From 194164a77eb4f2479b94c19e6f0e1278ab608781 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 16:13:49 -0400
Subject: fix: more casino, economy, gameplay, security, and world data
 hardening gaps

---
 internal/persistence/txn.go | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'internal/persistence')

diff --git a/internal/persistence/txn.go b/internal/persistence/txn.go
index d09feaa..8ba21fa 100644
--- a/internal/persistence/txn.go
+++ b/internal/persistence/txn.go
@@ -238,6 +238,15 @@ func (t *Transaction) Commit() error {
 	}
 	journalPath := filepath.Join(t.journalDir, "txn-"+hex.EncodeToString(id[:])+".json")
 	if err := WriteFile(journalPath, journal, 0600); err != nil {
+		// WriteFile can fail AFTER the rename (e.g. the directory fsync),
+		// leaving a complete, valid journal whose operations were never
+		// applied. Remove it before returning so a later Recover cannot replay
+		// its before-images over newer writes; if the removal also fails,
+		// surface that so the caller can stop admitting mutations instead of
+		// serving on with an unrecoverable journal on disk.
+		if rErr := t.removeJournalDurable(journalPath); rErr != nil {
+			return fmt.Errorf("write journal: %v; journal cleanup failed (journal left on disk): %v", err, rErr)
+		}
 		return fmt.Errorf("write journal: %w", err)
 	}
 
-- 
cgit v1.2.3