From 153acb7f644d755c45533b7c5311e3ffa47e8973 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 05:31:09 -0400
Subject: fix: harden engine across casino, economy, concurrency, security, and
 content

---
 internal/game/sys_combat.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'internal/game/sys_combat.go')

diff --git a/internal/game/sys_combat.go b/internal/game/sys_combat.go
index 26dac2a..b2a2463 100644
--- a/internal/game/sys_combat.go
+++ b/internal/game/sys_combat.go
@@ -105,6 +105,20 @@ func (g *Game) checkAggro(sess *net.Session) {
 		aggMob := mob
 
 		keepRolling := func() (keep bool) {
+			// The retry subscription outlives the session that armed it (only
+			// mob/combat/room state ends it), so a player who has since logged
+			// out, disconnected, or logged in again on a new connection must
+			// not have combat started for them here: the mob's own subscribers
+			// would then keep fighting a character who is not in the world.
+			if sess.Player == nil || sess.IsDisconnecting() {
+				return false
+			}
+			g.charsMu.Lock()
+			current := g.loggedInChars[p.Name]
+			g.charsMu.Unlock()
+			if current != nil && current != sess {
+				return false
+			}
 			if g.Combat.Get(p.Name) != nil {
 				return false
 			}
-- 
cgit v1.2.3