Quick answer: Clamp current HP to the range zero-to-max after every heal and every max-HP change so HP can never exceed the cap.

If resting between rooms leaves the player above their max HP, your heal code is not clamping. Applying a min/max clamp after each heal keeps HP within bounds and keeps percentage math sane.

How to fix it

1. Clamp after every heal

Wrap HP changes so that after adding healing you set hp = min(hp, maxHp). Apply the same clamp anywhere HP is modified, not just at rest sites.

2. Reclamp when max HP changes

If an item lowers max HP, immediately clamp current HP down to the new max so a reduced cap cannot leave HP stranded above it.

3. Centralize HP mutation

Route all HP changes through one function that applies the clamp, so no future heal source can bypass the bound.

Catching the ones you can't reproduce

The hardest version of this to fix is the one you can't reproduce — it only happens on a player's hardware, OS, driver, or save state, under conditions that simply aren't present on your machine. A report that says “it crashed” or “it froze” gives you nothing to act on, so the bug survives release after release while quietly costing you players.

Automatic error capture closes that gap. Each failure arrives with its full stack trace, the device and OS, the build number, and a breadcrumb trail of what the player did right before it broke, so even a failure you have never seen becomes a specific, reproducible issue. Fold identical failures into one signature ranked by how many players each hits, and your worklist sorts itself worst-first instead of arriving as a stream of vague complaints.

This is where a tool like Bugnet earns its place. Its SDK captures every GameMaker error automatically with the full stack trace plus device, OS, memory, build, and game-state context, folds duplicates into one grouped issue with an occurrence count, and ties each to the build it first appeared on — so you fix the problem that hurts the most players first and confirm it is gone when its signature disappears from the next release.

Ship the fix, watch the signature disappear from the next build. That's how you know it's really gone.