Fix bullet/ship desync; rework death, escape, arrival and hub awareness

(1) Bullets appeared to trail the ship. Two independent causes, measured with
the new tools/diag_prediction.gd rather than guessed at:
  - ServerRuntime ticked before ClientRuntime, so input sampled on frame N was
    not consumed until frame N+1, leaving the drawn ship a constant one tick
    (4.00px at 240 u/s) ahead of the authoritative one that bullets spawn from.
    ClientRuntime now sets process_physics_priority = -10. Gap on a listen
    server: 4.00px -> 0.10px mean, 0.30px worst.
  - PLAYER_MUZZLE_OFFSET was PLAYER_RADIUS + 6 = 12px against a 13px drawn
    ship, so bullets were born inside the sprite. Regression from the previous
    commit's hitbox shrink; it now derives from PLAYER_VISUAL_RADIUS.

(2) No more timed respawn. A downed player stays down until they ask for the
hub (E), which is an ordinary input -- the server has no "revive me" message.

(3) Escape channel 3s -> 1s, and damage no longer cancels it. An interruptible
channel makes killing the process strictly better than using the button, so a
dropped connection now runs the same channel: the player stays in the world as
linkdead, still killable, and is only released once it completes. Instances
refuse to close while a linkdead body is resolving, or a solo drop would delete
it on the next tick and hand the exploit straight back.

(4) Escape opens an in-game menu: return to hub (routed through the same held-
escape channel, not a new message), disconnect, quit.

(5) Server pushes a roster so the hub shows who is online and which dungeon
they are in. Entering a dungeon grants 2s arrival protection -- invulnerable
AND weapons-cold, since invulnerability alone would make the spawn a free
firing position -- flagged in the snapshot and drawn on every protected ship.

(6) Cleared dungeons hold the party 30s (was 5s) with a visible countdown.

(7) The hub's grey circle was a 100k-HP target dummy that read as scenery. Now
drawn as a bullseye so its purpose is legible.

Protocol version 1 -> 2. 91 tests (was 78); smoke.sh gains a bot that is
SIGKILLed mid-dungeon to prove the disconnect path end to end. check.sh,
test.sh and smoke.sh all pass.

src/autoload/net.gd

@@ -182,6 +182,13 @@ func send_events(peer_id: int, data: PackedByteArray) -> void:
 		s_events.rpc_id(peer_id, data)
 
 
+func send_roster(peer_id: int, data: PackedByteArray) -> void:
+	if _is_local(peer_id):
+		client.on_roster(data)
+	else:
+		s_roster.rpc_id(peer_id, data)
+
+
 func send_reject(peer_id: int, reason: String) -> void:
 	if _is_local(peer_id):
 		GameLog.error("net", "local client rejected: %s" % reason)
@@ -237,6 +244,12 @@ func s_reject(reason: String) -> void:
 	_set_state(State.FAILED)
 
 
+@rpc("authority", "call_remote", "reliable", 1)
+func s_roster(data: PackedByteArray) -> void:
+	if client != null:
+		client.on_roster(data)
+
+
 @rpc("authority", "call_remote", "unreliable", 2)
 func s_snapshot(data: PackedByteArray) -> void:
 	if client != null:

src/core/sim_config.gd

@@ -29,6 +29,13 @@ const PLAYER_SPEED := 240.0
 const PLAYER_RADIUS := 6.0
 ## Render-only. Used by src/view/, never by anything under src/sim/.
 const PLAYER_VISUAL_RADIUS := 13.0
+## Where a player's bullets are born, measured from the ship's centre. Derived
+## from the VISUAL radius rather than the hitbox on purpose: this is the one
+## sim number whose whole job is to line up with what the player sees. Keep it
+## clear of PLAYER_VISUAL_RADIUS by a few px, or bullets appear to spawn inside
+## the ship -- and on a remote client, the ship is also drawn a tick or two
+## ahead of the server, so this margin is what absorbs that too.
+const PLAYER_MUZZLE_OFFSET := PLAYER_VISUAL_RADIUS + 6.0
 const PLAYER_MAX_HP := 100
 const PLAYER_FIRE_COOLDOWN := 7          # ticks
 const PLAYER_BULLET_SPEED := 620.0
@@ -36,7 +43,10 @@ const PLAYER_BULLET_RADIUS := 4.0
 const PLAYER_BULLET_LIFETIME := 90       # ticks
 const PLAYER_BULLET_DAMAGE := 6
 const PLAYER_IFRAMES := 36               # ticks of invulnerability after a hit
-const PLAYER_RESPAWN_DELAY := 180        # ticks
+## Invulnerable *and* unable to shoot on entering a dungeon, so arriving into a
+## live bullet field is survivable. Both halves matter: invulnerability alone
+## would make the spawn point a free firing position.
+const SPAWN_GRACE_TICKS := 120           # 2 seconds
 
 # --- Anti-cheat guards ------------------------------------------------------
 ## Inputs older than this (relative to the newest accepted) are discarded.
@@ -47,9 +57,13 @@ const INPUT_MAX_LEAD := 12
 const INPUT_MAX_PER_TICK := 4
 
 # --- Emergency escape -------------------------------------------------------
-const ESCAPE_CHANNEL_TICKS := 180        # 3 seconds
-## Taking damage while channelling cancels the escape.
-const ESCAPE_BREAK_ON_DAMAGE := true
+const ESCAPE_CHANNEL_TICKS := 60         # 1 second
+## Taking damage does NOT interrupt the channel. It used to, which sounds like
+## the right kind of risk until you notice the interaction with disconnects: if
+## a player under fire cannot escape, quitting the process is strictly better
+## than using the button, and the escape hatch becomes the cheese. A dropped
+## connection now runs the same one-second channel (see SimPlayer.linkdead),
+## which only works if being shot cannot cancel it.
 
