🆙 Bump version to 4.2.43 [skip ci]

㊙️ Security updates

Database Updates/010_furnidata_edit_log.sql

@@ -19,4 +19,50 @@ CREATE TABLE IF NOT EXISTS `furnidata_edit_log` (
 
 INSERT IGNORE INTO `emulator_settings` (`key`,`value`) VALUES
 ('items.furnidata.edit.backup.keep','10'),
-('items.furnidata.edit.ratelimit.ms','2000');
+('items.furnidata.edit.ratelimit.ms','2000'),
+-- Server-authoritative furni names (source of truth = furnidata JSON)
+('items.furnidata.names.enabled','true'),
+('items.furnidata.path',''),
+('items.furnidata.max.bytes','67108864'),
+-- Live-reload watcher
+('items.furnidata.watch.enabled','true'),
+('items.furnidata.watch.debounce.ms','750'),
+('items.furnidata.watch.min.interval.ms','5000'),
+('items.furnidata.delta.cap','500'),
+-- Furni editor: import official names/descriptions from Habbo
+('furni.editor.import.url','https://www.habbo.com/gamedata/furnidata_json/1'),
+('furni.editor.import.cache.ms','600000');
+
+START TRANSACTION;
+DROP TEMPORARY TABLE IF EXISTS cleanup_furnidata_settings;
+CREATE TEMPORARY TABLE cleanup_furnidata_settings (
+    `key` VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL PRIMARY KEY
+);
+INSERT INTO cleanup_furnidata_settings (`key`) VALUES
+    ('items.furnidata.names.enabled'),
+    ('items.furnidata.path'),
+    ('items.furnidata.max.bytes'),
+    ('items.furnidata.watch.enabled'),
+    ('items.furnidata.watch.debounce.ms'),
+    ('items.furnidata.watch.min.interval.ms'),
+    ('items.furnidata.delta.cap'),
+    ('furni.editor.import.url'),
+    ('furni.editor.import.cache.ms');
+
+-- Preview rows that will be removed.
+SELECT es.`key`, es.`value`
+FROM emulator_settings es
+JOIN cleanup_furnidata_settings cfs ON cfs.`key` = es.`key`
+ORDER BY es.`key`;
+
+DELETE es
+FROM emulator_settings es
+JOIN cleanup_furnidata_settings cfs ON cfs.`key` = es.`key`;
+
+-- Preview remaining matching rows inside the transaction.
+SELECT COUNT(*) AS remaining_furnidata_settings
+FROM emulator_settings es
+JOIN cleanup_furnidata_settings cfs ON cfs.`key` = es.`key`;
+
+-- Safe default. Change to COMMIT after reviewing the preview.
+ROLLBACK;

Database Updates/011_navigator_group_filter.sql

@@ -0,0 +1,9 @@
+-- Navigator search filters - companion to the gameserver fix for the catalog
+-- 'Find groups to join!' button (navigator/search/hotel_view/group:).
+
+INSERT IGNORE INTO `navigator_filter` (`key`, `field`, `compare`, `database_query`) VALUES
+('anything', 'getName', 'contains', 'SELECT rooms.* FROM rooms WHERE rooms.name LIKE ?'),
+('roomname', 'getName', 'contains', 'SELECT rooms.* FROM rooms WHERE rooms.name LIKE ?'),
+('owner', 'getOwnerName', 'equals_ignore_case', 'SELECT rooms.* FROM rooms WHERE rooms.owner_name LIKE ?'),
+('tag', 'getTags', 'contains', 'SELECT rooms.* FROM rooms WHERE rooms.tags LIKE ?'),
+('group', 'getGuildName', 'contains', 'SELECT rooms.* FROM rooms INNER JOIN guilds ON guilds.room_id = rooms.id WHERE guilds.name LIKE ?');

Database Updates/Own_Database_RunFirst/021_furnidata_config.sql

@@ -1,27 +0,0 @@
--- 021_furnidata_config.sql
--- Seeds the furnidata feature config keys read at runtime by
--- FurnitureTextProvider / FurnidataReader / FurnidataWatcher and
--- FurniEditorImportTextEvent. Without these rows a fresh install logs
--- "Config key not found" for each (ConfigurationManager logs ERROR even
--- when a default is supplied) and the values are not editable from the DB.
---
--- Notes:
---  * *.enabled keys are read via Boolean.parseBoolean → use true/false (NOT 1/0).
---  * items.furnidata.path is intentionally empty: when blank the source is
---    derived from furni.editor.asset.base.path (seeded by 004_furni_editor.sql)
---    → <base>/furnidata (split-tier) or <base>/FurnitureData.json (single file).
---  * Editor write-path keys (items.furnidata.edit.*) are seeded by 020.
-
-INSERT IGNORE INTO `emulator_settings` (`key`,`value`) VALUES
--- Server-authoritative furni names (source of truth = furnidata JSON)
-('items.furnidata.names.enabled','true'),
-('items.furnidata.path',''),
-('items.furnidata.max.bytes','67108864'),
--- Live-reload watcher
-('items.furnidata.watch.enabled','true'),
-('items.furnidata.watch.debounce.ms','750'),
-('items.furnidata.watch.min.interval.ms','5000'),
-('items.furnidata.delta.cap','500'),
--- Furni editor: import official names/descriptions from Habbo
-('furni.editor.import.url','https://www.habbo.it/gamedata/furnidata_json/1'),
-('furni.editor.import.cache.ms','600000');

Database Updates/Own_Database_RunFirst/021_furnidata_config_cleanup.sql

@@ -0,0 +1,42 @@
+-- 021_furnidata_config_cleanup.sql
+-- Reverts the emulator_settings rows inserted by 021_furnidata_config.sql.
+--
+-- Safe default:
+-- This script ends with ROLLBACK. Run it once to preview the exact rows, then
+-- change the final ROLLBACK to COMMIT only if the preview is correct.
+
+START TRANSACTION;
+
+DROP TEMPORARY TABLE IF EXISTS cleanup_furnidata_settings;
+CREATE TEMPORARY TABLE cleanup_furnidata_settings (
+    `key` VARCHAR(255) NOT NULL PRIMARY KEY
+);
+
+INSERT INTO cleanup_furnidata_settings (`key`) VALUES
+    ('items.furnidata.names.enabled'),
+    ('items.furnidata.path'),
+    ('items.furnidata.max.bytes'),
+    ('items.furnidata.watch.enabled'),
+    ('items.furnidata.watch.debounce.ms'),
+    ('items.furnidata.watch.min.interval.ms'),
+    ('items.furnidata.delta.cap'),
+    ('furni.editor.import.url'),
+    ('furni.editor.import.cache.ms');
+
+-- Preview rows that will be removed.
+SELECT es.`key`, es.`value`
+FROM emulator_settings es
+JOIN cleanup_furnidata_settings cfs ON cfs.`key` = es.`key`
+ORDER BY es.`key`;
+
+DELETE es
+FROM emulator_settings es
+JOIN cleanup_furnidata_settings cfs ON cfs.`key` = es.`key`;
+
+-- Preview remaining matching rows inside the transaction.
+SELECT COUNT(*) AS remaining_furnidata_settings
+FROM emulator_settings es
+JOIN cleanup_furnidata_settings cfs ON cfs.`key` = es.`key`;
+
+-- Safe default. Change to COMMIT after reviewing the preview.
+ROLLBACK;

Database Updates/Set Rooms wallitems/fix_room_paint_null.sql

@@ -0,0 +1,15 @@
+-- Fix NULL room paint columns
+--
+-- Some legacy/imported rooms have NULL in paper_wall / paper_floor / paper_landscape.
+-- The server compares these with .equals("0.0") on room entry, which throws a
+-- NullPointerException (RoomManager.openRoom) and prevents the room from loading.
+-- This normalizes existing NULL values and re-enforces the NOT NULL DEFAULT '0.0'
+-- constraint so it cannot happen again.
+
+UPDATE `rooms` SET `paper_wall`      = '0.0' WHERE `paper_wall`      IS NULL;
+UPDATE `rooms` SET `paper_floor`     = '0.0' WHERE `paper_floor`     IS NULL;
+UPDATE `rooms` SET `paper_landscape` = '0.0' WHERE `paper_landscape` IS NULL;
+
+ALTER TABLE `rooms` MODIFY COLUMN `paper_wall`      VARCHAR(50) NOT NULL DEFAULT '0.0';
+ALTER TABLE `rooms` MODIFY COLUMN `paper_floor`     VARCHAR(50) NOT NULL DEFAULT '0.0';
+ALTER TABLE `rooms` MODIFY COLUMN `paper_landscape` VARCHAR(50) NOT NULL DEFAULT '0.0';

Emulator/pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>com.eu.habbo</groupId>
     <artifactId>Habbo</artifactId>
-    <version>4.2.38</version>
+    <version>4.2.43</version>
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -66,7 +66,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.2.5</version>
+                <version>3.5.2</version>
             </plugin>
         </plugins>
     </build>
@@ -83,21 +83,21 @@
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-all</artifactId>
-            <version>4.1.115.Final</version>
+            <version>4.2.15.Final</version>
         </dependency>
 
         <!-- GSON -->
         <dependency>
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
-            <version>2.11.0</version>
+            <version>2.14.0</version>
         </dependency>
 
         <!-- MariaDB Connector/J (native driver for MariaDB) -->
         <dependency>
             <groupId>org.mariadb.jdbc</groupId>
             <artifactId>mariadb-java-client</artifactId>
-            <version>3.5.1</version>
+            <version>3.5.8</version>
             <scope>runtime</scope>
         </dependency>
 
@@ -113,7 +113,7 @@
         <dependency>
             <groupId>com.zaxxer</groupId>
             <artifactId>HikariCP</artifactId>
-            <version>6.2.1</version>
+            <version>7.0.2</version>
             <scope>compile</scope>
         </dependency>
 
@@ -121,7 +121,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.17.0</version>
+            <version>3.20.0</version>
             <scope>compile</scope>
         </dependency>
 
@@ -137,7 +137,7 @@
         <dependency>
             <groupId>org.jsoup</groupId>
             <artifactId>jsoup</artifactId>
-            <version>1.18.3</version>
+            <version>1.22.2</version>
             <scope>compile</scope>
         </dependency>
 
@@ -145,14 +145,14 @@
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-api</artifactId>
-            <version>2.0.16</version>
+            <version>2.0.18</version>
         </dependency>
 
         <!-- Logback -->
         <dependency>
             <groupId>ch.qos.logback</groupId>
             <artifactId>logback-classic</artifactId>
-            <version>1.5.15</version>
+            <version>1.5.34</version>
             <scope>compile</scope>
         </dependency>
 
@@ -160,14 +160,7 @@
         <dependency>
             <groupId>org.fusesource.jansi</groupId>
             <artifactId>jansi</artifactId>
-            <version>2.4.1</version>
-        </dependency>
-
-        <!-- Joda Time -->
-        <dependency>
-            <groupId>joda-time</groupId>
-            <artifactId>joda-time</artifactId>
-            <version>2.13.0</version>
+            <version>2.4.3</version>
         </dependency>
 
         <!-- jBCrypt � used by the built-in /api/auth/* HTTP login handler
@@ -183,14 +176,14 @@
         <dependency>
             <groupId>org.eclipse.angus</groupId>
             <artifactId>jakarta.mail</artifactId>
-            <version>2.0.3</version>
+            <version>2.0.5</version>
         </dependency>
 
         <!-- JUnit Jupiter -->
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter</artifactId>
-            <version>5.10.2</version>
+            <version>6.1.0</version>
             <scope>test</scope>
         </dependency>
     </dependencies>

Emulator/src/main/java/com/eu/habbo/database/DatabasePool.java

@@ -79,6 +79,14 @@ class DatabasePool {
             databaseConfiguration.addDataSourceProperty("useLocalSessionState",     "true");
             databaseConfiguration.addDataSourceProperty("cacheResultSetMetadata",   "true");
             databaseConfiguration.addDataSourceProperty("elideSetAutoCommits",      "true");
+
+            // Fail fast instead of pinning a pooled connection (and its worker
+            // thread) indefinitely on a stalled/slow MariaDB. HikariCP's
+            // connectionTimeout only bounds the pool *borrow*; these bound the
+            // actual socket/connect round-trip. Overridable via db.params.
+            databaseConfiguration.addDataSourceProperty("socketTimeout",  "30000");
+            databaseConfiguration.addDataSourceProperty("connectTimeout", "10000");
+            databaseConfiguration.addDataSourceProperty("tcpKeepAlive",   "true");
             databaseConfiguration.addDataSourceProperty("maintainTimeStats",        "false");
 
             databaseConfiguration.setPoolName("HabboHikariPool");

Emulator/src/main/java/com/eu/habbo/habbohotel/achievements/AchievementManager.java

@@ -100,9 +100,9 @@ public class AchievementManager {
         if (oldLevel != null && (oldLevel.level == achievement.levels.size() && currentProgress >= oldLevel.progress)) //Maximum achievement gotten.
             return;
 
-        habbo.getHabboStats().setProgress(achievement, currentProgress + amount);
+        int newProgress = habbo.getHabboStats().incrementProgress(achievement, amount);
 
-        AchievementLevel newLevel = achievement.getLevelForProgress(currentProgress + amount);
+        AchievementLevel newLevel = achievement.getLevelForProgress(newProgress);
 
         if (AchievementManager.TALENTTRACK_ENABLED) {
             for (TalentTrackType type : TalentTrackType.values()) {

Emulator/src/main/java/com/eu/habbo/habbohotel/bots/BotManager.java

@@ -188,7 +188,11 @@ public class BotManager {
             if (pickedUpEvent.isCancelled())
                 return;
 
-            if (habbo == null || (bot.getOwnerId() == habbo.getHabboInfo().getId() || habbo.hasPermission(Permission.ACC_ANYROOMOWNER))) {
+            Room currentRoom = habbo != null ? habbo.getHabboInfo().getCurrentRoom() : null;
+            if (habbo == null
+                    || bot.getOwnerId() == habbo.getHabboInfo().getId()
+                    || habbo.hasPermission(Permission.ACC_ANYROOMOWNER)
+                    || (currentRoom != null && (currentRoom.getOwnerId() == habbo.getHabboInfo().getId() || habbo.hasPermission(Permission.ACC_PLACEFURNI)))) {
                 if (habbo != null && !habbo.hasPermission(Permission.ACC_UNLIMITED_BOTS) && habbo.getInventory().getBotsComponent().getBots().size() >= BotManager.MAXIMUM_BOT_INVENTORY_SIZE) {
                     habbo.alert(Emulator.getTexts().getValue("error.bots.max.inventory").replace("%amount%", BotManager.MAXIMUM_BOT_INVENTORY_SIZE + ""));
                     return;

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/CatalogManager.java

@@ -1247,6 +1247,11 @@ public class CatalogManager {
                                     Guild guild = Emulator.getGameEnvironment().getGuildManager().getGuild(guildId);
 
                                     if (guild != null && Emulator.getGameEnvironment().getGuildManager().getGuildMember(guild, habbo) != null) {
+                                        if (baseItem.getName().equals("guild_forum") && guild.getOwnerId() != habbo.getHabboInfo().getId()) {
+                                            habbo.getClient().sendResponse(new AlertPurchaseFailedComposer(AlertPurchaseFailedComposer.SERVER_ERROR));
+                                            return;
+                                        }
+
                                         InteractionGuildFurni habboItem = (InteractionGuildFurni) Emulator.getGameEnvironment().getItemManager().createItem(habbo.getClient().getHabbo().getHabboInfo().getId(), baseItem, limitedStack, limitedNumber, extradata);
                                         habboItem.setExtradata("");
                                         habboItem.needsUpdate(true);

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/marketplace/MarketPlace.java

@@ -171,8 +171,9 @@ public class MarketPlace {
                 statement.setInt(paramIndex++, maxPrice);
             }
             if (!search.isEmpty()) {
-                statement.setString(paramIndex++, "%" + search + "%");
-                statement.setString(paramIndex++, "%" + search + "%");
+                String likeSearch = "%" + com.eu.habbo.util.SqlLikeEscaper.escape(search) + "%";
+                statement.setString(paramIndex++, likeSearch);
+                statement.setString(paramIndex++, likeSearch);
             }
 
             try (ResultSet set = statement.executeQuery()) {
@@ -278,8 +279,9 @@ public class MarketPlace {
                                             return;
                                         }
 
+                                        int soldTimestamp = Emulator.getIntUnixTimestamp();
                                         try (PreparedStatement updateOffer = connection.prepareStatement("UPDATE marketplace_items SET state = 2, sold_timestamp = ? WHERE id = ? AND state = 1")) {
-                                            updateOffer.setInt(1, Emulator.getIntUnixTimestamp());
+                                            updateOffer.setInt(1, soldTimestamp);
                                             updateOffer.setInt(2, offerId);
                                             int updated = updateOffer.executeUpdate();
                                             if (updated == 0) {
@@ -306,7 +308,11 @@ public class MarketPlace {
                                         client.sendResponse(new MarketplaceBuyErrorComposer(MarketplaceBuyErrorComposer.REFRESH, 0, offerId, price));
 
                                         if (habbo != null) {
-                                            habbo.getInventory().getOffer(offerId).setState(MarketPlaceState.SOLD);
+                                            MarketPlaceOffer offer = habbo.getInventory().getOffer(offerId);
+                                            if (offer != null) {
+                                                offer.setState(MarketPlaceState.SOLD);
+                                                offer.setSoldTimestamp(soldTimestamp);
+                                            }
                                         }
                                     }
                                 }
@@ -368,6 +374,11 @@ public class MarketPlace {
         event.item.setFromGift(false);
 
         MarketPlaceOffer offer = new MarketPlaceOffer(event.item, event.price, client.getHabbo());
+        if (!offer.isPersisted()) {
+            LOGGER.warn("Marketplace offer insert failed for user {} item {}", client.getHabbo().getHabboInfo().getId(), event.item.getId());
+            return false;
+        }
+
         client.getHabbo().getInventory().addMarketplaceOffer(offer);
         client.getHabbo().getInventory().getItemsComponent().removeHabboItem(event.item);
         item.setUserId(-1);

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/marketplace/MarketPlaceOffer.java

@@ -98,6 +98,10 @@ public class MarketPlaceOffer implements Runnable {
         return this.offerId;
     }
 
+    public boolean isPersisted() {
+        return this.offerId > 0;
+    }
+
     public void setOfferId(int offerId) {
         this.offerId = offerId;
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/BanCommand.java

@@ -9,6 +9,8 @@ import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboInfo;
 import com.eu.habbo.habbohotel.users.HabboManager;
 
+import java.util.List;
+
 public class BanCommand extends Command {
     public BanCommand() {
         super("cmd_ban", Emulator.getTexts().getValue("commands.keys.cmd_ban").split(";"));
@@ -72,7 +74,13 @@ public class BanCommand extends Command {
             }
         }
 
-        ModToolBan ban = Emulator.getGameEnvironment().getModToolManager().ban(target.getId(), gameClient.getHabbo(), reason.toString(), banTime, ModToolBanType.ACCOUNT, -1).get(0);
+        List<ModToolBan> bans = Emulator.getGameEnvironment().getModToolManager().ban(target.getId(), gameClient.getHabbo(), reason.toString(), banTime, ModToolBanType.ACCOUNT, -1);
+        if (bans == null || bans.isEmpty()) {
+            gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.user_offline"), RoomChatMessageBubbles.ALERT);
+            return true;
+        }
+
+        ModToolBan ban = bans.get(0);
         gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.succes.cmd_ban.ban_issued").replace("%user%", target.getUsername()).replace("%time%", ban.expireDate - Emulator.getIntUnixTimestamp() + "").replace("%reason%", ban.reason), RoomChatMessageBubbles.ALERT);
 
         return true;

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/IPBanCommand.java

@@ -8,6 +8,8 @@ import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboInfo;
 import com.eu.habbo.habbohotel.users.HabboManager;
 
+import java.util.List;
+
 public class IPBanCommand extends Command {
     public final static int TEN_YEARS = 315569260;
 
@@ -50,12 +52,12 @@ public class IPBanCommand extends Command {
                 return true;
             }
 
-            Emulator.getGameEnvironment().getModToolManager().ban(habbo.getId(), gameClient.getHabbo(), reason.toString(), TEN_YEARS, ModToolBanType.IP, -1);
-            count++;
+            List<?> bans = Emulator.getGameEnvironment().getModToolManager().ban(habbo.getId(), gameClient.getHabbo(), reason.toString(), TEN_YEARS, ModToolBanType.IP, -1);
+            count += bans != null ? bans.size() : 0;
             for (Habbo h : Emulator.getGameServer().getGameClientManager().getHabbosWithIP(habbo.getIpLogin())) {
                 if (h != null) {
-                    count++;
-                    Emulator.getGameEnvironment().getModToolManager().ban(h.getHabboInfo().getId(), gameClient.getHabbo(), reason.toString(), TEN_YEARS, ModToolBanType.IP, -1);
+                    bans = Emulator.getGameEnvironment().getModToolManager().ban(h.getHabboInfo().getId(), gameClient.getHabbo(), reason.toString(), TEN_YEARS, ModToolBanType.IP, -1);
+                    count += bans != null ? bans.size() : 0;
                 }
             }
         } else {

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/MachineBanCommand.java

@@ -8,6 +8,8 @@ import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboInfo;
 import com.eu.habbo.habbohotel.users.HabboManager;
 
+import java.util.List;
+
 public class MachineBanCommand extends Command {
     public MachineBanCommand() {
         super("cmd_machine_ban", Emulator.getTexts().getValue("commands.keys.cmd_machine_ban").split(";"));
@@ -46,7 +48,8 @@ public class MachineBanCommand extends Command {
                 return true;
             }
 
-            count = Emulator.getGameEnvironment().getModToolManager().ban(habbo.getId(), gameClient.getHabbo(), reason.toString(), IPBanCommand.TEN_YEARS, ModToolBanType.MACHINE, -1).size();
+            List<?> bans = Emulator.getGameEnvironment().getModToolManager().ban(habbo.getId(), gameClient.getHabbo(), reason.toString(), IPBanCommand.TEN_YEARS, ModToolBanType.MACHINE, -1);
+            count = bans != null ? bans.size() : 0;
 
 
         } else {
@@ -58,4 +61,4 @@ public class MachineBanCommand extends Command {
 
         return true;
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/gameclients/GameClient.java

@@ -149,6 +149,10 @@ public class GameClient {
     }
 
     public void dispose() {
+        this.dispose(true);
+    }
+
+    public void dispose(boolean allowSessionResume) {
         try {
             this.channel.close();
 
@@ -161,7 +165,7 @@ public class GameClient {
                 // appena ripristinata (era la causa del "Bye"/kick al 2° reconnect).
                 if (this.habbo.getClient() == this && this.habbo.isOnline()) {
                     // Try to park the habbo in the grace period instead of immediate disconnect
-                    boolean parked = SessionResumeManager.getInstance().parkHabbo(this.habbo, this.ssoTicket);
+                    boolean parked = allowSessionResume && SessionResumeManager.getInstance().parkHabbo(this.habbo, this.ssoTicket);
 
                     if (!parked) {
                         // No grace period configured — immediate disconnect as before
@@ -177,4 +181,4 @@ public class GameClient {
             LOGGER.error("Caught exception", e);
         }
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/gameclients/GameClientManager.java

@@ -43,14 +43,34 @@ public class GameClientManager {
 
 
     public void disposeClient(GameClient client) {
-        this.disposeClient(client.getChannel());
+        if (client == null) {
+            return;
+        }
+
+        this.disposeClient(client.getChannel(), true);
+    }
+
+    public void forceDisposeClient(GameClient client) {
+        if (client == null) {
+            return;
+        }
+
+        this.disposeClient(client.getChannel(), false);
     }
 
     private void disposeClient(Channel channel) {
+        this.disposeClient(channel, true);
+    }
+
+    private void disposeClient(Channel channel, boolean allowSessionResume) {
+        if (channel == null) {
+            return;
+        }
+
         GameClient client = channel.attr(GameServerAttributes.CLIENT).get();
 
         if (client != null) {
-            client.dispose();
+            client.dispose(allowSessionResume);
         }
         channel.deregister();
         channel.attr(GameServerAttributes.CLIENT).set(null);
@@ -190,4 +210,4 @@ public class GameClientManager {
             CFKeepAlive();
         }, 30000);
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/gameclients/SessionResumeManager.java

@@ -71,6 +71,15 @@ public class SessionResumeManager {
             }
         }, graceSeconds * 1000);
 
