Health survives a door, and experience needs you to be there

Arriving anywhere set health to maximum, so a run cost nothing: walk in,
take what you could, walk out, walk back in whole. Current health now
lives on the character record for the same reason the inventory does --
SimWorld builds a blank player on every instance change, so anything that
must survive a door has to be written down -- and it is banked at every
transfer, every disconnect, and on every item transaction, since a potion
moves an item and hit points in one action.

The hub is where that damage is paid off, at 10% of maximum per second:
about ten seconds from nothing, fast enough not to be a chore and slow
enough to be a decision before walking back in. The dungeon rate is
unchanged, so waiting one out is still not a plan. Regeneration is a
property of the world now rather than a constant.

adopt() no longer touches current health. It is called mid-session by
on_choose_upgrade, and reading health from the record there would snap a
player back to whatever was last written to disk; recompute_max_hp still
clamps downwards so Glass Cannon takes the hit points above the new
ceiling with it. ServerRuntime._adopt_character stays the one place a
record becomes a live player.

Experience is still undivided, but now only among players within
XP_AWARD_RADIUS of the kill -- ten percent past what a player can see, so
anyone who watched it die is inside and someone parked in the entrance
room is not. The death events carry a position for this, and deliberately
do not put it on the wire: encode_events still writes the id alone.

diag_progression covers the whole chain end to end -- wounded in a
dungeon, escaped to the hub with the wound intact, healing there, and
walking back in still hurt -- because a unit test cannot transfer a peer.
Both halves were mutation-tested against it; the unit suite alone missed
the arrival heal entirely.

The Proving Grounds is recorded in the roadmap as a debugging tool that
does not ship: it pays full experience for a boss with 8% health.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_character_store.gd

@@ -362,3 +362,44 @@ func test_an_immediate_write_clears_the_pending_one() -> void:
 	var reloaded := CharacterStore.new(store._path)
 	reloaded.load_from_disk()
 	assert_eq(reloaded.get_character(ACC, c.id).total_xp, 7)
+
+
+# --- Health on the record ---------------------------------------------------
+# SimWorld builds a blank player on every instance change, so anything that must
+# survive walking through a door lives here, exactly like the inventory.
+
+func test_health_survives_a_save_and_reload() -> void:
+	var c := store.create_character(ACC, "Wounded")
+	store.set_health(ACC, c.id, 137)
+	store.flush()
+	var reloaded := CharacterStore.new(store._path)
+	assert_true(reloaded.load_from_disk())
+	assert_eq(reloaded.get_character(ACC, c.id).hp, 137)
+
+
+func test_a_fresh_character_is_recorded_as_whole_rather_than_as_a_number() -> void:
+	var c := store.create_character(ACC, "New")
+	assert_eq(c.hp, Character.HP_FULL,
+		"a character who has never been hurt has no health number to keep")
+
+
+func test_a_save_from_before_health_was_kept_loads_as_whole() -> void:
+	var d := Character.create("Old", RandomNumberGenerator.new()).to_dict()
+	d.erase("hp")
+	assert_eq(Character.from_dict(d).hp, Character.HP_FULL)
+
+
+func test_a_nonsense_health_in_a_save_loads_as_whole_not_as_dead() -> void:
+	# Under permadeath, a character that loads at zero health is unrecoverable,
+	# so every unreadable value has to fail in the generous direction.
+	for bad in [0, -5, "banana"]:
+		var d := Character.create("Odd", RandomNumberGenerator.new()).to_dict()
+		d["hp"] = bad
+		assert_eq(Character.from_dict(d).hp, Character.HP_FULL,
+			"hp %s must load as whole" % bad)
+
+
+func test_health_is_never_banked_at_zero() -> void:
+	var c := store.create_character(ACC, "Edge")
+	store.set_health(ACC, c.id, 0)
+	assert_eq(c.hp, 1, "the store floors it; a live character is never on zero")

tests/unit/test_regen.gd

@@ -96,3 +96,50 @@ func test_it_cannot_outpace_incoming_fire() -> void:
 			SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 		world.step()
 	assert_lt(p.hp, start, "standing in fire must still lose health")
+
+
+# --- Where you are decides how fast you heal ---------------------------------
+# Arriving anywhere used to set health to maximum, which made a run free: walk
+# in, take what you can, walk out, walk back in whole. The hub pays that off
+# over about ten seconds instead.
+
+func test_the_hub_heals_far_faster_than_a_dungeon() -> void:
+	var hub := Instance.make_lobby(1)
+	assert_eq(hub.world.regen_percent_per_sec,
+		SimConfig.LOBBY_HP_REGEN_PERCENT_PER_SEC)
+	var run := Instance.make_dungeon(2, 99)
+	assert_eq(run.world.regen_percent_per_sec, SimConfig.HP_REGEN_PERCENT_PER_SEC)
+	assert_gt(hub.world.regen_percent_per_sec, run.world.regen_percent_per_sec,
+		"recovering is what the hub is for; a dungeon must not be a rest stop")
+
+
+func test_a_full_bar_takes_about_ten_seconds_in_the_hub() -> void:
+	var hub := Instance.make_lobby(1)
+	var p := hub.world.add_player(1, "hurt")
+	p.hp = 1
+	for _t in SimConfig.TICK_RATE * 10:
+		hub.step()
+	assert_eq(p.hp, p.max_hp, "ten seconds of standing in the hub is a full bar")
+
+
+func test_the_hub_still_takes_a_noticeable_moment() -> void:
+	# Fast, but not the instant heal this replaced: half a second must not do it.
+	var hub := Instance.make_lobby(1)
+	var p := hub.world.add_player(1, "hurt")
+	p.hp = 1
+	for _t in SimConfig.TICK_RATE / 2:
+		hub.step()
+	assert_lt(p.hp, p.max_hp, "arriving in the hub is not a heal button")
+	assert_gt(p.hp, 1, "but it is visibly happening")
+
+
+func test_a_dungeon_cannot_be_waited_out() -> void:
+	var run := Instance.make_dungeon(2, 99)
+	var p := run.world.add_player(1, "hurt")
+	p.hp = 1
+	p.spawn_grace = 0
+	var before := p.hp
+	for _t in SimConfig.TICK_RATE * 10:
+		p.regenerate(run.world.regen_percent_per_sec)
+	assert_lt(p.hp - before, p.max_hp / 10,
+		"ten seconds in a dungeon must not undo a fight")

