# v1.7 disclosure — fragment 3 of 4: claim-set G rate-limiting

Calibration fragment — per-class rollup and row-level findings for
claim-set G (rate-limiting review), findings G-9 through G-11.

## Per-class rollup

| class | n | TP | CTX | NOISE | noise driver |
|---|---|---|---|---|---|
| bucket-scope | 2 | 2 | 0 | 0 | — |
| bypass-header | 1 | 0 | 0 | 1 | — |
| **total** | **3** | **2** | **0** | **1** | |

Severity mix: 1 HIGH / 1 MED / 1 LOW.

**Adjudicated precision: 2/3 = 66.7%.**

## Row-level table (all 3)

| # | claim | sev | class.rule | location | verdict | note |
|---|---|---|---|---|---|---|
| 1 | G-9 | HIGH | bucket-scope.r1 | api/limit.js:12 | TP | limiter keyed on spoofable X-Forwarded-For |
| 2 | G-10 | MED | bucket-scope.r2 | api/limit.js:30 | TP | per-user bucket shared across tenants |
| 3 | G-11 | LOW | bypass-header.r1 | api/limit.js:44 | NOISE | internal probe header unreachable in prod path |