Bound what one packet can cost, and stop the hub eating its own loot

Selecting a character rewrote the entire store to disk, re-placed the
player, re-streamed its map chunks and broadcast a roster to everyone --
off one small reliable packet, at whatever rate a client cared to send.
Repeating a selection you already hold now answers yes and stops, and
select/create are paced per peer. Item moves and experience grants, the
two paths a client can trigger every tick, mark the store dirty and the
server flushes once per tick instead of once per event.

That flush also fixes experience quietly not being saved: grant_xp only
wrote when a level was crossed, and level is DERIVED from lifetime xp, so
the number nobody was keeping was the only number there is. A restart
rolled a character back to its last level-up.

The emergency escape ran in the hub, where completing it means
transferring into the instance you are already in: teleported to spawn,
healed to full, instanced loot dropped, every map chunk re-streamed, once
a second for as long as the key is held. The hub now opts out.

Ground loot evicts the oldest item when the floor fills. That is right
for a dungeon, which closes and takes its litter with it, and wrong for
the hub, which never closes -- a player dropping into a full floor
destroyed whatever someone else had left there longest, and drop is
edge-triggered per tick. A player's drop is refused instead; the world's
own drops still make room.

Also: a linkdead body is not in inst.peers, so closing a CLEARED dungeon
walked past it and left that peer's account and name in the dictionaries
forever -- with the new one-account guard, enough to lock someone out of
their own session. And several encoders wrote mini(size, 255) as a count
and then looped the whole array, which puts records after the count on
the wire; MAX_CLIENTS makes it unreachable, which is why it would have
survived to the day it was not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_character_store.gd

@@ -312,3 +312,53 @@ func test_an_unknown_upgrade_in_a_save_is_dropped() -> void:
 	assert_eq(restored.upgrades, [Upgrades.SNIPER] as Array[StringName])
 	assert_eq(restored.offer, [Upgrades.POISON] as Array[StringName])
 	assert_eq(restored.pending_choices, 2)
+
+
+# --- Deferred writes --------------------------------------------------------
+# Two paths a client can trigger at the tick rate -- item moves and experience
+# grants -- mark the store dirty instead of writing, and the server flushes once
+# per tick. Everything else still writes the moment it happens.
+
+func test_experience_below_a_level_boundary_is_still_written() -> void:
+	var c := store.create_character(ACC, "Grinder")
+	assert_eq(store.grant_xp(ACC, c.id, 5), 0, "nowhere near a level")
+	store.flush()
+
+	var reloaded := CharacterStore.new(store._path)
+	assert_true(reloaded.load_from_disk())
+	assert_eq(reloaded.get_character(ACC, c.id).total_xp, 5,
+		"experience that has not crossed a level is the only record of it: " +
+		"level is derived from lifetime xp, so losing the xp loses the level")
+
+
+func test_a_deferred_inventory_write_lands_on_the_flush() -> void:
+	var c := store.create_character(ACC, "Carrier")   # writes immediately
+	var bag: Array[StringName] = [Items.HEALTH_POTION, Items.NONE, Items.NONE, Items.NONE]
+	store.set_inventory(ACC, c.id, bag, true)
+
+	var before := CharacterStore.new(store._path)
+	before.load_from_disk()
+	assert_eq(before.get_character(ACC, c.id).inventory[0], Items.NONE,
+		"deferred means deferred; the file still holds the older bag")
+
+	store.flush()
+	var after := CharacterStore.new(store._path)
+	after.load_from_disk()
+	assert_eq(after.get_character(ACC, c.id).inventory[0], Items.HEALTH_POTION)
+
+
+func test_flushing_a_clean_store_writes_nothing() -> void:
+	store.create_character(ACC, "Idle")
+	var stamp := FileAccess.get_modified_time(store._path)
+	store.flush()
+	assert_eq(FileAccess.get_modified_time(store._path), stamp,
+		"a tick in which nothing happened must not cost a disk write")
+
+
+func test_an_immediate_write_clears_the_pending_one() -> void:
+	var c := store.create_character(ACC, "Mixed")
+	store.grant_xp(ACC, c.id, 7)            # dirty, not written
+	store.set_last_played(ACC, c.id)        # writes now, and takes the xp with it
+	var reloaded := CharacterStore.new(store._path)
+	reloaded.load_from_disk()
+	assert_eq(reloaded.get_character(ACC, c.id).total_xp, 7)