmt.Sprintf("%s is logged in. Log all characters out before purging.", name))
@@ -383,12 +369,24 @@ func (g *Game) handlePurgeAccount(sess *net.Session, input string) {
 		}
 	}
 
-	for _, name := range sess.Account.Characters {
-		os.Remove(g.AccountStore.CharPath(name))
+	if err := g.purgeAccountTxn(sess.Account.Name, sess.Account.Characters); err != nil {
+		sess.WriteLine(fmt.Sprintf("Error purging account: %v", err))
+		g.showMenu(sess)
+		return
 	}
 
-	os.Remove(g.AccountStore.AccountPath(sess.Account.Name))
-
 	sess.WriteLine(fmt.Sprintf("Account %s has been purged. Thanks for playing.", sess.Account.Name))
+	// Other authenticated sessions of this account are stale now; tell
+	// them and close them (they cannot safely keep using cached state).
+	for _, other := range g.allSessionsOfAccount(sess.Account.Name) {
+		if other == sess {
+			continue
+		}
+		other.Account = nil
+		other.PendingChar = ""
+		other.PendingMenu = nil
+		other.WriteLine("\nYour account has been purged from another session.")
+		other.Close()
+	}
 	sess.Close()
 }
diff --git a/internal/game/core_login_char.go b/internal/game/core_login_char.go
index 9d7c211..68a0d58 100644
--- a/internal/game/core_login_char.go
+++ b/internal/game/core_login_char.go
@@ -2,7 +2,6 @@ package game
 
 import (
 	"fmt"
-	"os"
 	"strings"
 
 	"thehouseoficarus/internal/net"
@@ -34,33 +33,26 @@ func (g *Game) handleNewCharName(sess *net.Session, input string) {
 		return
 	}
 
+	// Everything below runs on the owner goroutine (session input): the
+	// existence check, file creation, and account publication are one
+	// transaction with no interleaved session input, so a concurrent
+	// creation of the same name cannot slip through the check.
 	if g.AccountStore.CharacterExists(name) {
 		sess.WriteLine("A character with that name already exists.")
 		sess.Write("Character name: ")
 		return
 	}
 
-	p := player.New(name)
-	p.RoomID = g.StartingRoom
-	p.Stats.RecordRoomVisit(g.StartingRoom)
-
-	if err := g.AccountStore.SaveCharacter(p); err != nil {
-		sess.WriteLine(fmt.Sprintf("Error creating character: %v", err))
-		sess.State = net.StateMenu
-		g.showMenu(sess)
-		return
-	}
-
-	acc, err := g.AccountStore.LoadAccount(sess.Account.Name)
+	p, err := g.createCharacterTxn(sess.Account.Name, name, g.StartingRoom)
 	if err != nil {
 		sess.WriteLine(fmt.Sprintf("Error creating character: %v", err))
 		sess.State = net.StateMenu
 		g.showMenu(sess)
 		return
 	}
-	acc.Characters = append(acc.Characters, name)
-	g.AccountStore.SaveAccount(acc)
-	sess.Account.Characters = acc.Characters
+	_ = p
+	sess.Account.Characters = append(sess.Account.Characters, name)
+	g.publishAccountUpdate(sess.Account.Name)
 
 	g.connectCharacter(sess, name)
 
@@ -70,6 +62,29 @@ func (g *Game) handleNewCharName(sess *net.Session, input string) {
 }
 
 func (g *Game) connectCharacter(sess *net.Session, name string) {
+	// This whole function runs as one owner step (invoked from session
+	// input): membership validation, the online check, registry
+	// publication, and room entry are serialized against every other
+	// lifecycle operation, closing the check-then-register gap.
+
+	// Authorize by ownership, not just existence: the character file's
+	// owner must match this account, so a stale cached name cannot connect
+	// a character reassigned to another account.
+	actualName, err := g.canonicalChar(name)
+	if err != nil {
+		sess.WriteLine(fmt.Sprintf("Error loading character: %v", err))
+		sess.State = net.StateMenu
+		g.showMenu(sess)
+		return
+	}
+	if !g.isMemberOf(sess.Account.Name, actualName) {
+		sess.WriteLine("That character does not belong to this account.")
+		sess.State = net.StateMenu
+		g.showMenu(sess)
+		return
+	}
+	name = actualName
+
 	g.charsMu.Lock()
 	if existing := g.loggedInChars[name]; existing != nil {
 		g.charsMu.Unlock()
@@ -87,6 +102,7 @@ func (g *Game) connectCharacter(sess *net.Session, name string) {
 		g.showMenu(sess)
 		return
 	}
+	g.adoptCharacterIdentity(p, sess.Account.Name)
 
 	sess.Player = p
 	sess.State = net.StateGame
@@ -171,49 +187,45 @@ func (g *Game) handleRenameCharName(sess *net.Session, input string) {
 		g.showMenu(sess)
 		return
 	}
-	if g.AccountStore.CharacterExists(newName) {
-		sess.WriteLine("A character with that name already exists.")
-		sess.Write("New name: ")
+
+	// Checks and mutation run as one owner step: no session input can
+	// interleave between the membership/online checks and the file
+	// rename, and the rename is a single journal transaction.
+	actualOld, err := g.canonicalChar(oldName)
+	if err != nil {
+		sess.WriteLine(fmt.Sprintf("Error renaming: %v", err))
+		g.showMenu(sess)
 		return
 	}
-	if g.characterOnline(oldName) {
-		sess.WriteLine("That character is logged in elsewhere. Log them out first.")
+	if !g.isMemberOf(sess.Account.Name, actualOld) {
+		sess.WriteLine(fmt.Sprintf("No character named %s on this account.", oldName))
 		sess.PendingChar = ""
 		g.showMenu(sess)
 		return
 	}
-
-	oldPath := g.AccountStore.CharPath(oldName)
-	newPath := g.AccountStore.CharPath(newName)
-	if err := os.Rename(oldPath, newPath); err != nil {
-		sess.WriteLine(fmt.Sprintf("Error renaming: %v", err))
-		g.showMenu(sess)
+	if newName != actualOld && g.AccountStore.CharacterExists(newName) {
+		sess.WriteLine("A character with that name already exists.")
+		sess.Write("New name: ")
 		return
 	}
-
-	p, _ := g.AccountStore.LoadCharacter(newName)
-	if p != nil {
-		p.Name = newName
-		g.AccountStore.SaveCharacter(p)
+	if g.characterOnline(actualOld) {
+		sess.WriteLine("That character is logged in elsewhere. Log them out first.")
+		sess.PendingChar = ""
+		g.showMenu(sess)
+		return
 	}
 
-	acc, err := g.AccountStore.LoadAccount(sess.Account.Name)
-	if err != nil {
+	if err := g.renameCharacterTxn(sess.Account.Name, actualOld, newName); err != nil {
 		sess.WriteLine(fmt.Sprintf("Error renaming: %v", err))
 		g.showMenu(sess)
 		return
 	}
-	for i, c := range acc.Characters {
-		if c == oldName {
-			acc.Characters[i] = newName
-			break
-		}
-	}
-	g.AccountStore.SaveAccount(acc)
-	sess.Account.Characters = acc.Characters
 
 	sess.PendingChar = ""
-	sess.WriteLine(fmt.Sprintf("%s renamed to %s.", oldName, newName))
+	sess.WriteLine(fmt.Sprintf("%s renamed to %s.", actualOld, newName))
+	// Refresh every session of this account so no stale character list or
+	// pending selection survives the rename.
+	g.publishAccountUpdate(sess.Account.Name)
 	g.showMenu(sess)
 }
 
@@ -256,39 +268,37 @@ func (g *Game) handleDeleteChar(sess *net.Session, input string) {
 		return
 	}
 
-	if g.characterOnline(sess.PendingChar) {
-		sess.WriteLine("That character is logged in elsewhere. Log them out first.")
+	// Checks and mutation run as one owner step; the delete is a single
+	// journal transaction (character file + account list).
+	actualName, err := g.canonicalChar(sess.PendingChar)
+	if err != nil {
+		sess.WriteLine(fmt.Sprintf("Error deleting: %v", err))
 		sess.PendingChar = ""
 		g.showMenu(sess)
 		return
 	}
-
-	charPath := g.AccountStore.CharPath(sess.PendingChar)
-	if err := os.Remove(charPath); err != nil {
-		sess.WriteLine(fmt.Sprintf("Error deleting: %v", err))
+	if !g.isMemberOf(sess.Account.Name, actualName) {
+		sess.WriteLine(fmt.Sprintf("No character named %s on this account.", sess.PendingChar))
+		sess.PendingChar = ""
+		g.showMenu(sess)
+		return
+	}
+	if g.characterOnline(actualName) {
+		sess.WriteLine("That character is logged in elsewhere. Log them out first.")
 		sess.PendingChar = ""
 		g.showMenu(sess)
 		return
 	}
 