+        if (future == null) {
+            // The scheduler refused the grace-expiry task (pool saturated or
+            // shutting down). Parking now would leave a GhostSession that nothing
+            // can ever reap (the Habbo + room refs pinned for the JVM lifetime),
+            // so disconnect immediately instead.
+            performFullDisconnect(habbo);
+            return false;
+        }
+
         ghostSessions.put(userId, new GhostSession(habbo, ssoTicket, future, previousEffectId, previousEffectEnd));
 
         applyPausedEffect(habbo);

Emulator/src/main/java/com/eu/habbo/habbohotel/guilds/GuildManager.java

@@ -421,9 +421,9 @@ public class GuildManager {
 
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("SELECT users.username, users.look, guilds_members.* FROM guilds_members INNER JOIN users ON guilds_members.user_id = users.id WHERE guilds_members.guild_id = ?  " + (rankQuery(levelId)) + " AND users.username LIKE ? ORDER BY level_id, member_since ASC LIMIT ?, ?")) {
             statement.setInt(1, guild.getId());
-            statement.setString(2, "%" + query + "%");
+            statement.setString(2, "%" + com.eu.habbo.util.SqlLikeEscaper.escape(query) + "%");
             statement.setInt(3, page * 14);
-            statement.setInt(4, (page * 14) + 14);
+            statement.setInt(4, 14);
 
             try (ResultSet set = statement.executeQuery()) {
                 while (set.next()) {

Emulator/src/main/java/com/eu/habbo/habbohotel/guilds/forums/ForumThread.java

@@ -101,21 +101,27 @@ public class ForumThread implements Runnable, ISerialize {
             if (statement.executeUpdate() < 1)
                 return null;
 
-            ResultSet set = statement.getGeneratedKeys();
-            if (set.next()) {
-                int threadId = set.getInt(1);
-                createdThread = new ForumThread(threadId, guild.getId(), opener.getHabboInfo().getId(), subject, 0, timestamp, timestamp, ForumThreadState.OPEN, false, false, 0, null);
-                cacheThread(createdThread);
-
-                ForumThreadComment comment = ForumThreadComment.create(createdThread, opener, message);
-                createdThread.addComment(comment);
-
-                Emulator.getPluginManager().fireEvent(new GuildForumThreadCreated(createdThread));
+            try (ResultSet set = statement.getGeneratedKeys()) {
+                if (set.next()) {
+                    int threadId = set.getInt(1);
+                    createdThread = new ForumThread(threadId, guild.getId(), opener.getHabboInfo().getId(), subject, 0, timestamp, timestamp, ForumThreadState.OPEN, false, false, 0, null);
+                    cacheThread(createdThread);
+                }
             }
         } catch (SQLException e) {
             LOGGER.error("Caught SQL exception", e);
         }
 
+        // ForumThreadComment.create() opens its OWN connection; do it after the
+        // thread's connection has been released to avoid holding two pooled
+        // connections simultaneously per forum-thread creation.
+        if (createdThread != null) {
+            ForumThreadComment comment = ForumThreadComment.create(createdThread, opener, message);
+            createdThread.addComment(comment);
+
+            Emulator.getPluginManager().fireEvent(new GuildForumThreadCreated(createdThread));
+        }
+
         return createdThread;
     }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/guilds/forums/ForumThreadComment.java

@@ -98,12 +98,13 @@ public class ForumThreadComment implements Runnable, ISerialize {
             if (statement.executeUpdate() < 1)
                 return null;
 
-            ResultSet set = statement.getGeneratedKeys();
-            if (set.next()) {
-                int commentId = set.getInt(1);
-                createdComment = new ForumThreadComment(commentId, thread.getThreadId(), poster.getHabboInfo().getId(), message, timestamp, ForumThreadState.OPEN, 0);
+            try (ResultSet set = statement.getGeneratedKeys()) {
+                if (set.next()) {
+                    int commentId = set.getInt(1);
+                    createdComment = new ForumThreadComment(commentId, thread.getThreadId(), poster.getHabboInfo().getId(), message, timestamp, ForumThreadState.OPEN, 0);
 
-                Emulator.getPluginManager().fireEvent(new GuildForumThreadCommentCreated(createdComment));
+                    Emulator.getPluginManager().fireEvent(new GuildForumThreadCommentCreated(createdComment));
+                }
             }
         } catch (SQLException e) {
             LOGGER.error("Caught SQL exception", e);

Emulator/src/main/java/com/eu/habbo/habbohotel/items/FurnidataReader.java

@@ -109,13 +109,13 @@ public class FurnidataReader {
             JsonArray types = sectionObj.getAsJsonArray("furnitype");
             for (JsonElement el : types) {
                 JsonObject o = el.getAsJsonObject();
-                if (!o.has("id") || !o.has("classname")) continue;
+                if (!o.has("id") || o.get("id").isJsonNull() || !o.has("classname") || o.get("classname").isJsonNull()) continue;
                 out.add(new FurnidataEntry(
                     o.get("id").getAsInt(),
                     o.get("classname").getAsString(),
                     type,
-                    o.has("name") ? o.get("name").getAsString() : "",
-                    o.has("description") ? o.get("description").getAsString() : ""
+                    (o.has("name") && !o.get("name").isJsonNull()) ? o.get("name").getAsString() : "",
+                    (o.has("description") && !o.get("description").isJsonNull()) ? o.get("description").getAsString() : ""
                 ));
             }
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/FurnidataSourceResolver.java

@@ -0,0 +1,172 @@
+package com.eu.habbo.habbohotel.items;
+
+import com.eu.habbo.Emulator;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+public final class FurnidataSourceResolver {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(FurnidataSourceResolver.class);
+
+    public enum Status {
+        RESOLVED,
+        SOURCE_MISSING,
+        CONFIG_MISSING,
+        UNRESOLVED_PLACEHOLDER,
+        ERROR
+    }
+
+    public record Source(Path path, boolean directory, Status status, String message) {
+        public boolean ok() {
+            return this.status == Status.RESOLVED && this.path != null && Files.exists(this.path);
+        }
+    }
+
+    private FurnidataSourceResolver() {
+    }
+
+    public static Source resolve() {
+        try {
+            String override = Emulator.getConfig().getValue("items.furnidata.path", "");
+            if (!override.isEmpty()) {
+                Path p = Paths.get(override);
+                if (Files.exists(p)) return new Source(p, Files.isDirectory(p), Status.RESOLVED, "items.furnidata.path");
+                return new Source(p, Files.isDirectory(p), Status.SOURCE_MISSING, "items.furnidata.path does not exist");
+            }
+
+            String rendererConfigPath = Emulator.getConfig().getValue("furni.editor.renderer.config.path", "");
+            String assetBasePath = Emulator.getConfig().getValue("furni.editor.asset.base.path", "");
+
+            if (!rendererConfigPath.isEmpty()) {
+                Source fromRenderer = resolveFromRendererConfig(Paths.get(rendererConfigPath), assetBasePath.isEmpty() ? null : Paths.get(assetBasePath));
+                if (fromRenderer.ok() || fromRenderer.status() == Status.UNRESOLVED_PLACEHOLDER) return fromRenderer;
+            }
+
+            Source fallback = resolveFromAssetBase(assetBasePath);
+            if (fallback != null) return fallback;
+
+            return new Source(null, false, Status.CONFIG_MISSING, "No furnidata source config found");
+        } catch (Exception e) {
+            LOGGER.warn("FurnidataSourceResolver failed", e);
+            return new Source(null, false, Status.ERROR, e.getMessage() != null ? e.getMessage() : "Resolver error");
+        }
+    }
+
+    public static Source resolveFromRendererConfig(Path rendererConfig, Path assetBase) {
+        try {
+            if (rendererConfig == null || !Files.exists(rendererConfig)) {
+                return new Source(rendererConfig, false, Status.SOURCE_MISSING, "renderer-config path does not exist");
+            }
+
+            String raw = Files.readString(rendererConfig, StandardCharsets.UTF_8);
+            JsonObject rendererObj = JsonParser.parseString(FurnidataReader.stripJson5(raw)).getAsJsonObject();
+            String furniUrl = expandRendererUrl(rendererObj, "furnidata.url");
+
+            if (furniUrl.isBlank()) return new Source(null, false, Status.CONFIG_MISSING, "furnidata.url is missing");
+            if (hasUnresolvedPathPlaceholder(furniUrl)) return new Source(null, false, Status.UNRESOLVED_PLACEHOLDER, furniUrl);
+
+            Source source = toLocalSource(assetBase, furniUrl);
+            if (source == null) return new Source(null, false, Status.CONFIG_MISSING, "furni.editor.asset.base.path is missing");
+            if (!Files.exists(source.path())) return new Source(source.path(), source.directory(), Status.SOURCE_MISSING, "Resolved source does not exist");
+
+            return source;
+        } catch (Exception e) {
+            return new Source(null, false, Status.ERROR, e.getMessage() != null ? e.getMessage() : "renderer-config parse failed");
+        }
+    }
+
+    private static Source resolveFromAssetBase(String assetBasePath) {
+        if (assetBasePath == null || assetBasePath.isEmpty()) return null;
+
+        Path dir = Paths.get(assetBasePath);
+        Path split = dir.resolve("furnidata");
+        if (Files.isDirectory(split)) return new Source(split, true, Status.RESOLVED, "asset base split furnidata");
+
+        Path legacy = dir.resolve("FurnitureData.json");
+        if (Files.exists(legacy)) return new Source(legacy, false, Status.RESOLVED, "asset base FurnitureData.json");
+
+        return new Source(dir, true, Status.SOURCE_MISSING, "No furnidata or FurnitureData.json under asset base");
+    }
+
+    public static String expandRendererUrl(JsonObject rendererObj, String key) {
+        if (rendererObj == null || !rendererObj.has(key)) return "";
+
+        String value = rendererObj.get(key).getAsString();
+        for (int i = 0; i < 10; i++) {
+            int start = value.indexOf("${");
+            if (start < 0) break;
+
+            int end = value.indexOf('}', start + 2);
+            if (end < 0) break;
+
+            String placeholder = value.substring(start + 2, end);
+            if (!rendererObj.has(placeholder)) break;
+
+            value = value.substring(0, start) + rendererObj.get(placeholder).getAsString() + value.substring(end + 1);
+        }
+
+        return value;
+    }
+
+    public static Source toLocalSource(Path assetBase, String furniUrl) {
+        if (furniUrl == null || furniUrl.isBlank()) return null;
+
+        String cleanUrl = stripQueryAndFragment(furniUrl);
+        boolean splitMode = cleanUrl.endsWith("/");
+
+        if (!cleanUrl.startsWith("http")) {
+            Path local = Paths.get(cleanUrl);
+            return new Source(local, splitMode || Files.isDirectory(local), Status.RESOLVED, "local furnidata.url");
+        }
+
+        if (assetBase == null) return null;
+
+        String urlPath;
+        try {
+            urlPath = URI.create(cleanUrl).getPath();
+        } catch (Exception e) {
+            int scheme = cleanUrl.indexOf("://");
+            int pathStart = scheme >= 0 ? cleanUrl.indexOf('/', scheme + 3) : -1;
+            urlPath = pathStart >= 0 ? cleanUrl.substring(pathStart) : cleanUrl;
+        }
+
+        String normalized = urlPath.replace('\\', '/');
+        String baseName = assetBase.getFileName() != null ? assetBase.getFileName().toString() : "";
+        String marker = "/" + baseName + "/";
+        int markerIndex = baseName.isEmpty() ? -1 : normalized.indexOf(marker);
+
+        Path candidate;
+        if (markerIndex >= 0) {
+            candidate = assetBase.resolve(normalized.substring(markerIndex + marker.length()));
+        } else if (splitMode) {
+            String trimmed = normalized.endsWith("/") ? normalized.substring(0, normalized.length() - 1) : normalized;
+            candidate = assetBase.resolve(trimmed.substring(trimmed.lastIndexOf('/') + 1));
+        } else {
+            candidate = assetBase.resolve(normalized.substring(normalized.lastIndexOf('/') + 1));
+        }
+
+        return new Source(candidate, splitMode || Files.isDirectory(candidate), Status.RESOLVED, "renderer-config furnidata.url");
+    }
+
+    private static boolean hasUnresolvedPathPlaceholder(String value) {
+        if (value == null) return false;
+        return stripQueryAndFragment(value).contains("${");
+    }
+
+    private static String stripQueryAndFragment(String value) {
+        String out = value;
+        int q = out.indexOf('?');
+        if (q >= 0) out = out.substring(0, q);
+        int h = out.indexOf('#');
+        if (h >= 0) out = out.substring(0, h);
+        return out;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/FurnidataWatcher.java

@@ -115,32 +115,39 @@ public class FurnidataWatcher {
         }
     }
 
-    private void onChange() {
+    private void onChange() throws InterruptedException {
+        // Re-index under the shared furnidata lock so the watcher and editor
+        // writes never swap the index concurrently. The lock is released before
+        // the throttle/broadcast below so a slow broadcast can't stall editor saves.
+        List<FurnidataEntry> delta;
         FurnidataLock.LOCK.lock();
         try {
             Path source = this.provider.getSource();
             if (source == null) return;
-
-            List<FurnidataEntry> delta = this.provider.reindex(new FurnidataReader(source, this.maxBytes).read());
-            if (delta.isEmpty()) return;
-
-            long now = System.currentTimeMillis();
-            if (now - this.lastBroadcast < this.minIntervalMs) {
-                LOGGER.info("FurnidataWatcher: {} changes indexed but broadcast skipped (min interval) — clients update on next change or reconnect", delta.size());
-                return;
-            }
-            this.lastBroadcast = now;
-
-            FurnitureDataReloadComposer composer = (delta.size() > this.deltaCap)
-                ? new FurnitureDataReloadComposer(FurnitureDataReloadComposer.MODE_RELOAD_HINT, List.of())
-                : new FurnitureDataReloadComposer(FurnitureDataReloadComposer.MODE_DELTA, delta);
-
-            broadcast(composer);
-            LOGGER.info("FurnidataWatcher: broadcast {} ({} entries)",
-                delta.size() > this.deltaCap ? "reload-hint" : "delta", delta.size());
+            delta = this.provider.reindex(new FurnidataReader(source, this.maxBytes).read());
         } finally {
             FurnidataLock.LOCK.unlock();
         }
+        if (delta.isEmpty()) return;
+
+        // Min-interval throttle: the index has already been swapped, so we must
+        // not drop this delta (the next reindex would diff against the updated
+        // index and never re-emit it). Instead, defer the broadcast until the
+        // interval elapses. Running on a dedicated daemon thread, sleeping is
+        // safe; file events arriving meanwhile coalesce into the next cycle.
+        long sinceLast = System.currentTimeMillis() - this.lastBroadcast;
+        if (sinceLast < this.minIntervalMs) {
+            Thread.sleep(this.minIntervalMs - sinceLast);
+        }
+        this.lastBroadcast = System.currentTimeMillis();
+
+        FurnitureDataReloadComposer composer = (delta.size() > this.deltaCap)
+            ? new FurnitureDataReloadComposer(FurnitureDataReloadComposer.MODE_RELOAD_HINT, List.of())
+            : new FurnitureDataReloadComposer(FurnitureDataReloadComposer.MODE_DELTA, delta);
+
+        broadcast(composer);
+        LOGGER.info("FurnidataWatcher: broadcast {} ({} entries)",
+            delta.size() > this.deltaCap ? "reload-hint" : "delta", delta.size());
     }
 
     private void broadcast(FurnitureDataReloadComposer composer) {

Emulator/src/main/java/com/eu/habbo/habbohotel/items/FurnitureTextProvider.java

@@ -5,7 +5,6 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Locale;
@@ -44,7 +43,7 @@ public class FurnitureTextProvider {
         try {
             this.source = resolveSource();
             if (this.source == null) {
-                LOGGER.warn("FurnitureTextProvider: no furnidata source resolved — names fall back to public_name");
+                LOGGER.warn("FurnitureTextProvider: no furnidata source resolved - names fall back to public_name");
                 return;
             }
             reindex(new FurnidataReader(this.source, DEFAULT_MAX_BYTES).read());
@@ -90,20 +89,10 @@ public class FurnitureTextProvider {
     }
 
     private static Path resolveSource() {
-        String override = Emulator.getConfig().getValue("items.furnidata.path", "");
-        if (!override.isEmpty()) {
-            Path p = Paths.get(override);
-            if (Files.exists(p)) return p;
-            LOGGER.warn("FurnitureTextProvider: items.furnidata.path '{}' does not exist", override);
-            return null;
-        }
-        String basePath = Emulator.getConfig().getValue("furni.editor.asset.base.path", "");
-        if (basePath.isEmpty()) return null;
-        Path dir = Paths.get(basePath);
-        Path split = dir.resolve("furnidata");
-        if (Files.isDirectory(split)) return split;
-        Path legacy = dir.resolve("FurnitureData.json");
-        return Files.exists(legacy) ? legacy : null;
+        FurnidataSourceResolver.Source source = FurnidataSourceResolver.resolve();
+        if (source.ok()) return source.path();
+        LOGGER.warn("FurnitureTextProvider: no furnidata source resolved ({}) - {}", source.status(), source.message());
+        return null;
     }
 
     /**

Emulator/src/main/java/com/eu/habbo/habbohotel/items/Item.java

@@ -123,7 +123,7 @@ public class Item implements ISerialize {
 
         if (!set.getString("vending_ids").isEmpty()) {
             this.vendingItems = new TIntArrayList();
-            String[] vendingIds = set.getString("vending_ids").replace(";", ",").split(",");
+            String[] vendingIds = set.getString("vending_ids").replace(";", ",").replace(".", ",").split(",");
             for (String s : vendingIds) {
                 this.vendingItems.add(Integer.parseInt(s.replace(" ", "")));
             }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/InteractionGift.java

@@ -13,11 +13,13 @@ import org.slf4j.LoggerFactory;
 
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 public class InteractionGift extends HabboItem {
     private static final Logger LOGGER = LoggerFactory.getLogger(InteractionGift.class);
 
     public boolean explode = false;
+    private final AtomicBoolean opening = new AtomicBoolean(false);
     private int[] itemId;
     private int colorId = 0;
     private int ribbonId = 0;
@@ -46,6 +48,15 @@ public class InteractionGift extends HabboItem {
         }
     }
 
+    /**
+     * Claims the right to open this gift, returning true exactly once. Guards
+     * against two near-simultaneous OpenRecycleBox packets both scheduling an
+     * (async, delayed) OpenGift before the wrapper is removed from the room.
+     */
+    public boolean tryStartOpening() {
+        return this.opening.compareAndSet(false, true);
+    }
+
     @Override
     public void serializeExtradata(ServerMessage serverMessage) {
         //serverMessage.appendInt(this.colorId * 1000 + this.ribbonId);

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/InteractionMultiHeight.java

@@ -65,9 +65,8 @@ public class InteractionMultiHeight extends HabboItem {
                 if (this.getBaseItem().getMultiHeights().length > 0) {
                     this.setExtradata("" + (Integer.parseInt(this.getExtradata()) + 1) % (this.getBaseItem().getMultiHeights().length));
                     this.needsUpdate(true);
-                    room.updateTiles(room.getLayout().getTilesAt(room.getLayout().getTile(this.getX(), this.getY()), this.getBaseItem().getWidth(), this.getBaseItem().getLength(), this.getRotation()));
-                    room.updateItemState(this);
-                    //room.sendComposer(new UpdateStackHeightComposer(this.getX(), this.getY(), this.getBaseItem().getMultiHeights()[Integer.valueOf(this.getExtradata())] * 256.0D).compose());
+                    room.updateItem(this);
+                    this.updateUnitsOnItem(room);
                 }
             }
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/InteractionWired.java

@@ -18,6 +18,7 @@ import java.sql.SQLException;
 import java.util.Iterator;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 /**
  * Base abstract class for all wired furniture items (triggers, effects, conditions, extras).
@@ -61,7 +62,11 @@ public abstract class InteractionWired extends InteractionDefault {
      */
     private static final long CACHE_EXPIRY_MS = 5 * 60 * 1000;
     
-    private long cooldown;
+    private volatile long cooldown;
+    // Ensures one box is processed by a single thread at a time, so the
+    // cooldown check-and-set in WiredHandler can't double-fire when a packet
+    // thread and the room cycle thread trigger the same box concurrently.
+    private final AtomicBoolean processing = new AtomicBoolean(false);
     private final ConcurrentHashMap<Long, Long> userExecutionCache = new ConcurrentHashMap<>();
 
     InteractionWired(ResultSet set, Item baseItem) throws SQLException {
@@ -149,6 +154,15 @@ public abstract class InteractionWired extends InteractionDefault {
         this.cooldown = newMillis;
     }
 
+    /** Claims exclusive processing of this box; returns false if another thread is already in it. */
+    public boolean tryBeginProcessing() {
+        return this.processing.compareAndSet(false, true);
+    }
+
+    public void endProcessing() {
+        this.processing.set(false);
+    }
+
     @Override
     public boolean allowWiredResetState() {
         return false;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/pets/InteractionPetBreedingNest.java

@@ -190,6 +190,14 @@ public class InteractionPetBreedingNest extends HabboItem {
     }
 
     public void breed(Habbo habbo, String name, int petOneId, int petTwoId) {
+        // Guard before the destructive delete below: a crafted packet can call
+        // this on a nest that isn't full, which would delete the nest furni and
+        // then NPE on petOne/petTwo in the async runnable (losing the furni).
+        if (habbo == null || this.petOne == null || this.petTwo == null
+                || habbo.getHabboInfo().getCurrentRoom() == null) {
+            return;
+        }
+
         Emulator.getThreading().run(new QueryDeleteHabboItem(this.getId()));
 
         this.setExtradata("2");

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionHabboCount.java

@@ -65,8 +65,14 @@ public class WiredConditionHabboCount extends InteractionWiredCondition {
         } else {
             String[] data = wiredData.split(":");
 
-            this.lowerLimit = Integer.parseInt(data[0]);
-            this.upperLimit = Integer.parseInt(data[1]);
+            if (data.length >= 2) {
+                try {
+                    this.lowerLimit = Integer.parseInt(data[0].trim());
+                    this.upperLimit = Integer.parseInt(data[1].trim());
+                } catch (NumberFormatException ignored) {
+                    // malformed legacy data — keep the constructed defaults
+                }
+            }
             this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
         }
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionMatchStatePosition.java

@@ -263,22 +263,29 @@ public class WiredConditionMatchStatePosition extends InteractionWiredCondition
         } else {
             String[] data = wiredData.split(":");
 
-            int itemCount = Integer.parseInt(data[0]);
+            if (data.length >= 5) {
+                try {
+                    int itemCount = Integer.parseInt(data[0]);
 
-            String[] items = data[1].split(";");
+                    String[] items = data[1].split(";");
 
-            for (int i = 0; i < itemCount; i++) {
-                String[] stuff = items[i].split("-");
+                    for (int i = 0; i < itemCount && i < items.length; i++) {
+                        String[] stuff = items[i].split("-");
 
-                if (stuff.length >= 6)
-                    this.settings.add(new WiredMatchFurniSetting(Integer.parseInt(stuff[0]), stuff[1], Integer.parseInt(stuff[2]), Integer.parseInt(stuff[3]), Integer.parseInt(stuff[4]), Double.parseDouble(stuff[5])));
-                else if (stuff.length >= 5)
-                    this.settings.add(new WiredMatchFurniSetting(Integer.parseInt(stuff[0]), stuff[1], Integer.parseInt(stuff[2]), Integer.parseInt(stuff[3]), Integer.parseInt(stuff[4])));
+                        if (stuff.length >= 6)
+                            this.settings.add(new WiredMatchFurniSetting(Integer.parseInt(stuff[0]), stuff[1], Integer.parseInt(stuff[2]), Integer.parseInt(stuff[3]), Integer.parseInt(stuff[4]), Double.parseDouble(stuff[5])));
+                        else if (stuff.length >= 5)
+                            this.settings.add(new WiredMatchFurniSetting(Integer.parseInt(stuff[0]), stuff[1], Integer.parseInt(stuff[2]), Integer.parseInt(stuff[3]), Integer.parseInt(stuff[4])));
+                    }
+
+                    this.state = data[2].equals("1");
+                    this.direction = data[3].equals("1");
+                    this.position = data[4].equals("1");
+                } catch (NumberFormatException ignored) {
+                    // malformed legacy data — keep whatever was parsed plus defaults
+                }
             }
 
