@@ -0,0 +1,18 @@
+---
+'@objectstack/runtime': patch
+'@objectstack/service-sms': patch
+'@objectstack/service-automation': patch
+'@objectstack/core': patch
+---
+
+fix(server): every budget counter holds its limit under concurrent requests, counts in a registered `cache` service, and keeps its in-process fallback bounded
+
+Clause-②: no
+Metadata-protocol: none
+
+The rule `@objectstack/plugin-auth`'s counters already follow now holds for the server's other budget counters (ADR-0069 D2).
+
+- **`@objectstack/runtime`: a token bucket holds its budget under concurrency inside one process.** Updates of one bucket key are serialised in the process, so the inbound limiter (`server.security.rateLimit`) and a declared endpoint `rateLimit` admit no more requests than their budget for one caller however many arrive at once. Other callers keep counting concurrently.
+- **The counters count in the registered `cache`.** When a `cache` service is registered, as a value or as a factory, the runtime's inbound and endpoint buckets, the daily SMS send quota (`@objectstack/service-sms`) and the `notify` node's per-address email-field limit (`@objectstack/service-automation`) count in it. The kernel's own in-memory stand-in is not a shared store: with no cache plugin they keep their bounded per-process fallback and say so once.
+- **`@objectstack/core`: the in-memory `cache` fallback stays bounded.** Entries whose time-to-live has passed leave it without having to be read again, so it holds at most about twice its live entries. Nothing live is evicted; the `ICacheService` contract is unchanged.
+- **Across nodes, unchanged.** `ICacheService` has no atomic increment, so two nodes that share one cache can still over-admit slightly between them, as documented.
@@ -0,0 +1,58 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The rule these pin: the kernel's in-memory `cache` stand-in stays bounded by
+ * what is live. Entries whose TTL has passed leave the map without having to
+ * be read again, and nothing live is ever evicted to get there.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { createMemoryCache } from './memory-cache';
+
+const WAVE = 1_000;
+const WAVES = 20;
+
+describe('createMemoryCache — bounded by its live entries', () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+        vi.setSystemTime(1_000_000);
+    });
+    afterEach(() => {
+        vi.useRealTimers();
+    });
+
+    it('many distinct keys that expire unread do not accumulate', async () => {
+        const cache = createMemoryCache();
+        for (let wave = 0; wave < WAVES; wave++) {
+            for (let i = 0; i < WAVE; i++) await cache.set(`wave${wave}:key${i}`, { n: 1 }, 1);
+            // Let the whole wave expire; none of its keys is ever read again.
+            vi.advanceTimersByTime(2_000);
+        }
+        const { keyCount } = await cache.stats();
+        // Unbounded, the map would hold every key ever written (WAVES × WAVE).
+        expect(keyCount).toBeLessThan(3 * WAVE);
+    });
+
+    it('never evicts a live entry: no TTL, or a TTL still running, survives every sweep', async () => {
+        const cache = createMemoryCache();
+        await cache.set('pinned', 'forever');
+        await cache.set('long', 'still-live', 3_600);
+        for (let wave = 0; wave < WAVES; wave++) {
+            for (let i = 0; i < WAVE; i++) await cache.set(`wave${wave}:key${i}`, i, 1);
+            vi.advanceTimersByTime(2_000);
+        }
+        // The last wave was written with time running; write one more, still live.
+        for (let i = 0; i < WAVE; i++) await cache.set(`live:key${i}`, i, 60);
+        expect(await cache.get('pinned')).toBe('forever');
+        expect(await cache.get('long')).toBe('still-live');
+        for (let i = 0; i < WAVE; i++) expect(await cache.get(`live:key${i}`)).toBe(i);
+    });
+
+    it('an expired entry still reads as absent before any sweep reaches it', async () => {
+        const cache = createMemoryCache();
+        await cache.set('k', 'v', 1);
+        vi.advanceTimersByTime(1_500);
+        expect(await cache.get('k')).toBeUndefined();
+    });
+});
@@ -1,5 +1,8 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
+/** The fewest entries at which a write sweeps expired entries out. */
+const SWEEP_FLOOR = 1024;
+
 /**
  * In-memory Map-backed cache fallback.
  *
@@ -15,11 +18,28 @@
  * it as fully `available`. `handlerReady: false` because
  * no HTTP surface is mounted for `cache` at all — the same reason realtime
  * reports false.
