@@ -717,6 +717,7 @@ mod tests {
             .layer(Extension(IpRateLimiter {
                 limiter: RateLimiter::new(60, Duration::from_secs(3600)),
                 trust: TrustedProxy::None,
+                skip_reads: false,
             }))
             .with_state(state);
         let mut req =
@@ -765,6 +766,7 @@ mod tests {
             .layer(Extension(IpRateLimiter {
                 limiter: RateLimiter::new(1, Duration::from_secs(3600)),
                 trust: TrustedProxy::None,
+                skip_reads: false,
             }))
             .with_state(state);
         let peer = "203.0.113.5:5000".parse::<SocketAddr>().unwrap();
 
@@ -4,7 +4,7 @@ use std::sync::Arc;
 use std::time::{Duration, Instant};
 
 use axum::extract::{ConnectInfo, Request};
-use axum::http::{HeaderMap, StatusCode};
+use axum::http::{HeaderMap, Method, StatusCode};
 use axum::middleware::Next;
 use axum::response::{IntoResponse, Response};
 use axum::Json;
@@ -361,6 +361,18 @@ pub fn client_key(
 pub struct IpRateLimiter {
     pub limiter: RateLimiter,
     pub trust: TrustedProxy,
+    /// Exempt GET/HEAD from this bucket. The signed-write brake classifies
+    /// whole routers, but `write_routes` chains PUT/DELETE/GET on one path
+    /// (`/api/v1/repos/{owner}/{repo}/visibility`, `server.rs`), and `gl
+    /// visibility list` deliberately signs that owner-only GET — so without
+    /// this the read spends the write quota and a normal listing 429s after a
+    /// few writes from the same IP (one NAT egress makes the coupling vivid).
+    /// The method check is the same general form `consume_signature` uses for
+    /// its ledger skip: a read has no write side effect for the brake to
+    /// protect. Leave this `false` on any limiter whose job IS braking reads —
+    /// the `/ipfs/{cid}` brake exists precisely to cap GET-driven history
+    /// walks, so a blanket skip inside `rate_limit_by_ip` would delete it.
+    pub skip_reads: bool,
 }
 
 /// Infallible extractor for the socket peer address from `ConnectInfo`. Yields
@@ -418,10 +430,16 @@ pub async fn rate_limit_by_ip(request: Request, next: Next) -> Response {
         .map(|c| c.0);
 
     if let Some(limiter) = limiter {
-        if let Some(key) = client_key(request.headers(), peer, limiter.trust) {
-            if !limiter.limiter.check(&key).await {
-                tracing::warn!(key = %key, path = %request.uri().path(), "per-IP rate limit exceeded");
-                return too_many_requests();
+        // Opt-in read exemption (see `IpRateLimiter::skip_reads`): only a
+        // limiter that declares itself write-only skips GET/HEAD, so the /ipfs
+        // read brake and every other read-facing bucket keep braking reads.
+        let is_read = matches!(*request.method(), Method::GET | Method::HEAD);
+        if !(limiter.skip_reads && is_read) {
+            if let Some(key) = client_key(request.headers(), peer, limiter.trust) {
+                if !limiter.limiter.check(&key).await {
+                    tracing::warn!(key = %key, path = %request.uri().path(), "per-IP rate limit exceeded");
+                    return too_many_requests();
+                }
             }
         }
     }
@@ -757,6 +775,7 @@ mod tests {
         let router = ip_limited_router(IpRateLimiter {
             limiter: RateLimiter::new(2, Duration::from_secs(60)),
             trust: TrustedProxy::None,
+            skip_reads: false,
         });
         let peer: SocketAddr = "203.0.113.7:5000".parse().unwrap();
         // Two requests inside the budget, the third over it (shared Arc state).
@@ -773,6 +792,7 @@ mod tests {
         let router = ip_limited_router(IpRateLimiter {
             limiter: RateLimiter::new(1, Duration::from_secs(60)),
             trust: TrustedProxy::None,
+            skip_reads: false,
         });
         let a: SocketAddr = "203.0.113.1:1".parse().unwrap();
         let b: SocketAddr = "203.0.113.2:1".parse().unwrap();
@@ -781,6 +801,70 @@ mod tests {
         assert_eq!(post_from(&router, a).await, StatusCode::TOO_MANY_REQUESTS);
     }
 