 # --- Bullets ----------------------------------------------------------------
 const MAX_BULLETS := 4096
@@ -67,6 +81,10 @@ const LOBBY_INSTANCE_ID := 1
 const DUNGEON_PARTY_MAX := 4
 ## How long a forming dungeon waits for more players before it locks.
 const DUNGEON_FORMING_TICKS := 300
+## Victory lap: how long a cleared dungeon holds the party before returning
+## them to the hub and closing. Once closed (or once it empties), the next
+## player through the portal opens a fresh instance.
+const DUNGEON_CLEARED_EXIT_TICKS := 1800  # 30 seconds
 
 # --- Portal -----------------------------------------------------------------
 const PORTAL_POS := Vector2(0.0, -220.0)

src/game.tscn

@@ -1,9 +1,10 @@
-[gd_scene load_steps=5 format=3]
+[gd_scene load_steps=6 format=3]
 
 [ext_resource type="Script" path="res://src/view/game_scene.gd" id="1"]
 [ext_resource type="Script" path="res://src/view/world_view.gd" id="2"]
 [ext_resource type="Script" path="res://src/view/bullet_renderer.gd" id="3"]
 [ext_resource type="Script" path="res://src/ui/hud.gd" id="4"]
+[ext_resource type="Script" path="res://src/ui/game_menu.gd" id="5"]
 
 [node name="Game" type="Node2D"]
 script = ExtResource("1")
@@ -17,3 +18,6 @@ script = ExtResource("3")
 
 [node name="HUD" type="CanvasLayer" parent="."]
 script = ExtResource("4")
+
+[node name="GameMenu" type="CanvasLayer" parent="."]
+script = ExtResource("5")

src/instances/instance.gd

@@ -49,6 +49,9 @@ static func make_dungeon(instance_id: int, dungeon_seed: int) -> Instance:
 	inst.seed_value = dungeon_seed
 	inst.world = SimWorld.new(dungeon_seed)
 	inst.world.spawn_point = Vector2(0.0, 260.0)
+	# Arriving into a fight already in progress needs a moment of protection;
+	# arriving in the hub does not.
+	inst.world.spawn_grace_ticks = SimConfig.SPAWN_GRACE_TICKS
 	inst.boss_id = Content.BOSS_WARDEN
 	inst.state = State.FORMING
 	if GameOpts.boss_rush:
@@ -68,10 +71,40 @@ func remove_peer(peer_id: int) -> void:
 	world.remove_player(peer_id)
 
 
+## Drop a peer from the send list but leave its player in the world. Used when a
+## connection dies: the body stays behind, still killable, channelling its way
+## out (see SimPlayer.linkdead), while we stop trying to send to a dead socket.
+func detach_peer(peer_id: int) -> void:
+	peers.erase(peer_id)
+	var p: SimPlayer = world.players.get(peer_id)
+	if p != null:
+		p.linkdead = true
+
+
+## Peers we still talk to. Linkdead bodies are not counted -- an instance whose
+## only occupant has dropped should wind down, not wait on a ghost.
 func is_empty() -> bool:
 	return peers.is_empty()
 
 
+## True while a dropped player is still resolving its escape channel. Keeps the
+## instance alive just long enough for that to finish.
+func has_linkdead() -> bool:
+	for p in world.players.values():
+		if p.linkdead:
+			return true
+	return false
+
+
+## Whole seconds until a cleared dungeon returns its party, or
+## Protocol.COUNTDOWN_NONE when that does not apply.
+func exit_countdown_seconds() -> int:
+	if state != State.CLEARED:
+		return Protocol.COUNTDOWN_NONE
+	return mini(int(ceil(float(stage_delay) / float(SimConfig.TICK_RATE))),
+		Protocol.COUNTDOWN_NONE - 1)
+
+
 func accepts_new_party_member() -> bool:
 	return kind == Protocol.InstanceKind.DUNGEON \
 		and state == State.FORMING \
@@ -110,7 +143,9 @@ func _step_dungeon() -> void:
 		if world.boss != null and world.boss.alive:
 			return
 		state = State.CLEARED
-		stage_delay = 300
+		stage_delay = SimConfig.DUNGEON_CLEARED_EXIT_TICKS
+		GameLog.info("instance", "instance %d CLEARED, returning party in %ds" % [
+			id, SimConfig.DUNGEON_CLEARED_EXIT_TICKS / SimConfig.TICK_RATE])
 		return
 
 	stage += 1

src/net/client_runtime.gd

@@ -33,6 +33,20 @@ var my_hp: int = SimConfig.PLAYER_MAX_HP
 var my_alive: bool = true
 var my_escape: float = 0.0
 var my_escaping: bool = false
+## Arrival protection: invulnerable and unable to shoot.
+var my_spawn_grace: bool = false
+
+## Set by the in-game menu's "return to hub" -- synthesises a held escape
+## button, so the menu route runs the identical server-side channel as the key.
+## Cleared when the channel resolves or the player cancels.
+var request_escape: bool = false
+
+## Who is online and where, for the hub's player list. Server-pushed.
+var roster: Array[Dictionary] = []
+
+## Whole seconds until a cleared dungeon returns the party, or
+## Protocol.COUNTDOWN_NONE outside that state.
+var cleared_countdown: int = Protocol.COUNTDOWN_NONE
 
 var snap_prev: Dictionary = {}
 var snap_curr: Dictionary = {}
@@ -42,6 +56,14 @@ var _bot_tick: int = 0
 
 func _ready() -> void:
 	world.authoritative = false
+	# Sample and send input BEFORE ServerRuntime ticks. On a listen server both
+	# live in one process, and default tree order put the server first -- so the
+	# input sampled on frame N was not consumed until the server's frame N+1,
+	# leaving the drawn ship a permanent one-tick (4px at 240 u/s) ahead of the
+	# authoritative one. Bullets, spawned at the authoritative position, visibly
+	# trailed the ship. Going first closes the gap to zero on a listen server
+	# and costs a remote client nothing.
+	process_physics_priority = -10
 	set_physics_process(true)
 
 
@@ -84,7 +106,7 @@ func _sample_input() -> InputFrame:
 	var buttons := 0
 	if Input.is_action_pressed("fire"):
 		buttons |= InputFrame.BTN_FIRE
-	if Input.is_action_pressed("emergency_escape"):
+	if Input.is_action_pressed("emergency_escape") or request_escape:
 		buttons |= InputFrame.BTN_ESCAPE
 	if Input.is_action_pressed("interact"):
 		buttons |= InputFrame.BTN_INTERACT
@@ -99,6 +121,10 @@ func _bot_input() -> InputFrame:
 	var move := Vector2(cos(t * 0.9), sin(t * 1.3))
 	aim = t * 2.1
 	var buttons := InputFrame.BTN_FIRE
+	if not my_alive:
+		# Downed bots ask for the hub, same as a player would -- otherwise a bot
+		# that dies mid-run just lies there and the smoke test stalls.
+		return InputFrame.make(input_tick, Vector2.ZERO, aim, InputFrame.BTN_INTERACT)
 	if instance_kind == Protocol.InstanceKind.LOBBY and _bot_tick % 120 < 30:
 		buttons |= InputFrame.BTN_INTERACT
 		# Walk onto the portal instead of orbiting, or interact never lands.
@@ -116,6 +142,11 @@ func on_welcome(peer_id: int) -> void:
 	GameLog.info("client", "welcome, peer id %d" % peer_id)
 
