fix(server): bound tick work and preserve linked lighting

[zoeyrose]

Summary

Address the locally confirmed sources of expensive Classic server ticks investigated in #566: synchronous password derivation, clustered map expiry, celestial keyframe work, and repeated or incomplete local-light rebuilds.

Implementation / behavior

• Revalidate live access admission before asynchronous account completion; retain bounded completed results while the access store is busy, under their original deadlines. Access admission itself also retains completed jobs on BUSY, and expired login jobs cannot revive a session.
• Run password verification/creation in two workers with eight queued slots. Keep account/socket ownership, credential and permission revalidation, and durable commits on the main thread; fence stale results and cleanse secrets on cancellation/shutdown.
• Limit ordinary expiry to one swap attempt per tick, with FIFO scheduling, occupancy/reentry cancellation and bounded retry backoff. Shutdown retains complete synchronous flushing.
• Calculate next-hour celestial fields incrementally with a 2 ms budget and bounded reservations. Publish complete endpoints, promote ready fields, preserve synchronous current fallback, and refresh neighboring MAP2 endpoints when they complete.
• Skip unchanged geometry and batch multipart updates. Rebuild incoming scalar/RGB contributions correctly, bound resolver reach for reciprocal equal-sized maps, and retain complete fallback for other layouts. Repair unload/backlink changes and flush before emitter mutations.
• Add account, worker, QUIC, expiry, lighting and MAP2 regressions, plus opt-in performance fixtures.

Validation

Integrated qualification applies to head d79a42abc2d34ea40e1e9209e6daa32e1bc3c0e9 against current main at f7da19591ce104ae27d52dbd5ba7cce9a835505f, including the book-writing integration:

• Debug and Release: 64/64 tests each.
• Address/undefined-behavior sanitizers and dedicated leak check: 65/65.
• Coverage: 64/64; gcovr: 76.2% lines, 86.3% functions, 49.2% branches.
• Independently reviewed authentication/access admission, deadline/cancellation, exploration integration, and Windows fixture/format portability. The book-writing merge received an independent integration review; account, async authentication, book editing, Python books, lighting and expiry tests passed.
• Imported-history verification and whitespace/conflict checks passed.

Sequential Release smoke on the previously qualified head 686b91d7, in the current pinned build image: all 517/517 route moves across 14 maps completed; worst main stage 21.606 ms, MAP2 p95 4.827 ms. Expiry swapped one map per tick. City lighting retained 320/320 exact rebuild comparisons; 1,000 unchanged-floor updates took 0.099 ms. These fresh timings are separate from the earlier same-image comparison below.

Earlier same-image optimized comparisons of original 6bd367ac versus reviewed da7a369a retain their measured source identities. They are not measurements of the newly integrated head. These used the same digest-pinned Classic build image, with fresh synthetic state and public content@main Classic-target inputs:

Workload	Original	Proposed
1,000 unchanged-floor updates	734.797 ms	0.100 ms
517-step, 14-map torch route: worst main stage	140.840 ms	22.333 ms
Route MAP2 p95	6.156 ms	4.328 ms
16-map city lighting stability	204 changed cells on first rebuild	320/320 exact comparisons

At the expiry burst, the original swapped ten maps in one stage; the proposed code swapped one. End-of-route residency differs (30 resident/18 swapped versus 37/11), so these stage times do not represent equal amounts of completed expiry work.

Limitations / follow-up

• Durable saves remain synchronous. Single saves, cold current-field calculation and complete fallback on irregular/narrow maps can still be expensive; this does not guarantee a hard tick deadline.
• Correctness adds cold-load overhead: route load median increased from 1.744 to 2.641 ms; overall Release asset validation increased from 21.88 to 26.24 seconds.
• Loopback QUIC tests prove keepalive and normal MOVE/MAP2 service while authentication is held pending, then verify a real hash after release. They do not measure latency under actual Argon2 CPU contention.
• The route fixture has the same zero-speed torch diagnostic on both revisions; source radius and successful traversal are asserted. No GUI/GPU or deployed-server reproduction is claimed.
• The original multi-second storage incident remains unattributed. This PR does not deploy changes or close that investigation.

Refs #566.

[codecov]

Codecov Report

❌ Patch coverage is 74.14773% with 364 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
server/src/server/content_benchmark.c	1.57%	183 Missing and 4 partials ⚠️
server/src/server/account.c	77.59%	17 Missing and 37 partials ⚠️
server/src/server/celestial_light.c	85.75%	23 Missing and 31 partials ⚠️
server/src/server/light.c	88.77%	8 Missing and 25 partials ⚠️
server/src/server/auth_worker.c	86.45%	14 Missing and 7 partials ⚠️
server/src/server/swap.c	88.88%	1 Missing and 4 partials ⚠️
server/src/server/main.c	50.00%	4 Missing ⚠️
server/src/server/access_server.c	87.50%	1 Missing and 2 partials ⚠️
server/src/socket/server.c	66.66%	0 Missing and 2 partials ⚠️
server/src/plugins/plugin_python/atrinik_object.c	75.00%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[zoeyrose]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T01:13:04.770923Z	d79a42a	Manual request
🔒 Security Review	✅ Completed 2026-10-09T01:14:24.510029Z	d79a42a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 686b91d7ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 686b91d7ec

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[zoeyrose]

Reviewed the informational coverage report. Its largest gap is 183 missing lines in the opt-in content_benchmark.c diagnostics, exercised separately by the qualified Release smoke runs: 517/517 route moves, 320/320 exact city rebuild comparisons, and 1,000 unchanged-floor updates. Those runs are outside the instrumented coverage suite.

The instrumented suite passed 62/62 tests (75.6% lines, 48.9% branches). Focused regressions cover auth/access admission, revocation, BUSY retries, deadlines, cancellation/shutdown, expiry, and lighting/MAP2 correctness. The report still records remaining unexercised and partial branches; full branch coverage is not claimed.

[zoeyrose]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: d79a42abc2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: d79a42abc2

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.