+ *
+ * Bounded by what is live: an entry whose TTL has passed is evicted without
+ * having to be read again. A `get` of an expired key drops it as before, and a
+ * `set` that grows the map to the next sweep mark walks it once and drops every
+ * expired entry. The mark is then set to twice the entries left (never below
+ * {@link SWEEP_FLOOR}), so the map holds at most about twice its live entries
+ * and the walks cost O(1) per write, amortised. A key that is written once and
+ * never read again — a per-caller counter, say — therefore does not stay
+ * forever. Nothing live is ever evicted: an entry with no TTL, or a TTL still
+ * running, survives every sweep, so the `ICacheService` contract is unchanged.
  */
 export function createMemoryCache() {
   const store = new Map<string, { value: unknown; expires?: number }>();
   let hits = 0;
   let misses = 0;
+  let sweepAt = SWEEP_FLOOR;
+  const sweepExpired = (now: number): void => {
+    for (const [key, entry] of store) {
+      if (entry.expires && now > entry.expires) store.delete(key);
+    }
+    sweepAt = Math.max(SWEEP_FLOOR, store.size * 2);
+  };
   return {
     __serviceInfo: {
       status: 'degraded' as const,
@@ -38,7 +58,9 @@ export function createMemoryCache() {
       return entry.value as T;
     },
     async set<T = unknown>(key: string, value: T, ttl?: number): Promise<void> {
-      store.set(key, { value, expires: ttl ? Date.now() + ttl * 1000 : undefined });
+      const now = Date.now();
+      store.set(key, { value, expires: ttl ? now + ttl * 1000 : undefined });
+      if (store.size >= sweepAt) sweepExpired(now);
     },
     async delete(key: string): Promise<boolean> { return store.delete(key); },
     async has(key: string): Promise<boolean> { return store.has(key); },
 
@@ -0,0 +1,104 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The rule these pin (ADR-0069 D2), through the composed dispatcher: the
+ * inbound limiter's buckets count in the registered `cache` service — a value
+ * or a FACTORY registration — and only when none is registered (the kernel's
+ * own `degraded` stand-in included) in the bounded per-process fallback.
+ *
+ * Booted on a real `ObjectKernel`, the kernel that supports factory
+ * registrations, over a real socket.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { createMemoryCache, ObjectKernel, type Plugin, type PluginContext } from '@objectstack/core';
+import { HonoServerPlugin } from '@objectstack/plugin-hono-server';
+import type { IHttpServer } from '@objectstack/spec/contracts';
+
+import { createDispatcherPlugin } from './dispatcher-plugin.js';
+
+const BUDGET = { enabled: true, windowMs: 60_000, maxRequests: 2 };
+
+function fakeAuthPlugin(): Plugin {
+    return {
+        name: 'com.objectstack.test.fake-auth',
+        version: '1.0.0',
+        init: async (ctx: PluginContext) => {
+            ctx.registerService('auth', {
+                api: {
+                    getSession: async ({ headers }: { headers: any }) => {
+                        const uid = typeof headers?.get === 'function' ? headers.get('x-test-user') : headers?.['x-test-user'];
+                        return uid ? { user: { id: uid } } : undefined;
+                    },
+                },
+            });
+        },
+    };
+}
+
+function cachePlugin(register: (ctx: PluginContext) => void): Plugin {
+    return { name: 'com.objectstack.test.cache', version: '1.0.0', init: async (ctx: PluginContext) => register(ctx) };
+}
+
+async function boot(register: (ctx: PluginContext) => void) {
+    const kernel = new ObjectKernel({ logger: { level: 'silent' }, gracefulShutdown: false, skipSystemValidation: true });
+    await kernel.use(fakeAuthPlugin());
+    await kernel.use(cachePlugin(register));
+    await kernel.use(new HonoServerPlugin({ port: 0 }));
+    await kernel.use(createDispatcherPlugin({
+        prefix: '/api/v1',
+        securityHeaders: false,
+        rateLimit: { budget: BUDGET, trustProxy: false },
+    }));
+    await kernel.bootstrap();
+    const httpServer = kernel.getService<IHttpServer>('http.server');
+    return { kernel, baseUrl: `http://127.0.0.1:${httpServer.getPort!()}` };
+}
+
+async function shutdown(kernel: ObjectKernel | undefined) {
+    if (!kernel) return;
+    await Promise.race([kernel.shutdown(), new Promise<void>((resolve) => setTimeout(resolve, 10_000))]);
+}
+
+async function statusesFor(baseUrl: string, user: string, n: number): Promise<number[]> {
+    const statuses: number[] = [];