-	acc, err := g.AccountStore.LoadAccount(sess.Account.Name)
-	if err != nil {
+	if err := g.deleteCharacterTxn(sess.Account.Name, actualName); err != nil {
 		sess.WriteLine(fmt.Sprintf("Error deleting: %v", err))
 		sess.PendingChar = ""
 		g.showMenu(sess)
 		return
 	}
-	var newChars []string
-	for _, c := range acc.Characters {
-		if c != sess.PendingChar {
-			newChars = append(newChars, c)
-		}
-	}
-	acc.Characters = newChars
-	g.AccountStore.SaveAccount(acc)
-	sess.Account.Characters = newChars
 
-	sess.WriteLine(fmt.Sprintf("%s has been deleted.", sess.PendingChar))
+	sess.WriteLine(fmt.Sprintf("%s has been deleted.", actualName))
 	sess.PendingChar = ""
+	g.publishAccountUpdate(sess.Account.Name)
 	g.showMenu(sess)
 }
diff --git a/internal/game/economy.go b/internal/game/economy.go
new file mode 100644
index 0000000..90c24ed
--- /dev/null
+++ b/internal/game/economy.go
@@ -0,0 +1,289 @@
+package game
+
+// The economy journal: durable, idempotent money movement. Every casino
+// wager and payout writes a journal record BEFORE the balance mutation,
+// then the character save makes the balance durable, then the record is
+// settled. A crash at any point leaves either:
+//   - an open record with the character file at its pre-transaction state
+//     (crash before save) — recovery settles it as void (debit) or applies
+//     it (payout, which the player is owed); or
+//   - an open record with the character file at its post-transaction state
+//     (crash after save) — recovery refunds open debit records (the round
+//     state was lost in the crash, so the stake returns) and voids payout
+//     records that are already durable.
+//
+// The reducer folds journal lines by record ID (later lines win), so
+// settlement markers are idempotent appends. Recovery runs once at startup
+// before any session can join; compaction rewrites the journal keeping only
+// open records (normally none).
+
+import (
+	"bufio"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"thehouseoficarus/internal/player"
+)
+
+type economyRecord struct {
+	ID     string    `json:"id"`
+	Player string    `json:"player"`
+	Kind   string    `json:"kind"` // "wager" or "payout"
+	Chips  int       `json:"chips"`
+	Credit int       `json:"credits"`
+	Status string    `json:"status"` // "open", "settled", "void"
+	TS     time.Time `json:"ts"`
+
+	// Balance checkpoints used to decide recovery compensation.
+	CreditsBefore int `json:"credits_before"`
+	CreditsAfter  int `json:"credits_after"`
+	ChipsBefore   int `json:"chips_before"`
+	ChipsAfter    int `json:"chips_after"`
+}
+
+type economyJournal struct {
+	path string
+}
+
+func newEconomyJournal(dataDir string) *economyJournal {
+	dir := filepath.Join(dataDir, "economy")
+	_ = os.MkdirAll(dir, 0700)
+	return &economyJournal{path: filepath.Join(dir, "journal.jsonl")}
+}
+
+func newEconomyRecordID() string {
+	var b [8]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		panic(fmt.Sprintf("economy record id: %v", err))
+	}
+	return hex.EncodeToString(b[:])
+}
+
+// append writes one durable line. Errors are returned to the caller, which
+// must treat the transaction as failed.
+func (j *economyJournal) append(rec economyRecord) error {
+	rec.TS = time.Now()
+	data, err := json.Marshal(rec)
+	if err != nil {
+		return err
+	}
+	f, err := os.OpenFile(j.path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
+	if err != nil {
+		return fmt.Errorf("open economy journal: %w", err)
+	}
+	defer f.Close()
+	if _, err := f.Write(append(data, '\n')); err != nil {
+		return fmt.Errorf("append economy journal: %w", err)
+	}
+	if err := f.Sync(); err != nil {
+		return fmt.Errorf("sync economy journal: %w", err)
+	}
+	return nil
+}
+
+// start opens a durable record for the in-flight transaction.
+func (j *economyJournal) start(kind string, p *player.Player, chips, credits, creditsBefore, creditsAfter, chipsBefore, chipsAfter int) (*economyRecord, error) {
+	rec := &economyRecord{
+		ID:            newEconomyRecordID(),
+		Player:        p.Name,
+		Kind:          kind,
+		Chips:         chips,
+		Credit:        credits,
+		Status:        "open",
+		CreditsBefore: creditsBefore,
+		CreditsAfter:  creditsAfter,
+		ChipsBefore:   chipsBefore,
+		ChipsAfter:    chipsAfter,
+	}
+	if err := j.append(*rec); err != nil {
+		return nil, err
+	}
+	return rec, nil
+}
+
+// settle marks a record settled (the balance mutation is durable).
+func (j *economyJournal) settle(rec *economyRecord) {
+	rec.Status = "settled"
+	_ = j.append(*rec)
+}
+
+// void marks a record void (the mutation was reverted in memory and never
+// became durable; recovery must not compensate).
+func (j *economyJournal) void(rec *economyRecord) {
+	rec.Status = "void"
+	_ = j.append(*rec)
+}
+
+// loadOpen folds the journal and returns the still-open records.
+func (j *economyJournal) loadOpen() []*economyRecord {
+	f, err := os.Open(j.path)
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+	latest := map[string]*economyRecord{}
+	scanner := bufio.NewScanner(f)
+	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	for scanner.Scan() {
+		line := scanner.Bytes()
+		if len(line) == 0 {
+			continue
+		}
+		var rec economyRecord
+		if err := json.Unmarshal(line, &rec); err != nil {
+			// A torn final line (crash mid-append) is not a valid record;
+			// skip it. Appends are small and single-line, so only the last
+			// line can be torn.
+			continue
+		}
+		latest[rec.ID] = &rec
+	}
+	var open []*economyRecord
+	for _, rec := range latest {
+		if rec.Status == "open" {
+			open = append(open, rec)
+		}
+	}
+	return open
+}
+
+// compact rewrites the journal keeping only still-open records.
+func (j *economyJournal) compact() {
+	open := j.loadOpen()
+	tmp := j.path + ".compact"
+	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
+	if err != nil {
+		return
+	}
+	defer os.Remove(tmp)
+	w := bufio.NewWriter(f)
+	for _, rec := range open {
+		rec.TS = time.Now()
+		data, err := json.Marshal(rec)
+		if err != nil {
+			continue
+		}
+		w.Write(data)
+		w.WriteByte('\n')
+	}
+	if err := w.Flush(); err != nil {
+		f.Close()
+		return
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		return
+	}
+	f.Close()
+	// Best-effort atomic-ish replacement; a torn compaction leaves the
+	// original file intact.
+	if err := os.Rename(tmp, j.path); err != nil {
+		os.Remove(tmp)
+	}
+}
+
+// giveChips re-credits chips to a player's inventory (used by recovery
+// refunds). Stacks onto an existing chips slot when one exists.
+func (g *Game) giveChips(p *player.Player, qty int) {
+	for _, slot := range p.Inventory {
+		if slot != nil && slot.ItemID == "chips" {
+			slot.Quantity += qty
+			return
+		}
+	}
+	slot := p.FirstFreeSlot()
+	if slot >= 0 {
+		p.SetInvSlot(slot, &player.InventorySlot{ItemID: "chips", Quantity: qty})
+	}
+}
+
+// payCreditsDurable applies a checked credit increase and persists it.
+func (g *Game) payCreditsDurable(p *player.Player, amount int) error {
+	if amount < 0 {
+		return fmt.Errorf("negative payout %d", amount)
+	}
+	sum, err := addCreditsChecked(p.Credits, amount)
+	if err != nil {
+		return err
+	}
+	p.Credits = sum
+	return g.AccountStore.SaveCharacter(p)
+}
+
+// addCreditsChecked is the game-side checked addition against the economy
+// cap (mirrors casino.MaxCredits; kept local to avoid a dependency cycle).
+func addCreditsChecked(a, b int) (int, error) {
+	const maxCredits = 1_000_000_000_000
+	if b > 0 && a > maxCredits-b {
+		return maxCredits, fmt.Errorf("credit overflow: %d + %d exceeds %d", a, b, maxCredits)
+	}
+	if b < 0 {
+		return 0, fmt.Errorf("negative credit add %d", b)
+	}
+	return a + b, nil
+}
+
+// recoverEconomy compensates open records from the last crash. It is called
+// once from New, before any session connects.
+func (g *Game) recoverEconomy() {
+	if g.Economy == nil {
+		return
+	}
+	records := g.Economy.loadOpen()
+	compensated := 0
+	for _, rec := range records {
+		p, err := g.AccountStore.LoadCharacter(rec.Player)
+		if err != nil {
+			// Character file unreadable: leave the record open so a later
+			// attempt (or operator inspection) can resolve it; do not
+			// silently drop money.
+			fmt.Fprintf(os.Stderr, "economy recovery: load %s: %v\n", rec.Player, err)
+			continue
+		}
+		switch {
+		case rec.Kind == "wager" && p.Credits == rec.CreditsBefore:
+			// The debit never became durable: void it.
+			g.Economy.void(rec)
+		case rec.Kind == "wager" && p.Credits == rec.CreditsAfter:
+			// The debit is durable but the round was lost in the crash:
+			// refund the stake (approved refund-on-recovery policy).
+			chips, credits := rec.Chips, rec.Credit
+			p.Credits += credits
+			if chips > 0 {
+				g.giveChips(p, chips)
+			}
+			if err := g.AccountStore.SaveCharacter(p); err != nil {
+				fmt.Fprintf(os.Stderr, "economy recovery: refund save %s: %v\n", p.Name, err)
+				continue
+			}
+			g.Economy.settle(rec)
+			compensated++
+		case rec.Kind == "wager":
+			// Balance moved past the recorded checkpoint: cannot compensate
+			// reliably; surface for operator inspection.
+			fmt.Fprintf(os.Stderr, "economy recovery: ambiguous wager %s for %s (credits %d, want before %d or after %d)\n",
