Hide dead characters, suggest names, make the XP bar live

The roster sent to clients now contains living characters only. Retirement stays
server-side bookkeeping for archival; from the player's side a dead character is
simply gone, and listing it offers a choice that cannot be taken.

The XP bar only moved on a level-up or a character swap because it read the
character roster, which is re-sent only when the SET of characters changes.
Experience now rides the snapshot -- four bytes on a message already going out
at 20Hz -- and the server mirrors each grant into the world immediately rather
than only when a level is crossed.

The create field starts with a suggested name instead of blank, and offers
another after each creation.

Two bugs found while testing, both mine:

The first was a bad patch of my own: a change meant for the snapshot decoder
also matched inside decode_characters, which then read a four-byte field its
encoder never wrote and ran off the end of every packet. This is precisely the
"encodes but decodes wrong" failure the codec tests exist to catch, and it was
caught within a minute of the test being written.

Chasing that exposed a real robustness gap: StreamPeerBuffer.get_utf8_string()
pushes an engine error and returns garbage when the buffer is short, so a
truncated or hostile character/roster packet produced error spam instead of
degrading. Both decoders now bounds-check every field, with tests that slice
each packet at many lengths and assert it degrades rather than inventing
entries -- the same guarantee the input decoder already had.

206 tests. check.sh, test.sh, smoke.sh and both diagnostics pass.

src/net/client_runtime.gd

@@ -44,6 +44,9 @@ var my_hp: int = SimConfig.PLAYER_MAX_HP
 ## Follows the character's level, so the HUD bar cannot be computed from a
 ## constant.
 var my_max_hp: int = SimConfig.PLAYER_MAX_HP
+## Lifetime experience, straight from the snapshot so the bar moves per kill
+## rather than per roster message.
+var my_total_xp: int = 0
 var my_alive: bool = true
 var my_escape: float = 0.0
 var my_escaping: bool = false
@@ -364,6 +367,7 @@ func _reconcile(rec: Dictionary) -> void:
 	my_spawn_grace = (int(rec["flags"]) & Protocol.F_SPAWN_GRACE) != 0
 	my_escape = float(rec["escape"])
 	my_respawn_wait = float(rec["respawn_wait"])
+	my_total_xp = int(rec["total_xp"])
 	if my_alive:
 		request_respawn = false
 	hud_dirty.emit()

src/net/net_codec.gd

@@ -69,6 +69,10 @@ static func encode_snapshot(world: SimWorld,
 		# wasteful -- but it is four bytes, and the alternative is a separate
 		# message plus the join-ordering bug where someone arrives before it.
 		b.put_u32(p.colour.to_rgba32())
+		# Experience rides the snapshot rather than waiting for a roster
+		# message: the bar has to move on every kill, and the roster is only
+		# re-sent when the set of characters actually changes.
+		b.put_u32(maxi(p.total_xp, 0))
 
 	var live_enemies: Array[SimEnemy] = []
 	for e in world.enemies.values():
@@ -125,6 +129,7 @@ static func decode_snapshot(data: PackedByteArray) -> Dictionary:
 			"respawn_wait": float(b.get_u8()) / 10.0,
 			"last_input_tick": b.get_u32(),
 			"colour": Color.hex(b.get_u32()),
+			"total_xp": b.get_u32(),
 		})
 
 	var ecount := b.get_u16()
@@ -317,11 +322,16 @@ static func decode_roster(data: PackedByteArray) -> Array[Dictionary]:
 	b.data_array = data
 	var count := b.get_u8()
 	for _i in count:
-		# get_utf8_string reads its own length prefix, so a truncated packet
-		# yields empty strings rather than reading off the end.
+		if b.get_available_bytes() < 4:
+			break
+		var peer := b.get_u32()
+		var display := _safe_utf8(b)
+		# kind, instance, alive.
+		if b.get_available_bytes() < 1 + 4 + 1:
+			break
 		out.append({
-			"peer": b.get_u32(),
-			"name": b.get_utf8_string(),
+			"peer": peer,
+			"name": display,
 			"kind": b.get_u8(),
 			"instance": b.get_u32(),
 			"alive": b.get_u8() == 1,
@@ -386,6 +396,24 @@ static func encode_characters(chars: Array[Character], selected: String) -> Pack
 	return b.data_array
 
