@@ -36,6 +36,21 @@ use crate::git::visibility_pack::{
 use crate::state::AppState;
 use crate::visibility::{visibility_check, Decision};
 
+/// Hard ceiling on the number of full-history reachability walks a single
+/// `GET /ipfs/{cid}` request may spawn. The per-request `ipfs_rate_limiter`
+/// check brakes *repeat* requests, but within one request the object can exist
+/// under path-scoped rules in many repos, and each distinct repo pays its own
+/// `spawn_blocking` walk (the memo only dedups the same repo). Without a ceiling
+/// a single request fans out to O(repos) walks for one rate-limiter token — an
+/// amplification sink (INV-10). Once this many walks have run, no further walk is
+/// spawned for the rest of the request: any remaining candidate that still needs
+/// a walk is skipped (and, with nothing else readable, the request falls through
+/// to the opaque 404). The bound is deliberately generous: a legitimate caller
+/// serves on the first repo that grants them, so reaching it requires being
+/// denied by this many path-scoped repos first, which real traffic effectively
+/// never does. Tunable if that assumption stops holding.
+pub(crate) const MAX_HISTORY_WALKS_PER_REQUEST: u32 = 16;
+
 /// GET /ipfs/{cid}
 ///
 /// Resolve the CIDv1 to its git oid via the `pinned_cids` table, then search all
@@ -158,6 +173,11 @@ pub async fn get_by_cid(
     // reused across candidates.
     let mut walk_rate_checked = false;
 
+    // Per-request full-history walk budget (INV-10). Declared outside BOTH loops
+    // so it persists across oid candidates: once spent, the next candidate's walk
+    // is skipped too, so a multi-oid CID cannot re-open the fan-out per candidate.
+    let mut walks: u32 = 0;
+
     // Outer loop over every oid the CID maps to (#173): the cid index is
     // non-unique, so try each candidate and serve the first readable one rather
     // than false-404 when an arbitrary pick is withheld/absent while another is
@@ -208,6 +228,21 @@ pub async fn get_by_cid(
                     &mut allowed_tree_memo
                 };
                 if !memo.contains_key(&repo.id) {
+                    // Per-request fan-out ceiling (INV-10): once this request has
+                    // spawned MAX_HISTORY_WALKS_PER_REQUEST walks, stop paying more
+                    // O(history) walks for this oid candidate. `break` (not
+                    // `break 'outer`) is deliberate: the budget persists across the
+                    // outer oid loop, so a later candidate that can be served WITHOUT
+                    // a walk (a `commit`/`tag`, or a no-rule public copy) is still
+                    // served, while any further walk it would need re-trips this
+                    // guard and is skipped. Breaking the whole search instead would
+                    // 404 that free candidate for no amplification benefit. A repo
+                    // set with no walk-free candidate left simply falls through to
+                    // the opaque 404, exactly as if none were readable.
+                    if walks >= MAX_HISTORY_WALKS_PER_REQUEST {
+                        break;
+                    }
+                    walks += 1;
                     // First actual walk of this request: brake it on the source IP
                     // once. A memo hit below never reaches here, so a same-request
                     // re-check is impossible. When no key can be resolved (e.g. a
 
@@ -427,22 +427,16 @@ async fn main() -> Result<()> {
 
     // Periodic cleanup of expired rate limit entries + consumed-proof ledger
     {
-        let rl = state.rate_limiter.clone();
-        let create_ip_rl = state.create_ip_rate_limiter.clone();
-        let push_rl = state.push_rate_limiter.clone();
-        let sync_trigger_rl = state.sync_trigger_rate_limiter.clone();
-        let peer_write_rl = state.peer_write_rate_limiter.clone();
+        let cleanup_state = state.clone();
         let db = state.db.clone();
         let mut shutdown_rx = state.subscribe_shutdown();
         tokio::spawn(async move {
             loop {
                 tokio::select! {
                     _ = tokio::time::sleep(std::time::Duration::from_secs(300)) => {
-                        rl.cleanup().await;
-                        create_ip_rl.cleanup().await;
-                        push_rl.cleanup().await;
-                        sync_trigger_rl.cleanup().await;
-                        peer_write_rl.cleanup().await;
+                        // Sweep every per-IP/DID limiter (incl. the ipfs walk brake)
+                        // so bounded maps shed stale keys instead of sitting at cap.
+                        cleanup_state.sweep_rate_limiters().await;
                         let now = std::time::SystemTime::now()
                             .duration_since(std::time::UNIX_EPOCH)
                             .map(|d| d.as_secs() as i64)
 
