Hodor as the Rate-Limiting Choice

Context

The homegrown Redis fixed-window rate-limiting Filter carried high maintenance costs and was coupled to storage.

Decision

Global-side rate limiting adopts the official Drogon Hodor plugin: token bucket, in-process CacheMap (zero external dependencies), IP/user/global tiers, a trust_ips whitelist, pure-JSON configuration; the homegrown Redis fixed window is retired. The rejection body is folded into the error envelope VALIDATION_RATE_LIMITED (429). Mounted only in config.prod.json; authentication-side brute-force protection is carried separately by F-018 failure-count rate limiting (the two operate on different surfaces).

Consequences and Current State

The config.prod.json plugins block is in active use; see the rate-limiting section of security-architecture.