Bound what one packet can cost, and stop the hub eating its own loot

Selecting a character rewrote the entire store to disk, re-placed the
player, re-streamed its map chunks and broadcast a roster to everyone --
off one small reliable packet, at whatever rate a client cared to send.
Repeating a selection you already hold now answers yes and stops, and
select/create are paced per peer. Item moves and experience grants, the
two paths a client can trigger every tick, mark the store dirty and the
server flushes once per tick instead of once per event.

That flush also fixes experience quietly not being saved: grant_xp only
wrote when a level was crossed, and level is DERIVED from lifetime xp, so
the number nobody was keeping was the only number there is. A restart
rolled a character back to its last level-up.

The emergency escape ran in the hub, where completing it means
transferring into the instance you are already in: teleported to spawn,
healed to full, instanced loot dropped, every map chunk re-streamed, once
a second for as long as the key is held. The hub now opts out.

Ground loot evicts the oldest item when the floor fills. That is right
for a dungeon, which closes and takes its litter with it, and wrong for
the hub, which never closes -- a player dropping into a full floor
destroyed whatever someone else had left there longest, and drop is
edge-triggered per tick. A player's drop is refused instead; the world's
own drops still make room.

Also: a linkdead body is not in inst.peers, so closing a CLEARED dungeon
walked past it and left that peer's account and name in the dictionaries
forever -- with the new one-account guard, enough to lock someone out of
their own session. And several encoders wrote mini(size, 255) as a count
and then looped the whole array, which puts records after the count on
the wire; MAX_CLIENTS makes it unreachable, which is why it would have
survived to the day it was not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/net/net_codec.gd

@@ -38,7 +38,13 @@ static func encode_snapshot(world: SimWorld,
 				or eye.distance_squared_to(p.pos) <= cull_sq:
 			visible_players.append(p)
 
-	b.put_u8(mini(visible_players.size(), 255))
+	# Sliced, not just clamped. Writing mini(size, 255) as the header and then
+	# looping the full array puts records after the count on the wire, and the
+	# decoder reads the enemy count out of the middle of a player. MAX_CLIENTS
+	# keeps it unreachable today, which is exactly why it would survive to the
+	# day it is not.
+	visible_players = visible_players.slice(0, 255)
+	b.put_u8(visible_players.size())
 	for p in visible_players:
 		b.put_u32(p.peer_id)
 		b.put_float(p.pos.x)
@@ -81,7 +87,8 @@ static func encode_snapshot(world: SimWorld,
 		if observer != null and eye.distance_squared_to(e.pos) > cull_sq:
 			continue
 		live_enemies.append(e)
-	b.put_u16(mini(live_enemies.size(), 65535))
+	live_enemies = live_enemies.slice(0, 65535)
+	b.put_u16(live_enemies.size())
 	for e in live_enemies:
 		b.put_u32(e.id)
 		b.put_float(e.pos.x)
@@ -123,7 +130,8 @@ static func encode_snapshot(world: SimWorld,
 			if eye.distance_squared_to(l.pos) > cull_sq:
 				continue
 		visible_loot.append(l)
-	b.put_u16(mini(visible_loot.size(), 65535))
+	visible_loot = visible_loot.slice(0, 65535)
+	b.put_u16(visible_loot.size())
 	for l in visible_loot:
 		b.put_u32(l.id)
 		b.put_float(l.pos.x)
@@ -361,7 +369,8 @@ static func decode_inputs(data: PackedByteArray) -> Array[InputFrame]:
 static func encode_roster(entries: Array[Dictionary]) -> PackedByteArray:
 	var b := StreamPeerBuffer.new()
 	b.big_endian = false
-	b.put_u8(mini(entries.size(), 255))
+	entries = entries.slice(0, 255)
+	b.put_u8(entries.size())
 	for e in entries:
 		b.put_u32(int(e["peer"]))
 		b.put_utf8_string(String(e["name"]))