@bongos/core 1.20.16 → 1.20.17

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.16",
-  "core_contract": "1.20.16",
-  "source_commit": "594ee4d4c853130397cd87e0095a3b50e03ad4b0",
+  "core_version": "1.20.17",
+  "core_contract": "1.20.17",
+  "source_commit": "4e92fa5764cf7041b99baefbf8d249edbba9159d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T12:51:52.406Z",
+  "built_at": "2026-09-30T13:31:15.089Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 556,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3210,
-  "tree_sha256": "9a6832279c80fa1b768101f4b2c4c13e626f023be26da7232d0596ef21accfa9",
+  "tree_sha256": "4715c740ddb7d2c5cdfed3960679731b4a2cdef5b901f92945ba362f12f26570",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1547,7 +1547,7 @@
     {
       "path": "docs/adr/0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md",
       "mode": "0000644",
-      "sha256": "828e785306df71d1620e0bb541d0ce3cce9ff65dcd996adc4a817803000cbb7c"
+      "sha256": "15d0455b7a29968c01ea01fb64d9c01fb63d7d2db0ef351df5f0fb9dfa677a94"
     },
     {
       "path": "docs/adr/0216-a-fake-pool-interpreter-must-fail-loudly-not-silently-ignore.md",
@@ -2242,7 +2242,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "c1360ad6a6659819a5a2db72cef07fd3631a3052745ef4fcf20075e9849f7fbd"
+      "sha256": "829ba538e06cca081f0540bf819f280ba36e738a553e5fa3634af5f5af5bc5b0"
     },
     {
       "path": "docs/architecture.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2664b90799e3d947cdce43f2eb6c05699da1aafad223fef1b6eafd463c4478e3"
+      "sha256": "c2490d5cdc3d8044ad02ba2ade0a9918e8c3d041e79f0ac0d61f3126152053d1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7057,7 +7057,7 @@
     {
       "path": "modules/platform-identity/read-rate-limit.js",
       "mode": "0000644",
-      "sha256": "dc11b89460e4cca22af1ab61672104ac99298f477c1bad890d688f87456494fa"
+      "sha256": "fb22fef7442c1488499dce4ec8aafce30400166df51f5c7bd88577c83fb8873e"
     },
     {
       "path": "modules/platform-identity/recruiter-sliver.js",
@@ -7112,7 +7112,7 @@
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
-      "sha256": "fbd1f8679be51718131d3d95d6ed7d8dcd1ebe091df6cfc190b69fd62c00013c"
+      "sha256": "3fbaaafe605fd891c449499ca85a716f9b8780bb1869f25b32162593ada8fedd"
     },
     {
       "path": "modules/platform-identity/routes/sso.js",
@@ -8862,12 +8862,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "979f117fe308e4c9d4c2b8d9765fc7a8314c490d8cb134215efd61cded7cf30e"
+      "sha256": "f04a559437cf80ab6eeb46905a8f943091dd4601e02b7d7ae58ca57aae35b050"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f5ff021f7aedefb0c74cd4e019815aaada727a00b4a1dc7609f369aa41186b85"
+      "sha256": "b8cd817f9d22b1222c06404648c197080fce17573ce0c83f43b4f03f87fb06b4"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8887,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "95ae54225e9925f4d47f66179e6a081db5668a217c0000b94c06c992a2cae479"
+      "sha256": "06f6c8587835146b2f325adf518aca1e74699cb2f38f0313ad4bf7f5fe37577c"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11002,7 +11002,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0d0657d70e9b17cb8f11328fd85f36df2bb7d67c1f44cac8745364e6558bc453"
+      "sha256": "ae8085fdd1b2e41ff442de4a863b7b105bebaad915054a0cfa38bb57321289be"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14842,7 +14842,7 @@
     {
       "path": "tests/recruiter_sliver_boundary.mjs",
       "mode": "0000644",
-      "sha256": "522df6e7930347ff312ef5b2cb98cfde3c53f7465a133618dd970872241bc2b3"
+      "sha256": "34c56222c40ab58be128f380a2881a2d17bd6c483560d878f6de01a00bcef297"
     },
     {
       "path": "tests/redteam_followup_kind.mjs",

package/docs/adr/0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md

@@ -61,7 +61,7 @@ A **previous** handle resolves to nothing here either, deliberately unlike `reso
 
 ### D4 — The sliver holds spec D3's **archon floor**; the directory's wider door is not reused, and the audience goes to the owner
 
-`GET /scouting/:handle` sits in `modules/platform-identity/routes/scouting.js` beside `GET /scouting`, and the two do **not** share a gate. The sliver is `requireBuilder` → `api.requireRank('archon')`; the directory keeps `requireScoutingReader({ curateGate: requirePermission('project.curate') })`. Each gate is spelled in its own route's middleware list, so `route-rank-check.js` and `gen-api-docs.js` classify each from its real floor rather than recording a privileged route as `any-builder`.
+`GET /scouting/:handle` sits in `modules/platform-identity/routes/scouting.js` beside `GET /scouting`, and the two do **not** share a gate. The sliver is `requireBuilder` → `api.requireRank('archon')` (behind its own read budget since [task 1003540](https://cloudbongos.com/builders#/task/1003540) — see the last honest limit); the directory keeps `requireScoutingReader({ curateGate: requirePermission('project.curate') })`. Each gate is spelled in its own route's middleware list, so `route-rank-check.js` and `gen-api-docs.js` classify each from its real floor rather than recording a privileged route as `any-builder`.
 
 Spec D3 says the sliver is "gated at the route by `project.recruit`" — and that atom **does not exist**. ADR 0201 D3 and ADR 0210 both refuse to mint it, on the same grounds: it belongs to the project-admin-console wave ([spike 1002786](https://cloudbongos.com/builders#/task/1002786) R3), which defines it, and minting it in a third place would fork its definition across three waves before any had shipped. **So which door does it use meanwhile?** The first draft reused the directory's, and that was wrong in the dangerous direction. Spec D1 declares the missing atom's shape — **floor archon**, widenable per instance through the governance tab — while the directory admits `project.curate` at the **metic** floor (ADR 0157) **OR any project owner**, who is typically a bare `xenos` on the hub (ADR 0210 D2). That door is *wider* than the signed floor on both halves. Reusing it would have widened an owner-signed privacy decision by implementation convenience, on the first surface that discloses a private account — and narrowing after people have been disclosed is not a recoverable move, while widening later is. So the sliver holds D3's declared floor, by rank, until the atom exists.
 
@@ -102,7 +102,7 @@ Both columns exist (migration `platform_identity_012_account_privacy.sql`); the
 - **A recruiting read added in another FILE would not trip the two-route guard.** D6's count is over `routes/scouting.js` alone, so the "both recruiting surfaces" copy could become false without reddening. Sweeping every route file for reach-joining reads is a structural guard of its own and belongs with the shared-predicate work, not here.
 - **`getRecruiterSliver` (the by-id port spec D3 names) has no production caller yet** — [task 1002972](https://cloudbongos.com/builders#/task/1002972) is its consumer. The route uses the by-handle sibling; the proof exercises both.
 - **`active_recently` is coarse by design and coarse in practice.** It is derived from `max(last_active)` across the rollup, which is refreshed on federated sign-in and on ship — so a builder active only on a project that never reports will read as inactive. That understates rather than overstates, which is the safe direction for a privacy surface.
-- **This route is not rate-limited, and there is an asymmetry worth naming.** `GET /profiles/:handle` carries a per-IP read limiter precisely so the handle→identity mapping cannot be scripted at line rate (task 1002798), and `GET /scouting/:handle` — which is authenticated and permission-gated, so it starts from a much stronger position — has none. The asymmetry that remains is specific: a reader of this surface can probe guessed handles unmetered and learn *which private accounts opted into recruiting*, a set no other surface publishes. It is bounded by needing to guess a private account's handle (nothing publishes it) and by the audience already holding the full rollup of every public builder, so it is a widening of degree, not of kind. It is **not** fixable by reusing `accountExistenceReadRateLimit`: ADR 0209's whole decision is one budget per oracle, and this is a different oracle — sharing it would hand an enumerator the sum of two budgets on the route it cares about. The right fix is a dedicated budget behind a doorway-exported factory, which is a decision about the doorway rather than about the sliver; filed rather than smuggled in here.
+- **~~This route is not rate-limited~~ — closed by [task 1003540](https://cloudbongos.com/builders#/task/1003540); what was open, and why the fix took the shape it did.** `GET /profiles/:handle` carries a per-IP read limiter so the handle→identity mapping cannot be scripted at line rate (task 1002798), and `GET /scouting/:handle` shipped with none: a reader could probe guessed handles and learn *which private accounts opted into recruiting*, a set no other surface publishes — bounded by needing to guess a private handle, so a widening of degree, not of kind. It now spends its **own** per-IP budget, `recruiter-sliver-read`, at the `/public/*` posture (120 reads / 60s), mounted **ahead of** `requireBuilder`: the tag takes the route off core's default read ceiling (`rate-limit.js` #6), so a limiter behind the gate would have left every refused probe unmetered. It is **not** `accountExistenceReadRateLimit` — ADR 0209 is one budget per oracle, and sharing would hand an enumerator the sum of two. This note used to name a **doorway-exported factory** as the fix. That was wrong on ADR 0209's own terms, which rejects a limiter factory on the doorway as *"more general and more wrong"* (two call sites with matching config get two budgets), and it was overtaken: the module has had its own single limiter factory since task 1002978 (`modules/platform-identity/read-rate-limit.js`, mounted by the community and guild reads). The sliver's budget is one instance from that factory, built at module scope so every router the file builds spends from the same bucket — no new copy, and no change to the doorway. `tests/recruiter_sliver_boundary.mjs` §6b pins the budget, its position ahead of the gate, and that it is none of core's shared instances.
 
 **Rejected:**
 

package/docs/api/openapi.json

@@ -16630,7 +16630,7 @@
           "scouting"
         ],
         "summary": "GET /scouting/:handle",
-        "description": "the PRE-ACCEPT SLIVER for ONE builder (privacy spec D3, ADR 0215 D4, task 1002968). This is the FIRST surface on the platform that discloses a PRIVATE account, and its audience is deliberately NOT the directory's. WHY A RANK GATE AND NOT THE RECRUITING DOOR ABOVE. Spec D3 gates this read on `project.recruit`, an atom whose declared shape is FLOOR ARCHON, widenable per instance (spec D1). That atom does not exist — ADR 0201 D3 and ADR 0210 both refuse to mint it outside the project-admin-console wave that defines it (spike 1002786 R3), and this task does not either. The directory's door (`project.curate` at metic, OR any project owner — ADR 0210 D2) is WIDER than the signed floor on both halves, so adopting it here would widen an owner-signed privacy decision by implementation convenience. Until the atom lands, the honest reading of D3 is its floor, held by rank. Whether the wider recruiting audience is authorized for this surface is the owner's call and is filed as a blocker, NOT resolved here; when it is answered, this one line moves and nothing else does. 404, never 403, for a builder who is not recruiter-reachable: a 403 would confirm the handle exists, which is the disclosure the opt-out removes. The sliver's own predicate does the deciding, inside the module.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).",
+        "description": "the PRE-ACCEPT SLIVER for ONE builder (privacy spec D3, ADR 0215 D4, task 1002968). This is the FIRST surface on the platform that discloses a PRIVATE account, and its audience is deliberately NOT the directory's. WHY A RANK GATE AND NOT THE RECRUITING DOOR ABOVE. Spec D3 gates this read on `project.recruit`, an atom whose declared shape is FLOOR ARCHON, widenable per instance (spec D1). That atom does not exist — ADR 0201 D3 and ADR 0210 both refuse to mint it outside the project-admin-console wave that defines it (spike 1002786 R3), and this task does not either. The directory's door (`project.curate` at metic, OR any project owner — ADR 0210 D2) is WIDER than the signed floor on both halves, so adopting it here would widen an owner-signed privacy decision by implementation convenience. Until the atom lands, the honest reading of D3 is its floor, held by rank. Whether the wider recruiting audience is authorized for this surface is the owner's call and is filed as a blocker, NOT resolved here; when it is answered, this one line moves and nothing else does. 404, never 403, for a builder who is not recruiter-reachable: a 403 would confirm the handle exists, which is the disclosure the opt-out removes. The sliver's own predicate does the deciding, inside the module. Rate-limited per IP (120 reads / 60s, 429 scope `recruiter-sliver-read`), and the budget is spent FIRST, ahead of the gate: its tag takes this route off core's default read ceiling, so a limiter behind requireBuilder would leave every refused probe unmetered.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).",
         "x-rank": "archon",
         "x-source": "modules/platform-identity/routes/scouting.js",
         "parameters": [

package/docs/module-api-changelog.md

@@ -2689,5 +2689,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.14 with no explicit bump. run 36713710510. (task 1002620)
   1.20.16 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.15 with no explicit bump. run 36717488992. (task 1002620)
+  1.20.17 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.16 with no explicit bump. run 36722139698. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/read-rate-limit.js

@@ -1,12 +1,14 @@
-// modules/platform-identity/read-rate-limit.js — a per-IP read cap for an
-// UNAUTHENTICATED public GET in this module. The global limiter meters writes
+// modules/platform-identity/read-rate-limit.js — a per-IP read cap for a GET
+// in this module that must not be scripted at line rate. The global limiter meters writes
 // only, and core's per-IP sliding window (src/bongos/middleware/rate-limit.js
 // perIpSlidingWindow) reaches modules only as ready-built instances on the
 // doorway (ADR 0209: an instance per budget), none of which is this module's.
 // This is the module-side twin of that function — same 429 envelope and
 // headers — written once (task 1002978) and mounted by the community reads
-// (routes/community-leaderboard.js, routes/community-search.js) and the public
-// guild read (routes/guilds-public.js).
+// (routes/community-leaderboard.js, routes/community-search.js), the public
+// guild read (routes/guilds-public.js) and the recruiter sliver
+// (routes/scouting.js GET /scouting/:handle, task 1003540 — authenticated, but a
+// handle probe there reveals who opted into recruiting).
 // routes/public-profile.js and routes/sso.js still carry older vendored copies.
 'use strict';
 

package/modules/platform-identity/routes/scouting.js

@@ -41,9 +41,26 @@ const pi = require('../platform-identity');
 const scoutingAuthz = require('../scouting-authz');
 const recruiterSliver = require('../recruiter-sliver');
 const scoutingNameOnly = require('../scouting-name-only');
+const { createReadRateLimit } = require('../read-rate-limit');
 
 const { pool, requireBuilder, parsePagination } = api;
 
+// The sliver's per-IP read budget (task 1003540, ADR 0215). Probing guessed
+// handles tells a reader WHICH private accounts opted into recruiting — a set no
+// other surface publishes — so the probe is metered at the /public/* posture.
+// Its OWN budget, never accountExistenceReadRateLimit: ADR 0209 is one budget per
+// oracle, and sharing hands an enumerator the sum of two. Built ONCE at module
+// scope, so every router this file builds spends from the same bucket, by the
+// module's one limiter factory rather than a vendored copy. Not a doorway
+// factory: ADR 0209 rejected that shape because two call sites get two budgets.
+const SLIVER_READ_WINDOW_MS = 60 * 1000;
+const SLIVER_READ_LIMIT = 120;
+const sliverReadRateLimit = createReadRateLimit({
+  scope: 'recruiter-sliver-read',
+  limit: SLIVER_READ_LIMIT,
+  windowMs: SLIVER_READ_WINDOW_MS,
+});
+
 // Resolved at CALL time, never at load. Proofs that exercise this route pin a
 // PARTIAL doorway (tests/profile_route.mjs stubs pool + the two gates and
 // nothing else), and a module-scope api.logger() would make this file
@@ -118,8 +135,14 @@ module.exports = function scoutingRoutes() {
   // 404, never 403, for a builder who is not recruiter-reachable: a 403 would
   // confirm the handle exists, which is the disclosure the opt-out removes. The
   // sliver's own predicate does the deciding, inside the module.
+  //
+  // Rate-limited per IP (120 reads / 60s, 429 scope `recruiter-sliver-read`),
+  // and the budget is spent FIRST, ahead of the gate: its tag takes this route
+  // off core's default read ceiling, so a limiter behind requireBuilder would
+  // leave every refused probe unmetered.
   router.get(
     '/scouting/:handle',
+    sliverReadRateLimit,
     requireBuilder,
     api.requireRank('archon'),
     async (req, res) => {
@@ -139,3 +162,7 @@ module.exports = function scoutingRoutes() {
 
   return router;
 };
+
+// Exported for tests — the sliver's budget instance and its limits (the
+// routes/community-search.js precedent).
+module.exports._internals = { sliverReadRateLimit, SLIVER_READ_LIMIT, SLIVER_READ_WINDOW_MS };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.16",
+  "version": "1.20.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.16",
+      "version": "1.20.17",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.16",
+  "version": "1.20.17",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8152,5 +8152,11 @@
       "id": "1004185",
       "text": "Cleaned out leftover code for a hosting option we retired, with proof that every live project's setup is unchanged — no project sees any difference."
     }
+  ],
+  "1.20.17": [
+    {
+      "id": "1003540",
+      "text": "Guessing someone's private profile name on the recruiting page is now speed-limited, so it can't be used to discover who is open to recruiting."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.16'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.17'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/recruiter_sliver_boundary.mjs

@@ -57,6 +57,8 @@
 // project owner — is wider on both halves. A metic operator and a project owner
 // both read the directory and are both refused here, which is asserted in both
 // directions so a later "tidy-up" onto one shared gate cannot pass quietly.
+// And the read BUDGET ahead of that gate (§6b, task 1003540): the sliver's own
+// per-IP bucket, never a shared one (ADR 0209), so a handle probe is metered.
 //
 // MECHANISM (tests/profile_privacy_owner_view.mjs + tests/connections_ownership.mjs):
 // in-memory tables whose row filter is built FROM EACH STATEMENT'S OWN WHERE
@@ -802,6 +804,73 @@ test('each route spells its OWN gate in its OWN middleware list', () => {
     'and the sliver must never pick up the directory wider door by accident');
 });
 
+// ===========================================================================
+// 6b. THE READ BUDGET — its own, and ahead of the gate (task 1003540)
+// ===========================================================================
+
+// The middleware list of one route, as the router a fresh scoutingRoutes() builds.
+const handlersOf = (routePath) => buildScoutingRoutes().stack
+  .find((l) => l.route && l.route.path === routePath).route.stack.map((l) => l.handle);
+
+test('the sliver spends its OWN per-IP read budget, and one budget however many routers mount it', () => {
+  // Probing guessed handles tells a reader WHICH private accounts opted into
+  // recruiting — a set no other surface publishes — so the probe is metered
+  // (ADR 0215's honest limit, closed). ADR 0209: one budget per oracle. Sharing
+  // an existing budget would hand an enumerator the sum of two, and a limiter
+  // built per router would hand a second mount a second budget.
+  const { sliverReadRateLimit } = buildScoutingRoutes._internals;
+  assert.equal(sliverReadRateLimit.meteredScope, 'recruiter-sliver-read');
+  assert.equal(handlersOf('/scouting/:handle')[0], sliverReadRateLimit);
+  assert.equal(handlersOf('/scouting/:handle')[0], handlersOf('/scouting/:handle')[0],
+    'two routers built from this file spend from ONE budget, not one each');
+  const core = require('../src/bongos/middleware/rate-limit.js');
+  for (const other of [core.accountExistenceReadRateLimit, core.publicProjectFeedRateLimit, core.publicReadRateLimitMiddleware]) {
+    assert.notEqual(sliverReadRateLimit, other, `the sliver must not spend the ${other.meteredScope} budget`);
+  }
+  assert.ok(!handlersOf('/scouting').includes(sliverReadRateLimit),
+    'the directory is a different read and does not spend the sliver budget');
+});
+
+test('the budget runs AHEAD of the gate, so an unauthenticated probe is metered too', () => {
+  // A tagged route is skipped by core's default read ceiling (rate-limit.js #6).
+  // Behind requireBuilder, this limiter would leave every refused probe unmetered
+  // — looser than the ceiling it replaces.
+  const handlers = handlersOf('/scouting/:handle');
+  const { sliverReadRateLimit } = buildScoutingRoutes._internals;
+  assert.equal(handlers.indexOf(sliverReadRateLimit), 0, 'the limiter is the first handler on the route');
+});
+
+test('120 reads a minute per IP, then a 429 that names the sliver budget', () => {
+  const { sliverReadRateLimit, SLIVER_READ_LIMIT, SLIVER_READ_WINDOW_MS } = buildScoutingRoutes._internals;
+  assert.equal(SLIVER_READ_LIMIT, 120, 'the /public/* posture');
+  assert.equal(SLIVER_READ_WINDOW_MS, 60 * 1000);
+  const mkRes = () => {
+    const r = { _status: 200, _json: null, _headers: {} };
+    r.set = (k, v) => { r._headers[k] = v; return r; };
+    r.status = (s) => { r._status = s; return r; };
+    r.json = (j) => { r._json = j; return r; };
+    attachFail({}, r, () => {});
+    return r;
+  };
+  // A documentation-range IP of its own, so the HTTP tests above keep their bucket.
+  const req = { ip: '203.0.113.140' };
+  let allowed = 0;
+  for (let i = 0; i < SLIVER_READ_LIMIT; i++) sliverReadRateLimit(req, mkRes(), () => { allowed++; });
+  assert.equal(allowed, SLIVER_READ_LIMIT, 'every read up to the cap passes');
+  const res = mkRes();
+  let nexted = false;
+  sliverReadRateLimit(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'the read past the cap never reaches the gate or the query');
+  assert.equal(res._status, 429);
+  assert.equal(res._json.error.code, 'rate_limited');
+  assert.equal(res._headers['X-RateLimit-Scope'], 'recruiter-sliver-read');
+  assert.equal(res._headers['X-RateLimit-Limit'], '120');
+  assert.ok(Number(res._headers['Retry-After']) >= 1, 'a Retry-After header is set');
+  let otherPassed = false;
+  sliverReadRateLimit({ ip: '203.0.113.141' }, mkRes(), () => { otherPassed = true; });
+  assert.equal(otherPassed, true, 'one address hitting the cap does not throttle another');
+});
+
 // ===========================================================================
 // 7. IT GRANTS NOTHING (ADR 0016)
 // ===========================================================================