refactor: replace CF budget tracking with in-memory invalid requests tracker

- Removed the CF budget tracking mechanism and its associated files.
- Introduced an in-memory invalid requests tracker that counts 401, 403, and non-shared 429 responses.
- Updated the Proxy to use the new invalid requests tracker for rate limiting decisions.
- Adjusted related documentation and admin commands to reflect the changes in tracking invalid requests.
- Ensured that multi-replica deployment remains incompatible due to the nature of the in-memory tracking.

Author: acehox

CONTEXT.md

@@ -12,17 +12,17 @@
 
 - **Passthrough** — any non-crosspost Discord REST request from the bot's discord.js Client. Forwarded by the Proxy unchanged with all `x-ratelimit-*` headers preserved, since the bot's Client uses them to maintain its handler/hash collections.
 
-- **CF budget** — the rolling 10-minute count of invalid requests (401/403/429) Cloudflare uses to ban an egress IP. Tracked in-memory via `RESTEvents.InvalidRequestWarning`. Single-replica only.
+- **Invalid requests** — the rolling 10-minute count of invalid requests Cloudflare uses to ban an egress IP. Counts 401, 403, and 429 except those with `X-RateLimit-Scope: shared`. Tracked in-memory via `RESTEvents.Response`. Single-replica only.
 
 - **Sublimit** — Discord's per-channel 10/hour shared 429 on crossposts. Surfaces as `RateLimitError` with `scope: 'shared'`.
 
 - **Blocked cache** — negative TTL'd record marking a channel as un-crosspostable (401/403). Cleared by the bot via `DELETE /internal/blocked/:id` on permission updates.
 
 ## Internal Proxy modules
 
-- **Gateway** — owns the `REST` instance, the `rejectOnRateLimit` predicate, REST event listeners, the CF-budget tracker, and the passthrough Express route. Pure rate-limit-sync concern.
+- **Gateway** — owns the `REST` instance, the `rejectOnRateLimit` predicate, REST event listeners, the invalid-requests tracker, and the passthrough Express route. Pure rate-limit-sync concern.
 
-- **Crosspost** — owns the BullMQ queue + worker, the gate (CF-budget + blocked + sublimit), the Discord-error classifier, the Redis-backed caches, and the enqueue Express route.
+- **Crosspost** — owns the BullMQ queue + worker, the gate (invalid-requests + blocked + sublimit), the Discord-error classifier, the Redis-backed caches, and the enqueue Express route.
 
 The Crosspost module calls `Gateway.rest.post(...)` directly (in-process function call, not HTTP).
 
@@ -32,4 +32,4 @@ The Crosspost module calls `Gateway.rest.post(...)` directly (in-process functio
 
 - **Explicit RPC bot↔proxy for crossposts.** Bot calls `POST /crosspost/:channelId/:messageId` (empty body) instead of letting the Proxy intercept Discord-shaped URLs. Keeps the async-queue semantics visible at the call site.
 
-- **CF budget in-memory.** Relies on single-replica deployment. Multi-replica deployment requires moving this back to Redis.
+- **Invalid-requests in-memory.** Relies on single-replica deployment. Multi-replica deployment requires moving this back to Redis.

docs/PROXY_MIGRATION.md

@@ -12,11 +12,11 @@ The `refactor/v7` branch experimented with splitting these concerns into two ser
 
 ## Decision
 
-The Proxy is one Node process. The Crosspost module calls the Gateway's REST instance directly via in-process function calls — no HTTP hop between them. Scaling out to multiple processes is not a goal; if it becomes one, this ADR is reopened together with [ADR 0003](./0003-cf-budget-in-memory.md).
+The Proxy is one Node process. The Crosspost module calls the Gateway's REST instance directly via in-process function calls — no HTTP hop between them. Scaling out to multiple processes is not a goal; if it becomes one, this ADR is reopened together with [ADR 0003](./0003-invalid-requests-in-memory.md).
 
