Vanity shop (/vanity): cosmetic badges/titles as a pure whale coin sink -
purchases burn coins (not credited to the house) and equip a badge shown on
/profile. New vanity_owned/vanity_active fields, schema sync, and tests.
Money-safety and robustness fixes from a codebase review:
- _parse_amount now rejects negative amounts. Every bet/give/request flows
through it, so a negative value can no longer mint coins on a loss/transfer
path that trusts the caller's sign (all call sites already guarded <= 0;
this closes the source).
- do_blackjack_payout no longer raises on a DB failure. The stake was already
deducted in do_blackjack_bet, so it now logs critical with the owed amount
(for admin reconciliation) and returns db_error; all payout call sites render
a clear "payout failed" notice instead of crashing the interaction.
- Instant "kohv" consumable now cancels the pending reminder DMs for the
cooldowns it wipes (via new INSTANT_RESET_COMMANDS), so no stale/duplicate
reminders fire.
- Renamed the misleadingly-named _refund_user_safe -> _debit_house_safe (it
debits the house) and dropped its ignored first arg.
- Added __all__ to vanity.py and consumables.py so `import *` no longer leaks
incidental imports into the economy namespace.
- Documented Kõrvaklapid's +25 coin daily bonus in README and DEV_NOTES.
Tests: blackjack payout DB-failure safety and INSTANT_RESET_COMMANDS lockstep.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013VbAVsrZuYesea99mPMmPT
Multi-agent audit of the money-moving economy modules surfaced three
confirmed correctness bugs. All three are fixed here with regression tests.
heist (core/economy/heist.py):
- `house = await get_user(house.HOUSE_ID)` shadowed the imported `house`
module for the whole function, so `house.HOUSE_ID` raised UnboundLocalError
on every successful heist (win payout was entirely dead) and on the
fail-path compensation branch. Rename the local to `house_rec`.
- Un-shadowing exposed a latent mint: the pot was floored at 300 but the
house was debited only min(total, balance), so a poor house paid out more
than it lost. Cap the pot at the balance and debit exactly what is paid
(house debit == sum of payouts). No mint, no leak.
- Add the missing `_is_jailed` import (do_heist_check referenced it unimported).
blackjack (commands/economy_games_commands.py):
- Button callbacks had no reentrancy guard; discord.py dispatches each click
as its own task, so double-clicking Stand within the dealer-reveal window
paid out twice (mint), and double-clicking Double/Split deducted the extra
bet twice. Add a synchronous `_busy` guard (matching the existing RpsGame
idiom) on all four callbacks plus a `_resolved` idempotency flag on
settlement, so a game can only pay out once.
bail (core/economy/jail.py, commands/economy_extra_commands.py):
- do_bail only checked balance, never jail state; a double-click or a stale
BailView from a re-run /jailbreak charged bail twice, destroying coins (bail
is a pure sink). Make do_bail a no-op when the user is not jailed, and add a
UI reentrancy guard + "already free" message.
Tests: 47 passed (4 new regression tests covering heist coin-conservation and
bail idempotency).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
