Bound what one packet can cost, and stop the hub eating its own loot

Selecting a character rewrote the entire store to disk, re-placed the
player, re-streamed its map chunks and broadcast a roster to everyone --
off one small reliable packet, at whatever rate a client cared to send.
Repeating a selection you already hold now answers yes and stops, and
select/create are paced per peer. Item moves and experience grants, the
two paths a client can trigger every tick, mark the store dirty and the
server flushes once per tick instead of once per event.

That flush also fixes experience quietly not being saved: grant_xp only
wrote when a level was crossed, and level is DERIVED from lifetime xp, so
the number nobody was keeping was the only number there is. A restart
rolled a character back to its last level-up.

The emergency escape ran in the hub, where completing it means
transferring into the instance you are already in: teleported to spawn,
healed to full, instanced loot dropped, every map chunk re-streamed, once
a second for as long as the key is held. The hub now opts out.

Ground loot evicts the oldest item when the floor fills. That is right
for a dungeon, which closes and takes its litter with it, and wrong for
the hub, which never closes -- a player dropping into a full floor
destroyed whatever someone else had left there longest, and drop is
edge-triggered per tick. A player's drop is refused instead; the world's
own drops still make room.

Also: a linkdead body is not in inst.peers, so closing a CLEARED dungeon
walked past it and left that peer's account and name in the dictionaries
forever -- with the new one-account guard, enough to lock someone out of
their own session. And several encoders wrote mini(size, 255) as a count
and then looped the whole array, which puts records after the count on
the wire; MAX_CLIENTS makes it unreachable, which is why it would have
survived to the day it was not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_loot.gd

@@ -418,3 +418,35 @@ func test_the_same_tick_tie_break_is_join_order_not_distance() -> void:
 	assert_eq(world.players[ME].inventory[0], Items.HEALTH_POTION,
 		"the player who joined first wins, despite standing further away")
 	assert_eq(them.inventory[0], Items.NONE)
+
+
+## Ground loot evicts the oldest item when the floor fills up, which is the
+## right answer for a dungeon's own drops and the wrong one for a player's: the
+## hub never closes, so dropping into a full floor destroyed whatever someone
+## else had left there longest -- and drop is edge-triggered per tick, so a
+## client could clear the hub floor in seconds.
+func test_a_player_drop_never_destroys_someone_elses_item() -> void:
+	var w := SimWorld.new(1)
+	var mine := w.add_player(1, "me")
+	mine.pos = Vector2.ZERO
+	mine.inventory[0] = Items.HEALTH_POTION
+
+	var theirs: Array[int] = []
+	for i in SimConfig.MAX_LOOT_PER_INSTANCE:
+		theirs.append(w.spawn_loot(Items.WARDENS_RATION, Vector2(500.0, float(i))).id)
+	assert_eq(w.loot.size(), SimConfig.MAX_LOOT_PER_INSTANCE, "the floor is full")
+
+	w._drop_slot(mine, 0)
+	assert_eq(mine.inventory[0], Items.HEALTH_POTION,
+		"the drop is refused, so the item stays in the bag")
+	for id in theirs:
+		assert_true(w.loot.has(id), "nothing already on the floor may be evicted")
+
+
+func test_the_cap_still_bites_for_drops_the_world_generates_itself() -> void:
+	# A dungeon's own drops keep the old behaviour: they must never fail to
+	# appear, and the instance closes and takes the litter with it anyway.
+	var w := SimWorld.new(1)
+	for i in SimConfig.MAX_LOOT_PER_INSTANCE + 5:
+		w.spawn_loot(Items.WARDENS_RATION, Vector2(float(i), 0.0))
+	assert_eq(w.loot.size(), SimConfig.MAX_LOOT_PER_INSTANCE)