caddy: custom image with mholt/caddy-ratelimit; three sliding-window zones (ws connects, keyed xrpc, anonymous http) keyed per client with /24 / /56 subnet grouping. validated, not yet deployed. in-process: --max-subscribers (1013 close at ceiling) and --max-cold-readers (bounded cold-replay concurrency, contended passes back off 20ms). 0 = unbounded, so prod behavior is unchanged until opted in. divergence recorded in docs/semantic-parity.md — upstream keeps admission at the CDN/proxy layer it has and we lack. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>