Stage 4: upgrades, and a quartermaster to spend them at

Every level banks one choice. Choices queue, and are spent at an NPC in the
hub: walk to it, press E, take one of three weighted options. Seven upgrades,
all data — split shot, glass cannon, spread, sniper, doubleshot, poison,
eraser — and SimWorld gained no per-upgrade branch to run any of them.

The four ambiguities in the brief were settled with the user first, since
each changes what gets written:

  damage      base x (1 + sum additive) x product multiplicative. The flat
              +5% every upgrade carries, spread's -10%, doubleshot's -50%
              and glass cannon's +100% pool; sniper multiplies on top, so
              two snipers is 4x and not +200%.
  glass       half the LEVELLED maximum, multiplying if taken twice, so the
              price does not fade to a rounding error by level 15.
  poison      independent stacks, not a refresh.
  split       +/-45 degrees from the original heading.

Independent poison stacks sound expensive and are not: every dose lasts the
same number of ticks, so doses expire in the order they were added, the
pending expiries are a plain FIFO, and PoisonTrack only ever looks at its
front. O(1) per actor per tick however many are live.

Stats are derived from the upgrade list and never stored, the way level is
derived from experience -- a saved stat cannot disagree with the upgrades
that produced it. Upgrade riders (split charges, poison, erase chance) travel
on the bullet instead, because a shot in flight has to keep what it was fired
with rather than gaining Poison because the shooter just took it.

Two invariants this collided with, both now pinned:

  - bullet speed gained a ceiling. Wall collision samples once per tick, so
    anything over a tile per tick tunnels; two snipers asked for 2480 u/s
    against a 1920 threshold, and a tunnelling bullet looks like a bullet.
  - BULLET_INTEREST_RADIUS rose to 2900, because an upgraded player shot is
    now the longest-travelling bullet in the game. test_interest measured
    the worst case from static content, which upgrades quietly invalidated.

Choosing is intent checked three ways: a choice must be owed, the index must
name one of the three options the SERVER put on the table, and the player
must be standing at the NPC. The offer is rolled once and persisted, so
closing the screen is not a reroll and neither is a crash.

tools/diag_upgrades.tscn covers level -> banked choice -> refused in a
dungeon and refused across the room -> taken at the NPC -> new stats ->
on disk. Bots never walk to the quartermaster, so the smoke test cannot.

Known gap recorded in the roadmap: at PLAYER_BULLET_DAMAGE = 6, the +5% the
first upgrade carries rounds back to 6 and visibly does nothing. It comes out
right in aggregate, but the fix is a balance edit across content.gd and so is
the user's call.

check.sh clean, 357 tests, SMOKE PASS (18 assertions), all four diagnostics
green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_character_store.gd