+				rec.ID, rec.Player, p.Credits, rec.CreditsBefore, rec.CreditsAfter)
+			g.Economy.void(rec)
+		case rec.Kind == "payout" && p.Credits == rec.CreditsBefore:
+			// The payout was lost in the crash: the player is owed it.
+			if err := g.payCreditsDurable(p, rec.Credit); err != nil {
+				fmt.Fprintf(os.Stderr, "economy recovery: payout save %s: %v\n", p.Name, err)
+				continue
+			}
+			g.Economy.settle(rec)
+			compensated++
+		case rec.Kind == "payout" && p.Credits == rec.CreditsAfter:
+			g.Economy.settle(rec)
+		case rec.Kind == "payout":
+			fmt.Fprintf(os.Stderr, "economy recovery: ambiguous payout %s for %s (credits %d, want before %d or after %d)\n",
+				rec.ID, rec.Player, p.Credits, rec.CreditsBefore, rec.CreditsAfter)
+			g.Economy.settle(rec)
+		}
+	}
+	g.Economy.compact()
+}
diff --git a/internal/game/economy_shutdown_test.go b/internal/game/economy_shutdown_test.go
new file mode 100644
index 0000000..bd6c253
--- /dev/null
+++ b/internal/game/economy_shutdown_test.go
@@ -0,0 +1,263 @@
+package game
+
+// Durable-money and graceful-shutdown regressions: journal-first wagers
+// with revert on save failure, startup recovery that refunds lost wagers
+// and re-pays lost payouts, checked currency arithmetic, and a shutdown
+// that persists online characters.
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"thehouseoficarus/internal/casino"
+	"thehouseoficarus/internal/config"
+	"thehouseoficarus/internal/net"
+	"thehouseoficarus/internal/player"
+
+	"gopkg.in/yaml.v3"
+)
+
+// harnessFromDir builds a Game over an existing directory (used when tests
+// must pre-seed character files and journal records before startup).
+func harnessFromDir(t *testing.T, dir string) *harness {
+	t.Helper()
+	colors := &config.ColorsConfig{}
+	g := New(dir, colors, colors, config.ValidationConfig{}, 1)
+	hub := net.NewHub()
+	g.SetHub(hub)
+	stopTick := make(chan struct{})
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		tick := time.NewTicker(2 * time.Millisecond)
+		defer tick.Stop()
+		for {
+			select {
+			case <-tick.C:
+				g.Ticks.Tick()
+			case <-stopTick:
+				return
+			}
+		}
+	}()
+	h := &harness{
+		t: t, dir: dir, g: g, hub: hub,
+		sessions: make(map[string]*net.Session),
+		conns:    make(map[string]*chanConn),
+	}
+	h.stop = func() { close(stopTick); <-done }
+	t.Cleanup(h.stop)
+	return h
+}
+
+func writeSeedFile(t *testing.T, path string, data []byte) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, data, 0600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func writeEconomyJournal(t *testing.T, dir string, records []economyRecord) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Join(dir, "economy"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	var data []byte
+	for _, rec := range records {
+		line, err := json.Marshal(rec)
+		if err != nil {
+			t.Fatal(err)
+		}
+		data = append(data, line...)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "economy", "journal.jsonl"), data, 0600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestEconomyWagerDebitsDurallyAndSettles(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	p := h.seedCharacter("alice", "alice")
+	h.g.RunOnOwner(func() {
+		p.Credits = 100
+	})
+	w := casinoWallet{g: h.g, p: p}
+
+	var wagerErr error
+	h.g.RunOnOwner(func() {
+		_, wagerErr = w.Wager(10)
+	})
+	h.barrier()
+	if wagerErr != nil {
+		t.Fatalf("wager failed: %v", wagerErr)
+	}
+	if p.Credits != 90 {
+		t.Fatalf("credits after wager = %d, want 90", p.Credits)
+	}
+	// The journal must show the record settled (debit is durable).
+	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+		t.Fatalf("open records remain after a successful wager: %v", open)
+	}
+}
+
+func TestEconomyFailedSaveRevertsAndVoids(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	p := h.seedCharacter("alice", "alice")
+	h.g.RunOnOwner(func() {
+		p.Credits = 100
+	})
+
+	// Make character saves fail: read-only characters directory.
+	charDir := filepath.Join(h.dir, "players", "characters")
+	if err := os.Chmod(charDir, 0500); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.Chmod(charDir, 0700) })
+
+	var wagerErr error
+	h.g.RunOnOwner(func() {
+		_, wagerErr = casinoWallet{g: h.g, p: p}.Wager(10)
+	})
+	h.barrier()
+	if wagerErr != casino.ErrWalletPersistence {
+		t.Fatalf("wager error = %v, want ErrWalletPersistence", wagerErr)
+	}
+	// The in-memory mutation must have been reverted: nothing was charged.
+	if p.Credits != 100 {
+		t.Fatalf("credits after failed wager = %d, want 100 (reverted)", p.Credits)
+	}
+	// The record is void, not open: recovery must not compensate.
+	os.Chmod(charDir, 0700)
+	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+		t.Fatalf("void record remained open: %v", open)
+	}
+}
+
+func TestEconomyRecoveryRefundsDurableLostWager(t *testing.T) {
+	dir := t.TempDir()
+	seedWorld(t, dir)
+
+	// Character with the debit already durable (crash after save).
+	hash, _ := player.HashPassword("pw")
+	accData, _ := yaml.Marshal(&player.Account{Name: "alice", PasswordHash: hash})
+	writeSeedFile(t, filepath.Join(dir, "players", "accounts", "alice.yaml"), accData)
+	p := player.New("alice")
+	p.Credits = 90 // post-debit balance
+	p.Account = "alice"
+	pData, _ := yaml.Marshal(p)
+	writeSeedFile(t, filepath.Join(dir, "players", "characters", "alice.yaml"), pData)
+
+	// Open wager record: 10 credits debited (before=100, after=90).
+	writeEconomyJournal(t, dir, []economyRecord{{
+		ID: "lost-wager", Player: "alice", Kind: "wager",
+		Chips: 0, Credit: 10, Status: "open",
+		CreditsBefore: 100, CreditsAfter: 90,
+		ChipsBefore: 0, ChipsAfter: 0,
+	}})
+
+	h := harnessFromDir(t, dir)
+	// Recovery must refund the stake: credits back to 100.
+	loaded, err := h.g.AccountStore.LoadCharacter("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.Credits != 100 {
+		t.Fatalf("credits after recovery = %d, want 100 (refund)", loaded.Credits)
+	}
+	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+		t.Fatalf("recovered record left open: %v", open)
+	}
+}
+
+func TestEconomyRecoveryAppliesLostPayout(t *testing.T) {
+	dir := t.TempDir()
+	seedWorld(t, dir)
+
+	// Character at pre-payout balance; the payout was journaled but the
+	// save never happened (crash before save). The player is owed it.
+	hash, _ := player.HashPassword("pw")
+	accData, _ := yaml.Marshal(&player.Account{Name: "bob", PasswordHash: hash})
+	writeSeedFile(t, filepath.Join(dir, "players", "accounts", "bob.yaml"), accData)
+	p := player.New("bob")
+	p.Credits = 50
+	p.Account = "bob"
+	pData, _ := yaml.Marshal(p)
+	writeSeedFile(t, filepath.Join(dir, "players", "characters", "bob.yaml"), pData)
+
+	writeEconomyJournal(t, dir, []economyRecord{{
+		ID: "lost-payout", Player: "bob", Kind: "payout",
+		Chips: 0, Credit: 25, Status: "open",
+		CreditsBefore: 50, CreditsAfter: 75,
+		ChipsBefore: 0, ChipsAfter: 0,
+	}})
+
+	h := harnessFromDir(t, dir)
+	loaded, err := h.g.AccountStore.LoadCharacter("bob")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.Credits != 75 {
+		t.Fatalf("credits after recovery = %d, want 75 (payout re-applied)", loaded.Credits)
+	}
+	if open := h.g.Economy.loadOpen(); len(open) != 0 {
+		t.Fatalf("recovered record left open: %v", open)
+	}
+}
+
+func TestShutdownSavesOnlineCharactersAndRefundsWagers(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	h.seedAccount("bob", "pw", false)
+	h.seedCharacter("alice", "alice")
+	h.seedCharacter("bob", "bob")
+	sA, _ := h.connect("alice")
+	pA := sA.Player
+	sB, _ := h.connect("bob")
+	pB := sB.Player
+
+	// bob sits at a machine with a committed stake; shutdown must refund.
+	h.g.RunOnOwner(func() {
+		pB.Credits = 100
+		h.g.Casino.JoinMachine(1, casino.MachineConfig{ID: "slots", Game: casino.GameSlots, MinBet: 1}, "bob")
+		h.g.Casino.SetMachineBet(1, "slots", "bob", 20, casinoWallet{g: h.g, p: pB})
+	})
+	h.barrier()
+	if pB.Credits != 80 {
+		t.Fatalf("bob's credits after wager = %d, want 80", pB.Credits)
+	}
+
+	transportClosed := make(chan struct{})
+	h.g.SetTransportStop(func() { close(transportClosed) })
+	h.g.RequestShutdown("test")
+	// The shutdown goroutine closes the transports at the end of the
+	// ordered sequence; block for it.
+	select {
+	case <-transportClosed:
+	case <-time.After(5 * time.Second):
+		t.Fatal("transport stop was never invoked during shutdown")
+	}
+
+	// Both characters must be saved with the wager refunded.
+	loadedA, err := h.g.AccountStore.LoadCharacter("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loadedA.Credits != pA.Credits {
+		t.Fatalf("alice save mismatch: file %d, memory %d", loadedA.Credits, pA.Credits)
+	}
+	loadedB, err := h.g.AccountStore.LoadCharacter("bob")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loadedB.Credits != 100 {
+		t.Fatalf("bob's file = %d, want 100 (stake refunded at shutdown)", loadedB.Credits)
+	}
+}
diff --git a/internal/game/exit_migrate.go b/internal/game/exit_migrate.go
index ff905f6..db70c8d 100644
--- a/internal/game/exit_migrate.go
+++ b/internal/game/exit_migrate.go
@@ -112,11 +112,11 @@ func rekeyIntMap[V any](m map[int]V, idMap map[int]int) bool {
 	return true
 }
 
