[4.5.2] — Bug-Fix Release

🔴 Critical Fixes

BUG-1 · Boss Zombie drops Diamond Armour on death

• File: ZombieSpawnService.java — spawnBossZombie()
• Root cause: setArmorContents() was called without setting drop chances to 0. Bukkit's default drop chance is ~8.5%, so players could farm Diamond Helmet / Chestplate by killing the Boss.
• Fix: Added explicit setHelmetDropChance(0f), setChestplateDropChance(0f), setLeggingsDropChance(0f), and setBootsDropChance(0f) after every armour assignment, including the custom-model-data head path.

BUG-2 · Boss HP inconsistent — evolveZombie() multiplier overridden

• File: ZombieSpawnService.java — spawnBossZombie()
• Root cause: spawnCustomZombie() internally called evolveZombie() which applied a tier health multiplier (up to ×2.5 for ABERRANT), but spawnBossZombie() then hard-reset the attribute to boss.health config value, discarding the tier scaling entirely.
• Fix: spawnBossZombie() now sets bossHealth first, then calls evolveZombie() so the tier multiplier compounds on top of the intended base. Boss HP in late-game now scales correctly with the threat level.

🟡 Medium Fixes

BUG-3 · ABERRANT zombies appear ~35 days too early

• File: ZombieEvolutionService.java — determineTier()
• Root cause: The else branch covered threat >= 30, but the class-level comment stated "Threat > 50: Aberrant possible". Players hit ABERRANT-tier enemies during Phase 3 (Day ~15) instead of Phase 5 (Day ~25+).
• Fix: Inserted an explicit threat < 50 bracket (no ABERRANT, Mutated max) and moved ABERRANT to threat >= 50 only, matching the original design intent.

BUG-4 · /zapoc infect shows hardcoded "10m" regardless of config

• File: ZombieApoc.java — onCommand() case "infect"
• Root cause: incubationTicks was read from config but immediately discarded; the player message used the literal string "10m".
• Fix: timeDisplay is now derived from incubationTicks / 20 seconds so the displayed time always reflects the actual configured value.

BUG-5 · ZombieBehaviorTask batch-skipping uses hashCode() % 2 (uneven distribution)

• File: ZombieBehaviorTask.java — run()
• Root cause: UUID.hashCode() is a 32-bit hash with no uniformity guarantee. In practice this can result in 70 % of zombies processed on one tick and 30 % on the other, defeating the purpose of two-bucket batching.
• Fix: Changed the modulus operand to UUID.getLeastSignificantBits() which is a raw 64-bit random value from the UUID v4 spec, giving near-perfect 50/50 split.

BUG-6 · HallucinationListener double-registration on /zapoc reload

• File: ZombieApoc.java — startTasks()
• Root cause: startTasks() checked if (hallucinationListener == null) before creating a new instance, but cancelAllTasks() already set it to null. In specific edge cases (e.g. psychological-horror.enabled toggled via config between reloads) the old instance could survive unregistered yet the new instance would be registered on top.
• Fix: startTasks() now unconditionally calls HandlerList.unregisterAll() and nulls the field before constructing a fresh HallucinationListener, making the lifecycle explicit and immune to ordering issues.

BUG-7 · WorldEventTask blood-moon maps leak UUID entries for unloaded worlds

• File: WorldEventTask.java
• Root cause: bloodMoonStates and bloodMoonRolledDay used world UUIDs as keys but never removed entries when a world was unloaded (e.g. on map rotation or /mv unload). Over time this created an unbounded set of stale entries.
• Fix: WorldEventTask now implements Listener and handles WorldUnloadEvent to remove both maps' entries for the unloaded world. The task is registered and unregistered as a listener in startTasks() / cancelAllTasks().

🟢 Minor Improvements

PERF-1 · ZombieBehaviorTask reads 7 YAML values every 10-tick cycle

• File: ZombieBehaviorTask.java
• Root cause: moanEnabled, moanChance, moanVol, moanPitch, mutationEnabled, mutationInterval, and breakingEnabled were fetched from FileConfiguration on every call to run().
• Fix: All seven values are now cached as class-level fields alongside the existing sun / screamer caches and refreshed once every 100 ticks inside reloadSunConfigCache().