 
+## Length-prefixed string read that refuses to run off the end.
+##
+## StreamPeerBuffer.get_utf8_string() reads a length and then that many bytes,
+## and pushes an engine error if the buffer is short -- so a truncated or
+## hostile packet turns into error spam plus a garbage value. Returns an empty
+## string and leaves the cursor at the end instead, which callers detect via
+## get_available_bytes().
+static func _safe_utf8(b: StreamPeerBuffer) -> String:
+	if b.get_available_bytes() < 4:
+		b.seek(b.get_size())
+		return ""
+	var length := b.get_u32()
+	if length > b.get_available_bytes():
+		b.seek(b.get_size())
+		return ""
+	return b.get_data(length)[1].get_string_from_utf8() if length > 0 else ""
+
+
 ## Returns { "selected": String, "characters": Array[Dictionary] }.
 static func decode_characters(data: PackedByteArray) -> Dictionary:
 	var out: Array[Dictionary] = []
@@ -394,14 +422,21 @@ static func decode_characters(data: PackedByteArray) -> Dictionary:
 	var b := StreamPeerBuffer.new()
 	b.big_endian = false
 	b.data_array = data
-	var selected := b.get_utf8_string()
+	var selected := _safe_utf8(b)
+	if b.get_available_bytes() < 1:
+		return {"selected": selected, "characters": out}
 	var count := b.get_u8()
+	# Bytes each entry needs after its two strings: level, xp, progress,
+	# max_hp, active, colour.
+	var fixed := 1 + 4 + 1 + 2 + 1 + 4
 	for _i in count:
-		if b.get_available_bytes() <= 0:
+		var id := _safe_utf8(b)
+		var display := _safe_utf8(b)
+		if id.is_empty() or b.get_available_bytes() < fixed:
 			break
 		out.append({
-			"id": b.get_utf8_string(),
-			"name": b.get_utf8_string(),
+			"id": id,
+			"name": display,
 			"level": b.get_u8(),
 			"xp": b.get_u32(),
 			"progress": float(b.get_u8()) / 255.0,

src/net/server_runtime.gd

@@ -222,8 +222,11 @@ func _send_characters(peer_id: int) -> void:
 	var account: int = peer_accounts.get(peer_id, AuthProvider.NO_ACCOUNT)
 	if account == AuthProvider.NO_ACCOUNT:
 		return
+	# Living characters only. Retirement is bookkeeping for the server's own
+	# archive -- from the player's side a dead character is simply gone, and
+	# listing it would offer a choice that cannot be taken.
 	Net.send_characters(peer_id, NetCodec.encode_characters(
-		store.characters_for(account), peer_characters.get(peer_id, "")))
+		store.active_characters(account), peer_characters.get(peer_id, "")))
 
 
 func on_select_character(peer_id: int, character_id: String) -> void:
@@ -439,6 +442,16 @@ func _grant_xp(peer_id: int, amount: int) -> void:
 	if account == AuthProvider.NO_ACCOUNT or character_id.is_empty():
 		return
 	var levels := store.grant_xp(account, character_id, amount)
+	var earned := store.get_character(account, character_id)
+	if earned == null:
+		return
+	# Mirrored into the world every grant, not only on a level-up, so the bar
+	# tracks each kill.
+	var here := instance_of(peer_id)
+	if here != null:
+		var mine: SimPlayer = here.world.players.get(peer_id)
+		if mine != null:
+			mine.total_xp = earned.total_xp
 	if levels <= 0:
 		return
 	# A level raises max health immediately, and heals by the amount gained --