@@ -130,6 +130,13 @@ impl RateLimiter {
             !w.timestamps.is_empty()
         });
     }
+
+    /// Number of distinct keys currently tracked. Test-only introspection so a
+    /// cross-module test can assert that a sweep actually evicted expired entries.
+    #[cfg(test)]
+    pub(crate) async fn tracked_keys(&self) -> usize {
+        self.state.lock().await.len()
+    }
 }
 
 pub async fn rate_limit_by_did(request: Request, next: Next) -> Response {
 
@@ -104,6 +104,20 @@ impl AppState {
         self.shutdown_tx.subscribe()
     }
 
+    /// Sweep expired entries from every per-IP/DID rate limiter. Driven by the
+    /// periodic cleanup task so a bounded limiter's key map sheds stale entries
+    /// instead of sitting near its cap until an inline capacity sweep reclaims
+    /// them. Every limiter on the state is swept here; adding a new limiter means
+    /// adding it to this list.
+    pub(crate) async fn sweep_rate_limiters(&self) {
+        self.rate_limiter.cleanup().await;
+        self.create_ip_rate_limiter.cleanup().await;
+        self.push_rate_limiter.cleanup().await;
+        self.ipfs_rate_limiter.cleanup().await;
+        self.sync_trigger_rate_limiter.cleanup().await;
+        self.peer_write_rate_limiter.cleanup().await;
+    }
+
     /// Trigger graceful shutdown. Idempotent — calling more than once
     /// has no effect. Returns `true` if this call was the one that
     /// flipped the signal.
 