-// RewriteRoomIDs is the shared entry point called by every room-ID change path
-// (the swapid command and the admin web GUI rename) to migrate room-ID-embedded
+// RewriteRoomIDs is the shared entry point called by every room-ID change
+// path (the swapid command and the admin web GUI rename) to migrate room-ID-embedded
 // state across all characters. Online players are updated in memory (and
-// re-saved); offline characters are loaded, rewritten, and saved. It follows
-// the same cross-goroutine mutation precedent as cmd_undig/cmd_summon.
+// re-saved); offline characters are loaded, rewritten, and saved. Callers
+// must be on the owner goroutine (use MigrateRoomIDs from other goroutines).
 func (g *Game) RewriteRoomIDs(idMap map[int]int) {
 	if len(idMap) == 0 {
 		return
@@ -150,3 +150,34 @@ func (g *Game) RewriteRoomIDs(idMap map[int]int) {
 		}
 	}
 }
+
+// MigrateRoomIDs is the complete room-ID migration entry point for other
+// goroutines (the admin API and swapid command): player state, Hub room
+// buckets, casino room keys, world room-keyed runtime state, and live mob
+// instances all move together under one owner task. This is what makes a
+// live rename leave NO gameplay or broadcast attached to the old location.
+func (g *Game) MigrateRoomIDs(idMap map[int]int) {
+	if len(idMap) == 0 {
+		return
+	}
+	g.RunOnOwner(func() {
+		g.migrateRoomIDsLocked(idMap)
+	})
+}
+
+// migrateRoomIDsLocked performs the full runtime migration; caller must
+// already be on the owner goroutine.
+func (g *Game) migrateRoomIDsLocked(idMap map[int]int) {
+	if g.Hub != nil {
+		g.Hub.RekeyRooms(idMap)
+	}
+	if g.Casino != nil {
+		g.Casino.RekeyRooms(idMap)
+	}
+	g.World.RekeyRooms(idMap)
+	g.MobStore.RekeyRooms(idMap)
+	// The file paths changed under the world: rebuild its room index so
+	// lookups agree with the post-migration layout.
+	g.World.RebuildRoomIndex(g.DataDir)
+	g.RewriteRoomIDs(idMap)
+}
diff --git a/internal/game/game.go b/internal/game/game.go
index 822042e..7f29d1f 100644
--- a/internal/game/game.go
+++ b/internal/game/game.go
@@ -2,6 +2,7 @@ package game
 
 import (
 	"fmt"
+	"log"
 	"path/filepath"
 	"sort"
 	"strings"
@@ -76,9 +77,26 @@ type Game struct {
 	sequences         map[string]*sequence
 	globalSeqs        []*sequence
 
-	shutdownCancel chan struct{}
-	shutdownActive bool
-	shutdownMu     sync.Mutex
+	shutdownMu sync.Mutex
+
+	// shutdownOnce guards RequestShutdown; transportStop is the registered
+	// hook that closes the network transports (set by main at startup).
+	shutdownOnce  sync.Once
+	shutdownRun   *scheduledShutdown
+	shutdownHook  func(reason string)
+	transportStop func()
+
+	// Economy is the durable money journal; see economy.go.
+	Economy *economyJournal
+
+	// owner serializes all live-state mutations; see owner.go.
+	owner     *owner
+	ownerStop sync.Once
+
+	// shuttingDown disables disconnect forfeit/save callbacks while the
+	// graceful shutdown sequence owns final persistence.
+	shuttingDownMu sync.Mutex
+	shuttingDown   bool
 }
 
 func New(dataDir string, colorConfig *config.ColorsConfig, constantColorConfig *config.ColorsConfig, valConfig config.ValidationConfig, startingRoom int) *Game {
@@ -111,12 +129,25 @@ func New(dataDir string, colorConfig *config.ColorsConfig, constantColorConfig *
 		hackingStates:    make(map[string]*hacking.Session),
 		sequences:        make(map[string]*sequence),
 	}
+	g.owner = newOwner()
+	// Runtime assignment (not initializer-level) so the command registry,
+	// which statically references executeShutdown, cannot form an
+	// initialization cycle with the shutdown coordinator.
+	g.shutdownHook = g.RequestShutdown
+	g.Economy = newEconomyJournal(dataDir)
+	// Compensate open money records from any prior crash before any
+	// session can connect.
+	g.recoverEconomy()
 	g.CourseStore.SetWorld(g.World)
 	g.CourseStore.LoadAll()
 	g.LoadMods()
 	g.LoadTechs()
 	g.buildCraftIndex()
 	g.loadAllFlagTriggers()
+	// Journal recovery before any store reads files a leftover transaction
+	// may reference, then one-time stable-identity migration.
+	g.recoverJournals()
+	g.backfillCharacterIDs()
 	g.ValidateAndLog()
 	return g
 }
@@ -124,30 +155,141 @@ func New(dataDir string, colorConfig *config.ColorsConfig, constantColorConfig *
 func (g *Game) SetHub(hub *net.Hub) {
 	g.Hub = hub
 	hub.OnRemove(func(sess *net.Session) {
-		if p := sess.Player; p != nil {
-			g.restoreGodPlayer(p)
-			g.persistLockedOnDisconnect(p)
-			g.AccountStore.SaveCharacter(p)
-			p.DeactivateAllTechs()
-			g.charsMu.Lock()
-			delete(g.loggedInChars, p.Name)
-			g.charsMu.Unlock()
-			delete(g.hackingStates, p.Name)
-			if ss, ok := g.safespot.Get(p.Name); ok {
-				g.forceLeaveSafespot(sess, p, &ss, "")
+		// Runs on the connection/tick goroutine that removed the session;
+		// the callback itself mutates live game state, so it executes on
+		// the owner. During shutdown this callback is suppressed: the
+		// shutdown sequence has already persisted everyone.
+		g.run(func() {
+			if g.isShuttingDown() {
+				return
 			}
-		}
+			if p := sess.Player; p != nil {
+				g.restoreGodPlayer(p)
+				g.persistLockedOnDisconnect(p)
+				g.AccountStore.SaveCharacter(p)
+				p.DeactivateAllTechs()
+				g.detachSession(p.Name)
+				delete(g.hackingStates, p.Name)
+				if ss, ok := g.safespot.Get(p.Name); ok {
+					g.forceLeaveSafespot(sess, p, &ss, "")
+				}
+			}
+		})
 	})
 	hub.OnDisconnect(func(sess *net.Session) {
-		if sess.Player != nil {
-			g.emitCasinoEvents(g.Casino.MarkDisconnected(sess.Player.Name))
-		}
+		g.run(func() {
+			if sess.Player != nil {
+				g.emitCasinoEvents(g.Casino.MarkDisconnected(sess.Player.Name))
+			}
+		})
 	})
 	g.GlobalFlags.OnChange(func(name string, value any) {
+		// Fire flag triggers synchronously on the caller; global-flag writes
+		// all happen on the owner (game commands) or via the admin API which
+		// is routed through the owner, so a nested run() would deadlock.
 		g.fireGlobalFlagTriggers(name, value)
 	})
 }
 