 
+func on_roster(data: PackedByteArray) -> void:
+	roster = NetCodec.decode_roster(data)
+	hud_dirty.emit()
+
+
 func on_enter_instance(id: int, kind: int, server_tick: int, boss_id: String,
 		spawn: Vector2) -> void:
 	instance_id = id
@@ -132,6 +163,12 @@ func on_enter_instance(id: int, kind: int, server_tick: int, boss_id: String,
 	my_hp = SimConfig.PLAYER_MAX_HP
 	my_escape = 0.0
 	my_escaping = false
+	my_spawn_grace = false
+	# Arriving somewhere is the natural end of an escape request, however it
+	# was triggered -- otherwise the synthesised button would keep firing and
+	# bounce the player straight back out of the hub.
+	request_escape = false
+	cleared_countdown = Protocol.COUNTDOWN_NONE
 	GameLog.info("client", "entered instance %d (%s)" % [id, Protocol.InstanceKind.keys()[kind]])
 	instance_changed.emit()
 	hud_dirty.emit()
@@ -141,6 +178,7 @@ func on_snapshot(data: PackedByteArray) -> void:
 	var snap := NetCodec.decode_snapshot(data)
 	if not snap_curr.is_empty() and int(snap["tick"]) <= int(snap_curr["tick"]):
 		return  # stale or duplicate; unreliable channel, newest wins
+	cleared_countdown = int(snap["cleared_countdown"])
 	snap_prev = snap_curr
 	snap_curr = snap
 	_interp = 0.0
@@ -166,6 +204,7 @@ func _reconcile(rec: Dictionary) -> void:
 	my_hp = int(rec["hp"])
 	my_alive = (int(rec["flags"]) & Protocol.F_ALIVE) != 0
 	my_escaping = (int(rec["flags"]) & Protocol.F_ESCAPING) != 0
+	my_spawn_grace = (int(rec["flags"]) & Protocol.F_SPAWN_GRACE) != 0
 	my_escape = float(rec["escape"])
 	hud_dirty.emit()
 

src/net/net_codec.gd

@@ -8,10 +8,14 @@ extends RefCounted
 
 # --- Snapshot ---------------------------------------------------------------
 
-static func encode_snapshot(world: SimWorld) -> PackedByteArray:
+## [param cleared_countdown] is whole seconds until a cleared dungeon returns
+## its party, or Protocol.COUNTDOWN_NONE when that does not apply.
+static func encode_snapshot(world: SimWorld,
+		cleared_countdown: int = Protocol.COUNTDOWN_NONE) -> PackedByteArray:
 	var b := StreamPeerBuffer.new()
 	b.big_endian = false
 	b.put_u32(world.tick)
+	b.put_u8(clampi(cleared_countdown, 0, Protocol.COUNTDOWN_NONE))
 
 	b.put_u8(mini(world.players.size(), 255))
 	for p in world.players.values():
@@ -27,6 +31,10 @@ static func encode_snapshot(world: SimWorld) -> PackedByteArray:
 			flags |= Protocol.F_INVULN
 		if p.escape_ticks > 0:
 			flags |= Protocol.F_ESCAPING
+		if p.spawn_grace > 0:
+			flags |= Protocol.F_SPAWN_GRACE
+		if p.linkdead:
+			flags |= Protocol.F_LINKDEAD
 		b.put_u8(flags)
 		b.put_u8(clampi(roundi(p.escape_progress() * 255.0), 0, 255))
 		# Echoed so the owning client knows how far to rewind when reconciling.
@@ -62,7 +70,11 @@ static func decode_snapshot(data: PackedByteArray) -> Dictionary:
 	var b := StreamPeerBuffer.new()
 	b.big_endian = false
 	b.data_array = data
-	var snap := {"tick": b.get_u32(), "players": [], "enemies": [], "boss": null}
+	var snap := {
+		"tick": b.get_u32(),
+		"cleared_countdown": b.get_u8(),
+		"players": [], "enemies": [], "boss": null,
+	}
 
 	var pcount := b.get_u8()
 	for _i in pcount:
@@ -99,7 +111,13 @@ static func decode_snapshot(data: PackedByteArray) -> Dictionary:
 # --- Events -----------------------------------------------------------------
 
 ## Events the client never sees; the instance layer consumes them server-side.
-const SERVER_ONLY := [SimEvent.Type.PORTAL_USED, SimEvent.Type.ESCAPE_COMPLETED]
+## These describe a decision the server is about to act on, not an outcome --
+## leaking them would tell a client about a message it might try to forge.
+const SERVER_ONLY := [
+	SimEvent.Type.PORTAL_USED,
+	SimEvent.Type.ESCAPE_COMPLETED,
+	SimEvent.Type.RESPAWN_REQUESTED,
+]
 
 
 ## [param server_tick] rides along so the client can fast-forward a bullet by
@@ -232,3 +250,41 @@ static func decode_inputs(data: PackedByteArray) -> Array[InputFrame]:
 	for _i in count:
 		out.append(InputFrame.read(b))
 	return out
+
+
+# --- Roster -----------------------------------------------------------------
+# Who is online and where. Low frequency (membership changes only), so it is
+# the one message that carries strings; everything hot stays fixed-width.
+
+static func encode_roster(entries: Array[Dictionary]) -> PackedByteArray:
+	var b := StreamPeerBuffer.new()
+	b.big_endian = false
+	b.put_u8(mini(entries.size(), 255))
+	for e in entries:
+		b.put_u32(int(e["peer"]))
+		b.put_utf8_string(String(e["name"]))
+		b.put_u8(int(e["kind"]))
+		b.put_u32(int(e["instance"]))
+		b.put_u8(1 if e["alive"] else 0)
+	return b.data_array
+
+
+static func decode_roster(data: PackedByteArray) -> Array[Dictionary]:
+	var out: Array[Dictionary] = []
+	if data.size() < 1:
+		return out
+	var b := StreamPeerBuffer.new()
+	b.big_endian = false
+	b.data_array = data
+	var count := b.get_u8()
+	for _i in count:
+		# get_utf8_string reads its own length prefix, so a truncated packet
+		# yields empty strings rather than reading off the end.
+		out.append({
+			"peer": b.get_u32(),
+			"name": b.get_utf8_string(),
+			"kind": b.get_u8(),
+			"instance": b.get_u32(),
+			"alive": b.get_u8() == 1,
+		})
+	return out

src/net/protocol.gd

@@ -3,7 +3,9 @@ extends RefCounted
 ## Wire constants. Bump [constant VERSION] whenever a codec layout changes; the
 ## server refuses mismatched clients at handshake rather than desyncing later.
 
