@

v0.129.0: CAMPAIGN-4 fixes — rate-limiter key (F-B) + volume-blind estimate (F-A) + no-op claim status (F-C)

F-B (MED, security): shared clientIP(r) helper (XFF first-hop, else SplitHostPort
host, else raw) replaces requestIP + the duplicated inline derivation in handleLogin,
so login AND escrow re-auth key on the port-stripped host IP — distinct direct
connections no longer evade the failed-attempt counter. XFF-trust out of scope (commented).

F-A (MED, honesty): volumeSizer seam reads volume size from a container view
(docker run --rm -v vol:/vol:ro alpine du -sb /vol), replacing the host-path du that
returned 0 inside the containerized controller. Failed read -> size_unknown +
fits_on_dest forced false (never "fits"). Export pre-flight hard-aborts only on a
KNOWN doesn.t-fit. HDD branch unchanged.

F-C (LOW-MED): escrowClaimAPIHandler relays agent 404 -> clean 404 and 409 -> 409;
410 and genuine-unreachable 502 unchanged (was: 404 fell through to 502).

Tests + red-proofs: ratelimit_ip_test.go (F-B x6), estimate_volsize_test.go (F-A x3),
TestEscrowClaim_ProxySemantics +3 (F-C). Alpine busybox du -sb verified prod-valid.

Claude-Session: https://claude.ai/code/session_01LbMm4T7Ayzs1unB9pN6Uqd
@

controller/README.md

@@ -1623,7 +1623,10 @@ race where a new `felhom.<domain>` cert appears in CT logs minutes before any pa
   registered address only. Reset rides the same page (a claimed box reaches `/claim` pre-auth).
 - **Anti-brute-force**: per-source + global counter, 5 failures → 15-minute lockout (both scopes),
   raising the allowlisted `claim_lockout` event. Pre-auth CSRF is an HMAC over `web.session_secret`
-  (fixes the CTRL-007 bare-double-submit weakness).
+  (fixes the CTRL-007 bare-double-submit weakness). The per-source key is the client IP resolved by
+  the shared `clientIP(r)` helper — XFF first-hop, else `RemoteAddr` with the ephemeral **port
+  stripped** (v0.129.0 F-B; keying on the raw `RemoteAddr` let distinct direct connections evade the
+  counter). The login form and the escrow wizard re-auth share the same helper/key.
 - **Delivery**: the hub bakes `web.claim_code_{hash,generation,issued_at}` into the Day-0
   controller.yaml (gate-from-first-boot) and serves the freshest state in the report ACK
   (`report/claim_sync.go` caches it idempotently by generation — newer advances, same/older/nil