+// RequestShutdown begins the graceful shutdown sequence exactly once; both
+// SIGINT/SIGTERM and the in-game shutdown command converge here. It returns
+// immediately: the sequence runs on a fresh goroutine (never the owner, so
+// its owner tasks cannot deadlock), performs the ordered drain, and closes
+// the transports at the end. main then simply returns.
+func (g *Game) RequestShutdown(reason string) {
+	g.shutdownOnce.Do(func() {
+		g.setShuttingDown()
+		go func() {
+			log.Printf("shutdown requested: %s", reason)
+			g.runShutdown()
+		}()
+	})
+}
+
+// SetTransportStop registers the hook that closes network transports during
+// shutdown. main wires it to (*net.Server).Shutdown.
+func (g *Game) SetTransportStop(stop func()) {
+	g.transportStop = stop
+}
+
+// runShutdown executes the ordered shutdown sequence:
+//
+//  1. Admissions stop: setShuttingDown already makes session input and
+//     disconnect forfeit/save callbacks no-ops (all handlers are owner
+//     tasks; the owner still drains what was accepted).
+//  2. Stop the tick engine AND join the in-flight callback.
+//  3. On the owner: drain remaining queued commands, refund outstanding
+//     wagers, save every online character. Disconnect-forfeit does not run:
+//     this is a server-initiated shutdown, not a player disconnect.
+//  4. Stop the owner loop.
+//  5. Close transports (sessions flush their outbound queues first).
+func (g *Game) runShutdown() {
+	g.broadcastLoggedIn("[Server] Shutting down. Your progress is being saved.")
+
+	// Join the running tick so the last tick's mutations are complete.
+	g.Ticks.StopAndWait()
+
+	var saveErr error
+	g.RunOnOwner(func() {
+		g.ProcessQueuedCommands()
+		if g.Casino != nil {
+			g.emitCasinoEvents(g.Casino.RefundAll())
+		}
+		if err := g.saveAllOnlineCharacters(); err != nil {
+			saveErr = err
+		}
+	})
+	if saveErr != nil {
+		log.Printf("shutdown: final save failed: %v", saveErr)
+	}
+
+	g.stopOwner()
+
+	if g.transportStop != nil {
+		g.transportStop()
+	}
+	log.Println("shutdown complete")
+}
+
+// saveAllOnlineCharacters persists every online player exactly once under
+// owner ownership. The first error is reported to the operator; remaining
+// characters are still saved.
+func (g *Game) saveAllOnlineCharacters() error {
+	if g.Hub == nil {
+		return nil
+	}
+	var firstErr error
+	for _, sess := range g.Hub.AllSessions() {
+		if p := sess.Player; p != nil {
+			g.restoreGodPlayer(p)
+			g.persistLockedOnDisconnect(p)
+			if err := g.AccountStore.SaveCharacter(p); err != nil && firstErr == nil {
+				firstErr = fmt.Errorf("save %s: %w", p.Name, err)
+			}
+		}
+	}
+	return firstErr
+}
+
+// HandleSessionOnOwner is the entry point handed to the network server:
+// connection goroutines submit one task per input line, so all game state
+// mutation executes on the owner goroutine.
+func (g *Game) HandleSessionOnOwner(sess *net.Session, input string) {
+	g.RunOnOwner(func() {
+		g.HandleSession(sess, input)
+	})
+}
+
+// RunOnOwner executes fn on the owner goroutine and waits for completion.
+// Network and admin goroutines must route every live-state mutation through
+// this; code already running on the owner must not call it (it would
+// deadlock waiting for itself). Alias of Game.run with an exported name.
+func (g *Game) RunOnOwner(fn func()) {
+	g.run(fn)
+}
+
+// HandleSession dispatches one line of session input by state. Callers must
+// already be on the owner goroutine (use HandleSessionOnOwner otherwise).
 func (g *Game) HandleSession(sess *net.Session, input string) {
 	input = player.StripControlCharacters(input)
 	switch sess.State {
@@ -200,6 +342,45 @@ func (g *Game) HandleSession(sess *net.Session, input string) {
 	}
 }
 
