From 6ef40a5739f1723ec26cc32dfc48fe764f776dca Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Wed, 16 Sep 2026 19:57:45 -0400
Subject: fix: durable payouts survive journal failure, cap bank withdrawals,
 hash passwords off the owner loop.

---
 internal/player/player.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'internal/player/player.go')

diff --git a/internal/player/player.go b/internal/player/player.go
index 708588c..0a48b04 100644
--- a/internal/player/player.go
+++ b/internal/player/player.go
@@ -176,7 +176,15 @@ type Player struct {
 	// amounts are ALREADY INCLUDED in this file's credit balance. Recovery
 	// uses membership to prove a payout became durable instead of guessing
 	// from balance checkpoints, which unrelated credit changes can fake.
-	OpenPayouts            []string         `yaml:"open_payouts,omitempty"`
+	OpenPayouts []string `yaml:"open_payouts,omitempty"`
+	// ResolvedStakes is durable evidence for the economy journal (see
+	// internal/game/economy.go): the IDs of outstanding wager records the
+	// session RESOLVED (won, lost, pushed, refunded) but whose settled
+	// markers could not be appended to the journal (e.g. a broken economy
+	// path). Recovery treats membership as proof the round resolved — the
+	// stake must not be refunded and its chip part must not return in kind
+	// on top of a settlement that already returned it as credits.
+	ResolvedStakes         []string         `yaml:"resolved_stakes,omitempty"`
 	Description            string           `yaml:"description"`
 	AttackStyle            AttackStyle      `yaml:"attack_style"`
 	Prompt                 string           `yaml:"prompt"`
-- 
cgit v1.2.3