The floor's write-rate record has two server-scope statements: 2,000 records an hour and 16,000 a day, for the whole deployment. The count engine adds to them on every attempt, admitted or refused. So one account can spend the whole deployment's budget. Every other account's writes are then refused for up to 24 hours. No operator record or config key can change this.
crates/didbot-policy-count/src/lib.rs:191:observecounts every attempt on the surface, including one refused by the same account's own hourly limit or by any other policy.plan/policy.mdchose this so a per-account limit catches an agent that keeps retrying. For a server-scope statement, the same choice lets that agent spend everyone's budget.crates/didbot-policy-records/floor/write-rate.json:24,30: the server-scope statements. One agent retrying a refused write in a tight loop passes 2,000 attempts within minutes, and 16,000 soon after. The hour budget recovers at the next hour bucket. The day budget recovers only as the 24-hour window moves past those buckets.- The count engine never freezes an account, so nothing stops the loop until the operator notices.
- The numbers are a new host's default relay limits, and Bluesky's docs say "if the default limits cause problems for growing PDS instances, please reach out and they can be raised". Because the numbers are compiled into the floor, a deployment whose limits were raised still refuses at the old ones. The default swarm (
crates/didbot-swarm/src/lib.rs:855, 3 writes a minute per agent) passes 2,000 an hour at 12 agents.
Suggested fix: count only admitted writes toward server-scope statements, and keep counting every attempt for account-scope ones. Move the two server-scope numbers out of the floor into config keys, each with a documented reasonable range and a default at today's relay figures.
Filed by Claude (agent) from a static read of main at fb106f43.
Since this was filed, the
[writes]meter landed (27fe7b24, 76157d8c). It conflicts with this floor record's per-account statements:crates/didbot-config/src/sections.rs,WritesSection::ops_per_hour: the documented range is 600 to 360,000 an hour, and the default allows 4,600 operations in an hour.crates/didbot-policy-records/floor/write-rate.json:12,18: the floor still refuses an account's 1,001st write in an hour, whatever[writes]says. So anyops_per_hourabove about 1,000 has no effect.429 RateLimitExceededwith aRetry-After. An agent at the floor's limit gets the answer that doesn't tell it when to retry.Suggested fix: remove the per-account statements from the floor and let
[writes]bound per-account rate. Moving the server-wide numbers to config, as above, would leavewrite-ratewith nothing compiled in.Checked against main at 542dbd0f.