+    /// `skip_reads` mechanics, isolated from the production router: on a
+    /// limiter that declares itself write-only, GET and HEAD never touch the
+    /// bucket — they pass an already-exhausted one AND never debit it — while
+    /// a mutation from the same peer stays braked. On a limiter that does not
+    /// opt in (the /ipfs read brake), GET is braked exactly as before. The
+    /// production wiring (the signed-write brake on `write_routes`, whose one
+    /// GET is the signed visibility listing) is proven end-to-end by
+    /// `signed_write_brake_rejects_writes_but_serves_visibility_get` in
+    /// `test_support`; this pins the middleware seam it rides on.
+    #[tokio::test]
+    async fn skip_reads_exempts_get_and_head_but_still_brakes_writes() {
+        use tower::ServiceExt;
+        let router = |skip_reads: bool| {
+            axum::Router::new()
+                .route(
+                    "/thing",
+                    axum::routing::get(|| async { StatusCode::OK })
+                        .head(|| async { StatusCode::OK })
+                        .put(|| async { StatusCode::OK }),
+                )
+                .layer(axum::middleware::from_fn(rate_limit_by_ip))
+                .layer(axum::Extension(IpRateLimiter {
+                    limiter: RateLimiter::new(1, Duration::from_secs(60)),
+                    trust: TrustedProxy::None,
+                    skip_reads,
+                }))
+        };
+        let peer: SocketAddr = "203.0.113.9:5000".parse().unwrap();
+        let send = |router: &axum::Router, method: axum::http::Method| {
+            let mut req = axum::http::Request::builder()
+                .method(method)
+                .uri("/thing")
+                .body(axum::body::Body::empty())
+                .unwrap();
+            req.extensions_mut().insert(ConnectInfo(peer));
+            let router = router.clone();
+            async move { router.oneshot(req).await.unwrap().status() }
+        };
+
+        // Opted-in limiter: the PUT spends the single slot...
+        let r = router(true);
+        assert_eq!(send(&r, axum::http::Method::PUT).await, StatusCode::OK);
+        // ...reads from the same peer still pass the exhausted bucket...
+        assert_eq!(send(&r, axum::http::Method::GET).await, StatusCode::OK);
+        assert_eq!(send(&r, axum::http::Method::HEAD).await, StatusCode::OK);
+        // ...and did not debit it behind the scenes some other way — the next
+        // mutation is still the one that gets braked.
+        assert_eq!(
+            send(&r, axum::http::Method::PUT).await,
+            StatusCode::TOO_MANY_REQUESTS,
+            "the write brake must keep braking writes while exempting reads"
+        );
+
+        // Non-opted-in limiter: GET is braked like any other method, so the
+        // exemption cannot silently spread to read-braking buckets like /ipfs.
+        let r = router(false);
+        assert_eq!(send(&r, axum::http::Method::GET).await, StatusCode::OK);
+        assert_eq!(
+            send(&r, axum::http::Method::GET).await,
+            StatusCode::TOO_MANY_REQUESTS,
+            "a limiter that did not opt in must keep braking reads"
+        );
+    }
+
     // ── creation-route layering: IP brake runs BEFORE auth ──────────────
 
     /// A minimal stand-in for the creation route group: an inner "auth" layer
@@ -826,6 +910,7 @@ mod tests {
         let router = ip_limited_over_auth_router(IpRateLimiter {
             limiter: RateLimiter::new(1, Duration::from_secs(60)),
             trust: TrustedProxy::None,
+            skip_reads: false,
         });
         let peer: SocketAddr = "203.0.113.42:7000".parse().unwrap();
 
