Stage 4: upgrades, and a quartermaster to spend them at

Every level banks one choice. Choices queue, and are spent at an NPC in the
hub: walk to it, press E, take one of three weighted options. Seven upgrades,
all data — split shot, glass cannon, spread, sniper, doubleshot, poison,
eraser — and SimWorld gained no per-upgrade branch to run any of them.

The four ambiguities in the brief were settled with the user first, since
each changes what gets written:

  damage      base x (1 + sum additive) x product multiplicative. The flat
              +5% every upgrade carries, spread's -10%, doubleshot's -50%
              and glass cannon's +100% pool; sniper multiplies on top, so
              two snipers is 4x and not +200%.
  glass       half the LEVELLED maximum, multiplying if taken twice, so the
              price does not fade to a rounding error by level 15.
  poison      independent stacks, not a refresh.
  split       +/-45 degrees from the original heading.

Independent poison stacks sound expensive and are not: every dose lasts the
same number of ticks, so doses expire in the order they were added, the
pending expiries are a plain FIFO, and PoisonTrack only ever looks at its
front. O(1) per actor per tick however many are live.

Stats are derived from the upgrade list and never stored, the way level is
derived from experience -- a saved stat cannot disagree with the upgrades
that produced it. Upgrade riders (split charges, poison, erase chance) travel
on the bullet instead, because a shot in flight has to keep what it was fired
with rather than gaining Poison because the shooter just took it.

Two invariants this collided with, both now pinned:

  - bullet speed gained a ceiling. Wall collision samples once per tick, so
    anything over a tile per tick tunnels; two snipers asked for 2480 u/s
    against a 1920 threshold, and a tunnelling bullet looks like a bullet.
  - BULLET_INTEREST_RADIUS rose to 2900, because an upgraded player shot is
    now the longest-travelling bullet in the game. test_interest measured
    the worst case from static content, which upgrades quietly invalidated.

Choosing is intent checked three ways: a choice must be owed, the index must
name one of the three options the SERVER put on the table, and the player
must be standing at the NPC. The offer is rolled once and persisted, so
closing the screen is not a reroll and neither is a crash.

tools/diag_upgrades.tscn covers level -> banked choice -> refused in a
dungeon and refused across the room -> taken at the NPC -> new stats ->
on disk. Bots never walk to the quartermaster, so the smoke test cannot.

Known gap recorded in the roadmap: at PLAYER_BULLET_DAMAGE = 6, the +5% the
first upgrade carries rounds back to 6 and visibly does nothing. It comes out
right in aggregate, but the fix is a balance edit across content.gd and so is
the user's call.

check.sh clean, 357 tests, SMOKE PASS (18 assertions), all four diagnostics
green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/sim/sim_world.gd

@@ -37,6 +37,11 @@ var map: MapGrid = null
 ## A list rather than a single position because which dungeon an entrance opens
 ## is the whole reason there is more than one.
 var portals: Array[SimPortal] = []
+## Where the hub's upgrade NPC stands. Only meaningful when
+## [member has_upgrade_npc] is true -- the map is centred on the origin, so
+## Vector2.ZERO is a real position and cannot double as "there isn't one".
+var upgrade_npc := Vector2.ZERO
+var has_upgrade_npc: bool = false
 var spawn_point := Vector2(0.0, 240.0)
 ## Arrival protection granted to players entering this world. 0 in the hub,
 ## SimConfig.SPAWN_GRACE_TICKS in a dungeon.
@@ -131,6 +136,14 @@ func portal_at(at: Vector2) -> SimPortal:
 	return best
 
 
+## Whether [param at] is close enough to spend a level-up. Checked on the
+## server for the same reason the portal is: where a player is standing is the
+## one thing a modified client cannot fake.
+func at_upgrade_npc(at: Vector2) -> bool:
+	return has_upgrade_npc \
+		and at.distance_to(upgrade_npc) <= SimConfig.UPGRADE_NPC_RADIUS
+
+
 func alive_player_count() -> int:
 	var n := 0
 	for p in players.values():
@@ -186,6 +199,7 @@ func step() -> void:
 		_step_boss()
 		pool.step()
 		_resolve_bullet_hits()
+		_step_poison()
 		_emit_wall_kill_events()
 		_emit_spawn_events()
 	else:
@@ -276,18 +290,44 @@ func _button_edge(p: SimPlayer, frame: InputFrame) -> int:
 	return edge
 
