Stage 2: accounts, characters, permadeath, levels and experience

Identity is shaped like Steamworks so swapping to it is one subclass and no
schema change: the client presents an opaque ticket, the server validates it
into a stable 64-bit account id, and nothing downstream sees anything else.
LocalAuthProvider takes any ticket at face value -- insecure on purpose, and
labelled as such everywhere, because the point is the shape rather than the
security. Do not ship it.

Characters persist as JSON keyed by account. Account ids are written as decimal
strings because they are 64-bit and JSON numbers are doubles, which would
silently round them. A corrupt store aborts the server rather than starting
empty: starting empty looks like it worked and then saves over every character
on the first level-up.

Levels 1-15, +10 max health each, level DERIVED from lifetime experience rather
than stored beside it, so a hand-edited save cannot produce a level 12 character
with a level 3's experience. Experience is shared undivided across everyone
alive in the instance -- splitting it would make bringing a friend cost you
progress. A level-up heals by what it added, so gaining one mid-fight is relief
rather than a bar that moved further from full.

Death is permanent and unbinds the character entirely: no "return to the hub as
the character who just died", because the run is over. The record is retired,
never deleted. The five-character cap counts LIVING characters only -- counting
the dead would lock a player out of their own account after five deaths.

Verified by tools/diag_progression.tscn, which drives the real server through
kill -> xp -> level -> health and death -> retire -> roster. The bot smoke test
cannot cover that: bots are poor shots and rarely kill anything. Writing it
caught two real ordering bugs -- the death event was dispatched before the
payload that tells the player they died, and the dead character stayed bound to
the peer.

Also added --account and --store so several clients and test runs can coexist
on one machine. The smoke test now uses a scratch store; without it a rerun
resumed the previous run's characters and "a character was created" quietly
stopped being true.

193 tests. check.sh, test.sh, smoke.sh, diag_progression and diag_prediction
all pass.

docs/DECISIONS.md

@@ -126,3 +126,38 @@ dungeon should give a bit more than is needed for the first level-up.
 
 **Permadeath.** Death marks a character inactive — never deleted, for archival
 and troubleshooting — and the player picks another character or creates one.
+
+---
+
+## Characters and progression *(this session)*
+
+**Level 1 is base health; each level adds 10.** So level 15 is
+`PLAYER_MAX_HP + 14 * 10` = 240. Level is *derived* from lifetime experience
+rather than stored alongside it, so the two can never disagree — a hand-edited
+save cannot produce a level 12 character with a level 3's experience.
+
+**The five-character cap counts LIVING characters only.** Retired ones stay in
+the store forever but free their slot. Counting the dead would lock a player out
+of their own account permanently after five deaths, which is not a punishment
+anyone signed up for.
+
+**Death unbinds the character entirely.** There is deliberately no "return to
+the hub as the character who just died" — the run is over, so the peer is
+removed from the instance and left at the roster screen. The one exception is a
+linkdead player, which has nobody to show a roster to, so its body is left for
+the escape channel to resolve as before.
+
+**Experience is shared across the party, undivided.** Everyone alive in the
+instance receives the full amount for a kill. Splitting it would make bringing a
+friend cost you progress, which is the opposite of what the hub roster exists to
+encourage.
+
+**A level-up heals by the amount it added.** Gaining a level mid-fight should
+feel like relief, not like the bar you were watching got further from full.
+
+**The character store refuses to start rather than starting empty.** A corrupt
+or unreadable save aborts the server. Loading empty would look like it worked
+and then overwrite every character on the first level-up.
+
+**Account ids are written as decimal strings in JSON.** They are 64-bit and JSON
+numbers are doubles, which would silently round them.

docs/ROADMAP.md

@@ -71,7 +71,34 @@ play off server events. Enough to prove the pipeline, not a finished look.
 | **In-game credits screen** | **todo** | Not cosmetic: the SFX are CC BY 4.0 and attribution is a licence *requirement*. [CREDITS.md](../CREDITS.md) is not reachable by a player. |
 | Replace the two non-redistributable packs | todo | Bullet and FX art is local-only and non-commercial. CC0 replacements would let them into the repo and unblock a commercial release. See [ASSETS.md](ASSETS.md). |
 
-## Stage 2 — Characters, persistence, levels · *todo, next*
+## Stage 2 — Characters, persistence, levels · *done*
+
+| Feature | State | Where |
+| --- | --- | --- |
+| Steam-shaped identity abstraction | done | [src/meta/auth_provider.gd](../src/meta/auth_provider.gd), [local_auth_provider.gd](../src/meta/local_auth_provider.gd) |
+| Character store, JSON, survives restart | done | [src/meta/character_store.gd](../src/meta/character_store.gd) |
+| Up to 5 living characters, random colour | done | `CharacterStore.MAX_ACTIVE`, `Character.create` |
+| Last-played auto-selected on login | done | `CharacterStore.last_played` |
+| Permadeath → retired, never deleted | done | `ServerRuntime._on_player_died` |
+| Roster screen: pick or create | done | [src/ui/character_select.gd](../src/ui/character_select.gd) |
+| Levels 1–15, +10 max HP each | done | [src/meta/progression.gd](../src/meta/progression.gd) |
+| XP from kills, bosses worth far more | done | `ServerRuntime._award_kill` |
+| Colour visible in world and on the HUD | done | snapshot carries it; `WorldView._draw_ship` tints |
+
+Verified end to end by `tools/diag_progression.tscn`, which drives the real
+server through kill → xp → level → health and death → retire → roster. That
+path cannot be covered by the bot smoke test, because bots are poor shots.
+
+### Still open in this area
+
+- **The local identity provider is insecure by design.** Any client can claim
+  any account id. Fine for a LAN; must be replaced before the game is reachable
+  from the internet. Swapping in Steam is one `AuthProvider` subclass and no
+  schema change.
+- `--account` and `--store` exist so several clients and test runs can coexist
+  on one machine. A real provider makes `--account` unnecessary.
+
+## Stage 3 — Inventory and loot · *todo, next*
 
 Depends on nothing in Stage 1 except a place to stand. Blocked only on the
 identity layer, which is decided but unbuilt.
@@ -92,7 +119,7 @@ Current behaviour to replace: `SimPlayer` has no identity beyond a peer id;
 
 ---
 
-## Stage 3 — Upgrades · *todo*
+## Stage 4 — Upgrades · *todo*
 
 | Feature | Notes |
 | --- | --- |
@@ -110,8 +137,6 @@ bullets spawn per shot, so they belong in the same place.
 
 ---
 
-## Stage 4 — Inventory and loot · *todo*
-
 | Feature | Notes |
 | --- | --- |
 | Small always-on-screen inventory | Slot count unspecified. |