PERF-2 · handleExplosive() reads explosive.power from YAML at explosion time

• File: ZombieBehaviorTask.java
• Fix: Added cachedExplosivePower field, populated in reloadSunConfigCache().

PERF-3 · CampfireManager.isInsideSafeZone() reads check-radius from YAML per call

• File: CampfireManager.java
• Root cause: plugin.getMechanicsConfig().getInt("campfires.check-radius", 100) was called on every invocation. isInsideSafeZone() is called once per second per online player from PlayerStatusTask, making this a hot path.
• Fix: Added cachedCheckRadius field, initialised in the constructor and refreshed in reload().

DEPRECATION-1 · TurretListener used legacy ChatColor string API

• File: TurretListener.java
• Fix: All player messages converted to net.kyori.adventure.text.Component using NamedTextColor and TextDecoration, the standard approach on Paper 1.16+.

DEPRECATION-2 · ZombieApoc.sendActionBar() used BungeeCord spigot bridge

• File: ZombieApoc.java
• Fix: Replaced player.spigot().sendMessage(ChatMessageType.ACTION_BAR, ...) with the Paper-native player.sendActionBar(Component) call. Removed unused net.md_5.bungee.api.* imports.

[4.5.1] - 2026-05-20 - Critical Bug Purge III

Fixed

• Turret system completely non-functional — Adventure vs. Legacy API mismatch (BF-16) — The crafting recipe assigned the "Sentry Turret" display name via the Adventure API (meta.displayName(Component.text(...))). TurretListener.isTurretItem() read the name with the deprecated Legacy API (meta.getDisplayName()), which always returns an empty string when the name was set via Adventure — so the check never matched and TurretManager.createTurret() was never called. Placing a crafted turret had no effect. isTurretItem() now reads the Adventure displayName() component first, serialises it to plain text, and falls back to the legacy accessor for pre-migration items.

• onDisable() never called turretManager.cleanup() — turret data loss on restart (BF-17) — CampfireManager.shutdown() was called in onDisable() but the analogous TurretManager.cleanup() call was absent. cleanup() is responsible for cancelling the internal firing task and flushing turrets_data.yml. Turrets placed during a session without a prior auto-save were silently lost on server restart. turretManager.cleanup() is now called from onDisable().

• /zapoc reload wiped all zombie custom AI — missing scanExistingZombies() call (BF-19) — loadConfig() (called by loadAllConfigs() at the start of every reload) called trackedZombies.clear(). ZombieBehaviorTask iterates that collection each tick; after a reload it was empty, so every living custom zombie lost its AI (no moans, no screaming, no sun effect, no mutation) until the zombie died or new ones spawned. scanExistingZombies() is now called at the end of the reload handler to repopulate the map immediately.

• /zapoc reload did not rebuild TurretManager — config changes had no effect (BF-18) — TurretManager reads range, damage, and fire-rate-ticks only in its constructor. After a reload the old instance kept running with stale values. The reload handler now calls turretManager.cleanup() and recreates a fresh TurretManager, matching the pattern already applied to StructureManager.

• Feign-Death zombie permanently invulnerable and AI-less after server restart (BF-20) — When a Feign-Death zombie "died", the code set invulnerable=true and AI=false, then scheduled a BukkitRunnable to revive it after 3–5 s. If the server restarted during that window, the task was discarded but the entity flags persisted in NBT — leaving an immortal, motionless zombie that could never be killed. A new PDC key feign_active is set at the start of feign-death and cleared on revive. ZombieCleanupListener.onChunkLoad now detects this key and immediately invokes the shared SpecialZombieListener.reviveZombie() method, which also handles the scheduled revive path.

• CampfireManager.damageCampfire() triggered a full YAML write on every zombie hit (BF-21) — saveCampfires() (atomic file I/O on the main thread) was called each time a zombie attacked a campfire. With multiple zombies attacking multiple campfires simultaneously during a Blood Moon, this caused significant main-thread stalls. Replaced with a dirty flag: damage marks the campfire data as dirty, and the periodic task flushes to disk at most once every ~5 seconds. Immediate saves are still performed when a campfire is destroyed.

