Tablet 46: the watch — rate limits at every gate, per IP at the pe'ah, per key inside

Tamid §1.1 wrote the pe'ah's limit (10/min, 100/h per IP); nothing
enforced it, on any tier, and every admitted request spends manna.

VavPipeline.BigdeiKodesh.Mishmar: fixed minute and hour windows per
subject in ETS, the subject stored only as sha256(boot salt, tier,
subject) — no IP and no key is ever in memory as itself, the sweep
drops closed windows, nothing survives a restart (the Tamid's "not
logged beyond the current request", kept in memory too). A refused
knock is not counted. 429 RATE_LIMITED with Retry-After and the manna
explanation (Shemot 16:18). Pe'ah per peer address; courtyard and
chatzer per key, after the gate (a wrong key is 401 and never counted).
Numbers: pe'ah 10/100 (Tamid), courtyard 20/200 and chatzer 5/60
(from Construction §2.3; config :rate_limits).

Service shorashim-external: externalTrafficPolicy Local. With Cluster
the pod saw every caller as the node, 91.92.153.113 (observed via
/proc/net/tcp) — a per-IP limit would have been one bucket for the
world.

Spec: tamid §1.1 (watch, 429 rows, the Service note), KOHEN.md.
Doorpost 42b38626… → e4e3d56d…. tablet46_mishmar_test; Elixir 533/0
(L3 on and off).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

vav_pipeline/config/test.exs

@@ -7,6 +7,13 @@ config :vav_pipeline,
   l1_mount_point: "../l1",
   manna_provision_file: "test/fixtures/manna/today.json",
   api_keys_file: "test/fixtures/api_keys",
+  # Wide open for the suite (Day 6/7 tests knock many times a second);
+  # tablet46_mishmar_test narrows them and resets.
+  rate_limits: [
+    peah: [minute: 10_000, hour: 100_000],
+    courtyard: [minute: 10_000, hour: 100_000],
+    chatzer: [minute: 10_000, hour: 100_000]
+  ],
   cycle_boundary_check_interval_ms: :timer.hours(24),
   http_port: 0