Since ZK 5 the zkau parameter names convention has changed from '.' to '_'
https://github.com/zkoss/zk/commit/c225c6b40e8ce3ca00433cee87d7183c1fae5aab

It looks like one occasion was forgotten and leads to a null value since then:
https://github.com/zkoss/zk/blob/v8.6.0.1/zk/src/org/zkoss/zk/au/http/DHtmlUpdateServlet.java#L746

As a consequence in the only place where the getFirstCommand method is called will always lead to calling recover()
https://github.com/zkoss/zk/blob/v8.6.0.1/zk/src/org/zkoss/zk/au/http/DHtmlUpdateServlet.java#L548-L550

Either this code is obsolete or should be fixed to use the correct parameter name convention.