• ZombieBehaviorTask.handleScreamer() read 6 YAML values per zombie per 0.5 s (BF-23) — Every invocation of handleScreamer() called getZombiesConfig().getDouble/getString/getInt() six times. With 20 Screamer zombies that is 120 YAML map lookups per 500 ms. All six values (scream-chance, particle, particle-count, scream-range, darkness-duration, message) are now cached in the same 5-second refresh cycle used by sun-effect config.

• ZombieBehaviorTask.handleBreaker() read success-chance from YAML per zombie per 2 s (BF-24) — zombie-breaking.success-chance was fetched from FileConfiguration inside the per-zombie loop every 40 ticks. Now cached alongside the other task-level values.

• PsychologicalHorrorTask.activeHallucinations used entity ID (int) as map key (BF-25) — Entity IDs are 32-bit integers reused by the server after an entity despawns. Using entity.getEntityId() as the map key could cause stale HallucinationData entries to collide with or shadow new entries sharing the same recycled ID. The key type is now UUID (entity.getUniqueId()), which is guaranteed unique per entity.

• Campfire heal task used 3×3 chunk scan instead of 5×5 (BF-22) — isInsideSafeZone() and onSpawn() were already corrected to 5×5 in a prior release, but the heal loop inside startTask() still searched only 3×3 chunks (~32 block reach). Tier-3 campfires have a 40-block radius, so players near the edge of the safe zone were not receiving the Regeneration effect. The heal loop now uses 5×5, consistent with all other campfire range checks.

Notes

• No config file changes are required. All existing data.yml, campfires.yml, and turrets_data.yml files are fully compatible with 4.5.1.
• Any turrets placed before this update that were saved in turrets_data.yml will load and function normally. Turrets placed during a session that ended with a 4.5.0 server stop without an intermediate save may have been lost — this is the bug being fixed.

[4.4.0] - 2026-04-17 - Bug Purge & Correctness Update

Fixed

• SurvivalGuideListener.PAGE_KEY NPE on startup — static final NamespacedKey PAGE_KEY was initialised at class-load time before the plugin instance existed, causing a NullPointerException on every server start. PAGE_KEY is now an instance field initialised in the constructor. (BF-01)

• InfectionListener ignored infection.enabled config — infection spread on every zombie hit regardless of infection.enabled: false in config.yml. ZombieBehaviorService already checked the flag but InfectionListener did not, making the config option partially ineffective. (BF-02a)

• InfectionListener ignored zapoc.immune permission — players with zapoc.immune could still receive infection points. The permission is now checked in both InfectionListener and ZombieBehaviorService. (BF-02b)

• Day-based spawn-rate (shouldSpawn()) was completely bypassed — ZombieBehaviorService runs at EventPriority.HIGH and cancelled natural spawns before SpawnListener ran, so the phase-based rates (40% / 70% / 90% / 100%) never took effect — zombies always spawned at 100% regardless of server age. shouldSpawn() is now called directly inside ZombieBehaviorService.onCreatureSpawn. (BF-03)

• TurretManager could permanently delete turrets_data.yml — the save code called dataFile.delete() before renameTo(). If the rename failed the data file was gone permanently. Replaced with Files.move(ATOMIC_MOVE) and a non-atomic fallback. (BF-04)

• Sanity config multipliers loaded but never applied — sanityDrainBase, nightMultiplier, infectedMultiplier, lowHealthMultiplier, and nearbyZombiesMultiplier were read from mechanics.yml but updateSanity() used hardcoded constants. Editing these values in config had no visible effect. All five multipliers are now applied correctly. (BF-05)

• whisperPhrases config key loaded but never used — handleWhispers() used an internal hardcoded array instead of the phrases from mechanics.yml. Player-configured phrases including phrases-vi / phrases-en are now displayed correctly. (BF-06)

• hg.no-netherite-drop bypass via corpse zombie — the death handler stripped netherite from event.getDrops() but then re-equipped the corpse zombie with raw armour including netherite. A player could kill the corpse to recover the items. Netherite is now stripped from the corpse's equipment when the option is enabled. (BF-07)

