fix: harden engine across casino, economy, concurrency, security, and content

1 files changed, 14 insertions, 0 deletions

diff --git a/internal/game/sys_combat.go b/internal/game/sys_combat.go
index 26dac2a..b2a2463 100644
--- a/internal/game/sys_combat.go
+++ b/internal/game/sys_combat.go
@@ -105,6 +105,20 @@ func (g *Game) checkAggro(sess *net.Session) {
 		aggMob := mob
 
 		keepRolling := func() (keep bool) {
+			// The retry subscription outlives the session that armed it (only
+			// mob/combat/room state ends it), so a player who has since logged
+			// out, disconnected, or logged in again on a new connection must
+			// not have combat started for them here: the mob's own subscribers
+			// would then keep fighting a character who is not in the world.
+			if sess.Player == nil || sess.IsDisconnecting() {
+				return false
+			}
+			g.charsMu.Lock()
+			current := g.loggedInChars[p.Name]
+			g.charsMu.Unlock()
+			if current != nil && current != sess {
+				return false
+			}
 			if g.Combat.Get(p.Name) != nil {
 				return false
 			}