 
@@ -98,9 +98,15 @@ pub fn build_router(state: AppState) -> Router {
     // quotas. Each group layers it OUTSIDE `add_auth_layers` (axum runs the last
     // `.layer` first) so an over-limit request is rejected before signature
     // verification burns CPU and before the ledger is charged.
+    // `skip_reads`: `write_routes` chains PUT/DELETE/GET on the visibility
+    // path, and `gl visibility list` signs that owner-only GET. A write-only
+    // brake must not let reads spend the write quota (or a listing starts
+    // 429ing behind a shared NAT after a handful of writes), mirroring the
+    // method skip `consume_signature` applies to the ledger for the same GET.
     let signed_write_ip_limiter = rate_limit::IpRateLimiter {
         limiter: state.signed_write_rate_limiter.clone(),
         trust: state.push_limiter_trust,
+        skip_reads: true,
     };
 
     // ── Task routes (write — require HTTP Signature) ───────────────────────
@@ -132,6 +138,7 @@ pub fn build_router(state: AppState) -> Router {
     let create_ip_limiter = rate_limit::IpRateLimiter {
         limiter: state.create_ip_rate_limiter.clone(),
         trust: state.push_limiter_trust,
+        skip_reads: false,
     };
     let creation_routes = add_auth_layers(
         Router::new()
@@ -236,6 +243,7 @@ pub fn build_router(state: AppState) -> Router {
     let push_limiter = rate_limit::IpRateLimiter {
         limiter: state.push_rate_limiter.clone(),
         trust: state.push_limiter_trust,
+        skip_reads: false,
     };
     let git_write_routes = add_auth_layers(
         Router::new()
@@ -263,6 +271,7 @@ pub fn build_router(state: AppState) -> Router {
     let ipfs_limiter = rate_limit::IpRateLimiter {
         limiter: state.ipfs_rate_limiter.clone(),
         trust: state.push_limiter_trust,
+        skip_reads: false,
     };
     let ipfs_routes = Router::new()
         .route("/ipfs/{cid}", get(ipfs::get_by_cid))
@@ -363,6 +372,7 @@ pub fn build_router(state: AppState) -> Router {
     .layer(axum::Extension(rate_limit::IpRateLimiter {
         limiter: state.sync_trigger_rate_limiter.clone(),
         trust: state.push_limiter_trust,
+        skip_reads: false,
     }));
 
     // announce + notify keep their rolling-upgrade signature behavior (unsigned
@@ -383,6 +393,7 @@ pub fn build_router(state: AppState) -> Router {
         .layer(axum::Extension(rate_limit::IpRateLimiter {
             limiter: state.peer_write_rate_limiter.clone(),
             trust: state.push_limiter_trust,
+            skip_reads: false,
         }));
 