@@ -2985,6 +2985,215 @@ mod tests {
         );
     }
 
+    /// INV-10 amplification bound: a single `GET /ipfs/{cid}` must not fan out an
+    /// unbounded number of full-history walks. The per-request `ipfs_rate_limiter`
+    /// check only brakes REPEAT requests (it fires once per request); within one
+    /// request the same object can exist under path-scoped rules in many repos,
+    /// each paying its own walk. `MAX_HISTORY_WALKS_PER_REQUEST` caps that fan-out.
+    ///
+    /// Load-bearing witness: a readable public copy (no path rule → served via the
+    /// no-walk path, exactly like `ipfs_cid_served_from_public_copy_when_withheld_elsewhere`)
+    /// is given the OLDEST `updated_at` so `list_all_repos` (ORDER BY updated_at
+    /// DESC) iterates it LAST. Ahead of it sit `cap + 1` path-scoped deniers, each
+    /// forcing an allowed-blob walk that denies anon. An UNCAPPED handler walks
+    /// every denier and then serves the copy (200); the cap stops spawning walks
+    /// after `cap` of them — before the copy is ever reached — and falls through to
+    /// the opaque 404. Neutralizing the `break` in `get_by_cid` (e.g. raising the
+    /// ceiling) turns this 404 back into a 200: the RED proof that the cap, not some
+    /// incidental deny, is what produces the 404.
+    #[sqlx::test]
+    async fn ipfs_walk_fanout_capped_per_request(pool: PgPool) {
+        use crate::db::VisibilityMode;
+        use chrono::Utc;
+        use gitlawb_core::identity::Keypair;
+
+        let owner = Keypair::generate();
+        let owner_did = owner.did().to_string();
+        let slug = owner_did.replace([':', '/'], "_");
+        let short = owner_did.split(':').next_back().unwrap().to_string();
+        let state = test_state(pool).await;
+
+        let cap = crate::api::ipfs::MAX_HISTORY_WALKS_PER_REQUEST as usize;
+
+        // `cap + 1` deniers guarantee the fan-out crosses the ceiling before the
+        // readable copy (iterated last) is reached. All bare clones share identical
+        // content, so the one secret-BLOB CID resolves to `secret_oid` in every repo.
+        let denier_names: Vec<String> = (0..=cap).map(|i| format!("denier{i}")).collect();
+        let mut names: Vec<&str> = vec!["readable"];
+        names.extend(denier_names.iter().map(|s| s.as_str()));
+        let fx = seed_cid_repos(&slug, &short, &names);
+
+        let readable_bare = std::path::PathBuf::from("/tmp")
+            .join(&slug)
+            .join("readable.git");
+        // The secret BLOB CID drives the path-scoped allowed-blob walk in every
+        // denier (the amplification surface) and is served cheaply from the
+        // no-rule public copy — the proven serve path.
+        let secret_cid = pin_cid_for(&readable_bare, &fx.secret_oid, &state.db).await;
+
+        // 1) Readable public copy — OLDEST updated_at → iterated LAST. Public with
+        //    NO visibility rule, so the blob serves via the no-walk path. This is
+        //    the copy an uncapped fan-out would eventually reach and serve.
+        let mut readable = seed_repo(&owner_did, "readable");
+        readable.updated_at = Utc::now() - chrono::Duration::seconds(60);
+        state
+            .db
+            .create_repo(&readable)
+            .await
+            .expect("seed readable copy");
+
+        // 2) cap+1 deniers with NEWER updated_at → iterated before the copy. Public
+        //    at "/", but a `/secret/**` Mode B rule with an EMPTY reader list, so an
+        //    anon blob fetch clears the "/" gate, runs the allowed-blob walk, and is
+        //    denied (the secret blob is in no one's set) → continue. Each distinct
+        //    repo.id is its own walk (the memo only dedups the same repo).
+        for name in &denier_names {
+            let mut denier = seed_repo(&owner_did, name);
+            denier.updated_at = Utc::now();
+            state.db.create_repo(&denier).await.expect("seed denier");
+            state
+                .db
+                .set_visibility_rule(&denier.id, "/secret/**", VisibilityMode::B, &[], &owner_did)
+                .await
+                .expect("path rule");
+        }
+
+        // Anon (no peer, no XFF → the IP brake is skipped, so the walk cap is the
+        // only thing in play). Capped → 404 before the readable copy is reached.
+        let (st, body) = cid_parts(
+            cid_router(&state)
+                .oneshot(cid_anon(&secret_cid))
+                .await
+                .unwrap(),
+        )
+        .await;
+        assert_eq!(
+            st,
+            StatusCode::NOT_FOUND,
+            "the per-request walk fan-out must be capped before serving a copy past the cap"
+        );
+        // Opaque 404 — the withheld blob content must not leak.
+        assert!(
+            !body.contains("TOP SECRET"),
+            "capped 404 must not leak withheld blob content"
+        );
+    }
+
+    /// Multi-oid companion to `ipfs_walk_fanout_capped_per_request`: exercises the
+    /// outer oid loop and proves the ceiling uses a plain `break`, not a
+    /// whole-search break. The walk budget persists across oid candidates (so a
+    /// second candidate can't re-open the fan-out), yet a candidate that needs NO
+    /// walk is still served after the budget is spent.
+    ///
+    /// One CID is mapped to TWO oids (the non-unique cid index, #173): a withheld
+    /// `/secret` blob — walk-triggering, denied to anon in every denier — recorded
+    /// FIRST so a seq scan lists it before the root commit, which is walk-free (a
