{
 "audits": [
  {
   "at": "2026-11-02T07:05:00Z",
   "auditor": "quota-specialist",
   "events_covered": 8,
   "findings": [
    {
     "cause": {
      "bucket": "github.api.user_token (PAT)",
      "lane_behavior": "155-row promotion publish rode the shared PAT bucket into the wall mid-batch; the 403 surfaced on the publish path itself",
      "pattern": "bulk promotion publish",
      "surface": "REST core"
     },
     "class": "burst-publish",
     "event_refs": [
      "wall-2026-10-28T23:41:00Z-pat"
     ],
     "id": "F1",
     "improvement": "Bulk publishes route through the Publisher App bucket (own 5000/h) as primary with the PAT derived-reserve preflight (QAC-007) as the standard gate; PAT is fallback-only per the #1884 slice model (#2460). No bulk batch starts on PAT without a preflight read.",
     "owner": "quota-convergence (promotion pipeline) + quota-specialist (standard)",
     "state": "partial - App buckets and preflight exist and slices encode fallback-only; the 2026-10-28 practice predates enforcement. Verify on the next promotion cycle."
    },
    {
     "cause": {
      "bucket": "github.api.user_token (PAT)",
      "lane_behavior": "three wall hits in one day across lanes (fleet incident of record, docs/ops/RATE-LIMIT-2026-10-29.md); burn ~120-160 calls/min fleet-wide against an 83.3/min replenishment flow",
      "pattern": "multi-lane concurrent draw, no pacing",
      "surface": "REST core"
     },
     "class": "unpaced-fleet-storm",
     "event_refs": [
      "wall-2026-10-29T05:50:14Z-pat",
      "wall-2026-10-29T11:41:45Z-pat",
      "wall-2026-10-29T21:39:53Z-pat"
     ],
     "id": "F2",
     "improvement": "Pacing as infrastructure: quota-dispatch-tree regulator (live, */10 cadence) + per-lane draw budgets from the #1884 smooth-flow slices + per-request tick ledger (QAC-009) so draw is measured per lane, not discovered at the wall.",
     "owner": "cadence-optimizer",
     "state": "partial - regulator and slices landed after these events; tick-ledger record (QAC-009, PR #2473) still open, which leaves per-lane measurement incomplete."
    },
    {
     "cause": {
      "bucket": "github.api.user_token (PAT)",
      "lane_behavior": "one exhaustion episode (reset 2026-10-30T01:42:09Z) observed separately by three lanes; the gaps lane's circuit-breaker DEFER (01:34Z) is the mitigation working - it converted a would-be 403 into a deferral",
      "pattern": "single wall episode, three independent observations",
      "surface": "REST core"
     },
     "class": "wall-episode-observability",
     "event_refs": [
      "wall-2026-10-30T01:32:00Z-pat",
      "wall-2026-10-30T01:34:00Z-pat-gaps-defer",
      "wall-2026-10-30T01:36:00Z-pat"
     ],
     "id": "F3",
     "improvement": "One wall = one register episode with multi-observer provenance (done retroactively in this register), and lanes consult a single rate-state preflight before bulk pulls so an in-progress wall is discovered before draw, not at it. Circuit-breaker DEFER is the endorsed pattern for helper-driven pulls.",
     "owner": "quota-specialist",
     "state": "landed - register consolidation in audit-001; preflight exists in the publish helper; breaker pattern attested in production by the 01:34Z event itself."
    },
    {
     "cause": {
      "bucket": "github.api.user_token (PAT, search window)",
      "lane_behavior": "Registry census fanned involves:<actor> queries until the secondary limit cut the queue mid-census (RepoStory + signature counts uncounted); the lane then stopped all API calls per limits - correct containment, but the census lost its tail",
      "pattern": "enumeration burst on a narrow-window surface",
      "surface": "Search API"
     },
     "class": "search-surface-burst",
     "event_refs": [
      "census-2026-11-02T06:25:00Z-search-pat"
     ],
     "id": "F4",
     "improvement": "Cross-lane Search-window scheduling: search-heavy censuses batch actors per query, pace inside the 30/min search window with secondary-limit backoff, and checkpoint progress (watermark per actor set) so a limit cut resumes instead of losing the queue. Search draw is scheduled like a bucket, not discovered like a wall.",
     "owner": "registry lane (ac8e5e6b) + quota-specialist (pacing spec)",
     "state": "proposed - no search-window scheduler exists yet; the census lane's stop-on-limit behavior is the interim standard."
    }
   ],
   "id": "audit-001",
   "register": "ops/quota/rate-limit-events.json"
  },
  {
   "at": "2026-11-02T07:39:23Z",
   "auditor": "quota-specialist",
   "events_covered": 8,
   "findings": [
    {
     "event_refs": [
      "wall-2026-10-28T23:41:00Z-pat"
     ],
     "id": "F1",
     "state": "standard-landed",
     "update": "Publish preflight standard landed: scripts/quota_preflight.py (one batched /rate_limit read per principal; derived reserve = max(250, 10% of limit) must survive the batch; bulk >= 25 routes Publisher primary; PAT carrying bulk prints DEGRADED-GO, never a silent GO; failed read = NO-GO) + docs/ops/PUBLISH-PREFLIGHT.md. Remaining: promotion-pipeline adoption (owner: Convergence) - first production verdict lands with the next promotion batch."
    },
    {
     "event_refs": [
      "wall-2026-10-29T05:50:14Z-pat",
      "wall-2026-10-29T11:41:45Z-pat",
      "wall-2026-10-29T21:39:53Z-pat"
     ],
     "id": "F2",
     "state": "landed - CORRECTION to audit-001",
     "update": "audit-001 stated tick-ledger PR #2473 was still open. Firsthand recheck: PR #2473 MERGED 2026-11-01T13:41:36Z (merge a6a18d71939d) - scripts/cadence_tick_ledger.py + tests + docs/ops/CADENCE-TICK-LEDGER.md on master. It merged ~21 minutes after the wiring-check snapshot the audit drew on. The named gap is CLOSED; residual = operating adoption by Cadence, not a build gap. Correction recorded per verify-before-claim."
    }
   ],
   "id": "audit-002",
   "kind": "state-update (owner directive 2026-11-01: prioritize FIX from Audits)"
  },
  {
   "at": "2026-11-02T07:41:54Z",
   "auditor": "quota-specialist",
   "events_covered": 8,
   "findings": [
    {
     "event_refs": [
      "census-2026-11-02T06:25:00Z-search-pat"
     ],
     "id": "F4",
     "state": "machinery-landed",
     "update": "Search-window scheduling landed: scripts/quota_search_pacer.py (Pacer: token-bucket 24/min default under the 30/min cap, secondary-limit backoff to the API-named reset, never retry inside a closed window; Checkpoint: per-unit JSON watermarks, resume-after-cut; planners: window-pull batching preferred over per-key fan-out) + docs/ops/SEARCH-WINDOW-SCHEDULING.md (the three rules: batch, pace, checkpoint). Unit-verified (pacing math, planners, schedule estimate). Remaining: Registry lane census adoption (owner: registry lane ac8e5e6b + quota-specialist spec) - first paced census is the production proof."
    }
   ],
   "id": "audit-003",
   "kind": "state-update (owner directive 2026-11-01: prioritize FIX from Audits)"
  },
  {
   "at": "2026-11-02T09:42:00Z",
   "auditor": "quota-specialist",
   "events_covered": 8,
   "findings": [
    {
     "event_refs": [
      "census-2026-11-02T06:25:00Z-search-pat"
     ],
     "id": "F4",
     "state": "production-proven",
     "update": "F4 machinery-landed \u2192 production-proven on the Registry lane's paced census tails (the run the v1 fan-out was cut from): plan printed BEFORE any call (per-key fallback; schedule estimate 4 units \u2248 10s @24/min) \u00b7 Pacer held 24/min across both runs (3+1 calls, \u2205 limit hit) \u00b7 Checkpoint resume proven \u2014 run 2 skipped the completed unit from the watermark; final checkpoint loads 17 done / 0 remaining. Evidence: PR #3710 merged 69faf04810bc (ops/moniker-census/2026-11-01-census.json + 2026-11-01-checkpoint.json); checkpoint + this register verified firsthand @master by quota-specialist 2026-11-02T09:41Z. Environmental caveat of record (\u00ac machinery defect): VM exec-channel file writes are intermittently EPERM-denied \u2227 a Checkpoint.mark attempt truncates-then-fails on that channel \u21d2 the runner marked against a work copy \u2227 the canonical watermark was materialized in identical Checkpoint format via the file-tool channel, then re-loaded for the resume proof (recorded in the checkpoint meta). Residual hazard for VM-side runners: prefer a durable write channel for watermark files until the exec channel stabilizes."
    }
   ],
   "id": "audit-004",
   "kind": "state-update (F4 production proof \u2014 consuming-lane evidence)"
  },
  {
   "id": "audit-005",
   "at": "2026-11-03T19:21:00Z",
   "auditor": "quota-specialist",
   "events_covered": 8,
   "kind": "state-update (F1 production proof \u2014 consuming-lane evidence)",
   "findings": [
    {
     "id": "F1",
     "event_refs": [
      "wall-2026-10-28T23:41:00Z-pat"
     ],
     "state": "production-proven",
     "update": "F1 standard-landed \u2192 production-proven: the preflight gate ran FIRST on quota-convergence's 45-op promotion batch (PR #4569 merged 0e400fd9b0f1) \u2014 verdict recorded in the PR body: GO-PUBLISHER, Publisher bucket 4986/5000 remaining after the read; 12 of 15 files rode the Publisher bucket. The 3 .github/workflows files split to a small PAT sub-batch \u2014 platform-forced (GitHub bars App tokens lacking workflows permission from workflow-file writes) \u2227 disclosed in the PR; the standard's PAT-fallback-only term holds (permission-forced, \u00ac bulk on PAT). Verdict line + merge state verified firsthand by quota-specialist 2026-11-03T19:20Z. The 2026-10-28 burst-publish pattern now has its counter-proof in production: bulk rode the App bucket behind a recorded preflight verdict."
    }
   ]
  }
 ],
 "schema": "quota.rate-limit-event-audits/v1",
 "title": "Rate-limit event audits - the register, audited into improvements (owner standard 2026-11-01). Append-only: one audit entry per audit pass; findings are never edited in place - a state change is a new audit entry referencing the finding id."
}