Bound what one packet can cost, and stop the hub eating its own loot

Selecting a character rewrote the entire store to disk, re-placed the
player, re-streamed its map chunks and broadcast a roster to everyone --
off one small reliable packet, at whatever rate a client cared to send.
Repeating a selection you already hold now answers yes and stops, and
select/create are paced per peer. Item moves and experience grants, the
two paths a client can trigger every tick, mark the store dirty and the
server flushes once per tick instead of once per event.

That flush also fixes experience quietly not being saved: grant_xp only
wrote when a level was crossed, and level is DERIVED from lifetime xp, so
the number nobody was keeping was the only number there is. A restart
rolled a character back to its last level-up.

The emergency escape ran in the hub, where completing it means
transferring into the instance you are already in: teleported to spawn,
healed to full, instanced loot dropped, every map chunk re-streamed, once
a second for as long as the key is held. The hub now opts out.

Ground loot evicts the oldest item when the floor fills. That is right
for a dungeon, which closes and takes its litter with it, and wrong for
the hub, which never closes -- a player dropping into a full floor
destroyed whatever someone else had left there longest, and drop is
edge-triggered per tick. A player's drop is refused instead; the world's
own drops still make room.

Also: a linkdead body is not in inst.peers, so closing a CLEARED dungeon
walked past it and left that peer's account and name in the dictionaries
forever -- with the new one-account guard, enough to lock someone out of
their own session. And several encoders wrote mini(size, 255) as a count
and then looped the whole array, which puts records after the count on
the wire; MAX_CLIENTS makes it unreachable, which is why it would have
survived to the day it was not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_emergency_escape.gd

@@ -112,3 +112,33 @@ func test_escape_completion_never_reaches_the_client_directly() -> void:
 	for ev: Dictionary in packet["events"]:
 		assert_ne(int(ev["t"]), SimEvent.Type.ESCAPE_COMPLETED,
 			"the transfer is the server's decision; clients only see the outcome")
+
+
+## The hub has nothing to escape from, and completing the channel there routes
+## to "send this peer to the lobby" -- a transfer into the instance you are
+## already in, which re-places the player: teleported to spawn, healed to full,
+## instanced loot dropped, every map chunk re-streamed. Once a second, for as
+## long as the key is held.
+func test_the_hub_has_no_escape_to_channel() -> void:
+	var hub := Instance.make_lobby(1)
+	assert_false(hub.world.escape_enabled,
+		"the lobby is the one world that opts out")
+	hub.add_peer(99, "tester")
+	for i in SimConfig.ESCAPE_CHANNEL_TICKS * 2:
+		var frames: Array[InputFrame] = [InputFrame.make(hub.world.tick + 1,
+			Vector2.ZERO, 0.0, InputFrame.BTN_ESCAPE)]
+		hub.world.queue_input(99, frames)
+		hub.step()
+	var p: SimPlayer = hub.world.players[99]
+	assert_eq(p.escape_ticks, 0, "nothing should have been channelling")
+	for ev in hub.world.events:
+		assert_ne(int(ev["t"]), SimEvent.Type.ESCAPE_STARTED,
+			"holding escape in the hub must not start a channel")
+		assert_ne(int(ev["t"]), SimEvent.Type.ESCAPE_COMPLETED,
+			"and must certainly never complete one")
+
+
+func test_a_dungeon_still_lets_you_out() -> void:
+	# The guard above must not be a way to disable the escape everywhere.
+	var run := Instance.make_dungeon(2, 1234)
+	assert_true(run.world.escape_enabled)