 
+## One trigger pull. How many bullets that is, and what they carry, comes
+## entirely from the shooter's [PlayerStats] -- there is no per-upgrade branch
+## here, which is what lets a new upgrade be a table entry in [Upgrades].
 func _fire_player_shot(p: SimPlayer) -> void:
-	p.fire_cooldown = SimConfig.PLAYER_FIRE_COOLDOWN
+	p.fire_cooldown = p.stats.fire_cooldown
 	events.append({"t": SimEvent.Type.PLAYER_FIRED, "peer": p.peer_id})
-	var dir := Vector2.RIGHT.rotated(p.aim)
-	pool.spawn(
-		p.pos + dir * SimConfig.PLAYER_MUZZLE_OFFSET,
-		dir * SimConfig.PLAYER_BULLET_SPEED,
+	var forward := Vector2.RIGHT.rotated(p.aim)
+	var muzzle := p.pos + forward * SimConfig.PLAYER_MUZZLE_OFFSET
+
+	# The aimed shot plus Spread's cone, alternating sides so an odd count still
+	# comes out symmetric about the aim.
+	_spawn_player_bullet(p, muzzle, forward)
+	for i in p.stats.side_shots:
+		var step := float(i / 2 + 1) * SimConfig.SPREAD_STEP_DEG
+		var side_sign := 1.0 if i % 2 == 0 else -1.0
+		_spawn_player_bullet(p, muzzle,
+			forward.rotated(deg_to_rad(step * side_sign)))
+
+	# Doubleshot's extras travel parallel rather than fanned, so they are an
+	# offset at the muzzle and not an angle.
+	for i in p.stats.parallel_shots:
+		var gap := float(i / 2 + 1) * SimConfig.PARALLEL_OFFSET
+		var lateral_sign := 1.0 if i % 2 == 0 else -1.0
+		_spawn_player_bullet(p, muzzle + forward.orthogonal() * gap * lateral_sign,
+			forward)
+
+
+func _spawn_player_bullet(p: SimPlayer, at: Vector2, dir: Vector2) -> void:
+	var slot := pool.spawn(
+		at,
+		dir * p.stats.bullet_speed,
 		SimConfig.PLAYER_BULLET_RADIUS,
 		SimConfig.PLAYER_BULLET_LIFETIME,
-		SimConfig.PLAYER_BULLET_DAMAGE,
+		p.stats.damage,
 		SimConfig.TEAM_PLAYER,
 		SimConfig.KIND_PLAYER_SHOT)
+	pool.set_mods(slot, p.stats.split_charges, p.stats.poison_fraction,
+		p.stats.erase_chance)
 
 
 # --- Items and loot ---------------------------------------------------------
@@ -592,7 +632,12 @@ func _resolve_bullet_hits() -> void:
 			var consumed := false
 			if boss != null and boss.alive \
 					and Movement.circles_overlap(bp, br, boss.pos, boss.def.radius):
-				_damage_boss(pool.damage[i])
+				# Poison is taken from the damage the boss ACTUALLY took, so a
+				# phase that takes 30% extra is poisoned 30% harder too.
+				var applied := _damage_boss(pool.damage[i])
+				if pool.poison[i] > 0.0:
+					boss.poison_track().add(float(applied) * pool.poison[i], tick)
+				_split_shot(i, boss.pos, boss.def.radius)
 				consumed = true
 			if not consumed:
 				for e in enemies.values():
@@ -600,10 +645,82 @@ func _resolve_bullet_hits() -> void:
 						continue
 					if Movement.circles_overlap(bp, br, e.pos, e.def.radius):
 						_damage_enemy(e, pool.damage[i])
+						if pool.poison[i] > 0.0:
+							e.poison_track().add(
+								float(pool.damage[i]) * pool.poison[i], tick)
+						_split_shot(i, e.pos, e.def.radius)
 						consumed = true
 						break
 			if consumed:
 				_kill_bullet(i)
+			elif pool.erase[i] > 0.0:
+				_try_erase(i)
+
+
+## Split Shot: two children of the shot that just landed, leaving the target at
+## 45 degrees to either side.
+##
+## They are born just PAST the target rather than on it. A child spawned inside
+## the thing that was just hit would be resolved against it again on the same
+## tick -- a free second hit, and with several charges a free chain of them.
+##
+## Children inherit the remaining lifetime rather than a fresh one, so splitting
+## cannot extend a shot's reach indefinitely; a split at the end of a shot's
+## life produces two short-lived children, which is the conservative reading of
+## "two of the same bullet".
+func _split_shot(slot: int, from: Vector2, target_radius: float) -> void:
+	if pool.split[slot] <= 0:
+		return
+	var v: Vector2 = pool.vel[slot]
+	var speed := v.length()
+	if speed < 0.001:
+		return
+	var charges := pool.split[slot] - 1
+	var clearance := target_radius + pool.radius[slot] + 2.0
+	for side_sign in [1.0, -1.0]:
+		var dir := (v / speed).rotated(deg_to_rad(SimConfig.SPLIT_ANGLE_DEG) * side_sign)
+		var child := pool.spawn(from + dir * clearance, dir * speed,
+			pool.radius[slot], pool.life[slot], pool.damage[slot],
+			pool.team[slot], pool.kind[slot])
+		pool.set_mods(child, charges, pool.poison[slot], pool.erase[slot])
+
+
+## Eraser: at most ONE roll per shot per tick, against the first enemy
+## projectile it is overlapping.
+##
+## Rolling once per overlapping pair would multiply the stated 1% by however
+## many bullets happened to occupy the same place, which in a boss ring is a
+## lot. One opportunity per tick, taken or not, keeps the number the player was
+## promised close to the number they get.
+##
+## The scan is O(bullets) per erasing shot, and runs only for shots that carry
+## the upgrade -- which is why it is worth nothing until a legendary is drawn.
+func _try_erase(slot: int) -> void:
+	var p: Vector2 = pool.pos[slot]
+	var r: float = pool.radius[slot]
+	for j in pool.high_water:
+		if pool.alive[j] == 0 or pool.team[j] != SimConfig.TEAM_ENEMY:
+			continue
+		if not Movement.circles_overlap(p, r, pool.pos[j], pool.radius[j]):
+			continue
+		if rng.randf() < pool.erase[slot]:
+			_kill_bullet(j)
+		return
+
+
+## One tick of every live poison dose. Cheap regardless of how many are running
+## -- see [PoisonTrack] for why.
+func _step_poison() -> void:
+	for e in enemies.values():
+		if not e.alive or e.poison == null:
+			continue
+		var dealt: int = e.poison.step(tick)
+		if dealt > 0:
+			_damage_enemy(e, dealt, true)
+	if boss != null and boss.alive and boss.poison != null:
+		var on_boss: int = boss.poison.step(tick)
+		if on_boss > 0:
+			_damage_boss(on_boss, true, false)
 
