feat: guard stale reward owner location

Author: MikelCalvo

internal/minimal/shared_world.go

@@ -939,7 +939,7 @@ func (r *sharedWorldRegistry) registerGroundItem(ownerID uint64, ownerLogin stri
 	defer r.mu.Unlock()
 
 	registeredOwner, ok := r.playerCharacter(ownerID)
-	if !ok || characterAtBootstrapHPFloor(registeredOwner) || characterAtBootstrapHPFloor(character) {
+	if !ok || characterAtBootstrapHPFloor(registeredOwner) || characterAtBootstrapHPFloor(character) || !sameGroundRewardOwnerLocation(registeredOwner, character) {
 		return false
 	}
 	if _, exists := r.groundItemsByVID[vid]; exists {
@@ -968,6 +968,10 @@ func (r *sharedWorldRegistry) registerGroundItem(ownerID uint64, ownerLogin stri
 	return true
 }
 
+func sameGroundRewardOwnerLocation(registered loginticket.Character, supplied loginticket.Character) bool {
+	return registered.MapIndex == supplied.MapIndex && registered.X == supplied.X && registered.Y == supplied.Y && registered.Z == supplied.Z
+}
+
 func (r *sharedWorldRegistry) groundItemVisibleToCharacterLocked(ground sharedGroundItem, character loginticket.Character) bool {
 	return r.topology.SharesVisibleWorld(character, loginticket.Character{MapIndex: ground.MapIndex, X: ground.X, Y: ground.Y})
 }

internal/minimal/shared_world_test.go

@@ -459,6 +459,31 @@ func TestSharedWorldRegistryRegisterGroundRewardsRejectsStaleLiveOwnerSnapshotAf
 	}
 }
 
+func TestSharedWorldRegistryRegisterGroundRewardsRejectsStaleOwnerLocationSnapshotAfterOwnerMoves(t *testing.T) {
+	registry := newSharedWorldRegistry()
+	owner := peerVisibilityCharacter("StaleLocationRewardOwner", 0x01030198, 0x02040198, 1200, 2200, 0, 101, 201)
+	ownerID, _ := registry.Join(owner, newPendingServerFrames(), nil)
+	if ownerID == 0 {
+		t.Fatal("expected reward owner join to allocate a shared-world entity id")
+	}
+	movedOwner := owner
+	movedOwner.MapIndex = 42
+	movedOwner.X = 5000
+	movedOwner.Y = 6000
+	movedOwner.Z = 7
+	registry.UpdateCharacter(ownerID, movedOwner)
+
+	if registry.RegisterGroundItem(ownerID, "stale-location-reward-owner", owner, 0x07000019, inventory.ItemInstance{Vnum: 3001, Count: 1}) {
+		t.Fatal("expected stale owner location ground-item registration to fail closed after registered owner moves")
+	}
+	if registry.RegisterGroundGold(ownerID, "stale-location-reward-owner", owner, 0x0700001A, 250) {
+		t.Fatal("expected stale owner location ground-gold registration to fail closed after registered owner moves")
+	}
+	if registry.GroundItemExists(0x07000019) || registry.GroundItemExists(0x0700001A) {
+		t.Fatal("expected rejected stale-location reward ground entries to stay absent")
+	}
+}
+
 func TestSharedWorldRegistryRegisterGroundGoldRejectsExistingVID(t *testing.T) {
 	registry := newSharedWorldRegistry()
 	owner := peerVisibilityCharacter("GoldDropOwner", 0x01030194, 0x02040194, 1200, 2200, 0, 101, 201)

spec/protocol/non-player-reward-bootstrap.md

@@ -119,9 +119,10 @@ Transfer/rebootstrap destination visibility uses the same recipient gate for bot
 Ordinary session position updates that rebuild destination visibility use the same zero-HP gate, so a dead recipient cannot reacquire ground-entry visibility by arriving through a movement/sync-style shared-world update path instead of the structured transfer path.
 Fresh same-socket rebootstrap uses the same guard before building the selected character's trailing ground-entry burst, so a still-dead session cannot reacquire `ITEM_GROUND_ADD` / `ITEM_OWNERSHIP` visibility frames for pending ground rewards merely by re-entering the map while still at the bootstrap `0`-HP floor.
 Ground pickup also skips party-style delivery back into an owner that has since reached the bootstrap `0` HP floor: the ground handle keeps its owner metadata for display/ownership, but the live owner snapshot is withheld so a living collector either takes the item through the ordinary collector path or fails closed on collector capacity without mutating the dead owner's inventory/gold.
+Ground reward registration re-checks the registered owner snapshot before trusting the caller-supplied character copy, so a stale owner snapshot cannot create item-shaped or gold-shaped reward ground entries after the registered owner has already moved to a different runtime location.
 Lookup, pickup-resolution, and removal also re-check the registered collector snapshot before trusting the caller-supplied character copy, so a stale collector snapshot cannot see, resolve, or remove reward ground entries after that collector has already reached the bootstrap `0`-HP floor or moved out of the current ground-item visibility/reachability boundary.
 When that living and currently reachable collector succeeds, the collector receives the ordinary self pickup shape (`ITEM_GROUND_DEL`, inventory `ITEM_SET`, and normal `ITEM_GET` feedback) and the dead owner receives no queued party-style pickup feedback.
-This keeps death/restart cleanup from leaking new pickup surfaces, stale delete noise, debug/runtime-visible pickup affordances, stale collector pickup affordances, transfer-entry ground visibility, or late owner-delivery mutations for players that are already dead.
+This keeps death/restart cleanup and concurrent movement from leaking new pickup surfaces, stale delete noise, debug/runtime-visible pickup affordances, stale collector pickup affordances, stale owner-location ground registration, transfer-entry ground visibility, or late owner-delivery mutations for players that are already dead or no longer at the supplied reward location.
 
 Current rules:
 - each configured drop spawns at the killer's current position