• Tank zombie ENTITY_RAVAGER_STEP sound spam — handleTank() fired a full-volume step sound every 0.5 s with no throttle, flooding clients when multiple Tank zombies were active. A 10% per-call chance now limits the frequency. (BF-08)

• panicCooldowns HashMap memory leak — UUID entries were added on /zapoc panic but never removed on disconnect. Entries are now removed in onPlayerQuit. (BF-09)

• Stalker spawn used zombie's world for player's Y lookup — getHighestBlockYAt() was called on the zombie's world; if the target player had recently changed worlds the Y could be wrong. Player's own world is now used for the lookup. (BF-10)

Performance

• handleSunEffect() YAML reads inside per-zombie loop eliminated — seven FileConfiguration.get*() calls per zombie per tick removed. All sun-effect config values are now cached at task level and refreshed every 5 s. Eliminates ~1,400 redundant map lookups per second at 200 tracked zombies. (BF-11)

• Math.random() replaced with ThreadLocalRandom throughout — 20+ usages replaced across CampfireManager, ZombieApoc, ZombieBehaviorService, ZombieBehaviorTask, PlayerStatusTask, WorldEventTask, ZombieEvolutionService, and SpecialZombieListener. (BF-12)

Notes

• No config changes required. All existing data.yml, campfires.yml, and turrets_data.yml are fully compatible.

ZombieApocalypseSSS – Bug Fix Report (v4.3.2 → v4.3.3)

Custom Items Retained

• Bandage – stops bleeding
• Antivirus – cures infection
• Adrenaline – speed/strength boost (60s cooldown, crash effect after)
• ZombieCamo – zombies ignore you for 60s
• Radio – detect next supply drop location (5min cooldown)

Bug Fixes

New Utility Class

StructureHelper (structure/StructureHelper.java)

• isReplaceable(Material) — shared replaceable-block check
• isValidMobSpawn(World, Location) — 3-block column spawn validation
• setBlockSafe(World/Location, Material) — convenience block-place wrapper

[4.3.3] - 2026-04-13 - Bug Purge & Structure Overhaul

Fixed

• Zombie name encoding — SCREAMER, Stalker, Crawler, Feign Death, and Boss zombies displayed garbage text (§c§lSCREAMER) on all servers due to source-file encoding corruption. All names now render correctly.
• Recipes never registered — all 6 crafting recipes (Bandage, Antivirus, Adrenaline, Zombie Camo, Radio, Sentry Turret) were silently missing. registerRecipes() is now correctly called in onEnable.
• Bandage CustomModelData — BandageItem.create() read CMD from the wrong config file (config.yml instead of items.yml). Bandages now respect resource-pack model overrides.
• SurvivalGuide GUI crash — SurvivalGuideHolder.getInventory() returned null, violating the InventoryHolder contract. The holder now stores and returns a proper Inventory reference.
• Tower sniper spawn position — MilitaryCheckpoint snipers re-randomised their spawn offset on every call instead of using the cached tower position from cacheTowerPosition(). Snipers now always spawn on the tower platform they are supposed to guard.
• AdrenalineItem left-click trigger — added missing RIGHT_CLICK_AIR / RIGHT_CLICK_BLOCK guard; item could fire on left-click in edge cases.
• /zapoc give zombie-camo — tab-completion listed "camo" but execution expected "zombie-camo". Both are now consistent.
• setMaxHealth() deprecation — replaced all deprecated LivingEntity.setMaxHealth() calls in CrashedSupplyPlane and MilitaryCheckpoint with Attribute.GENERIC_MAX_HEALTH.setBaseValue().
• AbandonedHospital beds — WHITE_BED placement requires directional BlockData not set during procedural generation, causing silent failures. Replaced with WHITE_WOOL as a visual equivalent.
• RadioItem stale cooldown lore — cooldown label in item lore only updated when the radio was in the main hand or off hand. Now scans the full inventory so the label always reflects the real cooldown.

Changed

• Structure zombies now use plugin AI — AbandonedHospital, AbandonedOutpostPro, and SurvivorCamp spawned plain vanilla zombies that bypassed custom AI, tier evolution, sun effects, and the tracking map. They now call ZombieSpawnService.spawnCustomZombie(), so all structure zombies scale with server difficulty like any other custom zombie. Thematic equipment (hospital gown, outpost guard gear, survivor leather) is applied on top of the custom zombie.