-const VERSION := 1
+## 2: added spawn-grace flag + cleared countdown to the snapshot, and the
+## roster message.
+const VERSION := 2
 const DEFAULT_PORT := 27015
 const MAX_CLIENTS := 32
 
@@ -22,3 +24,12 @@ enum InstanceKind { LOBBY, DUNGEON }
 const F_ALIVE := 1
 const F_INVULN := 2
 const F_ESCAPING := 4
+## Arrival protection: invulnerable and unable to shoot. Distinct from F_INVULN
+## so the client can label the status rather than just tint the ship.
+const F_SPAWN_GRACE := 8
+## The peer behind this player has dropped and is being channelled out.
+const F_LINKDEAD := 16
+
+## Snapshot's cleared-countdown byte when the instance is not in the cleared
+## state -- 30s fits in a byte, so 255 is free to mean "not applicable".
+const COUNTDOWN_NONE := 255

src/net/server_runtime.gd

@@ -38,13 +38,18 @@ func _physics_process(_delta: float) -> void:
 		inst.step()
 		_dispatch_events(inst)
 		if send_snapshot and not inst.peers.is_empty():
-			var snap := NetCodec.encode_snapshot(inst.world)
+			var snap := NetCodec.encode_snapshot(inst.world, inst.exit_countdown_seconds())
 			for peer in inst.peers:
 				Net.send_snapshot(peer, snap)
-		if inst.kind == Protocol.InstanceKind.DUNGEON \
-				and inst.state == Instance.State.CLEARED and inst.stage_delay <= 0:
+		if inst.kind != Protocol.InstanceKind.DUNGEON:
+			continue
+		if inst.state == Instance.State.CLEARED and inst.stage_delay <= 0:
 			closing.append(inst.id)
-		elif inst.kind == Protocol.InstanceKind.DUNGEON and inst.is_empty() and inst.age > 60:
+		elif inst.is_empty() and not inst.has_linkdead() and inst.age > 60:
+			# has_linkdead() matters: without it a solo player could drop, the
+			# instance would close on the next tick, and their body would
+			# vanish before finishing the escape channel -- exactly the
+			# disconnect cheese the channel exists to prevent.
 			closing.append(inst.id)
 
 	for id in closing:
@@ -52,18 +57,25 @@ func _physics_process(_delta: float) -> void:
 
 
 ## Split the tick's events into the ones clients need and the ones only the
-## server acts on (escape completion, portal use).
+## server acts on (escape completion, portal use, respawn requests).
 func _dispatch_events(inst: Instance) -> void:
 	var events := inst.world.drain_events()
 	if events.is_empty():
 		return
-	var transfers: Array[Dictionary] = []
+	# Collected and applied after the send below, because a transfer mutates
+	# inst.peers and would otherwise change the list mid-broadcast.
+	var to_lobby: Array[int] = []
+	var to_dungeon: Array[int] = []
 	for ev in events:
 		match int(ev["t"]):
-			SimEvent.Type.ESCAPE_COMPLETED:
-				transfers.append({"peer": int(ev["peer"]), "to_lobby": true})
+			SimEvent.Type.ESCAPE_COMPLETED, SimEvent.Type.RESPAWN_REQUESTED:
+				var peer := int(ev["peer"])
+				if not to_lobby.has(peer):
+					to_lobby.append(peer)
 			SimEvent.Type.PORTAL_USED:
-				transfers.append({"peer": int(ev["peer"]), "to_lobby": false})
+				var peer := int(ev["peer"])
+				if not to_dungeon.has(peer):
+					to_dungeon.append(peer)
 			_:
 				pass
 
@@ -71,11 +83,10 @@ func _dispatch_events(inst: Instance) -> void:
 	for peer in inst.peers:
 		Net.send_events(peer, payload)
 
-	for t in transfers:
-		if t["to_lobby"]:
-			_send_to_lobby(int(t["peer"]))
-		else:
-			_send_to_dungeon(int(t["peer"]))
+	for peer in to_lobby:
+		_send_to_lobby(peer)
+	for peer in to_dungeon:
+		_send_to_dungeon(peer)
 
 
 # --- Peer lifecycle ---------------------------------------------------------
@@ -84,13 +95,42 @@ func on_peer_connected(peer_id: int) -> void:
 	GameLog.info("server", "peer %d connected, awaiting hello" % peer_id)
 
 
+## A drop inside a dungeon does NOT delete the player. The body is detached
+## from the send list but kept in the world, where it channels the same
+## one-second escape everyone else does and stays killable the whole time --
+## so quitting the process is never a cheaper exit than pressing the button.
+## Only once that channel resolves (_release_linkdead) is the peer forgotten.
+## A drop in the hub has nothing to dodge, so it is immediate.
 func on_peer_disconnected(peer_id: int) -> void:
 	var inst := instance_of(peer_id)
-	if inst != null:
-		inst.remove_peer(peer_id)
+	if inst == null:
+		_forget_peer(peer_id)
+		return
+	if inst.kind == Protocol.InstanceKind.DUNGEON:
+		inst.detach_peer(peer_id)
+		GameLog.info("server", "peer %d dropped in instance %d, channelling out"
+			% [peer_id, inst.id])
+		_broadcast_roster()
+		return
+	inst.remove_peer(peer_id)
+	_forget_peer(peer_id)
+	GameLog.info("server", "peer %d disconnected" % peer_id)
+
+
+func _forget_peer(peer_id: int) -> void:
 	peer_instance.erase(peer_id)
 	peer_names.erase(peer_id)
-	GameLog.info("server", "peer %d disconnected" % peer_id)
+	_broadcast_roster()
+
+
+## The linkdead body finished its channel (or died trying). Either way it leaves
+## the dungeon; with no persistence yet, "safely back in the hub" and "gone" are
+## the same outcome, so it is simply removed.
+func _release_linkdead(peer_id: int, inst: Instance) -> void:
+	inst.remove_peer(peer_id)
+	GameLog.info("server", "peer %d released from instance %d after drop"
+		% [peer_id, inst.id])
+	_forget_peer(peer_id)
 
