I tried having a look at the code, but I couldn't make much sense out of it. Apparently, some checking if a zone is unlocked is done in KoLAdventure.validate(), but the Chasm is unlocked (if Mafia can retrieve a Bridge) in AdventureRequest.run() (is there is a server hit to mountains.php each time you adventure in the chasm?)
The particularity of Fern's tower is that it appears in the plains once you get the key, but the key disappears from your inventory once you unlocked it.
I guess Mafia could visit fernruin.php before adventuring there if you have Fernswarthy's key in your inventory, and simply check plains.php to see if fernruin.php is there when you don't have the key.
If I understand the code correctly, and if there is indeed a server hit to mountains.php when you adventure in the Chasm, maybe a lastChasmUnlock and a lastFernsRuinUnlock property should be added to avoid this?
I'll wait for someone who really understands the code to weigh in though, I'm mostly guessing here.