Added

• StructureHelper utility class — isReplaceable(Material), isValidMobSpawn(World, Location), and setBlockSafe() were copy-pasted identically across 5 structure classes. This shared utility eliminates the duplication. All structure implementations now delegate to StructureHelper.

Notes

• No config file changes required for this update. Existing data.yml, campfires.yml, and turrets_data.yml are fully compatible.
• This release is recommended for all servers running 4.3.x.

ZombieApocalypseSSS – Bug Fix Report (v4.3 → v4.3.1)

Custom Items Retained

• Bandage – stops bleeding
• Antivirus – cures infection
• Adrenaline – speed/strength boost (now with 60s cooldown)
• ZombieCamo – zombies ignore you for 60s
• Radio – detect next supply drop location

Removed Items

Gun system (commented out), Ammo, Landmine, Grenade, Flashbang, MedKit — stubs removed from ZombieUtils.

Bug Fixes

[4.3] — 2026-04-05 🏗️ Structure System Refactor

Complete overhaul of all structure generation code for maintainability and safety.

🏗️ Structure System Overhaul

MilitaryCheckpoint.java

• Refactored rotation system: Unified transform() and applyRotation() methods
• Variant enum system: Converted from integers to proper Variant enum (ABANDONED, OVERRUN, ACTIVE)
• Constants extraction: Added 50+ named constants:
  • SPAWN_RADIUS, MAX_TERRAIN_HEIGHT_DIFF
  • ROAD_LENGTH, ROAD_HALF_WIDTH
  • BARRIER_LENGTH_BASE, TOWER_HEIGHT_BASE
  • SHULKER_CHANCE, CHEST_SEARCH_ATTEMPTS
  • HEAVY_SPAWN_CHANCE, BOSS_HEALTH_BASE, etc.
• Improved setBlockSafe(): Added comprehensive isReplaceable() helper
• Cached tower position: Pre-calculate for sniper spawning

CrashedSupplyPlane.java

• Fixed setBlockSafe(): Properly handles replaceable blocks
• Mob spawn safety: Added isValidMobSpawn()
• Location-based random: Unique randomness per structure
• Performance optimization: Reduced Location.clone() calls
• Improved canSpawn(): Height variation checks

AbandonedHospital.java

• Added constants: SPAWN_CHECK_RADIUS, MAX_HEIGHT_VARIATION, ZOMBIE_COUNT
• Safe block placement: setBlockSafe() with isReplaceable()
• Mob spawn safety: isValidMobSpawn()
• Safe chest placement: placeChestSafely()

SurvivorCamp.java

• Complete refactor: Extracted all magic numbers to constants
• Tent validation: buildTent() checks space before building
• Safe methods: setBlockSafe(), placeBlockSafely(), placeChestSafely()

AbandonedOutpostPro.java

• Added constants: FENCE_BROKEN_CHANCE, STRUCTURE_RADIUS
• Improved canSpawn(): Height check + replaceable block validation
• Mob spawn safety: spawnOutpostZombies() with validation

🧹 Code Cleanup

Removed Unused Files (11 files)

• EngineeringTableManager.java — No longer used
• items/impl/*.java (10 files) — Unused items:
  • ChainsawItem.java, FlashbangItem.java, GrenadeItem.java
  • KatanaItem.java, LandmineItem.java, MedKitItem.java
  • MeleeWeaponItem.java, MolotovItem.java, SimpleItem.java
  • ZGunWeapon.java

Updated Files

• StructureManager.java — Changed AbandonedOutpost → AbandonedOutpostPro

📊 Statistics

• Files refactored: 5 structure files
• Files deleted: 11 unused files
• Constants added: 75+
• Helper methods added: 15+

🔒 Safety Improvements

All structures now have:

• ✅ setBlockSafe() with isReplaceable()
• ✅ isValidMobSpawn() for safe spawning
• ✅ Height-aware canSpawn() validation
• ✅ Location-based random seed
• ✅ Constants replacing magic numbers

[4.2] — 2026-04-05 🧹 The Streamlining Update

Plugin refactored to focus on core survival mechanics. Guns and weapons moved to separate plugin.