+// SubscribeTicks registers a dynamic per-tick callback that executes on the
+// owner goroutine, preserving registration-ID order relative to the master
+// subscriber and other subscribers. Game code must use this instead of
+// engine.Subscribe directly so tick callbacks cannot race session input.
+func (g *Game) SubscribeTicks(interval int, cb func() bool) uint64 {
+	if g.owner == nil {
+		return g.Ticks.Subscribe(interval, cb)
+	}
+	return g.Ticks.Subscribe(interval, func() bool {
+		keep := false
+		g.run(func() { keep = cb() })
+		return keep
+	})
+}
+
+// isShuttingDown reports whether the graceful shutdown sequence has taken
+// ownership of final persistence.
+func (g *Game) isShuttingDown() bool {
+	g.shuttingDownMu.Lock()
+	defer g.shuttingDownMu.Unlock()
+	return g.shuttingDown
+}
+
+// setShuttingDown flips the shutdown ownership flag exactly once.
+func (g *Game) setShuttingDown() {
+	g.shuttingDownMu.Lock()
+	g.shuttingDown = true
+	g.shuttingDownMu.Unlock()
+}
+
+// EvictCasinoRoom evicts every cached table/machine in roomID (refund
+// semantics per casino.Manager.EvictRoom). Callers must be on the owner
+// goroutine.
+func (g *Game) EvictCasinoRoom(roomID int) {
+	if g.Casino != nil {
+		g.emitCasinoEvents(g.Casino.EvictRoom(roomID))
+	}
+}
+
 func (g *Game) writePrompt(sess *net.Session) {
 	sess.WritePrompt(g.promptStr(sess))
 }
diff --git a/internal/game/harness_test.go b/internal/game/harness_test.go
new file mode 100644
index 0000000..7898af2
--- /dev/null
+++ b/internal/game/harness_test.go
@@ -0,0 +1,266 @@
+package game
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"thehouseoficarus/internal/config"
+	"thehouseoficarus/internal/net"
+	"thehouseoficarus/internal/player"
+)
+
+// chanConn is a test Conn whose reads come from a channel, so a session's
+// input loop can run on its own goroutine exactly like the real server's
+// connection goroutine. Writes are recorded in a mutex-guarded buffer and may
+// optionally be gated to simulate a slow/stalled client.
+type chanConn struct {
+	mu     sync.Mutex
+	out    []byte
+	in     chan string
+	closed chan struct{}
+	once   sync.Once
+
+	// writeGate, when non-nil, blocks every Write until released.
+	writeGate chan struct{}
+}
+
+func newChanConn() *chanConn {
+	return &chanConn{in: make(chan string, 64), closed: make(chan struct{})}
+}
+
+func (c *chanConn) ReadMessage() (string, error) {
+	select {
+	case line := <-c.in:
+		return line, nil
+	case <-c.closed:
+		return "", fmt.Errorf("connection closed")
+	}
+}
+
+func (c *chanConn) Write(b []byte) (int, error) {
+	if c.writeGate != nil {
+		select {
+		case <-c.writeGate:
+		case <-c.closed:
+			return 0, fmt.Errorf("write on closed conn")
+		}
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.out = append(c.out, b...)
+	return len(b), nil
+}
+
+func (c *chanConn) Close() error {
+	c.once.Do(func() { close(c.closed) })
+	return nil
+}
+
+func (c *chanConn) SetWriteDeadline(time.Time) error { return nil }
+
+func (c *chanConn) SetEcho(bool) error { return nil }
+
+func (c *chanConn) Bytes() []byte {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return append([]byte(nil), c.out...)
+}
+
+func (c *chanConn) Contains(substr string) bool {
+	return strings.Contains(string(c.Bytes()), substr)
+}
+
+// send queues an input line for ReadMessage. No-op after close.
+func (c *chanConn) send(line string) {
+	select {
+	case c.in <- line:
+	case <-c.closed:
+	}
+}
+
+// harness wires a real Game (temp data dir) to fake transports driven from
+// per-connection goroutines plus a competing tick goroutine, reproducing the
+// production entry-point concurrency: session input, disconnect callbacks, and
+// tick callbacks all touching shared state at once.
+type harness struct {
+	t    *testing.T
+	dir  string
+	g    *Game
+	hub  *net.Hub
+	stop func()
+
+	mu       sync.Mutex
+	sessions map[string]*net.Session
+	conns    map[string]*chanConn
+}
+
+func newHarness(t *testing.T) *harness {
+	t.Helper()
+	dir := t.TempDir()
+	seedWorld(t, dir)
+	colors := &config.ColorsConfig{}
+	g := New(dir, colors, colors, config.ValidationConfig{}, 1)
+	hub := net.NewHub()
+	g.SetHub(hub)
+
+	stopTick := make(chan struct{})
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		tick := time.NewTicker(2 * time.Millisecond)
+		defer tick.Stop()
+		for {
+			select {
+			case <-tick.C:
+				g.Ticks.Tick()
+			case <-stopTick:
+				return
+			}
+		}
+	}()
+
+	h := &harness{
+		t: t, dir: dir, g: g, hub: hub,
+		sessions: make(map[string]*net.Session),
+		conns:    make(map[string]*chanConn),
+	}
+	h.stop = func() { close(stopTick); <-done }
+	t.Cleanup(h.stop)
+	return h
+}
+
+// seedWorld writes the minimal on-disk content a Game needs: three rooms.
+func seedWorld(t *testing.T, dir string) {
+	t.Helper()
+	for _, d := range []string{"rooms", "players/accounts", "players/characters"} {
+		if err := os.MkdirAll(filepath.Join(dir, d), 0755); err != nil {
+			t.Fatalf("mkdir %s: %v", d, err)
+		}
+	}
+	files := map[string]string{
+		"rooms/1.yaml": "id: 1\nname: Central\nexits:\n  north:\n    room: 2\n",
+		"rooms/2.yaml": "id: 2\nname: North\nexits:\n  south:\n    room: 1\n",
+		"rooms/3.yaml": "id: 3\nname: East\n",
+	}
+	for path, content := range files {
+		if err := os.WriteFile(filepath.Join(dir, path), []byte(content), 0644); err != nil {
+			t.Fatalf("seed %s: %v", path, err)
+		}
+	}
+}
+
+// seedAccount writes an account file directly (bypassing the login menu).
+func (h *harness) seedAccount(name, password string, admin bool) {
+	t := h.t
+	hash, err := player.HashPassword(password)
+	if err != nil {
+		t.Fatalf("hash: %v", err)
+	}
+	acc := &player.Account{Name: name, PasswordHash: hash, Admin: admin}
+	if err := h.g.AccountStore.SaveAccount(acc); err != nil {
+		t.Fatalf("seed account %s: %v", name, err)
+	}
+}
+
+// seedCharacter writes a character file owned by the named account.
+func (h *harness) seedCharacter(charName, accountName string) *player.Player {
+	t := h.t
+	p := player.New(charName)
+	p.RoomID = 1
+	p.Account = accountName
+	if err := h.g.AccountStore.SaveCharacter(p); err != nil {
+		t.Fatalf("seed character %s: %v", charName, err)
+	}
+	acc, err := h.g.AccountStore.LoadAccount(accountName)
+	if err != nil {
+		t.Fatalf("load account %s: %v", accountName, err)
+	}
+	acc.Characters = append(acc.Characters, charName)
+	if err := h.g.AccountStore.SaveAccount(acc); err != nil {
+		t.Fatalf("save account: %v", err)
+	}
+	return p
+}
+
+// connect registers a live in-game session directly, bypassing the login
+// menu. The session is put into queued-write mode (like real transports) and
+// its input is dispatched through the owner entry point, matching production
+// concurrency exactly. Tests that exercise the menu drive handleAccountName
+// themselves.
+func (h *harness) connect(name string) (*net.Session, *chanConn) {
+	t := h.t
+	acc, err := h.g.AccountStore.LoadAccount(name)
+	if err != nil {
+		t.Fatalf("connect %s: %v", name, err)
+	}
+	p, err := h.g.AccountStore.LoadCharacter(name)
+	if err != nil {
+		t.Fatalf("connect %s: %v", name, err)
+	}
+	conn := newChanConn()
+	sess := &net.Session{Conn: conn, Account: acc, Player: p, State: net.StateGame}
+	sess.StartWriter()
+	h.hub.Add(sess)
+	h.hub.EnterRoom(sess, p.RoomID)
+	h.g.attachSession(sess)
+	h.mu.Lock()
+	h.sessions[name] = sess
+	h.conns[name] = conn
+	h.mu.Unlock()
+	return sess, conn
+}
+
+// connectMenu registers a session authenticated to accountName sitting in
+// the character menu (no character loaded).
+func (h *harness) connectMenu(accountName string) *net.Session {
+	acc, err := h.g.AccountStore.LoadAccount(accountName)
+	if err != nil {
+		h.t.Fatalf("connectMenu %s: %v", accountName, err)
+	}
+	conn := newChanConn()
+	sess := &net.Session{Conn: conn, Account: acc, State: net.StateMenu}
+	sess.StartWriter()
+	h.hub.Add(sess)
+	h.mu.Lock()
+	h.sessions[accountName+"-menu"] = sess
+	h.conns[accountName+"-menu"] = conn
+	h.mu.Unlock()
+	return sess
+}
+
+// barrier blocks until every task submitted so far has executed on the
+// owner goroutine.
+func (h *harness) barrier() {
+	h.g.RunOnOwner(func() {})
+}
+
+// input mirrors net.Server.handleSession: a per-connection goroutine reading
+// lines and dispatching them to HandleSession until the channel closes.
+func (h *harness) input(sess *net.Session, lines <-chan string) {
+	for line := range lines {
+		h.g.HandleSessionOnOwner(sess, line)
+	}
+}
+
+// goInput starts input goroutine(s) for a session, returning the send channel.
+func (h *harness) goInput(sess *net.Session, workers int) chan<- string {
+	lines := make(chan string, 64)
+	for i := 0; i < workers; i++ {
+		go h.input(sess, lines)
+	}
+	return lines
+}
+
+const workers = 1
+
+// sessionFor returns the registered session for a character name.
+func (h *harness) sessionFor(name string) *net.Session {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.sessions[name]
+}
diff --git a/internal/game/lifecycle_txn_test.go b/internal/game/lifecycle_txn_test.go
new file mode 100644
index 0000000..f575298
--- /dev/null
+++ b/internal/game/lifecycle_txn_test.go
@@ -0,0 +1,160 @@
+package game
+
+// Account lifecycle transaction regressions: same-account races, stale
+// session state, and injected filesystem failures must preserve
+// identity/membership with no orphaned or duplicated characters.