-            this.state = data[2].equals("1");
-            this.direction = data[3].equals("1");
-            this.position = data[4].equals("1");
             this.altitude = false;
             this.furniSource = this.settings.isEmpty() ? WiredSourceUtil.SOURCE_TRIGGER : WiredSourceUtil.SOURCE_SELECTED;
             this.quantifier = QUANTIFIER_ALL;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionNotHabboCount.java

@@ -64,8 +64,14 @@ public class WiredConditionNotHabboCount extends InteractionWiredCondition {
             this.userSource = data.userSource;
         } else {
             String[] data = wiredData.split(":");
-            this.lowerLimit = Integer.parseInt(data[0]);
-            this.upperLimit = Integer.parseInt(data[1]);
+            if (data.length >= 2) {
+                try {
+                    this.lowerLimit = Integer.parseInt(data[0].trim());
+                    this.upperLimit = Integer.parseInt(data[1].trim());
+                } catch (NumberFormatException ignored) {
+                    // malformed legacy data — keep the constructed defaults
+                }
+            }
             this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
         }
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/effects/WiredEffectMoveRotateFurni.java

@@ -190,10 +190,15 @@ public class WiredEffectMoveRotateFurni extends InteractionWiredEffect implement
                 }
 
                 for (String s : data[3].split("\r")) {
-                    HabboItem item = room.getHabboItem(Integer.parseInt(s));
+                    if (s.trim().isEmpty()) continue;
+                    try {
+                        HabboItem item = room.getHabboItem(Integer.parseInt(s.trim()));
 
-                    if (item != null)
-                        this.items.add(item);
+                        if (item != null)
+                            this.items.add(item);
+                    } catch (NumberFormatException ignored) {
+                        // skip malformed furni id token
+                    }
                 }
             }
             this.furniSource = this.items.isEmpty() ? WiredSourceUtil.SOURCE_TRIGGER : WiredSourceUtil.SOURCE_SELECTED;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/effects/WiredEffectTeleport.java

@@ -151,7 +151,7 @@ public class WiredEffectTeleport extends InteractionWiredEffect {
                 @Override
                 public boolean execute(InteractionWiredTrigger object) {
                     if (!object.isTriggeredByRoomUnit()) {
-                        invalidTriggers.add(object.getId());
+                        invalidTriggers.add(object.getBaseItem().getSpriteId());
                     }
                     return true;
                 }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/effects/WiredEffectUserFurniBase.java

@@ -252,7 +252,7 @@ public abstract class WiredEffectUserFurniBase extends InteractionWiredEffect {
                 @Override
                 public boolean execute(InteractionWiredTrigger object) {
                     if (!object.isTriggeredByRoomUnit()) {
-                        invalidTriggers.add(object.getId());
+                        invalidTriggers.add(object.getBaseItem().getSpriteId());
                     }
                     return true;
                 }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/extra/WiredVariableReferenceSupport.java

@@ -227,6 +227,18 @@ public final class WiredVariableReferenceSupport {
         USER_ASSIGNMENT_CACHE.entrySet().removeIf(entry -> entry.getKey().startsWith(prefix));
     }
 
+    /**
+     * Drops all cached shared-variable assignments belonging to a room. Both
+     * caches are keyed "roomId:itemId[:userId]", so the trailing colon makes the
+     * prefix match the exact room id. Called on room dispose so the static caches
+     * don't retain entries for the JVM lifetime.
+     */
+    public static void invalidateRoom(int roomId) {
+        String prefix = roomId + ":";
+        USER_ASSIGNMENT_CACHE.entrySet().removeIf(entry -> entry.getKey().startsWith(prefix));
+        ROOM_ASSIGNMENT_CACHE.entrySet().removeIf(entry -> entry.getKey().startsWith(prefix));
+    }
+
     public static SharedRoomAssignment getSharedRoomAssignment(WiredExtraVariableReference reference) {
         if (reference == null || !reference.isRoomReference()) {
             return null;

Emulator/src/main/java/com/eu/habbo/habbohotel/messenger/Messenger.java

@@ -53,7 +53,7 @@ public class Messenger {
     public static THashSet<MessengerBuddy> searchUsers(String username) {
         THashSet<MessengerBuddy> users = new THashSet<>();
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("SELECT * FROM users WHERE username LIKE ? ORDER BY username ASC LIMIT " + Emulator.getConfig().getInt("hotel.messenger.search.maxresults"))) {
-            statement.setString(1, username + "%");
+            statement.setString(1, com.eu.habbo.util.SqlLikeEscaper.escape(username) + "%");
             try (ResultSet set = statement.executeQuery()) {
                 while (set.next()) {
                     users.add(new MessengerBuddy(set, false));

Emulator/src/main/java/com/eu/habbo/habbohotel/modtool/HousekeepingAuditLog.java

@@ -0,0 +1,97 @@
+package com.eu.habbo.habbohotel.modtool;
+
+import com.eu.habbo.Emulator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.SQLException;
+import java.sql.Statement;
+
+/**
+ * Append-only audit trail for privileged housekeeping/admin actions (rank grants,
+ * currency grants, etc.). There was previously no record of which operator did
+ * what to whom. Writes are dispatched off the calling thread; the backing table
+ * is created on first use so no manual migration is required.
+ */
+public final class HousekeepingAuditLog {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(HousekeepingAuditLog.class);
+
+    private static volatile boolean tableReady = false;
+
+    private HousekeepingAuditLog() {
+    }
+
+    /**
+     * Records a privileged action asynchronously.
+     *
+     * @param operatorId   the acting staff member's user id
+     * @param operatorName the acting staff member's username
+     * @param action       a short action key, e.g. {@code "user.set_rank"}
+     * @param targetUserId the affected user's id (0 if not applicable)
+     * @param detail       free-form detail, e.g. {@code "rankId=6"} (capped to 512 chars)
+     * @param ip           the operator's IP, for correlation
+     */
+    public static void log(int operatorId, String operatorName, String action, int targetUserId, String detail, String ip) {
+        Emulator.getThreading().run(() -> writeEntry(operatorId, operatorName, action, targetUserId, detail, ip));
+    }
+
+    private static void writeEntry(int operatorId, String operatorName, String action, int targetUserId, String detail, String ip) {
+        ensureTable();
+
+        try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+             PreparedStatement statement = connection.prepareStatement(
+                     "INSERT INTO housekeeping_log (operator_id, operator_name, action, target_user_id, detail, ip, timestamp) " +
+                             "VALUES (?, ?, ?, ?, ?, ?, ?)")) {
+            statement.setInt(1, operatorId);
+            statement.setString(2, operatorName != null ? operatorName : "");
+            statement.setString(3, action != null ? action : "");
+            statement.setInt(4, targetUserId);
+            statement.setString(5, truncate(detail));
+            statement.setString(6, ip != null ? ip : "");
+            statement.setInt(7, Emulator.getIntUnixTimestamp());
+            statement.execute();
+        } catch (SQLException e) {
+            LOGGER.error("Failed to write housekeeping audit log entry", e);
+        }
+    }
+
+    private static String truncate(String detail) {
+        if (detail == null) return "";
+        return detail.length() > 512 ? detail.substring(0, 512) : detail;
+    }
+
+    private static void ensureTable() {
+        if (tableReady) {
+            return;
+        }
+        synchronized (HousekeepingAuditLog.class) {
+            if (tableReady) {
+                return;
+            }
+            try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+                 Statement statement = connection.createStatement()) {
+                statement.execute(
+                        "CREATE TABLE IF NOT EXISTS housekeeping_log (" +
+                                "id INT UNSIGNED NOT NULL AUTO_INCREMENT, " +
+                                "operator_id INT NOT NULL, " +
+                                "operator_name VARCHAR(64) NOT NULL DEFAULT '', " +
+                                "action VARCHAR(64) NOT NULL, " +
+                                "target_user_id INT NOT NULL DEFAULT 0, " +
+                                "detail VARCHAR(512) NOT NULL DEFAULT '', " +
+                                "ip VARCHAR(64) NOT NULL DEFAULT '', " +
+                                "timestamp INT NOT NULL, " +
+                                "PRIMARY KEY (id), " +
+                                "KEY idx_operator (operator_id), " +
+                                "KEY idx_target (target_user_id), " +
+                                "KEY idx_timestamp (timestamp)" +
+                                ") ENGINE=InnoDB DEFAULT CHARSET=utf8mb4");
+                tableReady = true;
+            } catch (SQLException e) {
+                LOGGER.error("Failed to create housekeeping_log table", e);
+            }
+        }
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/modtool/ModToolManager.java

@@ -378,7 +378,9 @@ public class ModToolManager {
             statement.setString(6, reason);
             statement.setString(7, type.getType());
 
-            try (ResultSet set = statement.executeQuery()) {
+            statement.executeUpdate();
+
+            try (ResultSet set = statement.getGeneratedKeys()) {
                 if (set.next()) {
                     try (PreparedStatement selectBanStatement = connection.prepareStatement("SELECT * FROM bans WHERE id = ? LIMIT 1")) {
                         selectBanStatement.setInt(1, set.getInt(1));
@@ -434,6 +436,10 @@ public class ModToolManager {
         Habbo target = Emulator.getGameEnvironment().getHabboManager().getHabbo(targetUserId);
         HabboInfo offlineInfo = target != null ? target.getHabboInfo() : HabboManager.getOfflineHabboInfo(targetUserId);
 
+        if (offlineInfo == null) {
+            return bans;
+        }
+
         if (moderator.getHabboInfo().getRank().getId() < offlineInfo.getRank().getId()) {
             return bans;
         }
@@ -454,7 +460,7 @@ public class ModToolManager {
         bans.add(ban);
 
         if (target != null) {
-            Emulator.getGameServer().getGameClientManager().disposeClient(target.getClient());
+            Emulator.getGameServer().getGameClientManager().forceDisposeClient(target.getClient());
         }
 
         if ((type == ModToolBanType.IP || type == ModToolBanType.SUPER) && target != null && !ban.ip.equals("offline")) {
@@ -465,7 +471,7 @@ public class ModToolManager {
                 Emulator.getPluginManager().fireEvent(new SupportUserBannedEvent(moderator, h, ban));
                 Emulator.getThreading().run(ban);
                 bans.add(ban);
-                Emulator.getGameServer().getGameClientManager().disposeClient(h.getClient());
+                Emulator.getGameServer().getGameClientManager().forceDisposeClient(h.getClient());
             }
         }
 
@@ -477,7 +483,7 @@ public class ModToolManager {
                 Emulator.getPluginManager().fireEvent(new SupportUserBannedEvent(moderator, h, ban));
                 Emulator.getThreading().run(ban);
                 bans.add(ban);
-                Emulator.getGameServer().getGameClientManager().disposeClient(h.getClient());
+                Emulator.getGameServer().getGameClientManager().forceDisposeClient(h.getClient());
             }
         }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/Room.java

@@ -213,16 +213,16 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   public java.util.Set<Integer> getYoutubeWatchers() { return this.youtubeWatchers; }
 
   public void setYoutubeVideo(String videoId, String senderName, java.util.List<String> playlist) {
-      this.youtubeCurrentVideo = videoId;
-      this.youtubeSenderName = senderName;
-      this.youtubePlaylist.clear();
-      if (playlist != null) this.youtubePlaylist.addAll(playlist);
+    this.youtubeCurrentVideo = videoId;
+    this.youtubeSenderName = senderName;
+    this.youtubePlaylist.clear();
+    if (playlist != null) this.youtubePlaylist.addAll(playlist);
   }
 
   public void clearYoutubeVideo() {
-      this.youtubeCurrentVideo = "";
-      this.youtubeSenderName = "";
-      this.youtubePlaylist.clear();
+    this.youtubeCurrentVideo = "";
+    this.youtubeSenderName = "";
+    this.youtubePlaylist.clear();
   }
 
   public final THashMap<String, Object> cache;
@@ -239,9 +239,9 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     this.usersMax = set.getInt("users_max");
     this.score = set.getInt("score");
     this.category = set.getInt("category");
-    this.floorPaint = set.getString("paper_floor");
-    this.wallPaint = set.getString("paper_wall");
-    this.backgroundPaint = set.getString("paper_landscape");
+    this.floorPaint = set.getString("paper_floor") == null ? "0.0" : set.getString("paper_floor");
+    this.wallPaint = set.getString("paper_wall") == null ? "0.0" : set.getString("paper_wall");
+    this.backgroundPaint = set.getString("paper_landscape") == null ? "0.0" : set.getString("paper_landscape");
     this.wallSize = set.getInt("thickness_wall");
     this.wallHeight = set.getInt("wall_height");
     this.floorSize = set.getInt("thickness_floor");
@@ -464,7 +464,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
       if (this.loaded || this.loadingInProgress || !this.preLoaded) {
         return;
       }
-      
+
       this.loadingInProgress = true;
       this.loadingFuture = CompletableFuture.runAsync(() -> {
         this.loadDataInternal();
@@ -484,7 +484,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
       }
       future = this.loadingFuture;
     }
-    
+
     if (future != null) {
       try {
         future.join();
@@ -499,7 +499,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   public void loadData() {
     CompletableFuture<Void> futureToWait = null;
     boolean shouldLoad = false;
-    
+
     synchronized (this.loadLock) {
       if (this.loadingInProgress) {
         // Get the future to wait on outside the lock
@@ -509,7 +509,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
         shouldLoad = true;
       }
     }
-    
+
     // Wait for existing load outside the lock
     if (futureToWait != null) {
       try {
@@ -519,7 +519,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
       }
       return;
     }
-    
+
     // Load if needed
     if (shouldLoad) {
       this.loadDataInternal();
@@ -559,7 +559,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
         CompletableFuture.runAsync(() -> {
           try (Connection promoConnection = Emulator.getDatabase().getDataSource().getConnection();
                PreparedStatement stmt = promoConnection.prepareStatement(
-                   "SELECT * FROM room_promotions WHERE room_id = ? AND end_timestamp > ? LIMIT 1")) {
+                       "SELECT * FROM room_promotions WHERE room_id = ? AND end_timestamp > ? LIMIT 1")) {
             stmt.setInt(1, this.id);
             stmt.setInt(2, Emulator.getIntUnixTimestamp());
             try (ResultSet promoSet = stmt.executeQuery()) {
@@ -654,7 +654,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
       }
 
       this.roomCycleTask = Emulator.getThreading().getService()
-          .scheduleAtFixedRate(this, 500, 500, TimeUnit.MILLISECONDS);
+              .scheduleAtFixedRate(this, 500, 500, TimeUnit.MILLISECONDS);
     } catch (Exception e) {
       LOGGER.error("Caught exception during room load", e);
     }
@@ -673,7 +673,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
       item.setExtradata("1");
       this.updateItem(item);
     }
-    
+
     // Set loaded flag with lock
     synchronized (this.loadLock) {
       this.loaded = true;
@@ -690,7 +690,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
         this.layout = Emulator.getGameEnvironment().getRoomManager().loadCustomLayout(this);
       } else {
         this.layout = Emulator.getGameEnvironment().getRoomManager()
-            .loadLayout(this.layoutName, this);
+                .loadLayout(this.layoutName, this);
       }
     }
   }
@@ -722,7 +722,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     this.unitManager.clearBots();
 
     try (PreparedStatement statement = connection.prepareStatement(
-        "SELECT users.username AS owner_name, bots.* FROM bots INNER JOIN users ON bots.user_id = users.id WHERE room_id = ?")) {
+            "SELECT users.username AS owner_name, bots.* FROM bots INNER JOIN users ON bots.user_id = users.id WHERE room_id = ?")) {
       statement.setInt(1, this.id);
       try (ResultSet set = statement.executeQuery()) {
         while (set.next()) {
@@ -733,11 +733,11 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
             b.setRoomUnit(new RoomUnit());
             b.getRoomUnit().setPathFinderRoom(this);
             b.getRoomUnit()
-                .setLocation(this.layout.getTile((short) set.getInt("x"), (short) set.getInt("y")));
+                    .setLocation(this.layout.getTile((short) set.getInt("x"), (short) set.getInt("y")));
             if (b.getRoomUnit().getCurrentLocation() == null) {
               b.getRoomUnit().setLocation(this.getLayout().getDoorTile());
               b.getRoomUnit()
-                  .setRotation(RoomUserRotation.fromValue(this.getLayout().getDoorDirection()));
+                      .setRotation(RoomUserRotation.fromValue(this.getLayout().getDoorDirection()));
             } else {
               b.getRoomUnit().setZ(set.getDouble("z"));
               b.getRoomUnit().setPreviousLocationZ(set.getDouble("z"));
@@ -761,7 +761,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     this.unitManager.clearPets();
 
     try (PreparedStatement statement = connection.prepareStatement(
-        "SELECT users.username as pet_owner_name, users_pets.* FROM users_pets INNER JOIN users ON users_pets.user_id = users.id WHERE room_id = ?")) {
+            "SELECT users.username as pet_owner_name, users_pets.* FROM users_pets INNER JOIN users ON users_pets.user_id = users.id WHERE room_id = ?")) {
       statement.setInt(1, this.id);
       try (ResultSet set = statement.executeQuery()) {
         while (set.next()) {
@@ -771,11 +771,11 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
             pet.setRoomUnit(new RoomUnit());
             pet.getRoomUnit().setPathFinderRoom(this);
             pet.getRoomUnit()
-                .setLocation(this.layout.getTile((short) set.getInt("x"), (short) set.getInt("y")));
+                    .setLocation(this.layout.getTile((short) set.getInt("x"), (short) set.getInt("y")));
             if (pet.getRoomUnit().getCurrentLocation() == null) {
               pet.getRoomUnit().setLocation(this.getLayout().getDoorTile());
               pet.getRoomUnit()
-                  .setRotation(RoomUserRotation.fromValue(this.getLayout().getDoorDirection()));
+                      .setRotation(RoomUserRotation.fromValue(this.getLayout().getDoorDirection()));
             } else {
               pet.getRoomUnit().setZ(set.getDouble("z"));
               pet.getRoomUnit().setRotation(RoomUserRotation.values()[set.getInt("rot")]);
@@ -849,7 +849,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
 
       THashSet<RoomTile> updatedTiles = new THashSet<>();
       Rectangle rectangle = RoomLayout.getRectangle(item.getX(), item.getY(),
-          item.getBaseItem().getWidth(), item.getBaseItem().getLength(), item.getRotation());
+              item.getBaseItem().getWidth(), item.getBaseItem().getLength(), item.getRotation());
 
       for (short x = (short) rectangle.x; x < rectangle.x + rectangle.getWidth(); x++) {
         for (short y = (short) rectangle.y; y < rectangle.y + rectangle.getHeight(); y++) {
@@ -878,7 +878,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     }
 
     Habbo habbo = (picker != null && picker.getHabboInfo().getId() == item.getId() ? picker
-        : Emulator.getGameServer().getGameClientManager().getHabbo(item.getUserId()));
+            : Emulator.getGameServer().getGameClientManager().getHabbo(item.getUserId()));
     if (!trackedBuildersClubItem && habbo != null) {
       habbo.getInventory().getItemsComponent().addItem(item);
       habbo.getClient().sendResponse(new AddHabboItemComposer(item));
@@ -1116,7 +1116,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     message.appendInt(this.category);
 
     String[] tags = Arrays.stream(this.tags.split(";")).filter(t -> !t.isEmpty())
-        .toArray(String[]::new);
+            .toArray(String[]::new);
     message.appendInt(tags.length);
     for (String s : tags) {
       message.appendString(s);
@@ -1183,8 +1183,8 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   public void save() {
     if (this.needsUpdate) {
       try (Connection connection = Emulator.getDatabase().getDataSource()
-          .getConnection(); PreparedStatement statement = connection.prepareStatement(
-          "UPDATE rooms SET name = ?, description = ?, password = ?, state = ?, users_max = ?, category = ?, score = ?, paper_floor = ?, paper_wall = ?, paper_landscape = ?, thickness_wall = ?, wall_height = ?, thickness_floor = ?, moodlight_data = ?, tags = ?, allow_other_pets = ?, allow_other_pets_eat = ?, allow_walkthrough = ?, allow_hidewall = ?, chat_mode = ?, chat_weight = ?, chat_speed = ?, chat_hearing_distance = ?, chat_protection =?, who_can_mute = ?, who_can_kick = ?, who_can_ban = ?, poll_id = ?, guild_id = ?, roller_speed = ?, override_model = ?, is_staff_picked = ?, promoted = ?, trade_mode = ?, move_diagonally = ?, owner_id = ?, owner_name = ?, jukebox_active = ?, hidewired = ?, allow_underpass = ?, youtube_enabled = ?, builders_club_trial_locked = ?, builders_club_original_state = ? WHERE id = ?")) {
+              .getConnection(); PreparedStatement statement = connection.prepareStatement(
+              "UPDATE rooms SET name = ?, description = ?, password = ?, state = ?, users_max = ?, category = ?, score = ?, paper_floor = ?, paper_wall = ?, paper_landscape = ?, thickness_wall = ?, wall_height = ?, thickness_floor = ?, moodlight_data = ?, tags = ?, allow_other_pets = ?, allow_other_pets_eat = ?, allow_walkthrough = ?, allow_hidewall = ?, chat_mode = ?, chat_weight = ?, chat_speed = ?, chat_hearing_distance = ?, chat_protection =?, who_can_mute = ?, who_can_kick = ?, who_can_ban = ?, poll_id = ?, guild_id = ?, roller_speed = ?, override_model = ?, is_staff_picked = ?, promoted = ?, trade_mode = ?, move_diagonally = ?, owner_id = ?, owner_name = ?, jukebox_active = ?, hidewired = ?, allow_underpass = ?, youtube_enabled = ?, builders_club_trial_locked = ?, builders_club_original_state = ? WHERE id = ?")) {
         statement.setString(1, this.name);
         statement.setString(2, this.description);
         statement.setString(3, this.password);
@@ -1252,8 +1252,8 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
    */
   public void updateDatabaseUserCount() {
     try (Connection connection = Emulator.getDatabase().getDataSource()
-        .getConnection(); PreparedStatement statement = connection.prepareStatement(
-        "UPDATE rooms SET users = ? WHERE id = ? LIMIT 1")) {
+            .getConnection(); PreparedStatement statement = connection.prepareStatement(
+            "UPDATE rooms SET users = ? WHERE id = ? LIMIT 1")) {
       statement.setInt(1, this.getUserCount());
       statement.setInt(2, this.id);
       statement.executeUpdate();
@@ -1493,6 +1493,10 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     return this.getGuildId() != 0;
   }
 
+  public boolean belongsToGuild() {
+    return this.guild > 0;
+  }
+
   public void setGuild(int guild) {
     this.guild = guild;
   }
@@ -1600,7 +1604,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
           if (extraData.length == 4) {
             if (extraData[0].equalsIgnoreCase("1")) {
               return Color.getHSBColor(Integer.parseInt(extraData[1]),
-                  Integer.parseInt(extraData[2]), Integer.parseInt(extraData[3]));
+                      Integer.parseInt(extraData[2]), Integer.parseInt(extraData[3]));
             }
           }
         }
@@ -1707,7 +1711,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
 
   public String[] filterAnything() {
     return new String[]{this.getOwnerName(), this.getGuildName(), this.getDescription(),
-        this.getPromotionDesc()};
+            this.getPromotionDesc()};
   }
 
   public long getCycleTimestamp() {
@@ -1914,7 +1918,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
 
     // If the broadcast sender leaves, stop the broadcast for everyone
     if (!this.youtubeCurrentVideo.isEmpty()
-        && habbo.getHabboInfo().getUsername().equals(this.youtubeSenderName)) {
+            && habbo.getHabboInfo().getUsername().equals(this.youtubeSenderName)) {
       this.clearYoutubeVideo();
       this.sendComposer(new com.eu.habbo.messages.outgoing.rooms.youtube.YouTubeRoomBroadcastComposer("", "", java.util.Collections.emptyList()).compose());
     }
@@ -2059,7 +2063,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   }
 
   public void talk(final Habbo habbo, final RoomChatMessage roomChatMessage, RoomChatType chatType,
-      boolean ignoreWired) {
+                   boolean ignoreWired) {
     this.chatManager.talk(habbo, roomChatMessage, chatType, ignoreWired);
   }
 
