fix: economy recovery double-refund/erased-liability/cap-drops, entity editor path traversal

3 files changed, 161 insertions, 19 deletions

diff --git a/internal/game/casino.go b/internal/game/casino.go
index 3f06b41..bc1e690 100644
--- a/internal/game/casino.go
+++ b/internal/game/casino.go
@@ -82,15 +82,20 @@ func (w casinoWallet) PayCredits(amount int) error {
 	}
 	creditsBefore := w.p.Credits
 	chipsBefore := countChips(w.p)
-	creditsAfter, err := addCreditsChecked(creditsBefore, amount)
-	if err != nil {
-		return err
-	}
+	creditsAfter, capErr := addCreditsChecked(creditsBefore, amount)
+	// The journal record is written FIRST, even when the economy cap
+	// blocks the payout: a won settlement must never be silently dropped.
+	// With the cap blocking, the balance is unchanged and the open record
+	// keeps the owed amount durable; startup recovery re-applies it once
+	// the balance has room below the cap.
 	rec, err := w.g.Economy.start("payout", w.p, 0, amount,
 		creditsBefore, creditsAfter, chipsBefore, chipsBefore)
 	if err != nil {
 		return casino.ErrWalletPersistence
 	}
+	if capErr != nil {
+		return capErr
+	}
 	w.p.Credits = creditsAfter
 	if err := w.g.AccountStore.SaveCharacter(w.p); err != nil {
 		w.p.Credits = creditsBefore
diff --git a/internal/game/economy.go b/internal/game/economy.go
index 04508be..afdcdd8 100644
--- a/internal/game/economy.go
+++ b/internal/game/economy.go
@@ -353,13 +353,21 @@ func (g *Game) recoverEconomy() {
 		players[name] = p
 		return p
 	}
-	hasLaterPayout := func(name string, seq int) bool {
+	// laterPayoutEvidence reports whether any non-void payout record was
+	// journaled for the player after seq — evidence the round resolved and
+	// its settlement was recorded — together with the total credits those
+	// records promise. A payout covering the stake's full value returned
+	// the stake inside the payout (win, push, or refund); a smaller total
+	// (e.g. the credit side of a crashed mixed refund) leaves the chip
+	// side of the stake outstanding.
+	laterPayoutEvidence := func(name string, seq int) (resolved bool, credits int) {
 		for _, fr := range folded {
 			if fr.rec.Kind == "payout" && fr.rec.Player == name && fr.rec.Status != "void" && fr.seq > seq {
-				return true
+				resolved = true
+				credits += fr.rec.Credit
 			}
 		}
-		return false
+		return resolved, credits
 	}
 	compensated := 0
 
