Audit + guard player-name ↔ GOVERNMENT-account-name collisions across all bare-name resolvers

Status reconciliation — 2026-10-22

Merged PR #72 supplies shared namespace prevention while preserving legacy resolver guards. It does not by itself prove this broader resolver audit, recurring collision audit or balance-remediation acceptance. Keep open; coordinate remaining audit with PAR-501 and current ADT-193 migration/routing blockers rather than duplicating namespace implementation.

Why

Governments are operated as Minecraft player alt-accounts whose usernames equal same-named Treasury GOVERNMENT accounts, so each such entity has two wallets with the same name. Any code that resolves a bare name (no explicit account type) or resolves by owner UUID can silently land on the player's personal wallet. PAR-142 fixes the /pay instance and PAR-143 the Realty instance — this issue closes it once and for all by sweeping every other bare-name surface and preventing new collisions.

Current collisions (prod, for remediation/awareness)

Names existing as BOTH a GOVERNMENT account and a player alt:

• DCGovernmentAV → GOV #49929 / PERSONAL #104237
• DCGovernmentOR → GOV #27107 / PERSONAL #104236

Player alts with NO matching gov account (no ambiguity today, but same pattern): DCGovernmentAG #79295, DCgovernmentDH #77276, DCGovernmentDOJ #49046. Gov accounts with no alt: DCGovernment #2, DCGovernmentJUD #99393.

Audit query (keep as an admin/CI check):

SELECT a.account_id gov_id, a.display_name, pa.account_id personal_id, fp.current_name
FROM accounts a
JOIN firm_players fp ON fp.current_name = a.display_name
LEFT JOIN accounts pa ON pa.account_type='PERSONAL' AND pa.owner_uuid_bin = fp.player_uuid_bin
WHERE a.account_type='GOVERNMENT';

Scope

1. Sweep every bare-name / owner-UUID resolver for the same ambiguity and make each deterministic (explicit type or defined precedence + collision refusal). Known surfaces to check: Treasury /pay (PAR-142 ✔), Realty payouts (PAR-143), ChestShop sign-owner resolution (ChestShop-3 TreasuryListener.onAccountQuery), the Vault economy adapter (name-based getBalance/deposit/withdraw → resolves player names), and treasury-rest-api by-name lookups. File follow-ups for any new instances found.
2. Guard at the source: when creating a GOVERNMENT account, warn/flag if a player with that exact username already exists (and vice-versa surface it), so new collisions are visible rather than silent.
3. Decide the canonical policy: one documented rule for "what does the bare name DCGovernmentX resolve to" across the whole economy, so all surfaces agree. (Recommended: bare-name government references require explicit typing; governments should not be silently addressable as players.)
4. Provide the remediation list for existing mis-routed balances (coordinate with PAR-143 for the Realty money in #104236).

Acceptance

• No bare-name/owner-UUID resolver can silently pick the wrong account type for a colliding name.
• Audit query wired as a recurring check; existing collisions documented + remediation planned.

Umbrella for PAR-142 (Treasury /pay) and PAR-143 (Realty payouts).