@@ -2204,7 +2208,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   private void loadRights(Connection connection) {
     this.rights.clear();
     try (PreparedStatement statement = connection.prepareStatement(
-        "SELECT user_id FROM room_rights WHERE room_id = ?")) {
+            "SELECT user_id FROM room_rights WHERE room_id = ?")) {
       statement.setInt(1, this.id);
       try (ResultSet set = statement.executeQuery()) {
         while (set.next()) {
@@ -2220,7 +2224,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     this.bannedHabbos.clear();
 
     try (PreparedStatement statement = connection.prepareStatement(
-        "SELECT users.username, users.id, room_bans.* FROM room_bans INNER JOIN users ON room_bans.user_id = users.id WHERE ends > ? AND room_bans.room_id = ?")) {
+            "SELECT users.username, users.id, room_bans.* FROM room_bans INNER JOIN users ON room_bans.user_id = users.id WHERE ends > ? AND room_bans.room_id = ?")) {
       statement.setInt(1, Emulator.getIntUnixTimestamp());
       statement.setInt(2, this.id);
       try (ResultSet set = statement.executeQuery()) {
@@ -2338,24 +2342,24 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
       this.wiredSettingsLoaded = true;
 
       Emulator.getThreading().run(() -> {
-          try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
-               PreparedStatement statement = connection.prepareStatement(
-                   "INSERT INTO room_wired_settings (room_id, inspect_mask, modify_mask) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE inspect_mask = VALUES(inspect_mask), modify_mask = VALUES(modify_mask)")) {
-            statement.setInt(1, finalId);
-            statement.setInt(2, finalInspectMask);
-            statement.setInt(3, finalModifyMask);
-            statement.executeUpdate();
-          } catch (SQLException e) {
-            synchronized (this.wiredSettingsLock) {
-                if (this.wiredInspectMask == finalInspectMask && this.wiredModifyMask == finalModifyMask) {
-                    this.wiredInspectMask = previousInspectMask;
-                    this.wiredModifyMask = previousModifyMask;
-                }
+        try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+             PreparedStatement statement = connection.prepareStatement(
+                     "INSERT INTO room_wired_settings (room_id, inspect_mask, modify_mask) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE inspect_mask = VALUES(inspect_mask), modify_mask = VALUES(modify_mask)")) {
+          statement.setInt(1, finalId);
+          statement.setInt(2, finalInspectMask);
+          statement.setInt(3, finalModifyMask);
+          statement.executeUpdate();
+        } catch (SQLException e) {
+          synchronized (this.wiredSettingsLock) {
+            if (this.wiredInspectMask == finalInspectMask && this.wiredModifyMask == finalModifyMask) {
+              this.wiredInspectMask = previousInspectMask;
+              this.wiredModifyMask = previousModifyMask;
             }
-            LOGGER.error("Caught SQL exception while saving wired room settings", e);
           }
+          LOGGER.error("Caught SQL exception while saving wired room settings", e);
+        }
       });
-      
+
       this.pushWiredSettingsToCurrentHabbos();
       return true;
     }
@@ -2430,7 +2434,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
 
       try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
            PreparedStatement statement = connection.prepareStatement(
-               "SELECT inspect_mask, modify_mask FROM room_wired_settings WHERE room_id = ? LIMIT 1")) {
+                   "SELECT inspect_mask, modify_mask FROM room_wired_settings WHERE room_id = ? LIMIT 1")) {
         statement.setInt(1, this.id);
 
         try (ResultSet set = statement.executeQuery()) {
@@ -2530,15 +2534,15 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     }
 
     if (habbo.getRoomUnit().hasStatus(RoomUnitStatus.SIT) || !habbo.getRoomUnit()
-        .canForcePosture()) {
+            .canForcePosture()) {
       return;
     }
 
     this.dance(habbo, DanceType.NONE);
     habbo.getRoomUnit().cmdSit = true;
     habbo.getRoomUnit().setBodyRotation(
-        RoomUserRotation.values()[habbo.getRoomUnit().getBodyRotation().getValue()
-            - habbo.getRoomUnit().getBodyRotation().getValue() % 2]);
+            RoomUserRotation.values()[habbo.getRoomUnit().getBodyRotation().getValue()
+                    - habbo.getRoomUnit().getBodyRotation().getValue() % 2]);
     habbo.getRoomUnit().setStatus(RoomUnitStatus.SIT, 0.5 + "");
     this.sendComposer(new RoomUserStatusComposer(habbo.getRoomUnit()).compose());
     WiredManager.triggerUserPerformsAction(this, habbo.getRoomUnit(), WiredUserActionType.SIT, -1);
@@ -2552,11 +2556,11 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     HabboItem item = this.getTopItemAt(habbo.getRoomUnit().getX(), habbo.getRoomUnit().getY());
     if (item == null || !item.getBaseItem().allowSit() || !item.getBaseItem().allowLay()) {
       boolean wasSittingOrLaying = habbo.getRoomUnit().hasStatus(RoomUnitStatus.SIT)
-          || habbo.getRoomUnit().hasStatus(RoomUnitStatus.LAY);
+              || habbo.getRoomUnit().hasStatus(RoomUnitStatus.LAY);
       habbo.getRoomUnit().cmdStand = true;
       habbo.getRoomUnit().setBodyRotation(
-          RoomUserRotation.values()[habbo.getRoomUnit().getBodyRotation().getValue()
-              - habbo.getRoomUnit().getBodyRotation().getValue() % 2]);
+              RoomUserRotation.values()[habbo.getRoomUnit().getBodyRotation().getValue()
+                      - habbo.getRoomUnit().getBodyRotation().getValue() % 2]);
       habbo.getRoomUnit().removeStatus(RoomUnitStatus.SIT);
       habbo.getRoomUnit().removeStatus(RoomUnitStatus.LAY);
       this.sendComposer(new RoomUserStatusComposer(habbo.getRoomUnit()).compose());
@@ -2584,38 +2588,38 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   }
 
   public void updateItem(HabboItem item) {
-      if (this.isLoaded()) {
-        if (item != null && item.getRoomId() == this.id) {
-          if (item.getBaseItem() != null) {
-            if (item.getBaseItem().getType() == FurnitureType.FLOOR) {
-              this.sendComposer(new FloorItemUpdateComposer(item).compose());
-              this.updateTiles(this.getLayout()
-                  .getTilesAt(this.layout.getTile(item.getX(), item.getY()),
-                      item.getBaseItem().getWidth(), item.getBaseItem().getLength(),
-                      item.getRotation()));
+    if (this.isLoaded()) {
+      if (item != null && item.getRoomId() == this.id) {
+        if (item.getBaseItem() != null) {
+          if (item.getBaseItem().getType() == FurnitureType.FLOOR) {
+            this.sendComposer(new FloorItemUpdateComposer(item).compose());
+            this.updateTiles(this.getLayout()
+                    .getTilesAt(this.layout.getTile(item.getX(), item.getY()),
+                            item.getBaseItem().getWidth(), item.getBaseItem().getLength(),
+                            item.getRotation()));
 
-              if (RoomAreaHideSupport.isControllerItem(item)) {
-                RoomAreaHideSupport.sendState(this, item);
-              }
-            } else if (item.getBaseItem().getType() == FurnitureType.WALL) {
-              this.sendComposer(new WallItemUpdateComposer(item).compose());
+            if (RoomAreaHideSupport.isControllerItem(item)) {
+              RoomAreaHideSupport.sendState(this, item);
             }
+          } else if (item.getBaseItem().getType() == FurnitureType.WALL) {
+            this.sendComposer(new WallItemUpdateComposer(item).compose());
           }
         }
+      }
     }
   }
 
   public void updateItemState(HabboItem item) {
-      if (item != null && RoomAreaHideSupport.isControllerItem(item)) {
-        this.updateItem(item);
-        return;
-      }
+    if (item != null && RoomAreaHideSupport.isControllerItem(item)) {
+      this.updateItem(item);
+      return;
+    }
 
-      if (!item.isLimited()) {
-        this.sendComposer(new ItemStateComposer(item).compose());
-      } else {
-        this.sendComposer(new FloorItemUpdateComposer(item).compose());
-      }
+    if (!item.isLimited()) {
+      this.sendComposer(new ItemStateComposer(item).compose());
+    } else {
+      this.sendComposer(new FloorItemUpdateComposer(item).compose());
+    }
 
     if (item.getBaseItem().getType() == FurnitureType.FLOOR) {
       if (this.layout == null) {
@@ -2623,8 +2627,8 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
       }
 
       this.updateTiles(this.getLayout()
-          .getTilesAt(this.layout.getTile(item.getX(), item.getY()), item.getBaseItem().getWidth(),
-              item.getBaseItem().getLength(), item.getRotation()));
+              .getTilesAt(this.layout.getTile(item.getX(), item.getY()), item.getBaseItem().getWidth(),
+                      item.getBaseItem().getLength(), item.getRotation()));
 
       if (item instanceof InteractionMultiHeight) {
         ((InteractionMultiHeight) item).updateUnitsOnItem(this);
@@ -2632,12 +2636,12 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
     }
 
     if (item.getBaseItem().getType() == FurnitureType.FLOOR
-        && (RoomConfInvisSupport.isControllerItem(item) || RoomConfInvisSupport.isTarget(item))) {
+            && (RoomConfInvisSupport.isControllerItem(item) || RoomConfInvisSupport.isTarget(item))) {
       RoomConfInvisSupport.sendState(this);
     }
 
     if (item.getBaseItem().getType() == FurnitureType.FLOOR
-        && RoomHanditemBlockSupport.isControllerItem(item)) {
+            && RoomHanditemBlockSupport.isControllerItem(item)) {
       RoomHanditemBlockSupport.sendState(this);
     }
   }
@@ -2671,18 +2675,18 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   public void refreshGuild(Guild guild) {
     if (guild.getRoomId() == this.id) {
       THashSet<GuildMember> members = Emulator.getGameEnvironment().getGuildManager()
-          .getGuildMembers(guild.getId());
+              .getGuildMembers(guild.getId());
 
       for (Habbo habbo : this.getHabbos()) {
         Optional<GuildMember> member = members.stream()
-            .filter(m -> m.getUserId() == habbo.getHabboInfo().getId()).findAny();
+                .filter(m -> m.getUserId() == habbo.getHabboInfo().getId()).findAny();
 
         if (!member.isPresent()) {
           continue;
         }
 
         habbo.getClient()
-            .sendResponse(new GuildInfoComposer(guild, habbo.getClient(), false, member.get()));
+                .sendResponse(new GuildInfoComposer(guild, habbo.getClient(), false, member.get()));
       }
     }
 
@@ -2717,7 +2721,7 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
       if (habbo.getHabboInfo().getCurrentRoom() == this) {
         if (habbo.getHabboInfo().getId() != this.ownerId) {
           if (!(habbo.hasPermission(Permission.ACC_ANYROOMOWNER) || habbo.hasPermission(
-              Permission.ACC_MOVEROTATE))) {
+                  Permission.ACC_MOVEROTATE))) {
             this.refreshRightsForHabbo(habbo);
           }
         }
@@ -2803,18 +2807,18 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
       }
     } else {
       this.sendComposer(new RoomFloorItemsComposer(this.itemManager.getFurniOwnerNames(),
-          this.roomSpecialTypes.getTriggers()).compose());
+              this.roomSpecialTypes.getTriggers()).compose());
       this.sendComposer(new RoomFloorItemsComposer(this.itemManager.getFurniOwnerNames(),
-          this.roomSpecialTypes.getEffects()).compose());
+              this.roomSpecialTypes.getEffects()).compose());
       this.sendComposer(new RoomFloorItemsComposer(this.itemManager.getFurniOwnerNames(),
-          this.roomSpecialTypes.getConditions()).compose());
+              this.roomSpecialTypes.getConditions()).compose());
       this.sendComposer(new RoomFloorItemsComposer(this.itemManager.getFurniOwnerNames(),
-          this.roomSpecialTypes.getExtras()).compose());
+              this.roomSpecialTypes.getExtras()).compose());
     }
   }
 
   public FurnitureMovementError canPlaceFurnitureAt(HabboItem item, Habbo habbo, RoomTile tile,
-      int rotation) {
+                                                    int rotation) {
     return this.itemManager.canPlaceFurnitureAt(item, habbo, tile, rotation);
   }
 
@@ -2823,17 +2827,17 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   }
 
   public FurnitureMovementError furnitureFitsAt(RoomTile tile, HabboItem item, int rotation,
-      boolean checkForUnits) {
+                                                boolean checkForUnits) {
     return this.itemManager.furnitureFitsAt(tile, item, rotation, checkForUnits);
   }
 
   public FurnitureMovementError furnitureFitsAtWithPhysics(RoomTile tile, HabboItem item, int rotation,
-      boolean checkForUnits, WiredMovementPhysics physics) {
+                                                           boolean checkForUnits, WiredMovementPhysics physics) {
     return this.itemManager.furnitureFitsAtWithPhysics(tile, item, rotation, checkForUnits, physics);
   }
 
   public FurnitureMovementError placeFloorFurniAt(HabboItem item, RoomTile tile, int rotation,
-      Habbo owner) {
+                                                  Habbo owner) {
     return this.itemManager.placeFloorFurniAt(item, tile, rotation, owner);
   }
 
@@ -2842,17 +2846,17 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   }
 
   public FurnitureMovementError moveFurniTo(HabboItem item, RoomTile tile, int rotation,
-      Habbo actor) {
+                                            Habbo actor) {
     return this.itemManager.moveFurniTo(item, tile, rotation, actor);
   }
 
   public FurnitureMovementError moveFurniTo(HabboItem item, RoomTile tile, int rotation,
-      Habbo actor, boolean sendUpdates) {
+                                            Habbo actor, boolean sendUpdates) {
     return this.itemManager.moveFurniTo(item, tile, rotation, actor, sendUpdates);
   }
 
   public FurnitureMovementError moveFurniTo(HabboItem item, RoomTile tile, int rotation,
-      Habbo actor, boolean sendUpdates, boolean checkForUnits) {
+                                            Habbo actor, boolean sendUpdates, boolean checkForUnits) {
     return this.itemManager.moveFurniTo(item, tile, rotation, actor, sendUpdates, checkForUnits);
   }
 
@@ -2869,12 +2873,12 @@ public class Room implements Comparable<Room>, ISerialize, Runnable {
   }
 
   public FurnitureMovementError moveFurniToWithPhysics(HabboItem item, RoomTile tile, int rotation,
-      Habbo actor, boolean sendUpdates, boolean checkForUnits, WiredMovementPhysics physics) {
+                                                       Habbo actor, boolean sendUpdates, boolean checkForUnits, WiredMovementPhysics physics) {
     return this.itemManager.moveFurniToWithPhysics(item, tile, rotation, actor, sendUpdates, checkForUnits, physics);
   }
 
   public FurnitureMovementError moveFurniToWithPhysics(HabboItem item, RoomTile tile, int rotation, double z,
-      Habbo actor, boolean sendUpdates, boolean checkForUnits, WiredMovementPhysics physics) {
+                                                       Habbo actor, boolean sendUpdates, boolean checkForUnits, WiredMovementPhysics physics) {
     return this.itemManager.moveFurniToWithPhysics(item, tile, rotation, z, actor, sendUpdates, checkForUnits, physics);
   }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomCycleManager.java

@@ -300,15 +300,20 @@ public class RoomCycleManager {
             return;
         }
 
-        TIntObjectIterator<Bot> botIterator = currentBots.iterator();
-        for (int i = currentBots.size(); i-- > 0; ) {
+        // Snapshot under the map monitor (currentBots is a synchronizedMap whose
+        // iterator isn't concurrency-safe), then cycle OFF-lock. Holding the
+        // monitor across the whole tick would block bot place/pickup and room
+        // dispose for the tick duration AND invert the lock order vs
+        // roomUnitLock -> currentBots taken by RoomUnitManager.addBot/clear.
+        final ArrayList<Bot> bots;
+        synchronized (currentBots) {
+            bots = new ArrayList<>(currentBots.valueCollection());
+        }
+
+        for (Bot bot : bots) {
             try {
-                final Bot bot;
-                try {
-                    botIterator.advance();
-                    bot = botIterator.value();
-                } catch (Exception e) {
-                    break;
+                if (bot == null || bot.getRoomUnit() == null) {
+                    continue;
                 }
 
                 if (!this.room.isAllowBotsWalk() && bot.getRoomUnit().isWalking()) {
@@ -322,10 +327,8 @@ public class RoomCycleManager {
                 if (this.cycleRoomUnit(bot.getRoomUnit(), RoomUnitType.BOT)) {
                     updatedUnit.add(bot.getRoomUnit());
                 }
-
-            } catch (NoSuchElementException e) {
+            } catch (Exception e) {
                 LOGGER.error("Caught exception", e);
-                break;
             }
         }
     }
@@ -339,31 +342,37 @@ public class RoomCycleManager {
             return;
         }
 
-        TIntObjectIterator<Pet> petIterator = currentPets.iterator();
-        for (int i = currentPets.size(); i-- > 0; ) {
+        // Snapshot under the monitor, then cycle off-lock (see processBots): avoids
+        // holding currentPets for the whole tick and the roomUnitLock inversion.
+        final ArrayList<Pet> pets;
+        synchronized (currentPets) {
+            pets = new ArrayList<>(currentPets.valueCollection());
+        }
+
+        for (Pet pet : pets) {
             try {
-                petIterator.advance();
-            } catch (NoSuchElementException e) {
+                if (pet == null || pet.getRoomUnit() == null) {
+                    continue;
+                }
+
+                if (this.cycleRoomUnit(pet.getRoomUnit(), RoomUnitType.PET)) {
+                    updatedUnit.add(pet.getRoomUnit());
+                }
+
+                pet.cycle();
+
+                if (pet.packetUpdate) {
+                    updatedUnit.add(pet.getRoomUnit());
+                    pet.packetUpdate = false;
+                }
+
+                if (pet.getRoomUnit().isWalking() && pet.getRoomUnit().getPath().size() == 1
+                        && pet.getRoomUnit().hasStatus(RoomUnitStatus.GESTURE)) {
+                    pet.getRoomUnit().removeStatus(RoomUnitStatus.GESTURE);
+                    updatedUnit.add(pet.getRoomUnit());
+                }
+            } catch (Exception e) {
                 LOGGER.error("Caught exception", e);
-                break;
-            }
-
-            Pet pet = petIterator.value();
-            if (this.cycleRoomUnit(pet.getRoomUnit(), RoomUnitType.PET)) {
-                updatedUnit.add(pet.getRoomUnit());
-            }
-
-            pet.cycle();
-
-            if (pet.packetUpdate) {
-                updatedUnit.add(pet.getRoomUnit());
-                pet.packetUpdate = false;
-            }
-
-            if (pet.getRoomUnit().isWalking() && pet.getRoomUnit().getPath().size() == 1
-                    && pet.getRoomUnit().hasStatus(RoomUnitStatus.GESTURE)) {
-                pet.getRoomUnit().removeStatus(RoomUnitStatus.GESTURE);
-                updatedUnit.add(pet.getRoomUnit());
             }
         }
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomItemManager.java

@@ -167,17 +167,22 @@ public class RoomItemManager {
      */
     public THashSet<HabboItem> getFloorItems() {
         THashSet<HabboItem> items = new THashSet<>();
-        TIntObjectIterator<HabboItem> iterator = this.roomItems.iterator();
+        // roomItems is a TCollections.synchronizedMap; its iterator is not safe
+        // against concurrent put/remove (item place/pickup), so hold the map
+        // monitor for the whole traversal, matching the mutation sites.
+        synchronized (this.roomItems) {
+            TIntObjectIterator<HabboItem> iterator = this.roomItems.iterator();
 
-        for (int i = this.roomItems.size(); i-- > 0; ) {
-            try {
-                iterator.advance();
-            } catch (Exception e) {
-                break;
-            }
+            for (int i = this.roomItems.size(); i-- > 0; ) {
+                try {
+                    iterator.advance();
+                } catch (Exception e) {
+                    break;
+                }
 
-            if (iterator.value().getBaseItem().getType() == FurnitureType.FLOOR) {
-                items.add(iterator.value());
+                if (iterator.value().getBaseItem().getType() == FurnitureType.FLOOR) {
+                    items.add(iterator.value());
+                }
             }
         }
 
@@ -189,17 +194,19 @@ public class RoomItemManager {
      */
     public THashSet<HabboItem> getWallItems() {
         THashSet<HabboItem> items = new THashSet<>();
-        TIntObjectIterator<HabboItem> iterator = this.roomItems.iterator();
+        synchronized (this.roomItems) {
+            TIntObjectIterator<HabboItem> iterator = this.roomItems.iterator();
 
-        for (int i = this.roomItems.size(); i-- > 0; ) {
-            try {
-                iterator.advance();
-            } catch (Exception e) {
-                break;
-            }
+            for (int i = this.roomItems.size(); i-- > 0; ) {
+                try {
+                    iterator.advance();
+                } catch (Exception e) {
+                    break;
+                }
 
-            if (iterator.value().getBaseItem().getType() == FurnitureType.WALL) {
-                items.add(iterator.value());
+                if (iterator.value().getBaseItem().getType() == FurnitureType.WALL) {
+                    items.add(iterator.value());
+                }
             }
         }
 
@@ -211,18 +218,20 @@ public class RoomItemManager {
      */
     public THashSet<HabboItem> getPostItNotes() {
         THashSet<HabboItem> items = new THashSet<>();
-        TIntObjectIterator<HabboItem> iterator = this.roomItems.iterator();
+        synchronized (this.roomItems) {
+            TIntObjectIterator<HabboItem> iterator = this.roomItems.iterator();
 
-        for (int i = this.roomItems.size(); i-- > 0; ) {
-            try {
-                iterator.advance();
-            } catch (Exception e) {
-                break;
-            }
+            for (int i = this.roomItems.size(); i-- > 0; ) {
+                try {
+                    iterator.advance();
+                } catch (Exception e) {
+                    break;
+                }
 
-            if (iterator.value().getBaseItem().getInteractionType().getType()
-                    == InteractionPostIt.class) {
-                items.add(iterator.value());
+                if (iterator.value().getBaseItem().getInteractionType().getType()
+                        == InteractionPostIt.class) {
+                    items.add(iterator.value());
+                }
             }
         }
 
@@ -276,44 +285,49 @@ public class RoomItemManager {
             }
         }
 
-        TIntObjectIterator<HabboItem> iterator = this.roomItems.iterator();
+        // Cache miss: iterate roomItems under its monitor so a concurrent
+        // place/pickup can't rehash the map mid-traversal (which the per-advance
+        // try/catch would otherwise silently swallow into an incomplete result).
+        synchronized (this.roomItems) {
+            TIntObjectIterator<HabboItem> iterator = this.roomItems.iterator();
 
-        for (int i = this.roomItems.size(); i-- > 0; ) {
-            HabboItem item;
-            try {
-                iterator.advance();
-                item = iterator.value();
-            } catch (Exception e) {
-                break;
-            }
+            for (int i = this.roomItems.size(); i-- > 0; ) {
+                HabboItem item;
+                try {
+                    iterator.advance();
+                    item = iterator.value();
+                } catch (Exception e) {
+                    break;
+                }
 
-            if (item == null) {
-                continue;
-            }
+                if (item == null) {
+                    continue;
+                }
 
-            if (item.getBaseItem().getType() != FurnitureType.FLOOR) {
-                continue;
-            }
+                if (item.getBaseItem().getType() != FurnitureType.FLOOR) {
+                    continue;
+                }
 
-            int width, length;
+                int width, length;
 
-            if (item.getRotation() != 2 && item.getRotation() != 6) {
-                width = item.getBaseItem().getWidth() > 0 ? item.getBaseItem().getWidth() : 1;
-                length = item.getBaseItem().getLength() > 0 ? item.getBaseItem().getLength() : 1;
-            } else {
-                width = item.getBaseItem().getLength() > 0 ? item.getBaseItem().getLength() : 1;
-                length = item.getBaseItem().getWidth() > 0 ? item.getBaseItem().getWidth() : 1;
-            }
+                if (item.getRotation() != 2 && item.getRotation() != 6) {
+                    width = item.getBaseItem().getWidth() > 0 ? item.getBaseItem().getWidth() : 1;
+                    length = item.getBaseItem().getLength() > 0 ? item.getBaseItem().getLength() : 1;
+                } else {
+                    width = item.getBaseItem().getLength() > 0 ? item.getBaseItem().getLength() : 1;
+                    length = item.getBaseItem().getWidth() > 0 ? item.getBaseItem().getWidth() : 1;
+                }
 
-            if (!(tile.x >= item.getX() && tile.x <= item.getX() + width - 1 && tile.y >= item.getY()
-                    && tile.y <= item.getY() + length - 1)) {
-                continue;
-            }
+                if (!(tile.x >= item.getX() && tile.x <= item.getX() + width - 1 && tile.y >= item.getY()
+                        && tile.y <= item.getY() + length - 1)) {
+                    continue;
+                }
 
