Found in the cross-plugin Bedrock/Floodgate audit. Cosmetic, fails safe.
SquirrelIdUsernameResolver (wired as the only name source in Realty.RealtyBackendImpl) chains PaperPlayerService → HttpRepositoryService.forMinecraft() (Mojang). getUsername(floodgateUuid) for an offline Bedrock owner misses the local cache and hits Mojang, which has no record of a Floodgate UUID → throws; the catch degrades to uuid.toString(). So every Bedrock owner displays as a raw UUID in property/agent/history listings (UUID→name direction, never the dangerous name→UUID — no wrong-account hazard).
Fix: prefer a local name source for offline players (the shared firm_players cache, or Bukkit.getOfflinePlayerIfCached(uuid).getName(), or Floodgate's API if present) before/instead of the Mojang HTTP resolver. Low priority — display-only.
Realty's name→UUID command paths (NamedAuthorityParser/AuthorityParser) are already safe: cache-only getOfflinePlayerIfCached + hasPlayedBefore(), no Mojang, no fabricated UUID.