Feature set 134.

[jackfperryjr]

Rate limiting was partitioning on the load balancer

Connection.RemoteIpAddress behind Railway is not the caller. Recovered from three months of
production IpHash values by hashing 4.7M candidate addresses through the same
SHA256(...)[..16] the logger uses — six of the ten busiest "clients" were:

41299CDA2B4E7CCC -> ::ffff:100.64.0.3
8FF6F9580DEB0B71 -> ::ffff:100.64.0.4
74D2322EC22F06E8 -> ::ffff:100.64.0.5
...

100.64.0.0/10 is carrier-grade NAT space — Railway's internal load balancer pool. Not Cloudflare
edge addresses either (all 15 published ranges were hashed; no hits). The aggregate agrees: distinct
addresses per day sat at 21–24 whether the day served 56 requests or 1,730.

So no caller could be isolated, legitimate callers shared buckets with abusers, and the anonymous
ceiling was ~60/min × proxy nodes × replicas — the source of the ~290/min measured in production.

ClientIpResolver resolves CF-Connecting-IP, but only when the request carries a secret the
Worker injects. That condition is the design, not belt-and-braces: Cloudflare appends to a
caller-supplied X-Forwarded-For so its first entry is attacker-controlled, and Railway answers on
its own *.up.railway.app hostname where CF-Connecting-IP can simply be typed in. A spoofable
partition key is worse than a coarse one — it lets one caller mint unlimited fresh windows. Without
the secret it falls back to the peer address. Seven tests cover the bypasses.

429s are now recorded. UseRateLimiter short-circuits ahead of the logging middleware, which is
why the logs contain zero of them — that zero was never evidence the limiter wasn't firing.
Reordering the pipeline was rejected as the fix: it would have exempted every static asset from rate
limiting. OnRejected writes through the extracted RequestLogWriter instead.

Stats: ranges and metrics

Presets (24h / 7d / 30d / All) plus custom dates. Buckets switch hourly → daily past three days, and
the response echoes the window actually measured, because a chart whose axis silently changed unit
is a chart that lies about its shape. Very large ranges are trimmed to their most recent slice and
say so.

New: keyed vs anonymous, top failing paths, per-endpoint p95 (endpoints under five requests omitted),
busiest clients. The clients panel carries the caveat that pre-fix rows counted infrastructure.

Verified against production data by booting locally with a temporary auth bypass, since the endpoint
is owner-only — that bypass is reverted and not in this diff. It caught a real bug: model binding
returns Kind=Local for an ISO string ending in Z, and Npgsql refuses non-UTC for timestamptz,
so every custom range 500'd while the default 24 hours worked. Fixed and re-verified across eight
range shapes including reversed, empty, zone-less, and all-time.

Two findings worth your eye, from the new panels: 125 404s on /api/v1/games (something is
calling a versioned path that doesn't exist), and /api/arena/roster at 3.3s p95, the slowest
endpoint in the catalogue.

Language

Drops the framing of this as a wiki-scraping project — README, workflow headers, tool header. The
seeder is gone and the catalogue is curated by hand. Attribution to the wiki stays: its text is
CC BY-SA, which requires credit regardless of how much hand-editing has happened since. References
that describe live behaviour (the Referer-blocking CDN, the MediaWiki thumbnail URL the regex
actually parses) were generalised, not deleted.

Needs you

cloudflare/RATE-LIMITING.md has the steps I can't do from here: wrangler secret put EDGE_SECRET,
the matching Edge__Secret on Railway, and the edge rate-limiting rule. Until both sides of the
secret are set, this changes nothing — the resolver falls back to today's behaviour, silently.

🤖 Generated with Claude Code