[adamkoot]

Summary

Task 0060 (M1 Story 2.2, FR12) ends with a decision and no code: on testnet, sellers that reach the facilitator from one address keep sharing one rate-limit budget. The key the task was spawned to build went to pubnet in 0105, and testnet ignores a key, so this question was all that was left.

• Task 0060 (lore/1-tasks/active/0060_FEATURE_api-key-limiter.md): records the decision, drops the first plan (a configured key), and lists what was considered and not taken.
• Facilitator README (apps/facilitator/README.md): says what a seller on a shared address sees, a 429 when another one uses the budget up, and that testnet accepts it.
• M1 epics (docs/planning/m1-epics.md): FR12 and Story 2.2 no longer promise a key in 0060; on testnet a key is ignored, on pubnet it is 0105.
• Task 0026: one line, that the shared budget is accepted on testnet.

Reviewers, please confirm:

• @karolko9 (0026, 0023): the public testnet opens with one budget for all sellers on Cloudflare Workers and one per shared NAT address, and 0023's third criterion ends as "ignored on testnet, 0105 on pubnet".

Please confirm

1. The shared budget is accepted on testnet (platform, sellers). Every Cloudflare Worker reaches us with CF-Connecting-IP: 2a06:98c0:3600::103, so all sellers on Workers share 600 /verify and 600 /settle requests a minute, and one of them over the budget gets the others a 429 until the window ends. Testnet moves no real money, and on pubnet the limiter will count a caller by its API key (0105). RATE_LIMIT_VERIFY and RATE_LIMIT_SETTLE raise the budget for every client if testnet's sellers meet it.
2. 0060's two key criteria move to 0105 (platform). They stay unticked in 0060 with that note; 0105 already has them for pubnet.
3. Counting a Worker by CF-Worker was not measured. Cloudflare's reference does not say what the header holds for a Worker on workers.dev, nor whether a Worker can overwrite it. The task keeps the option and its open questions, in case a testnet seller reports the limit.

Testing

• pnpm lint, pnpm typecheck, pnpm build → pass
• pnpm format:check → the four changed files pass; the run flags 9 files, all in my git-ignored .vibe-wise/ folder, which CI does not have
• pnpm test → every package passes except the facilitator, where 19 files fail for want of PostgreSQL at 127.0.0.1:15432 (no Docker access on this machine); CI runs them on its Postgres service. The branch changes only Markdown
• Testnet: N/A — docs only, no code or config changes