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"thehouseoficarus/internal/net"
+)
+
+// lifecycle setup: account "acct" with two characters and two menu-state
+// sessions authenticated to it.
+func setupAcct(t *testing.T, h *harness) (*net.Session, *net.Session) {
+	t.Helper()
+	h.seedAccount("acct", "pw", false)
+	h.seedCharacter("alice", "acct")
+	h.seedCharacter("bob", "acct")
+	s1 := h.connectMenu("acct")
+	s2 := h.connectMenu("acct")
+	return s1, s2
+}
+
+func assertCharFiles(t *testing.T, h *harness, want ...string) {
+	t.Helper()
+	names, err := h.g.AccountStore.ListCharacterNames()
+	if err != nil {
+		t.Fatalf("list characters: %v", err)
+	}
+	have := map[string]bool{}
+	for _, n := range names {
+		have[n] = true
+	}
+	for _, w := range want {
+		if !have[w] {
+			t.Fatalf("expected character file %s to exist; files: %v", w, names)
+		}
+	}
+	if len(names) != len(want) {
+		t.Fatalf("unexpected character files: got %v, want %v", names, want)
+	}
+}
+
+// TestLifecycleConcurrentRenameNoOrphan: two sessions of the same account
+// rename the same character at once. Exactly one succeeds; files and the
+// account list stay consistent (no orphaned characters, no duplicate list
+// entries).
+func TestLifecycleConcurrentRenameNoOrphan(t *testing.T) {
+	h := newHarness(t)
+	s1, s2 := setupAcct(t, h)
+
+	h.g.RunOnOwner(func() { h.g.handleRenameChar(s1, "alice") })
+	h.g.RunOnOwner(func() { h.g.handleRenameChar(s2, "alice") })
+
+	// Both sessions now hold a pending rename of alice; drive them to
+	// submit new names concurrently.
+	h.g.RunOnOwner(func() { h.g.handleRenameCharName(s1, "alicia") })
+	h.g.RunOnOwner(func() { h.g.handleRenameCharName(s2, "alicia") })
+
+	h.barrier()
+	// Alicia exists exactly once, alice does not.
+	assertCharFiles(t, h, "alicia", "bob")
+	if !h.g.AccountStore.CharacterExists("alicia") {
+		t.Fatal("renamed character missing")
+	}
+}
+
+// TestLifecycleStaleMenuAfterDelete: deleting a character from one session
+// refreshes the other session's pending selection (it cannot confirm-delete
+// a stale name afterwards).
+func TestLifecycleStaleMenuAfterDelete(t *testing.T) {
+	h := newHarness(t)
+	s1, s2 := setupAcct(t, h)
+
+	// Session 2 selects alice for deletion (pending).
+	h.g.RunOnOwner(func() {
+		h.g.handleDeleteChar(s2, "alice") // asks for confirmation
+	})
+	if s2.PendingChar != "alice" {
+		t.Fatalf("expected pending delete of alice, got %q", s2.PendingChar)
+	}
+
+	// Session 1 confirms the delete first (its own pending selection is
+	// "alice", mirroring the same menu state).
+	h.g.RunOnOwner(func() {
+		s1.PendingChar = "alice"
+		h.g.handleDeleteChar(s1, "DELETE alice")
+	})
+	h.barrier()
+
+	// Session 2's pending selection must have been invalidated.
+	if s2.PendingChar == "alice" {
+		t.Fatalf("stale pending delete survived the delete from another session")
+	}
+	if s2.Account != nil {
+		for _, c := range s2.Account.Characters {
+			if strings.EqualFold(c, "alice") {
+				t.Fatalf("deleted character still in another session's account list")
+			}
+		}
+	}
+}
+
+// TestLifecycleRenameBeatsConnect: a character cannot be renamed while it
+// is connected (the online check holds and no stale-name rename goes
+// through).
+func TestLifecycleRenameBeatsConnect(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("carl", "pw", false)
+	h.seedCharacter("carl", "carl")
+	sess, conn := h.connect("carl")
+
+	h.g.RunOnOwner(func() {
+		// Drive the rename menu directly while the character is online.
+		sess.PendingChar = "carl"
+		sess.State = net.StateRenameCharName
+		h.g.handleRenameCharName(sess, "carla")
+	})
+	h.barrier()
+	if h.g.AccountStore.CharacterExists("carla") {
+		t.Fatalf("rename succeeded while character was online")
+	}
+	if !h.g.AccountStore.CharacterExists("carl") {
+		t.Fatalf("original character file vanished")
+	}
+	_ = conn
+}
+
+// TestLifecycleInjectedFailureRollsBack: a failure mid-transaction (the
+// account file cannot be written because its directory is read-only... the
+// journal lives elsewhere, so use a permissions failure on the account dir)
+// must leave both files untouched.
+func TestLifecycleInjectedFailureRollsBack(t *testing.T) {
+	h := newHarness(t)
+	s1, _ := setupAcct(t, h)
+
+	accDir := filepath.Join(h.dir, "players", "accounts")
+	if err := os.Chmod(accDir, 0500); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.Chmod(accDir, 0700) })
+
+	// Rename via the transaction path (invoked from a menu session whose
+	// account dir is unwritable): the move succeeds on disk but the account
+	// list rewrite fails, so the whole transaction must roll back.
+	h.g.RunOnOwner(func() {
+		s1.PendingChar = "alice"
+		s1.State = net.StateRenameCharName
+		h.g.handleRenameCharName(s1, "alicia")
+	})
+	h.barrier()
+
+	os.Chmod(accDir, 0700)
+	// The character must be untouched: no alicia, alice still present.
+	assertCharFiles(t, h, "alice", "bob")
+}
diff --git a/internal/game/migrate_rooms_test.go b/internal/game/migrate_rooms_test.go
new file mode 100644
index 0000000..eb4a44c
--- /dev/null
+++ b/internal/game/migrate_rooms_test.go
@@ -0,0 +1,115 @@
+package game
+
+// Runtime room-ID migration regressions: Hub buckets, casino room keys,
+// world room-keyed state, mob instances, and player state all move
+// together through Game.MigrateRoomIDs (owner-executed).
+
+import (
+	"testing"
+
+	"thehouseoficarus/internal/casino"
+)
+
+// TestMigrateRoomIDsMovesEverythingTogether: a live player in room 2, a
+// casino machine in room 2, and seeded world state all migrate to room 4
+// in one owner task; nothing stays attached to room 2.
+func TestMigrateRoomIDsMovesEverythingTogether(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	p := h.seedCharacter("alice", "alice")
+	sess, _ := h.connect("alice")
+	p = sess.Player
+
+	h.g.RunOnOwner(func() {
+		p.RoomID = 2
+		h.hub.EnterRoom(sess, 2)
+		// A machine in room 2 with a committed stake.
+		h.g.Casino.JoinMachine(2, casino.MachineConfig{ID: "slots", Game: casino.GameSlots, MinBet: 1}, "alice")
+	})
+
+	// Migrate 2 -> 4 through the full runtime entry point.
+	h.g.MigrateRoomIDs(map[int]int{2: 4})
+	h.barrier()
+
+	h.g.RunOnOwner(func() {
+		if p.RoomID != 4 {
+			t.Fatalf("player room = %d, want 4", p.RoomID)
+		}
+		if room := h.hub.PlayersInRoom(4); len(room) != 1 || room[0] != sess {
+			t.Fatalf("hub bucket for room 4 = %v, want [alice]", len(room))
+		}
+		if room := h.hub.PlayersInRoom(2); len(room) != 0 {
+			t.Fatalf("stale hub bucket for room 2: %d players", len(room))
+		}
+		if _, playing := h.g.Casino.Participation("alice"); !playing {
+			t.Fatal("casino participation lost during migration")
+		}
+		// The machine's events must route to room 4 now: emit one and
+		// check the room target.
+		machine, ok := h.g.Casino.MachineFor("alice")
+		if !ok {
+			t.Fatal("machine lost during migration")
+		}
+		if machine.RoomID != 4 {
+			t.Fatalf("machine room = %d, want 4", machine.RoomID)
+		}
+	})
+}
+
+// TestMigrateRoomIDsRoundTrip preserves participation both directions.
+func TestMigrateRoomIDsRoundTrip(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	h.seedCharacter("alice", "alice")
+	sess, _ := h.connect("alice")
+	p := sess.Player
+
+	h.g.RunOnOwner(func() {
+		p.RoomID = 3
+		h.hub.EnterRoom(sess, 3)
+	})
+	h.g.MigrateRoomIDs(map[int]int{3: 9})
+	h.g.RunOnOwner(func() {
+		if p.RoomID != 9 {
+			t.Fatalf("forward migration: player room = %d, want 9", p.RoomID)
+		}
+	})
+	h.g.MigrateRoomIDs(map[int]int{9: 3})
+	h.g.RunOnOwner(func() {
+		if p.RoomID != 3 {
+			t.Fatalf("inverse migration: player room = %d, want 3", p.RoomID)
+		}
+		if room := h.hub.PlayersInRoom(3); len(room) != 1 {
+			t.Fatalf("inverse migration: hub bucket room 3 = %d players", len(room))
+		}
+	})
+}
+
+// TestMigrateRoomIDsPersistsOnlinePlayer: the migrated player state is
+// saved to disk (RoomID rewritten in the character file).
+func TestMigrateRoomIDsPersistsOnlinePlayer(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	h.seedCharacter("alice", "alice")
+	sess, _ := h.connect("alice")
+	p := sess.Player
+
+	h.g.RunOnOwner(func() {
+		p.RoomID = 2
+		p.Flags["hidden_exit_2_north"] = true
+		h.hub.EnterRoom(sess, 2)
+	})
+	h.g.MigrateRoomIDs(map[int]int{2: 4})
+	h.barrier()
+
+	loaded, err := h.g.AccountStore.LoadCharacter("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.RoomID != 4 {
+		t.Fatalf("saved room = %d, want 4", loaded.RoomID)
+	}
+	if _, ok := loaded.Flags["hidden_exit_4_north"]; !ok {
+		t.Fatalf("discovered-exit flag not rewritten: %v", loaded.Flags)
+	}
+}
diff --git a/internal/game/owner.go b/internal/game/owner.go
new file mode 100644
index 0000000..df87653
--- /dev/null
+++ b/internal/game/owner.go
@@ -0,0 +1,119 @@
+package game
+
+import "sync"
+
+// owner is the single execution authority for live game state. Every
+// mutation of players, sessions, the Hub membership, runtime maps, and all
+// tick callbacks runs on exactly one goroutine (the loop below). Network and
+// admin goroutines submit tasks; they never touch live objects directly.
+//
+// Rules:
+//   - Game.run blocks the caller until the closure has executed on the
+//     owner goroutine. Connection goroutines use it per input line, which
+//     gives natural per-client backpressure without ever blocking another
