Tablet 46: the watch — rate limits at every gate, per IP at the pe'ah, per key inside

Tamid §1.1 wrote the pe'ah's limit (10/min, 100/h per IP); nothing
enforced it, on any tier, and every admitted request spends manna.

VavPipeline.BigdeiKodesh.Mishmar: fixed minute and hour windows per
subject in ETS, the subject stored only as sha256(boot salt, tier,
subject) — no IP and no key is ever in memory as itself, the sweep
drops closed windows, nothing survives a restart (the Tamid's "not
logged beyond the current request", kept in memory too). A refused
knock is not counted. 429 RATE_LIMITED with Retry-After and the manna
explanation (Shemot 16:18). Pe'ah per peer address; courtyard and
chatzer per key, after the gate (a wrong key is 401 and never counted).
Numbers: pe'ah 10/100 (Tamid), courtyard 20/200 and chatzer 5/60
(from Construction §2.3; config :rate_limits).

Service shorashim-external: externalTrafficPolicy Local. With Cluster
the pod saw every caller as the node, 91.92.153.113 (observed via
/proc/net/tcp) — a per-IP limit would have been one bucket for the
world.

Spec: tamid §1.1 (watch, 429 rows, the Service note), KOHEN.md.
Doorpost 42b38626… → e4e3d56d…. tablet46_mishmar_test; Elixir 533/0
(L3 on and off).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

specs/shorashim_tamid.md

@@ -47,6 +47,9 @@ Rate limit: 10 requests per minute per IP
            100 requests per hour per IP
            No identification stored. IP is used for rate-limiting only,
            not logged beyond the current request.
+           429 carries Retry-After and the manna explanation.
+           (The Service must deliver the caller's address to the pod —
+           externalTrafficPolicy: Local — or every caller is one IP.)
 ```
 
 **Design requirements:** No cookies. No session state. No analytics. No tracking pixels. No JavaScript fingerprinting. The pe'ah endpoint collects nothing. The stranger is safe to approach.
@@ -62,6 +65,16 @@ file or no keys: nobody passes, and the log says `GATE_NO_KEYS`. The
 caller is never told why beyond "missing or invalid API key". Issued by
 the kohen (KOHEN.md "Issuing a key"); the key never appears in a log.
 
+**The watch.** Past the gate, each key may knock 20 times a minute and
+200 times an hour at the courtyard (Construction §2.3: 200 korbanot an
+hour is the system's peak — one key may not be the whole peak), 5 a
+minute and 60 an hour at the chatzer (five panels at once). The pe'ah's
+10/100 per IP is above. Counted per key, not per IP; a refused key is
+never counted. The counters are salted hashes in memory, swept as the
+windows close — no list of who called exists. 429 carries `Retry-After`
+and the manna explanation. The numbers are configuration
+(`config :vav_pipeline, :rate_limits`); the pe'ah's are this document's.
+
 ```
 Endpoint: POST /courtyard/offering
 
@@ -174,6 +187,7 @@ Errors:
   401 — Invalid or missing API key
   403 — A key for an outer ring at an inner gate
   422 — Missing or empty output, output over 65,536 bytes, unknown model
+  429 — Rate limit exceeded (20/min, 200/h per key). Retry-After; manna explanation.
   503 — MANNA_DEPLETED (provision exhausted), KORBAN_UNAVAILABLE,
         TALMUDIC_UNAVAILABLE. Body says which; resubmit: true.