-            items.add(item);
+                items.add(item);
 
-            if (returnOnFirst) {
-                return items;
+                if (returnOnFirst) {
+                    return items;
+                }
             }
         }
 
@@ -956,9 +970,11 @@ public class RoomItemManager {
     public int getUserUniqueFurniCount(int userId) {
         THashSet<Item> items = new THashSet<>();
 
-        for (HabboItem item : this.roomItems.valueCollection()) {
-            if (!items.contains(item.getBaseItem()) && item.getUserId() == userId) {
-                items.add(item.getBaseItem());
+        synchronized (this.roomItems) {
+            for (HabboItem item : this.roomItems.valueCollection()) {
+                if (!items.contains(item.getBaseItem()) && item.getUserId() == userId) {
+                    items.add(item.getBaseItem());
+                }
             }
         }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomLayout.java

@@ -130,13 +130,16 @@ public class RoomLayout {
     this.roomTiles = new RoomTile[this.mapSizeX][this.mapSizeY];
 
     for (short y = 0; y < this.mapSizeY; y++) {
-      if (modelTemp[y].isEmpty() || modelTemp[y].equalsIgnoreCase("\r")) {
-        continue;
-      }
+      // A row shorter/longer than the model width (or empty) cannot be parsed
+      // per-square. Previously such tiles were left null while tileExists()
+      // still reported them present, causing NPEs in the coordinate accessors.
+      // Fill them with INVALID tiles so every in-bounds coordinate is non-null.
+      boolean validRow = !modelTemp[y].isEmpty() && modelTemp[y].length() == this.mapSizeX;
 
       for (short x = 0; x < this.mapSizeX; x++) {
-        if (modelTemp[y].length() != this.mapSizeX) {
-          break;
+        if (!validRow) {
+          this.roomTiles[x][y] = new RoomTile(x, y, (short) 0, RoomTileState.INVALID, true);
+          continue;
         }
 
         String square = modelTemp[y].substring(x, x + 1).trim().toLowerCase();
@@ -159,7 +162,9 @@ public class RoomLayout {
       }
     }
 
-    this.doorTile = this.roomTiles[this.doorX][this.doorY];
+    this.doorTile = (this.doorX >= 0 && this.doorX < this.mapSizeX && this.doorY >= 0 && this.doorY < this.mapSizeY)
+        ? this.roomTiles[this.doorX][this.doorY]
+        : null;
 
     if (this.doorTile != null) {
       this.doorTile.setAllowStack(false);

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomManager.java

@@ -731,10 +731,10 @@ public class RoomManager {
 
         habbo.getClient().sendResponse(new RoomModelComposer(room));
 
-        if (!room.getWallPaint().equals("0.0"))
+        if (room.getWallPaint() != null && !room.getWallPaint().equals("0.0"))
             habbo.getClient().sendResponse(new RoomPaintComposer("wallpaper", room.getWallPaint()));
 
-        if (!room.getFloorPaint().equals("0.0"))
+        if (room.getFloorPaint() != null && !room.getFloorPaint().equals("0.0"))
             habbo.getClient().sendResponse(new RoomPaintComposer("floor", room.getFloorPaint()));
 
         habbo.getClient().sendResponse(new RoomPaintComposer("landscape", room.getBackgroundPaint()));

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomRightsManager.java

@@ -272,10 +272,16 @@ public class RoomRightsManager {
         } else if (this.isOwner(habbo)) {
             habbo.getClient().sendResponse(new RoomOwnerComposer());
             flatCtrl = RoomRightLevels.MODERATOR;
-        } else if (this.hasRights(habbo) && !this.room.hasGuild()) {
-            flatCtrl = RoomRightLevels.RIGHTS;
         } else if (this.room.hasGuild()) {
-            flatCtrl = this.getGuildRightLevel(habbo);
+            // Explicit room rights must still be honoured in guild rooms (the old
+            // `&& !hasGuild()` guard stripped them for non-guild members) — take
+            // whichever of the two is stronger.
+            RoomRightLevels guildLevel = this.getGuildRightLevel(habbo);
+            flatCtrl = (this.hasRights(habbo) && RoomRightLevels.RIGHTS.isEqualOrGreaterThan(guildLevel))
+                    ? RoomRightLevels.RIGHTS
+                    : guildLevel;
+        } else if (this.hasRights(habbo)) {
+            flatCtrl = RoomRightLevels.RIGHTS;
         }
 
         habbo.getClient().sendResponse(new RoomRightsComposer(flatCtrl));

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomSpecialTypes.java

@@ -152,15 +152,23 @@ public class RoomSpecialTypes {
 
 
     public InteractionNest getNest(int itemId) {
-        return this.nests.get(itemId);
+        synchronized (this.nests) {
+            return this.nests.get(itemId);
+        }
     }
 
     public void addNest(InteractionNest item) {
-        this.nests.put(item.getId(), item); this.specialItemsById.put(item.getId(), item);
+        synchronized (this.nests) {
+            this.nests.put(item.getId(), item);
+        }
+        this.specialItemsById.put(item.getId(), item);
     }
 
     public void removeNest(InteractionNest item) {
-        this.nests.remove(item.getId()); this.specialItemsById.remove(item.getId());
+        synchronized (this.nests) {
+            this.nests.remove(item.getId());
+        }
+        this.specialItemsById.remove(item.getId());
     }
 
     public THashSet<InteractionNest> getNests() {
@@ -174,15 +182,23 @@ public class RoomSpecialTypes {
 
 
     public InteractionPetDrink getPetDrink(int itemId) {
-        return this.petDrinks.get(itemId);
+        synchronized (this.petDrinks) {
+            return this.petDrinks.get(itemId);
+        }
     }
 
     public void addPetDrink(InteractionPetDrink item) {
-        this.petDrinks.put(item.getId(), item); this.specialItemsById.put(item.getId(), item);
+        synchronized (this.petDrinks) {
+            this.petDrinks.put(item.getId(), item);
+        }
+        this.specialItemsById.put(item.getId(), item);
     }
 
     public void removePetDrink(InteractionPetDrink item) {
-        this.petDrinks.remove(item.getId()); this.specialItemsById.remove(item.getId());
+        synchronized (this.petDrinks) {
+            this.petDrinks.remove(item.getId());
+        }
+        this.specialItemsById.remove(item.getId());
     }
 
     public THashSet<InteractionPetDrink> getPetDrinks() {
@@ -196,15 +212,23 @@ public class RoomSpecialTypes {
 
 
     public InteractionPetFood getPetFood(int itemId) {
-        return this.petFoods.get(itemId);
+        synchronized (this.petFoods) {
+            return this.petFoods.get(itemId);
+        }
     }
 
     public void addPetFood(InteractionPetFood item) {
-        this.petFoods.put(item.getId(), item); this.specialItemsById.put(item.getId(), item);
+        synchronized (this.petFoods) {
+            this.petFoods.put(item.getId(), item);
+        }
+        this.specialItemsById.put(item.getId(), item);
     }
 
     public void removePetFood(InteractionPetFood petFood) {
-        this.petFoods.remove(petFood.getId()); this.specialItemsById.remove(petFood.getId());
+        synchronized (this.petFoods) {
+            this.petFoods.remove(petFood.getId());
+        }
+        this.specialItemsById.remove(petFood.getId());
     }
 
     public THashSet<InteractionPetFood> getPetFoods() {
@@ -218,15 +242,23 @@ public class RoomSpecialTypes {
 
 
     public InteractionPetToy getPetToy(int itemId) {
-        return this.petToys.get(itemId);
+        synchronized (this.petToys) {
+            return this.petToys.get(itemId);
+        }
     }
 
     public void addPetToy(InteractionPetToy item) {
-        this.petToys.put(item.getId(), item); this.specialItemsById.put(item.getId(), item);
+        synchronized (this.petToys) {
+            this.petToys.put(item.getId(), item);
+        }
+        this.specialItemsById.put(item.getId(), item);
     }
 
     public void removePetToy(InteractionPetToy petToy) {
-        this.petToys.remove(petToy.getId()); this.specialItemsById.remove(petToy.getId());
+        synchronized (this.petToys) {
+            this.petToys.remove(petToy.getId());
+        }
+        this.specialItemsById.remove(petToy.getId());
     }
 
     public THashSet<InteractionPetToy> getPetToys() {
@@ -240,15 +272,23 @@ public class RoomSpecialTypes {
 
 
     public InteractionPetTree getPetTree(int itemId) {
-        return this.petTrees.get(itemId);
+        synchronized (this.petTrees) {
+            return this.petTrees.get(itemId);
+        }
     }
 
     public void addPetTree(InteractionPetTree item) {
-        this.petTrees.put(item.getId(), item); this.specialItemsById.put(item.getId(), item);
+        synchronized (this.petTrees) {
+            this.petTrees.put(item.getId(), item);
+        }
+        this.specialItemsById.put(item.getId(), item);
     }
 
     public void removePetTree(InteractionPetTree petTree) {
-        this.petTrees.remove(petTree.getId()); this.specialItemsById.remove(petTree.getId());
+        synchronized (this.petTrees) {
+            this.petTrees.remove(petTree.getId());
+        }
+        this.specialItemsById.remove(petTree.getId());
     }
 
     public THashSet<InteractionPetTree> getPetTrees() {

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomTrade.java

@@ -26,6 +26,7 @@ public class RoomTrade {
 
     private final List<RoomTradeUser> users;
     private final Room room;
+    private boolean completed = false;
 
     public RoomTrade(Habbo userOne, Habbo userTwo, Room room) {
         this.users = new ArrayList<>();
@@ -54,7 +55,7 @@ public class RoomTrade {
         this.sendMessageToUsers(new TradeStartComposer(this));
     }
 
-    public void offerItem(Habbo habbo, HabboItem item) {
+    public synchronized void offerItem(Habbo habbo, HabboItem item) {
         RoomTradeUser user = this.getRoomTradeUserForHabbo(habbo);
 
         if (user.getItems().contains(item))
@@ -67,7 +68,7 @@ public class RoomTrade {
         this.updateWindow();
     }
 
-    public void offerMultipleItems(Habbo habbo, THashSet<HabboItem> items) {
+    public synchronized void offerMultipleItems(Habbo habbo, THashSet<HabboItem> items) {
         RoomTradeUser user = this.getRoomTradeUserForHabbo(habbo);
 
         for (HabboItem item : items) {
@@ -81,7 +82,7 @@ public class RoomTrade {
         this.updateWindow();
     }
 
-    public void removeItem(Habbo habbo, HabboItem item) {
+    public synchronized void removeItem(Habbo habbo, HabboItem item) {
         RoomTradeUser user = this.getRoomTradeUserForHabbo(habbo);
 
         if (!user.getItems().contains(item))
@@ -94,7 +95,7 @@ public class RoomTrade {
         this.updateWindow();
     }
 
-    public void accept(Habbo habbo, boolean value) {
+    public synchronized void accept(Habbo habbo, boolean value) {
         RoomTradeUser user = this.getRoomTradeUserForHabbo(habbo);
 
         user.setAccepted(value);
@@ -110,7 +111,13 @@ public class RoomTrade {
         }
     }
 
-    public void confirm(Habbo habbo) {
+    public synchronized void confirm(Habbo habbo) {
+        // Re-entry guard: both participants confirm on their own EventLoop
+        // threads. Without this (and the method-level lock) two concurrent
+        // confirms could each observe "all confirmed" and run tradeItems()
+        // twice → item/credit duplication.
+        if (this.completed) return;
+
         RoomTradeUser user = this.getRoomTradeUserForHabbo(habbo);
 
         user.confirm();
@@ -122,6 +129,8 @@ public class RoomTrade {
                 accepted = false;
         }
         if (accepted) {
+            this.completed = true;
+
             if (this.tradeItems()) {
                 this.closeWindow();
                 this.sendMessageToUsers(new TradeCompleteComposer());
@@ -264,6 +273,10 @@ public class RoomTrade {
     protected void clearAccepted() {
         for (RoomTradeUser user : this.users) {
             user.setAccepted(false);
+            // Any change to the offered items invalidates a prior confirmation;
+            // without this a stale confirmed=true lets a user strip their side
+            // and still complete the trade once the partner re-confirms.
+            user.setConfirmed(false);
         }
     }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomTradeUser.java

@@ -51,6 +51,10 @@ public class RoomTradeUser {
         this.confirmed = true;
     }
 
+    public void setConfirmed(boolean value) {
+        this.confirmed = value;
+    }
+
     public void addItem(HabboItem item) {
         this.items.add(item);
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomUnit.java

@@ -31,6 +31,7 @@ import org.slf4j.LoggerFactory;
 
 import java.util.*;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentLinkedDeque;
 import java.util.concurrent.ScheduledFuture;
 import java.util.stream.Collectors;
 
@@ -71,7 +72,10 @@ public class RoomUnit {
   private RoomUserRotation headRotation = RoomUserRotation.NORTH;
   private DanceType danceType;
   private RoomUnitType roomUnitType;
-  private Deque<RoomTile> path = new LinkedList<>();
+  // Concurrent + volatile: the room cycle thread polls/clears this path while a
+  // walk packet thread rebuilds it via findPath/setPath. A plain LinkedList would
+  // corrupt under the concurrent structural modification.
+  private volatile Deque<RoomTile> path = new ConcurrentLinkedDeque<>();
   private int handItem;
   private long handItemTimestamp;
   private long lastRollerTime;
@@ -587,7 +591,7 @@ public class RoomUnit {
     Deque<RoomTile> newPath = this.room.getLayout().getPathfinder()
         .findPath(this.currentLocation, this.goalLocation, this.goalLocation, this);
     if (newPath != null && !newPath.isEmpty()) {
-      this.path = newPath;
+      this.path = new ConcurrentLinkedDeque<>(newPath);
     }
   }
 
@@ -765,7 +769,7 @@ public class RoomUnit {
   }
 
   public void setPath(Deque<RoomTile> path) {
-    this.path = path;
+    this.path = (path == null) ? new ConcurrentLinkedDeque<>() : new ConcurrentLinkedDeque<>(path);
   }
 
   public RoomRightLevels getRightsLevel() {

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/pathfinding/impl/PathfinderImpl.java

@@ -24,8 +24,11 @@ public class PathfinderImpl implements Pathfinder {
 
   private static final int CACHED_TIMEOUT_MS = Emulator.getConfig()
       .getInt(CONFIG_EXECUTION_TIME, 25);
+  // Default ON: bound A* to CACHED_TIMEOUT_MS (25ms) so a pathological search
+  // can't run unbounded and stall the thread. On timeout findPath returns an
+  // empty path (the unit simply doesn't move there) — graceful degradation.
   private static final boolean CACHED_TIMEOUT_ENABLED = Emulator.getConfig()
-      .getBoolean(CONFIG_TIMEOUT_ENABLED, false);
+      .getBoolean(CONFIG_TIMEOUT_ENABLED, true);
   private static final long CACHED_TIMEOUT_NANOS = CACHED_TIMEOUT_MS * 1_000_000L;
 
   private final Room room;

Emulator/src/main/java/com/eu/habbo/habbohotel/users/Habbo.java

@@ -146,31 +146,23 @@ public class Habbo implements Runnable {
             this.habboInfo.setIpLogin(ip);
         }
 
-        if (this.client.getMachineId() == null || this.client.getMachineId().length() == 0) {
-            return false;
-        }
+        // The Nitro client sends the UniqueID (machine fingerprint) packet right
+        // AFTER the SSO ticket, so client.getMachineId() may still be null here.
+        // Do NOT reject the login for a missing machineId — MachineIDEvent sets it
+        // and enforces the MAC ban as soon as the UniqueID packet arrives. Only
+        // MAC-ban check here when the fingerprint is already available.
+        String machineId = this.client.getMachineId();
+        if (machineId != null && !machineId.isEmpty()) {
+            this.habboInfo.setMachineID(machineId);
 
-        this.habboInfo.setMachineID(this.client.getMachineId());
-
-        if (Emulator.getGameEnvironment().getModToolManager().hasMACBan(this.client)) {
-            return false;
+            if (Emulator.getGameEnvironment().getModToolManager().hasMACBan(this.client)) {
+                return false;
+            }
         }
 
         if (Emulator.getGameEnvironment().getModToolManager().hasIPBan(this.habboInfo.getIpLogin())) {
             return false;
         }
-
-        this.habboInfo.setMachineID(this.client.getMachineId());
-
-        if (Emulator.getGameEnvironment().getModToolManager().hasMACBan(this.client)) {
-            return false;
-        }
-
-        if (Emulator.getGameEnvironment().getModToolManager().hasIPBan(this.habboInfo.getIpLogin())) {
-            return false;
-        }
-
-        this.habboInfo.setMachineID(this.client.getMachineId());
         this.isOnline(true);
 
         this.messenger.connectionChanged(this, true, false);

Emulator/src/main/java/com/eu/habbo/habbohotel/users/HabboInfo.java

@@ -55,6 +55,11 @@ public class HabboInfo implements Runnable {
     private RideablePet riding;
     private Class<? extends Game> currentGame;
     private TIntIntHashMap currencies;
+    // Serializes credits + currencies read-modify-write and the saveCurrencies
+    // snapshot so the credit-roller thread and purchase/trade handler threads
+    // can't lose updates or rehash the Trove map mid-iteration. Never held
+    // across run()'s DB I/O.
+    private final Object currencyLock = new Object();
     private GamePlayer gamePlayer;
     private int photoRoomId;
     private int photoTimestamp;
@@ -123,11 +128,16 @@ public class HabboInfo implements Runnable {
     }
 
     private void saveCurrencies() {
-        List<int[]> entries = new ArrayList<>(this.currencies.size());
-        this.currencies.forEachEntry((type, amount) -> {
-            entries.add(new int[]{type, amount});
-            return true;
-        });
+        // Snapshot under the lock so a concurrent adjustOrPutValue/put can't
+        // rehash the Trove map while we iterate; do the DB batch off-lock.
+        List<int[]> entries;
+        synchronized (this.currencyLock) {
+            entries = new ArrayList<>(this.currencies.size());
+            this.currencies.forEachEntry((type, amount) -> {
+                entries.add(new int[]{type, amount});
+                return true;
+            });
+        }
 
         try {
             SqlQueries.batchUpdate(
@@ -238,20 +248,30 @@ public class HabboInfo implements Runnable {
     }
 
     public int getCurrencyAmount(int type) {
-        return this.currencies.get(type);
+        synchronized (this.currencyLock) {
+            return this.currencies.get(type);
+        }
     }
 
     public TIntIntHashMap getCurrencies() {
-        return this.currencies;
+        // Return a snapshot under the lock: callers iterate this map, which would
+        // otherwise corrupt during a concurrent adjustOrPutValue rehash.
+        synchronized (this.currencyLock) {
+            return new TIntIntHashMap(this.currencies);
+        }
     }
 
     public void addCurrencyAmount(int type, int amount) {
-        this.currencies.adjustOrPutValue(type, amount, amount);
+        synchronized (this.currencyLock) {
+            this.currencies.adjustOrPutValue(type, amount, amount);
+        }
         this.run();
     }
 
     public void setCurrencyAmount(int type, int amount) {
-        this.currencies.put(type, amount);
+        synchronized (this.currencyLock) {
+            this.currencies.put(type, amount);
+        }
         this.run();
     }
 
@@ -380,20 +400,26 @@ public class HabboInfo implements Runnable {
     }
 
     public boolean canBuy(CatalogItem item) {
-        return this.credits >= item.getCredits() && this.getCurrencies().get(item.getPointsType()) >= item.getPoints();
+        return this.getCredits() >= item.getCredits() && this.getCurrencyAmount(item.getPointsType()) >= item.getPoints();
     }
 
     public int getCredits() {
-        return this.credits;
+        synchronized (this.currencyLock) {
+            return this.credits;
+        }
     }
 
     public void setCredits(int credits) {
-        this.credits = credits;
+        synchronized (this.currencyLock) {
+            this.credits = credits;
+        }
         this.run();
     }
 
     public void addCredits(int credits) {
-        this.credits += credits;
+        synchronized (this.currencyLock) {
+            this.credits += credits;
+        }
         this.run();
     }
 
@@ -600,6 +626,13 @@ public class HabboInfo implements Runnable {
     public void run() {
         this.saveCurrencies();
 
+        // Read credits under the lock so the persisted value is consistent with
+        // concurrent addCredits/setCredits (matches the currencyLock invariant).
+        final int creditsForSave;
+        synchronized (this.currencyLock) {
+            creditsForSave = this.credits;
+        }
+
         try {
             SqlQueries.update(
                     "UPDATE users SET motto = ?, online = ?, look = ?, gender = ?, credits = ?, last_login = ?, last_online = ?, home_room = ?, ip_current = ?, `rank` = ?, machine_id = ?, username = ?, background_id = ?, background_stand_id = ?, background_overlay_id = ?, background_card_id = ?, background_border_id = ? WHERE id = ?",
@@ -607,7 +640,7 @@ public class HabboInfo implements Runnable {
                     this.online ? "1" : "0",
                     this.look,
                     this.gender.name(),
-                    this.credits,
+                    creditsForSave,
                     Emulator.getIntUnixTimestamp(),
                     this.lastOnline,
                     this.homeRoom,

Emulator/src/main/java/com/eu/habbo/habbohotel/users/HabboManager.java

@@ -111,7 +111,7 @@ public class HabboManager {
         habbo = this.cloneCheck(userId);
         if (habbo != null) {
             habbo.alert(Emulator.getTexts().getValue("loggedin.elsewhere"));
-            Emulator.getGameServer().getGameClientManager().disposeClient(habbo.getClient());
+            Emulator.getGameServer().getGameClientManager().forceDisposeClient(habbo.getClient());
             habbo = null;
         }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/users/HabboStats.java

@@ -448,14 +448,26 @@ public class HabboStats implements Runnable {
             return 0;
         }
 
-        if (this.achievementProgress.containsKey(achievement))
-            return this.achievementProgress.get(achievement);
-
-        return -1;
+        synchronized (this.achievementProgress) {
+            Integer progress = this.achievementProgress.get(achievement);
+            return progress != null ? progress : -1;
+        }
     }
 
     public void setProgress(Achievement achievement, int progress) {
-        this.achievementProgress.put(achievement, progress);
+        synchronized (this.achievementProgress) {
+            this.achievementProgress.put(achievement, progress);
+        }
+    }
+
+    /** Atomic read-add-write so concurrent progress sources don't lose updates. Returns the new total. */
+    public int incrementProgress(Achievement achievement, int amount) {
+        synchronized (this.achievementProgress) {
+            Integer current = this.achievementProgress.get(achievement);
+            int next = (current != null ? current : 0) + amount;
+            this.achievementProgress.put(achievement, next);
+            return next;
+        }
     }
 
     public int getRentedTimeEnd() {

Emulator/src/main/java/com/eu/habbo/habbohotel/wired/WiredHandler.java

@@ -178,6 +178,15 @@ public class WiredHandler {
     private static boolean handle(InteractionWiredTrigger trigger, final RoomUnit roomUnit, final Room room, final Object[] stuff, final LegacyExecutionPlan executionPlan) {
         long millis = System.currentTimeMillis();
         int roomUnitId = roomUnit != null ? roomUnit.getId() : -1;
+
+        // Only one thread may process a given trigger box at a time, so the
+        // cooldown check (below) and setCooldown (further down) act as one
+        // atomic claim — preventing a concurrent packet/cycle double-fire.
+        if (!trigger.tryBeginProcessing()) {
+            return false;
+        }
+
+        try {
         if (Emulator.isReady && ((Emulator.getConfig().getBoolean("wired.custom.enabled", false) && (trigger.canExecute(millis) || roomUnitId > -1) && trigger.userCanExecute(roomUnitId, millis)) || (!Emulator.getConfig().getBoolean("wired.custom.enabled", false) && trigger.canExecute(millis))) && trigger.execute(roomUnit, room, stuff)) {
             THashSet<InteractionWiredCondition> conditions = room.getRoomSpecialTypes().getConditions(trigger.getX(), trigger.getY());
             THashSet<InteractionWiredEffect> effects = room.getRoomSpecialTypes().getEffects(trigger.getX(), trigger.getY());
@@ -272,6 +281,9 @@ public class WiredHandler {
         }
 
         return false;
+        } finally {
+            trigger.endProcessing();
+        }
     }
 
     private static boolean evaluateConditions(THashSet<InteractionWiredCondition> conditions, RoomUnit roomUnit, Room room, Object[] stuff, int evaluationMode, int evaluationValue) {