+    for (let i = 0; i < n; i++) {
+        statuses.push((await fetch(`${baseUrl}/api/v1/health`, { headers: { 'x-test-user': user } })).status);
+    }
+    return statuses;
+}
+
+describe('inbound limiter, `cache` registered by FACTORY', () => {
+    const entries = new Map<string, unknown>();
+    let kernel: ObjectKernel;
+    let baseUrl: string;
+
+    beforeAll(async () => {
+        ({ kernel, baseUrl } = await boot((ctx) => ctx.registerServiceFactory('cache', () => ({
+            get: async (key: string) => entries.get(key),
+            set: async (key: string, value: unknown) => { entries.set(key, value); },
+        }))));
+    }, 30_000);
+    afterAll(() => shutdown(kernel), 30_000);
+
+    it("the caller's bucket lives in the registered cache, and the budget holds", async () => {
+        expect(await statusesFor(baseUrl, 'usr_factory', BUDGET.maxRequests + 1)).toEqual([200, 200, 429]);
+        expect([...entries.keys()]).toContain('principal:usr_factory');
+    });
+});
+
+describe("inbound limiter, only the kernel's `degraded` stand-in registered", () => {
+    const standIn = createMemoryCache();
+    let kernel: ObjectKernel;
+    let baseUrl: string;
+
+    beforeAll(async () => {
+        ({ kernel, baseUrl } = await boot((ctx) => ctx.registerService('cache', standIn)));
+    }, 30_000);
+    afterAll(() => shutdown(kernel), 30_000);
+
+    it('the stand-in is not counted in: the bounded fallback holds the budget', async () => {
+        expect(await statusesFor(baseUrl, 'usr_standin', BUDGET.maxRequests + 1)).toEqual([200, 200, 429]);
+        expect((await standIn.stats()).keyCount).toBe(0);
+    });
+});
@@ -4,7 +4,6 @@ import { Plugin, PluginContext, IHttpServer, ANONYMOUS_DENY_BODY, ANONYMOUS_DENY
 import { looksLikeInternalErrorLeak, INTERNAL_ERROR_MESSAGE, resolveThrownHttpError, serverFaultProvenance, declaredRefusalMessage, demotedDeclaredCode, logServerFault, describeFaultRequest, inProcessSessionReadInput } from '@objectstack/types';
 import { DispatcherErrorCode } from '@objectstack/spec/api';
 import type { IAuthService, IMetadataService, Logger } from '@objectstack/spec/contracts';
-import type { CounterStore } from '@objectstack/plugin-auth/rate-limit-storage';
 import { HttpDispatcher, HttpDispatcherResult, type HttpProtocolContext } from './http-dispatcher.js';
 import { isServiceServeable } from './service-serveable.js';
 import { deferRequestBody } from './deferred-request-body.js';
@@ -21,6 +20,7 @@ import {
 } from './security/index.js';
 import { resolveSessionData, resolveSessionPrincipalId } from './security/resolve-session-principal.js';
 import { buildActorUser } from './security/actor-user.js';
+import { resolveKernelCache } from './security/kernel-cache.js';
 import {
     NoopMetricsRegistry,
     NoopErrorReporter,
@@ -911,7 +911,7 @@ export function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plu
                         safeGetService<IAuthService>(ctx, 'auth'),
                         headers as Record<string, unknown>,
                     ),
-                resolveCache: async () => safeGetService<CounterStore>(ctx, 'cache'),
+                resolveCache: () => resolveKernelCache(ctx),
                 logger: ctx.logger,
             });
             // `null` = no budget declared, or declared disabled. Nothing is
@@ -2190,7 +2190,7 @@ export function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plu
                 // Same `resolveCache` the server-level limiter uses, so one
                 // deployment has one counter backend, not two.
                 const endpointLimiters = createEndpointRateLimiterRegistry({
-                    resolveCache: async () => safeGetService<CounterStore>(ctx, 'cache'),
+                    resolveCache: () => resolveKernelCache(ctx),
                     logger: ctx.logger,
                 });
 
 
@@ -0,0 +1,120 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The rule these pin (ADR-0069 D2): inside one process, a token bucket admits
+ * no more than its budget however many requests for one key arrive at once —
+ * in a networked cache whose read and write are separate awaited calls, and in
+ * the per-process fallback alike. Serialisation is per KEY: other keys keep
+ * counting concurrently, and nothing is left behind once a burst has drained.
+ *
+ * The same `SharedTokenBucketLimiter` backs the server-level inbound limiter
+ * and the declarative endpoint limiters, so both are exercised through their
+ * public builders.