🔥 Major Changes

🗑️ Removed Custom Items (except 5 core items)

All custom items have been removed except:

• Bandage — Paper ×2 + String
• Antivirus — Golden Apple + Potion + Fermented Spider Eye
• Adrenaline — Sugar + Glowstone Dust + Spider Eye
• Zombie Camo — 8× Rotten Flesh + Slime Ball
• Radio — 9× Compass

Removed: medkit, molotov, grenade, flashbang, landmine, goggles, all guns (pistol, smg, ak47, sniper, shotgun), all melee weapons (bat, katana, chainsaw, axes), and ammo.

🔨 Removed Engineering Table

The EngineeringTableManager has been completely removed. All remaining items now use vanilla crafting table recipes.

🔫 CombatGunSSS Integration

For guns, ammo, and advanced weaponry, install the companion plugin:

• CombatGunSSS — 30+ guns with ballistics engine
• Full API compatibility between plugins
• Seamless infection and zombie damage integration

[4.1] — 2026-03-14 🔧 The Bug Purge Update

23 bugs fixed across all severity levels. This release focuses entirely on correctness, stability, and developer experience — no new gameplay features, just a rock-solid foundation.

🔴 Critical Fixes

🏰 Turrets lost on every server restart (BUG-02)

loadTurrets() and saveTurrets() were both empty // TODO stubs. Every turret placed by players vanished after a restart.

Fix: Full persistence implemented via turrets_data.yml using atomic write (.tmp → rename) to prevent data corruption on crashes.

📦 Supply Drop loot table was never loaded (BUG-03)

spawnSupplyDrop() read supply-drop.loot from config.yml, but this section is defined in events.yml. The config section was always null, so every Supply Drop fell back to a hardcoded 5-item list, ignoring all admin configuration.

Fix: spawnSupplyDrop() and all related methods now read exclusively from eventsConfig (events.yml). Admin-configured loot tables are now respected.

🌕 blood-moon.chance config had no effect (BUG-04)

The bloodMoonChance field was loaded from config (default 5%) but never referenced in checkBloodMoon(). Blood Moon triggered at 100% probability every N days instead of the configured 5% chance.

Fix: Math.random() < bloodMoonChance check added in checkBloodMoon(). Blood Moon now correctly triggers by chance each eligible night.

💥 NullPointerException when Molotov reached max range (BUG-05)

ProjectileHitEvent fires when a projectile expires at max range, at which point both getHitBlock() and getHitEntity() return null. The handler assumed at least one was non-null, causing a server-crashing NPE.

Fix: Three-way null check: hit block → hit entity → projectile location (fallback).

🟠 High Severity Fixes

🩸 Bleeding damage triggered every 40 seconds instead of 2 (BUG-06)

PlayerStatusTask runs every 20 ticks (1 second). The bleeding check used tickCount % 40 == 0, which fires every 40 runs = every 40 seconds. Players with bleeding could regenerate faster than they took damage.

Fix: Changed to tickCount % 2 == 0 → bleeds every 2 seconds as intended.

⚠️ No combined cap on zombie difficulty multipliers (BUG-07)

Three independent scaling systems stacked without a total ceiling:

• Global difficulty multiplier (capped at ×3.0 ✓)
• Evolution tier multiplier (Aberrant ×2.5 ✓)
• Per-player daysSurvived scaling (no cap ✗)

On a 100-day server, the combined multiplier could reach ×26×, making zombies practically unkillable.

Fix: daysSurvived scaling is now capped — health ≤ ×3.0, speed ≤ ×2.0, spawn count ≤ 5 per spawn event.

🔫 Gun reload lock persisted through player relog (BUG-08)

RELOAD_COOLDOWN_KEY and FIRE_COOLDOWN_KEY were stored in player.getPersistentDataContainer() as Unix timestamps. If a player disconnected mid-reload and reconnected, the stale future timestamp would lock them out of firing/reloading until the original timer expired.

Fix: Both cooldowns moved to ConcurrentHashMap<UUID, Long> in-memory maps. Cleared automatically when the player disconnects.