Emulator/src/main/java/com/eu/habbo/messages/ClientMessage.java

@@ -4,6 +4,8 @@ import com.eu.habbo.util.PacketUtils;
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.Unpooled;
 
+import java.nio.charset.StandardCharsets;
+
 public class ClientMessage {
     private final int header;
     private final ByteBuf buffer;
@@ -61,10 +63,17 @@ public class ClientMessage {
 
     public String readString() {
         try {
-            int length = this.readShort();
+            // Length is an unsigned short in the protocol; mask to avoid a
+            // negative array size, and clamp to what's actually buffered so a
+            // bogus length can't throw mid-read and desync the remaining fields.
+            int length = this.readShort() & 0xFFFF;
+            int available = this.buffer.readableBytes();
+            if (length > available) {
+                length = available;
+            }
             byte[] data = new byte[length];
             this.buffer.readBytes(data);
-            return new String(data);
+            return new String(data, StandardCharsets.UTF_8);
         } catch (Exception e) {
             return "";
         }

Emulator/src/main/java/com/eu/habbo/messages/ServerMessage.java

@@ -7,6 +7,7 @@ import io.netty.buffer.ByteBufOutputStream;
 import io.netty.buffer.Unpooled;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 
 public class ServerMessage {
 
@@ -61,7 +62,7 @@ public class ServerMessage {
         }
 
         try {
-            byte[] data = obj.getBytes();
+            byte[] data = obj.getBytes(StandardCharsets.UTF_8);
             this.stream.writeShort(data.length);
             this.stream.write(data);
         } catch (IOException e) {

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/CatalogBuyItemEvent.java

@@ -14,11 +14,7 @@ import com.eu.habbo.habbohotel.users.HabboBadge;
 import com.eu.habbo.habbohotel.users.HabboInventory;
 import com.eu.habbo.habbohotel.users.subscriptions.Subscription;
 import com.eu.habbo.messages.incoming.MessageHandler;
-import com.eu.habbo.messages.outgoing.catalog.AlertPurchaseFailedComposer;
-import com.eu.habbo.messages.outgoing.catalog.AlertPurchaseUnavailableComposer;
-import com.eu.habbo.messages.outgoing.catalog.BuildersClubFurniCountComposer;
-import com.eu.habbo.messages.outgoing.catalog.BuildersClubSubscriptionStatusComposer;
-import com.eu.habbo.messages.outgoing.catalog.PurchaseOKComposer;
+import com.eu.habbo.messages.outgoing.catalog.*;
 import com.eu.habbo.messages.outgoing.generic.alerts.BubbleAlertComposer;
 import com.eu.habbo.messages.outgoing.generic.alerts.BubbleAlertKeys;
 import com.eu.habbo.messages.outgoing.generic.alerts.HotelWillCloseInMinutesComposer;
@@ -52,6 +48,8 @@ public class CatalogBuyItemEvent extends MessageHandler {
             int itemId = this.packet.readInt();
             String extraData = this.packet.readString();
             int count = this.packet.readInt();
+            if (count < 1) count = 1;
+            if (count > 100) count = 100;
 
             try {
                 if (this.client.getHabbo().getInventory().getItemsComponent().itemCount() > HabboInventory.MAXIMUM_ITEMS) {
@@ -203,12 +201,6 @@ public class CatalogBuyItemEvent extends MessageHandler {
             else
                 item = page.getCatalogItem(itemId);
 
-            // Search-results buy sends the catalog offer_id as itemId
-            // (FurnitureOffer.offerId is derived from furnidata's
-            // purchaseOfferId, which matches `catalog_items.offer_id`),
-            // not the `catalog_items.id` primary key that getCatalogItem
-            // expects. Fall back to scanning the page for the matching
-            // offer_id so the search → buy flow works.
             if (item == null && !(page instanceof RecentPurchasesLayout)) {
                 for (CatalogItem candidate : page.getCatalogItems().valueCollection()) {
                     if (candidate != null && candidate.getOfferId() == itemId) {
@@ -217,13 +209,7 @@ public class CatalogBuyItemEvent extends MessageHandler {
                     }
                 }
             }
-            // Inventory cap check based on the actual base items the
-            // purchase will create, not the page layout - bots/pets
-            // can legitimately live on bundle pages, search results,
-            // recent-purchases, etc., and the layout-instanceof check
-            // missed all those paths. Mirrors the bot/pet branches
-            // inside CatalogManager.purchaseItem (Item.isBot / isPet
-            // and the same prefix check) so detection stays in sync.
+
             boolean itemHasBot = false;
             boolean itemHasPet = false;
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/recycler/OpenRecycleBoxEvent.java

@@ -29,6 +29,11 @@ public class OpenRecycleBoxEvent extends MessageHandler {
             if (item.getUserId() != this.client.getHabbo().getHabboInfo().getId()) return;
 
             if (item instanceof InteractionGift) {
+                // The actual unwrap (OpenGift) runs async/delayed and only then
+                // removes the wrapper, so a second packet would otherwise pass
+                // the room/owner checks and double-process the gift. Claim it once.
+                if (!((InteractionGift) item).tryStartOpening()) return;
+
                 if (item.getBaseItem().getName().contains("present_wrap")) {
                     ((InteractionGift) item).explode = true;
                     room.updateItem(item);

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/recycler/RecycleEvent.java

@@ -40,23 +40,26 @@ public class RecycleEvent extends MessageHandler {
                 }
             }
 
-            if (items.size() == count) {
-                for (HabboItem item : items) {
-                    this.client.getHabbo().getInventory().getItemsComponent().removeHabboItem(item);
-                    this.client.sendResponse(new RemoveHabboItemComposer(item.getGiftAdjustedId()));
-                    Emulator.getThreading().run(new QueryDeleteHabboItem(item.getId()));
-                }
-            } else {
+            if (items.size() != count) {
                 this.client.sendResponse(new AlertPurchaseFailedComposer(AlertPurchaseFailedComposer.SERVER_ERROR));
                 return;
             }
 
+            // Compute the reward BEFORE consuming the inputs. Previously the
+            // inputs were deleted first, so a null reward (misconfiguration)
+            // permanently destroyed the 8 furni with nothing in return.
             HabboItem reward = Emulator.getGameEnvironment().getItemManager().handleRecycle(this.client.getHabbo(), Emulator.getGameEnvironment().getCatalogManager().getRandomRecyclerPrize().getId() + "");
             if (reward == null) {
                 this.client.sendResponse(new AlertPurchaseFailedComposer(AlertPurchaseFailedComposer.SERVER_ERROR));
                 return;
             }
 
+            for (HabboItem item : items) {
+                this.client.getHabbo().getInventory().getItemsComponent().removeHabboItem(item);
+                this.client.sendResponse(new RemoveHabboItemComposer(item.getGiftAdjustedId()));
+                Emulator.getThreading().run(new QueryDeleteHabboItem(item.getId()));
+            }
+
             this.client.sendResponse(new AddHabboItemComposer(reward));
             this.client.getHabbo().getInventory().getItemsComponent().addItem(reward);
             this.client.sendResponse(new RecyclerCompleteComposer(RecyclerCompleteComposer.RECYCLING_COMPLETE));

Emulator/src/main/java/com/eu/habbo/messages/incoming/crafting/CraftingCraftItemEvent.java

@@ -37,6 +37,8 @@ public class CraftingCraftItemEvent extends MessageHandler {
                     HabboItem habboItem = this.client.getHabbo().getInventory().getItemsComponent().getAndRemoveHabboItem(set.getKey());
 
                     if (habboItem == null) {
+                        // Not enough ingredients — give back whatever we already pulled.
+                        this.restoreItems(toRemove);
                         return;
                     }
 
@@ -70,8 +72,23 @@ public class CraftingCraftItemEvent extends MessageHandler {
                 return;
             }
 
+            // Reward creation failed after we already pulled the ingredients —
+            // restore them so the craft isn't a silent item sink.
+            this.restoreItems(toRemove);
         }
 
         this.client.sendResponse(new CraftingResultComposer(null));
     }
+
+    private void restoreItems(TIntObjectHashMap<HabboItem> items) {
+        if (items.isEmpty()) {
+            return;
+        }
+        items.forEachValue(item -> {
+            this.client.getHabbo().getInventory().getItemsComponent().addItem(item);
+            this.client.sendResponse(new AddHabboItemComposer(item));
+            return true;
+        });
+        this.client.sendResponse(new InventoryRefreshComposer());
+    }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/furnieditor/FurniDataManager.java

@@ -1,6 +1,7 @@
 package com.eu.habbo.messages.incoming.furnieditor;
 
 import com.eu.habbo.Emulator;
+import com.eu.habbo.habbohotel.items.FurnidataSourceResolver;
 import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
@@ -9,12 +10,15 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
+import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.Arrays;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 /**
  * Manages reading and writing of FurnitureData entries.
@@ -43,24 +47,172 @@ public class FurniDataManager {
     private static final List<String> DEFAULT_TIERS = Arrays.asList("core", "custom", "seasonal");
     private static final List<String> MANIFEST_NAMES = Arrays.asList("manifest.json5", "manifest.json");
     private static final List<String> SECTIONS = Arrays.asList("roomitemtypes", "wallitemtypes");
+    private static volatile CachedIndex cachedIndex = null;
+
+    public record LookupResult(String itemJson, String diagnosticJson) {
+    }
 
     /**
      * Get the JSON string for a specific item.
      * Returns "{}" if not found or on error.
      */
     public static String getItemJson(int itemId) {
-        try {
-            ResolvedSource source = resolveSource();
-            if (source == null) return "{}";
+        return getItemJson(itemId, null);
+    }
 
-            if (source.directory) {
-                return findItemInSplitDir(source.path, itemId);
+    /**
+     * Get the JSON string for a specific item.
+     * Prefer the DB classname because items_base.id can diverge from the
+     * furnidata id after imports/reconciliations. Falls back to id lookup.
+     * Returns "{}" if not found or on error.
+     */
+    public static String getItemJson(int itemId, String classname) {
+        return getItemLookup(itemId, classname).itemJson();
+    }
+
+    public static LookupResult getItemLookup(int itemId, String classname) {
+        FurnidataSourceResolver.Source source = FurnidataSourceResolver.resolve();
+        if (source == null || !source.ok()) {
+            return new LookupResult("{}", diagnostic(source, itemId, classname, "source_missing"));
+        }
+
+        try {
+            CachedIndex index = indexFor(source);
+            String key = baseClassname(classname);
+            String byClassname = key != null ? index.byClassname.get(key) : null;
+            if (byClassname != null) {
+                return new LookupResult(byClassname, diagnostic(source, itemId, classname, "matched_classname"));
             }
 
-            if (!Files.exists(source.path)) return "{}";
+            String byId = index.byId.get(itemId);
+            if (byId != null) {
+                return new LookupResult(byId, diagnostic(source, itemId, classname, "matched_id"));
+            }
 
-            String content = readJson5(source.path);
-            return findItemInRoot(JsonParser.parseString(content).getAsJsonObject(), itemId);
+            String reason = index.empty ? "manifest_empty" : "not_found";
+            return new LookupResult("{}", diagnostic(source, itemId, classname, reason));
+        } catch (Exception e) {
+            LOGGER.warn("Failed to read FurnitureData for item " + itemId, e);
+            FurnidataSourceResolver.Source errorSource = new FurnidataSourceResolver.Source(source.path(), source.directory(), FurnidataSourceResolver.Status.ERROR, e.getMessage());
+            return new LookupResult("{}", diagnostic(errorSource, itemId, classname, "error"));
+        }
+    }
+
+    private static CachedIndex indexFor(FurnidataSourceResolver.Source source) {
+        long signature = sourceSignature(source.path());
+        String sourceKey = source.path().toAbsolutePath().normalize().toString();
+        CachedIndex current = cachedIndex;
+        if (current != null && current.sourceKey.equals(sourceKey) && current.signature == signature) return current;
+
+        CachedIndex next = buildIndex(source, sourceKey, signature);
+        cachedIndex = next;
+        return next;
+    }
+
+    private static CachedIndex buildIndex(FurnidataSourceResolver.Source source, String sourceKey, long signature) {
+        Map<Integer, String> byId = new HashMap<>();
+        Map<String, String> byClassname = new HashMap<>();
+
+        if (source.directory()) {
+            indexSplitDir(source.path(), byId, byClassname);
+        } else {
+            try {
+                String content = readJson5(source.path());
+                indexRoot(JsonParser.parseString(content).getAsJsonObject(), byId, byClassname);
+            } catch (Exception e) {
+                LOGGER.warn("Failed to parse furnidata source {}", source.path(), e);
+            }
+        }
+
+        return new CachedIndex(sourceKey, signature, Map.copyOf(byId), Map.copyOf(byClassname), byId.isEmpty() && byClassname.isEmpty());
+    }
+
+    private static void indexSplitDir(Path baseDir, Map<Integer, String> byId, Map<String, String> byClassname) {
+        if (!Files.isDirectory(baseDir)) return;
+
+        for (String tier : readTiersManifest(baseDir)) {
+            Path tierDir = baseDir.resolve(tier);
+            if (!Files.isDirectory(tierDir)) continue;
+
+            for (String fileName : readFilesManifest(tierDir)) {
+                Path file = tierDir.resolve(fileName);
+                if (!Files.exists(file)) continue;
+
+                try {
+                    String content = readJson5(file);
+                    indexRoot(JsonParser.parseString(content).getAsJsonObject(), byId, byClassname);
+                } catch (Exception e) {
+                    LOGGER.warn("Failed to parse split gamedata file " + file, e);
+                }
+            }
+        }
+    }
+
+    private static void indexRoot(JsonObject root, Map<Integer, String> byId, Map<String, String> byClassname) {
+        for (String section : SECTIONS) {
+            if (!root.has(section)) continue;
+            JsonObject sectionObj = root.getAsJsonObject(section);
+            if (!sectionObj.has("furnitype")) continue;
+
+            for (JsonElement el : sectionObj.getAsJsonArray("furnitype")) {
+                JsonObject obj = el.getAsJsonObject();
+                String json = obj.toString();
+
+                if (obj.has("id")) byId.put(obj.get("id").getAsInt(), json);
+                if (obj.has("classname")) {
+                    String key = baseClassname(obj.get("classname").getAsString());
+                    if (key != null) byClassname.put(key, json);
+                }
+            }
+        }
+    }
+
+    private static long sourceSignature(Path source) {
+        try {
+            if (source == null || !Files.exists(source)) return -1L;
+            if (!Files.isDirectory(source)) return Files.getLastModifiedTime(source).toMillis() ^ Files.size(source);
+
+            final long[] signature = { 17L };
+            try (var stream = Files.walk(source)) {
+                stream.filter(Files::isRegularFile).forEach(path -> {
+                    try {
+                        signature[0] = (signature[0] * 31L) ^ Files.getLastModifiedTime(path).toMillis() ^ Files.size(path);
+                    } catch (Exception ignored) {
+                    }
+                });
+            }
+            return signature[0];
+        } catch (Exception e) {
+            return System.nanoTime();
+        }
+    }
+
+    private static String diagnostic(FurnidataSourceResolver.Source source, int itemId, String classname, String reason) {
+        JsonObject obj = new JsonObject();
+        obj.addProperty("reason", reason);
+        obj.addProperty("itemId", itemId);
+        obj.addProperty("classname", classname != null ? classname : "");
+        obj.addProperty("sourcePath", source != null && source.path() != null ? source.path().toString() : "");
+        obj.addProperty("sourceDirectory", source != null && source.directory());
+        obj.addProperty("sourceStatus", source != null ? source.status().name() : "CONFIG_MISSING");
+        obj.addProperty("message", source != null && source.message() != null ? source.message() : "");
+        return obj.toString();
+    }
+
+    private record CachedIndex(String sourceKey, long signature, Map<Integer, String> byId, Map<String, String> byClassname, boolean empty) {
+    }
+
+    static String findItemJson(Path source, boolean directory, int itemId, String classname) {
+        try {
+            if (directory) {
+                return findItemInSplitDir(source, itemId, classname);
+            }
+
+            if (!Files.exists(source)) return "{}";
+
+            String content = readJson5(source);
+            String found = findItemInRoot(JsonParser.parseString(content).getAsJsonObject(), itemId, classname);
+            return found != null ? found : "{}";
         } catch (Exception e) {
             LOGGER.warn("Failed to read FurnitureData for item " + itemId, e);
         }
@@ -69,6 +221,13 @@ public class FurniDataManager {
     }
 
     private static String findItemInRoot(JsonObject root, int itemId) {
+        return findItemInRoot(root, itemId, null);
+    }
+
+    private static String findItemInRoot(JsonObject root, int itemId, String classname) {
+        String byClassname = findItemInRootByClassname(root, classname);
+        if (byClassname != null) return byClassname;
+
         for (String section : SECTIONS) {
             if (!root.has(section)) continue;
             JsonObject sectionObj = root.getAsJsonObject(section);
@@ -85,11 +244,43 @@ public class FurniDataManager {
         return null;
     }
 
+    private static String findItemInRootByClassname(JsonObject root, String classname) {
+        String wanted = baseClassname(classname);
+        if (wanted == null) return null;
+
+        for (String section : SECTIONS) {
+            if (!root.has(section)) continue;
+            JsonObject sectionObj = root.getAsJsonObject(section);
+            if (!sectionObj.has("furnitype")) continue;
+            JsonArray types = sectionObj.getAsJsonArray("furnitype");
+
+            for (JsonElement el : types) {
+                JsonObject obj = el.getAsJsonObject();
+                if (!obj.has("classname")) continue;
+
+                String actual = baseClassname(obj.get("classname").getAsString());
+                if (wanted.equals(actual)) return obj.toString();
+            }
+        }
+
+        return null;
+    }
+
+    private static String baseClassname(String classname) {
+        if (classname == null) return null;
+
+        int star = classname.indexOf('*');
+        String base = star >= 0 ? classname.substring(0, star) : classname;
+        base = base.trim().toLowerCase(java.util.Locale.ROOT);
+
+        return base.isEmpty() ? null : base;
+    }
+
     /**
      * Walk the split directory layout looking for an item by id.
      * Later tiers (custom, then seasonal) override earlier ones.
      */
-    private static String findItemInSplitDir(Path baseDir, int itemId) {
+    private static String findItemInSplitDir(Path baseDir, int itemId, String classname) {
         if (!Files.isDirectory(baseDir)) return "{}";
 
         List<String> tiers = readTiersManifest(baseDir);
@@ -107,7 +298,7 @@ public class FurniDataManager {
                 try {
                     String content = readJson5(file);
                     JsonObject obj = JsonParser.parseString(content).getAsJsonObject();
-                    String match = findItemInRoot(obj, itemId);
+                    String match = findItemInRoot(obj, itemId, classname);
                     if (match != null) found = match;
                 } catch (Exception e) {
                     LOGGER.warn("Failed to parse split gamedata file " + file, e);
@@ -239,7 +430,7 @@ public class FurniDataManager {
      * Represents the resolved location of the furnidata source: either a single
      * file or a directory in split-layout mode.
      */
-    private static class ResolvedSource {
+    static class ResolvedSource {
         final Path path;
         final boolean directory;
 
@@ -270,9 +461,9 @@ public class FurniDataManager {
 
             if (!rendererObj.has("furnidata.url")) return null;
 
-            String furniUrl = rendererObj.get("furnidata.url").getAsString();
+            String furniUrl = expandRendererUrl(rendererObj, "furnidata.url");
 
-            if (furniUrl.contains("${")) {
+            if (hasUnresolvedPathPlaceholder(furniUrl)) {
                 Path fallback = fallbackToBasePath();
                 return fallback != null ? new ResolvedSource(fallback, Files.isDirectory(fallback)) : null;
             }
@@ -296,6 +487,9 @@ public class FurniDataManager {
             String basePath = Emulator.getConfig().getValue("furni.editor.asset.base.path", "");
             if (basePath.isEmpty()) return null;
 
+            ResolvedSource mapped = toLocalSource(Paths.get(basePath), furniUrl);
+            if (mapped != null) return mapped;
+
             if (splitMode) {
                 // Derive the directory name from the URL: take the last non-empty
                 // segment before the trailing slash. e.g. https://x/y/furnidata/ -> "furnidata"
@@ -326,4 +520,86 @@ public class FurniDataManager {
         if (Files.exists(legacy)) return legacy;
         return null;
     }
+
+    static String expandRendererUrl(JsonObject rendererObj, String key) {
+        if (rendererObj == null || !rendererObj.has(key)) return "";
+
+        String value = rendererObj.get(key).getAsString();
+        for (int i = 0; i < 10; i++) {
+            int start = value.indexOf("${");
+            if (start < 0) break;
+
+            int end = value.indexOf('}', start + 2);
+            if (end < 0) break;
+
+            String placeholder = value.substring(start + 2, end);
+            if (!rendererObj.has(placeholder)) break;
+
+            String replacement = rendererObj.get(placeholder).getAsString();
+            value = value.substring(0, start) + replacement + value.substring(end + 1);
+        }
+
+        return value;
+    }
+
+    private static boolean hasUnresolvedPathPlaceholder(String value) {
+        if (value == null) return false;
+
+        String pathOnly = stripQueryAndFragment(value);
+        return pathOnly.contains("${");
+    }
+
+    static ResolvedSource toLocalSource(Path assetBase, String furniUrl) {
+        if (furniUrl == null || furniUrl.isBlank()) return null;
+
+        String cleanUrl = stripQueryAndFragment(furniUrl);
+        boolean splitMode = cleanUrl.endsWith("/");
+
+        if (!cleanUrl.startsWith("http")) {
+            Path local = Paths.get(cleanUrl);
+            return new ResolvedSource(local, splitMode || Files.isDirectory(local));
+        }
+
+        if (assetBase == null) return null;
+
+        String urlPath;
+        try {
+            urlPath = URI.create(cleanUrl).getPath();
+        } catch (Exception e) {
+            int scheme = cleanUrl.indexOf("://");
+            int pathStart = scheme >= 0 ? cleanUrl.indexOf('/', scheme + 3) : -1;
+            urlPath = pathStart >= 0 ? cleanUrl.substring(pathStart) : cleanUrl;
+        }
+
+        String normalizedUrlPath = urlPath.replace('\\', '/');
+        String baseName = assetBase.getFileName() != null ? assetBase.getFileName().toString() : "";
+        String marker = "/" + baseName + "/";
+
+        Path candidate;
+        int markerIndex = baseName.isEmpty() ? -1 : normalizedUrlPath.indexOf(marker);
+        if (markerIndex >= 0) {
+            String relative = normalizedUrlPath.substring(markerIndex + marker.length());
+            candidate = assetBase.resolve(relative);
+        } else if (splitMode) {
+            String trimmed = normalizedUrlPath.endsWith("/")
+                ? normalizedUrlPath.substring(0, normalizedUrlPath.length() - 1)
+                : normalizedUrlPath;
+            String dirName = trimmed.substring(trimmed.lastIndexOf('/') + 1);
+            candidate = assetBase.resolve(dirName);
+        } else {
+            String filename = normalizedUrlPath.substring(normalizedUrlPath.lastIndexOf('/') + 1);
+            candidate = assetBase.resolve(filename);
+        }
+
+        return new ResolvedSource(candidate, splitMode || Files.isDirectory(candidate));
+    }
+
+    private static String stripQueryAndFragment(String value) {
+        String out = value;
+        int q = out.indexOf('?');
+        if (q >= 0) out = out.substring(0, q);
+        int h = out.indexOf('#');
+        if (h >= 0) out = out.substring(0, h);
+        return out;
+    }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/furnieditor/FurniEditorDetailEvent.java

@@ -41,6 +41,7 @@ public class FurniEditorDetailEvent extends MessageHandler {
         int usageCount = 0;
         List<Map<String, Object>> catalogItems = new ArrayList<>();
         String furniDataJson = "{}";
+        String furniDataDiagnosticJson = "{}";
 
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection()) {
             // Load full item data
@@ -86,11 +87,15 @@ public class FurniEditorDetailEvent extends MessageHandler {
 
         // Try to read furnidata.json entry
         try {
-            furniDataJson = FurniDataManager.getItemJson(itemId);
+            Object classname = item.get("item_name");
+            FurniDataManager.LookupResult lookup = FurniDataManager.getItemLookup(itemId, classname != null ? classname.toString() : null);
+            furniDataJson = lookup.itemJson();
+            furniDataDiagnosticJson = lookup.diagnosticJson();
         } catch (Exception e) {
             furniDataJson = "{}";
+            furniDataDiagnosticJson = "{}";
         }
 