 
 func on_hello(peer_id: int, version: int, display_name: String) -> void:
@@ -109,6 +149,7 @@ func on_hello(peer_id: int, version: int, display_name: String) -> void:
 	Net.send_welcome(peer_id)
 	_place(peer_id, lobby)
 	GameLog.info("server", "peer %d joined as '%s'" % [peer_id, clean])
+	_broadcast_roster()
 
 
 func on_input(peer_id: int, data: PackedByteArray) -> void:
@@ -135,7 +176,8 @@ func _place(peer_id: int, inst: Instance) -> void:
 	var backlog := _live_bullet_events(inst.world)
 	if not backlog.is_empty():
 		Net.send_events(peer_id, NetCodec.encode_events(inst.world.tick, backlog))
-	Net.send_snapshot(peer_id, NetCodec.encode_snapshot(inst.world))
+	Net.send_snapshot(peer_id, NetCodec.encode_snapshot(inst.world,
+		inst.exit_countdown_seconds()))
 
 
 func _transfer(peer_id: int, to: Instance) -> void:
@@ -143,9 +185,19 @@ func _transfer(peer_id: int, to: Instance) -> void:
 	if from != null:
 		from.remove_peer(peer_id)
 	_place(peer_id, to)
+	_broadcast_roster()
 
 
+## Where everything that ends a dungeon run converges: the escape channel, a
+## downed player asking out, and a linkdead body finishing its channel.
 func _send_to_lobby(peer_id: int) -> void:
+	var from := instance_of(peer_id)
+	if from != null:
+		var p: SimPlayer = from.world.players.get(peer_id)
+		if p != null and p.linkdead:
+			_release_linkdead(peer_id, from)
+			return
+
 	GameLog.info("server", "peer %d escaped to lobby" % peer_id)
 	_transfer(peer_id, lobby)
 
@@ -173,6 +225,33 @@ func _close_dungeon(id: int) -> void:
 	GameLog.info("server", "closed dungeon instance %d" % id)
 
 
+# --- Roster -----------------------------------------------------------------
+
+## Tell everyone who is online and where they are, so the hub can show that a
+## dungeon is already running before you walk into the portal.
+##
+## Sent on membership changes only, not per tick -- it is the one message that
+## carries names, and nothing about it is time critical.
+func _broadcast_roster() -> void:
+	var entries: Array[Dictionary] = []
+	for peer in peer_names:
+		var inst := instance_of(peer)
+		if inst == null:
+			continue
+		var p: SimPlayer = inst.world.players.get(peer)
+		entries.append({
+			"peer": peer,
+			"name": peer_names[peer],
+			"kind": int(inst.kind),
+			"instance": inst.id,
+			"alive": p != null and p.alive,
+		})
+	var payload := NetCodec.encode_roster(entries)
+	for inst in instances.values():
+		for peer in inst.peers:
+			Net.send_roster(peer, payload)
+
+
 func _live_bullet_events(world: SimWorld) -> Array[Dictionary]:
 	var out: Array[Dictionary] = []
 	for i in world.pool.high_water:

src/sim/sim_events.gd

@@ -11,6 +11,9 @@ enum Type {
 	PLAYER_HIT,        ## peer, damage, hp
 	PLAYER_DIED,       ## peer
 	PLAYER_RESPAWNED,  ## peer, pos
+	## A downed player asked to be returned to the hub. Server-only: the
+	## instance layer performs the transfer, the client just sees it arrive.
+	RESPAWN_REQUESTED, ## peer
 	ENEMY_HIT,         ## id, damage, hp
 	ENEMY_DIED,        ## id
 	BOSS_PHASE,        ## phase index

src/sim/sim_player.gd

@@ -11,7 +11,14 @@ var hp: int = SimConfig.PLAYER_MAX_HP
 var alive: bool = true
 var iframes: int = 0
 var fire_cooldown: int = 0
-var respawn_timer: int = 0
+## Ticks of arrival protection left: invulnerable, and unable to shoot.
+var spawn_grace: int = 0
+
+## The peer's connection dropped, but the player is deliberately still in the
+## world. Held here rather than deleted so a disconnect cannot be used to dodge
+## a dangerous moment: a linkdead player keeps channelling the escape (and stays
+## killable) for the same second everyone else would. See ServerRuntime.
+var linkdead: bool = false
 
 ## Ticks the emergency escape has been held. 0 means not channelling.
 var escape_ticks: int = 0
@@ -30,12 +37,25 @@ func escape_progress() -> float:
 	return clampf(float(escape_ticks) / float(SimConfig.ESCAPE_CHANNEL_TICKS), 0.0, 1.0)
 
 
-func reset_for_instance(spawn: Vector2) -> void:
+## Invulnerable while arriving, or in the usual post-hit window.
+func invulnerable() -> bool:
+	return spawn_grace > 0 or iframes > 0
+
+
+## Arrival protection also locks the gun, so the spawn point is not a free
+## firing position.
+func can_fire() -> bool:
+	return alive and spawn_grace <= 0 and fire_cooldown == 0
+
+
+## [param grace] is 0 for the hub (nothing there can shoot) and
+## SimConfig.SPAWN_GRACE_TICKS for a dungeon.
+func reset_for_instance(spawn: Vector2, grace: int = 0) -> void:
 	pos = spawn
 	hp = SimConfig.PLAYER_MAX_HP
 	alive = true
-	iframes = SimConfig.PLAYER_IFRAMES
+	iframes = 0
+	spawn_grace = grace
 	fire_cooldown = 0
-	respawn_timer = 0
 	escape_ticks = 0
 	input_queue.clear()

src/sim/sim_world.gd

@@ -28,6 +28,9 @@ var events: Array[Dictionary] = []
 ## Set on a lobby world so the interact button can open a dungeon.
 var portal_enabled: bool = false
 var spawn_point := Vector2(0.0, 240.0)
+## Arrival protection granted to players entering this world. 0 in the hub,
+## SimConfig.SPAWN_GRACE_TICKS in a dungeon.
+var spawn_grace_ticks: int = 0
 
 var _next_actor_id: int = 1
 var _ctx := EmitContext.new()
@@ -50,7 +53,7 @@ func add_player(peer_id: int, display_name: String) -> SimPlayer:
 	var p := SimPlayer.new()
 	p.peer_id = peer_id
 	p.display_name = display_name
-	p.reset_for_instance(spawn_point)
+	p.reset_for_instance(spawn_point, spawn_grace_ticks)
 	players[peer_id] = p
 	return p
 