👻 Hallucination Villager stood completely still (BUG-09)

updateHallucinations() called mob.setTarget(player) to make hallucinations chase their target. While Zombie entities respond to setTarget() by pathfinding toward the player, Villager ignores it (Villagers don't attack).

Fix: Villager hallucinations now use getPathfinder().moveTo(player, 1.15) with periodic re-pathfind if the current path becomes null.

👁️ Players who joined late could see hallucination entities (BUG-10)

spawnHallucination() called hideEntity() only for players online at spawn time. Any player joining after a hallucination spawned would see a phantom zombie/villager wandering around with no explanation.

Fix: The existing onPlayerJoin() handler correctly hides all active hallucinations for new joiners. Spawn-time hiding loop now also reliably covers all current online players.

🟡 Medium Severity Fixes

🪓 Weapon upgrade chain used hardcoded CustomModelData values (BUG-11)

FeaturesListener hardcoded CMDs like 3004, 3011, 3005 directly in Java. Changing any custom-model-data in items.yml would silently break upgrade chains with no error or warning.

Fix: CMDs are now read from items.yml and mechanics.yml at runtime. Upgrade chains survive config customization.

🔥 Campfire data corrupted if world name contained _ (BUG-12)

Save keys used worldName_x_y_z format. Loading split on _ and took parts[0] as the world name. A world named my_world would produce 5 parts instead of 4, causing parts[0] = "my" → Bukkit.getWorld("my") = null → all campfires lost.

Fix: Keys now use worldUUID_x_y_z (UUID with hyphens stripped = always 32 hex chars, no ambiguous underscores). Legacy world-name keys are still parsed as a migration fallback.

🌙 blood-moon.enabled / supply-drop.enabled read from wrong config (BUG-14)

Both keys are defined in events.yml, but WorldEventTask.run() read them from config.yml. Since config.yml doesn't contain these keys, the fallback true was always used — neither event could be disabled.

Fix: All WorldEventTask config reads now use eventsConfig consistently.

☠️ Corpse reanimation could not be disabled (BUG-15)

When a player died, items were cleared and a zombie "corpse" was spawned wearing their gear. There was no config toggle — servers running minigames or PvP arenas had no way to opt out of this mechanic.

Fix: Gated behind corpse-reanimation.enabled in mechanics.yml (default: true).

💬 Misleading comment in ZombieBehaviorTask (BUG-16)

Comment said // Every 20 ticks = 1s next to tickCounter % 2 == 0. The actual math (task runs every 10 ticks; %2 = every 2 runs = every 20 ticks = 1s) was correct but the comment was confusing enough to invite accidental breakage.

Fix: Comment updated to explain the full calculation chain.

🎆 Default Screamer particle "PORTAL" is invalid in Paper 1.21 (BUG-17)

Particle.valueOf("PORTAL") throws IllegalArgumentException in Paper 1.21+. The exception was caught and logged, but the screamer ability silently failed every time on unmodified configs.

Fix: Default changed to "ENTITY_EFFECT" in both code and zombies.yml.

🟢 Code Quality

⚙️ Config Changes

mechanics.yml — new keys:

corpse-reanimation:
  enabled: true          # Set false to disable zombie corpse on player death

infection:
  natural-decay:
    enabled: true
    chance-per-second: 0.033   # ~1 point per 30s; 3× faster in Campfire safe zones

events.yml — new key:

blood-moon:
  cycle-days: 7          # (moved from config.yml) eligible cycle in days

zombies.yml — changed default:

screamer:
  particle: ENTITY_EFFECT   # was: PORTAL (invalid in Paper 1.21)

🧩 API Changes

// ✅ Fixed
api.isInfected(player)          // now correctly returns true when infected

// ✅ New
api.getInfectionLevel(player)   // int 0–5
api.getInfectionPoints(player)  // int 0–100
api.setInfectionPoints(player, n)
api.getThreatLevel()            // double
api.getZombieTier(zombie)       // ZombieTier enum
api.isInSafeZone(location)      // boolean
api.spawnZombie(world, loc, type)

// ⚠️ Deprecated
api.infectPlayer(player, ticks) // use setInfectionPoints() instead