-        client.sendResponse(new FurniEditorDetailComposer(item, usageCount, catalogItems, furniDataJson));
+        client.sendResponse(new FurniEditorDetailComposer(item, usageCount, catalogItems, furniDataJson, furniDataDiagnosticJson));
     }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/furnieditor/FurniEditorSearchEvent.java

@@ -49,15 +49,17 @@ public class FurniEditorSearchEvent extends MessageHandler {
             try {
                 int numericQuery = Integer.parseInt(query);
                 isNumeric = true;
+                String likeQuery = "%" + com.eu.habbo.util.SqlLikeEscaper.escape(query) + "%";
                 whereClause.append(" AND (id = ? OR sprite_id = ? OR item_name LIKE ? OR public_name LIKE ?)");
                 params.add(numericQuery);
                 params.add(numericQuery);
-                params.add("%" + query + "%");
-                params.add("%" + query + "%");
+                params.add(likeQuery);
+                params.add(likeQuery);
             } catch (NumberFormatException e) {
+                String likeQuery = "%" + com.eu.habbo.util.SqlLikeEscaper.escape(query) + "%";
                 whereClause.append(" AND (item_name LIKE ? OR public_name LIKE ?)");
-                params.add("%" + query + "%");
-                params.add("%" + query + "%");
+                params.add(likeQuery);
+                params.add(likeQuery);
             }
         }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/handshake/MachineIDEvent.java

@@ -32,8 +32,15 @@ public class MachineIDEvent extends MessageHandler {
         if (!storedMachineId.isEmpty() && this.client.getHabbo() != null && this.client.getHabbo().getHabboInfo() != null) {
             this.client.getHabbo().getHabboInfo().setMachineID(storedMachineId);
             Emulator.getThreading().run(this.client.getHabbo());
+
+            // The fingerprint can arrive AFTER login (UniqueID is sent right after the
+            // SSO ticket), so Habbo.connect() may have skipped the MAC-ban check for
+            // lack of a machineId. Enforce it now that the fingerprint is known.
+            if (Emulator.getGameEnvironment().getModToolManager().hasMACBan(this.client)) {
+                Emulator.getGameServer().getGameClientManager().forceDisposeClient(this.client);
+            }
         }
 
         LOGGER.debug("Setting client MachineId to {}", storedMachineId);
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/messages/incoming/handshake/SecureLoginEvent.java

@@ -306,7 +306,7 @@ public class SecureLoginEvent extends MessageHandler {
                     Emulator.getPluginManager().fireEvent(userLoginEvent);
 
                     if(userLoginEvent.isCancelled()) {
-                        Emulator.getGameServer().getGameClientManager().disposeClient(this.client);
+                        Emulator.getGameServer().getGameClientManager().forceDisposeClient(this.client);
                         return;
                     }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/housekeeping/HousekeepingGiveCreditsEvent.java

@@ -12,6 +12,7 @@ import java.sql.SQLException;
 
 public class HousekeepingGiveCreditsEvent extends MessageHandler {
     private static final String ACTION_KEY = "user.give_credits";
+    private static final int MAX_GRANT = 1_000_000_000;
 
     @Override
     public int getRatelimit() {
@@ -27,7 +28,7 @@ public class HousekeepingGiveCreditsEvent extends MessageHandler {
         int userId = this.packet.readInt();
         int amount = this.packet.readInt();
 
-        if (userId <= 0 || amount == 0) {
+        if (userId <= 0 || amount == 0 || amount < -MAX_GRANT || amount > MAX_GRANT) {
             this.client.sendResponse(new HousekeepingActionResultComposer(ACTION_KEY, false, 0, "housekeeping.error.invalid_input"));
             return;
         }
@@ -38,6 +39,7 @@ public class HousekeepingGiveCreditsEvent extends MessageHandler {
             // giveCredits already pushes UserCreditsComposer and persists via the
             // standard HabboInfo write path; nothing extra needed for the online branch.
             online.giveCredits(amount);
+            this.audit(userId, amount);
             this.client.sendResponse(new HousekeepingActionResultComposer(ACTION_KEY, true, userId, ""));
             return;
         }
@@ -57,6 +59,15 @@ public class HousekeepingGiveCreditsEvent extends MessageHandler {
             return;
         }
 
+        this.audit(userId, amount);
         this.client.sendResponse(new HousekeepingActionResultComposer(ACTION_KEY, true, userId, ""));
     }
+
+    private void audit(int userId, int amount) {
+        com.eu.habbo.habbohotel.modtool.HousekeepingAuditLog.log(
+                this.client.getHabbo().getHabboInfo().getId(),
+                this.client.getHabbo().getHabboInfo().getUsername(),
+                ACTION_KEY, userId, "amount=" + amount,
+                this.client.getHabbo().getHabboInfo().getIpLogin());
+    }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/housekeeping/HousekeepingGiveCurrencyEvent.java

@@ -18,6 +18,7 @@ import java.sql.SQLException;
  */
 public class HousekeepingGiveCurrencyEvent extends MessageHandler {
     private static final int CURRENCY_DUCKETS = 0;
+    private static final int MAX_GRANT = 1_000_000_000;
 
     @Override
     public int getRatelimit() {
@@ -36,7 +37,7 @@ public class HousekeepingGiveCurrencyEvent extends MessageHandler {
 
         String actionKey = "user.give_currency_" + currencyType;
 
-        if (userId <= 0 || amount == 0) {
+        if (userId <= 0 || amount == 0 || amount < -MAX_GRANT || amount > MAX_GRANT) {
             this.client.sendResponse(new HousekeepingActionResultComposer(actionKey, false, 0, "housekeeping.error.invalid_input"));
             return;
         }
@@ -52,6 +53,7 @@ public class HousekeepingGiveCurrencyEvent extends MessageHandler {
                 online.givePoints(currencyType, amount);
             }
 
+            this.audit(actionKey, userId, currencyType, amount);
             this.client.sendResponse(new HousekeepingActionResultComposer(actionKey, true, userId, ""));
             return;
         }
@@ -69,6 +71,15 @@ public class HousekeepingGiveCurrencyEvent extends MessageHandler {
             return;
         }
 
+        this.audit(actionKey, userId, currencyType, amount);
         this.client.sendResponse(new HousekeepingActionResultComposer(actionKey, true, userId, ""));
     }
+
+    private void audit(String actionKey, int userId, int currencyType, int amount) {
+        com.eu.habbo.habbohotel.modtool.HousekeepingAuditLog.log(
+                this.client.getHabbo().getHabboInfo().getId(),
+                this.client.getHabbo().getHabboInfo().getUsername(),
+                actionKey, userId, "type=" + currencyType + " amount=" + amount,
+                this.client.getHabbo().getHabboInfo().getIpLogin());
+    }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/housekeeping/HousekeepingSearchRoomsEvent.java

@@ -56,7 +56,7 @@ public class HousekeepingSearchRoomsEvent extends MessageHandler {
 
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
              PreparedStatement statement = connection.prepareStatement(sql)) {
-            statement.setString(1, exactMatch ? query : query + "%");
+            statement.setString(1, exactMatch ? query : com.eu.habbo.util.SqlLikeEscaper.escape(query) + "%");
             statement.setInt(2, limit);
 
             try (ResultSet set = statement.executeQuery()) {

Emulator/src/main/java/com/eu/habbo/messages/incoming/housekeeping/HousekeepingSetUserRankEvent.java

@@ -11,6 +11,7 @@ import com.eu.habbo.messages.outgoing.users.UserPermissionsComposer;
 
 import java.sql.Connection;
 import java.sql.PreparedStatement;
+import java.sql.ResultSet;
 import java.sql.SQLException;
 
 public class HousekeepingSetUserRankEvent extends MessageHandler {
@@ -44,6 +45,43 @@ public class HousekeepingSetUserRankEvent extends MessageHandler {
 
         Rank rank = permissions.getRank(rankId);
 
+        // Rank-ceiling guard: an operator must never be able to grant a rank
+        // above their own, nor modify a user who already outranks them. This
+        // mirrors GiveRankCommand and prevents privilege escalation through
+        // the housekeeping path (including self-promotion).
+        int operatorRankId = this.client.getHabbo().getHabboInfo().getRank().getId();
+
+        if (rank.getId() > operatorRankId) {
+            this.client.sendResponse(new HousekeepingActionResultComposer(ACTION_KEY, false, 0, "housekeeping.error.rank_too_high"));
+            return;
+        }
+
+        Habbo online = Emulator.getGameEnvironment().getHabboManager().getHabbo(userId);
+
+        int targetRankId;
+        if (online != null) {
+            targetRankId = online.getHabboInfo().getRank().getId();
+        } else {
+            targetRankId = 0;
+            try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement statement = connection.prepareStatement("SELECT rank FROM users WHERE id = ? LIMIT 1")) {
+                statement.setInt(1, userId);
+                try (ResultSet set = statement.executeQuery()) {
+                    if (set.next()) {
+                        targetRankId = set.getInt("rank");
+                    }
+                }
+            } catch (SQLException e) {
+                this.client.sendResponse(new HousekeepingActionResultComposer(ACTION_KEY, false, 0, "housekeeping.error.db_failed"));
+                return;
+            }
+        }
+
+        if (targetRankId > operatorRankId) {
+            this.client.sendResponse(new HousekeepingActionResultComposer(ACTION_KEY, false, 0, "housekeeping.error.rank_too_high"));
+            return;
+        }
+
         // Persist for the offline path. Online users get their in-memory
         // HabboInfo.rank rebound below so server-side hasPermission()
         // checks land on the new permission set without a relogin.
@@ -57,8 +95,6 @@ public class HousekeepingSetUserRankEvent extends MessageHandler {
             return;
         }
 
-        Habbo online = Emulator.getGameEnvironment().getHabboManager().getHabbo(userId);
-
         if (online != null) {
             online.getHabboInfo().setRank(rank);
             // Ship the refreshed permissions snapshot — same payload the
@@ -66,6 +102,12 @@ public class HousekeepingSetUserRankEvent extends MessageHandler {
             online.getClient().sendResponse(new UserPermissionsComposer(online));
         }
 
+        com.eu.habbo.habbohotel.modtool.HousekeepingAuditLog.log(
+                this.client.getHabbo().getHabboInfo().getId(),
+                this.client.getHabbo().getHabboInfo().getUsername(),
+                ACTION_KEY, userId, "rankId=" + rankId,
+                this.client.getHabbo().getHabboInfo().getIpLogin());
+
         this.client.sendResponse(new HousekeepingActionResultComposer(ACTION_KEY, true, userId, ""));
     }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolRequestUserChatlogEvent.java

@@ -3,6 +3,7 @@ package com.eu.habbo.messages.incoming.modtool;
 import com.eu.habbo.Emulator;
 import com.eu.habbo.habbohotel.modtool.ScripterManager;
 import com.eu.habbo.habbohotel.permissions.Permission;
+import com.eu.habbo.habbohotel.users.HabboInfo;
 import com.eu.habbo.habbohotel.users.HabboManager;
 import com.eu.habbo.messages.incoming.MessageHandler;
 import com.eu.habbo.messages.outgoing.modtool.ModToolUserChatlogComposer;
@@ -12,7 +13,11 @@ public class ModToolRequestUserChatlogEvent extends MessageHandler {
     public void handle() throws Exception {
         if (this.client.getHabbo().hasPermission(Permission.ACC_SUPPORTTOOL)) {
             int userId = this.packet.readInt();
-            String username = HabboManager.getOfflineHabboInfo(userId).getUsername();
+            HabboInfo habboInfo = HabboManager.getOfflineHabboInfo(userId);
+            if (habboInfo == null) {
+                return;
+            }
+            String username = habboInfo.getUsername();
 
             this.client.sendResponse(new ModToolUserChatlogComposer(Emulator.getGameEnvironment().getModToolManager().getUserRoomVisitsAndChatlogs(userId), userId, username));
         } else {

Emulator/src/main/java/com/eu/habbo/messages/incoming/navigator/AddSavedSearchEvent.java

@@ -5,6 +5,13 @@ import com.eu.habbo.messages.incoming.MessageHandler;
 import com.eu.habbo.messages.outgoing.navigator.NewNavigatorSavedSearchesComposer;
 
 public class AddSavedSearchEvent extends MessageHandler {
+    private static final int MAX_SAVED_SEARCHES = 50;
+
+    @Override
+    public int getRatelimit() {
+        return 1000;
+    }
+
     @Override
     public void handle() throws Exception {
         String searchCode = this.packet.readString();
@@ -13,6 +20,11 @@ public class AddSavedSearchEvent extends MessageHandler {
         if (searchCode.length() > 255) searchCode = searchCode.substring(0, 255);
         if (filter.length() > 255) filter = filter.substring(0, 255);
 
+        if (this.client.getHabbo().getHabboInfo().getSavedSearches().size() >= MAX_SAVED_SEARCHES) {
+            this.client.sendResponse(new NewNavigatorSavedSearchesComposer(this.client.getHabbo().getHabboInfo().getSavedSearches()));
+            return;
+        }
+
         this.client.getHabbo().getHabboInfo().addSavedSearch(new NavigatorSavedSearch(searchCode, filter));
 
         this.client.sendResponse(new NewNavigatorSavedSearchesComposer(this.client.getHabbo().getHabboInfo().getSavedSearches()));

Emulator/src/main/java/com/eu/habbo/messages/incoming/navigator/DeleteSavedSearchEvent.java

@@ -5,6 +5,11 @@ import com.eu.habbo.messages.incoming.MessageHandler;
 import com.eu.habbo.messages.outgoing.navigator.NewNavigatorSavedSearchesComposer;
 
 public class DeleteSavedSearchEvent extends MessageHandler {
+    @Override
+    public int getRatelimit() {
+        return 500;
+    }
+
     @Override
     public void handle() throws Exception {
         int searchId = this.packet.readInt();

Emulator/src/main/java/com/eu/habbo/messages/incoming/navigator/RequestNewNavigatorRoomsEvent.java

@@ -15,12 +15,20 @@ import java.util.*;
 
 public class RequestNewNavigatorRoomsEvent extends MessageHandler {
     private static final Logger LOGGER = LoggerFactory.getLogger(RequestNewNavigatorRoomsEvent.class);
+    private static final int MAX_VIEW_LENGTH = 32;
+    private static final int MAX_QUERY_LENGTH = 64;
+
+    @Override
+    public int getRatelimit() {
+        return 200;
+    }
 
     @Override
     public void handle() throws Exception {
         String view = this.packet.readString();
         String query = this.packet.readString();
-
+        if (view.length() > MAX_VIEW_LENGTH) return;
+        if (query.length() > MAX_QUERY_LENGTH) query = query.substring(0, MAX_QUERY_LENGTH);
         if (view.equals("query")) view = "hotel_view";
         if (view.equals("groups")) view = "hotel_view";
 
@@ -43,7 +51,7 @@ public class RequestNewNavigatorRoomsEvent extends MessageHandler {
         NavigatorFilterField field = Emulator.getGameEnvironment().getNavigatorManager().filterSettings.get(filterField);
         if (filter != null) {
             if (query.contains(":")) {
-                String[] parts = query.split(":");
+                String[] parts = query.split(":", 2);
 
                 if (parts.length > 1) {
                     filterField = parts[0];
@@ -53,6 +61,7 @@ public class RequestNewNavigatorRoomsEvent extends MessageHandler {
                     if (!Emulator.getGameEnvironment().getNavigatorManager().filterSettings.containsKey(filterField)) {
                         filterField = "anything";
                     }
+                    part = "";
                 }
             }
 
@@ -95,28 +104,19 @@ public class RequestNewNavigatorRoomsEvent extends MessageHandler {
                 rooms.addAll(searchResultList.rooms);
                 resultLists.add(new SearchResultList(searchResultList.order, searchResultList.code, searchResultList.query, searchResultList.action, searchResultList.mode, searchResultList.hidden, rooms, searchResultList.filter, searchResultList.showInvisible, searchResultList.displayOrder, searchResultList.categoryOrder));
             }
+            if ("group".equals(filterField)) {
+                final String needle = part.toLowerCase();
+                for (SearchResultList list : resultLists) {
+                    list.rooms.removeIf(room -> !room.belongsToGuild()
+                            || (!needle.isEmpty() && !room.getGuildName().toLowerCase().contains(needle)));
+                }
+            }
             filter.filter(field.field, part, resultLists);
             resultLists = toQueryResults(resultLists);
             this.client.sendResponse(new NewNavigatorSearchResultsComposer(view, query, resultLists));
         } catch (Exception e) {
             LOGGER.error("Caught exception", e);
         }
-
-        /*
-        try
-        {
-
-            List<SearchResultList> resultLists = new ArrayList<>(filter.getResult(this.client.getHabbo(), field, part, category != null ? category.getId() : -1));
-            filter.filter(field.field, part, resultLists);
-
-            Collections.sort(resultLists);
-            this.client.sendResponse(new NewNavigatorSearchResultsComposer(view, query, resultLists));
-        }
-        catch (Exception e)
-        {
-            LOGGER.error("Caught exception", e);
-        }
-        */
     }
 
     private ArrayList<SearchResultList> toQueryResults(List<SearchResultList> resultLists) {

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/RoomRequestBannedUsersEvent.java

@@ -14,7 +14,7 @@ public class RoomRequestBannedUsersEvent extends MessageHandler {
 
         Room room = Emulator.getGameEnvironment().getRoomManager().getRoom(roomId);
         if (room == null) return;
-        if (!room.hasRights(this.client.getHabbo()) || !this.client.getHabbo().hasPermission(Permission.ACC_ANYROOMOWNER)) return;
+        if (!room.hasRights(this.client.getHabbo()) && !this.client.getHabbo().hasPermission(Permission.ACC_ANYROOMOWNER)) return;
 
         this.client.sendResponse(new RoomBannedUsersComposer(room));
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/ToggleFloorItemEvent.java

@@ -25,6 +25,11 @@ public class ToggleFloorItemEvent extends MessageHandler {
 
     private static HashSet<String> PET_BOXES = new HashSet<>(Arrays.asList("val11_present", "gnome_box", "leprechaun_box", "velociraptor_egg", "pterosaur_egg", "petbox_epic"));
 
+    @Override
+    public int getRatelimit() {
+        return 100;
+    }
+
     @Override
     public void handle() throws Exception {
         try {

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/ToggleWallItemEvent.java

@@ -9,6 +9,11 @@ import com.eu.habbo.plugin.Event;
 import com.eu.habbo.plugin.events.furniture.FurnitureToggleEvent;
 
 public class ToggleWallItemEvent extends MessageHandler {
+    @Override
+    public int getRatelimit() {
+        return 100;
+    }
+
     @Override
     public void handle() throws Exception {
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/TriggerColorWheelEvent.java

@@ -6,6 +6,11 @@ import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
 
 public class TriggerColorWheelEvent extends MessageHandler {
+    @Override
+    public int getRatelimit() {
+        return 100;
+    }
+
     @Override
     public void handle() throws Exception {
         int itemId = this.packet.readInt();

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/TriggerDiceEvent.java

@@ -7,6 +7,11 @@ import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
 
 public class TriggerDiceEvent extends MessageHandler {
+    @Override
+    public int getRatelimit() {
+        return 100;
+    }
+
     @Override
     public void handle() throws Exception {
         int itemId = this.packet.readInt();

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/TriggerOneWayGateEvent.java

@@ -5,6 +5,11 @@ import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
 
 public class TriggerOneWayGateEvent extends MessageHandler {
+    @Override
+    public int getRatelimit() {
+        return 100;
+    }
+
     @Override
     public void handle() throws Exception {
         if (this.client.getHabbo().getHabboInfo().getCurrentRoom() == null)

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/pets/ConfirmPetBreedingEvent.java

@@ -1,6 +1,7 @@
 package com.eu.habbo.messages.incoming.rooms.pets;
 
 import com.eu.habbo.habbohotel.items.interactions.pets.InteractionPetBreedingNest;
+import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
 
@@ -13,7 +14,10 @@ public class ConfirmPetBreedingEvent extends MessageHandler {
         int petOneId = this.packet.readInt();
         int petTwoId = this.packet.readInt();
 
-        HabboItem item = this.client.getHabbo().getHabboInfo().getCurrentRoom().getHabboItem(itemId);
+        Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
+        if (room == null) return;
+
+        HabboItem item = room.getHabboItem(itemId);
 
         if (item instanceof InteractionPetBreedingNest) {
             ((InteractionPetBreedingNest) item).breed(this.client.getHabbo(), name, petOneId, petTwoId);

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/pets/PetPickupEvent.java

@@ -23,7 +23,7 @@ public class PetPickupEvent extends MessageHandler {
         Pet pet = room.getPet(petId);
 
         if (pet != null) {
-            if (this.client.getHabbo().getHabboInfo().getId() == pet.getId() || room.getOwnerId() == this.client.getHabbo().getHabboInfo().getId() || this.client.getHabbo().hasPermission(Permission.ACC_ANYROOMOWNER)) {
+            if (this.client.getHabbo().getHabboInfo().getId() == pet.getUserId() || room.getOwnerId() == this.client.getHabbo().getHabboInfo().getId() || this.client.getHabbo().hasPermission(Permission.ACC_ANYROOMOWNER)) {
                 if (!this.client.getHabbo().hasPermission(Permission.ACC_UNLIMITED_PETS) && this.client.getHabbo().getInventory().getPetsComponent().getPets().size() >= PetManager.MAXIMUM_PET_INVENTORY_SIZE) {
                     this.client.getHabbo().alert(Emulator.getTexts().getValue("error.pets.max.inventory").replace("%amount%", PetManager.MAXIMUM_PET_INVENTORY_SIZE + ""));
                     return;

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/users/RoomUserWalkEvent.java

@@ -163,7 +163,13 @@ public class RoomUserWalkEvent extends MessageHandler {
           }
 
           if (roomUnit.getMoveBlockingTask() != null) {
-            roomUnit.getMoveBlockingTask().get();
+            try {
+              // Bound the wait so a stuck/delayed move-blocking task can't park
+              // the Netty event loop (and thus every client on it) indefinitely.
+              roomUnit.getMoveBlockingTask().get(2, java.util.concurrent.TimeUnit.SECONDS);
+            } catch (java.util.concurrent.TimeoutException | java.util.concurrent.ExecutionException | InterruptedException e) {
+              // proceed with the walk regardless
+            }
           }
 
           boolean needsLocationResync =

Emulator/src/main/java/com/eu/habbo/messages/outgoing/furnieditor/FurniEditorDetailComposer.java

@@ -12,12 +12,18 @@ public class FurniEditorDetailComposer extends MessageComposer {
     private final int usageCount;
     private final List<Map<String, Object>> catalogItems;
     private final String furniDataJson;
+    private final String furniDataDiagnosticJson;
 
     public FurniEditorDetailComposer(Map<String, Object> item, int usageCount, List<Map<String, Object>> catalogItems, String furniDataJson) {
+        this(item, usageCount, catalogItems, furniDataJson, "{}");
+    }
+
+    public FurniEditorDetailComposer(Map<String, Object> item, int usageCount, List<Map<String, Object>> catalogItems, String furniDataJson, String furniDataDiagnosticJson) {
         this.item = item;
         this.usageCount = usageCount;
         this.catalogItems = catalogItems;
         this.furniDataJson = furniDataJson;
+        this.furniDataDiagnosticJson = furniDataDiagnosticJson;
     }
 
     @Override
@@ -71,6 +77,7 @@ public class FurniEditorDetailComposer extends MessageComposer {
 
         // furnidata JSON string
         this.response.appendString(this.furniDataJson != null ? this.furniDataJson : "{}");
+        this.response.appendString(this.furniDataDiagnosticJson != null ? this.furniDataDiagnosticJson : "{}");
 
         return this.response;
     }

Emulator/src/main/java/com/eu/habbo/messages/outgoing/modtool/ModToolSanctionInfoComposer.java

@@ -9,8 +9,8 @@ import com.eu.habbo.messages.ServerMessage;
 import com.eu.habbo.messages.outgoing.MessageComposer;
 import com.eu.habbo.messages.outgoing.Outgoing;
 import gnu.trove.map.hash.THashMap;
-import org.joda.time.DateTime;
 
+import java.time.ZoneId;
 import java.util.ArrayList;
 import java.util.Date;
 
@@ -47,7 +47,10 @@ public class ModToolSanctionInfoComposer extends MessageComposer {
                 if (item.probationTimestamp > 0) {
                     probationEndTime = new Date((long) item.probationTimestamp * 1000);
 