@@ -148,24 +151,25 @@ func _step_players() -> void:
 	for p in players.values():
 		if p.iframes > 0:
 			p.iframes -= 1
+		if p.spawn_grace > 0:
+			p.spawn_grace -= 1
 		if p.fire_cooldown > 0:
 			p.fire_cooldown -= 1
 
+		var frame := _take_input(p)
+
 		if not p.alive:
-			p.respawn_timer -= 1
-			if p.respawn_timer <= 0:
-				p.alive = true
-				p.hp = SimConfig.PLAYER_MAX_HP
-				p.pos = spawn_point
-				p.iframes = SimConfig.PLAYER_IFRAMES
-				events.append({"t": SimEvent.Type.PLAYER_RESPAWNED, "peer": p.peer_id, "pos": p.pos})
+			# No timed respawn: a downed player waits for the hub. Asking to go
+			# is an input like any other, so a dead client cannot be revived by
+			# anything except its own request reaching the server.
+			if frame.pressed(InputFrame.BTN_INTERACT) or p.linkdead:
+				events.append({"t": SimEvent.Type.RESPAWN_REQUESTED, "peer": p.peer_id})
 			continue
 
-		var frame := _take_input(p)
 		p.aim = frame.aim
 		p.pos = Movement.step_player(p.pos, frame.move, SimConfig.PLAYER_SPEED, SimConfig.ARENA_HALF)
 
-		if frame.pressed(InputFrame.BTN_FIRE) and p.fire_cooldown == 0:
+		if frame.pressed(InputFrame.BTN_FIRE) and p.can_fire():
 			_fire_player_shot(p)
 
 		_step_escape(p, frame)
@@ -196,7 +200,7 @@ func _fire_player_shot(p: SimPlayer) -> void:
 	p.fire_cooldown = SimConfig.PLAYER_FIRE_COOLDOWN
 	var dir := Vector2.RIGHT.rotated(p.aim)
 	pool.spawn(
-		p.pos + dir * (SimConfig.PLAYER_RADIUS + 6.0),
+		p.pos + dir * SimConfig.PLAYER_MUZZLE_OFFSET,
 		dir * SimConfig.PLAYER_BULLET_SPEED,
 		SimConfig.PLAYER_BULLET_RADIUS,
 		SimConfig.PLAYER_BULLET_LIFETIME,
@@ -206,7 +210,10 @@ func _fire_player_shot(p: SimPlayer) -> void:
 
 
 func _step_escape(p: SimPlayer, frame: InputFrame) -> void:
-	if frame.pressed(InputFrame.BTN_ESCAPE):
+	# A dropped connection is treated as holding the button down. Pulling the
+	# plug then costs exactly what pressing escape costs -- one second of
+	# standing there, still killable -- instead of an instant, safe exit.
+	if p.linkdead or frame.pressed(InputFrame.BTN_ESCAPE):
 		if p.escape_ticks == 0:
 			events.append({"t": SimEvent.Type.ESCAPE_STARTED, "peer": p.peer_id})
 		p.escape_ticks += 1
@@ -317,7 +324,10 @@ func _resolve_bullet_hits() -> void:
 		var br: float = pool.radius[i]
 		if pool.team[i] == SimConfig.TEAM_ENEMY:
 			for p in players.values():
-				if not p.alive or p.iframes > 0:
+				# invulnerable() covers arrival grace as well as post-hit
+				# i-frames -- a player who just walked into a live bullet field
+				# must not be hit by what was already in the air.
+				if not p.alive or p.invulnerable():
 					continue
 				if Movement.circles_overlap(bp, br, p.pos, SimConfig.PLAYER_RADIUS):
 					_damage_player(p, pool.damage[i])
@@ -346,7 +356,7 @@ func _resolve_contact_damage() -> void:
 		if not e.alive or e.def.contact_damage <= 0:
 			continue
 		for p in players.values():
-			if not p.alive or p.iframes > 0:
+			if not p.alive or p.invulnerable():
 				continue
 			if Movement.circles_overlap(e.pos, e.def.radius, p.pos, SimConfig.PLAYER_RADIUS):
 				_damage_player(p, e.def.contact_damage)
@@ -358,16 +368,15 @@ func _kill_bullet(slot: int) -> void:
 	pool.despawn(slot)
 
 
+## Damage deliberately does NOT interrupt an escape channel -- see the note on
+## SimConfig.ESCAPE_CHANNEL_TICKS for why that would reward pulling the plug.
 func _damage_player(p: SimPlayer, amount: int) -> void:
 	p.hp = maxi(p.hp - amount, 0)
 	p.iframes = SimConfig.PLAYER_IFRAMES
-	if SimConfig.ESCAPE_BREAK_ON_DAMAGE and p.escape_ticks > 0:
-		p.escape_ticks = 0
-		events.append({"t": SimEvent.Type.ESCAPE_CANCELLED, "peer": p.peer_id})
 	events.append({"t": SimEvent.Type.PLAYER_HIT, "peer": p.peer_id, "dmg": amount, "hp": p.hp})
 	if p.hp <= 0:
 		p.alive = false
-		p.respawn_timer = SimConfig.PLAYER_RESPAWN_DELAY
+		p.escape_ticks = 0
 		events.append({"t": SimEvent.Type.PLAYER_DIED, "peer": p.peer_id})
 
