fix(sim): cap crash point so extreme seeds cannot overflow or bankrupt

At u=1 the unsigned quotient exceeded int64 and wrapped negative, so the
rarest and most valuable outcome silently became an instant 1.00x loss.
At u=2 it produced a 2.1-billion-times payout the house could never
cover, which would have left settlement failing and the player unpaid.
The crash point is now capped at the largest multiplier the curve can
express, which is unreachable anyway since the round hits its tick
ceiling first.

FromInt now panics outside the Q32.32 integer range instead of wrapping
a positive input into a negative value.

Raises coverage to 88% overall; adds a Makefile with db-reset, since the
append-only ledger steadily consumes bridge headroom across test runs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

pkg/sim/crash.go

@@ -44,10 +44,22 @@ func CrashPoint(seed [32]byte) fixed.F {
 
 	// crash = payoutRatio / (u / 2^32), computed as (payoutRatio * 2^32) / u
 	// through a 128-bit intermediate so no precision is lost.
-	// hi is zero because payoutRatio < 2^32, so the division cannot overflow.
 	hi, lo := bits.Mul64(payoutRatio, 1<<32)
 	q, _ := bits.Div64(hi, lo, u)
 
+	// The quotient can exceed int64 for the very smallest u — at u=1 it wraps
+	// negative, which would silently turn the rarest and most valuable outcome
+	// into an instant loss. Compare in unsigned space before converting.
+	//
+	// The cap is the largest multiplier the curve can express. Anything above
+	// it is unreachable anyway: the round would hit its tick ceiling first.
+	// It also bounds the maximum payout, so a single round cannot demand more
+	// than the house can hold.
+	maxCP := MaxMultiplier()
+	if q >= uint64(maxCP) {
+		return maxCP
+	}
+
 	cp := fixed.F(q)
 	if cp < fixed.One {
 		cp = fixed.One

pkg/sim/crash_test.go

@@ -102,8 +102,7 @@ func TestRoundLengthIsBounded(t *testing.T) {
 		t.Fatalf("curve past the ceiling = %v, want %v", got, MaxMultiplier())
 	}
 	// Even the most extreme crash point settles within the ceiling.
-	worst := fixed.FromInt(4_000_000_000)
-	if tick := TicksToMultiplier(worst); tick > RoundTicks {
+	if tick := TicksToMultiplier(MaxMultiplier()); tick > RoundTicks {
 		t.Fatalf("extreme crash point needs %d ticks, ceiling is %d", tick, RoundTicks)
 	}
 }
@@ -114,7 +113,7 @@ func TestCurveTimings(t *testing.T) {
 		multiplier int64
 		maxSeconds float64
 	}{
-		{2, 20},   // the common case should arrive quickly
+		{2, 20}, // the common case should arrive quickly
 		{10, 45},
 		{100, 56},
 	} {
@@ -125,3 +124,42 @@ func TestCurveTimings(t *testing.T) {
 		}
 	}
 }
+
+// The crash point must never be negative or below 1.0, at any seed. An
+// unsigned quotient exceeding int64 previously wrapped negative here.
+func TestCrashPointNeverOverflows(t *testing.T) {
+	// Drive the derivation across seeds chosen to produce very small u, which
+	// is where the quotient is largest.
+	for i := 0; i < 200000; i++ {
+		var seed [32]byte
+		for j := 0; j < 32; j++ {
+			seed[j] = byte(i >> (8 * (j % 4)))
+		}
+		cp := CrashPoint(seed)
+		if cp < fixed.One {
+			t.Fatalf("seed %d produced crash point %v, below 1.0", i, cp)
+		}
+		if cp > MaxMultiplier() {
+			t.Fatalf("seed %d produced crash point %v, above the ceiling %v",
+				i, cp, MaxMultiplier())
+		}
+	}
+}
+
+// The payout a single round can demand must be bounded, so settlement can
+// always be covered.
+func TestMaximumPayoutIsBounded(t *testing.T) {
+	max := MaxMultiplier()
+	if max <= 0 {
+		t.Fatalf("ceiling is not positive: %v", max)
+	}
+	// A 1000-sat stake at the ceiling must stay well inside int64.
+	const stakeMsat = int64(1_000_000)
+	payout := stakeMsat * int64(max) / int64(fixed.One)
+	if payout <= 0 {
+		t.Fatalf("payout at the ceiling overflowed: %d", payout)
+	}
+	if payout > 1<<62 {
+		t.Fatalf("payout at the ceiling is %d, unreasonably large", payout)
+	}
+}