You were right, and the cause was worse than it looked.

When two of you are on a map, one player's game acts as the host — it is the copy that actually kills the creature and decides who owns the loot. Every hit the other player lands gets sent over to that host. The message carrying your hits lost the name of who threw them, so the host read all your damage as its own, concluded it had done all the work, and stamped itself as the owner. Owned drops are locked to their owner for thirty seconds, which is why John could pick them up and you could not.

Vesos looked like the only casualty for two reasons. Almost every creature drops them, so the locked bag was there every single kill — and it lands exactly where the creature died, right in the middle of the pile, so it also swallowed your pickup key press and nothing else in the pile got tried. The etc items you could still pick up were your own quest drops, rolled on your own machine, which never belonged to anyone else. That is why they were the one thing that kept working.

Since the first fix I have closed the two things it left open. Ownership is no longer decided by the host's browser at all — the server now counts every hit itself and overrules a wrong owner, so a player on a stale page can no longer take your loot. And party members can now pick up each other's drops immediately, the way the real game works.

What to re-test: both hard-refresh first. Non-host does all the killing while the host stands well clear — vesos, etc drops, experience, quest kill count and monster cards should all land on the killer, and the host should be locked out for thirty seconds. Then swap roles. Then party up and confirm there is no wait at all.

Expect one change that is not a bug: a host standing idle next to you no longer earns experience from your kills. That is the fix working. Boss loot on Zakum and Horntail is also now open to everyone present, which is authentic.

Still not done: no live two-player run yet, and the thirty-second lock is twice the original game's fifteen — that is a deliberate house rule we set, and worth a decision.

Closing this — confirmed with two players. The v43 test run verified that whoever lands the killing blow gets the vesos, exp, quest kills and monster cards rather than the other player, that both players can see and pick up each other's drops, and that two players cannot both pick up the same drop. All passed. The one thing still worth a decision rather than a fix: our ownership lock is thirty seconds where the original game used fifteen. That is a house rule we chose, not a bug — say the word if you want it moved to fifteen.

Two follow-ups, no status change. The loot ownership window is now 15 seconds rather than 30 — 15 is the original game's figure and you asked for authentic. Separately, while working through the two-player queue we found the monster name and level tags only drew for monsters a REMOTE player hit, never ones you hit yourself, so your own kills looked untagged. Both shipped. Nothing here changes who owns a drop; that stayed exactly as you confirmed it.