Stop the rate limiter from being its own amplifier

The control-message pacing added two commits ago logged one WARN line
per refused packet, which is a thousand formatted strings and a thousand
stdout writes per second for a client sending a thousand -- the exact
cost the limiter was added to bound, moved from the disk write to the
log. One line per burst now, re-armed when the peer behaves.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/net/server_runtime.gd

@@ -38,6 +38,11 @@ var _snapshot_phase: int = 0
 var _tick: int = 0
 ## Tick each peer was last allowed a control message on.
 var _peer_control_tick: Dictionary[int, int] = {}
+## Peers already told off for going too fast. Without this the refusal logs one
+## line per packet, which turns the limiter into the amplification it exists to
+## prevent -- a client sending a thousand a second would get a thousand lines
+## formatted and written. One line per burst, cleared when the peer behaves.
+var _peer_control_warned: Dictionary[int, bool] = {}
 
 
 func _ready() -> void:
@@ -205,6 +210,7 @@ func _forget_peer(peer_id: int) -> void:
 	peer_accounts.erase(peer_id)
 	peer_characters.erase(peer_id)
 	_peer_control_tick.erase(peer_id)
+	_peer_control_warned.erase(peer_id)
 	_broadcast_roster()
 
 
@@ -427,9 +433,14 @@ func instance_of(peer_id: int) -> Instance:
 func _accept_control(peer_id: int) -> bool:
 	var last: int = _peer_control_tick.get(peer_id, -CONTROL_COOLDOWN_TICKS)
 	if _tick - last < CONTROL_COOLDOWN_TICKS:
-		GameLog.warn("server", "peer %d control message dropped, too fast" % peer_id)
+		if not _peer_control_warned.get(peer_id, false):
+			_peer_control_warned[peer_id] = true
+			GameLog.warn("server",
+				"peer %d is sending control messages faster than %d ticks apart"
+					% [peer_id, CONTROL_COOLDOWN_TICKS])
 		return false
 	_peer_control_tick[peer_id] = _tick
+	_peer_control_warned.erase(peer_id)
 	return true