@@ -210,3 +210,105 @@ func test_setting_an_inventory_on_a_missing_character_is_harmless() -> void:
 	var nothing: Array[StringName] = [Items.HEALTH_POTION]
 	store.set_inventory(ACC, "no-such-id", nothing)
 	assert_eq(store.characters_for(ACC).size(), 0)
+
+
+# --- Upgrades ---------------------------------------------------------------
+
+func test_a_level_banks_a_choice_and_puts_three_on_the_table() -> void:
+	var c := store.create_character(ACC, "Riser")
+	store.grant_choices(ACC, c.id, 1)
+	assert_eq(c.pending_choices, 1)
+	assert_eq(c.offer.size(), SimConfig.UPGRADE_CHOICES)
+
+
+## The offer is rolled once and held. If it regenerated per request, closing and
+## reopening the screen would be a free reroll until a legendary appeared.
+func test_the_offer_is_stable_until_something_is_taken() -> void:
+	var c := store.create_character(ACC, "Picky")
+	store.grant_choices(ACC, c.id, 1)
+	var first := c.offer.duplicate()
+	store.grant_choices(ACC, c.id, 1)
+	assert_eq(c.offer, first, "banking another level must not reroll the table")
+
+
+## Two levels in one run owe two choices. Losing one for doing well is a
+## punishment nobody would guess at.
+func test_choices_queue() -> void:
+	var c := store.create_character(ACC, "Fast")
+	store.grant_choices(ACC, c.id, 3)
+	assert_eq(c.pending_choices, 3)
+	store.take_upgrade(ACC, c.id, 0)
+	assert_eq(c.pending_choices, 2)
+	assert_eq(c.offer.size(), SimConfig.UPGRADE_CHOICES, "and the next three appear")
+
+
+func test_taking_an_upgrade_records_it_and_rerolls_the_table() -> void:
+	var c := store.create_character(ACC, "Taker")
+	store.grant_choices(ACC, c.id, 1)
+	var wanted: StringName = c.offer[1]
+	var taken := store.take_upgrade(ACC, c.id, 1)
+	assert_eq(taken, wanted)
+	assert_eq(c.upgrades, [wanted] as Array[StringName])
+	assert_eq(c.pending_choices, 0)
+	assert_true(c.offer.is_empty(), "nothing pending means nothing on the table")
+
+
+func test_taking_without_a_pending_choice_is_refused() -> void:
+	var c := store.create_character(ACC, "Greedy")
+	assert_eq(store.take_upgrade(ACC, c.id, 0), &"")
+	assert_eq(c.upgrades.size(), 0)
+
+
+## The index arrives from a client, so nonsense has to be a refusal rather than
+## a crash or a free upgrade.
+func test_an_index_outside_the_offer_is_refused() -> void:
+	var c := store.create_character(ACC, "Sneaky")
+	store.grant_choices(ACC, c.id, 1)
+	assert_eq(store.take_upgrade(ACC, c.id, -1), &"")
+	assert_eq(store.take_upgrade(ACC, c.id, 99), &"")
+	assert_eq(c.pending_choices, 1, "and costs nothing")
+
+
+func test_a_dead_character_cannot_spend_a_choice() -> void:
+	var c := store.create_character(ACC, "Late")
+	store.grant_choices(ACC, c.id, 1)
+	store.retire_character(ACC, c.id)
+	assert_eq(store.take_upgrade(ACC, c.id, 0), &"")
+
+
+func test_upgrades_and_pending_choices_survive_a_reload() -> void:
+	var c := store.create_character(ACC, "Persistent")
+	store.grant_choices(ACC, c.id, 2)
+	var taken := store.take_upgrade(ACC, c.id, 0)
+	var offer := c.offer.duplicate()
+
+	var reloaded := CharacterStore.new(store._path)
+	assert_true(reloaded.load_from_disk())
+	var got := reloaded.get_character(ACC, c.id)
+	assert_eq(got.upgrades, [taken] as Array[StringName])
+	assert_eq(got.pending_choices, 1)
+	assert_eq(got.offer, offer,
+		"the table has to survive a restart, or it is a reroll on every crash")
+
+
+## Upgrades change what a character IS, so the roster has to show the real
+## number rather than the one the level alone implies.
+func test_the_roster_health_reflects_the_upgrades_taken() -> void:
+	var c := store.create_character(ACC, "Fragile")
+	var before := c.max_hp()
+	c.upgrades.append(Upgrades.GLASS_CANNON)
+	assert_eq(c.max_hp(), before / 2)
+
+
+## A save written by a build with an upgrade this one lacks must not leave a
+## phantom that counts toward the flat damage bonus and does nothing else.
+func test_an_unknown_upgrade_in_a_save_is_dropped() -> void:
+	var restored := Character.from_dict({
+		"id": "z", "name": "Old", "xp": 0,
+		"upgrades": ["sniper", "telekinesis"],
+		"pending_choices": 2,
+		"offer": ["poison", "not_a_thing"],
+	})
+	assert_eq(restored.upgrades, [Upgrades.SNIPER] as Array[StringName])
+	assert_eq(restored.offer, [Upgrades.POISON] as Array[StringName])
+	assert_eq(restored.pending_choices, 2)