Fix bullet/ship desync; rework death, escape, arrival and hub awareness

(1) Bullets appeared to trail the ship. Two independent causes, measured with
the new tools/diag_prediction.gd rather than guessed at:
  - ServerRuntime ticked before ClientRuntime, so input sampled on frame N was
    not consumed until frame N+1, leaving the drawn ship a constant one tick
    (4.00px at 240 u/s) ahead of the authoritative one that bullets spawn from.
    ClientRuntime now sets process_physics_priority = -10. Gap on a listen
    server: 4.00px -> 0.10px mean, 0.30px worst.
  - PLAYER_MUZZLE_OFFSET was PLAYER_RADIUS + 6 = 12px against a 13px drawn
    ship, so bullets were born inside the sprite. Regression from the previous
    commit's hitbox shrink; it now derives from PLAYER_VISUAL_RADIUS.

(2) No more timed respawn. A downed player stays down until they ask for the
hub (E), which is an ordinary input -- the server has no "revive me" message.

(3) Escape channel 3s -> 1s, and damage no longer cancels it. An interruptible
channel makes killing the process strictly better than using the button, so a
dropped connection now runs the same channel: the player stays in the world as
linkdead, still killable, and is only released once it completes. Instances
refuse to close while a linkdead body is resolving, or a solo drop would delete
it on the next tick and hand the exploit straight back.

(4) Escape opens an in-game menu: return to hub (routed through the same held-
escape channel, not a new message), disconnect, quit.

(5) Server pushes a roster so the hub shows who is online and which dungeon
they are in. Entering a dungeon grants 2s arrival protection -- invulnerable
AND weapons-cold, since invulnerability alone would make the spawn a free
firing position -- flagged in the snapshot and drawn on every protected ship.

(6) Cleared dungeons hold the party 30s (was 5s) with a visible countdown.

(7) The hub's grey circle was a 100k-HP target dummy that read as scenery. Now
drawn as a bullseye so its purpose is legible.

Protocol version 1 -> 2. 91 tests (was 78); smoke.sh gains a bot that is
SIGKILLed mid-dungeon to prove the disconnect path end to end. check.sh,
test.sh and smoke.sh all pass.

tests/integration/test_dungeon_flow.gd

@@ -67,9 +67,13 @@ func test_killing_the_boss_clears_the_instance() -> void:
 	inst.world.boss.alive = false
 	_step(5)
 	assert_eq(inst.state, Instance.State.CLEARED)
+	assert_almost_eq(inst.exit_countdown_seconds(),
+		SimConfig.DUNGEON_CLEARED_EXIT_TICKS / SimConfig.TICK_RATE, 1,
+		"the party gets a visible countdown, not an instant boot")
 	# The exit timer has to run down, or the party would never be released.
-	_step(400)
+	_step(SimConfig.DUNGEON_CLEARED_EXIT_TICKS + 10)
 	assert_eq(inst.stage_delay, 0)
+	assert_eq(inst.exit_countdown_seconds(), 0)
 
 
 func test_the_lobby_has_a_portal_and_no_hostiles() -> void:

tests/unit/test_emergency_escape.gd

@@ -33,7 +33,9 @@ func test_escape_takes_the_full_channel_time() -> void:
 
 
 func test_releasing_the_button_cancels_the_channel() -> void:
-	_hold_escape(60)
+	# Deliberately short of ESCAPE_CHANNEL_TICKS: hold the full duration and the
+	# channel completes instead, which is a different test.
+	_hold_escape(SimConfig.ESCAPE_CHANNEL_TICKS / 2)
 	assert_gt(world.players[PEER].escape_ticks, 0)
 	var frames: Array[InputFrame] = [InputFrame.make(world.tick + 1, Vector2.ZERO, 0.0, 0)]
 	world.queue_input(PEER, frames)
@@ -42,18 +44,63 @@ func test_releasing_the_button_cancels_the_channel() -> void:
 	assert_eq(_events_of(SimEvent.Type.ESCAPE_CANCELLED).size(), 1)
 