     // ── Read routes — open for public repos ───────────────────────────────
 
@@ -1987,6 +1987,111 @@ mod tests {
         );
     }
 
+    /// The signed-write IP brake is write-only. `write_routes` chains
+    /// PUT/DELETE/GET on the visibility path, and `gl visibility list` signs
+    /// that owner-only GET, so a brake that counted methods it does not exist
+    /// for would let ordinary reads spend the write quota — behind one NAT
+    /// egress, a few writes would start 429ing every listing. Through the
+    /// PRODUCTION router with a single-slot bucket: the first write spends the
+    /// quota, a second write (and a DELETE) is 429, and the authenticated
+    /// visibility GET from the SAME exhausted IP is still served. MUTATION
+    /// (RED): set `skip_reads: false` on `signed_write_ip_limiter` in
+    /// `server.rs` (or drop the method check in `rate_limit_by_ip`) and the
+    /// final GET comes back 429.
+    #[sqlx::test]
+    async fn signed_write_brake_rejects_writes_but_serves_visibility_get(pool: PgPool) {
+        use gitlawb_core::http_sig::sign_request;
+
+        let kp = Keypair::generate();
+        let owner_did = kp.did().to_string();
+        // Short owner form in the URL path, as in the real-signature test above:
+        // no colons, so the signed @path matches path_and_query() byte-for-byte.
+        let short = owner_did.split(':').next_back().unwrap().to_string();
+
+        let mut state = test_state(pool).await;
+        // Single-slot bucket: the FIRST successful write exhausts it.
+        state.signed_write_rate_limiter =
+            crate::rate_limit::RateLimiter::new(1, Duration::from_secs(3600));
+        state.push_limiter_trust = crate::rate_limit::TrustedProxy::None;
+        let repo = seed_repo(&owner_did, "brake-repo");
+        state.db.create_repo(&repo).await.expect("seed repo");
+        let router = crate::server::build_router(state);
+
+        let peer: std::net::SocketAddr = "203.0.113.61:5000".parse().unwrap();
+        let path = format!("/api/v1/repos/{short}/brake-repo/visibility");
+        let put_body: &[u8] = br#"{"path_glob":"/","reader_dids":[]}"#;
+        // Each request is freshly signed — the brake is outermost, but a reused
+        // signature would trip the replay ledger and muddy which gate answered.
+        let signed_req = |method: &str, body: &'static [u8]| {
+            let signed = sign_request(&kp, method, &path, body);
+            let mut req = Request::builder()
+                .method(method)
+                .uri(&path)
+                .header(axum::http::header::CONTENT_TYPE, "application/json")
+                .header("content-digest", signed.content_digest)
+                .header("signature-input", signed.signature_input)
+                .header("signature", signed.signature)
+                .body(Body::from(body))
+                .unwrap();
+            req.extensions_mut()
+                .insert(axum::extract::ConnectInfo(peer));
+            req
+        };
+
+        // First write passes the brake, reaches the handler, and succeeds —
+        // debiting the single-slot bucket.
+        let resp = router
+            .clone()
+            .oneshot(signed_req("PUT", put_body))
+            .await
+            .unwrap();
+        assert!(
+            resp.status().is_success(),
+            "the first signed write from an IP must pass the brake, got {}",
+            resp.status()
+        );
+
+        // Second write from the same IP: braked with 429 before auth runs.
+        let resp = router
+            .clone()
+            .oneshot(signed_req("PUT", put_body))
+            .await
+            .unwrap();
+        assert_eq!(
+            resp.status(),
+            StatusCode::TOO_MANY_REQUESTS,
+            "an exhausted signed-write bucket must reject a PUT"
+        );
+        // A DELETE is a mutation too and shares the exhausted bucket.
+        let resp = router
+            .clone()
+            .oneshot(signed_req("DELETE", put_body))
+            .await
+            .unwrap();
+        assert_eq!(
+            resp.status(),
+            StatusCode::TOO_MANY_REQUESTS,
+            "an exhausted signed-write bucket must reject a DELETE"
+        );
+
+        // The signed visibility GET from the SAME IP bypasses the write brake
+        // and is fully served: 200 with the rule the first PUT created — the
+        // read did not merely dodge a 429, it reached the handler as the owner.
+        let resp = router.oneshot(signed_req("GET", b"")).await.unwrap();
+        assert_eq!(
+            resp.status(),
+            StatusCode::OK,
+            "the authenticated visibility GET must be served despite the exhausted write bucket"
+        );
+        let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
+            .await
+            .unwrap();
+        assert!(
+            String::from_utf8_lossy(&bytes).contains("path_glob"),
+            "the owner sees the visibility rules through the exhausted-bucket IP"
+        );
+    }
+
     /// A signed request body reused by the request-target trio below. Non-empty so
     /// the content-digest the signature covers is a real hash rather than the
     /// empty-body constant, which keeps `@path` the only component under test.