Health survives a door, and experience needs you to be there

Arriving anywhere set health to maximum, so a run cost nothing: walk in,
take what you could, walk out, walk back in whole. Current health now
lives on the character record for the same reason the inventory does --
SimWorld builds a blank player on every instance change, so anything that
must survive a door has to be written down -- and it is banked at every
transfer, every disconnect, and on every item transaction, since a potion
moves an item and hit points in one action.

The hub is where that damage is paid off, at 10% of maximum per second:
about ten seconds from nothing, fast enough not to be a chore and slow
enough to be a decision before walking back in. The dungeon rate is
unchanged, so waiting one out is still not a plan. Regeneration is a
property of the world now rather than a constant.

adopt() no longer touches current health. It is called mid-session by
on_choose_upgrade, and reading health from the record there would snap a
player back to whatever was last written to disk; recompute_max_hp still
clamps downwards so Glass Cannon takes the hit points above the new
ceiling with it. ServerRuntime._adopt_character stays the one place a
record becomes a live player.

Experience is still undivided, but now only among players within
XP_AWARD_RADIUS of the kill -- ten percent past what a player can see, so
anyone who watched it die is inside and someone parked in the entrance
room is not. The death events carry a position for this, and deliberately
do not put it on the wire: encode_events still writes the id alone.

diag_progression covers the whole chain end to end -- wounded in a
dungeon, escaped to the hub with the wound intact, healing there, and
walking back in still hurt -- because a unit test cannot transfer a peer.
Both halves were mutation-tested against it; the unit suite alone missed
the arrival heal entirely.

The Proving Grounds is recorded in the roadmap as a debugging tool that
does not ship: it pays full experience for a boss with 8% health.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_server_authority.gd

@@ -351,3 +351,81 @@ func test_a_refused_flood_is_logged_once_and_not_once_per_packet() -> void:
 	assert_true(srv._accept_control(PEER))
 	assert_false(srv._peer_control_warned.has(PEER),
 		"behaving again re-arms the warning for the next burst")
+
+
+# --- Who gets paid for a kill -----------------------------------------------
+# Experience is undivided among everyone who was there, which is settled. Who
+# counts as "there" was not: without a radius, a player parked in the entrance
+# room collected the full experience for a boss they never saw.
+
+func _paying_server(where: Instance) -> ServerRuntime:
+	var srv := _runtime()
+	srv.store = CharacterStore.new("user://test_award_%d.json" % randi())
+	srv.store.load_from_disk()
+	srv.instances[where.id] = where
+	return srv
+
+
+func _seat(srv: ServerRuntime, where: Instance, peer: int, at: Vector2) -> SimPlayer:
+	var c := srv.store.create_character(peer, "p%d" % peer)
+	srv.peer_accounts[peer] = peer
+	srv.peer_characters[peer] = c.id
+	srv.peer_instance[peer] = where.id
+	where.add_peer(peer, c.display_name)
+	var p: SimPlayer = where.world.players[peer]
+	p.pos = at
+	return p
+
+
+func _xp_of(srv: ServerRuntime, peer: int) -> int:
+	return srv.store.get_character(peer, srv.peer_characters[peer]).total_xp
+
+
+func test_only_players_near_the_kill_are_paid() -> void:
+	var run := Instance.make_dungeon(9, 4242)
+	var srv := _paying_server(run)
+	var kill := Vector2(500.0, 500.0)
+	_seat(srv, run, 11, kill + Vector2(50.0, 0.0))
+	_seat(srv, run, 22, kill + Vector2(SimConfig.XP_AWARD_RADIUS + 200.0, 0.0))
+
+	srv._award_kill(run, 50, kill)
+	assert_eq(_xp_of(srv, 11), 50, "standing over it counts")
+	assert_eq(_xp_of(srv, 22), 0, "parked across the map does not")
+	DirAccess.remove_absolute(ProjectSettings.globalize_path(srv.store._path))
+
+
+func test_the_radius_reaches_past_what_a_player_can_see() -> void:
+	# Anyone who watched it die must be paid, so the boundary sits outside the
+	# fog rather than on it.
+	var run := Instance.make_dungeon(9, 4242)
+	var srv := _paying_server(run)
+	var kill := Vector2.ZERO
+	_seat(srv, run, 11, Vector2(SimConfig.FOG_VIEW_RADIUS, 0.0))
+	srv._award_kill(run, 50, kill)
+	assert_eq(_xp_of(srv, 11), 50,
+		"at the very edge of sight you still saw it happen")
+	DirAccess.remove_absolute(ProjectSettings.globalize_path(srv.store._path))
+
+
+func test_a_kill_still_pays_the_whole_party_that_was_there() -> void:
+	# The radius decides who was present; it must not turn into a split.
+	var run := Instance.make_dungeon(9, 4242)
+	var srv := _paying_server(run)
+	var kill := Vector2(100.0, 100.0)
+	for peer in [11, 22, 33]:
+		_seat(srv, run, peer, kill + Vector2(40.0, 0.0))
+	srv._award_kill(run, 50, kill)
+	for peer in [11, 22, 33]:
+		assert_eq(_xp_of(srv, peer), 50, "undivided, for everyone present")
+	DirAccess.remove_absolute(ProjectSettings.globalize_path(srv.store._path))
+
+
+func test_the_dead_are_not_paid_however_close_they_are_lying() -> void:
+	var run := Instance.make_dungeon(9, 4242)
+	var srv := _paying_server(run)
+	var kill := Vector2.ZERO
+	var corpse := _seat(srv, run, 11, kill)
+	corpse.alive = false
+	srv._award_kill(run, 50, kill)
+	assert_eq(_xp_of(srv, 11), 0)
+	DirAccess.remove_absolute(ProjectSettings.globalize_path(srv.store._path))