 

src/ui/game_menu.gd

@@ -0,0 +1,103 @@
+extends CanvasLayer
+## In-game system menu, opened with Escape.
+##
+## Exists because without it there is no way out of a session short of killing
+## the process -- and "kill the process" is exactly the behaviour the escape
+## channel is designed to discourage, so leaving it as the only exit would work
+## against the rest of the design.
+
+signal resumed
+signal return_to_hub_requested
+signal disconnect_requested
+
+var _panel: VBoxContainer
+var _hub_button: Button
+var _open: bool = false
+
+
+func _ready() -> void:
+	layer = 20
+	var root := Control.new()
+	root.set_anchors_and_offsets_preset(Control.PRESET_FULL_RECT)
+	add_child(root)
+
+	# Dim the game behind the menu so it is obvious the world is still running.
+	var scrim := ColorRect.new()
+	scrim.color = Color(0.0, 0.0, 0.0, 0.55)
+	scrim.set_anchors_and_offsets_preset(Control.PRESET_FULL_RECT)
+	scrim.mouse_filter = Control.MOUSE_FILTER_STOP
+	root.add_child(scrim)
+
+	var center := CenterContainer.new()
+	center.set_anchors_and_offsets_preset(Control.PRESET_FULL_RECT)
+	root.add_child(center)
+
+	_panel = VBoxContainer.new()
+	_panel.custom_minimum_size = Vector2(320.0, 0.0)
+	_panel.add_theme_constant_override("separation", 10)
+	center.add_child(_panel)
+
+	var title := Label.new()
+	title.text = "PAUSED"
+	title.add_theme_font_size_override("font_size", 26)
+	_panel.add_child(title)
+
+	var note := Label.new()
+	note.text = "The world keeps running. You are not safe here."
+	note.add_theme_font_size_override("font_size", 12)
+	note.add_theme_color_override("font_color", Color(1.0, 0.7, 0.5))
+	_panel.add_child(note)
+
+	_hub_button = _button("Return to hub", func() -> void:
+		return_to_hub_requested.emit()
+		close())
+	_button("Resume", func() -> void: close())
+	_button("Disconnect to menu", func() -> void:
+		disconnect_requested.emit()
+		close())
+	_button("Quit game", func() -> void: get_tree().quit())
+
+	visible = false
+
+
+func _button(text: String, on_press: Callable) -> Button:
+	var b := Button.new()
+	b.text = text
+	b.pressed.connect(on_press)
+	_panel.add_child(b)
+	return b
+
+
+func _unhandled_input(event: InputEvent) -> void:
+	if event.is_action_pressed("system_menu"):
+		toggle()
+		get_viewport().set_input_as_handled()
+
+
+func toggle() -> void:
+	if _open:
+		close()
+	else:
+		open()
+
+
+func open() -> void:
+	_open = true
+	visible = true
+	# Nothing is paused -- the server does not stop for one client's menu, so
+	# neither does the view. Only the mouse is freed.
+	Input.mouse_mode = Input.MOUSE_MODE_VISIBLE
+
+
+func close() -> void:
+	_open = false
+	visible = false
+
+
+func is_open() -> bool:
+	return _open
+
+
+## The hub button is meaningless when you are already in the hub.
+func set_in_dungeon(in_dungeon: bool) -> void:
+	_hub_button.disabled = not in_dungeon

src/ui/game_menu.gd.uid

@@ -0,0 +1 @@
+uid://6j1nytv113kn

src/ui/hud.gd

@@ -68,9 +68,11 @@ func _status_text() -> String:
 func _hint_text() -> String:
 	if client == null:
 		return ""
+	if not client.my_alive:
+		return "DOWN   --   press E to return to the hub"
 	if client.instance_kind == Protocol.InstanceKind.LOBBY:
-		return "WASD move   mouse aim   LMB fire   E on the ring to enter a dungeon"
-	return "WASD move   mouse aim   LMB fire   hold F to escape to the lobby"
+		return "WASD move   mouse aim   LMB fire   E on the ring to enter a dungeon   Esc menu"
+	return "WASD move   mouse aim   LMB fire   hold F to return to the hub   Esc menu"
 
 
 func _draw_hud() -> void:
@@ -89,16 +91,64 @@ func _draw_hud() -> void:
 
 	_draw_boss_bar()
 
+	if client.my_spawn_grace:
+		_canvas.draw_string(ThemeDB.fallback_font,
+			origin + Vector2(BAR_W + 12.0, BAR_H),
+			"ARRIVING -- invulnerable, weapons cold",
+			HORIZONTAL_ALIGNMENT_LEFT, -1, 14, Color(0.6, 0.9, 1.0))
+
+	_draw_cleared_countdown()
+	_draw_roster()
+
 	if not client.my_alive:
-		var size := _canvas.size
-		_canvas.draw_string(ThemeDB.fallback_font, size * 0.5 - Vector2(70.0, 0.0),
-			"DOWN -- respawning", HORIZONTAL_ALIGNMENT_LEFT, -1, 22, Color(1.0, 0.4, 0.4))
+		# Centred on the canvas, which is only correct because _canvas actually
+		# has the viewport's size now -- see the anchor note in _ready().
+		var centre := _canvas.size * 0.5
+		_canvas.draw_string(ThemeDB.fallback_font, centre - Vector2(52.0, 8.0),
+			"DOWN", HORIZONTAL_ALIGNMENT_LEFT, -1, 34, Color(1.0, 0.4, 0.4))
+		_canvas.draw_string(ThemeDB.fallback_font, centre - Vector2(118.0, -18.0),
+			"press E to return to the hub", HORIZONTAL_ALIGNMENT_LEFT, -1, 16,
+			Color(1.0, 0.75, 0.75))
 
 	if _hit_flash > 0.0:
 		_canvas.draw_rect(Rect2(Vector2.ZERO, _canvas.size),
 			Color(1.0, 0.2, 0.25, 0.18 * _hit_flash))
 
 
+## Shown after the boss dies, so the victory lap has a visible clock on it.
+func _draw_cleared_countdown() -> void:
+	if client.cleared_countdown >= Protocol.COUNTDOWN_NONE:
+		return
+	var text := "DUNGEON CLEARED  --  returning to the hub in %ds" % client.cleared_countdown
+	_canvas.draw_string(ThemeDB.fallback_font,
+		Vector2(_canvas.size.x * 0.5 - 190.0, _canvas.size.y * 0.5 - 60.0),
+		text, HORIZONTAL_ALIGNMENT_LEFT, -1, 18, Color(0.6, 1.0, 0.75))
+
+
+## Who else is online, and whether they are already in a dungeon. Only useful in
+## the hub, which is the one place you are deciding whether to go in.
+func _draw_roster() -> void:
+	if client.instance_kind != Protocol.InstanceKind.LOBBY or client.roster.is_empty():
+		return
+	var x := _canvas.size.x - 240.0
+	var y := MARGIN + 4.0
+	_canvas.draw_string(ThemeDB.fallback_font, Vector2(x, y), "ONLINE",
+		HORIZONTAL_ALIGNMENT_LEFT, -1, 13, Color(0.65, 0.7, 0.8))
+	y += 20.0
+	for entry in client.roster:
+		var in_dungeon: bool = int(entry["kind"]) == Protocol.InstanceKind.DUNGEON
+		var where := "dungeon %d" % int(entry["instance"]) if in_dungeon else "hub"
+		var col := Color(1.0, 0.7, 0.45) if in_dungeon else Color(0.7, 0.8, 0.9)
+		if not entry["alive"]:
+			col = Color(0.85, 0.4, 0.4)
+			where += " (down)"
+		var me := "  <- you" if int(entry["peer"]) == client.my_peer else ""
+		_canvas.draw_string(ThemeDB.fallback_font, Vector2(x, y),
+			"%s  --  %s%s" % [entry["name"], where, me],
+			HORIZONTAL_ALIGNMENT_LEFT, -1, 13, col)
+		y += 18.0
+
+
 func _draw_boss_bar() -> void:
 	var b := client.boss_state()
 	if b.is_empty() or client.boss_def == null:

src/view/game_scene.gd

@@ -5,6 +5,7 @@ extends Node2D
 
 @onready var world_view: Node2D = $WorldView
 @onready var hud: CanvasLayer = $HUD
+@onready var menu: CanvasLayer = $GameMenu
 
 var _bound: ClientRuntime = null
 
@@ -12,6 +13,8 @@ var _bound: ClientRuntime = null
 func _ready() -> void:
 	world_view.position = get_viewport_rect().size * 0.5
 	get_viewport().size_changed.connect(_recentre)
+	menu.return_to_hub_requested.connect(_on_return_to_hub)
+	menu.disconnect_requested.connect(_on_disconnect)
 
 
 func _recentre() -> void:
@@ -23,6 +26,20 @@ func _process(_delta: float) -> void:
 		_bound = Net.client
 		if _bound != null and not _bound.local_hit.is_connected(_on_local_hit):
 			_bound.local_hit.connect(_on_local_hit)
+	menu.set_in_dungeon(_bound != null
+		and _bound.instance_kind == Protocol.InstanceKind.DUNGEON)
+
+
+## Routed through the same held-escape channel the F key uses, rather than a
+## direct "teleport me" message -- the server has no such message, and adding
+## one would hand clients an instant, uninterruptible exit.
+func _on_return_to_hub() -> void:
+	if _bound != null:
+		_bound.request_escape = true
+
+
+func _on_disconnect() -> void:
+	Net.shutdown()
 
 
 func _on_local_hit(_damage: int) -> void:

src/view/world_view.gd

@@ -11,6 +11,8 @@ const COL_LOCAL := Color(0.5, 1.0, 0.8)
 const COL_REMOTE := Color(0.55, 0.75, 1.0)
 const COL_DEAD := Color(0.4, 0.4, 0.45, 0.5)
 const COL_PORTAL := Color(0.5, 0.9, 1.0)
+## EnemyDef.visual index for the hub's practice target.
+const VISUAL_DUMMY := 3
 const ENEMY_COLORS := [
 	Color(0.95, 0.55, 0.55),  # drifter
 	Color(0.85, 0.7, 0.35),   # turret
@@ -71,10 +73,25 @@ func _draw_portal() -> void:
 func _draw_enemy(e: Dictionary) -> void:
 	var col: Color = ENEMY_COLORS[clampi(int(e["visual"]), 0, ENEMY_COLORS.size() - 1)]
 	var r: float = e["radius"]
+	if int(e["visual"]) == VISUAL_DUMMY:
+		_draw_target_dummy(e["pos"], r, col)
+		return
 	draw_circle(e["pos"], r, Color(col, 0.35))
 	draw_arc(e["pos"], r, 0.0, TAU, 24, col, 2.0)
 
 
+## The hub dummy is a shooting-range target, not an enemy. It used to be drawn
+## as a plain grey disc with 100k hit points, which read as scenery -- nothing
+## about it said "shoot me" and nothing visibly happened when you did. Concentric
+## rings make the intent obvious at a glance.
+func _draw_target_dummy(pos: Vector2, r: float, col: Color) -> void:
+	draw_circle(pos, r, Color(col, 0.18))
+	for i in 3:
+		var ring := r * (1.0 - 0.3 * float(i))
+		draw_arc(pos, ring, 0.0, TAU, 24, Color(col, 0.5 + 0.15 * float(i)), 1.5)
+	draw_circle(pos, r * 0.12, Color(1.0, 0.5, 0.4, 0.9))
+
+
 func _draw_boss() -> void:
 	var b := client.boss_state()
 	if b.is_empty():
@@ -87,10 +104,13 @@ func _draw_boss() -> void:
 
 
 func _draw_remote_player(p: Dictionary) -> void:
-	var alive := (int(p["flags"]) & Protocol.F_ALIVE) != 0
+	var flags := int(p["flags"])
+	var alive := (flags & Protocol.F_ALIVE) != 0
 	var col := COL_REMOTE if alive else COL_DEAD
 	_draw_ship(p["pos"], p["aim"], col, alive)
-	if (int(p["flags"]) & Protocol.F_ESCAPING) != 0:
+	if (flags & Protocol.F_SPAWN_GRACE) != 0:
+		_draw_grace_ring(p["pos"])
+	if (flags & Protocol.F_ESCAPING) != 0:
 		_draw_escape_ring(p["pos"], float(p["escape"]), col)
 
 
@@ -99,10 +119,20 @@ func _draw_local_player() -> void:
 		_draw_ship(client.predicted_pos, client.aim, COL_DEAD, false)
 		return
 	_draw_ship(client.predicted_pos, client.aim, COL_LOCAL, true)
+	if client.my_spawn_grace:
+		_draw_grace_ring(client.predicted_pos)
 	if client.my_escaping:
 		_draw_escape_ring(client.predicted_pos, client.my_escape, COL_LOCAL)
 
 
+## Arrival protection. Drawn on every protected ship, not just your own, so it
+## is clear who can currently be shot and who cannot.
+func _draw_grace_ring(pos: Vector2) -> void:
+	var pulse := 0.5 + 0.5 * sin(float(Time.get_ticks_msec()) * 0.012)
+	draw_arc(pos, SimConfig.PLAYER_VISUAL_RADIUS + 5.0, 0.0, TAU, 28,
+		Color(0.55, 0.85, 1.0, 0.35 + 0.45 * pulse), 2.0)
+
+
 ## Drawn at PLAYER_VISUAL_RADIUS, larger than the PLAYER_RADIUS hitbox actually
 ## used for hits -- see the comment on those constants in sim_config.gd. The
 ## mismatch is deliberate, not a placeholder: a bullet can visibly clip the