 ## Consequences
 
 - One Docker container, one port, one lifecycle to manage.
 - The Crosspost worker shares the same REST bucket state as passthrough — both contribute to and observe the same rate-limit handlers.
-- Multi-replica deployment is not currently supported. Doing so would require sharing CF-budget state ([ADR 0003](./0003-cf-budget-in-memory.md)) and routing crosspost traffic to a single replica or sharding by `channelId`.
+- Multi-replica deployment is not currently supported. Doing so would require sharing the invalid-requests tracker state ([ADR 0003](./0003-invalid-requests-in-memory.md)) and routing crosspost traffic to a single replica or sharding by `channelId`.
 - The internal split into `Gateway` and `Crosspost` modules is justified by testability and locality, not by anticipating a future service split.

docs/adr/0001-proxy-stays-single-process.md

@@ -0,0 +1,42 @@
+# ADR 0003: Invalid requests tracked in-memory via REST events
+
+## Status
+
+Accepted — 2026-05-08
+Updated — 2026-05-10 (switched source from `InvalidRequestWarning` to `Response` event to exclude shared-scope 429s)
+
+## Context
+
+Cloudflare bans the bot's egress IP if more than ~10 000 invalid requests (401/403/429) are seen in a 10-minute rolling window. The Proxy must shed crosspost work before this threshold is crossed.
+
+Per [Discord's docs](https://docs.discord.com/developers/topics/rate-limits#invalid-request-limit-aka-cloudflare-bans), 429 responses with `X-RateLimit-Scope: shared` are **not** counted by Cloudflare. Sublimit responses on the crosspost route arrive with `scope=shared` and must be excluded.
+
+`@discordjs/rest` exposes two relevant events:
+
+- `RESTEvents.InvalidRequestWarning` — fires on 401/403/429 but does **not** check `X-RateLimit-Scope` before counting (see `incrementInvalidCount` in `dist/index.js`). Inflates the count by every shared 429.
+- `RESTEvents.Response` — fires once per response with the raw `Response` object, allowing direct inspection of `X-RateLimit-Scope`.
+
+The previous design hand-counted invalid responses via Redis with unique UUID keys and a 10-min TTL. Single-process Proxy ([ADR 0001](./0001-proxy-stays-single-process.md)) makes Redis unnecessary for this counter.
+
+## Decision
+
+The invalid-requests tracker is in-memory. It listens on `RESTEvents.Response` and increments only when:
+
+- `status === 401` or `status === 403`, OR
+- `status === 429` AND `X-RateLimit-Scope !== 'shared'`
+
+It stores `{ count, expiresAt }` with a fixed 10-minute window — first counted request after expiry resets the window and starts at count=1, mirroring the library's internal logic.
+
+The crosspost gate reads this synchronously to decide whether to shed.
+
+`InvalidRequestWarning` is no longer used. `invalidRequestWarningInterval` is dropped from REST options.
+
+## Consequences
+
+- Excludes shared-scope 429s correctly — produces a count consistent with what Cloudflare actually sees on its end.
+- Strictly more accurate than the prior hand-counted tally and than `InvalidRequestWarning`.
+- One fewer Redis database, one fewer connection, one fewer failure mode.
+- Gate decisions are synchronous on this dimension (no Redis round-trip).
+- **Multi-replica deployment is now incompatible.** Two Proxy replicas behind one egress IP would each track only their own slice of invalid requests, undercounting against the CF budget. If multi-replica becomes a goal, the tracker moves back to a shared store and this ADR is reopened.
+- Restarting the Proxy resets the count. Acceptable because Cloudflare's window is also rolling and the Proxy is rarely restarted under load.
+- Fixed-window approximation: count snaps to 0 at window expiry rather than decaying continuously. Cheaper than a sliding window and accurate enough for a safety-net threshold of 5 000.

