Bound what one packet can cost, and stop the hub eating its own loot

Selecting a character rewrote the entire store to disk, re-placed the
player, re-streamed its map chunks and broadcast a roster to everyone --
off one small reliable packet, at whatever rate a client cared to send.
Repeating a selection you already hold now answers yes and stops, and
select/create are paced per peer. Item moves and experience grants, the
two paths a client can trigger every tick, mark the store dirty and the
server flushes once per tick instead of once per event.

That flush also fixes experience quietly not being saved: grant_xp only
wrote when a level was crossed, and level is DERIVED from lifetime xp, so
the number nobody was keeping was the only number there is. A restart
rolled a character back to its last level-up.

The emergency escape ran in the hub, where completing it means
transferring into the instance you are already in: teleported to spawn,
healed to full, instanced loot dropped, every map chunk re-streamed, once
a second for as long as the key is held. The hub now opts out.

Ground loot evicts the oldest item when the floor fills. That is right
for a dungeon, which closes and takes its litter with it, and wrong for
the hub, which never closes -- a player dropping into a full floor
destroyed whatever someone else had left there longest, and drop is
edge-triggered per tick. A player's drop is refused instead; the world's
own drops still make room.

Also: a linkdead body is not in inst.peers, so closing a CLEARED dungeon
walked past it and left that peer's account and name in the dictionaries
forever -- with the new one-account guard, enough to lock someone out of
their own session. And several encoders wrote mini(size, 255) as a count
and then looped the whole array, which puts records after the count on
the wire; MAX_CLIENTS makes it unreachable, which is why it would have
survived to the day it was not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/net/server_runtime.gd

@@ -24,8 +24,20 @@ var store: CharacterStore = null
 var peer_chunks: Dictionary[int, Dictionary] = {}
 var lobby: Instance
 
+## Ticks a peer must wait between control messages. Selecting or creating a
+## character rewrites the whole store to disk, re-places the player (which wipes
+## its map-chunk record and re-streams the neighbourhood), and broadcasts a
+## roster to every peer on the server -- all off one small reliable packet.
+## Unrated, one client could hold the server in a synchronous JSON write. A
+## quarter of a second is far under anything a person clicks deliberately.
+const CONTROL_COOLDOWN_TICKS := 15
+
 var _next_instance_id: int = SimConfig.LOBBY_INSTANCE_ID
 var _snapshot_phase: int = 0
+## Server clock, in physics ticks. Only used to pace the control messages above.
+var _tick: int = 0
+## Tick each peer was last allowed a control message on.
+var _peer_control_tick: Dictionary[int, int] = {}
 
 
 func _ready() -> void:
@@ -49,6 +61,7 @@ func _take_instance_id() -> int:
 
 
 func _physics_process(_delta: float) -> void:
+	_tick += 1
 	_snapshot_phase += 1
 	var send_snapshot := _snapshot_phase % SimConfig.SNAPSHOT_INTERVAL == 0
 	var closing: Array[int] = []
@@ -79,6 +92,12 @@ func _physics_process(_delta: float) -> void:
 	for id in closing:
 		_close_dungeon(id)
 
+	# One write per tick at most, however many item pickups and experience
+	# grants the tick produced. Everything that defers is bounded here; the
+	# paths that matter more (a character created, retired, or levelled) still
+	# write the moment they happen.
+	store.flush()
+
 
 ## Split the tick's events into the ones clients need and the ones only the
 ## server acts on (escape completion, portal use, respawn requests).
@@ -185,6 +204,7 @@ func _forget_peer(peer_id: int) -> void:
 	peer_chunks.erase(peer_id)
 	peer_accounts.erase(peer_id)
 	peer_characters.erase(peer_id)
+	_peer_control_tick.erase(peer_id)
 	_broadcast_roster()
 
 
@@ -270,6 +290,16 @@ func on_select_character(peer_id: int, character_id: String) -> void:
 		Net.send_select_result(peer_id, Protocol.SelectResult.NOT_IN_HUB,
 			"you can only change character in the hub")
 		return
+	# Already playing this one, and already where a swap would put you. Answering
+	# yes and stopping is not just an optimisation: the full path rewrites the
+	# store, re-places the player and re-streams its map, so a client that simply
+	# repeats its own selection was free work for the asking.
+	if peer_characters.get(peer_id, "") == character_id and here != null:
+		Net.send_select_result(peer_id, Protocol.SelectResult.OK, "")
+		_send_characters(peer_id)
+		return
+	if not _accept_control(peer_id):
+		return
 	var c := store.get_character(account, character_id)
 	if c == null:
 		Net.send_select_result(peer_id, Protocol.SelectResult.NO_SUCH_CHARACTER, "no such character")
@@ -293,6 +323,8 @@ func on_create_character(peer_id: int, character_name: String) -> void:
 		Net.send_select_result(peer_id, Protocol.SelectResult.NOT_IN_HUB,
 			"you can only change character in the hub")
 		return
+	if not _accept_control(peer_id):
+		return
 	var c := store.create_character(account, character_name)
 	if c == null:
 		Net.send_select_result(peer_id, Protocol.SelectResult.LIMIT_REACHED,
@@ -389,6 +421,18 @@ func instance_of(peer_id: int) -> Instance:
 	return instances.get(id)
 
 
+## Whether [param peer_id] may spend a control message this tick, recording it
+## if so. Silent when it refuses: there is no SelectResult for "too fast", and a
+## dropped message at this rate can only come from a client that is not a menu.
+func _accept_control(peer_id: int) -> bool:
+	var last: int = _peer_control_tick.get(peer_id, -CONTROL_COOLDOWN_TICKS)
+	if _tick - last < CONTROL_COOLDOWN_TICKS:
+		GameLog.warn("server", "peer %d control message dropped, too fast" % peer_id)
+		return false
+	_peer_control_tick[peer_id] = _tick
+	return true
+
+
 ## The peer currently signed in as [param account], or 0 for none.
 ##
 ## A peer that dropped inside a dungeon still counts while its linkdead body is
@@ -521,6 +565,17 @@ func _close_dungeon(id: int) -> void:
 		return
 	for peer in inst.peers.duplicate():
 		_transfer(peer, lobby)
+	# A linkdead body is not in inst.peers, so the loop above walks straight past
+	# it. The empty-instance path checks has_linkdead() and waits; the CLEARED
+	# path does not, so a party that killed the boss with one member disconnected
+	# left that peer's account, name and instance id in the dictionaries with no
+	# instance to resolve -- invisible, permanent, and enough to keep the account
+	# locked out of its own session by the one-account guard.
+	for p in inst.world.players.values():
+		if p.linkdead:
+			GameLog.info("server", "peer %d released with instance %d as it closed"
+				% [p.peer_id, id])
+			_forget_peer(p.peer_id)
 	instances.erase(id)
 	GameLog.info("server", "closed dungeon instance %d" % id)
 
@@ -579,7 +634,10 @@ func _persist_inventory(inst: Instance, peer_id: int) -> void:
 	var p: SimPlayer = inst.world.players.get(peer_id)
 	if p == null:
 		return
-	store.set_inventory(account, character_id, p.inventory)
+	# Deferred: a client can produce an item action every tick, and each one used
+	# to re-serialise every account on the server. ServerRuntime flushes once at
+	# the end of the tick.
+	store.set_inventory(account, character_id, p.inventory, true)
 
 
 func _grant_xp(peer_id: int, amount: int) -> void: