jacobh2
725901c98f
Before, any response other than 401 (426 without X-Kvitt-Protocol, 405, ...) marked a random bearer token accepted for good: it never counted against its IP and was never pruned, so a stranger could bypass the 60/min IP limit and grow the in-memory map without bound. Now (proposed D-115, SPEC §8.6): a request with a token that is not accepted counts against its IP before it runs and is refused once the IP is over; a 2xx accepts the token and gives that count back (a newly paired device costs its IP nothing, as before); a 401 for an accepted token counts against the IP and withdraws the acceptance; token entries are pruned once their window expires, accepted or not. Every 401 still counts against the IP exactly once. Unit tests for each rule and an integration test for random tokens without the protocol header (60 x 426, then 429, the paired device unaffected). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B