Spend Ceiling Limiter

An ordinary rate limiter protects against LOAD. It does not protect against COST, and those want opposite settings: generous to one honest user, absolutely rigid about the total bill. The daily ceiling is checked FIRST, because it is a property of the wallet rather than of any caller.

TWO REAL BUGS found in the live source while packaging it. The rejection path was the leak: the original used a defaultdict, so merely LOOKING UP an address allocated an entry, and every rejected request left a key behind. An attacker being actively blocked grew the map on each attempt. Measured: 500 distinct callers against a 40-per-minute cap left 500 resident entries for 40 served requests. And stale callers were never evicted, because self-cleaning only removed an address when that same address returned.

VERIFIED: 14 tests, 6 deliberate defects applied to the real source, 5 caught and 1 proved unreachable (the sweep cannot evict the caller it is deciding about, because check() self-cleans that entry first); the set and the proof ship in mutations.json. One mutation of mine survived on the first attempt and that was my error, not a weak test.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence -- unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction: do not republish the source as source.