+    /// `commit` object clears the "/" gate and serves with no allowed-set walk).
+    /// The blob candidate burns the whole walk budget across the deniers; the
+    /// commit candidate is then served anyway (200, `x-git-hash` = the commit oid).
+    /// Reverting the plain `break` to a whole-search break turns this into a 404
+    /// (the RED proof that the ceiling bounds walks without discarding a free
+    /// candidate).
+    #[sqlx::test]
+    async fn ipfs_walk_cap_still_serves_walk_free_candidate(pool: PgPool) {
+        use crate::db::VisibilityMode;
+        use chrono::Utc;
+        use gitlawb_core::identity::Keypair;
+
+        let owner = Keypair::generate();
+        let owner_did = owner.did().to_string();
+        let slug = owner_did.replace([':', '/'], "_");
+        let short = owner_did.split(':').next_back().unwrap().to_string();
+        let state = test_state(pool).await;
+
+        let cap = crate::api::ipfs::MAX_HISTORY_WALKS_PER_REQUEST as usize;
+
+        // cap+1 path-scoped deniers, all carrying identical content (same oids).
+        let denier_names: Vec<String> = (0..=cap).map(|i| format!("m{i}")).collect();
+        let names: Vec<&str> = denier_names.iter().map(|s| s.as_str()).collect();
+        let fx = seed_cid_repos(&slug, &short, &names);
+        let bare = std::path::PathBuf::from("/tmp").join(&slug).join("m0.git");
+
+        // ONE cid → TWO oids. The withheld blob is recorded first (seq scan lists it
+        // first → tried first → burns the budget); the walk-free commit is second.
+        let multi_cid = pin_cid_for(&bare, &fx.secret_oid, &state.db).await;
+        state
+            .db
+            .record_pinned_cid(&fx.commit_oid, &multi_cid)
+            .await
+            .expect("co-locate the commit oid under the same cid");
+
+        for name in &denier_names {
+            let mut d = seed_repo(&owner_did, name);
+            d.updated_at = Utc::now();
+            state.db.create_repo(&d).await.expect("seed denier");
+            state
+                .db
+                .set_visibility_rule(&d.id, "/secret/**", VisibilityMode::B, &[], &owner_did)
+                .await
+                .expect("path rule");
+        }
+
+        // Anon: the blob candidate is denied in every denier (a walk each, capping
+        // out); the commit candidate is walk-free and must still be served.
+        let resp = cid_router(&state)
+            .oneshot(cid_anon(&multi_cid))
+            .await
+            .unwrap();
+        let served_hash = resp
+            .headers()
+            .get("x-git-hash")
+            .and_then(|v| v.to_str().ok())
+            .map(str::to_string);
+        let (st, body) = cid_parts(resp).await;
+        assert_eq!(
+            st,
+            StatusCode::OK,
+            "a walk-free candidate must still be served after the walk budget is spent"
+        );
+        assert_eq!(
+            served_hash.as_deref(),
+            Some(fx.commit_oid.as_str()),
+            "the served object must be the walk-free commit candidate, not the withheld blob"
+        );
+        assert!(
+            !body.contains("TOP SECRET"),
+            "the withheld blob must not leak"
+        );
+    }
+
+    /// The periodic cleanup task must sweep the ipfs walk limiter, not only its
+    /// five siblings. Drives `AppState::sweep_rate_limiters` — the exact method the
+    /// 300s loop calls — and asserts the ipfs limiter's expired entry is evicted.
+    /// Dropping `ipfs_rate_limiter.cleanup()` from that method leaves the entry in
+    /// place (`tracked_keys` stays 1): the RED proof that the sweep covers it.
+    #[sqlx::test]
+    async fn sweep_rate_limiters_includes_ipfs_limiter(pool: PgPool) {
+        let mut state = test_state(pool).await;
+        // Short window so a single recorded hit is already expired at sweep time.
+        state.ipfs_rate_limiter = crate::rate_limit::RateLimiter::new(5, Duration::from_millis(50));
+
+        assert!(
+            state.ipfs_rate_limiter.check("1.2.3.4").await,
+            "record a hit on the ipfs limiter"
+        );
+        assert_eq!(
+            state.ipfs_rate_limiter.tracked_keys().await,
+            1,
+            "the source-IP key is tracked before the sweep"
+        );
+
+        // Expire the entry (still mapped — cleanup hasn't run), then sweep.
+        tokio::time::sleep(Duration::from_millis(60)).await;
+        state.sweep_rate_limiters().await;
+
+        assert_eq!(
+            state.ipfs_rate_limiter.tracked_keys().await,
+            0,
+            "the periodic sweep must evict the ipfs limiter's expired entries"
+        );
+    }
+
     // ---------------------------------------------------------------------------
     // Issue #120 — repo-scoped read surfaces visibility gate
     // ---------------------------------------------------------------------------
Original file line number	Diff line number	Diff line change
`@@ -130,6 +130,13 @@ impl RateLimiter {`
`130`	`130`	`!w.timestamps.is_empty()`
`131`	`131`	`});`
`132`	`132`	`}`
	`133`	`+`
	`134`	`+ /// Number of distinct keys currently tracked. Test-only introspection so a`
	`135`	`+ /// cross-module test can assert that a sweep actually evicted expired entries.`
	`136`	`+ #[cfg(test)]`
	`137`	`+ pub(crate) async fn tracked_keys(&self) -> usize {`
	`138`	`+ self.state.lock().await.len()`
	`139`	`+ }`
`133`	`140`	`}`
`134`	`141`
`135`	`142`	`pub async fn rate_limit_by_did(request: Request, next: Next) -> Response {`