 
 ## Bullets removed early must be announced -- clients cannot derive a hit.
@@ -624,9 +741,14 @@ func _damage_player(p: SimPlayer, amount: int) -> void:
 		events.append({"t": SimEvent.Type.PLAYER_DIED, "peer": p.peer_id})
 
 
-func _damage_enemy(e: SimEnemy, amount: int) -> void:
+## [param silent] suppresses the ENEMY_HIT event. Poison ticks use it: they
+## land many times a second on the reliable channel, and the client learns hp
+## from the snapshot anyway. Death is still announced either way, because that
+## is what the experience award is keyed on.
+func _damage_enemy(e: SimEnemy, amount: int, silent: bool = false) -> void:
 	e.hp = maxi(e.hp - amount, 0)
-	events.append({"t": SimEvent.Type.ENEMY_HIT, "id": e.id, "dmg": amount, "hp": e.hp})
+	if not silent:
+		events.append({"t": SimEvent.Type.ENEMY_HIT, "id": e.id, "dmg": amount, "hp": e.hp})
 	if e.hp <= 0:
 		e.alive = false
 		_drop_loot(e.def.loot, e.pos)
@@ -635,16 +757,23 @@ func _damage_enemy(e: SimEnemy, amount: int) -> void:
 		events.append({"t": SimEvent.Type.ENEMY_DIED, "id": e.id, "def": String(e.def.id)})
 
 
-func _damage_boss(amount: int) -> void:
+## Returns the damage actually applied, after the phase's armour multiplier, so
+## the caller can derive poison from the same number.
+##
+## [param scale] is false for poison ticks, whose damage was already scaled when
+## the dose was applied -- scaling again would compound the multiplier.
+func _damage_boss(amount: int, silent: bool = false, scale: bool = true) -> int:
 	var phase := boss.current_phase()
-	var mult := 1.0 if phase == null else phase.damage_taken_mult
+	var mult := 1.0 if phase == null or not scale else phase.damage_taken_mult
 	var applied := maxi(1, roundi(float(amount) * mult))
 	boss.hp = maxi(boss.hp - applied, 0)
-	events.append({"t": SimEvent.Type.ENEMY_HIT, "id": boss.id, "dmg": applied, "hp": boss.hp})
+	if not silent:
+		events.append({"t": SimEvent.Type.ENEMY_HIT, "id": boss.id, "dmg": applied, "hp": boss.hp})
 	if boss.hp <= 0:
 		boss.alive = false
 		_drop_loot(boss.def.loot, boss.pos)
 		events.append({"t": SimEvent.Type.BOSS_DIED, "def": String(boss.def.id)})
+	return applied
 
 
 ## Bullets that died against geometry. A client is only streamed the map near