From 153acb7f644d755c45533b7c5311e3ffa47e8973 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 05:31:09 -0400
Subject: fix: harden engine across casino, economy, concurrency, security, and
 content

---
 internal/game/session_registry.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'internal/game/session_registry.go')

diff --git a/internal/game/session_registry.go b/internal/game/session_registry.go
index 0e47f82..c4f5d67 100644
--- a/internal/game/session_registry.go
+++ b/internal/game/session_registry.go
@@ -11,9 +11,15 @@ func (g *Game) attachSession(sess *net.Session) {
 	g.charsMu.Unlock()
 }
 
-// detachSession removes a character's registry entry.
+// detachSession removes a character's registry entry and drops every command
+// queued under its name. Leftover queue entries retain the departed session
+// (and its transport) and would otherwise replay against the next session
+// that logs in as the same character.
 func (g *Game) detachSession(name string) {
 	g.charsMu.Lock()
 	delete(g.loggedInChars, name)
 	g.charsMu.Unlock()
+	if g.queue != nil {
+		g.queue.ClearPlayer(name)
+	}
 }
-- 
cgit v1.2.3