docs/adr/0003-cf-budget-in-memory.md

@@ -12,7 +12,7 @@ const get = async () => {
       handlers: number;
       activeHandlers: number;
       hashes: number;
-      cfBudget: {
+      invalidRequests: {
         count: number;
         expiresInMs: number;
       };

docs/adr/0003-invalid-requests-in-memory.md

@@ -21,9 +21,9 @@ export default new AdminCommand(CommandNames.INFO, async ({ channel }) => {
     '### Channels:',
     `> Sublimited: ${data?.sublimitCount}`,
     `> Blocked: ${data?.blockedCount}`,
-    '### CF budget (10min window):',
-    `> Invalid requests: ${data?.rest.cfBudget.count ?? 0}`,
-    `> Window remaining: ${Math.round((data?.rest.cfBudget.expiresInMs ?? 0) / 1_000)}s`,
+    '### Invalid requests (10min window):',
+    `> Count: ${data?.rest.invalidRequests.count ?? 0}`,
+    `> Window remaining: ${Math.round((data?.rest.invalidRequests.expiresInMs ?? 0) / 1_000)}s`,
   ];
   channel.send(parsedData.join('\n'));
 });

services/bot/src/services/info.ts

@@ -1,7 +1,7 @@
-import type { CfBudget } from '../gateway/cfBudget.js';
+import type { InvalidRequestsTracker } from '../gateway/invalidRequests.js';
 import type { BlockedCache, SublimitCounter } from './caches.js';
 
-export type GateRejectReason = 'cf_budget' | 'blocked' | 'sublimit';
+export type GateRejectReason = 'invalid_requests' | 'blocked' | 'sublimit';
 
 export type GateVerdict =
   | { kind: 'allow' }
@@ -12,12 +12,12 @@ export type Gate = {
 };
 
 export const createGate = (deps: {
-  cfBudget: CfBudget;
+  invalidRequests: InvalidRequestsTracker;
   blocked: BlockedCache;
   sublimit: SublimitCounter;
 }): Gate => ({
   evaluate: async (channelId) => {
-    if (deps.cfBudget.isOverThreshold()) return { kind: 'reject', reason: 'cf_budget' };
+    if (deps.invalidRequests.isOverThreshold()) return { kind: 'reject', reason: 'invalid_requests' };
     if (await deps.blocked.isBlocked(channelId)) return { kind: 'reject', reason: 'blocked' };
     if (await deps.sublimit.isOverLimit(channelId)) return { kind: 'reject', reason: 'sublimit' };
     return { kind: 'allow' };

services/bot/src/utils/admin-commands/info.ts

@@ -12,7 +12,7 @@ const QUEUE_NAME = 'crosspost';
 const QUEUE_DB = 0;
 const QUEUE_HIGH_WATER = 10_000;
 const RATE_LIMIT_RETRY_CAP_MS = 5 * 60 * 1_000;
-const CF_BUDGET_DELAY_MS = 60_000;
+const INVALID_REQUESTS_DELAY_MS = 60_000;
 const CHANNEL_ID_PATTERN = /^\d{17,19}$/;
 
 export type CrosspostJobData = {
@@ -89,9 +89,9 @@ export const createCrosspostQueue = (deps: {
     const { channelId, messageId } = job.data;
     const verdict = await deps.gate.evaluate(channelId);
     if (verdict.kind === 'reject') {
-      if (verdict.reason === 'cf_budget') {
-        logger.warn({ event: 'crosspost.shed.cf_budget', channelId, messageId });
-        await job.moveToDelayed(Date.now() + CF_BUDGET_DELAY_MS, job.token);
+      if (verdict.reason === 'invalid_requests') {
+        logger.warn({ event: 'crosspost.shed.invalid_requests', channelId, messageId });
+        await job.moveToDelayed(Date.now() + INVALID_REQUESTS_DELAY_MS, job.token);
         throw new DelayedError();
       }
       logger.debug({ event: 'crosspost.skipped', channelId, messageId, reason: verdict.reason });
@@ -126,8 +126,8 @@ export const createCrosspostQueue = (deps: {
 
     const verdict = await deps.gate.evaluate(channelId);
     if (verdict.kind === 'reject') {
-      if (verdict.reason === 'cf_budget') {
-        logger.warn({ event: 'crosspost.rejected.cf_budget', channelId, messageId });
+      if (verdict.reason === 'invalid_requests') {
+        logger.warn({ event: 'crosspost.rejected.invalid_requests', channelId, messageId });
         res.setHeader('Retry-After', '60').status(503).end();
         return;
       }