Health survives a door, and experience needs you to be there

Arriving anywhere set health to maximum, so a run cost nothing: walk in,
take what you could, walk out, walk back in whole. Current health now
lives on the character record for the same reason the inventory does --
SimWorld builds a blank player on every instance change, so anything that
must survive a door has to be written down -- and it is banked at every
transfer, every disconnect, and on every item transaction, since a potion
moves an item and hit points in one action.

The hub is where that damage is paid off, at 10% of maximum per second:
about ten seconds from nothing, fast enough not to be a chore and slow
enough to be a decision before walking back in. The dungeon rate is
unchanged, so waiting one out is still not a plan. Regeneration is a
property of the world now rather than a constant.

adopt() no longer touches current health. It is called mid-session by
on_choose_upgrade, and reading health from the record there would snap a
player back to whatever was last written to disk; recompute_max_hp still
clamps downwards so Glass Cannon takes the hit points above the new
ceiling with it. ServerRuntime._adopt_character stays the one place a
record becomes a live player.

Experience is still undivided, but now only among players within
XP_AWARD_RADIUS of the kill -- ten percent past what a player can see, so
anyone who watched it die is inside and someone parked in the entrance
room is not. The death events carry a position for this, and deliberately
do not put it on the wire: encode_events still writes the id alone.

diag_progression covers the whole chain end to end -- wounded in a
dungeon, escaped to the hub with the wound intact, healing there, and
walking back in still hurt -- because a unit test cannot transfer a peer.
Both halves were mutation-tested against it; the unit suite alone missed
the arrival heal entirely.

The Proving Grounds is recorded in the roadmap as a debugging tool that
does not ship: it pays full experience for a boss with 8% health.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_character_store.gd

@@ -362,3 +362,44 @@ func test_an_immediate_write_clears_the_pending_one() -> void:
 	var reloaded := CharacterStore.new(store._path)
 	reloaded.load_from_disk()
 	assert_eq(reloaded.get_character(ACC, c.id).total_xp, 7)
+
+
+# --- Health on the record ---------------------------------------------------
+# SimWorld builds a blank player on every instance change, so anything that must
+# survive walking through a door lives here, exactly like the inventory.
+
+func test_health_survives_a_save_and_reload() -> void:
+	var c := store.create_character(ACC, "Wounded")
+	store.set_health(ACC, c.id, 137)
+	store.flush()
+	var reloaded := CharacterStore.new(store._path)
+	assert_true(reloaded.load_from_disk())
+	assert_eq(reloaded.get_character(ACC, c.id).hp, 137)
+
+
+func test_a_fresh_character_is_recorded_as_whole_rather_than_as_a_number() -> void:
+	var c := store.create_character(ACC, "New")
+	assert_eq(c.hp, Character.HP_FULL,
+		"a character who has never been hurt has no health number to keep")
+
+
+func test_a_save_from_before_health_was_kept_loads_as_whole() -> void:
+	var d := Character.create("Old", RandomNumberGenerator.new()).to_dict()
+	d.erase("hp")
+	assert_eq(Character.from_dict(d).hp, Character.HP_FULL)
+
+
+func test_a_nonsense_health_in_a_save_loads_as_whole_not_as_dead() -> void:
+	# Under permadeath, a character that loads at zero health is unrecoverable,
+	# so every unreadable value has to fail in the generous direction.
+	for bad in [0, -5, "banana"]:
+		var d := Character.create("Odd", RandomNumberGenerator.new()).to_dict()
+		d["hp"] = bad
+		assert_eq(Character.from_dict(d).hp, Character.HP_FULL,
+			"hp %s must load as whole" % bad)
+
+
+func test_health_is_never_banked_at_zero() -> void:
+	var c := store.create_character(ACC, "Edge")
+	store.set_health(ACC, c.id, 0)
+	assert_eq(c.hp, 1, "the store floors it; a live character is never on zero")