+ */
+
+import { describe, expect, it } from 'vitest';
+import type { CounterStore } from '@objectstack/plugin-auth/rate-limit-storage';
+
+import { createEndpointRateLimiterRegistry } from '../endpoint-policy.js';
+import { createInboundRateLimitMiddleware, SharedTokenBucketLimiter } from './inbound-rate-limit.js';
+import { serializePerKey, serializedKeysInFlight } from './per-key-serial.js';
+
+const BURST = 20;
+const CAPACITY = 3;
+/** A slow refill, so no token comes back while a burst is in flight. */
+const BUCKET = { capacity: CAPACITY, refillPerSec: 0.001 } as const;
+const CLOCK = (): number => 1_000_000;
+
+/** A cache stand-in whose reads and writes each cross a macrotask, as a networked store's do. */
+function makeNetworkedCache(): CounterStore & { readonly store: Map<string, unknown> } {
+    const store = new Map<string, unknown>();
+    const hop = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0));
+    return {
+        store,
+        async get<T = unknown>(key: string): Promise<T | undefined> {
+            await hop();
+            return store.get(key) as T | undefined;
+        },
+        async set<T = unknown>(key: string, value: T): Promise<void> {
+            await hop();
+            store.set(key, value);
+        },
+    };
+}
+
+async function admittedOfBurst(consume: () => Promise<{ allowed: boolean }>): Promise<number> {
+    const decisions = await Promise.all(Array.from({ length: BURST }, consume));
+    return decisions.filter((d) => d.allowed).length;
+}
+
+describe('concurrent consumes of one key never exceed the budget (one process)', () => {
+    it('networked cache: exactly `capacity` of the burst are admitted', async () => {
+        const cache = makeNetworkedCache();
+        const limiter = new SharedTokenBucketLimiter(BUCKET, async () => cache, CLOCK);
+        expect(await admittedOfBurst(() => limiter.consume('principal:burst'))).toBe(CAPACITY);
+        // The stored bucket is empty: every admitted request spent its token.
+        expect(JSON.parse(cache.store.get('principal:burst') as string)).toMatchObject({ t: 0 });
+    });
+
+    it('per-process fallback (no cache service): exactly `capacity` of the burst are admitted', async () => {
+        const middleware = createInboundRateLimitMiddleware({
+            budget: { enabled: true, maxRequests: CAPACITY, windowMs: 3_600_000 },
+            resolveCache: async () => undefined,
+        })!;
+        let passed = 0;
+        let refused = 0;
+        await Promise.all(Array.from({ length: BURST }, async () => {
+            const res: any = {
+                status(code: number) { if (code === 429) refused++; return res; },
+                header() { return res; },
+                json() {},
+                send() {},
+            };
+            const req: any = { method: 'GET', path: '/api/v1/x', headers: {}, query: {}, params: {}, remoteAddress: '10.9.9.9' };
+            await middleware(req, res, async () => { passed++; });
+        }));
+        expect(passed).toBe(CAPACITY);
+        expect(refused).toBe(BURST - CAPACITY);
+    });
+
+    it('declared endpoint budget: exactly `capacity` of the burst are admitted', async () => {
+        const cache = makeNetworkedCache();
+        const registry = createEndpointRateLimiterRegistry({ resolveCache: async () => cache, now: CLOCK });
+        const limiter = registry.limiterFor({
+            name: 'burst_endpoint',
+            rateLimit: { enabled: true, maxRequests: CAPACITY, windowMs: 3_600_000 },
+        } as never)!;
+        expect(await admittedOfBurst(() => limiter.consume('endpoint:burst_endpoint:ip:10.0.0.1'))).toBe(CAPACITY);
+    });
+
+    it('serialisation is per key: a burst on one key does not change another key', async () => {
+        const cache = makeNetworkedCache();
+        const limiter = new SharedTokenBucketLimiter(BUCKET, async () => cache, CLOCK);
+        const [a, b] = await Promise.all([
+            admittedOfBurst(() => limiter.consume('ip:10.0.0.1')),
+            admittedOfBurst(() => limiter.consume('ip:10.0.0.2')),
+        ]);
+        expect([a, b]).toEqual([CAPACITY, CAPACITY]);
+    });
+
+    it('a key parked inside its update does not hold up another key', async () => {
+        let release!: () => void;
+        const parked = serializePerKey('parked', () => new Promise<void>((resolve) => { release = resolve; }));
+        await expect(serializePerKey('other', async () => 'ran')).resolves.toBe('ran');
+        release();
+        await parked;
+    });
+
+    it('a failing update releases the next one, and no key is left behind once a burst drains', async () => {
+        const failing = serializePerKey('k', async () => { throw new Error('store down'); });
+        const next = serializePerKey('k', async () => 'next');
+        await expect(failing).rejects.toThrow('store down');
+        await expect(next).resolves.toBe('next');
+
+        const cache = makeNetworkedCache();
+        const limiter = new SharedTokenBucketLimiter(BUCKET, async () => cache, CLOCK);
+        await admittedOfBurst(() => limiter.consume('principal:drain'));
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        expect(serializedKeysInFlight()).toBe(0);
+    });
+});