@@ -413,13 +421,23 @@ func (g *Game) recoverEconomy() {
 				paid++
 				compensated++
 			}
-			for _, other := range group {
-				if paid == 0 {
-					break
+			for idx, other := range group {
+				if idx < paid {
+					g.Economy.settle(other)
+					settled[other.ID] = true
+					continue
 				}
-				g.Economy.settle(other)
-				settled[other.ID] = true
-				paid--
+				// An unpaid sibling (the save failed, or the credit cap
+				// blocked re-application) stays owed. Re-anchor its
+				// checkpoints to the current durable balance so a later
+				// recovery re-applies it against a balance it can actually
+				// be paid from — without this, the balance a PAID sibling
+				// moved reads as this record's own durability and the
+				// liability is silently settled instead of paid.
+				other.CreditsBefore = p.Credits
+				other.CreditsAfter = p.Credits + other.Credit
+				settled[other.ID] = true // handled for the rest of this run
+				_ = g.Economy.append(*other)
 			}
 		case p.Credits == rec.CreditsAfter && len(group) == 1:
 			g.Economy.settle(rec)
@@ -439,7 +457,7 @@ func (g *Game) recoverEconomy() {
 	}
 	for k := len(openWagers) - 1; k >= 0; k-- {
 		rec := &folded[openWagers[k]].rec
-		resolvedByPayout := hasLaterPayout(rec.Player, folded[openWagers[k]].seq)
+		resolvedByPayout, laterPayoutCredits := laterPayoutEvidence(rec.Player, folded[openWagers[k]].seq)
 		p := loadPlayer(rec.Player)
 		if p == nil {
 			continue
@@ -449,11 +467,12 @@ func (g *Game) recoverEconomy() {
 		creditsNow, chipsNow := p.Credits, countChips(p)
 		// Chips are recovered independently of the credit checkpoints. Any
 		// state where the chip debit is durable but the chips have not come
-		// back (post-debit chip balance) still owes the chips, even when a
-		// later payout record already resolves the credit side. A durable
-		// chip refund always restores the balance to ChipsBefore, so this
-		// cannot double-return.
-		chipsOwed := rec.Chips > 0 && chipsNow == rec.ChipsAfter
+		// back (post-debit chip balance) still owes the chips — unless the
+		// resolving payout already returned the stake's full value in
+		// credits (a win, push, or refund includes the stake): returning
+		// the chips in kind on top would double-refund the round.
+		chipsOwed := rec.Chips > 0 && chipsNow == rec.ChipsAfter &&
+			(!resolvedByPayout || laterPayoutCredits < rec.Chips+rec.Credit)
 		if chipsOwed && !g.giveChips(p, rec.Chips) {
 			// No inventory room for the chip return: keep the record open
 			// for operator inspection rather than silently dropping the
diff --git a/internal/game/economy_recovery_regression_test.go b/internal/game/economy_recovery_regression_test.go
index 12df39b..0e764ca 100644
--- a/internal/game/economy_recovery_regression_test.go
+++ b/internal/game/economy_recovery_regression_test.go
@@ -359,3 +359,121 @@ func TestRecoveryRestoresChipsFromMixedRefundCrash(t *testing.T) {
 		t.Fatalf("nothing may stay owed after recovery: %+v", open)
 	}
 }
+
+// TestRecoveryDoesNotReturnPaidChipStakeInKind: a chip wager whose round
+// resolved with a durable payout (a win returns the stake inside the
+// payout) must not ALSO get the chips back in kind on recovery — the
+// resolving payout is the refund. Only a payout that does not cover the
+// stake's full value (e.g. the credit side of a crashed mixed refund)
+// leaves the chip side outstanding.
+func TestRecoveryDoesNotReturnPaidChipStakeInKind(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	p := h.seedCharacter("alice", "alice")
+	h.g.RunOnOwner(func() {
+		p.Credits = 100
+		p.SetInvSlot(0, &player.InventorySlot{ItemID: "chips", Quantity: 10})
+		w := casinoWallet{g: h.g, p: p}
+		if _, err := w.Wager(10); err != nil {
+			t.Error(err)
+			return
+		}
+		// The round resolved: a 2x payout (20) is durable, then the crash
+		// lands before the stake's resolution marker.
+		if err := w.PayCredits(20); err != nil {
+			t.Error(err)
+			return
+		}
+		h.g.recoverEconomy()
+	})
+	loaded, err := h.g.AccountStore.LoadCharacter("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.Credits != 120 || countChips(loaded) != 0 {
+		t.Fatalf("won chip bet after recovery = (%d credits, %d chips), want (120, 0) — no double refund",
+			loaded.Credits, countChips(loaded))
+	}
+}
+
+// TestRecoveryUnpaidLiabilitySurvivesLaterRecoveries: an unpaid payout
+// liability (the credit cap blocked re-application) must survive repeated
+// recoveries. Without checkpoint re-anchoring, a later recovery mistakes
+// the balance a paid sibling moved for the unpaid record's own durability
+// and silently erases the owed amount.
+func TestRecoveryUnpaidLiabilitySurvivesLaterRecoveries(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	p := h.seedCharacter("alice", "alice")
+	h.g.RunOnOwner(func() {
+		p.Credits = casino.MaxCredits - 30
+		if err := h.g.AccountStore.SaveCharacter(p); err != nil {
+			t.Error(err)
+			return
+		}
+		for i := 0; i < 2; i++ {
+			if _, err := h.g.Economy.start("payout", p, 0, 20, p.Credits, p.Credits+20, 0, 0); err != nil {
+				t.Error(err)
+				return
+			}
+		}
+		h.g.recoverEconomy()
+		if len(h.g.Economy.loadOpen()) != 1 {
+			t.Errorf("setup: expected one unpaid record after capped recovery, got %d", len(h.g.Economy.loadOpen()))
+			return
+		}
+		// A later startup over the same files: the liability stays owed.
+		h.g.recoverEconomy()
+		if got := len(h.g.Economy.loadOpen()); got != 1 {
+			t.Errorf("second recovery erased the unpaid 20-credit liability: open=%d, want 1", got)
+		}
+	})
+	loaded, err := h.g.AccountStore.LoadCharacter("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.Credits != casino.MaxCredits-10 {
+		t.Fatalf("balance after repeated recovery = %d, want %d (one payout applied)", loaded.Credits, casino.MaxCredits-10)
+	}
+}
+
+// TestCapBlockedPayoutIsJournaled: a won payout at the economy cap must be
+// recorded as an owed (open) payout record even though it cannot be
+// applied — a reported win is never silently dropped.
+func TestCapBlockedPayoutIsJournaled(t *testing.T) {
+	h := newHarness(t)
+	h.seedAccount("alice", "pw", false)
+	p := h.seedCharacter("alice", "alice")
+	h.g.RunOnOwner(func() {
+		p.Credits = casino.MaxCredits
+		w := casinoWallet{g: h.g, p: p}
+		if _, err := w.Wager(10); err != nil {
+			t.Error(err)
+			return
+		}
+		if err := w.PayCredits(20); err == nil {
+			t.Error("payout at the credit cap must fail, not silently clamp")
+			return
+		}
+		if p.Credits != casino.MaxCredits-10 {
+			t.Errorf("cap-blocked payout mutated the balance: %d", p.Credits)
+		}
+	})
+	if err := h.g.AccountStore.SaveCharacter(p); err != nil {
+		t.Fatal(err)
+	}
+	restarted := harnessFromDir(t, h.dir)
+	loaded, err := restarted.g.AccountStore.LoadCharacter("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Recovery: the owed win cannot be applied (cap), so the liability
+	// stays open for operator inspection, never erased; the consumed
+	// stake is settled against the payout evidence.
+	if got := len(restarted.g.Economy.loadOpen()); got != 1 {
+		t.Fatalf("owed cap-blocked payout must stay open after recovery, open records: %+v", restarted.g.Economy.loadOpen())
+	}
+	if loaded.Credits != casino.MaxCredits-10 {
+		t.Fatalf("recovery mutated a capped balance: %d", loaded.Credits)
+	}
+}