+//     client: the owner stays free because network I/O happens outside
+//     (Session writes go through outbound queues, saves serialize copies).
+//   - Code already executing on the owner must NOT call Game.run (it would
+//     deadlock waiting for itself). Owner-executed code calls functions
+//     directly.
+//   - Task ordering is FIFO: submitted input lines, disconnect callbacks,
+//     and admin mutations execute in submission order. Tick callbacks
+//     serialize against these tasks the same way (the engine's ticker
+//     goroutine submits each callback), preserving the documented tick
+//     order relative to subscriber registration IDs.
+type owner struct {
+	mu     sync.Mutex
+	closed bool
+	tasks  chan func()
+	done   chan struct{}
+}
+
+const ownerTaskQueue = 4096
+
+func newOwner() *owner {
+	o := &owner{
+		tasks: make(chan func(), ownerTaskQueue),
+		done:  make(chan struct{}),
+	}
+	go o.loop()
+	return o
+}
+
+func (o *owner) loop() {
+	defer close(o.done)
+	for task := range o.tasks {
+		task()
+	}
+}
+
+// submit enqueues a task; it returns false once the owner has stopped.
+// The closed flag is guarded by the mutex so a submit racing with stop
+// cannot send on a closed channel.
+func (o *owner) submit(fn func()) bool {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	if o.closed {
+		return false
+	}
+	select {
+	case o.tasks <- fn:
+		return true
+	default:
+		return false
+	}
+}
+
+func (o *owner) stop() {
+	o.mu.Lock()
+	if !o.closed {
+		o.closed = true
+		close(o.tasks)
+	}
+	o.mu.Unlock()
+	<-o.done
+}
+
+// run executes fn on the owner goroutine and waits for it. When no owner
+// exists (synthetic Games in unit tests) fn runs inline on the caller's
+// goroutine; production Games always have one, started by New.
+func (g *Game) run(fn func()) {
+	o := g.owner
+	if o == nil {
+		fn()
+		return
+	}
+	task := make(chan struct{})
+	if !o.submit(func() {
+		fn()
+		close(task)
+	}) {
+		// The owner loop has stopped (graceful shutdown in progress).
+		// Admissions are already closed, so only stragglers reach this:
+		// execute inline rather than block forever.
+		fn()
+		return
+	}
+	<-task
+}
+
+// tryRun executes fn on the owner if it is currently idle-draining; it is
+// not currently used for correctness paths but exists for future non-blocking
+// administrative reads. It returns false when the queue is full.
+func (g *Game) tryRun(fn func()) bool {
+	o := g.owner
+	if o == nil {
+		fn()
+		return true
+	}
+	return o.submit(fn)
+}
+
+// stopOwner drains and stops the owner loop. Called once during graceful
+// shutdown after all entry points have stopped submitting.
+func (g *Game) stopOwner() {
+	g.ownerStop.Do(func() {
+		if g.owner != nil {
+			g.owner.stop()
+		}
+	})
+}
diff --git a/internal/game/owner_concurrency_test.go b/internal/game/owner_concurrency_test.go
new file mode 100644
index 0000000..58e426b
--- /dev/null
+++ b/internal/game/owner_concurrency_test.go
@@ -0,0 +1,154 @@
+package game
+
+// Owner-loop concurrency regressions. These exercise the competing runtime
+// entry points (connection input, ticks, disconnects, admin mutations) the
+// way production does and must pass under -race now that all live-state
+// mutation executes on the owner goroutine. The pre-owner baselines live in
+// baseline_race_test.go behind the baselinerace build tag.
+
+import (
+	"sync"
+	"testing"
+	"time"
+)
+
+// TestOwnerSerializesEntryPoints runs session input, the ticker goroutine,
+// and hub disconnects concurrently.
+func TestOwnerSerializesEntryPoints(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	h.seedAccount("bob", "pw", false)
+	h.seedCharacter("alice", "alice")
+	h.seedCharacter("bob", "bob")
+
+	aSess, _ := h.connect("alice")
+	bSess, _ := h.connect("bob")
+
+	aLines := h.goInput(aSess, 1)
+	bLines := h.goInput(bSess, 1)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 200; i++ {
+			aLines <- "look"
+		}
+		close(aLines)
+	}()
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 200; i++ {
+			bLines <- "say hi"
+		}
+		close(bLines)
+	}()
+
+	go func() {
+		for i := 0; i < 50; i++ {
+			h.hub.PlayersInRoom(1)
+			if i == 25 {
+				h.hub.Remove(bSess)
+			}
+		}
+	}()
+
+	wg.Wait()
+	h.barrier()
+}
+
+// TestOwnerAdminRewriteWhilePlaying runs Game.RewriteRoomIDs (admin entry)
+// concurrently with live movement and ticking.
+func TestOwnerAdminRewriteWhilePlaying(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("carol", "pw", false)
+	h.seedCharacter("carol", "carol")
+	sess, _ := h.connect("carol")
+	lines := h.goInput(sess, 1)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 100; i++ {
+			lines <- "look"
+		}
+		close(lines)
+	}()
+	go func() {
+		defer wg.Done()
+		// Rewrite 2->4, then back; exercise both directions while the
+		// player commands run.
+		for i := 0; i < 10; i++ {
+			h.g.RunOnOwner(func() { h.g.RewriteRoomIDs(map[int]int{2: 4}) })
+			h.g.RunOnOwner(func() { h.g.RewriteRoomIDs(map[int]int{4: 2}) })
+		}
+	}()
+	wg.Wait()
+	h.barrier()
+}
+
+// TestSlowClientDoesNotStallTheWorld proves the write-queue boundary: a
+// session whose transport blocks forever on Write must not prevent other
+// players from receiving output and progressing.
+func TestSlowClientDoesNotStallTheWorld(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	h.seedAccount("bob", "pw", false)
+	h.seedCharacter("alice", "alice")
+	h.seedCharacter("bob", "bob")
+
+	// Alice's writer goroutine blocks at the transport (full socket buffer
+	// equivalent); her queue absorbs or disconnects her, but never blocks
+	// the owner goroutine.
+	aSess, aConn := h.connect("alice")
+	bSess, bConn := h.connect("bob")
+	aConn.writeGate = make(chan struct{})
+
+	bLines := h.goInput(bSess, 1)
+
+	for i := 0; i < 300; i++ {
+		aSess.WriteLine("spam for the stalled client")
+	}
+	// Bob keeps playing and must still see output while alice is stuck.
+	bLines <- "say hello"
+	deadline := time.Now().Add(3 * time.Second)
+	for time.Now().Before(deadline) {
+		if bConn.Contains("hello") {
+			return
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("bob's output never arrived while alice's client was stalled")
+}
+
+// TestOwnerDisconnectDuringInput removes a session from a separate goroutine
+// while its input goroutine is mid-stream, proving the remove callback
+// (save + registry cleanup) serializes with session input on the owner.
+func TestOwnerDisconnectDuringInput(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("dave", "pw", false)
+	h.seedCharacter("dave", "dave")
+	sess, conn := h.connect("dave")
+
+	lines := h.goInput(sess, 1)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		for i := 0; i < 50; i++ {
+			lines <- "look"
+		}
+		close(lines)
+	}()
+	// Hard-remove while input is streaming; the onRemove callback mutates
+	// player state and must not race with HandleSession.
+	for i := 0; i < 50; i++ {
+		h.hub.PlayersInRoom(1)
+		if i == 10 {
+			h.hub.HardRemove(sess)
+		}
+	}
+	<-done
+	h.barrier()
+	_ = conn
+}
diff --git a/internal/game/session_registry.go b/internal/game/session_registry.go
new file mode 100644
index 0000000..0e47f82
--- /dev/null
+++ b/internal/game/session_registry.go
@@ -0,0 +1,19 @@
+package game
+
+import "thehouseoficarus/internal/net"
+
+// attachSession registers a fully-logged-in session in the game's
+// character registry. Menu flows call it through connectCharacter; the test
+// harness uses it to skip the menu.
+func (g *Game) attachSession(sess *net.Session) {
+	g.charsMu.Lock()
+	g.loggedInChars[sess.Player.Name] = sess
+	g.charsMu.Unlock()
+}
+
+// detachSession removes a character's registry entry.
+func (g *Game) detachSession(name string) {
+	g.charsMu.Lock()
+	delete(g.loggedInChars, name)
+	g.charsMu.Unlock()
+}
diff --git a/internal/game/sys_combat.go b/internal/game/sys_combat.go
index b37459e..26dac2a 100644
--- a/internal/game/sys_combat.go
+++ b/internal/game/sys_combat.go
@@ -129,7 +129,7 @@ func (g *Game) checkAggro(sess *net.Session) {
 		if !keepRolling() {
 			break
 		}
-		g.Ticks.Subscribe(1, keepRolling)
+		g.SubscribeTicks(1, keepRolling)
 		break
 	}
 }
diff --git a/internal/game/sys_escape_test.go b/internal/game/sys_escape_test.go
index a9842ba..0a64666 100644
--- a/internal/game/sys_escape_test.go
+++ b/internal/game/sys_escape_test.go
@@ -3,6 +3,7 @@ package game
 import (
 	"os"
 	"testing"
+	"time"
 
 	"thehouseoficarus/internal/combat"
 	"thehouseoficarus/internal/engine"
@@ -22,6 +23,8 @@ func (c *escapeTestConn) Write(b []byte) (int, error) {
 	c.data = append(c.data, b...)
 	return len(b), nil
 }
+func (c *escapeTestConn) SetWriteDeadline(time.Time) error { return nil }
+
 func (c *escapeTestConn) Close() error       { return nil }
 func (c *escapeTestConn) SetEcho(bool) error { return nil }
 
diff --git a/internal/game/sys_safespot.go b/internal/game/sys_safespot.go
index d833b62..2529471 100644
--- a/internal/game/sys_safespot.go
+++ b/internal/game/sys_safespot.go
@@ -227,7 +227,7 @@ func (g *Game) scheduleSafespotRespawn(st *world.ObjState, objDef *object.Object
 	}
 	roomID := st.RoomID
 	defID := objDef.ID
-	g.Ticks.Subscribe(engine.ToTicks(cfg.RespawnTicks), func() bool {
+	g.SubscribeTicks(engine.ToTicks(cfg.RespawnTicks), func() bool {
 		respawnSt := g.World.GetObjState(roomID, defID, 0)
 		if respawnSt == nil {
 			return false