Bound what one packet can cost, and stop the hub eating its own loot

Selecting a character rewrote the entire store to disk, re-placed the
player, re-streamed its map chunks and broadcast a roster to everyone --
off one small reliable packet, at whatever rate a client cared to send.
Repeating a selection you already hold now answers yes and stops, and
select/create are paced per peer. Item moves and experience grants, the
two paths a client can trigger every tick, mark the store dirty and the
server flushes once per tick instead of once per event.

That flush also fixes experience quietly not being saved: grant_xp only
wrote when a level was crossed, and level is DERIVED from lifetime xp, so
the number nobody was keeping was the only number there is. A restart
rolled a character back to its last level-up.

The emergency escape ran in the hub, where completing it means
transferring into the instance you are already in: teleported to spawn,
healed to full, instanced loot dropped, every map chunk re-streamed, once
a second for as long as the key is held. The hub now opts out.

Ground loot evicts the oldest item when the floor fills. That is right
for a dungeon, which closes and takes its litter with it, and wrong for
the hub, which never closes -- a player dropping into a full floor
destroyed whatever someone else had left there longest, and drop is
edge-triggered per tick. A player's drop is refused instead; the world's
own drops still make room.

Also: a linkdead body is not in inst.peers, so closing a CLEARED dungeon
walked past it and left that peer's account and name in the dictionaries
forever -- with the new one-account guard, enough to lock someone out of
their own session. And several encoders wrote mini(size, 255) as a count
and then looped the whole array, which puts records after the count on
the wire; MAX_CLIENTS makes it unreachable, which is why it would have
survived to the day it was not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_character_store.gd

@@ -312,3 +312,53 @@ func test_an_unknown_upgrade_in_a_save_is_dropped() -> void:
 	assert_eq(restored.upgrades, [Upgrades.SNIPER] as Array[StringName])
 	assert_eq(restored.offer, [Upgrades.POISON] as Array[StringName])
 	assert_eq(restored.pending_choices, 2)
+
+
+# --- Deferred writes --------------------------------------------------------
+# Two paths a client can trigger at the tick rate -- item moves and experience
+# grants -- mark the store dirty instead of writing, and the server flushes once
+# per tick. Everything else still writes the moment it happens.
+
+func test_experience_below_a_level_boundary_is_still_written() -> void:
+	var c := store.create_character(ACC, "Grinder")
+	assert_eq(store.grant_xp(ACC, c.id, 5), 0, "nowhere near a level")
+	store.flush()
+
+	var reloaded := CharacterStore.new(store._path)
+	assert_true(reloaded.load_from_disk())
+	assert_eq(reloaded.get_character(ACC, c.id).total_xp, 5,
+		"experience that has not crossed a level is the only record of it: " +
+		"level is derived from lifetime xp, so losing the xp loses the level")
+
+
+func test_a_deferred_inventory_write_lands_on_the_flush() -> void:
+	var c := store.create_character(ACC, "Carrier")   # writes immediately
+	var bag: Array[StringName] = [Items.HEALTH_POTION, Items.NONE, Items.NONE, Items.NONE]
+	store.set_inventory(ACC, c.id, bag, true)
+
+	var before := CharacterStore.new(store._path)
+	before.load_from_disk()
+	assert_eq(before.get_character(ACC, c.id).inventory[0], Items.NONE,
+		"deferred means deferred; the file still holds the older bag")
+
+	store.flush()
+	var after := CharacterStore.new(store._path)
+	after.load_from_disk()
+	assert_eq(after.get_character(ACC, c.id).inventory[0], Items.HEALTH_POTION)
+
+
+func test_flushing_a_clean_store_writes_nothing() -> void:
+	store.create_character(ACC, "Idle")
+	var stamp := FileAccess.get_modified_time(store._path)
+	store.flush()
+	assert_eq(FileAccess.get_modified_time(store._path), stamp,
+		"a tick in which nothing happened must not cost a disk write")
+
+
+func test_an_immediate_write_clears_the_pending_one() -> void:
+	var c := store.create_character(ACC, "Mixed")
+	store.grant_xp(ACC, c.id, 7)            # dirty, not written
+	store.set_last_played(ACC, c.id)        # writes now, and takes the xp with it
+	var reloaded := CharacterStore.new(store._path)
+	reloaded.load_from_disk()
+	assert_eq(reloaded.get_character(ACC, c.id).total_xp, 7)

