[lilyshen0722]

TASK-126 — the swap-all half, as ruled 2026-09-25 (wren: swap all 21 sites, no burn-down baseline, guard is a behavioural probe).

What it does

21 sites in 18 files fell back to req.ip. Behind nginx req.ip is a cloudflared pod address for every external caller, so each was one limiter bucket serving the whole internet:

• 20 via ipKeyGenerator(req.ip);
• routes/agentHooks.ts:29, a raw `ip:${req.ip || 'unknown'}` — the 21st, and the reason the guard is not a source scan. The census that missed it enumerated a spelling (ipKeyGenerator() and called it the class; the same mistake is available to the next scan.

All 21 now call cloudflareIpRateLimitKeyGenerator, which prefers cf-connecting-ip and falls back to req.ip only when that header is absent — unchanged for a caller that sends none.

Measured on this branch: grep -rn 'ipKeyGenerator(' backend --include=*.ts outside middleware/ipRateLimit.ts returns 0.

The guard is behavioural, deliberately

backend/__tests__/unit/middleware/rateLimitIpKeySeparation.test.js walks the loaded app's router stack and drives two requests that differ only in cf-connecting-ip:

• every walked instance counts and separates; none collapses
• finds the limiters that mount late or behind a router
• negative control: the instrument catches a limiter keyed the way the swapped sites were — the probe is shown to fail on the old shape, so "all separate" is evidence and not a vacuous walk
• positive control: the CF-aware key separates on the same stub

How this was cut (the stack, not the branch)

The old branch 1e6beaef was a 3-deep stack whose merge-base (9a32fca5) predated #1880/#1881/#1883, and it overlapped #1883 on five files (as @vera flagged). This branch is cut fresh from main b27b5aea with only:

• the TASK-126 commit (661d3b07, 18 files), and
• the five probe-test commits.

Dropped, because they are already in main under their own PRs: 2c37996d (TASK-123 Discord containment → #1867 451c9db6) and cdfb0c64 (TASK-125 → #1883 a7dea33a). That removes the overlap rather than resolving it: no integrationRateLimit.ts, no test-file collisions, and no baseline json touched (0 files).

routes/users.ts merged without a conflict and is verified in the result: all three sites on the CF generator, :59 being the line #1883 merged and :38/:79 the two this change adds. Per @vera, users.ts:79 is user-first and mounted after auth — it is inside "all 21" for uniformity, not a fallback any caller reaches.

Victim measurement

@vera, live, across all 21 mounts: one live victim and twenty latent. routes/podInvites.ts:161 mounts inviteReadRateLimit with no auth in the chain (its two sibling mounts, :90 and :189, both carry auth), and GET /invites/:token/preview is called for logged-out visitors (V2InviteRedeem.tsx:59) — so all of them share one instance-wide bucket. The four that looked unauthenticated on a first pass (agentBinding.ts:179/:284/:352, machines.ts:99) sit behind daemonAuth, which reads Authorization — exactly what both key generators read — so daemons bucket per credential and share nothing.

Verification

• Targeted: 23 tests / 3 suites (the probe, rateLimitDefaultKey, integrationRateLimit).
• Full backend tier on this branch: 437/437 suites, 4100 tests passed, 24 skipped, 0 failed.
• eslint . --ext .ts → 0 errors / 1210 warnings, identical to the same-instrument baseline at d2cfcb2f. Delta 0.

Gate: @vera (fix + tests + the probe's shape).

Clearance (vera, 2026-09-25)

13 green at c621dd92, unconditional, and the piece the gate was holding was the guard's reach: she mutated a real site rather than trusting the synthetic control — routes/podInvites.ts:26 to a constant key, in an isolated worktree — and the walk reddened, naming both limiters that key backs (POST /api/pods/:podId/invites [r1=19 r2=18 r3=17] and the GET) with exactly the r3 = r2 - 1 collapse signature the probe documents. So the probe catches a regression at a real site, by path, not only in its own fixture.

Corrected in passing: the probe runs in ~310ms. Two earlier attempts died in globalSetup and were misattributed to the walk's length.

Press: @connector-ops (asked by the gate). Backend-only, so no image-ordering constraint.