tests/unit/test_server_authority.gd

@@ -351,3 +351,81 @@ func test_a_refused_flood_is_logged_once_and_not_once_per_packet() -> void:
 	assert_true(srv._accept_control(PEER))
 	assert_false(srv._peer_control_warned.has(PEER),
 		"behaving again re-arms the warning for the next burst")
+
+
+# --- Who gets paid for a kill -----------------------------------------------
+# Experience is undivided among everyone who was there, which is settled. Who
+# counts as "there" was not: without a radius, a player parked in the entrance
+# room collected the full experience for a boss they never saw.
+
+func _paying_server(where: Instance) -> ServerRuntime:
+	var srv := _runtime()
+	srv.store = CharacterStore.new("user://test_award_%d.json" % randi())
+	srv.store.load_from_disk()
+	srv.instances[where.id] = where
+	return srv
+
+
+func _seat(srv: ServerRuntime, where: Instance, peer: int, at: Vector2) -> SimPlayer:
+	var c := srv.store.create_character(peer, "p%d" % peer)
+	srv.peer_accounts[peer] = peer
+	srv.peer_characters[peer] = c.id
+	srv.peer_instance[peer] = where.id
+	where.add_peer(peer, c.display_name)
+	var p: SimPlayer = where.world.players[peer]
+	p.pos = at
+	return p
+
+
+func _xp_of(srv: ServerRuntime, peer: int) -> int:
+	return srv.store.get_character(peer, srv.peer_characters[peer]).total_xp
+
+
+func test_only_players_near_the_kill_are_paid() -> void:
+	var run := Instance.make_dungeon(9, 4242)
+	var srv := _paying_server(run)
+	var kill := Vector2(500.0, 500.0)
+	_seat(srv, run, 11, kill + Vector2(50.0, 0.0))
+	_seat(srv, run, 22, kill + Vector2(SimConfig.XP_AWARD_RADIUS + 200.0, 0.0))
+
+	srv._award_kill(run, 50, kill)
+	assert_eq(_xp_of(srv, 11), 50, "standing over it counts")
+	assert_eq(_xp_of(srv, 22), 0, "parked across the map does not")
+	DirAccess.remove_absolute(ProjectSettings.globalize_path(srv.store._path))
+
+
+func test_the_radius_reaches_past_what_a_player_can_see() -> void:
+	# Anyone who watched it die must be paid, so the boundary sits outside the
+	# fog rather than on it.
+	var run := Instance.make_dungeon(9, 4242)
+	var srv := _paying_server(run)
+	var kill := Vector2.ZERO
+	_seat(srv, run, 11, Vector2(SimConfig.FOG_VIEW_RADIUS, 0.0))
+	srv._award_kill(run, 50, kill)
+	assert_eq(_xp_of(srv, 11), 50,
+		"at the very edge of sight you still saw it happen")
+	DirAccess.remove_absolute(ProjectSettings.globalize_path(srv.store._path))
+
+
+func test_a_kill_still_pays_the_whole_party_that_was_there() -> void:
+	# The radius decides who was present; it must not turn into a split.
+	var run := Instance.make_dungeon(9, 4242)
+	var srv := _paying_server(run)
+	var kill := Vector2(100.0, 100.0)
+	for peer in [11, 22, 33]:
+		_seat(srv, run, peer, kill + Vector2(40.0, 0.0))
+	srv._award_kill(run, 50, kill)
+	for peer in [11, 22, 33]:
+		assert_eq(_xp_of(srv, peer), 50, "undivided, for everyone present")
+	DirAccess.remove_absolute(ProjectSettings.globalize_path(srv.store._path))
+
+
+func test_the_dead_are_not_paid_however_close_they_are_lying() -> void:
+	var run := Instance.make_dungeon(9, 4242)
+	var srv := _paying_server(run)
+	var kill := Vector2.ZERO
+	var corpse := _seat(srv, run, 11, kill)
+	corpse.alive = false
+	srv._award_kill(run, 50, kill)
+	assert_eq(_xp_of(srv, 11), 0)
+	DirAccess.remove_absolute(ProjectSettings.globalize_path(srv.store._path))