tests/unit/test_emergency_escape.gd

@@ -112,3 +112,33 @@ func test_escape_completion_never_reaches_the_client_directly() -> void:
 	for ev: Dictionary in packet["events"]:
 		assert_ne(int(ev["t"]), SimEvent.Type.ESCAPE_COMPLETED,
 			"the transfer is the server's decision; clients only see the outcome")
+
+
+## The hub has nothing to escape from, and completing the channel there routes
+## to "send this peer to the lobby" -- a transfer into the instance you are
+## already in, which re-places the player: teleported to spawn, healed to full,
+## instanced loot dropped, every map chunk re-streamed. Once a second, for as
+## long as the key is held.
+func test_the_hub_has_no_escape_to_channel() -> void:
+	var hub := Instance.make_lobby(1)
+	assert_false(hub.world.escape_enabled,
+		"the lobby is the one world that opts out")
+	hub.add_peer(99, "tester")
+	for i in SimConfig.ESCAPE_CHANNEL_TICKS * 2:
+		var frames: Array[InputFrame] = [InputFrame.make(hub.world.tick + 1,
+			Vector2.ZERO, 0.0, InputFrame.BTN_ESCAPE)]
+		hub.world.queue_input(99, frames)
+		hub.step()
+	var p: SimPlayer = hub.world.players[99]
+	assert_eq(p.escape_ticks, 0, "nothing should have been channelling")
+	for ev in hub.world.events:
+		assert_ne(int(ev["t"]), SimEvent.Type.ESCAPE_STARTED,
+			"holding escape in the hub must not start a channel")
+		assert_ne(int(ev["t"]), SimEvent.Type.ESCAPE_COMPLETED,
+			"and must certainly never complete one")
+
+
+func test_a_dungeon_still_lets_you_out() -> void:
+	# The guard above must not be a way to disable the escape everywhere.
+	var run := Instance.make_dungeon(2, 1234)
+	assert_true(run.world.escape_enabled)

tests/unit/test_loot.gd

@@ -418,3 +418,35 @@ func test_the_same_tick_tie_break_is_join_order_not_distance() -> void:
 	assert_eq(world.players[ME].inventory[0], Items.HEALTH_POTION,
 		"the player who joined first wins, despite standing further away")
 	assert_eq(them.inventory[0], Items.NONE)
+
+
+## Ground loot evicts the oldest item when the floor fills up, which is the
+## right answer for a dungeon's own drops and the wrong one for a player's: the
+## hub never closes, so dropping into a full floor destroyed whatever someone
+## else had left there longest -- and drop is edge-triggered per tick, so a
+## client could clear the hub floor in seconds.
+func test_a_player_drop_never_destroys_someone_elses_item() -> void:
+	var w := SimWorld.new(1)
+	var mine := w.add_player(1, "me")
+	mine.pos = Vector2.ZERO
+	mine.inventory[0] = Items.HEALTH_POTION
+
+	var theirs: Array[int] = []
+	for i in SimConfig.MAX_LOOT_PER_INSTANCE:
+		theirs.append(w.spawn_loot(Items.WARDENS_RATION, Vector2(500.0, float(i))).id)
+	assert_eq(w.loot.size(), SimConfig.MAX_LOOT_PER_INSTANCE, "the floor is full")
+
+	w._drop_slot(mine, 0)
+	assert_eq(mine.inventory[0], Items.HEALTH_POTION,
+		"the drop is refused, so the item stays in the bag")
+	for id in theirs:
+		assert_true(w.loot.has(id), "nothing already on the floor may be evicted")
+
+
+func test_the_cap_still_bites_for_drops_the_world_generates_itself() -> void:
+	# A dungeon's own drops keep the old behaviour: they must never fail to
+	# appear, and the instance closes and takes the litter with it anyway.
+	var w := SimWorld.new(1)
+	for i in SimConfig.MAX_LOOT_PER_INSTANCE + 5:
+		w.spawn_loot(Items.WARDENS_RATION, Vector2(float(i), 0.0))
+	assert_eq(w.loot.size(), SimConfig.MAX_LOOT_PER_INSTANCE)