 
-func test_taking_damage_cancels_the_channel() -> void:
-	_hold_escape(60)
+## The inverse of what this asserted originally. Interrupting on damage makes
+## quitting the process strictly better than using the button, which turns the
+## escape hatch into the exploit -- see SimConfig.ESCAPE_CHANNEL_TICKS.
+func test_taking_damage_does_not_cancel_the_channel() -> void:
+	_hold_escape(20)
+	var before: int = world.players[PEER].escape_ticks
 	world.pool.spawn(world.players[PEER].pos, Vector2.ZERO, 6.0, 60, 10,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
+	_hold_escape(1)
+	assert_lt(world.players[PEER].hp, SimConfig.PLAYER_MAX_HP, "setup: should have been hit")
+	assert_eq(world.players[PEER].escape_ticks, before + 1,
+		"the channel must keep running while under fire")
+	assert_eq(_events_of(SimEvent.Type.ESCAPE_CANCELLED).size(), 0)
+
+
+## Dying is still an interruption -- it is the one thing the escape cannot beat,
+## which is what keeps the one-second channel a real risk.
+func test_dying_ends_the_channel() -> void:
+	_hold_escape(20)
+	var p: SimPlayer = world.players[PEER]
+	p.hp = 1
+	p.iframes = 0
+	world.pool.spawn(p.pos, Vector2.ZERO, 6.0, 60, 999,
+		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 	world.step()
-	assert_eq(world.players[PEER].escape_ticks, 0,
-		"escaping under fire has to be a real risk, not a free exit")
-	assert_gt(_events_of(SimEvent.Type.ESCAPE_CANCELLED).size(), 0)
+	assert_false(p.alive)
+	assert_eq(p.escape_ticks, 0)
+	assert_eq(_events_of(SimEvent.Type.ESCAPE_COMPLETED).size(), 0)
+
+
+## A dropped connection channels out on exactly the same timer, so pulling the
+## plug is never cheaper than pressing the button.
+func test_a_linkdead_player_channels_out_without_input() -> void:
+	var p: SimPlayer = world.players[PEER]
+	p.linkdead = true
+	for _i in SimConfig.ESCAPE_CHANNEL_TICKS - 1:
+		world.step()
+	assert_eq(_events_of(SimEvent.Type.ESCAPE_COMPLETED).size(), 0,
+		"a disconnect must not be an instant exit")
+	world.step()
+	assert_eq(_events_of(SimEvent.Type.ESCAPE_COMPLETED).size(), 1)
+
+
+func test_a_linkdead_player_is_still_killable_while_channelling() -> void:
+	var p: SimPlayer = world.players[PEER]
+	p.linkdead = true
+	p.hp = 1
+	p.iframes = 0
+	world.step()
+	world.pool.spawn(p.pos, Vector2.ZERO, 6.0, 60, 999,
+		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
+	world.step()
+	assert_false(p.alive, "the whole point: disconnecting does not grant immunity")
 
 
 func test_a_cancelled_channel_restarts_from_zero() -> void:
-	_hold_escape(120)
+	_hold_escape(SimConfig.ESCAPE_CHANNEL_TICKS / 2)
 	var frames: Array[InputFrame] = [InputFrame.make(world.tick + 1, Vector2.ZERO, 0.0, 0)]
 	world.queue_input(PEER, frames)
 	world.step()

tests/unit/test_net_codec.gd

@@ -11,7 +11,7 @@ func before_each() -> void:
 	p.pos = Vector2(120.5, -64.25)
 	p.aim = 1.25
 	p.hp = 73
-	p.escape_ticks = 90
+	p.escape_ticks = 30
 	p.last_input_tick = 555
 	world.spawn_enemy(Content.turret(), Vector2(-200.0, 100.0))
 	world.spawn_boss(Content.warden())
@@ -30,7 +30,7 @@ func test_snapshot_round_trips_player_state() -> void:
 	assert_eq(int(rec["last_input_tick"]), 555)
 	assert_true((int(rec["flags"]) & Protocol.F_ALIVE) != 0)
 	assert_true((int(rec["flags"]) & Protocol.F_ESCAPING) != 0)
-	assert_almost_eq(float(rec["escape"]), 90.0 / float(SimConfig.ESCAPE_CHANNEL_TICKS), 0.01)
+	assert_almost_eq(float(rec["escape"]), 30.0 / float(SimConfig.ESCAPE_CHANNEL_TICKS), 0.01)
 
 
 func test_snapshot_carries_enemy_radius_for_late_joiners() -> void:
@@ -105,3 +105,59 @@ func test_truncated_input_packet_is_rejected_not_read_past() -> void:
 
