Make character rollbacks impossible

[jaenster]

Players reported characters being rolled back to an older state. The cause was not a race — no deployed game server was writing character saves at all, and the one server that did wrote them under the wrong key. Every character on the live realm read charver=1: created, and never saved since.

The starting state

server	engines	save path
d2gs-native	1.14d (deployed)	cleared the engine's own -nosave flag, nothing replaced it; store.putChar had zero callers
d2host	1.06b–1.10f (deployed)	fpSaveDatabaseCharacter was a stack-balancing stub
d2gs	1.14d wine	implemented — but filed saves under the wrong account whenever its 16-slot join ring had recycled the player

realmd only ever wrote a save on create/copy/import/upgrade, so a login always restored whatever it had last written itself.

The structural fix

Rather than keep making every path above the store careful, the store now refuses to go backwards. realmd:charver becomes a compare-and-set token:

• a load returns the bytes and the version they were at (version read first — the other order lets a save landing between the two reads be overwritten by bytes built from it);
• a save is accepted only while the store is still at that version, with the whole compare-set-increment in one Lua script;
• a version of 0 is accepted whatever the caller expected — that means redis lost its state and was refilled from postgres, where a live session's bytes are the newest thing in existence;
• a refused save is never retried. It is obsolete by definition. Only an unreachable store parks a save.

Character names are realm-unique

Names were unique only within an account, while the seat tables, the retry queue, a departing player's seat release, and the Mac engine's own <charname>.d2s all key on the name alone. Two accounts with a "Bob" is not a rollback but a character swap. Claimed atomically in a charnames table — a table rather than an index on chars, because an index would be built over data that may already contain duplicates and would fail inside the startup schema bootstrap.

Other rollback paths closed

• deleting a character that is in a game — the server holds it and writes it back, resurrecting it, or landing old bytes on a recreated one of the same name;
• releasing a seat by matching a /name suffix over an unordered SMEMBERS, which could free a lock belonging to somebody still playing;
• a leave now carries the account, so the seat is named rather than guessed;
• the save-retry queue keyed by name alone, carried no fence, and had no age bound;
• d2gs-native uploaded the previous session's .d2s on rejoin (clearFile only ran in file mode);
• patch.zig dropped poisoned in skip()/rewind(), so a chain that had already refused an expect() still wrote.

Continuous saving

1.14d drops from 8192 game frames (~5.5 min) to 512 (~20s) by patching two immediates in UpdateClients. The pre-1.14 engines find the same site by its constant rather than by address — 0x80001fff is the signed-modulo-8192 idiom and nothing else in a game engine holds that number — and require exactly one match, refusing rather than guessing. All ten shipped D2Game.dll files have exactly one, in both encodings, with the fixup always at +7.

joinctx moves to packages/gs-seats, shared by all three servers, which previously had one table, another table, and none.

Verification

Run on the real engines under wine, not argued from source:

• the interval patch applies on all six engines (D2Game.dll autosaves every 512 frames (~20s), was 8192);
• a real client reaches a world on 1.14d and its charver climbs 1 → 2 → 3, the save landing ~21s after the fetch;
• a save replayed at a superseded version is refused (-4), version unchanged, character bytes intact.

282 unit tests (from 226) and 43/43 e2e, including new save_fence, realm_unique_names, save_account_key and delete_in_game scenarios.

The e2e suite used to fail about one run in two: pg_isready answers from the temporary server postgres runs during first-boot initdb, which listens on a unix socket while docker has already published the port. It now waits for a query over TCP — 27 consecutive clean runs.

Note on the first commit

6daf188 carries uncommitted 1.13c work that was already in the working tree (cooperative drive model, D2Net drain reporting). It is committed separately so this change is readable on its own, but apps/d2host/main.zig interleaves the two and could not be split cleanly. Drop that commit if it belongs elsewhere.