From 61881fd0c1a7066293f552be1a747143f70d03ff Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Tue, 15 Sep 2026 20:44:31 -0400
Subject: fix: registration overwrite, recovery chip/payout edge cases,
 bulk-delete rollback

---
 internal/game/core_login_account.go | 13 +++++++++++++
 1 file changed, 13 insertions(+)

(limited to 'internal/game/core_login_account.go')

diff --git a/internal/game/core_login_account.go b/internal/game/core_login_account.go
index fbd9e3a..60cca2c 100644
--- a/internal/game/core_login_account.go
+++ b/internal/game/core_login_account.go
@@ -145,6 +145,19 @@ func (g *Game) handleNewAccount(sess *net.Session, input string) {
 		return
 	}
 
+	// Re-check existence as part of the same owner step as the save. The
+	// name was validated as new when it was typed, but another session (or
+	// the admin API) may have created it in the meantime; saving without
+	// this check would overwrite that account's password and characters.
+	if _, findErr := g.AccountStore.FindAccount(sess.Account.Name); findErr == nil {
+		sess.Conn.SetEcho(true)
+		sess.Account = nil
+		sess.State = net.StateAccountName
+		sess.WriteLine("That account name was just taken; please sign in instead.")
+		sess.Write("Account name: ")
+		return
+	}
+
 	acc := &player.Account{
 		Name:         sess.Account.Name,
 		PasswordHash: hash,
-- 
cgit v1.2.3