L−1 — Edge defense

Status: stub. Day 4 deliverable — full R1–R6 rules + p95/p99 headroom math.

Six independent rate-limit / authentication rules (R1–R6) compose at the edge before any handler allocates a buffer. The mathematical guarantee in Blueprint v4.0 §3.4:

\max\;writeQPS \le \sum_{tenant} \min(plan.rps,\; R1 \cdot |IPs|,\; R2 \cdot |ASNs|)

Anonymous traffic is clamped to zero on every metered route by R5 — even a 10,000-IP distributed attack runs out of tenant-scoped tokens before D1 sees a single write.