-                    probationStartTime = new DateTime(probationEndTime).minusDays(modToolSanctions.getProbationDays(modToolSanctionLevelItem)).toDate();
+                    probationStartTime = Date.from(probationEndTime.toInstant()
+                            .atZone(ZoneId.systemDefault())
+                            .minusDays(modToolSanctions.getProbationDays(modToolSanctionLevelItem))
+                            .toInstant());
 
                     Date tradeLockedUntil = null;
 

Emulator/src/main/java/com/eu/habbo/messages/outgoing/rooms/users/RoomUsersComposer.java

@@ -99,7 +99,7 @@ public class RoomUsersComposer extends MessageComposer {
                     this.response.appendInt(1);
                     this.response.appendString(habbo.getHabboInfo().getGender().name().toUpperCase());
                     this.response.appendInt(habbo.getHabboStats().guild != 0 ? habbo.getHabboStats().guild : -1);
-                    this.response.appendInt(habbo.getHabboStats().guild != 0 ? habbo.getHabboStats().guild : -1);
+                    this.response.appendInt(habbo.getHabboStats().guild != 0 ? 1 : -1);
                     String name = "";
                     if (habbo.getHabboStats().guild != 0) {
                         Guild g = Emulator.getGameEnvironment().getGuildManager().getGuild(habbo.getHabboStats().guild);

Emulator/src/main/java/com/eu/habbo/messages/rcon/DisconnectUser.java

@@ -29,7 +29,7 @@ public class DisconnectUser extends RCONMessage<DisconnectUser.DisconnectUserJSO
             return;
         }
 
-        Emulator.getGameServer().getGameClientManager().disposeClient(target.getClient());
+        Emulator.getGameServer().getGameClientManager().forceDisposeClient(target.getClient());
         this.message = Emulator.getTexts().getValue("commands.succes.cmd_disconnect.disconnected").replace("%user%", target.getHabboInfo().getUsername());
     }
 
@@ -40,4 +40,4 @@ public class DisconnectUser extends RCONMessage<DisconnectUser.DisconnectUserJSO
 
         public String username;
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/networking/Server.java

@@ -1,12 +1,16 @@
 package com.eu.habbo.networking;
 
+import com.eu.habbo.Emulator;
 import io.netty.bootstrap.ServerBootstrap;
+import io.netty.buffer.ByteBufAllocator;
+import io.netty.buffer.PooledByteBufAllocator;
 import io.netty.buffer.UnpooledByteBufAllocator;
 import io.netty.channel.ChannelFuture;
 import io.netty.channel.ChannelOption;
 import io.netty.channel.EventLoopGroup;
 import io.netty.channel.FixedRecvByteBufAllocator;
-import io.netty.channel.nio.NioEventLoopGroup;
+import io.netty.channel.MultiThreadIoEventLoopGroup;
+import io.netty.channel.nio.NioIoHandler;
 import io.netty.channel.socket.nio.NioServerSocketChannel;
 import io.netty.util.concurrent.DefaultThreadFactory;
 import org.slf4j.Logger;
@@ -18,6 +22,30 @@ public abstract class Server {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(Server.class);
 
+    private static volatile ByteBufAllocator sharedAllocator;
+
+    /**
+     * Shared channel allocator. Defaults to unpooled-heap (the long-standing
+     * behaviour); set {@code io.netty.allocator.pooled=true} to switch to a
+     * pooled HEAP allocator (preferDirect=false, so the array-backed crypto
+     * paths keep working) which removes the per-packet alloc/GC churn. Opt-in
+     * until validated under load with the Netty leak detector, since pooled
+     * buffers that aren't released accumulate instead of being GC-reclaimed.
+     */
+    protected static ByteBufAllocator allocator() {
+        if (sharedAllocator == null) {
+            synchronized (Server.class) {
+                if (sharedAllocator == null) {
+                    boolean pooled = Emulator.getConfig() != null
+                            && "true".equalsIgnoreCase(Emulator.getConfig().getValue("io.netty.allocator.pooled", "false"));
+                    sharedAllocator = pooled ? new PooledByteBufAllocator(false) : new UnpooledByteBufAllocator(false);
+                    LOGGER.info("Netty ByteBuf allocator: {}", pooled ? "pooled-heap" : "unpooled-heap");
+                }
+            }
+        }
+        return sharedAllocator;
+    }
+
     protected final ServerBootstrap serverBootstrap;
     protected final EventLoopGroup bossGroup;
     protected final EventLoopGroup workerGroup;
@@ -32,8 +60,10 @@ public abstract class Server {
 
         String threadName = name.replace("Server", "").replace(" ", "");
 
-        this.bossGroup = new NioEventLoopGroup(bossGroupThreads, new DefaultThreadFactory(threadName + "Boss"));
-        this.workerGroup = new NioEventLoopGroup(workerGroupThreads, new DefaultThreadFactory(threadName + "Worker"));
+        // Netty 4.2: NioEventLoopGroup is deprecated in favour of the generic
+        // MultiThreadIoEventLoopGroup driven by an IoHandlerFactory (NIO here).
+        this.bossGroup = new MultiThreadIoEventLoopGroup(bossGroupThreads, new DefaultThreadFactory(threadName + "Boss"), NioIoHandler.newFactory());
+        this.workerGroup = new MultiThreadIoEventLoopGroup(workerGroupThreads, new DefaultThreadFactory(threadName + "Worker"), NioIoHandler.newFactory());
         this.serverBootstrap = new ServerBootstrap();
     }
 
@@ -45,7 +75,7 @@ public abstract class Server {
         this.serverBootstrap.childOption(ChannelOption.SO_REUSEADDR, true);
         this.serverBootstrap.childOption(ChannelOption.SO_RCVBUF, 4096);
         this.serverBootstrap.childOption(ChannelOption.RCVBUF_ALLOCATOR, new FixedRecvByteBufAllocator(4096));
-        this.serverBootstrap.childOption(ChannelOption.ALLOCATOR, new UnpooledByteBufAllocator(false));
+        this.serverBootstrap.childOption(ChannelOption.ALLOCATOR, allocator());
     }
 
     public void connect() {

Emulator/src/main/java/com/eu/habbo/networking/gameserver/GameServer.java

@@ -84,7 +84,7 @@ public class GameServer extends Server {
         this.webSocketBootstrap.childOption(ChannelOption.SO_REUSEADDR, true);
         this.webSocketBootstrap.childOption(ChannelOption.SO_RCVBUF, 4096);
         this.webSocketBootstrap.childOption(ChannelOption.RCVBUF_ALLOCATOR, new FixedRecvByteBufAllocator(4096));
-        this.webSocketBootstrap.childOption(ChannelOption.ALLOCATOR, new UnpooledByteBufAllocator(false));
+        this.webSocketBootstrap.childOption(ChannelOption.ALLOCATOR, allocator());
         this.webSocketBootstrap.childHandler(wsInitializer);
 
         ChannelFuture wsFuture = this.webSocketBootstrap.bind(wsHost, wsPort);

Emulator/src/main/java/com/eu/habbo/networking/gameserver/WebSocketChannelInitializer.java

@@ -26,12 +26,37 @@ import io.netty.handler.codec.http.websocketx.WebSocketServerProtocolHandler;
 import io.netty.handler.logging.LoggingHandler;
 import io.netty.handler.ssl.SslContext;
 import io.netty.handler.ssl.SslHandler;
+import io.netty.util.concurrent.DefaultEventExecutorGroup;
+import io.netty.util.concurrent.DefaultThreadFactory;
+import io.netty.util.concurrent.EventExecutorGroup;
 
 import javax.net.ssl.SSLEngine;
 
 public class WebSocketChannelInitializer extends ChannelInitializer<SocketChannel> {
     private static final int MAX_FRAME_SIZE = 500000;
 
+    // Runs the game packet handler OFF the Netty I/O event loop, so a blocking
+    // handler (login/friends/catalog/guild JDBC, A* pathfinding, etc.) can no
+    // longer stall socket I/O for every other client sharing that I/O thread.
+    // A DefaultEventExecutorGroup pins each channel to one executor, so a single
+    // client's packets stay strictly ordered (no new intra-client races); the
+    // cross-client concurrency degree is the same the multi-threaded I/O group
+    // already had. Daemon threads so they don't block JVM shutdown.
+    private static final EventExecutorGroup PACKET_HANDLER_GROUP = new DefaultEventExecutorGroup(
+            packetHandlerThreads(),
+            new DefaultThreadFactory("GamePacketHandler", true));
+
+    // Size of the packet-handler pool. Defaults to max(16, 2x CPU cores); set
+    // the optional `io.packet.handler.threads` config key to override.
+    private static int packetHandlerThreads() {
+        int fallback = Math.max(16, Runtime.getRuntime().availableProcessors() * 2);
+        if (Emulator.getConfig() == null) {
+            return fallback;
+        }
+        int configured = Emulator.getConfig().getInt("io.packet.handler.threads", fallback);
+        return configured > 0 ? configured : fallback;
+    }
+
     private final SslContext sslContext;
     private final boolean sslEnabled;
     private final WebSocketServerProtocolConfig wsConfig;
@@ -82,7 +107,7 @@ public class WebSocketChannelInitializer extends ChannelInitializer<SocketChanne
 
         ch.pipeline().addLast("idleEventHandler", new IdleTimeoutHandler(30, 60));
         ch.pipeline().addLast(new GameMessageRateLimit());
-        ch.pipeline().addLast(new GameMessageHandler());
+        ch.pipeline().addLast(PACKET_HANDLER_GROUP, "gameMessageHandler", new GameMessageHandler());
         ch.pipeline().addLast("messageEncoder", new GameServerMessageEncoder());
 
         if (PacketManager.DEBUG_SHOW_PACKETS) {

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/AccountChangeEndpoints.java

@@ -467,7 +467,7 @@ final class AccountChangeEndpoints {
                 com.eu.habbo.habbohotel.users.Habbo habbo =
                         Emulator.getGameServer().getGameClientManager().getHabbo(userId);
                 if (habbo != null && habbo.getClient() != null) {
-                    Emulator.getGameServer().getGameClientManager().disposeClient(habbo.getClient());
+                    Emulator.getGameServer().getGameClientManager().forceDisposeClient(habbo.getClient());
                 }
             }
 

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/AuthHttpHandler.java

@@ -9,8 +9,15 @@ import io.netty.handler.codec.http.HttpMethod;
 import io.netty.handler.codec.http.HttpResponseStatus;
 import io.netty.handler.codec.http.QueryStringDecoder;
 import io.netty.util.ReferenceCountUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.nio.charset.StandardCharsets;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.RejectedExecutionException;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
 
 import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.MAX_BODY_BYTES;
 import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.errorPayload;
@@ -21,6 +28,37 @@ import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.sendJson;
 
 public class AuthHttpHandler extends ChannelInboundHandlerAdapter {
 
+    private static final Logger LOGGER = LoggerFactory.getLogger(AuthHttpHandler.class);
+
+    // Dedicated, bounded pool for the auth endpoints. Their work blocks on
+    // BCrypt, JDBC, the Turnstile HTTPS round-trip and SMTP — running that on the
+    // Netty event loop stalls every client on the same worker. A SEPARATE pool
+    // (not the shared game ThreadPooling) also keeps it from starving room cycles.
+    private static final int AUTH_POOL_MAX = authPoolMax();
+    private static final ThreadPoolExecutor AUTH_EXECUTOR = new ThreadPoolExecutor(
+            Math.min(4, AUTH_POOL_MAX), AUTH_POOL_MAX, 60L, TimeUnit.SECONDS,
+            new LinkedBlockingQueue<>(512),
+            new java.util.concurrent.ThreadFactory() {
+                private final AtomicInteger counter = new AtomicInteger(1);
+                @Override
+                public Thread newThread(Runnable r) {
+                    Thread t = new Thread(r, "auth-http-worker-" + counter.getAndIncrement());
+                    t.setDaemon(true);
+                    return t;
+                }
+            });
+
+    // Max threads for the auth pool. Defaults to 16; set the optional
+    // `auth.http.pool.size` config key to override.
+    private static int authPoolMax() {
+        int fallback = 16;
+        if (com.eu.habbo.Emulator.getConfig() == null) {
+            return fallback;
+        }
+        int configured = com.eu.habbo.Emulator.getConfig().getInt("auth.http.pool.size", fallback);
+        return configured > 0 ? configured : fallback;
+    }
+
     static final String LOGIN_PATH           = "/api/auth/login";
     static final String REGISTER_PATH        = "/api/auth/register";
     static final String FORGOT_PATH          = "/api/auth/forgot-password";
@@ -52,10 +90,30 @@ public class AuthHttpHandler extends ChannelInboundHandlerAdapter {
             return;
         }
 
+        // Offload the (potentially blocking) auth work off the event loop. Netty
+        // writes are thread-safe, so the endpoints' sendJson/writeAndFlush calls
+        // are fine from the worker; the request is released once the work ends.
         try {
-            handle(ctx, req, path);
-        } finally {
-            ReferenceCountUtil.release(req);
+            AUTH_EXECUTOR.execute(() -> {
+                try {
+                    handle(ctx, req, path);
+                } catch (Throwable t) {
+                    LOGGER.error("Auth handler failed for {}", path, t);
+                    try {
+                        sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Internal error."));
+                    } catch (Throwable ignored) {
+                        // response may already be partially written — nothing else to do
+                    }
+                } finally {
+                    ReferenceCountUtil.release(req);
+                }
+            });
+        } catch (RejectedExecutionException rejected) {
+            try {
+                sendJson(ctx, req, HttpResponseStatus.SERVICE_UNAVAILABLE, errorPayload("Server busy, try again shortly."));
+            } finally {
+                ReferenceCountUtil.release(req);
+            }
         }
     }
 

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/AuthHttpUtil.java

@@ -28,7 +28,7 @@ import java.sql.SQLException;
 import java.util.Base64;
 import java.util.regex.Pattern;
 
-final class AuthHttpUtil {
+public final class AuthHttpUtil {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(AuthHttpUtil.class);
 
@@ -132,7 +132,10 @@ final class AuthHttpUtil {
         String ipHeader = Emulator.getConfig() != null
                 ? Emulator.getConfig().getValue("ws.ip.header", "")
                 : "";
-        if (!ipHeader.isEmpty() && req.headers().contains(ipHeader)) {
+        // Only trust a client-supplied forwarded-IP header when the DIRECT peer
+        // is a trusted reverse proxy; otherwise an attacker hitting the port
+        // directly could spoof it to evade per-IP rate limiting and IP bans.
+        if (!ipHeader.isEmpty() && req.headers().contains(ipHeader) && isTrustedProxy(ctx)) {
             String hv = req.headers().get(ipHeader);
             if (hv != null && !hv.isEmpty()) {
                 int comma = hv.indexOf(',');
@@ -148,6 +151,37 @@ final class AuthHttpUtil {
         return "";
     }
 
+    /**
+     * Whether the channel's direct peer may set a forwarded-IP header. Loopback
+     * is always trusted; additional proxies can be allow-listed (exact IP or
+     * string prefix, comma-separated) via the {@code ws.ip.header.trusted}
+     * config key. Default-deny so the header can't be spoofed from the open net.
+     */
+    public static boolean isTrustedProxy(ChannelHandlerContext ctx) {
+        String peerIp = (ctx.channel().remoteAddress() instanceof InetSocketAddress a)
+                ? a.getAddress().getHostAddress() : null;
+        if (peerIp == null || peerIp.isEmpty()) return false;
+        if (peerIp.equals("127.0.0.1") || peerIp.equals("::1") || peerIp.equals("0:0:0:0:0:0:0:1")) {
+            return true;
+        }
+        String trusted = Emulator.getConfig() != null
+                ? Emulator.getConfig().getValue("ws.ip.header.trusted", "")
+                : "";
+        if (trusted.isEmpty()) return false;
+        for (String entry : trusted.split(",")) {
+            String t = entry.trim();
+            if (t.isEmpty()) continue;
+            // Exact IP match, or a dotted/colon prefix range (e.g. "10.0.0." or
+            // "2001:db8:") — never a bare-IP prefix, so "10.0.0.1" can't also
+            // trust "10.0.0.12".
+            boolean isRange = t.endsWith(".") || t.endsWith(":");
+            if (peerIp.equals(t) || (isRange && peerIp.startsWith(t))) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     static boolean checkPassword(String plain, String stored) {
         String compatible = stored.startsWith("$2y$") ? "$2a$" + stored.substring(4) : stored;
         try {

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/AuthRateLimiter.java

@@ -11,8 +11,34 @@ public final class AuthRateLimiter {
     private static final Map<String, AtomicReference<State>> STATE = new ConcurrentHashMap<>();
     private static final Map<String, AtomicReference<ProbeState>> PROBE_STATE = new ConcurrentHashMap<>();
 
+    // Both maps are keyed by client IP and reachable by unauthenticated traffic.
+    // recordSuccess removes STATE on login, but failed-only and probe-only IPs
+    // never get removed otherwise — unbounded growth over the JVM lifetime.
+    // Opportunistically evict window-expired entries once the maps get large.
+    private static final int SWEEP_THRESHOLD = 10_000;
+    private static final long SWEEP_MIN_INTERVAL_MS = 60_000L;
+    private static volatile long lastSweepMillis = 0L;
+
     private AuthRateLimiter() {}
 
+    private static void maybeSweep(long now) {
+        if (STATE.size() < SWEEP_THRESHOLD && PROBE_STATE.size() < SWEEP_THRESHOLD) return;
+        if (now - lastSweepMillis < SWEEP_MIN_INTERVAL_MS) return;
+        lastSweepMillis = now;
+
+        long stateWindowMs = configInt("login.ratelimit.window_sec", 60) * 1000L;
+        STATE.entrySet().removeIf(e -> {
+            State s = e.getValue().get();
+            return s == null || (s.lockedUntilMillis <= now && (now - s.windowStartMillis) > stateWindowMs);
+        });
+
+        long probeWindowMs = configInt("login.probe.window_sec", 60) * 1000L;
+        PROBE_STATE.entrySet().removeIf(e -> {
+            ProbeState p = e.getValue().get();
+            return p == null || (now - p.windowStartMillis) > probeWindowMs;
+        });
+    }
+
     public static boolean isLocked(String ip) {
         if (!isEnabled() || ip == null || ip.isEmpty()) return false;
 
@@ -38,6 +64,7 @@ public final class AuthRateLimiter {
         if (!isEnabled() || ip == null || ip.isEmpty()) return;
 
         long now = System.currentTimeMillis();
+        maybeSweep(now);
         long windowMs = configInt("login.ratelimit.window_sec", 60) * 1000L;
         int maxAttempts = configInt("login.ratelimit.max_attempts", 5);
         long lockoutMs = configInt("login.ratelimit.lockout_sec", 120) * 1000L;
@@ -64,6 +91,7 @@ public final class AuthRateLimiter {
         if (isLocked(ip)) return false;
 
         long now = System.currentTimeMillis();
+        maybeSweep(now);
         long windowMs = configInt("login.probe.window_sec", 60) * 1000L;
         int maxAttempts = configInt("login.probe.max_attempts", 20);
 

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/SessionEndpoints.java

@@ -69,7 +69,7 @@ final class SessionEndpoints {
                         com.eu.habbo.habbohotel.users.Habbo habbo =
                                 Emulator.getGameServer().getGameClientManager().getHabbo(userId);
                         if (habbo != null && habbo.getClient() != null) {
-                            Emulator.getGameServer().getGameClientManager().disposeClient(habbo.getClient());
+                            Emulator.getGameServer().getGameClientManager().forceDisposeClient(habbo.getClient());
                         }
                     }
                 }

Emulator/src/main/java/com/eu/habbo/networking/gameserver/decoders/GameByteDecryption.java

@@ -2,6 +2,7 @@ package com.eu.habbo.networking.gameserver.decoders;
 
 import com.eu.habbo.networking.gameserver.GameServerAttributes;
 import io.netty.buffer.ByteBuf;
+import io.netty.buffer.Unpooled;
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.ByteToMessageDecoder;
 
@@ -15,14 +16,17 @@ public class GameByteDecryption extends ByteToMessageDecoder {
 
     @Override
     protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) {
-        // Read all available bytes.
-        ByteBuf data = in.readBytes(in.readableBytes());
+        // Copy the readable region into a plain array (offset-safe, so this is
+        // correct for pooled buffers too — buf.array() would have read the wrong
+        // region for a pooled/sliced buffer).
+        byte[] bytes = new byte[in.readableBytes()];
+        in.readBytes(bytes);
 
-        // Decrypt.
-        ctx.channel().attr(GameServerAttributes.CRYPTO_CLIENT).get().parse(data.array());
+        // Decrypt in place.
+        ctx.channel().attr(GameServerAttributes.CRYPTO_CLIENT).get().parse(bytes);
 
         // Continue in the pipeline.
-        out.add(data);
+        out.add(Unpooled.wrappedBuffer(bytes));
     }
 
 }

Emulator/src/main/java/com/eu/habbo/networking/gameserver/decoders/GameMessageHandler.java

@@ -56,14 +56,13 @@ public class GameMessageHandler extends ChannelInboundHandlerAdapter {
         ClientMessage message = (ClientMessage) msg;
 
         try {
-            ChannelReadHandler handler = new ChannelReadHandler(ctx, message);
-
-            if (PacketManager.MULTI_THREADED_PACKET_HANDLING) {
-                Emulator.getThreading().run(handler);
-                return;
-            }
-
-            handler.run();
+            // This handler is registered on a dedicated EventExecutorGroup
+            // (see WebSocketChannelInitializer), so channelRead already runs OFF
+            // the Netty I/O event loop, serialized per channel. Running the
+            // handler inline here keeps that per-channel ordering — submitting to
+            // the shared game pool instead would break ordering, so we no longer
+            // branch on MULTI_THREADED_PACKET_HANDLING.
+            new ChannelReadHandler(ctx, message).run();
         } catch (Exception e) {
             LOGGER.error("Caught exception", e);
         }

Emulator/src/main/java/com/eu/habbo/networking/gameserver/decoders/GameMessageRateLimit.java

@@ -23,7 +23,12 @@ public class GameMessageRateLimit extends MessageToMessageDecoder<ClientMessage>
     protected void decode(ChannelHandlerContext ctx, ClientMessage message, List<Object> out) throws Exception {
         GameClient client = ctx.channel().attr(GameServerAttributes.CLIENT).get();
 
+        // ClientMessage is not ReferenceCounted, so MessageToMessageDecoder's
+        // auto-release is a no-op for it; on every drop path we must release the
+        // wrapped ByteBuf ourselves or it leaks (it is only released downstream
+        // in ChannelReadHandler on the success path).
         if (client == null) {
+            message.release();
             return;
         }
 
@@ -42,6 +47,7 @@ public class GameMessageRateLimit extends MessageToMessageDecoder<ClientMessage>
         }
 
         if (count > MAX_COUNTER) {
+            message.release();
             return;
         }
 
@@ -53,6 +59,7 @@ public class GameMessageRateLimit extends MessageToMessageDecoder<ClientMessage>
                 LOGGER.warn("Global packet rate limit exceeded for {} ({} packets/sec) — dropping excess packets",
                         username, globalCount);
             }
+            message.release();
             return;
         }
 

Emulator/src/main/java/com/eu/habbo/networking/gameserver/encoders/GameByteEncryption.java

@@ -2,6 +2,7 @@ package com.eu.habbo.networking.gameserver.encoders;
 
 import com.eu.habbo.networking.gameserver.GameServerAttributes;
 import io.netty.buffer.ByteBuf;
+import io.netty.buffer.Unpooled;
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.channel.ChannelOutboundHandlerAdapter;
 import io.netty.channel.ChannelPromise;
@@ -14,16 +15,19 @@ public class GameByteEncryption extends ChannelOutboundHandlerAdapter {
         // convert to Bytebuf
         ByteBuf in = (ByteBuf) msg;
 
-        // read available bytes
-        ByteBuf data = (in).readBytes(in.readableBytes());
+        // Copy the readable region into a plain array (respects readerIndex /
+        // arrayOffset, so this is correct for pooled buffers too — buf.array()
+        // would have returned the wrong region for a pooled/sliced buffer).
+        byte[] bytes = new byte[in.readableBytes()];
+        in.readBytes(bytes);
 
         //release old object
         ReferenceCountUtil.release(in);
 
-        // Encrypt.
-        ctx.channel().attr(GameServerAttributes.CRYPTO_SERVER).get().parse(data.array());
+        // Encrypt in place.
+        ctx.channel().attr(GameServerAttributes.CRYPTO_SERVER).get().parse(bytes);
 
         // Continue in the pipeline.
-        ctx.write(data, promise);
+        ctx.write(Unpooled.wrappedBuffer(bytes), promise);
     }
 }