{
  "ticket": "B04",
  "date": "2026-09-08",
  "boundary": "Real local API, authentication, endpoint authorization, partitioned rate limiter, B02 middleware and synthetic SQLite data",
  "before": {
    "accountAStatuses": [200, 200],
    "accountBStatusesOnSameIP": [429, 429],
    "safeAssertionFailed": true
  },
  "after": {
    "aFirst": { "A": { "admitted": 2, "rejected": 1 }, "B": { "admitted": 2, "rejected": 1 } },
    "bFirst": { "A": { "admitted": 2, "rejected": 1 }, "B": { "admitted": 2, "rejected": 1 } },
    "concurrent": { "sessionsPerAccount": 2, "auth": ["cookie", "bearer"], "admitted": 4, "subsequentRejectedAcrossOtherIPs": 4 },
    "craftedEmailSendOwner": { "B": { "chargedAttempts": 10, "rejectedByRateLimit": 1 }, "A": { "chargedAttempts": 10, "rejectedByRateLimit": 1 }, "emailsSent": 0, "staleOrForgedContextStatusBeforeExhaustion": 409 },
    "invalidCredentials": { "categories": 7, "protectedAccountEndpointStatus": 401, "accountPartitionReached": false, "anonymousLoginScope": "IP; 10 admitted validation attempts then 429 per IP" },
    "untrustedProxyHeaders": { "source": "127.0.0.2", "admittedValidationAttempts": 10, "changedForwardedHeadersCannotEvade429": true, "secondSource127_0_0_3Status": 400 },
    "rateResponse": { "status": 429, "retryAfterSeconds": "positive fixed-window lease metadata", "cacheControl": "no-store", "code": "rate_limit_exceeded" }
  },
  "finalOrder": "Existing CSRF, authentication, endpoint authorization, rate limiting, B02 session context, controller",
  "scopeLimits": "Process-local policy counters; live external OAuth and production ingress not exercised. IP security policies and B03 global rendering admission remain distinct.",
  "originalEvidencePreserved": true
}