 func test_empty_input_packet_is_safe() -> void:
 	assert_eq(NetCodec.decode_inputs(PackedByteArray()).size(), 0)
+
+
+# --- Roster -----------------------------------------------------------------
+
+func test_roster_round_trips() -> void:
+	var entries: Array[Dictionary] = [
+		{"peer": 7, "name": "ada", "kind": Protocol.InstanceKind.LOBBY,
+			"instance": 1, "alive": true},
+		{"peer": 9, "name": "grace", "kind": Protocol.InstanceKind.DUNGEON,
+			"instance": 4, "alive": false},
+	]
+	var out := NetCodec.decode_roster(NetCodec.encode_roster(entries))
+	assert_eq(out.size(), 2)
+	assert_eq(int(out[0]["peer"]), 7)
+	assert_eq(String(out[0]["name"]), "ada")
+	assert_eq(int(out[0]["kind"]), Protocol.InstanceKind.LOBBY)
+	assert_true(out[0]["alive"])
+	assert_eq(String(out[1]["name"]), "grace")
+	assert_eq(int(out[1]["kind"]), Protocol.InstanceKind.DUNGEON,
+		"the hub needs to know someone is already inside")
+	assert_eq(int(out[1]["instance"]), 4)
+	assert_false(out[1]["alive"])
+
+
+func test_roster_survives_unicode_names() -> void:
+	var entries: Array[Dictionary] = [
+		{"peer": 1, "name": "ゆき", "kind": 0, "instance": 1, "alive": true}]
+	var out := NetCodec.decode_roster(NetCodec.encode_roster(entries))
+	assert_eq(String(out[0]["name"]), "ゆき")
+
+
+func test_empty_roster_is_safe() -> void:
+	assert_eq(NetCodec.decode_roster(PackedByteArray()).size(), 0)
+	assert_eq(NetCodec.decode_roster(NetCodec.encode_roster([] as Array[Dictionary])).size(), 0)
+
+
+# --- Snapshot extras --------------------------------------------------------
+
+func test_snapshot_carries_spawn_grace_and_linkdead_flags() -> void:
+	var p: SimPlayer = world.players[42]
+	p.spawn_grace = 30
+	p.linkdead = true
+	var snap := NetCodec.decode_snapshot(NetCodec.encode_snapshot(world))
+	var flags := int(snap["players"][0]["flags"])
+	assert_true((flags & Protocol.F_SPAWN_GRACE) != 0)
+	assert_true((flags & Protocol.F_LINKDEAD) != 0)
+
+
+func test_cleared_countdown_round_trips() -> void:
+	var snap := NetCodec.decode_snapshot(NetCodec.encode_snapshot(world, 17))
+	assert_eq(int(snap["cleared_countdown"]), 17)
+
+
+func test_countdown_defaults_to_not_applicable() -> void:
+	var snap := NetCodec.decode_snapshot(NetCodec.encode_snapshot(world))
+	assert_eq(int(snap["cleared_countdown"]), Protocol.COUNTDOWN_NONE)

tests/unit/test_server_authority.gd

@@ -122,17 +122,70 @@ func test_a_replica_world_never_resolves_a_hit() -> void:
 		"only the server decides damage; a client replica must never apply it")
 
 
-func test_player_death_and_respawn() -> void:
+func _kill_player() -> SimPlayer:
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
 	p.hp = 5
 	p.iframes = 0
+	p.spawn_grace = 0
 	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 	world.step()
-	assert_false(p.alive)
-	for _i in SimConfig.PLAYER_RESPAWN_DELAY + 1:
+	assert_false(p.alive, "setup: the player should be down")
+	return p
+
+
+func _events_of(type: int) -> Array:
+	return world.events.filter(func(e: Dictionary) -> bool: return int(e["t"]) == type)
+
+
+func test_a_downed_player_stays_down_without_input() -> void:
+	var p := _kill_player()
+	world.drain_events()
+	for _i in 600:
 		world.step()
-	assert_true(p.alive)
-	assert_eq(p.hp, SimConfig.PLAYER_MAX_HP)
-	assert_eq(p.pos, world.spawn_point)
+	assert_false(p.alive, "there is no timed respawn -- death waits for the player")
+	assert_eq(_events_of(SimEvent.Type.RESPAWN_REQUESTED).size(), 0)
+
+
+func test_a_downed_player_asking_to_respawn_is_reported_once_per_tick() -> void:
+	_kill_player()
+	world.drain_events()
+	_drive(1, Vector2.ZERO, InputFrame.BTN_INTERACT)
+	assert_eq(_events_of(SimEvent.Type.RESPAWN_REQUESTED).size(), 1,
+		"the request is an event for the instance layer, not a local revive")
+	# Crucially the world does NOT revive the player itself: only the server's
+	# instance layer can, by moving them to the hub.
+	assert_false(world.players[PEER].alive)
+
+
+func test_respawn_request_never_reaches_the_client() -> void:
+	_kill_player()
+	_drive(1, Vector2.ZERO, InputFrame.BTN_INTERACT)
+	var packet := NetCodec.decode_events(NetCodec.encode_events(world.tick, world.events))
+	for ev: Dictionary in packet["events"]:
+		assert_ne(int(ev["t"]), SimEvent.Type.RESPAWN_REQUESTED,
+			"where a dead player goes is the server's decision")
+
+
+func test_spawn_grace_blocks_damage_and_firing() -> void:
+	var p: SimPlayer = world.players[PEER]
+	p.pos = Vector2.ZERO
+	p.iframes = 0
+	p.spawn_grace = 60
+	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
+		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
+	_drive(1, Vector2.ZERO, InputFrame.BTN_FIRE)
+	assert_eq(p.hp, SimConfig.PLAYER_MAX_HP, "arrival protection must absorb the hit")
+	assert_eq(world.pool.live_count, 1,
+		"only the enemy bullet: a protected player cannot shoot either")
+
+
+func test_spawn_grace_expires() -> void:
+	var p: SimPlayer = world.players[PEER]
+	p.spawn_grace = 5
+	_drive(6)
+	assert_eq(p.spawn_grace, 0)
+	assert_false(p.invulnerable())
+	_drive(1, Vector2.ZERO, InputFrame.BTN_FIRE)
+	assert_eq(world.pool.live_count, 1, "the gun comes back once grace ends")