Close three holes an unmodified client could walk through

One account is now one session. Two peers signed in as the same account
each got their own player built from the SAME character record, so both
held a copy of one bag and whichever wrote last won: drop the single
potion from both copies and two potions hit the floor. Reconciling two
live mirrors of one record cannot be made to work, so the handshake
refuses the second connection -- the newcomer, not the incumbent, or
claiming an account would be a way to kick anyone off the server.

A muzzle offset is a teleport and the bullet pool never sees it: it
samples geometry once per tick. Forward that is 19px, but Doubleshot
adds up to 45px sideways, wider than a 32px wall plus the 6px hitbox
holding you off it. Six Doubleshots, stand flush against a wall, fire
along it, and live shots came out the far side. Shots now start from the
shooter when geometry stands in the way, which keeps the count honest.

Bullet-spawn events carry the firing actor's exact position, and they
were filtered by a flat 2900-unit radius against an 800-unit actor cull.
A depth-1 map's diagonal is about 2521, so that radius culled nothing:
every enemy that fired was pinpointed for every player, through fog, on
terrain the client was deliberately not streamed. The test is now
per bullet -- can THIS one reach ground you can see -- which keeps the
guarantee the wide radius existed for and drops the radar.

Found while fixing the above: a rejection never reached the client. The
RPC is queued and only leaves on the frame's flush, so kicking in the
same call threw the reason away, and _on_server_disconnected overwrote
last_error anyway. Both were true of protocol mismatch too, which is the
one message a player most needs. Smoke asserts the reason arrives.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_interest.gd

@@ -112,3 +112,75 @@ func test_no_stack_of_upgrades_can_outrun_the_bullet_radius() -> void:
 	var travel := PlayerStats.build(ids).bullet_speed \
 		* float(SimConfig.PLAYER_BULLET_LIFETIME) * SimConfig.TICK_DELTA
 	assert_gte(SimConfig.BULLET_INTEREST_RADIUS, travel + SimConfig.FOG_VIEW_RADIUS)
+
+
+# --- Per-bullet interest ----------------------------------------------------
+# The radius tests above pin the CEILING: no bullet in the game may need more
+# than BULLET_INTEREST_RADIUS. These pin the rule that actually runs, which asks
+# whether a particular bullet can reach ground this player can see. The two are
+# different questions, and only the second one closes the leak: a spawn event
+# carries the firing actor's exact position, so anything sent on the strength of
+# a flat radius is an enemy located for a modified client.
+
+func _server() -> ServerRuntime:
+	# Not added to the tree on purpose: _ready() would build a lobby and load a
+	# character store, and none of that is involved in an interest decision.
+	return autofree(ServerRuntime.new()) as ServerRuntime
+
+
+func test_a_slow_bullet_fired_across_the_map_is_not_announced() -> void:
+	var srv := _server()
+	var slow := Vector2(120.0, 0.0)   # 120 u/s for 60 ticks reaches 120 units
+	assert_false(srv._bullet_concerns(Vector2.ZERO, Vector2(2000.0, 0.0),
+		slow, 0.0, 60),
+		"it expires 1400 units short of anything this player can see")
+
+
+func test_a_bullet_that_can_reach_visible_ground_is_announced() -> void:
+	var srv := _server()
+	var fast := Vector2(900.0, 0.0)   # 900 u/s for 90 ticks reaches 1350
+	assert_true(srv._bullet_concerns(Vector2.ZERO, Vector2(1500.0, 0.0),
+		fast, 0.0, 90),
+		"1350 of travel plus the fog radius covers 1500, so it must be sent")
+
+
+func test_the_horizon_is_travel_plus_what_the_player_can_see() -> void:
+	var srv := _server()
+	# A bullet whose entire travel lands exactly on the edge of sight.
+	var speed := 600.0
+	var life := 60
+	var reach := Movement.bullet_reach(speed, 0.0, life)
+	var vel := Vector2(speed, 0.0)
+	assert_true(srv._bullet_concerns(Vector2.ZERO,
+		Vector2(reach + SimConfig.FOG_VIEW_RADIUS - 1.0, 0.0), vel, 0.0, life))
+	assert_false(srv._bullet_concerns(Vector2.ZERO,
+		Vector2(reach + SimConfig.FOG_VIEW_RADIUS + 1.0, 0.0), vel, 0.0, life))
+
+
+func test_acceleration_counts_toward_the_reach() -> void:
+	var srv := _server()
+	var at := Vector2(1200.0, 0.0)
+	var vel := Vector2(200.0, 0.0)
+	assert_false(srv._bullet_concerns(Vector2.ZERO, at, vel, 0.0, 90),
+		"200 u/s for 1.5s is 300 units; nowhere near")
+	assert_true(srv._bullet_concerns(Vector2.ZERO, at, vel, 900.0, 90),
+		"the same shot accelerating gets there, so it has to be announced")
+
+
+func test_no_enemy_in_the_content_leaks_its_position_across_a_dungeon() -> void:
+	# The regression this all exists for. A depth-1 map is 2112x1376 units, so
+	# its diagonal is about 2521 -- less than BULLET_INTEREST_RADIUS. Under the
+	# flat radius every firing enemy anywhere on the floor was announced to
+	# everyone, whatever the fog or the actor cull said.
+	var srv := _server()
+	var diagonal := Vector2(66.0, 43.0).length() * MapGrid.TILE
+	assert_lt(diagonal, SimConfig.BULLET_INTEREST_RADIUS,
+		"if this stops being true the flat radius was not the bug described here")
+	var leaked: Array[String] = []
+	for id in Content.ALL_ENEMIES:
+		for e in Content.enemy(id).emitters:
+			if srv._bullet_concerns(Vector2.ZERO, Vector2(diagonal, 0.0),
+					Vector2(e.speed, 0.0), 0.0, e.lifetime):
+				leaked.append("%s (%.0f u/s x %d ticks)" % [id, e.speed, e.lifetime])
+	assert_eq(leaked, [] as Array[String],
+		"an enemy firing at the far corner of the map must not be announced")

