[Taure]

Five issues on the zone tick hot path, measured before and after on one machine.

asobi#558 - -- on entity keys, every tick

sync_spatial_grid/3 derived removals with maps:keys(Old) -- maps:keys(New). -- is O(N*M), so with a spatial grid configured a zone holding N entities paid O(N^2) key comparisons every tick to almost always produce []. Profiled on an inert 2,000-entity zone, erlang:'--'/2 was 13.4% of the whole tick at ~498us a call. A fold with is_map_key/2 is O(N). Tick wall time at 2,000 entities: 1,533us -> 910us.

asobi#559 - the zone manager was on the per-tick path

Every occupied zone cast touch_zone at the manager on every tick, and the manager rebuilt a map per cast. At tick_rate = 50 that is 20 casts/sec/zone through the one gen_server that also answers ensure_zone/2 on the join and NPC-crossing path, where the crossing budget is 1s and a timeout costs the crossing.

Stamps move to a public ETS table zones write directly; the reap sweep selects expired coords out of it. The cast stays for a zone started outside a manager. The write is guarded: the table dies with the manager, and the instance supervisor stops the manager before the zones, so an unguarded ets:insert would turn every world teardown into a burst of badarg crashes.

asobi#560 - the ticker copied the whole zone table every tick

It asked the manager for the active set on every tick and got ets:tab2list/1 back, plus a gen_server call when the manager was addressed by pid. The ticker now owns the set: the manager pushes a zone in when it opens, and the ticker monitors it, so a reaped or crashed zone drops out on its own DOWN - which is the self-healing the old partition-against-the-list gave for free. hot/cold become maps, retiring the per-tick lists:uniq/1.

With #559, the zone manager is off the tick path entirely.

asobi#561 - cold_tick_divisor = 0

An idle zone is not ticked at all. Nothing has to be caught up on warm-up, and that is a property of zone_idle/1 rather than an omission: a zone is only demoted when its timer wheel and respawn queue are both empty, and both are driven by the wall clock the resumed tick passes them.

A zone with subscribers now declines reap and re-stamps. Mostly a statement of emergent behaviour, but it also closes a real race at every divisor: release_zone/2 backdates the stamp the moment a zone empties, and a sweep landing before the next re-stamp stopped a watched zone.

Default stays 10. ADR 0021.

asobi#557 - zone_tick/2 may declare what changed

{Entities, ZoneState, Busy, #{changed => #{Id => Entity}, removed => [Id]}}, merged onto the map the callback returned. A Lua script declaring it stops the bridge decoding the whole entities table, and the entities nobody named stay the same terms, so compute_deltas/2 settles each with a pointer comparison instead of walking its fields.

Median of three runs, inert script moving three entities, lua_vm_mode = owned:

entities	before	after	reductions on the zone before	after
100	299us	181us	10,945	526
500	1,784us	898us	53,314	672
2,000	9,292us	4,569us	200,466	1,209

The reduction column is the one that decides whether a zone keeps up with its tick budget, and it is the stable one.

The encode in the other direction is unchanged and still O(N). Removing it needs the VM to hold the entities table across ticks and asobi to push only its own mutations, which means tracking dirtiness across eight entity-writing sites where a missed mark is an entity that silently stops replicating. ADR 0022 records that as a separate decision.

Review gate

Architecture guardian -> security reviewer -> code reviewer, then a second commit working every finding. Highlights:

• decode_dirty/2 guarded is_tuple/1, which is not a Luerl-table check - Luerl represents every non-scalar as a record, so return entities, zone_state, false, function() end raised on a callback invoked with no try/catch and killed the zone. Now checks the record tag, with a try/catch for recursive tables.
• The malformed-declaration log handed a script-controlled map to a formatter that renders before truncating - ~10s on the zone process for a 32MB script binary, outside bounded_eval and invisible to max_heap_size. The bound moved to the way in.
• Four silent-revert paths now report bad_zone_dirty. Each produced the same symptom - every entity in the zone frozen, forever, no error - and three were one line from an idiom the guide itself showed.
• narrow_coords/1 filters and deletes rather than function_clause-ing the manager under one_for_all.
• Reverted the sync_spatial_grid identity match: on a miss it is a map =:= that can only fail, and the miss path is the default.
• ADR 0022's "inherent to any dirty contract" was overstated and its own cited prior art contradicts it. Narrowed, with the consequence stated.

Tests

+19. The hostile-fourth-value cases were verified by reverting each fix and confirming the specific case fails - the first version of them passed against the unfixed code, because the mode rode on game_state (handed to Luerl unencoded, so it never reached the script) and because print is stripped from the sandbox.

The third commit fixes a CT failure that was not flake: asobi_leaderboard_api_SUITE built board ids with erlang:unique_integer/1, unique within one runtime instance, so a second rebar3 ct reused the ids and inherited the first run's rows. asobi_test_helpers:unique_id/1 exists for this and says so, citing asobi#357.

Gate status

fmt --check, xref, dialyzer, elp lint clean on changed files; eqwalize-all 209 vs 212 on main (no new); ex_doc unchanged at 6; drift checks pass; eunit 2,398/0; CT 390/0 on two consecutive runs.

Known, not fixed here

asobi_world_zone_integration_tests:world_input_crossing_touches_only_ring_delta passes spuriously: find_player_pid/1 reads pg:get_members(nova_scope, {player, PlayerId}), that module never registers the group, and in the full suite it borrows a live process another module left behind. Run alone it correctly reports 0 subscribers and fails. Unrelated to this change and it alters what the test asserts, so it wants its own PR.

Closes #557
Closes #558
Closes #559
Closes #560
Closes #561

[github-actions]

🟡 Code Coverage — 76.8%

9364 of 12185 lines covered.

---

🟡 ELP Lint — 192 warnings

212 diagnostics found. See job logs for details.

---

✅ ELP eqWAlize

No diagnostics.