fix: durable payouts survive journal failure, cap bank withdrawals, hash passwords off the owner loop.

1 files changed, 9 insertions, 1 deletions

diff --git a/internal/player/player.go b/internal/player/player.go
index 708588c..0a48b04 100644
--- a/internal/player/player.go
+++ b/internal/player/player.go
@@ -176,7 +176,15 @@ type Player struct {
 	// amounts are ALREADY INCLUDED in this file's credit balance. Recovery
 	// uses membership to prove a payout became durable instead of guessing
 	// from balance checkpoints, which unrelated credit changes can fake.
-	OpenPayouts            []string         `yaml:"open_payouts,omitempty"`
+	OpenPayouts []string `yaml:"open_payouts,omitempty"`
+	// ResolvedStakes is durable evidence for the economy journal (see
+	// internal/game/economy.go): the IDs of outstanding wager records the
+	// session RESOLVED (won, lost, pushed, refunded) but whose settled
+	// markers could not be appended to the journal (e.g. a broken economy
+	// path). Recovery treats membership as proof the round resolved — the
+	// stake must not be refunded and its chip part must not return in kind
+	// on top of a settlement that already returned it as credits.
+	ResolvedStakes         []string         `yaml:"resolved_stakes,omitempty"`
 	Description            string           `yaml:"description"`
 	AttackStyle            AttackStyle      `yaml:"attack_style"`
 	Prompt                 string           `yaml:"prompt"`