tests/unit/test_map_grid.gd

@@ -102,3 +102,33 @@ func test_standing_inside_a_wall_can_still_see_out() -> void:
 	var inside := grid.tile_centre(0, 0)
 	var outside := grid.tile_centre(1, 1)
 	assert_true(grid.has_line_of_sight(inside, outside))
+
+
+## bullet_path_clear differs from has_line_of_sight in two ways that matter, and
+## both are easy to get wrong: it consults BLOCKS_BULLET (so a barricade stops
+## it and a pit does not), and the destination tile counts.
+func test_a_bullet_path_is_blocked_by_what_stops_bullets_not_by_what_stops_sight() -> void:
+	var a := grid.tile_centre(1, 4)
+	var b := grid.tile_centre(8, 4)
+	assert_true(grid.bullet_path_clear(a, b), "clear floor between them")
+
+	grid.set_tile(4, 4, MapGrid.Kind.PIT)
+	assert_true(grid.bullet_path_clear(a, b), "bullets fly over a pit")
+
+	grid.set_tile(4, 4, MapGrid.Kind.BARRICADE)
+	assert_false(grid.bullet_path_clear(a, b),
+		"you can SEE over a barricade, which is exactly why sight is the wrong test")
+	assert_true(grid.has_line_of_sight(a, b), "and sight still passes it")
+
+	grid.set_tile(4, 4, MapGrid.Kind.WALL)
+	assert_false(grid.bullet_path_clear(a, b), "a wall stops both")
+
+
+func test_a_bullet_path_ending_inside_a_wall_is_refused() -> void:
+	var from := grid.tile_centre(1, 4)
+	grid.set_tile(2, 4, MapGrid.Kind.WALL)
+	assert_false(grid.bullet_path_clear(from, grid.tile_centre(2, 4)),
+		"the destination counts: a muzzle inside a wall is the case this rules out")
+	# Sight deliberately does the opposite -- shooting at something embedded in
+	# a wall must still resolve -- so the two must not be collapsed into one.
+	assert_true(grid.has_line_of_sight(from, grid.tile_centre(2, 4)))

tests/unit/test_server_authority.gd

@@ -251,3 +251,58 @@ func test_spawn_grace_expires() -> void:
 	assert_false(p.invulnerable())
 	_drive(1, Vector2.ZERO, InputFrame.BTN_FIRE)
 	assert_eq(world.pool.live_count, 1, "the gun comes back once grace ends")
+
+
+## A muzzle offset moves a bullet's birthplace away from its shooter, and the
+## bullet pool samples geometry once per tick so it never sees that jump. With
+## six Doubleshots the sideways offset reaches 45px -- wider than a 32px wall
+## plus the 6px hitbox that holds you off it -- so standing flush against a wall
+## and firing along it put live shots down the far side. No modified client
+## needed, which is what made it worth a test rather than a comment.
+func _wall_at_column(column: int) -> SimWorld:
+	var g := MapGrid.new(10, 6, MapGrid.Kind.FLOOR)
+	for ty in 6:
+		g.set_tile(column, ty, MapGrid.Kind.WALL)
+	var w := SimWorld.new(1)
+	w.set_map(g)
+	return w
+
+
+func _fire_flush_against_the_wall(doubleshots: int) -> Dictionary:
+	var w := _wall_at_column(4)
+	var p := w.add_player(PEER, "tester")
+	var face: float = w.map.origin.x + 4.0 * MapGrid.TILE
+	p.pos = Vector2(face - SimConfig.PLAYER_RADIUS, w.map.tile_centre(3, 3).y)
+	p.aim = -PI / 2.0   # along the wall, not into it
+	p.spawn_grace = 0
+	p.fire_cooldown = 0
+	var ids: Array[StringName] = []
+	for _i in doubleshots:
+		ids.append(Upgrades.DOUBLESHOT)
+	p.stats = PlayerStats.build(ids)
+
+	w._fire_player_shot(p)
+	var fired := 0
+	var past := 0
+	for i in w.pool.high_water:
+		if w.pool.alive[i] == 0:
+			continue
+		fired += 1
+		if w.pool.pos[i].x > face:
+			past += 1
+	return {"fired": fired, "past_the_face": past}
+
+
+func test_no_stack_of_upgrades_can_put_a_shot_through_a_wall() -> void:
+	for doubleshots in [0, 5, 6, 10]:
+		var r := _fire_flush_against_the_wall(doubleshots)
+		assert_eq(int(r["past_the_face"]), 0,
+			"%d Doubleshot(s) put %d shot(s) on the far side of the wall"
+				% [doubleshots, r["past_the_face"]])
+
+
+func test_clamping_the_muzzle_does_not_swallow_the_shot() -> void:
+	# The fix must not silently reduce your firepower for standing near cover:
+	# a blocked muzzle falls back to the shooter's centre, it does not cancel.
+	assert_eq(int(_fire_flush_against_the_wall(6)["fired"]), 7,
+		"six Doubleshots is seven projectiles, wall or no wall")